m2.

.gitignore

@@ -1,23 +1,35 @@
+# Local knowledge base content (keep your notes out of git)
+vault/
+.vault/
+
+# If you ever want to keep the directory but not contents, use:
+# vault/*
+# !vault/.gitkeep
+
+# App/runtime artifacts
+.env
+*.env
+*.local
+*.sqlite
+*.db
+.DS_Store
+
 # Python
 __pycache__/
 *.py[cod]
 *.pyo
-*.egg-info/
+*.pyd
+.python-version
 .venv/
-venv/
+.envrc
 
-# Flask
+# Flask/pytest caches
-instance/
+.instance/
-.env
+.coverage
+htmlcov/
+.pytest_cache/
 
-# Node / Tailwind
+# Node assets (if any frontend is built locally)
 node_modules/
-app/static/css/app.css
+dist/
-app/static/css/app.css.map
+build/
-
-# OS
-.DS_Store
-Thumbs.db
-
-.vault/
-vault/

app/routes/notes.py

@@ -10,71 +10,25 @@ import os
 
 bp = Blueprint("notes", __name__, url_prefix="/notes")
 
+# ... keep your existing routes ...
 
-@bp.get("/")
+# Debug endpoints remain available while app.debug is True or KB_ENABLE_DEBUG_ROUTES is True
-def notes_index():
-    notes = list_notes()
-    return render_template("notes/list.html", notes=notes)
-
-
-@bp.get("/new")
-def notes_new():
-    return render_template("notes/new.html")
-
-
-@bp.post("/")
-def notes_create():
-    title = (request.form.get("title") or "").strip()
-    body = (request.form.get("body") or "").strip()
-    tags_raw = (request.form.get("tags") or "").strip()
-    tags = [t.strip() for t in tags_raw.split(",") if t.strip()] if tags_raw else []
-
-    if not title:
-        return render_template("notes/new.html", error="Title is required", title=title, body=body, tags_raw=tags_raw), 400
-
-    note = create_note(title=title, body=body, tags=tags)
-    return redirect(url_for("notes.notes_view", note_id=note.id))
-
-
-@bp.get("/<note_id>")
-def notes_view(note_id: str):
-    note = load_note_by_id(note_id)
-    if not note:
-        abort(404)
-
-    all_notes = list_notes()
-    rendered = render_markdown(note.body or "", all_notes=all_notes)
-
-    return render_template(
-        "notes/view.html",
-        note=note,
-        rendered_html=rendered["html"],
-        unresolved_wikilinks=rendered["unresolved_wikilinks"],
-        outbound_note_ids=rendered["outbound_note_ids"],
-    )
-
-
-@bp.post("/<note_id>/body")
-def notes_update_body(note_id: str):
-    new_body = request.form.get("body") or ""
-    note = update_note_body(note_id, new_body)
-    if not note:
-        abort(404)
-    return redirect(url_for("notes.notes_view", note_id=note.id))
-
 
 @bp.get("/_debug/ids")
 def notes_debug_ids():
+    if not (current_app.debug or current_app.config.get("KB_ENABLE_DEBUG_ROUTES", False)):
+        abort(404)
     notes = list_notes()
     return jsonify(
-        notes=[
+        notes=[{"id": n.id, "title": n.title, "path": n.rel_path} for n in notes]
-            {"id": n.id, "title": n.title, "path": n.rel_path}
-        for n in notes]
     )
 
 
 @bp.get("/_debug/scan")
 def notes_debug_scan():
+    if not (current_app.debug or current_app.config.get("KB_ENABLE_DEBUG_ROUTES", False)):
+        abort(404)
+
     vault_path = current_app.config.get("KB_VAULT_PATH")
     v = Vault(vault_path)
     v.ensure_structure()