@openparachute/vault 0.7.5 → 0.7.6-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.5",
+  "version": "0.7.6-rc.2",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/attachment-tickets.ts

@@ -24,6 +24,7 @@ import { sanitizeAttachmentExtension } from "../core/src/attachment/policy.ts";
 import { assetsDir, readVaultConfig } from "./config.ts";
 import {
   NO_PROVIDER_ERROR,
+  noProviderErrorFor,
   classifyAutoTranscribe,
   warnNoTranscriptionProvider,
 } from "./auto-transcribe.ts";
@@ -268,6 +269,17 @@ async function handleUploadSpend(
   // mint) wins; otherwise infer from mime-type + the owning vault's
   // auto-transcribe toggle.
   const explicitOptIn = ticket.transcribe === true;
+  // NO explicit-opt-out branch here, deliberately — unlike the REST attach
+  // route this path CANNOT express one today. `generateMcpTools` mints the
+  // ticket with `transcribe: params.transcribe === true` (core/src/mcp.ts),
+  // so a caller who says nothing and a caller who says `false` both arrive
+  // as `false`. Reading `false` as an opt-out here would therefore disable
+  // auto-transcribe for every ticket that didn't explicitly opt in — the
+  // collapse this work exists to undo, in the opposite direction.
+  //
+  // Making the ticket path symmetric means preserving the tri-state at mint
+  // first, which is a change to the MCP tool contract and belongs with that
+  // argument rather than smuggled in here.
   const perVaultEnabled = readVaultConfig(vaultName)?.auto_transcribe?.enabled;
   const autoDecision = explicitOptIn
     ? ({ kind: "transcribe" } as const)
@@ -292,7 +304,11 @@ async function handleUploadSpend(
     }
   } else if (transcribeUnavailable) {
     attMeta.transcribe_status = "failed";
-    attMeta.transcribe_error = NO_PROVIDER_ERROR;
+    // Name the real situation. On a box with a local provider configured,
+    // the flat NO_PROVIDER_ERROR told the operator to do what they'd done.
+    attMeta.transcribe_error = noProviderErrorFor(
+      autoDecision.kind === "unavailable" ? autoDecision.localProvider : null,
+    );
     attMeta.transcribe_requested_at = new Date().toISOString();
     attMeta.transcribe_origin = "auto";
     if (ticket.segmentIndex !== undefined) {

