@openparachute/vault 0.7.9-rc.2 → 0.7.9-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.9-rc.2",
+  "version": "0.7.9-rc.4",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",
@@ -19,7 +19,7 @@
     "start": "bun src/server.ts",
     "cli": "bun src/cli.ts",
     "test": "bun test ./src/",
-    "test:core": "cd core && node --experimental-vm-modules node_modules/vitest/dist/cli.js run",
+    "test:core": "bun test ./core/src/",
     "typecheck": "tsc --noEmit",
     "build:spa": "cd web/ui && bun install --frozen-lockfile && bun run build",
     "prepack": "bun run build:spa"

package/src/aggregate-routes.test.ts

@@ -217,6 +217,82 @@ describe("REST GET /notes — aggregate: count without group_by (vault#626)", ()
   });
 });
 
+describe("REST GET /notes — the filtered total's filter surface IS the list's (vault#626)", () => {
+  /**
+   * vault#626 item 1 promises the ungrouped count runs over "the same filter
+   * surface as the list query". Today that holds by construction — both
+   * `queryNotes` and `aggregateNotes` build their WHERE from the shared
+   * `buildFilterConditions` (core/src/notes.ts) — but "by construction" is
+   * exactly the kind of fact a later refactor breaks silently: a filter
+   * handled OUTSIDE the shared builder would still narrow the list while the
+   * count kept reporting the unfiltered total, and every existing test here
+   * (which only exercises `tag`) would stay green.
+   *
+   * So: for each filter, assert `count == list.length` — and assert the
+   * filter actually NARROWED (`0 < n < TOTAL`), because a param that both
+   * paths ignore would satisfy the equality vacuously.
+   */
+  const TOTAL = 5;
+
+  async function seed(): Promise<void> {
+    await store.upsertTagRecord("task", { fields: { status: { type: "string", indexed: true } } });
+    // 1 + 2 are linked to each other (the [[wikilink]] resolves by path).
+    await store.createNote("alpha [[Projects/beta]]", {
+      path: "Projects/alpha",
+      tags: ["task", "work"],
+      metadata: { status: "open" },
+    });
+    await store.createNote("beta", { path: "Projects/beta", tags: ["task"], metadata: { status: "done" } });
+    await store.createNote("gamma", { path: "Archive/gamma", tags: ["work"] });
+    await store.createNote("delta", { path: "Archive/delta", tags: ["work"] });
+    await store.createNote("untagged epsilon", { path: "Archive/epsilon" });
+  }
+
+  async function listLength(qs: string): Promise<number> {
+    const res = await get(`?${qs}&limit=500`);
+    expect(res.status).toBe(200);
+    return ((await res.json()) as any[]).length;
+  }
+
+  async function count(qs: string): Promise<number> {
+    const res = await get(`?${qs}&aggregate[op]=count`);
+    expect(res.status).toBe(200);
+    const body: any = await res.json();
+    expect(body).toHaveLength(1);
+    expect(body[0].group).toBeNull();
+    return body[0].value;
+  }
+
+  const CASES: [name: string, qs: string][] = [
+    ["tag", "tag=task"],
+    ["tag + tag_match=all", "tag=task&tag=work&tag_match=all"],
+    ["exclude_tag", "exclude_tag=work"],
+    ["has_tags=false", "has_tags=false"],
+    ["has_links=true", "has_links=true"],
+    ["path_prefix", "path_prefix=Projects/"],
+    ["exclude_path_prefix", "exclude_path_prefix=Projects/"],
+    ["meta[field][op]", "meta[status][eq]=open"],
+  ];
+
+  it("the unfiltered total matches the unfiltered list", async () => {
+    await seed();
+    expect(await count("")).toBe(TOTAL);
+    expect(await listLength("")).toBe(TOTAL);
+  });
+
+  for (const [name, qs] of CASES) {
+    it(`${name}: count == list length, and the filter really narrowed`, async () => {
+      await seed();
+      const n = await listLength(qs);
+      // Non-vacuity: a param both paths silently ignored would make the
+      // equality below trivially true.
+      expect(n).toBeGreaterThan(0);
+      expect(n).toBeLessThan(TOTAL);
+      expect(await count(qs)).toBe(n);
+    });
+  }
+});
+
 describe("REST GET /notes — aggregate: group_by \"tag\"", () => {
   it("counts by tag membership", async () => {
     await store.createNote("a", { tags: ["work", "urgent"] });

