@openparachute/vault 0.7.8 → 0.7.9-rc.1

package/core/src/notes.ts

@@ -1096,21 +1096,27 @@ export function buildFilterConditions(db: Database, opts: QueryOpts): { conditio
     params.push(opts.path);
   }
 
-  // Path prefix
+  // Path prefix. `escapeLikePattern` neutralizes `%` and `_` inside the
+  // caller-supplied prefix so it matches as a literal string: without it,
+  // `path_prefix=_tags/` silently matched `atags/…` too (`_` is LIKE's
+  // single-char wildcard), returning notes the caller never asked for and
+  // never saw a signal about (vault#659). The trailing `%` we append is
+  // still our actual wildcard. `ESCAPE '\'` is required for the escape to
+  // take effect.
   if (opts.pathPrefix) {
-    conditions.push("n.path LIKE ?");
-    params.push(opts.pathPrefix + "%");
+    conditions.push("n.path LIKE ? ESCAPE '\\'");
+    params.push(escapeLikePattern(opts.pathPrefix) + "%");
   }
 
   // Path-prefix exclusion (vault#628). Mirrors `pathPrefix` matching
-  // (`LIKE prefix || '%'`, SQLite LIKE is ASCII-case-insensitive). NULL
-  // paths are kept — they are not under the prefix. Repeatable: a note
-  // matching ANY listed prefix is dropped.
+  // (`LIKE prefix || '%'` with the same metachar escaping, SQLite LIKE is
+  // ASCII-case-insensitive). NULL paths are kept — they are not under the
+  // prefix. Repeatable: a note matching ANY listed prefix is dropped.
   if (opts.excludePathPrefix && opts.excludePathPrefix.length > 0) {
     for (const prefix of opts.excludePathPrefix) {
       if (typeof prefix !== "string" || prefix.length === 0) continue;
-      conditions.push("(n.path IS NULL OR n.path NOT LIKE ?)");
-      params.push(prefix + "%");
+      conditions.push("(n.path IS NULL OR n.path NOT LIKE ? ESCAPE '\\')");
+      params.push(escapeLikePattern(prefix) + "%");
     }
   }
 

package/core/src/types.ts

@@ -190,7 +190,8 @@ export interface QueryOpts {
   pathPrefix?: string;  // e.g., "Projects/Parachute" matches "Projects/Parachute/README"
   /**
    * Exclude notes whose path matches any of these prefixes. Same matching
-   * as `pathPrefix` (`n.path LIKE prefix || '%'`, ASCII case-insensitive).
+   * as `pathPrefix` (`n.path LIKE prefix || '%' ESCAPE '\'`, ASCII
+   * case-insensitive; `%`/`_` in the prefix are escaped to literals).
    * Repeatable. A note with no path is not excluded (it isn't under the
    * prefix). vault#628 — `.parachute/` system-space is the first client.
    */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.8",
+  "version": "0.7.9-rc.1",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/live-match.test.ts

@@ -130,6 +130,23 @@ describe("live-match — predicate parity with the query engine", () => {
     expect(ids.size).toBe(2);
   });
 
+  it("pathPrefix with a LIKE metachar matches literally (vault#659)", async () => {
+    // `_` is LIKE's single-char wildcard. Unescaped, `LIKE '_tags/%'` also
+    // matched `atags/x` in SQL while the matcher's `startsWith` did not —
+    // a snapshot/live divergence that also just returned the wrong answer.
+    const under = await store.createNote("under", { path: "_tags/x" });
+    await store.createNote("decoy", { path: "atags/x" });
+    const ids = await assertParity({ pathPrefix: "_tags/" });
+    expect([...ids]).toEqual([under.id]);
+  });
+
+  it("excludePathPrefix with a LIKE metachar excludes literally (vault#659)", async () => {
+    await store.createNote("under", { path: "_tags/x" });
+    const decoy = await store.createNote("decoy", { path: "atags/x" });
+    const ids = await assertParity({ excludePathPrefix: ["_tags/"] });
+    expect([...ids]).toEqual([decoy.id]);
+  });
+
   it("hasTags true/false (M1 — presence parity)", async () => {
     await store.createNote("tagged", { tags: ["x"] });
     await store.createNote("bare", {});

package/src/live-match.ts

@@ -20,9 +20,13 @@
  *     freezes it for the snapshot query.
  *   - `excludeTags` — raw exact-name match (engine does NOT expand excludes).
  *   - `path` — case-insensitive exact (engine: `n.path = ? COLLATE NOCASE`).
- *   - `pathPrefix` — prefix (engine: `n.path LIKE prefix || '%'`).
+ *   - `pathPrefix` — prefix (engine: `n.path LIKE prefix || '%' ESCAPE '\'`).
+ *     The engine escapes `%`/`_` in the prefix (vault#659), so the prefix
+ *     matches literally — exactly what `startsWith` does here. Before that
+ *     fix the two paths genuinely diverged: `_tags/` matched `atags/…` in
+ *     SQL and not in the matcher.
  *   - `excludePathPrefix` — NOT those prefixes (engine: `n.path IS NULL OR
- *     n.path NOT LIKE prefix || '%'`). Repeatable. vault#628.
+ *     n.path NOT LIKE prefix || '%' ESCAPE '\'`). Repeatable. vault#628.
  *   - `extension` — lower-cased, default "md" (engine: `LOWER(n.extension)`),
  *     a note with no extension is treated as "md".
  *   - `metadata` operator objects (eq/ne/gt/gte/lt/lte/in/not_in/exists) +

package/src/routes.ts

@@ -352,9 +352,26 @@ function parseLinkCountDirection(url: URL): "both" | "outbound" | "inbound" {
   return "both";
 }
 