package/src/auto-transcribe.test.ts

@@ -9,6 +9,8 @@ import { describe, test, expect } from "bun:test";
 import {
   _resetNoProviderWarnForTest,
   classifyAutoTranscribe,
+  NO_PROVIDER_ERROR,
+  noProviderErrorFor,
   shouldAutoTranscribe,
   warnNoTranscriptionProvider,
 } from "./auto-transcribe.ts";
@@ -281,3 +283,106 @@ describe("warnNoTranscriptionProvider throttle (vault#643)", () => {
     }
   });
 });
+
+/**
+ * The `unavailable` error must be TRUE, not merely actionable.
+ *
+ * Found live: a box with `TRANSCRIPTION_PROVIDER=whisper-cpp`, `parakeet-cli`
+ * on PATH, the model downloaded, and `[transcribe] worker started →
+ * whisper-cpp` in the same boot log was writing "no transcription provider
+ * configured — set TRANSCRIPTION_PROVIDER to a local provider" onto its
+ * attachments. Every clause of that is false there, and the fix it prescribes
+ * is a 400 MB re-download that changes nothing.
+ *
+ * The decision is deliberately unchanged — `unavailable` stays `unavailable`,
+ * because this path resolves a scribe URL and nothing else. Only the sentence
+ * moves.
+ */
+describe("the unavailable message tells the truth about the local install", () => {
+  const audio = "audio/webm";
+  const noScribe = () => undefined;
+
+  test("nothing runnable locally → the original message, unchanged", () => {
+    // The fresh-install case the old string was written for, and it is still
+    // exactly right there. Byte-identical so a fresh install sees no churn.
+    const d = classifyAutoTranscribe(audio, {
+      perVaultEnabled: true,
+      getCachedScribeUrlImpl: noScribe,
+      localProviderImpl: () => null,
+    });
+    expect(d.kind).toBe("unavailable");
+    expect(noProviderErrorFor(d.kind === "unavailable" ? d.localProvider : null)).toBe(
+      NO_PROVIDER_ERROR,
+    );
+  });
+
+  test("a runnable local provider → a message that does not contradict the box", () => {
+    const d = classifyAutoTranscribe(audio, {
+      perVaultEnabled: true,
+      getCachedScribeUrlImpl: noScribe,
+      localProviderImpl: () => "whisper-cpp",
+    });
+    expect(d.kind).toBe("unavailable");
+    const msg = noProviderErrorFor(d.kind === "unavailable" ? d.localProvider : null);
+
+    // The three false claims the old string made on such a box.
+    expect(msg).not.toContain("no transcription provider configured");
+    expect(msg).not.toContain("set TRANSCRIPTION_PROVIDER to a local provider");
+    expect(msg).not.toContain("transcription install");
+    // And what it must say instead: the local install is fine, this path just
+    // doesn't read it, and don't go reinstalling anything.
+    expect(msg).toContain("whisper-cpp");
+    expect(msg).toContain("SCRIBE_URL");
+    expect(msg).toMatch(/does not consult it/);
+    expect(msg).toMatch(/Reinstalling whisper-cpp will not change this/);
+  });
+
+  test("the decision itself is untouched — this diff moves no behaviour", () => {
+    // Same inputs, both local-provider states: still `unavailable` either way.
+    // If this ever diverges, the change stopped being diagnostic-only and
+    // started deciding what gets transcribed.
+    for (const local of [null, "whisper-cpp"]) {
+      expect(
+        classifyAutoTranscribe(audio, {
+          perVaultEnabled: true,
+          getCachedScribeUrlImpl: noScribe,
+          localProviderImpl: () => local,
+        }).kind,
+      ).toBe("unavailable");
+    }
+    // And a reachable scribe still wins outright, local install or not.
+    expect(
+      classifyAutoTranscribe(audio, {
+        perVaultEnabled: true,
+        getCachedScribeUrlImpl: () => "http://127.0.0.1:1943",
+        localProviderImpl: () => "whisper-cpp",
+      }).kind,
+    ).toBe("transcribe");
+  });
+
+  test("an installed provider with ffmpeg missing STILL gets the honest message", () => {
+    // The trap that cost a rewrite: `snap.ready` also demands ffmpeg, so it
+    // varies box to box. A machine with the provider installed and ffmpeg
+    // missing is still one where "no transcription provider configured" is
+    // false, so the discriminator is INSTALLED, not READY — it answers the
+    // question the sentence asks, identically everywhere.
+    const msg = noProviderErrorFor("whisper-cpp");
+    expect(msg).not.toBe(NO_PROVIDER_ERROR);
+    // And it must not over-claim in the other direction: with ffmpeg missing
+    // the install is present but not necessarily working, so the message says
+    // requests are ROUTED to it and points at status for the real state.
+    expect(msg).toMatch(/routed to it/);
+    expect(msg).toContain("transcription status");
+    expect(msg).not.toMatch(/is fine/);
+  });
+
+  test("the provider NAME is not the discriminator — the fresh-install trap", () => {
+    // `resolveTranscriptionProviderName` returns "whisper-cpp" on a box where
+    // nothing is set up at all, because that is the default when no scribe URL
+    // resolves. Keying off the name would tell a fresh-install operator their
+    // whisper-cpp install is fine when they have never installed one. The
+    // discriminator is RUNNABILITY, and null must produce the old message.
+    expect(noProviderErrorFor(null)).toBe(NO_PROVIDER_ERROR);
+    expect(noProviderErrorFor("whisper-cpp")).not.toBe(NO_PROVIDER_ERROR);
+  });
+});