package/src/config.ts

@@ -187,7 +187,7 @@ export interface TagSchema {
 
 export interface VaultConfig {
   name: string;
-  description?: string;
+  description?: string | null;
   api_keys: StoredKey[];
   created_at: string;
   tag_schemas?: Record<string, TagSchema>;
@@ -516,7 +516,13 @@ export function defaultBackupConfig(): BackupConfig {
 function serializeVaultConfig(config: VaultConfig): string {
   const lines: string[] = [];
   lines.push(`name: ${config.name}`);
-  if (config.description) {
+  // vault#669: only serialize a real string. A non-string that slipped
+  // past a write door used to throw here (`description.split is not a
+  // function`) and 500 the request; the doors now reject that shape, and
+  // this is the persist-time backstop so a poisoned in-memory config
+  // cannot crash the write path either. Falsy / non-string omits the
+  // field, which is how a `null` description clears.
+  if (typeof config.description === "string" && config.description.length > 0) {
     lines.push(`description: |`);
     for (const line of config.description.split("\n")) {
       lines.push(`  ${line}`);

package/src/mcp-http.test.ts

@@ -19,11 +19,21 @@
  * do — `McpError` is only ever constructed inside `mcp-http.ts` itself).
  */
 import { describe, test, expect } from "bun:test";
+import { Database } from "bun:sqlite";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { handleMcp, mcpDomainError } from "./mcp-http.ts";
-import type { McpToolDef } from "../core/src/mcp.ts";
+import { generateMcpTools, type McpToolDef } from "../core/src/mcp.ts";
+import { SqliteStore } from "../core/src/store.ts";
 import type { AuthResult } from "./auth.ts";
 
+interface ToolErrorResponse {
+  error: {
+    code: number;
+    message: string;
+    data: Record<string, unknown>;
+  };
+}
+
 function toolsWith(execute: (params: Record<string, unknown>) => unknown): () => McpToolDef[] {
   return () => [
     {
@@ -64,6 +74,29 @@ async function callBoom(execute: (params: Record<string, unknown>) => unknown):
   return res.json();
 }
 
+async function callNoteToolWithoutId(
+  name: "update-note" | "delete-note",
+): Promise<ToolErrorResponse> {
+  const db = new Database(":memory:");
+  try {
+    const store = new SqliteStore(db);
+    const req = new Request("http://localhost:1940/vault/v/mcp", {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/call",
+        params: { name, arguments: {} },
+      }),
+    });
+    const res = await handleMcp(req, () => generateMcpTools(store), "test-server", "v", fullAuth(), "");
+    return (await res.json()) as ToolErrorResponse;
+  } finally {
+    db.close();
+  }
+}
+
 describe("MCP SDK McpError — confirms the mechanics this fix depends on", () => {
   test("the SDK bakes the JSON-RPC prefix into .message itself, not just .toString()", () => {
     const err = new McpError(ErrorCode.InvalidParams, "bad stuff happened", { error_type: "invalid_query" });
@@ -150,3 +183,20 @@ describe("handleMcp JSON-RPC error mapping — end to end (vault#555 fix 6)", ()
     expect(body.result.content[0].text).toContain("plain unstructured failure");
   });
 });
+
+describe("note mutation tools require an id (vault#705)", () => {
+  for (const name of ["update-note", "delete-note"] as const) {
+    test(`${name} without id returns structured invalid params, never a TypeError`, async () => {
+      const body = await callNoteToolWithoutId(name);
+
+      expect(body.error.code).toBe(ErrorCode.InvalidParams);
+      expect(body.error.data).toMatchObject({
+        error_type: "missing_required_field",
+        field: "id",
+        hint: expect.stringContaining("path"),
+      });
+      expect(body.error.message).not.toContain("TypeError");
+      expect(body.error.message).not.toContain("idOrPath.match");
+    });
+  }
+});