+/**
+ * Parse a repeatable, comma-list query param (`tag`, `exclude_tag`,
+ * `exclude_path_prefix`). Two accepted shapes, and they compose:
+ *   - `?tag=a,b` (comma-list)
+ *   - `?tag=a&tag=b` (repeated param)
+ * Both yield `["a", "b"]`. This used to be `searchParams.get()` + split,
+ * which silently kept only the FIRST occurrence — a caller passing
+ * `?tag=a&tag=b` got results filtered by `a` alone, with no signal that
+ * `b` had been dropped (vault#659). Mirrors `parseExtensionFilter` below,
+ * with two deliberate differences: this always returns an array (these
+ * callers take `string[]`), and it does NOT trim — `exclude_path_prefix`
+ * is a path fragment, where surrounding whitespace is data, not noise.
+ * Returns undefined when absent so the queryNotes filter is skipped.
+ */
 function parseQueryList(url: URL, key: string): string[] | undefined {
-  const val = url.searchParams.get(key);
-  return val ? val.split(",") : undefined;
+  const all = url.searchParams.getAll(key);
+  if (all.length === 0) return undefined;
+  // Flatten comma-lists inside each param.
+  const flat = all.flatMap((v) => v.split(",")).filter((s) => s.length > 0);
+  return flat.length > 0 ? flat : undefined;
 }
 
 /**

package/src/vault.test.ts

@@ -2523,6 +2523,79 @@ describe("HTTP /notes", async () => {
     expect(body.map((n) => n.content).sort()).toEqual(["bare", "user"]);
   });
 
+  // vault#659 — repeated query params used to take the first occurrence
+  // only (`searchParams.get()` + comma-split), so `?tag=a&tag=b` silently
+  // filtered by `a` alone. Both forms accumulate now, and they compose.
+  test("GET /notes?tag=a&tag=b accumulates repeated params (vault#659)", async () => {
+    await store.createNote("only-a", { tags: ["ta"] });
+    await store.createNote("only-b", { tags: ["tb"] });
+    await store.createNote("neither", { tags: ["tc"] });
+    const res = await handleNotes(
+      mkReq("GET", "/notes?tag=ta&tag=tb&include_content=true"),
+      store,
+      "",
+    );
+    expect(res.status).toBe(200);
+    const body = await res.json() as any[];
+    // >1 tag without an explicit tag_match defaults to "any".
+    expect(body.map((n) => n.content).sort()).toEqual(["only-a", "only-b"]);
+  });
+
+  test("GET /notes?tag=a,b&tag=c mixes comma-list and repeated params (vault#659)", async () => {
+    await store.createNote("only-a", { tags: ["ma"] });
+    await store.createNote("only-b", { tags: ["mb"] });
+    await store.createNote("only-c", { tags: ["mc"] });
+    await store.createNote("neither", { tags: ["md"] });
+    const res = await handleNotes(
+      mkReq("GET", "/notes?tag=ma,mb&tag=mc&include_content=true"),
+      store,
+      "",
+    );
+    const body = await res.json() as any[];
+    expect(body.map((n) => n.content).sort()).toEqual(["only-a", "only-b", "only-c"]);
+  });
+
+  test("GET /notes?exclude_path_prefix repeated params accumulate (vault#659)", async () => {
+    await store.createNote("user", { path: "Projects/a" });
+    await store.createNote("sys", { path: ".parachute/notes/settings" });
+    await store.createNote("tmp", { path: "Scratch/x" });
+    const res = await handleNotes(
+      mkReq("GET", "/notes?exclude_path_prefix=.parachute/&exclude_path_prefix=Scratch/&include_content=true"),
+      store,
+      "",
+    );
+    const body = await res.json() as any[];
+    expect(body.map((n) => n.content)).toEqual(["user"]);
+  });
+
+  test("GET /notes?exclude_path_prefix mixes comma-list and repeated params (vault#659)", async () => {
+    await store.createNote("user", { path: "Projects/a" });
+    await store.createNote("sys", { path: ".parachute/notes/settings" });
+    await store.createNote("tmp", { path: "Scratch/x" });
+    await store.createNote("arch", { path: "Archive/old" });
+    const res = await handleNotes(
+      mkReq("GET", "/notes?exclude_path_prefix=.parachute/,Scratch/&exclude_path_prefix=Archive/&include_content=true"),
+      store,
+      "",
+    );
+    const body = await res.json() as any[];
+    expect(body.map((n) => n.content)).toEqual(["user"]);
+  });
+
+  // vault#659 — `_` is LIKE's single-char wildcard; an unescaped prefix
+  // silently pulled in neighbors that merely looked alike.
+  test("GET /notes?path_prefix=_tags/ escapes LIKE metachars (vault#659)", async () => {
+    await store.createNote("under", { path: "_tags/x" });
+    await store.createNote("decoy", { path: "atags/x" });
+    const res = await handleNotes(
+      mkReq("GET", "/notes?path_prefix=_tags/&include_content=true"),
+      store,
+      "",
+    );
+    const body = await res.json() as any[];
+    expect(body.map((n) => n.content)).toEqual(["under"]);
+  });
+
   test("GET /notes?include_metadata=false strips metadata from list", async () => {
     await store.createNote("a", { tags: ["m"], metadata: { summary: "hello", status: "ok" } });
     await store.createNote("b", { tags: ["m"], metadata: { summary: "world" } });