refactor(areas): make the area table user-configurable

The area table was the author's own project list, hardcoded four times over —
NOTION_AREAS, AREA_TO_FILE, MORGEN_AREAS, and a hand-maintained SAFE_PATH_RE —
plus the same names in the shipped n8n workflow templates, the sample sync
state, the docs, and the tests. This repo is public, so that published a client
roster, and the table was wrong for every user but one.

Areas now come from TASKMAXXING_AREAS via the new src/areas.js. The four
structures are derived from one config, so they cannot drift apart, and the
path-traversal allowlist is generated from the configured paths rather than
hand-kept alongside them. Optional `pathPrefix` and `aliasFiles` cover nested
task folders and query-only parent hubs, which were previously special-cased in
parseArea by name.

Defaults are the two non-identifying areas, URGENT and GENERAL. Degradation is
deliberate: an unset, malformed, GENERAL-less, duplicate-keyed, or traversal-
bearing config is rejected whole and the defaults apply, with a stderr warning
naming the failed check. Everything then files under GENERAL — a half-applied
table would route tasks into the wrong project, which is worse.

Also fixed in passing: an operator-precedence bug in the urgent co-tag guard
(&& binds tighter than ||), and a crash on the no-config path where the
built-in defaults were spread without an aliasFiles key.

New scripts/test-areas-config.js covers the degradation paths and asserts regex
metacharacters in configured paths are escaped rather than interpreted. Wired
into `npm test`. 61 tests pass across the three suites.

BREAKING: set TASKMAXXING_AREAS to keep per-project routing. Documented under
"Configuring your areas" in the README.

Author: fidgetcoding

CHANGELOG.md

@@ -14,7 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - README: tagline + workflow table + project tree updated 3-way → 2-way. A top-of-README NOTE banner explains the cutover.
 
 ### Why
-- Kit author's own instance (`obsidian-tasks-sync`) dropped Notion on the same date after the Notion bearer in W1+W3 was found to be silently 401-ing on every orchestrator tick. Morgen and Obsidian had become the only legs that mattered. The full investigation is in the kit author's vault under `05-Projects/LAVA-NET/invoices/2026-05-04-morgen-task-creation-and-sync-diagnosis.md` and the cutover memory at `project_notion_drop_2026_05_04.md`.
+- Kit author's own instance (`the author's own private sync repo`) dropped Notion on the same date after the Notion bearer in W1+W3 was found to be silently 401-ing on every orchestrator tick. Morgen and Obsidian had become the only legs that mattered. The full investigation is in the kit author's vault under `05-Projects/PROJECT-D/invoices/2026-05-04-morgen-task-creation-and-sync-diagnosis.md` and the cutover memory at `project_notion_drop_2026_05_04.md`.
 
 ### Added
 - README: social-links badge strip (X · LinkedIn · YouTube · Instagram, ruvnet-style for-the-badge) inserted into the centered header block beneath the project license badge.

README.md

@@ -99,7 +99,7 @@ Bidirectional. Edit anywhere; it converges everywhere. Two sub-workflows, one or
                                     │
                        ┌────────────▼───────────┐
                        │  GitHub                │
-                       │  obsidian-tasks-sync   │
+                       │  the author's own private sync repo   │
                        └─▲────────────────────┬─┘
                          │                    │
                 W2 commits│                    │ W1 reads
@@ -251,6 +251,49 @@ task-maxxing/
 