package/src/mcp-tools.ts

@@ -8,6 +8,7 @@
 import { generateMcpTools } from "../core/src/mcp.ts";
 import type { McpToolDef, GenerateMcpToolsOpts } from "../core/src/mcp.ts";
 import { getNoteTags, getVaultMap } from "../core/src/notes.ts";
+import { narrowLinkWarningsForVisibility } from "../core/src/wikilinks.ts";
 import type { Note } from "../core/src/types.ts";
 import {
   buildVaultProjection,
@@ -23,6 +24,7 @@ import {
   expandTokenTagScope,
   filterHydratedLinksByTagScope,
   noteWithinTagScope,
+  scopeQueryTagParam,
   scrubIndexedFieldConflictError,
   scrubNoteTagsByScope,
   scrubParentCycleError,
@@ -211,6 +213,24 @@ export function generateScopedMcpTools(
         )
     : undefined;
 
+  // Tag-scope guard for the ambiguous-links surface (vault#581 auth review):
+  // `candidate_count` is derived vault-wide, so without this a `work`-scoped
+  // reader learns from `candidate_count: 2` on its own `[[Dup]]` that a
+  // second `Dup` exists in a scope it cannot see — and `has_ambiguous_links:
+  // true` turns that into a standing, sweepable census of cross-scope naming
+  // collisions. Identical closure/shape to `nearTraversable` above (by note
+  // id, tags looked up sync + core-native); core narrows each row's
+  // candidates through it. Unscoped sessions install no predicate, so the
+  // persisted counts and the SQL filter answer directly, unchanged.
+  const ambiguityVisible = scoped
+    ? (noteId: string) =>
+        noteWithinTagScope(
+          { id: noteId, tags: getNoteTags(store.db, noteId) } as Note,
+          allowedHolder.value,
+          rawTags,
+        )
+    : undefined;
+
   // Tag-scope guard for `create-note` `if_exists` (vault#555 auth-review
   // must-fix): the core `if_exists` upsert resolves the target path VAULT-WIDE
   // and returns/updates/replaces the found note, so a scoped caller could
@@ -274,6 +294,7 @@ export function generateScopedMcpTools(
     ...(nearTraversable ? { nearTraversable } : {}),
     ...(ifExistsVisible ? { ifExistsVisible } : {}),
     ...(aggregateVisibility ? { aggregateVisibility } : {}),
+    ...(ambiguityVisible ? { ambiguityVisible } : {}),
     ...(writeContext ? { writeContext } : {}),
     ...(strictBypass ? { strictBypass } : {}),
     ...(onStrictBypass ? { onStrictBypass } : {}),
@@ -439,6 +460,38 @@ function applyTagScopeWrappers(
     return scrubNoteTagsByScope(n, allowedHolder?.value ?? null, rawTags);
   };
 