package/src/auto-transcribe.ts

@@ -10,6 +10,35 @@
 
 import { readGlobalConfig } from "./config.ts";
 import { getCachedScribeUrl } from "./scribe-discovery.ts";
+import { buildTranscriptionSnapshot } from "./transcription-routes.ts";
+
+/**
+ * The name of a local provider that is INSTALLED on this box, or null.
+ *
+ * Delegates to the same snapshot `transcription status` and the admin SPA
+ * answer from, so these surfaces share one implementation and cannot drift.
+ *
+ * Keyed on `binary.path`, deliberately, NOT on `snap.ready`. Readiness also
+ * demands ffmpeg, so it varies box to box in a way this message shouldn't: a
+ * machine with the provider installed but ffmpeg missing is still a machine
+ * where "no transcription provider configured — set TRANSCRIPTION_PROVIDER to
+ * a local provider" is false. `installed` answers the question the sentence
+ * actually asks, and answers it the same way everywhere.
+ * (Caught by running the real probe rather than the injected one — the unit
+ * tests inject `localProviderImpl` and would never have shown the difference.)
+ *
+ * Errors swallow to null: a broken probe must degrade to the old, flat message,
+ * never take down an attachment upload.
+ */
+function installedLocalProvider(): string | null {
+  try {
+    const snap = buildTranscriptionSnapshot();
+    if (snap.provider === "scribe-http") return null;
+    return snap.binary.path ? snap.provider : null;
+  } catch {
+    return null;
+  }
+}
 
 /**
  * Pre-vault#353 callers passed `transcribe: true` explicitly on the
@@ -88,7 +117,22 @@ export type AutoTranscribeDecision =
   | { kind: "transcribe" }
   | { kind: "not-audio" }
   | { kind: "disabled" }
-  | { kind: "unavailable" };
+  /**
+   * `localProvider` names a local provider INSTALLED on this box (its binary
+   * resolves), or null when there is nothing local here.
+   *
+   * Installation, deliberately, and not the configured provider NAME. The name
+   * is a trap: `resolveTranscriptionProviderName` returns `whisper-cpp` on a
+   * box where nothing at all is set up, because that is the default when no
+   * scribe URL resolves. Keying the message off the name would tell a
+   * fresh-install operator their whisper-cpp install is present when they have
+   * never installed one — trading one false sentence for another.
+   *
+   * It does NOT change the decision: `unavailable` is `unavailable` either way,
+   * because this path resolves a scribe URL and nothing else. It exists purely
+   * so the error can be true. See `noProviderErrorFor`.
+   */
+  | { kind: "unavailable"; localProvider: string | null };
 
 /** The full decision behind `shouldAutoTranscribe`. Same inputs, more answer. */
 export function classifyAutoTranscribe(
@@ -98,6 +142,12 @@ export function classifyAutoTranscribe(
     getCachedScribeUrlImpl?: () => string | undefined;
     perVaultEnabled?: boolean;
     enabledOverride?: boolean;
+    /**
+     * Injectable, same shape as the two impls above. Returns the name of a
+     * local provider installed here, or null. Defaults to the shared
+     * transcription snapshot.
+     */
+    localProviderImpl?: () => string | null;
   } = {},
 ): AutoTranscribeDecision {
   if (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("audio/")) {
@@ -109,20 +159,69 @@ export function classifyAutoTranscribe(
     ?? true;
   if (!enabled) return { kind: "disabled" };
   const url = (opts.getCachedScribeUrlImpl ?? getCachedScribeUrl)();
-  if (!url || !url.trim()) return { kind: "unavailable" };
+  if (!url || !url.trim()) {
+    // Still unavailable — this path reads a scribe URL and nothing else, and
+    // that is deliberately unchanged here. We only ask whether something local
+    // would run, so the message can name the real situation instead of telling
+    // an operator to do what they have already done.
+    return {
+      kind: "unavailable",
+      localProvider: (opts.localProviderImpl ?? installedLocalProvider)(),
+    };
+  }
   return { kind: "transcribe" };
 }
 