 ---
 
+## Configuring your areas
+
+An "area" is one task file plus the Morgen tag and Notion label it maps to. The
+area table is **yours** — this repo ships only two generic areas (`URGENT`,
+`GENERAL`) and reads the rest from the `TASKMAXXING_AREAS` env var, a JSON array:
+
+```json
+[
+  { "key": "URGENT",  "file": "TASKS-URGENT.md",
+    "morgenLabel": "Urgent",  "notionLabel": "01 URGENT" },
+  { "key": "GENERAL", "file": "TASKS-GENERAL.md",
+    "morgenLabel": "General", "notionLabel": "02 GENERAL" },
+  { "key": "PROJECT-A", "file": "TASKS-PROJECT-A.md",
+    "morgenLabel": "Project-A", "notionLabel": "03 PROJECT-A" },
+  { "key": "NESTED", "file": "NESTED/content/TASKS-NESTED-content.md",
+    "morgenLabel": "Nested", "notionLabel": "04 NESTED",
+    "pathPrefix": "NESTED/content/",
+    "aliasFiles": ["NESTED/TASKS-NESTED.md"] }
+]
+```
+
+| Field | Required | Meaning |
+|---|---|---|
+| `key` | yes | Internal area key, uppercase. Also matched as `TASKS-<key>.md`. |
+| `file` | yes | Path relative to your tasks directory. |
+| `morgenLabel` | yes | Morgen tag label — no number prefix, the chips read better without one. |
+| `notionLabel` | yes | Notion select label — keep the number prefix, it drives sort order. |
+| `pathPrefix` | no | Any path under this prefix maps to this area. |
+| `aliasFiles` | no | Extra paths that resolve here and are safe to write, e.g. a query-only parent hub. |
+
+A `GENERAL` entry is required — it is the fallback for any path the table does
+not recognise.
+
+**Degradation is deliberate.** If the variable is unset, malformed, missing
+`GENERAL`, or contains a duplicate key or a traversal path, the whole config is
+rejected and the built-in defaults apply, with a warning on stderr saying which
+check failed. Everything then files under `GENERAL`. A half-applied area table
+would route tasks into the *wrong* project, which is worse than routing them all
+to one place.
+
+The write allowlist that guards against path traversal is generated from this
+table, so it can't drift out of step with it.
+
 ## Status
 
 **Alpha.** Running in production on my vault since early 2026, but it's had exactly one user. Looking for testers who:

docs/ARCHITECTURE.md

@@ -398,7 +398,7 @@ Two identifiers do different jobs:
 
 Hash format: SHA-256 of the canonical fields, `::`-joined, truncated to 24 hex chars. 96 bits of collision resistance is fine for any single-user task backlog and short enough to eyeball in logs.
 
-Why include `sourceFile` in the hash? So that the same text in `TASKS-URGENT.md` and `TASKS-LORECRAFT.md` counts as two distinct tasks. Why exclude line number? So you can re-order tasks within a file without churning state.
+Why include `sourceFile` in the hash? So that the same text in `TASKS-URGENT.md` and `TASKS-PROJECT-A.md` counts as two distinct tasks. Why exclude line number? So you can re-order tasks within a file without churning state.
 
 ---
 

docs/DESIGN-RATIONALE.md

@@ -129,8 +129,8 @@ the response isn't paginated. `git log -S "ship the kit"
 05-Tasks/TASKS-URGENT.md` answers six months of "when did this task
 appear?" questions in one shell command.
 
-**Bulk edits are trivial.** Renaming a project from `LORECRAFT-HQ` to
-`LORECRAFT`? `sed -i` across the task files, commit, push, sync
+**Bulk edits are trivial.** Renaming a project from `PROJECT-A-HQ` to
+`PROJECT-A`? `sed -i` across the task files, commit, push, sync
 catches up. Doing the same against a SaaS API means writing a
 backfill script, dealing with pagination, and praying the rate limit
 holds. Text files are the cheapest schema-migration platform on
@@ -190,7 +190,7 @@ Three properties fall out for free:
   Obsidian doesn't surface anyway.
 - **Same text in two files = two tasks.** `sourceFile` is part of the
   hash input. Moving "ship the kit" from `TASKS-URGENT.md` to
-  `TASKS-LORECRAFT.md` reads as `archive + create`, which routes the
+  `TASKS-PROJECT-A.md` reads as `archive + create`, which routes the
   task into the right Morgen tag without any special-case logic.
 
 Completion state is **not** in the hash. Marking `- [ ]` → `- [x]`
@@ -237,7 +237,7 @@ matches `m-[0-9a-f]{8}` exactly. UUIDv4s embedded in 🆔 tokens (which
 predate this scheme) silently fail to parse — they're not picked up
 by W1, which means tasks created with them sit stranded in Obsidian
 without ever reaching Morgen. That failure mode bit hard once
-(LAVA-NET, May 2026, six invoice tasks stranded for hours) and is
+(PROJECT-D, May 2026, six invoice tasks stranded for hours) and is
 the reason `/maketasks` enforces the format.
 