+  /**
+   * Re-decide a write response's `ambiguous_link` warnings against the
+   * caller's OWN sub-vault (vault#707's rule, write side). `candidate_count`
+   * is derived vault-wide, so a `work`-scoped writer saving `[[Dup]]` would
+   * otherwise learn from `candidate_count: 2` that a second `Dup` exists in a
+   * scope it cannot see — the same oracle vault#707 closed on `query-notes`,
+   * reachable through `create-note` / `update-note` instead. Same visibility
+   * model as `ambiguityVisible` / `nearTraversable` in generateScopedMcpTools
+   * (`noteWithinTagScope` by note id), and the same decision function in core
+   * (`visibleResolutionCount`), so the surfaces cannot drift.
+   *
+   * Ordering: identical to `scrubNoteForScope` above — every write wrapper
+   * `await getAllowed()`s before `orig(params)`, so `allowedHolder.value` is
+   * the resolved allowlist by the time this runs.
+   */
+  const scrubWriteNote = (n: any): any => {
+    const scrubbed = scrubNoteForScope(n);
+    if (!scrubbed || !Array.isArray(scrubbed.warnings)) return scrubbed;
+    const visible = (noteId: string) =>
+      noteWithinTagScope(
+        { id: noteId, tags: getNoteTags(store.db, noteId) } as Note,
+        allowedHolder?.value ?? null,
+        rawTags,
+      );
+    const warnings = narrowLinkWarningsForVisibility(store.db, scrubbed.warnings, visible);
+    if (warnings.length === 0) {
+      const { warnings: _dropped, ...rest } = scrubbed;
+      return rest;
+    }
+    return { ...scrubbed, warnings };
+  };
+
   /**
    * Shape dispatcher for the WRITE tools (vault#568). `create-note` and
    * `update-note` echo the stored note, so they leak exactly what the read
@@ -449,18 +502,46 @@ function applyTagScopeWrappers(
    */
   const scrubWriteResult = (result: any): any => {
     if (!result || typeof result !== "object") return result;
-    if (Array.isArray(result)) return result.map(scrubNoteForScope);
+    if (Array.isArray(result)) return result.map(scrubWriteNote);
     if ("error" in result) return result;
     if (Array.isArray((result as any).notes)) {
-      return { ...result, notes: (result as any).notes.map(scrubNoteForScope) };
+      return { ...result, notes: (result as any).notes.map(scrubWriteNote) };
     }
-    if ("id" in result && "tags" in result) return scrubNoteForScope(result);
+    if ("id" in result && "tags" in result) return scrubWriteNote(result);
     return result;
   };
 
+  /**
+   * Neutralise out-of-scope tags NAMED IN THE QUERY (vault#675) before core
+   * ever runs. Without this a scoped session could ask `query-notes { tag:
+   * "project-manhattan" }` and read the answer off hit/miss — a co-tagged
+   * note is in scope via its OTHER tag, so it survived the result filter
+   * below and confirmed the guessed name. Rewriting the input (rather than
+   * emptying the output) keeps the response byte-identical to the same call
+   * naming a tag that doesn't exist, in every shape this tool returns —
+   * including the `aggregate` rollup and the `next_cursor` envelope, which
+   * an output-side patch could not reproduce. `exclude_tags` is rewritten on
+   * the same terms (core skips an exclude clause that can't match, so it
+   * excludes nothing — again exactly a nonexistent tag). Aliases mirror
+   * core's `exclude_tags ?? excludeTags ?? exclude_tag` resolution order.
+   */
+  const QUERY_TAG_PARAMS = ["tag", "exclude_tags", "excludeTags", "exclude_tag"] as const;
+  const scopeQueryTagParams = (params: any, allowed: Set<string> | null): any => {
+    if (!params || typeof params !== "object") return params;
+    let next = params;
+    for (const key of QUERY_TAG_PARAMS) {
+      if (params[key] === undefined) continue;
+      const scoped = scopeQueryTagParam(params[key], allowed, rawTags);
+      if (scoped === params[key]) continue;
+      if (next === params) next = { ...params };
+      next[key] = scoped;
+    }
+    return next;
+  };
+
   wrapReadTool(tools, "query-notes", async (orig, params) => {
     const allowed = await getAllowed();
-    const result = await orig(params);
+    const result = await orig(scopeQueryTagParams(params, allowed));
     if (!allowed) return result;
     // `aggregate` mode returns `[{group, value}]` rollup rows — no `.tags`
     // to post-filter (and `noteWithinTagScope` would wrongly drop every
@@ -863,7 +944,27 @@ function overrideVaultInfo(
           `Forbidden: updating the vault description requires the 'vault:admin' scope (or 'vault:${vaultName}:admin'). Granted scopes: ${auth?.scopes.join(" ") || "(none)"}.`,
         );
       }
-      config.description = params.description as string;
+      // vault#669: runtime type guard — the `as string` cast below was a
+      // compile-time claim guarding nothing, so a write/admin caller could
+      // persist a non-string `description` (or crash serializeVaultConfig
+      // with `description.split is not a function`) and poison the NEXT
+      // MCP `initialize` (projectionToMarkdown's `description.trim()`).
+      // Reject non-string/non-null here as a structured invalid-params
+      // error: a duck-typed `error_type` throw, which src/mcp-http.ts's
+      // generic branch turns into JSON-RPC -32602 INVALID_PARAMS carrying
+      // structured `data` — the same shape core's own validation leaves
+      // take, no new error family. `null` stays legal: it clears the
+      // description. Cross-door parity with cloud#263 (closes the bun
+      // half of cloud#87).
+      if (params.description !== null && typeof params.description !== "string") {
+        throw Object.assign(new Error("description must be a string or null"), {
+          error_type: "invalid_description",
+          field: "description",
+          got: params.description,
+          hint: "pass a string, or null to clear the description",
+        });
+      }
+      config.description = params.description as string | null;
       writeVaultConfig(config);
     }
 

