@openparachute/vault 0.7.0-rc.9 → 0.7.2-rc.3

package/src/routing.ts

@@ -828,20 +828,28 @@ export async function route(
 
   // /api/doctor — read-only taxonomy/metadata integrity scan (vault#552).
   // Same "dispatch before the generic read/write gate" shape as /triggers
-  // above, because this is ADMIN-tier regardless of method (GET-only, but
-  // admin — not read — since it's a whole-vault diagnostic, same tier as
-  // the MCP `doctor` tool and `prune-schema`).
+  // above — dispatched early because it's GET-only and doesn't otherwise
+  // fall under the generic verb→scope gate's method-based default.
+  //
+  // Tier: `read` (was `admin` — re-tiered to match the MCP `doctor` tool's
+  // own read/write/admin re-tier, vault#570-adjacent scope-completion pass:
+  // doctor never mutates and is ALREADY tag-scope-restricted via
+  // `doctorTagScope` below, so read-scoped monitoring/tending callers need
+  // to be able to run it without an admin credential over EITHER door. A
+  // `vault:read` token can now call `GET /api/doctor` (previously
+  // `Forbidden`) — matching MCP's `doctor` tool exactly, closing the
+  // REST/MCP divergence the scope re-tier PR left as a known gap.
   if (apiMatch[1] === "/doctor") {
     if (req.method !== "GET") {
       return Response.json({ error: "Method not allowed", error_type: "method_not_allowed" }, { status: 405 });
     }
-    if (!hasScopeForVault(auth.scopes, vaultName, "admin")) {
+    if (!hasScopeForVault(auth.scopes, vaultName, "read")) {
       return Response.json(
         {
           error: "Forbidden",
           error_type: "insufficient_scope",
-          message: `This endpoint requires the '${SCOPE_ADMIN}' scope (or '${SCOPE_ADMIN.replace("vault:", `vault:${vaultName}:`)}').`,
-          required_scope: SCOPE_ADMIN,
+          message: `This endpoint requires the '${SCOPE_READ}' scope (or '${SCOPE_READ.replace("vault:", `vault:${vaultName}:`)}').`,
+          required_scope: SCOPE_READ,
           granted_scopes: auth.scopes,
         },
         { status: 403 },
@@ -867,9 +875,30 @@ export async function route(
   const apiSubpath = apiMatch[1] ?? "";
   const isReadOnlyPost =
     req.method === "POST" && /^\/tags\/[^/]+\/conformance$/.test(apiSubpath);
-  const requiredVerb = isReadOnlyPost ? "read" : verbForMethod(req.method);
+  // Tag-schema/taxonomy mutation carve-out — mirrors the MCP-side
+  // update-tag/delete-tag/rename-tag/merge-tags re-tier (write → admin):
+  // these tools define a tag's SCHEMA or restructure the tag graph across
+  // every note carrying it — structure, not content — the same distinction
+  // that keeps `create-note`/`update-note`/`delete-note` at `write` while
+  // moving these to `admin`. Before this fix, the REST door only required
+  // `vault:write` here — a gap between doors (a `vault:write` token could
+  // rename/merge/delete/update a tag over REST while MCP already refused
+  // it). Matches PUT/DELETE `/tags/:name` (update-tag / delete-tag), POST
+  // `/tags/merge` (merge-tags), and POST `/tags/:name/rename` (rename-tag).
+  // Deliberately does NOT match `/tags/:name/conformance` (2 path segments,
+  // not 1 — see `isReadOnlyPost` above for that endpoint's own, lower tier)
+  // or plain GET `/tags[/:name]` (read, unaffected).
+  const isTagSchemaMutation =
+    ((req.method === "PUT" || req.method === "DELETE") && /^\/tags\/[^/]+$/.test(apiSubpath)) ||
+    (req.method === "POST" &&
+      (apiSubpath === "/tags/merge" || /^\/tags\/[^/]+\/rename$/.test(apiSubpath)));
+  const requiredVerb = isReadOnlyPost ? "read" : isTagSchemaMutation ? "admin" : verbForMethod(req.method);
   if (!hasScopeForVault(auth.scopes, vaultName, requiredVerb)) {
-    const requiredApiScope = isReadOnlyPost ? SCOPE_READ : scopeForMethod(req.method);
+    const requiredApiScope = isReadOnlyPost
+      ? SCOPE_READ
+      : isTagSchemaMutation
+        ? SCOPE_ADMIN
+        : scopeForMethod(req.method);
     return Response.json(
       {
         error: "Forbidden",
@@ -931,9 +960,16 @@ export async function route(
   if (apiPath.startsWith("/tags")) return handleTags(req, store, apiPath.slice(5), tagScope);
   if (apiPath === "/find-path") return handleFindPath(req, store, tagScope);
   if (apiPath === "/vault") {
-    return handleVault(req, store, vaultConfig, () => {
-      writeVaultConfig(vaultConfig);
-    });
+    return handleVault(
+      req,
+      store,
+      vaultConfig,
+      () => {
+        writeVaultConfig(vaultConfig);
+      },
+      undefined, // resolveCapability — keep the production default
+      tagScope,
+    );
   }
   if (apiPath === "/unresolved-wikilinks") return handleUnresolvedWikilinks(req, store, tagScope);
   if (apiPath.startsWith("/storage")) return handleStorage(req, apiPath.slice(8), vaultName, store, tagScope);

