@openparachute/vault 0.7.0-rc.3 → 0.7.0-rc.5

package/src/mcp-tools.ts

@@ -22,8 +22,15 @@ import {
   expandTokenTagScope,
   filterHydratedLinksByTagScope,
   noteWithinTagScope,
+  scrubIndexedFieldConflictError,
+  scrubParentCycleError,
+  scrubReferencingTagsByScope,
+  scrubTagFieldViolationsByScope,
   tagsWithinScope,
 } from "./tag-scope.ts";
+import { TagFieldConflictError, ParentCycleError } from "../core/src/tag-schemas.ts";
+import { IndexedFieldError } from "../core/src/indexed-fields.ts";
+import { runDoctorScan } from "../core/src/doctor.ts";
 import {
   findTokensReferencingTag,
   recordMcpMintLedger,
@@ -215,11 +222,12 @@ export function generateScopedMcpTools(
 }
 
 /**
- * Tag-delete and (future) tag-merge always check for tag-scoped tokens
- * referencing the doomed tag — regardless of whether the *deleter* is
- * itself tag-scoped. A successful delete that orphans an allowlist would
+ * Tag-delete and tag-merge always check for tag-scoped tokens referencing
+ * the doomed tag(s) — regardless of whether the CALLER is itself
+ * tag-scoped. A successful delete/merge that orphans an allowlist would
  * silently widen surface area downstream. Mirrors the REST 409
- * `tag_in_use_by_tokens` envelope.
+ * `tag_in_use_by_tokens` envelope (routes.ts's DELETE /tags/:name and
+ * POST /tags/merge run the identical check).
  */
 function applyTagDependencyGuards(tools: McpToolDef[], vaultName: string): void {
   const store = getVaultStore(vaultName);
@@ -239,6 +247,29 @@ function applyTagDependencyGuards(tools: McpToolDef[], vaultName: string): void
     }
     return await orig(params);
   });
+  // vault#552: merging consumes every source tag (same identity-drop as
+  // delete), so a source referenced by a tag-scoped token would orphan that
+  // token's allowlist exactly like a bare delete would. Aggregate matches
+  // across all sources into one 409-equivalent envelope, same shape REST's
+  // POST /tags/merge returns.
+  wrapReadTool(tools, "merge-tags", async (orig, params) => {
+    const sources = Array.isArray((params as any).sources) ? ((params as any).sources as unknown[]) : [];
+    const referenced: { source: string; tokens: { id: string; label: string }[] }[] = [];
+    for (const src of sources) {
+      if (typeof src !== "string") continue;
+      const tokens = findTokensReferencingTag(store.db, src);
+      if (tokens.length > 0) referenced.push({ source: src, tokens });
+    }
+    if (referenced.length > 0) {
+      return {
+        error: "TagInUseByTokens",
+        error_type: "tag_in_use_by_tokens",
+        message: `Cannot merge: ${referenced.length} source tag(s) referenced by tag-scoped token(s); revoke or re-mint them first.`,
+        referenced_by: referenced,
+      };
+    }
+    return await orig(params);
+  });
 }
 
 /**
@@ -344,7 +375,7 @@ function applyTagScopeWrappers(
     if (result && typeof result === "object" && "id" in result && "tags" in result) {
       return noteWithinTagScope(result as any, allowed, rawTags)
         ? scrubNoteLinks(result)
-        : { error: "Note not found", id: (result as any).id };
+        : { error: "Note not found", error_type: "not_found", id: (result as any).id };
     }
     return result;
   });
@@ -470,7 +501,7 @@ function applyTagScopeWrappers(
       if (!id) continue;
       const existing = await store.getNote(id as string);
       if (!existing || !noteWithinTagScope(existing, allowed, rawTags)) {
-        return { error: "Note not found", id };
+        return { error: "Note not found", error_type: "not_found", id };
       }
       const removed = new Set<string>((item as any).tags?.remove ?? []);
       const projected = new Set<string>((existing.tags ?? []).filter((t) => !removed.has(t)));
@@ -489,7 +520,7 @@ function applyTagScopeWrappers(
     if (id) {
       const existing = await store.getNote(id as string);
       if (!existing || !noteWithinTagScope(existing, allowed, rawTags)) {
-        return { error: "Note not found", id };
+        return { error: "Note not found", error_type: "not_found", id };
       }
     }
     return await orig(params);
@@ -502,7 +533,45 @@ function applyTagScopeWrappers(
     if (typeof tag === "string" && !allowed.has(tag)) {
       return forbidden(`update-tag: tag "${tag}" is outside the token's allowlist`);
     }
-    return await orig(params);
+    try {
+      return await orig(params);
+    } catch (err: any) {
+      // Tag-scope scrub for cross-tag field conflicts (vault#554
+      // auth-and-scope fold). Core's validation scans EVERY tag's schema
+      // (scope-unaware by architecture), so its TagFieldConflictError can
+      // name an OUT-OF-SCOPE tag and reveal its declared type/flag in both
+      // the violation entries and the error message. The write stays
+      // rejected — schema integrity is scope-independent — but re-throw
+      // with scrubbed violations (out-of-scope declarers generalized, no
+      // tag name / declared type, `other_tag` dropped; in-scope declarers
+      // keep full detail). Rebuilding via the constructor also rebuilds
+      // the top-level message from the scrubbed entries. Same pattern as
+      // the list-tags `did_you_mean` scrub above.
+      if (err && err.code === "TAG_FIELD_CONFLICT" && Array.isArray(err.violations)) {
+        throw new TagFieldConflictError(
+          err.tag ?? (tag as string),
+          scrubTagFieldViolationsByScope(err.violations, allowed),
+        );
+      }
+      // Same leak through the OTHER door (wire-review interaction): a
+      // both-indexed cross-tag type conflict deliberately bypasses the
+      // pre-check (preserving its declareField → invalid_indexed_field
+      // contract), and declareField's IndexedFieldError message names the
+      // other declarer tag(s). Generalize for scoped callers; solo
+      // own-field IndexedFieldErrors (no declarer_tags) pass untouched.
+      if (err instanceof IndexedFieldError) {
+        throw scrubIndexedFieldConflictError(err, allowed);
+      }
+      // parent_names cycle guard (vault#552) — the hierarchy `upsertTagRecord`
+      // validates against is vault-wide (scope-unaware by architecture), so
+      // the cycle path can name an out-of-scope tag. Same "write stays
+      // rejected, path gets generalized" posture as the field-conflict scrub
+      // above.
+      if (err instanceof ParentCycleError) {
+        throw scrubParentCycleError(err, allowed);
+      }
+      throw err;
+    }
   });
 