 /**
  * The `transcribe_error` written when auto-transcribe is on but no provider is
- * reachable. Deliberately actionable — the operator needs to know which of the
- * two things to do, not just that something went wrong.
+ * reachable AND nothing local is configured. Deliberately actionable — the
+ * operator needs to know which of the two things to do, not just that something
+ * went wrong.
+ *
+ * Correct only when the resolved provider is `scribe-http`. On a box that HAS a
+ * local provider this sentence is false in the most expensive way — see
+ * `noProviderErrorFor`.
  */
 export const NO_PROVIDER_ERROR =
   "no transcription provider configured — set TRANSCRIPTION_PROVIDER to a local " +
   "provider (see `parachute-vault transcription install`), or point SCRIBE_URL at " +
   "a transcription service";
 
+/**
+ * The `transcribe_error` for an `unavailable` decision, told truthfully.
+ *
+ * Found live: a box with `TRANSCRIPTION_PROVIDER=whisper-cpp`, `parakeet-cli` on
+ * PATH, the model downloaded, and `[transcribe] worker started → whisper-cpp` in
+ * the same boot was writing `NO_PROVIDER_ERROR` onto its attachments — telling
+ * the operator to set the variable they had set and install the provider that
+ * was already running. Same failure mode as the `transcription status` bug
+ * (#643): a diagnostic that lies during the exact task it exists for, and this
+ * one sends someone to re-download a 400 MB model to fix nothing.
+ *
+ * The asymmetry is real and worth naming in the message rather than hiding:
+ * `server.ts` starts a local worker with no scribe URL anywhere in the branch,
+ * but this path resolves ONLY a scribe URL. So a local provider genuinely does
+ * serve explicit `transcribe: true` requests while genuinely being invisible
+ * here. An operator who is not told that will reasonably conclude their install
+ * is broken.
+ *
+ * Deliberately NOT a fix for the asymmetry itself — teaching this path to see
+ * local providers changes what gets transcribed, which is a behaviour question
+ * and not this diff's to answer.
+ */
+export function noProviderErrorFor(localProvider: string | null): string {
+  if (!localProvider) return NO_PROVIDER_ERROR;
+  return (
+    `auto-transcribe found no reachable provider: it resolves only a scribe URL ` +
+    `(SCRIBE_URL, or a \`parachute-scribe\` entry in services.json), and neither is set. ` +
+    `A local ${localProvider} install IS present here and explicit transcription requests ` +
+    `are routed to it — this path does not consult it. Reinstalling ${localProvider} will ` +
+    `not change this. To auto-transcribe uploads, point SCRIBE_URL at a transcription ` +
+    `service; otherwise request transcription explicitly on the attachment. ` +
+    `\`parachute-vault transcription status\` reports the local install's own state.`
+  );
+}
+
 /** Throttle for {@link warnNoTranscriptionProvider}. */
 const NO_PROVIDER_WARN_INTERVAL_MS = 60_000;
 let lastNoProviderWarnAt = 0;

package/src/cli.ts

@@ -167,6 +167,8 @@ import {
   type TranscribeCppManifest,
   type PythonInstallManifest,
 } from "./transcription/select.ts";
+import { buildTranscriptionSnapshot } from "./transcription-routes.ts";
+import { TRANSCRIPTION_MODELS } from "./transcription/models.ts";
 import {
   buildTranscribeCli,
   cliSourceUrl,
@@ -3589,6 +3591,32 @@ function printHistoryUsage(): void {
  * per-provider install state.
  */
 async function cmdTranscription(args: string[]) {
+  // Read the config this command REPORTS ON. Every transcription setting lives
+  // in `~/.parachute/vault/.env` (CLAUDE.md, "Conventions"), and the resolvers
+  // underneath — `resolveTranscriptionProviderName`, `resolveScribeUrl`,
+  // `resolveTranscribeCppPaths`, the model lookup — all read `process.env`.
+  // The daemon gets that env because `server.ts` calls `loadEnvFile()` at boot;
+  // a one-shot CLI process does not, so before this line `transcription status`
+  // answered from an EMPTY env and printed the fallback default as though it
+  // were the operator's configuration.
+  //
+  // Three ways that lied on a box whose `.env` set the values (all reproduced
+  // at 7652af4):
+  //   - `TRANSCRIPTION_PROVIDER=scribe-http` in the file → reported whisper-cpp
+  //   - `TRANSCRIPTION_MODEL=whisper-tiny.en` in the file → reported Parakeet
+  //   - `WHISPER_CPP_BIN_DIR=<dir>` in the file → "parakeet-cli not found"
+  //     while the binary sat in that very directory
+  //
+  // The failure mode is the nasty one: with nothing configured the fallback
+  // HAPPENS to equal the file, so the command looks correct right up until an
+  // operator changes something — i.e. it lies precisely during the task it
+  // exists for. Loading here (not just in `status`) covers `install` too, whose
+  // binary probing reads the same overrides.
+  //
+  // `loadEnvFile` only fills keys that are `undefined`, so a var passed
+  // explicitly on the command line still wins — same precedence the daemon has.
+  loadEnvFile();
+
   const sub = args[0];
   if (sub === "install") {
     await cmdTranscriptionInstall(args.slice(1));
@@ -4188,100 +4216,87 @@ function noRunnableCliGuidance(
   return lines.join("\n");
 }
 
