@openparachute/vault 0.2.4 → 0.3.0

package/src/config-triggers.test.ts

@@ -80,4 +80,53 @@ describe("trigger config round-trip", () => {
     const config = readGlobalConfig();
     expect(config.triggers).toBeUndefined();
   });
+
+  it("roundtrips triggers with action.include_context", () => {
+    mkdirSync(testDir, { recursive: true });
+    writeGlobalConfig({
+      port: 1940,
+      triggers: [
+        {
+          name: "transcribe-with-people",
+          when: { tags: ["capture"], has_content: false },
+          action: {
+            webhook: "http://localhost:1943/v1/audio/transcriptions",
+            send: "attachment",
+            include_context: [
+              { tag: "person", include_metadata: ["summary", "aliases"] },
+              { tag: "project", exclude_tag: "archived", include_metadata: ["summary"] },
+            ],
+          },
+        },
+      ],
+    });
+
+    const config = readGlobalConfig();
+    const ctx = config.triggers![0].action.include_context!;
+    expect(ctx.length).toBe(2);
+    expect(ctx[0]).toEqual({ tag: "person", include_metadata: ["summary", "aliases"] });
+    expect(ctx[1]).toEqual({
+      tag: "project",
+      exclude_tag: "archived",
+      include_metadata: ["summary"],
+    });
+  });
+
+  it("skips include_context serialization when empty", () => {
+    mkdirSync(testDir, { recursive: true });
+    writeGlobalConfig({
+      port: 1940,
+      triggers: [
+        {
+          name: "plain",
+          when: { tags: ["t"] },
+          action: { webhook: "http://x/y" },
+        },
+      ],
+    });
+    const raw = readFileSync(join(testDir, "vault", "config.yaml"), "utf8");
+    expect(raw).not.toContain("include_context");
+    const config = readGlobalConfig();
+    expect(config.triggers![0].action.include_context).toBeUndefined();
+  });
 });

package/src/config.test.ts

@@ -125,6 +125,47 @@ describe("config", () => {
     expect(loaded!.tag_schemas).toBeUndefined();
   });
 
+  test("round-trips vault config transcription.context", () => {
+    const config: VaultConfig = {
+      name: "testvault",
+      api_keys: [],
+      created_at: "2026-01-01T00:00:00.000Z",
+      transcription: {
+        context: [
+          { tag: "person", include_metadata: ["summary", "aliases"] },
+          { tag: "project", exclude_tag: "archived", include_metadata: ["summary"] },
+        ],
+      },
+    };
+
+    writeVaultConfig(config);
+
+    const loaded = readVaultConfig("testvault");
+    expect(loaded).not.toBeNull();
+    expect(loaded!.transcription?.context).toBeDefined();
+    expect(loaded!.transcription!.context!.length).toBe(2);
+    expect(loaded!.transcription!.context![0]).toEqual({
+      tag: "person",
+      include_metadata: ["summary", "aliases"],
+    });
+    expect(loaded!.transcription!.context![1]).toEqual({
+      tag: "project",
+      exclude_tag: "archived",
+      include_metadata: ["summary"],
+    });
+  });
+
+  test("vault config without transcription.context loads cleanly", () => {
+    const config: VaultConfig = {
+      name: "testvault",
+      api_keys: [],
+      created_at: "2026-01-01T00:00:00.000Z",
+    };
+    writeVaultConfig(config);
+    const loaded = readVaultConfig("testvault");
+    expect(loaded!.transcription).toBeUndefined();
+  });
+
   test("round-trips discovery: enabled|disabled", () => {
     // Default: absent means enabled (endpoint serves names).