 **What you'd give up to switch.** A client-minted UUIDv4 scheme would
@@ -500,7 +500,7 @@ W2 could surface pinned slots back into a markdown comment, but
 the storage shape ("pinned-at" emoji?) isn't decided.
 
 **Multi-area task moves.** Moving a task from `TASKS-URGENT.md` to
-`TASKS-LORECRAFT.md` reads as `archive + create` because
+`TASKS-PROJECT-A.md` reads as `archive + create` because
 `sourceFile` is in the hash. The new Morgen task gets a new ID;
 the user-visible `m-XXXXXXXX` token in the markdown line changes
 on rewrite. That's fine for now but means a task's history is
@@ -516,7 +516,7 @@ PagerDuty). Once the kit's user base picks a default, it'll get
 shipped as a fourth workflow.
 
 **Tag-scheme migration.** During the Notion era we ran two parallel
-Morgen tag schemes (`Lava-Network` bare-label vs `09 LAVA-NETWORK`
+Morgen tag schemes (`Project-D` bare-label vs `09 PROJECT-D`
 Notion-prefixed). The post-cutover state still uses the prefixed
 form because W2's `notionLabelToAreaKey` routes by it; switching
 to bare labels is a one-shot migration we haven't run. New forks

docs/TROUBLESHOOTING.md

@@ -191,7 +191,7 @@ W1's only join key from markdown → Morgen is the `🆔 m-XXXXXXXX` token. If a
 
 ```bash
 cd "$VAULT_PATH/05-Tasks"
-git log -1 --pretty=format:"%s%n%b" -- TASKS-*.md FIDGETCODING/**/TASKS-*.md
+git log -1 --pretty=format:"%s%n%b" -- TASKS-*.md NESTED/**/TASKS-*.md
 ```
 
 Look at the commit subject. If it starts with **any `[bot:*]` prefix**, that's the problem — W1's echo guard skipped the run.
@@ -306,7 +306,7 @@ W1 only mints new IDs when a task line **lacks** the `🆔` token. The mint is t
 
 ### 10. Task lands in TASKS-GENERAL
 
-> You created a task that should have gone into a project area file (`TASKS-LORECRAFT.md`, `TASKS-WAGMI.md`, etc.) but it landed in `TASKS-GENERAL.md`.
+> You created a task that should have gone into a project area file (`TASKS-PROJECT-A.md`, `TASKS-PROJECT-G.md`, etc.) but it landed in `TASKS-GENERAL.md`.
 
 **Diagnose**
 

examples/sample-sync-state.json

@@ -3,7 +3,7 @@
   "_tagCache": {
     "01 URGENT": "11111111-1111-1111-1111-111111111111",
     "02 GENERAL": "22222222-2222-2222-2222-222222222222",
-    "03 LORECRAFT": "33333333-3333-3333-3333-333333333333"
+    "03 PROJECT-A": "33333333-3333-3333-3333-333333333333"
   },
   "entries": {
     "a1b2c3d4e5f67890abcdef01": {
@@ -44,11 +44,11 @@
     },
     "c3d4e5f67890abcdef010203": {
       "hash": "c3d4e5f67890abcdef010203",
-      "sourceFile": "TASKS-LORECRAFT.md",
+      "sourceFile": "TASKS-PROJECT-A.md",
       "lineNo": 9,
       "lineHash": "deadbeef12345678",
       "text": "Update the README with the new install flow",
-      "area": "LORECRAFT",
+      "area": "PROJECT-A",
       "priority": 5,
       "due": "2026-04-18",
       "scheduled": "2026-04-16",

package.json

@@ -10,12 +10,13 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node scripts/sync-e2e-tests.js",
+    "test": "node scripts/test-areas-config.js && node scripts/test-helpers.js && node scripts/sync-e2e-tests.js",
     "test:helpers": "node scripts/test-helpers.js",
     "validate:state": "node scripts/validate-sync-state.js",
     "validate:workflows": "node scripts/validate-workflows.js",
     "install:workflows": "./scripts/install-workflows.sh",
     "backfill:morgen": "node scripts/morgen-backfill.js",
-    "lint": "echo 'No linter configured yet'"
+    "lint": "echo 'No linter configured yet'",
+    "test:areas": "node scripts/test-areas-config.js"
   }
 }

scripts/sync-e2e-tests.js

@@ -25,6 +25,7 @@
 
 'use strict';
 