   wrapReadTool(tools, "delete-tag", async (orig, params) => {
@@ -512,9 +581,59 @@ function applyTagScopeWrappers(
     if (typeof tag === "string" && !allowed.has(tag)) {
       return forbidden(`delete-tag: tag "${tag}" is outside the token's allowlist`);
     }
+    const result = await orig(params);
+    // Referential-integrity refusal (vault#552) — scrub out-of-scope
+    // referencing tag names before returning. The delete stays refused
+    // either way; only the response's tag-name visibility changes.
+    if (result && typeof result === "object" && (result as any).error_type === "tag_referenced_as_parent") {
+      return {
+        ...(result as Record<string, unknown>),
+        referencing_tags: scrubReferencingTagsByScope((result as any).referencing_tags ?? [], allowed),
+      };
+    }
+    return result;
+  });
+
+  // rename-tag / merge-tags (vault#552 — MCP parity with the pre-existing
+  // REST engine). Same tag-scope posture as update-tag/delete-tag: every
+  // tag NAMED in the request (source(s) + target, or old/new name) must be
+  // inside the caller's allowlist — a rename/merge that pulls a tag out of
+  // scope (or in) is a privilege-boundary move, refuse the whole op before
+  // it reaches core.
+  wrapReadTool(tools, "rename-tag", async (orig, params) => {
+    const allowed = await getAllowed();
+    if (!allowed) return await orig(params);
+    const oldName = (params as any).old_name ?? (params as any).from ?? (params as any).tag;
+    const newName = (params as any).new_name ?? (params as any).to;
+    for (const t of [oldName, newName]) {
+      if (typeof t === "string" && !allowed.has(t)) {
+        return forbidden(`rename-tag: tag "${t}" is outside the token's allowlist`);
+      }
+    }
+    return await orig(params);
+  });
+
+  wrapReadTool(tools, "merge-tags", async (orig, params) => {
+    const allowed = await getAllowed();
+    if (!allowed) return await orig(params);
+    const sources = Array.isArray((params as any).sources) ? ((params as any).sources as unknown[]) : [];
+    const target = (params as any).target;
+    for (const t of [...sources, target]) {
+      if (typeof t === "string" && !allowed.has(t)) {
+        return forbidden(`merge-tags: tag "${t}" is outside the token's allowlist`);
+      }
+    }
     return await orig(params);
   });
 
+  // doctor (vault#552) — the scan itself is re-run with the caller's
+  // expanded allowlist rather than post-filtering the unscoped result, so
+  // aggregate counts (findings summary) never reflect out-of-scope data.
+  wrapReadTool(tools, "doctor", async (orig, params) => {
+    const allowed = await getAllowed();
+    if (!allowed) return await orig(params);
+    return runDoctorScan(store.db, { allowedTags: allowed });
+  });
 }
 
 function wrapReadTool(
@@ -542,6 +661,16 @@ function overrideVaultInfo(
   if (!vaultInfo) return;
 
   vaultInfo.execute = async (params) => {
+    // NOTE (vault#554): these two throws are deliberately left as plain,
+    // unstructured `Error`s — NOT given `error_type` — even though the rest
+    // of this file's sweep attaches one everywhere else. Attaching one here
+    // routes the throw through mcp-http.ts's structured-error mapping, which
+    // surfaces it as a JSON-RPC protocol-level error (`response.error`)
+    // instead of the in-band tool result the existing contract test asserts
+    // (`response.result.isError === true`, `response.result.content[0].text`
+    // containing the scope name) — see "tools/call of vault-info with
+    // description arg and vault:read scope is refused" in src/vault.test.ts.
+    // Changing that transport shape is out of scope for this wave.
     const config = readVaultConfig(vaultName);
     if (!config) throw new Error(`Vault "${vaultName}" not found`);
 

package/src/mirror-import.ts

@@ -518,6 +518,11 @@ function importResultFromStats(
       `Orphaned sidecar ${ss.sidecar_id} (path=${ss.expected_path ?? "—"}): ${ss.reason}`,
     );
   }
+  for (const sp of stats.skipped_schema_parents) {
+    warnings.push(
+      `Dropped parent_names on tag "${sp.tag}": ${sp.reason}`,
+    );
+  }
   const result: ImportResult = {
     notes_imported: stats.notes_created + stats.notes_updated,
     tags_imported: stats.schemas_restored,