-/** `parachute-vault transcription status` — provider + per-provider install state. */
+/**
+ * `parachute-vault transcription status` — is transcription working, and if
+ * not, what do I run.
+ *
+ * Rewritten to answer that in the first line. It used to open with a "tier
+ * default for this host" recommending `parakeet-mlx`, then list three
+ * superseded providers, and only then (after vault#641 taught it the word)
+ * mention whisper-cpp — which is the actual default and the only one
+ * `transcription install` sets up. An operator read a recommendation for
+ * something we no longer ship, above a wall of "not installed" for things they
+ * should never install.
+ *
+ * The legacy providers still WORK if an operator configured one, so they are
+ * not removed — they are demoted. They print only when actually active or
+ * actually installed, which on a normal box means they never print at all.
+ */
 async function cmdTranscriptionStatus(): Promise<void> {
   const active = resolveTranscriptionProviderName();
-  console.log(`Configured provider: ${active}`);
-
-  // What the ratified tier table would pick for this host (install default).
-  const tier = selectDefaultProvider({
-    platform: process.platform,
-    arch: process.arch,
-    totalRamBytes: detectTotalRamBytes(),
-  });
-  console.log(
-    `Tier default for this host (${tier.platform}/${tier.arch}, ${tier.totalRamGb}GB): ${tier.provider}${tier.model ? ` (${tier.model})` : ""}`,
-  );
+  const snap = buildTranscriptionSnapshot();
 
-  // transcribe-cpp — prebuilt libs + GGUF model + built CLI. "runnable" is an
-  // EXECUTED verdict, not a stat: `--help` must actually exit 0 (vault#534 —
-  // an existsSync-only check said "yes" on Linux while the CLI exited 1 on
-  // every real transcription because its dlopen'd CPU backends never loaded).
-  const paths = resolveTranscribeCppPaths();
-  const manifest = readManifest(paths.manifestPath);
-  const cliPresent = existsSync(paths.binPath);
-  const filesPresent = transcribeCppInstalled(paths); // CLI + model both on disk
-  let installed = false;
-  let notRunnableReason: string | undefined;
-  if (!filesPresent) {
-    notRunnableReason = !cliPresent ? "no transcribe-cli binary" : "no GGUF model on disk";
-  } else {
-    const probe = await probeTranscribeCliRunnable(paths.binPath);
-    installed = probe.ok;
-    notRunnableReason = probe.reason;
-  }
-  console.log(`\ntranscribe-cpp runnable: ${installed ? "yes" : `no (${notRunnableReason})`}`);
-  if (manifest) {
-    console.log(`  model:   ${manifest.model} (${manifest.modelFile})`);
-    console.log(
-      `  libs:    ${paths.libsDir}${manifest.libFiles?.length ? ` (${manifest.libFiles.length} file(s))` : ""}`,
-    );
-    console.log(
-      cliPresent
-        ? `  cli:     ${paths.binPath}${manifest.binBuiltFrom ? ` (built from source @ ${manifest.binBuiltFrom.slice(0, 12)})` : ""}`
-        : `  cli:     NOT FOUND — re-run \`transcription install\` to build one (needs a C++ compiler), or set TRANSCRIBE_CPP_BIN`,
-    );
-    console.log(`  ram:     ${manifest.ram_gb}GB at install (${manifest.os}/${manifest.arch})`);
+  // The headline: one line, answering the question that brought them here.
+  //
+  // Deliberately reports READINESS only, never `snap.active`. `active` reads
+  // the in-process transcription worker registry, which a one-shot CLI process
+  // never has — so keying on it would print "ready, but the worker isn't
+  // running yet" on every healthy box. Liveness is a question only the running
+  // daemon can answer, which is why the admin UI (served from that process)
+  // shows it and this command doesn't pretend to.
+  if (snap.ready) {
+    console.log(`Transcription: ready (${active})`);
   } else {
-    console.log(`  (not installed — run: parachute-vault transcription install --provider transcribe-cpp)`);
+    console.log(`Transcription: NOT running (${active})`);
+    if (snap.reason) console.log(`  ${snap.reason}`);
+    if (snap.fix_command) console.log(`  fix:  ${snap.fix_command}`);
   }
 