     writeGlobalConfig({ port: 1940 });
@@ -201,7 +242,9 @@ describe2("backup config round-trip", () => {
       process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
       const fs = await import("fs");
       const path = await import("path");
-      fs.writeFileSync(path.join(${JSON.stringify(dir)}, "config.yaml"),
+      const vaultHome = path.join(${JSON.stringify(dir)}, "vault");
+      fs.mkdirSync(vaultHome, { recursive: true });
+      fs.writeFileSync(path.join(vaultHome, "config.yaml"),
         "port: 1940\\nbackup:\\n  schedule: daily\\n  destinations: []\\n");
       const { readGlobalConfig } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
       console.log(JSON.stringify(readGlobalConfig().backup));
@@ -221,7 +264,9 @@ describe2("backup config round-trip", () => {
       process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
       const fs = await import("fs");
       const path = await import("path");
-      fs.writeFileSync(path.join(${JSON.stringify(dir)}, "config.yaml"),
+      const vaultHome = path.join(${JSON.stringify(dir)}, "vault");
+      fs.mkdirSync(vaultHome, { recursive: true });
+      fs.writeFileSync(path.join(vaultHome, "config.yaml"),
         "port: 1940\\nbackup:\\n  schedule: daily\\n  retention:\\n    daily: 3\\n  destinations: []\\n");
       const { readGlobalConfig } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
       console.log(JSON.stringify(readGlobalConfig().backup));
@@ -296,3 +341,273 @@ describe2("backup config round-trip", () => {
     expect2(parsed.destinations).toEqual([]);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Legacy layout migration — pre-0.3 installs put vault files at the
+// ecosystem root; on startup we move them into vault/.
+// ---------------------------------------------------------------------------
+
+describe2("migrateFromLegacyLayout", () => {
+  let dir: string;
+  beforeEach(() => { dir = mkdtempSync(join(tmpdir(), "parachute-migrate-")); });
+  afterEach(() => { rmSync(dir, { recursive: true, force: true }); });
+
+  test2("fresh install with no legacy files is a no-op and creates data/ + logs/", async () => {
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      const vaultHome = path.join(${JSON.stringify(dir)}, "vault");
+      console.log(JSON.stringify({
+        vaultHomeExists: fs.existsSync(vaultHome),
+        dataExists: fs.existsSync(path.join(vaultHome, "data")),
+        logsExists: fs.existsSync(path.join(vaultHome, "logs")),
+        legacyVaultsDirExists: fs.existsSync(path.join(vaultHome, "vaults")),
+        rootEnvExists: fs.existsSync(path.join(${JSON.stringify(dir)}, ".env")),
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    expect2(parsed.vaultHomeExists).toBe(true);
+    expect2(parsed.dataExists).toBe(true);
+    expect2(parsed.logsExists).toBe(true);
+    expect2(parsed.legacyVaultsDirExists).toBe(false);
+    expect2(parsed.rootEnvExists).toBe(false);
+  });
+
+  test2("moves legacy root files into vault/ (vaults → data/, logs → logs/)", async () => {
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const root = ${JSON.stringify(dir)};
+      fs.mkdirSync(root, { recursive: true });
+      fs.writeFileSync(path.join(root, ".env"), "PORT=1940\\n");
+      fs.writeFileSync(path.join(root, "config.yaml"), "port: 1940\\n");
+      fs.writeFileSync(path.join(root, "vault.log"), "log\\n");
+      fs.writeFileSync(path.join(root, "vault.err"), "err\\n");
+      fs.writeFileSync(path.join(root, "start.sh"), "#!/bin/bash\\n");
+      fs.writeFileSync(path.join(root, "server-path"), "/repo/src/server.ts\\n");
+      fs.mkdirSync(path.join(root, "vaults", "default"), { recursive: true });
+      fs.writeFileSync(path.join(root, "vaults", "default", "vault.yaml"), "name: default\\napi_keys: []\\n");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      const vaultHome = path.join(root, "vault");
+      console.log(JSON.stringify({
+        env: fs.readFileSync(path.join(vaultHome, ".env"), "utf-8"),
+        config: fs.readFileSync(path.join(vaultHome, "config.yaml"), "utf-8"),
+        start: fs.readFileSync(path.join(vaultHome, "start.sh"), "utf-8"),
+        serverPath: fs.readFileSync(path.join(vaultHome, "server-path"), "utf-8"),
+        vaultYaml: fs.readFileSync(path.join(vaultHome, "data", "default", "vault.yaml"), "utf-8"),
+        log: fs.readFileSync(path.join(vaultHome, "logs", "vault.log"), "utf-8"),
+        err: fs.readFileSync(path.join(vaultHome, "logs", "vault.err"), "utf-8"),
+        legacyEnv: fs.existsSync(path.join(root, ".env")),
+        legacyVaults: fs.existsSync(path.join(root, "vaults")),
+        legacyVaultLog: fs.existsSync(path.join(root, "vault.log")),
+        legacyVaultErr: fs.existsSync(path.join(root, "vault.err")),
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    expect2(parsed.env).toContain("PORT=1940");
+    expect2(parsed.config).toContain("port: 1940");
+    expect2(parsed.start).toContain("#!/bin/bash");
+    expect2(parsed.serverPath).toContain("/repo/src/server.ts");
+    expect2(parsed.vaultYaml).toContain("name: default");
+    expect2(parsed.log).toContain("log");
+    expect2(parsed.err).toContain("err");
+    // Legacy paths should be gone after the move.
