@openparachute/vault 0.4.8 → 0.4.9-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.4.8",
+  "version": "0.4.9-rc.2",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/auto-transcribe.test.ts

@@ -69,11 +69,16 @@ describe("shouldAutoTranscribe", () => {
     })).toBe(false);
   });
 
-  test("skips when enabled is unset (no auto_transcribe block in config)", () => {
+  test("fires when enabled is unset — unset config means ON", () => {
+    // Default behavior (no `auto_transcribe` block in config) is opt-out:
+    // once an operator has scribe reachable, audio attachments transcribe
+    // automatically. Operators wanting it OFF set
+    // `auto_transcribe.enabled: false` explicitly. Previously default-off;
+    // flipped to default-on so installing scribe is the only opt-in signal.
     expect(shouldAutoTranscribe("audio/wav", {
       readGlobalConfigImpl: readGlobalConfig(undefined),
       getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
+    })).toBe(true);
   });
 
   test("skips when scribe URL is undefined (no services.json entry, no env)", () => {

package/src/auto-transcribe.ts

@@ -19,7 +19,11 @@ import { getCachedScribeUrl } from "./scribe-discovery.ts";
  *
  * Returns `true` only when ALL three conditions hold:
  *   1. mime-type starts with `audio/` (case-insensitive).
- *   2. `globalConfig.auto_transcribe?.enabled === true`.
+ *   2. `globalConfig.auto_transcribe?.enabled` is not explicitly false.
+ *      Default behavior (when unset) is ON — once an operator has scribe
+ *      reachable, audio attachments transcribe automatically without a
+ *      separate config step. Operators who want it OFF set
+ *      `auto_transcribe.enabled: false` explicitly.
  *   3. Scribe is discoverable (services.json entry OR SCRIBE_URL env).
  *
  * The three conditions are independent guards: a single `false` is sufficient
@@ -40,7 +44,7 @@ export function shouldAutoTranscribe(
   }
   const enabled = opts.enabledOverride
     ?? (opts.readGlobalConfigImpl ?? readGlobalConfig)().auto_transcribe?.enabled
-    ?? false;
+    ?? true;
   if (!enabled) return false;
   const url = (opts.getCachedScribeUrlImpl ?? getCachedScribeUrl)();
   if (!url || !url.trim()) return false;

package/src/module-config.ts

@@ -19,8 +19,11 @@
  *   - port:                 GlobalConfig.port, exposed read-only.
  *   - autoTranscribe.*:     vault↔scribe handoff (vault#353, design 2026-05-21
  *                           Part 2). Three nested fields per design Q4:
- *       - enabled:          boolean toggle, default false (persisted in
- *                           GlobalConfig.auto_transcribe.enabled).
+ *       - enabled:          boolean toggle, default true when scribe is
+ *                           reachable (persisted in
+ *                           GlobalConfig.auto_transcribe.enabled). Default
+ *                           flipped from off → on so installing scribe is
+ *                           the only opt-in signal needed.
  *       - scribeUrl:        readOnly — resolved per-process from
  *                           `~/.parachute/services.json` via
  *                           `scribe-discovery.ts`. Operators can't point at an
@@ -69,10 +72,10 @@ export function buildConfigSchema(): ModuleConfigSchema {
         properties: {
           enabled: {
             type: "boolean",
-            default: false,
+            default: true,
             title: "Enable auto-transcription",
             description:
-              "Master toggle. When false, audio uploads land normally without any scribe interaction. Global — persisted in `GlobalConfig.auto_transcribe.enabled` and applies to every vault on this server. Per-vault control is a future enhancement when multi-vault deployments need it.",
+              "Master toggle. Default on — audio uploads transcribe automatically when scribe is reachable. Set to false to disable. Global — persisted in `GlobalConfig.auto_transcribe.enabled` and applies to every vault on this server. Per-vault control is a future enhancement when multi-vault deployments need it.",
           },
           scribeUrl: {
             type: "string",
@@ -139,7 +142,10 @@ export function buildConfigValues(
   return {
     audio_retention: vaultConfig.audio_retention ?? "keep",
     autoTranscribe: {
-      enabled: globalConfig.auto_transcribe?.enabled ?? false,
+      // Match shouldAutoTranscribe's `?? true` so the admin SPA displays
+      // the same value runtime uses. An unset config row shows `true`
+      // because that's what vault will actually do on the next audio upload.
+      enabled: globalConfig.auto_transcribe?.enabled ?? true,
       scribeUrl,
     },
     // Legacy alias mirrors `autoTranscribe.scribeUrl` so hubs reading the

package/src/routing.test.ts

@@ -17,7 +17,7 @@
  * never touch ~/.parachute.
  */
 
-import { describe, test, expect, beforeEach, afterEach, afterAll } from "bun:test";
+import { describe, test, expect, beforeAll, beforeEach, afterEach, afterAll } from "bun:test";
 import { rmSync, existsSync, mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
@@ -606,6 +606,24 @@ describe("MCP 401 WWW-Authenticate challenge (RFC 9728)", () => {
 
 const HUB_ORIGIN = "http://127.0.0.1:1939";
 
+// Process-env isolation: sibling test files (tokens-routes.test.ts,
+// auth-hub-jwt.test.ts) set PARACHUTE_HUB_ORIGIN in their own beforeAll
+// hooks. Bun's test runner shares a single process across test files,
+// and when file-ordering puts those before this one, their hook-set
+// value can still be live when our tests run. Restore the default
+// (unset) here so we test against `DEFAULT_HUB_LOOPBACK`. Caught when
+// vault rc.1 release CI failed with "Received: http://127.0.0.1:34295"
+// — a leaked ephemeral port from another test's fixture.
+let _prevHubOriginRouting: string | undefined;
+beforeAll(() => {
+  _prevHubOriginRouting = process.env.PARACHUTE_HUB_ORIGIN;
+  delete process.env.PARACHUTE_HUB_ORIGIN;
+});
+afterAll(() => {
+  if (_prevHubOriginRouting === undefined) delete process.env.PARACHUTE_HUB_ORIGIN;
+  else process.env.PARACHUTE_HUB_ORIGIN = _prevHubOriginRouting;
+});
+
 describe("per-vault OAuth discovery (hub-rooted after workstream E)", () => {
   test("AS metadata names the hub as issuer + endpoints", async () => {
     createVault("journal");