-  // parakeet-mlx / onnx-asr — Python venv providers (scribe-fold Phase 2b).
-  const pyManifest = readPythonManifest(pythonManifestPath());
-  const pkBin = resolveParakeetMlxBin();
-  const pkRunnable = parakeetMlxInstalled();
-  console.log(`\nparakeet-mlx runnable: ${pkRunnable ? "yes" : "no"}`);
-  if (pkRunnable) {
-    console.log(`  bin:     ${pkBin}`);
-    console.log(`  model:   ${resolveParakeetMlxModel()} (HF cache; downloads on first use)`);
-  } else {
-    console.log(
-      process.platform === "darwin" && process.arch === "arm64"
-        ? `  (not installed — run: parachute-vault transcription install${tier.provider === "parakeet-mlx" ? "" : " --provider parakeet-mlx"})`
-        : "  (macOS Apple Silicon only)",
-    );
+  // What's actually on this machine, for the active local provider.
+  if (snap.provider === "whisper-cpp") {
+    console.log("");
+    console.log(`  ${snap.binary.name.padEnd(14)} ${snap.binary.path ?? "not found"}`);
+    console.log(`  ${"ffmpeg".padEnd(14)} ${snap.ffmpeg.path ?? "not found"}`);
+    if (snap.model) {
+      console.log(
+        `  ${"model".padEnd(14)} ${snap.model.label} (${snap.model.size_mb} MB, ${snap.model.installed ? "downloaded" : "not downloaded"})`,
+      );
+    } else {
+      console.log(`  ${"model".padEnd(14)} ${snap.model_id} — not in the catalog`);
+    }
+    if (!snap.binary.path) {
+      // The macOS launchd trap: installed but invisible to a supervised vault.
+      console.log(`  searched:      ${snap.binary.searched.join(", ")}`);
+      console.log("  (installed elsewhere? set WHISPER_CPP_BIN_DIR to that directory)");
+    }
   }
 