+    expect2(parsed.legacyEnv).toBe(false);
+    expect2(parsed.legacyVaults).toBe(false);
+    expect2(parsed.legacyVaultLog).toBe(false);
+    expect2(parsed.legacyVaultErr).toBe(false);
+  });
+
+  test2("double-migration is idempotent", async () => {
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const root = ${JSON.stringify(dir)};
+      fs.writeFileSync(path.join(root, ".env"), "PORT=1940\\n");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      // Second call: no legacy paths left, nothing to do.
+      ensureConfigDirSync();
+      console.log(JSON.stringify({
+        envInVault: fs.readFileSync(path.join(root, "vault", ".env"), "utf-8"),
+        rootEnv: fs.existsSync(path.join(root, ".env")),
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    expect2(parsed.envInVault).toContain("PORT=1940");
+    expect2(parsed.rootEnv).toBe(false);
+  });
+
+  test2("0.3 install: vault/vaults/ → vault/data/, vault/{vault.log,vault.err} → vault/logs/", async () => {
+    // Users who installed on 0.3 (post-PR-8 but pre-filesystem-hygiene)
+    // have vault state under `vault/` with the old internal names.
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const vaultHome = path.join(${JSON.stringify(dir)}, "vault");
+      fs.mkdirSync(path.join(vaultHome, "vaults", "work"), { recursive: true });
+      fs.writeFileSync(path.join(vaultHome, "vaults", "work", "vault.yaml"), "name: work\\napi_keys: []\\n");
+      fs.writeFileSync(path.join(vaultHome, "vault.log"), "daemon-stdout\\n");
+      fs.writeFileSync(path.join(vaultHome, "vault.err"), "daemon-stderr\\n");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      console.log(JSON.stringify({
+        vaultYaml: fs.readFileSync(path.join(vaultHome, "data", "work", "vault.yaml"), "utf-8"),
+        log: fs.readFileSync(path.join(vaultHome, "logs", "vault.log"), "utf-8"),
+        err: fs.readFileSync(path.join(vaultHome, "logs", "vault.err"), "utf-8"),
+        legacyVaultsDir: fs.existsSync(path.join(vaultHome, "vaults")),
+        legacyLog: fs.existsSync(path.join(vaultHome, "vault.log")),
+        legacyErr: fs.existsSync(path.join(vaultHome, "vault.err")),
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    expect2(parsed.vaultYaml).toContain("name: work");
+    expect2(parsed.log).toContain("daemon-stdout");
+    expect2(parsed.err).toContain("daemon-stderr");
+    expect2(parsed.legacyVaultsDir).toBe(false);
+    expect2(parsed.legacyLog).toBe(false);
+    expect2(parsed.legacyErr).toBe(false);
+  });
+
+  test2("0.3 internal migration: both vault/vaults/ and vault/data/ exist — data/ wins, vaults/ preserved", async () => {
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const vaultHome = path.join(${JSON.stringify(dir)}, "vault");
+      // Both layouts present with distinct marker content — migration
+      // must NOT overwrite data/ (user may have manually staged it).
+      fs.mkdirSync(path.join(vaultHome, "vaults"), { recursive: true });
+      fs.writeFileSync(path.join(vaultHome, "vaults", "MARKER_LEGACY"), "legacy\\n");
+      fs.mkdirSync(path.join(vaultHome, "data"), { recursive: true });
+      fs.writeFileSync(path.join(vaultHome, "data", "MARKER_CURRENT"), "current\\n");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      console.log(JSON.stringify({
+        dataMarker: fs.existsSync(path.join(vaultHome, "data", "MARKER_CURRENT")),
+        legacyMarker: fs.existsSync(path.join(vaultHome, "vaults", "MARKER_LEGACY")),
+        dataOverwrittenByLegacy: fs.existsSync(path.join(vaultHome, "data", "MARKER_LEGACY")),
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    expect2(parsed.dataMarker).toBe(true); // data/ untouched
+    expect2(parsed.legacyMarker).toBe(true); // vaults/ untouched, for user to inspect
+    expect2(parsed.dataOverwrittenByLegacy).toBe(false);
+    // Warning surfaces on stderr so the user sees it.