+require('./test-areas.js'); // must precede sync-helpers
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const path = require('node:path');
@@ -420,7 +421,7 @@ function simulateW3({ vaultDir, stateFile, notion, commit }) {
       // New row from Notion → append to source file
       // row.area is a Notion select label; convert to internal key to pick the right file
       const areaKey = notionLabelToAreaKey(row.area) === 'GENERAL' && row.area !== '02 GENERAL'
-        ? row.area // fall back to raw for tests using the flat form "LORECRAFT"
+        ? row.area // fall back to raw for tests using the flat form "PROJECT-A"
         : notionLabelToAreaKey(row.area);
       // Also tolerate tests that pass the raw internal key as `area`
       const keyGuess = Object.prototype.hasOwnProperty.call(helpers._constants.NOTION_AREAS, row.area)
@@ -670,11 +671,11 @@ async function testB_MorgenCompletionW2() {
 async function testC_NotionCreationW3() {
   const vault = makeTmpVault();
   try {
-    const sourceFile = 'TASKS-LORECRAFT.md';
+    const sourceFile = 'TASKS-PROJECT-A.md';
     writeTaskFile(
       vault,
       sourceFile,
-      ['# TASKS — LORECRAFT', '', '## Open', '', ''].join('\n')
+      ['# TASKS — PROJECT-A', '', '## Open', '', ''].join('\n')
     );
     const stateFile = path.join(vault, '.sync-state.json');
     saveStateFile(stateFile, loadSyncState(null));
@@ -684,7 +685,7 @@ async function testC_NotionCreationW3() {
         {
           pageId: 'notion-page-new-1',
           title: 'research Lava token model',
-          area: 'LORECRAFT', // W3 tolerates raw internal key when flat file exists
+          area: 'PROJECT-A', // W3 tolerates raw internal key when flat file exists
           priority: '⏫ High',
           status: 'Not Started',
           editedAtTs: Date.now(),
@@ -1014,7 +1015,7 @@ async function testJ_IsSafePath() {
     'TASKS-../x.md',
     '05-Tasks/../../etc/passwd',
     'TASKS-HACKED.md',               // not in allowlist
-    'FIDGETCODING/evil/TASKS-x.md',  // wrong subfolder
+    'NESTED/evil/TASKS-x.md',  // wrong subfolder
     '../TASKS-URGENT.md',
     '',
     null,
@@ -1027,20 +1028,20 @@ async function testJ_IsSafePath() {
   const accepts = [
     'TASKS-URGENT.md',
     'TASKS-GENERAL.md',
-    'TASKS-LORECRAFT.md',
-    'TASKS-BLOOM.md',
-    'TASKS-CART-BLANCHE.md',
-    'TASKS-LAVA-NETWORK.md',
-    'TASKS-MMA.md',
-    'TASKS-PARZVL.md',
-    'TASKS-WAGMI.md',
-    'FIDGETCODING/content/TASKS-FIDGETCODING-content.md',
-    'FIDGETCODING/misc-building/TASKS-FIDGETCODING-misc-building.md',
-    'FIDGETCODING/TASKS-FIDGETCODING.md',
+    'TASKS-PROJECT-A.md',
+    'TASKS-PROJECT-B.md',