-  const oxBin = resolveOnnxAsrBin();
-  const oxRunnable = onnxAsrInstalled();
-  console.log(`onnx-asr runnable: ${oxRunnable ? "yes" : "no"}`);
-  if (oxRunnable) {
-    console.log(`  bin:     ${oxBin}`);
-    console.log(`  model:   ${resolveOnnxAsrModel()} (HF cache)`);
-  } else {
-    console.log(
-      `  (not installed — run: parachute-vault transcription install${tier.provider === "onnx-asr" ? "" : " --provider onnx-asr"})`,
-    );
+  // Legacy providers — demoted, and silent unless one is genuinely in play.
+  // Printing "not installed" for three superseded providers on every run
+  // trained operators to skim past the part that mattered.
+  const legacy: string[] = [];
+  const cppPaths = resolveTranscribeCppPaths();
+  if (active === "transcribe-cpp" || transcribeCppInstalled(cppPaths)) {
+    const probe = transcribeCppInstalled(cppPaths)
+      ? await probeTranscribeCliRunnable(cppPaths.binPath)
+      : { ok: false, reason: "not installed" };
+    legacy.push(`  transcribe-cpp   ${probe.ok ? "runnable" : `not runnable (${probe.reason})`}`);
   }
-  if (pyManifest) {
-    console.log(
-      `  python install: ${pyManifest.provider} (${pyManifest.pipTarget}) @ ${pyManifest.installedAt}${pyManifest.venv ? ` — venv ${pyManifest.venv}` : ""}`,
-    );
+  if (active === "parakeet-mlx" || parakeetMlxInstalled()) {
+    legacy.push(`  parakeet-mlx     ${parakeetMlxInstalled() ? `runnable (${resolveParakeetMlxBin()})` : "not installed"}`);
   }
-
-  // Offline warning when the ACTIVE provider isn't runnable.
-  const activeRunnable =
-    active === "scribe-http" ||
-    (active === "transcribe-cpp" && installed) ||
-    (active === "parakeet-mlx" && pkRunnable) ||
-    (active === "onnx-asr" && oxRunnable);
-  if (!activeRunnable) {
-    console.log(
-      `\n⚠  provider is ${active} but no runnable ${active} install was found — transcription is offline until one is available (\`parachute-vault transcription install\`).`,
-    );
+  if (active === "onnx-asr" || onnxAsrInstalled()) {
+    legacy.push(`  onnx-asr         ${onnxAsrInstalled() ? `runnable (${resolveOnnxAsrBin()})` : "not installed"}`);
   }
+  if (legacy.length > 0) {
+    console.log("\nLegacy providers (superseded by whisper-cpp):");
+    for (const line of legacy) console.log(line);
+  }
+
+  // The model catalog is what `--model` accepts, so it belongs with the
+  // provider that actually uses it.
   console.log(
-    `\nAvailable transcribe-cpp models (override with --model): ${Object.values(MODELS).map((m: ModelChoice) => m.name).join(", ")}`,
+    `\nModels for whisper-cpp (--model): ${TRANSCRIPTION_MODELS.map((m) => m.id).join(", ")}`,
   );
 }
 

package/src/mcp-tools.ts

@@ -883,9 +883,13 @@ function overrideVaultInfo(
  * model error), the cap is the backstop. Operators wanting long-lived
  * tokens mint a hub-issued JWT via the hub mint-token flow (the REST
  * /vault/<name>/tokens endpoint was removed with the pvt_* drop, vault#282).
+ * The `long_lived: true` opt-in deliberately relaxes this to a 90-day
+ * ceiling for standing credentials; the caller's admin JWT could already
+ * mint longer directly from the hub, so the flag adds no new authority.
  */
 const MANAGE_TOKEN_DEFAULT_TTL_SECONDS = 900; // 15 minutes
 const MANAGE_TOKEN_MAX_TTL_SECONDS = 3600; // 1 hour
+const MANAGE_TOKEN_LONG_TTL_MAX_SECONDS = 7776000; // 90 days; opt-in ceiling for `long_lived: true`, matching hub's API_MINT_TOKEN_DEFAULT_TTL_SECONDS
 