+    expect2(stderr).toContain("both");
+    expect2(stderr).toContain("vaults");
+    expect2(stderr).toContain("data");
+  });
+
+  test2("0.3 internal migration: idempotent — second boot is a no-op", async () => {
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const vaultHome = path.join(${JSON.stringify(dir)}, "vault");
+      fs.mkdirSync(path.join(vaultHome, "vaults", "journal"), { recursive: true });
+      fs.writeFileSync(path.join(vaultHome, "vaults", "journal", "vault.yaml"), "name: journal\\n");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      ensureConfigDirSync(); // second boot — no-op.
+      console.log(JSON.stringify({
+        vaultYaml: fs.readFileSync(path.join(vaultHome, "data", "journal", "vault.yaml"), "utf-8"),
+        legacyVaultsDir: fs.existsSync(path.join(vaultHome, "vaults")),
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    expect2(parsed.vaultYaml).toContain("name: journal");
+    expect2(parsed.legacyVaultsDir).toBe(false);
+  });
+
+  test2("leaves legacy in place when target already exists (no overwrite)", async () => {
+    const script = `
+      process.env.PARACHUTE_HOME = ${JSON.stringify(dir)};
+      const fs = await import("fs");
+      const path = await import("path");
+      const root = ${JSON.stringify(dir)};
+      const vaultHome = path.join(root, "vault");
+      fs.mkdirSync(vaultHome, { recursive: true });
+      fs.writeFileSync(path.join(root, ".env"), "LEGACY\\n");
+      fs.writeFileSync(path.join(vaultHome, ".env"), "CURRENT\\n");
+      const { ensureConfigDirSync } = await import(${JSON.stringify(join(import.meta.dir, "config.ts"))});
+      ensureConfigDirSync();
+      console.log(JSON.stringify({
+        vaultEnv: fs.readFileSync(path.join(vaultHome, ".env"), "utf-8"),
+        legacyEnv: fs.existsSync(path.join(root, ".env"))
+          ? fs.readFileSync(path.join(root, ".env"), "utf-8")
+          : null,
+      }));
+    `;
+    const proc = Bun.spawnSync({ cmd: ["bun", "-e", script], stdout: "pipe", stderr: "pipe" });
+    const stderr = new TextDecoder().decode(proc.stderr);
+    expect2(proc.exitCode, stderr).toBe(0);
+    const parsed = JSON.parse(new TextDecoder().decode(proc.stdout).trim());
+    // Target wins; legacy file is left alone for the user to investigate.
+    expect2(parsed.vaultEnv).toBe("CURRENT\n");
+    expect2(parsed.legacyEnv).toBe("LEGACY\n");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// formatMigrationFailure: the warn-line the migration catches emit. EXDEV
+// (cross-device rename) is hard to simulate in a test — PARACHUTE_HOME
+// straddling a mount is the real trigger — but we can at least verify the
+// helper attaches the "mount boundary" hint when the error code matches,
+// so users debugging a Docker/multi-disk layout get a meaningful message
+// instead of "failed to migrate X → Y: EXDEV: cross-device link not permitted".
+// ---------------------------------------------------------------------------
+
+import { formatMigrationFailure } from "./config.ts";
+
+describe("formatMigrationFailure", () => {
+  test("EXDEV errors get a mount-boundary hint and note legacy fallback", () => {
+    const err = Object.assign(new Error("EXDEV: cross-device link not permitted"), {
+      code: "EXDEV",
+    });
+    const msg = formatMigrationFailure("/src/path", "/dst/path", err);
+    expect(msg).toContain("mount boundary");
+    expect(msg).toContain("EXDEV");
+    expect(msg).toContain("legacy layout");
+    expect(msg).toContain("/src/path");
+    expect(msg).toContain("/dst/path");
+  });
+
+  test("non-EXDEV errors fall back to the raw message", () => {
+    const err = Object.assign(new Error("EACCES: permission denied"), { code: "EACCES" });
+    const msg = formatMigrationFailure("/src/path", "/dst/path", err);
+    expect(msg).toContain("EACCES: permission denied");
+    expect(msg).not.toContain("mount boundary");
+  });
+
+  test("non-Error values are stringified safely", () => {
+    const msg = formatMigrationFailure("/src", "/dst", "weird string");
+    expect(msg).toContain("weird string");
+    expect(msg).not.toContain("mount boundary");
+  });
+});