+    'TASKS-PROJECT-C.md',
+    'TASKS-PROJECT-D.md',
+    'TASKS-PROJECT-E.md',
+    'TASKS-PROJECT-F.md',
+    'TASKS-PROJECT-G.md',
+    'NESTED/content/TASKS-NESTED-content.md',
+    'NESTED/misc-building/TASKS-NESTED-misc-building.md',
+    'NESTED/TASKS-NESTED.md',
     'FUTURE-SCHEDULING/TASKS-FUTURE-SCHEDULING.md',
     // with 05-Tasks/ prefix also OK
     '05-Tasks/TASKS-URGENT.md',
-    '05-Tasks/FIDGETCODING/content/TASKS-FIDGETCODING-content.md',
+    '05-Tasks/NESTED/content/TASKS-NESTED-content.md',
   ];
   for (const p of accepts) {
     assert.equal(isSafePath(p), true, `should accept: ${JSON.stringify(p)}`);
@@ -1051,34 +1052,34 @@ async function testK_ParseAreaRoundTrip() {
   const cases = [
     ['TASKS-URGENT.md', 'URGENT', '01 URGENT'],
     ['TASKS-GENERAL.md', 'GENERAL', '02 GENERAL'],
-    ['TASKS-LORECRAFT.md', 'LORECRAFT', '03 LORECRAFT'],
-    ['TASKS-BLOOM.md', 'BLOOM', '04 BLOOM'],
-    ['TASKS-CART-BLANCHE.md', 'CART-BLANCHE', '05 CART-BLANCHE'],
+    ['TASKS-PROJECT-A.md', 'PROJECT-A', '03 PROJECT-A'],
+    ['TASKS-PROJECT-B.md', 'PROJECT-B', '04 PROJECT-B'],
+    ['TASKS-PROJECT-C.md', 'PROJECT-C', '05 PROJECT-C'],
     [
-      'FIDGETCODING/content/TASKS-FIDGETCODING-content.md',
-      'FIDGETCODING-CONTENT',
-      '06 FIDGETCODING · content',
+      'NESTED/content/TASKS-NESTED-content.md',
+      'NESTED-CONTENT',
+      '06 NESTED · content',
     ],
     [
-      'FIDGETCODING/misc-building/TASKS-FIDGETCODING-misc-building.md',
-      'FIDGETCODING-MISC-BUILDING',
-      '07 FIDGETCODING · misc-building',
+      'NESTED/misc-building/TASKS-NESTED-misc-building.md',
+      'NESTED-BUILD',
+      '07 NESTED · misc-building',
     ],
     [
       'FUTURE-SCHEDULING/TASKS-FUTURE-SCHEDULING.md',
       'FUTURE-SCHEDULING',
       '08 FUTURE-SCHEDULING',
     ],
-    ['TASKS-LAVA-NETWORK.md', 'LAVA-NETWORK', '09 LAVA-NETWORK'],
-    ['TASKS-MMA.md', 'MMA', '10 MMA'],
-    ['TASKS-PARZVL.md', 'PARZVL', '11 PARZVL'],
-    ['TASKS-WAGMI.md', 'WAGMI', '12 WAGMI'],
+    ['TASKS-PROJECT-D.md', 'PROJECT-D', '09 PROJECT-D'],
+    ['TASKS-PROJECT-E.md', 'PROJECT-E', '10 PROJECT-E'],
+    ['TASKS-PROJECT-F.md', 'PROJECT-F', '11 PROJECT-F'],
+    ['TASKS-PROJECT-G.md', 'PROJECT-G', '12 PROJECT-G'],
     // Also test with 05-Tasks/ prefix
     ['05-Tasks/TASKS-URGENT.md', 'URGENT', '01 URGENT'],
     [
-      '05-Tasks/FIDGETCODING/content/TASKS-FIDGETCODING-content.md',
-      'FIDGETCODING-CONTENT',
-      '06 FIDGETCODING · content',
+      '05-Tasks/NESTED/content/TASKS-NESTED-content.md',
+      'NESTED-CONTENT',
+      '06 NESTED · content',
     ],
   ];
   for (const [filePath, expectedKey, expectedLabel] of cases) {