package/src/tag-integrity-mcp.test.ts

@@ -2,9 +2,17 @@
  * End-to-end coverage for the vault#552 MCP + REST surface: rename-tag and
  * merge-tags tool wiring (verb + tag-scope gating), delete-tag's
  * cascade/detach flags flowing through the MCP wrapper, and the `doctor`
- * tool/endpoint's admin-gate + tag-scope filtering. Fixture pattern mirrors
+ * tool/endpoint's tag-scope filtering. Fixture pattern mirrors
  * tag-field-conflict-scope.test.ts (PARACHUTE_HOME temp home + hand-built
  * AuthResult).
+ *
+ * Write/admin re-tier (this PR): the MCP `doctor` tool moved admin → read
+ * (read-only, tag-scope-restricted diagnostic); `rename-tag`/`merge-tags`/
+ * `delete-tag`/`update-tag` moved write → admin (schema/taxonomy curation,
+ * not content). The REST `GET /api/doctor` endpoint is intentionally
+ * UNCHANGED — it stays admin-gated (a separate enforcement point in
+ * src/routing.ts) — so it and the MCP `doctor` tool now sit at different
+ * tiers for the same underlying scan; see CHANGELOG.
  */
 import { describe, test, expect, beforeEach, afterEach } from "bun:test";
 import { mkdirSync, rmSync, existsSync } from "fs";
@@ -156,8 +164,8 @@ describe("delete-tag cascade/detach — MCP wrapper pass-through (vault#552)", (
   });
 });
 
-describe("doctor — admin gate + tag-scope filtering (vault#552)", () => {
-  test("MCP: doctor is invisible in tools/list to a write-only (non-admin) session, and excluded-tool-called-explicitly still refuses it", async () => {
+describe("doctor — read gate (re-tier) + tag-scope filtering (vault#552)", () => {
+  test("MCP: doctor is visible + callable for a read-only session (re-tier: admin → read)", async () => {
     // `generateScopedMcpTools` (the `toolsFor` helper) always returns the
     // FULL tool set — the `requiredVerb` visibility filter lives one layer
     // up, in `handleScopedMcp`'s tools/list dispatch (mcp-http.ts). Drive
@@ -169,17 +177,48 @@ describe("doctor — admin gate + tag-scope filtering (vault#552)", () => {
       headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
       body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }),
     });
-    const listRes = await handleScopedMcp(listReq, "journal", authFor("journal", null, "write"));
+    const listRes = await handleScopedMcp(listReq, "journal", authFor("journal", null, "read"));
     const listBody = await listRes.json() as any;
     const names: string[] = listBody.result.tools.map((t: any) => t.name);
-    expect(names).not.toContain("doctor");
+    expect(names).toContain("doctor");
 
-    // Explicitly calling it anyway is refused, not silently executed.
+    // Explicitly calling it succeeds — no admin credential needed anymore.
     const callReq = new Request("http://localhost:1940/vault/journal/mcp", {
       method: "POST",
       headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
       body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/call", params: { name: "doctor", arguments: {} } }),
     });
+    const callRes = await handleScopedMcp(callReq, "journal", authFor("journal", null, "read"));
+    const callBody = await callRes.json() as any;
+    expect(callBody.result?.isError).toBeFalsy();
+    const report = JSON.parse(callBody.result.content[0].text);
+    expect(report.findings).toBeDefined();
+  });
+
+  test("MCP: update-tag is invisible in tools/list to a write-only (non-admin) session, and excluded-tool-called-explicitly still refuses it (re-tier: write → admin)", async () => {
+    seedVault("journal");
+    const { handleScopedMcp } = await import("./mcp-http.ts");
+    const listReq = new Request("http://localhost:1940/vault/journal/mcp", {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }),
+    });
+    const listRes = await handleScopedMcp(listReq, "journal", authFor("journal", null, "write"));
+    const listBody = await listRes.json() as any;
+    const names: string[] = listBody.result.tools.map((t: any) => t.name);
+    expect(names).not.toContain("update-tag");
+    expect(names).not.toContain("delete-tag");
+    expect(names).not.toContain("rename-tag");
+    expect(names).not.toContain("merge-tags");
+    // doctor, by contrast, IS visible — it's read-tier now, and write ⊇ read.
+    expect(names).toContain("doctor");
+
+    // Explicitly calling update-tag anyway is refused, not silently executed.
+    const callReq = new Request("http://localhost:1940/vault/journal/mcp", {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/call", params: { name: "update-tag", arguments: { tag: "mine" } } }),
+    });
     const callRes = await handleScopedMcp(callReq, "journal", authFor("journal", null, "write"));
     const callBody = await callRes.json() as any;
     expect(callBody.result?.isError).toBe(true);

package/src/tag-scope.ts

@@ -90,8 +90,17 @@ export function filterNotesByTagScope<T extends Note>(
  * about a warning's `schema`/`loser_schema` tag NAMES, not a note's whole
  * tag set) uses the identical visibility rule. `rawRoots === null` (unscoped)
  * → always visible.
+ *
+ * Exported (vault aggregate/rollup feature) so `query-notes`'s `aggregate`
+ * mode under `group_by: "tag"` can scrub GROUP NAMES for a scoped caller —
+ * a co-tagged note that's itself in scope (visible via one tag) still
+ * carries out-of-scope tags, and a tag rollup's groups ARE tag names, so
+ * narrowing which NOTES count (the `aggregateVisibility` note-level
+ * predicate) isn't sufficient on its own to keep an out-of-scope tag name
+ * from surfacing as a group. See `src/mcp-tools.ts` / `src/routes.ts`'s
+ * aggregate branches.
  */
-function tagVisibleInScope(
+export function tagVisibleInScope(
   tag: string,
   allowed: Set<string> | null,
   rawRoots: string[] | null,