@openparachute/vault 0.7.6 → 0.7.7

package/src/vault.test.ts

@@ -238,6 +238,14 @@ describe("BunStore", async () => {
     expect(results.map((n) => n.path)).toContain("Projects/Parachute/README");
     expect(results.map((n) => n.path)).toContain("Projects/Parachute/Notes");
   });
+
+  test("queryNotes excludePathPrefix drops matching paths (vault#628)", async () => {
+    await store.createNote("user", { path: "Projects/a" });
+    await store.createNote("sys", { path: ".parachute/notes/settings" });
+    await store.createNote("bare");
+    const results = await store.queryNotes({ excludePathPrefix: [".parachute/"] });
+    expect(results.map((n) => n.content).sort()).toEqual(["bare", "user"]);
+  });
 });
 
 describe("metadata", async () => {
@@ -1877,11 +1885,16 @@ describe("scoped MCP wrapper", async () => {
     // note, so it's not a schema-shape indicator.)
     const serialized = JSON.stringify(result);
     expect(serialized).not.toContain("fizzbuzz");
-    // The tag NAME must be gone from validation_status specifically. NOTE:
-    // it still appears in the note's `.tags` array — that's PRE-EXISTING
-    // scoped-read behavior (noteWithinTagScope has never scrubbed a returned
-    // note's tag set), independent of fix 3, and out of scope for this fix.
+    // The tag NAME must be gone from validation_status specifically.
+    // (Historical note: this assertion used to be narrowed to
+    // `validation_status` because the name STILL appeared in the note's
+    // `.tags` array — pre-existing scoped-read behavior, filed as vault#568
+    // and out of scope for fix 3. #568 has since scrubbed `.tags` too, so
+    // the name is now absent from the whole response; the narrow assertion
+    // is kept as-is because it pins THIS fix's field specifically.
+    // `tag-scope-note-tags.test.ts` owns the `.tags` coverage.)
     expect(JSON.stringify(result.validation_status)).not.toContain("project-manhattan");
+    expect(result.tags).toEqual(["work"]);
 
     // The in-scope tag's own warning DOES survive.
     const vs = result.validation_status;
@@ -2496,6 +2509,20 @@ describe("HTTP /notes", async () => {
     expect(body.preview).toBe("hello");
   });
 
+  test("GET /notes?exclude_path_prefix=.parachute/ drops system-space (vault#628)", async () => {
+    await store.createNote("user", { path: "Projects/a" });
+    await store.createNote("sys", { path: ".parachute/notes/settings" });
+    await store.createNote("bare");
+    const res = await handleNotes(
+      mkReq("GET", "/notes?exclude_path_prefix=.parachute/&include_content=true"),
+      store,
+      "",
+    );
+    expect(res.status).toBe(200);
+    const body = await res.json() as any[];
+    expect(body.map((n) => n.content).sort()).toEqual(["bare", "user"]);
+  });
+
   test("GET /notes?include_metadata=false strips metadata from list", async () => {
     await store.createNote("a", { tags: ["m"], metadata: { summary: "hello", status: "ok" } });
     await store.createNote("b", { tags: ["m"], metadata: { summary: "world" } });
@@ -2530,6 +2557,14 @@ describe("HTTP /notes", async () => {
     expect(body.metadata).toEqual({ summary: "s" });
   });
 
+  test("GET /notes?include_metadata=nonexistent keeps metadata: {} (vault#600)", async () => {
+    await store.createNote("a", { tags: ["m600"], metadata: { summary: "hello" } });
+    const res = await handleNotes(mkReq("GET", "/notes?tag=m600&include_metadata=nonexistent"), store, "");
+    const body = await res.json() as any[];
+    expect(body).toHaveLength(1);
+    expect(body[0]).toHaveProperty("metadata", {});
+  });
+
   test("GET /notes/:id?expand_links=true inlines wikilink content", async () => {
     await store.createNote("target body", { path: "Target" });
     await store.createNote("see [[Target]]", { id: "src", path: "Src" });

package/src/version.test.ts

@@ -21,6 +21,14 @@ function runCli(args: string[]): {
     cmd: ["bun", CLI, ...args],
     stdout: "pipe",
     stderr: "pipe",
+    // `env` is NOT optional here. Bun hands a child the environ the parent
+    // process *started* with, not the live `process.env` — so runtime
+    // assignments never reach it, including the temp PARACHUTE_HOME that
+    // `core/src/test-preload.ts` sets for the suite. Spawn without this and
+    // the child resolves its parachute home to the developer's real
+    // `~/.parachute`. Nothing here writes, but the next copy of this helper
+    // might; spreading `process.env` is the shape every CLI test should use.
+    env: { ...process.env } as Record<string, string>,
   });
   return {
     exitCode: proc.exitCode ?? -1,

package/src/ws-server.ts

@@ -37,7 +37,7 @@ import { readVaultConfig } from "./config.ts";
 import { getVaultStore } from "./vault-store.ts";
 import { authenticateVaultRequest, type AuthResult } from "./auth.ts";
 import { hasScopeForVault } from "./scopes.ts";
-import { expandTokenTagScope, filterNotesByTagScope } from "./tag-scope.ts";
+import { expandTokenTagScope, filterNotesByTagScope, scrubNotesTagsByScope } from "./tag-scope.ts";
 import { buildLiveMatcher } from "./live-match.ts";
 import {
   subscriptionManager,
@@ -254,7 +254,17 @@ export function createSubscribeWsBinding(deps: SubscribeWsDeps = {}): {
     // Project AFTER the tag-scope filter (which reads note.tags). `toNoteIndex`
     // is the SAME lean shape the REST list route returns, so a client that
     // renders REST lists renders these snapshot frames unchanged.
-    const frames = buildSnapshotFrames(lean ? snapshotNotes.map(toNoteIndex) : snapshotNotes);
+    //
+    // Then scrub each surviving note's `.tags` down to the in-scope subset
+    // (vault#568) — a snapshot is a read, and it must not disclose the NAMES
+    // of a visible note's out-of-scope co-tags any more than `GET /api/notes`
+    // does. Scrubbing AFTER the projection keeps the filter reading the full
+    // tag set. No-op for an unscoped subscription.
+    const frames = buildSnapshotFrames(
+      lean
+        ? scrubNotesTagsByScope(snapshotNotes.map(toNoteIndex), tagScopeAllowed, auth.scoped_tags)
+        : scrubNotesTagsByScope(snapshotNotes, tagScopeAllowed, auth.scoped_tags),
+    );
 
     // --- SYNCHRONOUS from here (no await) so no write interleaves between
     //     register and the snapshot flush.