scripts/test-areas-config.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/**
+ * test-areas-config.js
+ *
+ * Tests src/areas.js in isolation — the degradation paths in particular, since
+ * a crash or a silent mis-parse here misfiles every task in the sync.
+ * Runs in its own process so it can vary TASKMAXXING_AREAS freely.
+ */
+'use strict';
+const assert = require('node:assert/strict');
+const { getAreaConfig, _resetAreaConfig } = require('../src/areas.js');
+
+let pass = 0, fail = 0;
+function test(name, fn) {
+  try { fn(); console.log(`  [PASS] ${name}`); pass++; }
+  catch (e) { console.log(`  [FAIL] ${name}\n         ${e.message}`); fail++; }
+}
+function withEnv(value, fn) {
+  const prev = process.env.TASKMAXXING_AREAS;
+  if (value === undefined) delete process.env.TASKMAXXING_AREAS;
+  else process.env.TASKMAXXING_AREAS = value;
+  _resetAreaConfig();
+  try { fn(); } finally {
+    if (prev === undefined) delete process.env.TASKMAXXING_AREAS;
+    else process.env.TASKMAXXING_AREAS = prev;
+    _resetAreaConfig();
+  }
+}
+const keys = () => Object.keys(getAreaConfig().AREA_TO_FILE);
+
+console.log('\n  src/areas.js\n');
+
+test('unset env → built-in defaults, no crash', () => {
+  withEnv(undefined, () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('unset env → SAFE_PATH_RE still builds', () => {
+  withEnv(undefined, () => assert.equal(getAreaConfig().SAFE_PATH_RE.test('TASKS-URGENT.md'), true));
+});
+test('malformed JSON → defaults', () => {
+  withEnv('{bad', () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('not an array → defaults', () => {
+  withEnv('{"a":1}', () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('missing GENERAL → defaults', () => {
+  withEnv(JSON.stringify([{ key: 'X', file: 'TASKS-X.md', morgenLabel: 'X', notionLabel: '01 X' }]),
+    () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('duplicate key → defaults', () => {
+  withEnv(JSON.stringify([
+    { key: 'GENERAL', file: 'a.md', morgenLabel: 'G', notionLabel: '01 G' },
+    { key: 'GENERAL', file: 'b.md', morgenLabel: 'G2', notionLabel: '02 G2' },
+  ]), () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('traversal in file path → defaults', () => {
+  withEnv(JSON.stringify([
+    { key: 'GENERAL', file: '../../etc/passwd', morgenLabel: 'G', notionLabel: '01 G' },
+  ]), () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('traversal in aliasFiles → defaults', () => {
+  withEnv(JSON.stringify([
+    { key: 'GENERAL', file: 'TASKS-GENERAL.md', morgenLabel: 'G', notionLabel: '01 G',
+      aliasFiles: ['../../etc/passwd'] },
+  ]), () => assert.deepEqual(keys(), ['URGENT', 'GENERAL']));
+});
+test('valid config is applied', () => {
+  withEnv(JSON.stringify([
+    { key: 'GENERAL', file: 'TASKS-GENERAL.md', morgenLabel: 'General', notionLabel: '02 GENERAL' },
+    { key: 'PROJECT-A', file: 'TASKS-PROJECT-A.md', morgenLabel: 'Project-A', notionLabel: '03 PROJECT-A' },
+  ]), () => assert.deepEqual(keys(), ['GENERAL', 'PROJECT-A']));
+});
+test('regex metacharacters in a path are escaped, not interpreted', () => {
+  withEnv(JSON.stringify([
+    { key: 'GENERAL', file: 'TASKS-GENERAL.md', morgenLabel: 'G', notionLabel: '01 G' },
+    { key: 'DOT', file: 'TASKS-a.b.md', morgenLabel: 'Dot', notionLabel: '02 Dot' },
+  ]), () => {
+    const re = getAreaConfig().SAFE_PATH_RE;
+    assert.equal(re.test('TASKS-a.b.md'), true, 'literal path accepted');
+    assert.equal(re.test('TASKS-aXb.md'), false, 'dot must not act as a wildcard');
+  });
+});
+
+console.log(`\n  ${pass} passed · ${fail} failed\n`);
+process.exit(fail === 0 ? 0 : 1);