sync app filled in

apps/server/internal/docs/service.go

@@ -190,7 +190,17 @@ func (s *Service) SaveSourcePageWithBaseHash(ctx context.Context, requestPath st
 
 	record, _, err := s.resolveRecord(ctx, requestPath)
 	if err != nil {
-		return nil, err
+		if !errors.Is(err, sql.ErrNoRows) {
+			return nil, err
+		}
+		if baseHash != "" {
+			return nil, err
+		}
+		path, pathErr := normalizeWritableDocumentPath(requestPath)
+		if pathErr != nil {
+			return nil, pathErr
+		}
+		record = &DocumentRecord{Path: path}
 	}
 
 	if baseHash != "" && record.CurrentHash != baseHash {
@@ -270,6 +280,21 @@ func normalizeRequestPathCandidates(path string) []string {
 	return []string{path}
 }
 
+func normalizeWritableDocumentPath(path string) (string, error) {
+	path = strings.Trim(path, "/")
+	if path == "" {
+		return "", fmt.Errorf("document path is required")
+	}
+	path = filepath.ToSlash(filepath.Clean(filepath.FromSlash(path)))
+	if path == "." || strings.HasPrefix(path, "../") || path == ".." || filepath.IsAbs(path) {
+		return "", fmt.Errorf("invalid document path")
+	}
+	if !strings.HasSuffix(strings.ToLower(path), ".md") {
+		path += ".md"
+	}
+	return path, nil
+}
+
 func (s *Service) syncFile(ctx context.Context, path string) (*DocumentChange, error) {
 	content, err := os.ReadFile(path)
 	if err != nil {