 /**
  * Resolve the bare hub origin for the mint/revoke proxy calls. Reuses
@@ -952,8 +956,10 @@ function buildManageTokenTool(
       "escalate. Minting requires a hub-JWT session holding 'vault:" + vaultName +
       ":admin'. List + revoke are scoped to tokens this session minted; " +
       "CLI/REST-minted tokens are not surfaced here.\n\n" +
+      "`long_lived: true` raises the mint TTL cap to 90 days; a 90-day token is a " +
+      "standing credential and meaningfully increases blast radius if leaked/misused.\n\n" +
       "Actions (discriminator: `action`):\n" +
-      "- `mint` — { scope: string|string[], ttl_seconds?: number, description?: string } → { action: \"mint\", token, jti, expires_at, scopes, scoped_tags, vault_name } (vault#555: scopes/scoped_tags/vault_name were previously undocumented here)\n" +
+      "- `mint` — { scope: string|string[], ttl_seconds?: number, long_lived?: boolean, description?: string } → { action: \"mint\", token, jti, expires_at, scopes, scoped_tags, vault_name } (vault#555: scopes/scoped_tags/vault_name were previously undocumented here)\n" +
       "- `revoke` — { jti: string } → { action: \"revoke\", ok: boolean, already_revoked?: boolean } — idempotent; a jti not in this session's ledger, or already revoked, still returns ok:true. A genuine failure additionally carries error/message (and, for a hub-side rejection, hub_status).\n" +
       "- `list` — (no inputs) → { action: \"list\", tokens: [...] }",
     inputSchema: {
@@ -974,7 +980,11 @@ function buildManageTokenTool(
         },
         ttl_seconds: {
           type: "number",
-          description: `(action=mint) Token lifetime in seconds. Default ${MANAGE_TOKEN_DEFAULT_TTL_SECONDS} (15 min), max ${MANAGE_TOKEN_MAX_TTL_SECONDS} (1 hour). Values outside (0, ${MANAGE_TOKEN_MAX_TTL_SECONDS}] are rejected.`,
+          description: `(action=mint) Token lifetime in seconds. Default ${MANAGE_TOKEN_DEFAULT_TTL_SECONDS} (15 min), max ${MANAGE_TOKEN_MAX_TTL_SECONDS} (1 hour); with long_lived=true, max ${MANAGE_TOKEN_LONG_TTL_MAX_SECONDS} (90 days). Values outside the applicable (0, max] range are rejected.`,
+        },
+        long_lived: {
+          type: "boolean",
+          description: "(action=mint, optional) Set true to raise the TTL cap from 1 hour to 90 days. A 90-day token is a standing credential: long-lived and meaningfully increases blast radius if leaked/misused.",
         },
         description: {
           type: "string",
@@ -1107,9 +1117,20 @@ async function mintAction(
   }
 
   // TTL bounds. Default 900 (15 min); explicit values must satisfy
-  // `0 < ttl <= MANAGE_TOKEN_MAX_TTL_SECONDS`. Zero, negative, NaN, and
-  // beyond-max all reject — the cap is the safety backstop if revoke fails,
-  // so it must be strict.
+  // `0 < ttl <= MANAGE_TOKEN_MAX_TTL_SECONDS`, or
+  // `0 < ttl <= MANAGE_TOKEN_LONG_TTL_MAX_SECONDS` with `long_lived: true`.
+  // Zero, negative, NaN, and beyond-max all reject — the cap is the safety
+  // backstop if revoke fails, so it must be strict.
+  if (params.long_lived !== undefined && typeof params.long_lived !== "boolean") {
+    return {
+      action: "mint",
+      error: "invalid_request",
+      message: "manage-token mint: long_lived must be a boolean.",
+    };
+  }
+  const maxTtl = params.long_lived === true
+    ? MANAGE_TOKEN_LONG_TTL_MAX_SECONDS
+    : MANAGE_TOKEN_MAX_TTL_SECONDS;
   let ttl = MANAGE_TOKEN_DEFAULT_TTL_SECONDS;
   if (params.ttl_seconds !== undefined && params.ttl_seconds !== null) {
     if (typeof params.ttl_seconds !== "number" || !Number.isFinite(params.ttl_seconds)) {
@@ -1119,11 +1140,11 @@ async function mintAction(
         message: "manage-token mint: ttl_seconds must be a finite number.",
       };
     }
-    if (params.ttl_seconds <= 0 || params.ttl_seconds > MANAGE_TOKEN_MAX_TTL_SECONDS) {
+    if (params.ttl_seconds <= 0 || params.ttl_seconds > maxTtl) {
       return {
         action: "mint",
         error: "invalid_request",
-        message: `manage-token mint: ttl_seconds must be in (0, ${MANAGE_TOKEN_MAX_TTL_SECONDS}]; got ${params.ttl_seconds}.`,
+        message: `manage-token mint: ttl_seconds must be in (0, ${maxTtl}]; got ${params.ttl_seconds}.`,
       };
     }
     ttl = params.ttl_seconds;