@openparachute/vault 0.7.1 → 0.7.2-rc.4

package/core/src/aggregate.test.ts

@@ -214,6 +214,29 @@ describe("aggregateNotes — errors", () => {
     }
   });
 
+  // LB — a `type: "number"` (float) field can NEVER be `indexed: true`
+  // (only integer/boolean are indexable numeric shapes), so it legitimately
+  // never appears in `indexed_fields`. Before the fix, the FIELD_NOT_INDEXED
+  // thrown here carried the SAME generic "declare it via update-tag with
+  // indexed: true" hint every other unindexed field gets — advice that's
+  // impossible to satisfy for `number` specifically, dead-ending an agent
+  // that tries it and hits the SEPARATE "unsupported type ... for indexing"
+  // error. The hint must instead name the real fix: store as an integer.
+  it("FIELD_NOT_INDEXED on a type: \"number\" sum field carries an actionable hint, not the impossible generic \"declare indexed: true\" advice", async () => {
+    await store.upsertTagRecord("expense", { fields: { amount: { type: "number" } } });
+    await store.createNote("a", { tags: ["expense"], metadata: { amount: 9.99 } });
+    try {
+      aggregateNotes(db, { aggregate: { group_by: "tag", op: "sum", field: "amount" } });
+      throw new Error("expected throw");
+    } catch (e: any) {
+      expect(e.code).toBe("FIELD_NOT_INDEXED");
+      expect(e.message).not.toContain("declare it via update-tag with indexed: true");
+      const guidance = `${e.message} ${e.hint ?? ""}`.toLowerCase();
+      expect(guidance).toContain("integer");
+      expect(guidance).toMatch(/float|number|decimal/);
+    }
+  });
+
   it("throws INVALID_QUERY when the sum field is indexed but not numeric (TEXT-backed)", async () => {
     await store.upsertTagRecord("task", {
       fields: {

package/core/src/contract-taxonomy.test.ts

@@ -295,6 +295,28 @@ describe("contract: taxonomy — #552 (flipped from test.todo)", () => {
     expect(cleanReport.summary).toContain("clean");
   });
 
+  // LB — a DIRECT self-parent (`parent_names: [tag]` on tag itself) is a
+  // degenerate one-node cycle: `getTagDescendants` starts its traversal
+  // result at `{tag}`, and the moment it walks the tag's own self-edge it
+  // finds `tag` already `result.has(child)` and skips re-expanding it — so
+  // `descendants` never grows past size 1. `findHierarchyCycles`'s original
+  // gate (`descendants.has(tag) && descendants.size > 1`) requires size>1,
+  // so this exact case reported clean despite being a real cycle. Only
+  // reachable via guard-bypassing data (direct DB write / import) since
+  // `upsertTagRecord` rejects a self-parent at write time (see the "bare
+  // self-parent: also caught" assertion above, which exercises the WRITE
+  // guard — this test exercises the READ-side doctor scan on data that
+  // skipped that guard).
+  it("doctor flags a bare self-parent cycle (X declares parent_names: [X]), which the size>1 gate alone misses", async () => {
+    await store.upsertTagRecord("self-cyc", {});
+    db.prepare("UPDATE tags SET parent_names = ? WHERE name = ?").run(JSON.stringify(["self-cyc"]), "self-cyc");
+
+    const report = await store.doctor();
+    const finding = report.findings.find((f) => f.type === "parent_names_cycle" && f.subject === "self-cyc");
+    expect(finding).toBeDefined();
+    expect(finding?.severity).toBe("error");
+  });
+
   it("dead_tag_metadata_reference does not false-positive on a schema-declared enum field whose values coincide with an unrelated live tag (vault#570)", async () => {
     // "archived" is a real, unrelated live tag — coincidentally sharing a
     // name with one of "status"'s declared enum values. Pre-fix, this ONE

package/core/src/core.test.ts

@@ -8,7 +8,7 @@ import { traverseLinks } from "./links.js";
 import * as indexedFieldOps from "./indexed-fields.js";
 import { resolveLinkTarget } from "./wikilinks.js";
 import { generateUlid, ULID_REGEX } from "./ulid.js";
-import { getVaultMap, extractH1Title, findNotesByTitle, getNoteByTitle } from "./notes.js";
+import { getVaultMap, extractH1Title, findNotesByTitle, getNoteByTitle, validatePath, PathValidationError } from "./notes.js";
 
 let store: SqliteStore;
 let db: Database;
@@ -663,9 +663,13 @@ describe("renameTag cascade (vault#240 + #247)", async () => {
   // vault#555 fix 2 — a rename cascade's inline content rewrite is a real
   // persisted-state change; `updated_at` must move or a cursor/sync-poll
   // loop never sees the rewritten note.
-  it("1b. content rewrite bumps updated_at (vault#555)", async () => {
+  it("1b. content rewrite bumps updated_at (vault#555) AND updated_at_ms (vault#586)", async () => {
     const note = await store.createNote("Today's #task is important.", { tags: ["task"] });
     const before = note.updatedAt;
+    const msOf = (id: string) =>
+      (db.prepare("SELECT updated_at_ms FROM notes WHERE id = ?").get(id) as { updated_at_ms: number })
+        .updated_at_ms;
+    const beforeMs = msOf(note.id);
     await new Promise((r) => setTimeout(r, 5));
 
     await store.renameTag("task", "todo");
@@ -674,6 +678,12 @@ describe("renameTag cascade (vault#240 + #247)", async () => {
     expect(fresh!.content).toContain("#todo");
     expect(fresh!.updatedAt).not.toBe(before);
     expect(new Date(fresh!.updatedAt) > new Date(before)).toBe(true);
+    // vault#586: the integer keyset key must move in lockstep with updated_at —
+    // else a cursor sync-poll never surfaces the rewritten note. Pins the
+    // renameTag content-cascade ms hunk (a revert leaves ms stale → RED).
+    const afterMs = msOf(note.id);
+    expect(afterMs).toBeGreaterThan(beforeMs);
+    expect(afterMs).toBe(Date.parse(fresh!.updatedAt!));
   });
 
   it("2. cascades sub-tags recursively (task → todo, task/work → todo/work, task/work/client → todo/work/client)", async () => {
@@ -1543,7 +1553,16 @@ describe("queryNotes", async () => {
     // Helper: pin a note's updated_at to a known value so cursor math
     // doesn't race wall-clock writes from the test harness.
     function pinUpdatedAt(id: string, iso: string) {
-      db.prepare("UPDATE notes SET updated_at = ? WHERE id = ?").run(iso, id);
+      // Mirror production: EVERY write maintains updated_at_ms in lockstep with
+      // updated_at (vault#586 — the integer column is the keyset-ordering
+      // authority). A helper that pinned only the string would leave a stale ms
+      // and mis-order the cursor. The pinned values here are canonical `...Z`,
+      // so `Date.parse` is exact.
+      db.prepare("UPDATE notes SET updated_at = ?, updated_at_ms = ? WHERE id = ?").run(
+        iso,
+        Date.parse(iso),
+        id,
+      );
     }
 
     it("first call returns notes + a next_cursor string", async () => {
@@ -1790,7 +1809,12 @@ describe("queryNotes", async () => {
 
   describe("ULID ids for new notes (existing IDs unchanged)", () => {
     function pinUpdatedAt(id: string, iso: string) {
-      db.prepare("UPDATE notes SET updated_at = ? WHERE id = ?").run(iso, id);
+      // Keep updated_at_ms in lockstep — see the sibling helper's note (vault#586).
+      db.prepare("UPDATE notes SET updated_at = ?, updated_at_ms = ? WHERE id = ?").run(
+        iso,
+        Date.parse(iso),
+        id,
+      );
     }
 
     it("new notes get ULID-format ids (26-char Crockford base32)", async () => {
@@ -7652,3 +7676,45 @@ describe("vault projection (vault#271)", async () => {
     expect(approxTokens).toBeLessThan(5000);
   });
 });
+
+// ---- Path write-validation (vault#589 / FIX 2) ----
+
+describe("validatePath — reject NUL / '..' at the write surface", () => {
+  const NUL = String.fromCharCode(0);
+
+  it("rejects a NUL byte in the path", () => {
+    expect(() => validatePath(`bad${NUL}path`)).toThrow(PathValidationError);
+    try {
+      validatePath(`x${NUL}y`);
+      throw new Error("expected validatePath to throw");
+    } catch (e: any) {
+      expect(e.code).toBe("INVALID_PATH");
+      expect(e.error_type).toBe("invalid_path");
+      expect(e.reason).toMatch(/NUL/);
+    }
+  });
+
+  it("rejects a '..' path segment (traversal-shaped)", () => {
+    expect(() => validatePath("..")).toThrow(PathValidationError);
+    expect(() => validatePath("../secrets")).toThrow(PathValidationError);
+    expect(() => validatePath("a/../b")).toThrow(PathValidationError);
+    expect(() => validatePath("a/..")).toThrow(PathValidationError);
+    // Backslash form normalizes to '/', so it's caught too.
+    expect(() => validatePath("a\\..\\b")).toThrow(PathValidationError);
+  });
+
+  it("accepts legitimate paths, including ones that merely contain dots", () => {
+    expect(() => validatePath("Projects/Parachute/README")).not.toThrow();
+    expect(() => validatePath("notes/2026-07-09")).not.toThrow();
+    expect(() => validatePath("weird...name")).not.toThrow(); // three literal dots, not a '..' segment
+    expect(() => validatePath("a/.hidden/b")).not.toThrow();   // single-dot-prefixed segment is fine
+    expect(() => validatePath("with spaces and : colon?")).not.toThrow(); // FORBIDDEN_CHARS stay un-enforced at write
+  });
+
+  it("treats a null / undefined / empty path as valid (notes need no path)", () => {
+    expect(() => validatePath(null)).not.toThrow();
+    expect(() => validatePath(undefined)).not.toThrow();
+    expect(() => validatePath("")).not.toThrow();
+    expect(() => validatePath("   ")).not.toThrow(); // normalizes to null
+  });
+});