package/src/mirror-routes.test.ts

@@ -440,6 +440,53 @@ describe("handleMirrorPut", () => {
     expect(manager.getConfig().safety_net_seconds).toBe(120);
     await manager.stop();
   });
+
+  test("two concurrent PUTs both 200 and leave a live watcher (safety envelope, vault#662)", async () => {
+    // From #661's review: the serialized sibling above soundly proves the
+    // only promised behavior (sequential last-writer-wins). Concurrent
+    // execution still has residual value — both PUTs 200, watcher stays
+    // live, final safety_net_seconds is one of the two requested values.
+    // The product makes no concurrent-winner promise, so we do not assert
+    // which config won.
+    home = tmp("mirror-put-concurrent-");
+    const { manager } = makeManager(home);
+    const put = (body: Record<string, unknown>) =>
+      handleMirrorPut(
+        new Request("http://x/admin/mirror", {
+          method: "PUT",
+          body: JSON.stringify(body),
+        }),
+        manager,
+      );
+    const [res1, res2] = await Promise.all([
+      put({
+        enabled: true,
+        location: "internal",
+        sync_mode: "events",
+        auto_commit: false,
+        safety_net_seconds: 60,
+      }),
+      put({
+        enabled: true,
+        location: "internal",
+        sync_mode: "events",
+        auto_commit: false,
+        safety_net_seconds: 120,
+      }),
+    ]);
+    expect(res1.status).toBe(200);
+    expect(res2.status).toBe(200);
+    const status = manager.getStatus();
+    expect(status.enabled).toBe(true);
+    expect(status.watch_running).toBe(true);
+    expect([60, 120]).toContain(manager.getConfig().safety_net_seconds);
+    // Concurrent start() can re-arm timers after the other PUT's stop().
+    // Drain once more so this test cannot leak a safety-net interval into
+    // the rest of the suite.
+    await new Promise((r) => setTimeout(r, 50));
+    await manager.stop();
+    await manager.stop();
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/release-plan.test.ts

@@ -11,8 +11,10 @@
 import { describe, expect, test } from "bun:test";
 import {
   compareVersions,
+  coreVersion,
   decidePublish,
   distTagFor,
+  matchingRcVersions,
   readRegistry,
   unpublishedDrift,
 } from "../scripts/release-plan.ts";
@@ -193,13 +195,81 @@ describe("decidePublish", () => {
       {
         versionExists: false,
         currentDistTagVersion: "0.7.8",
-        publishedVersions: ["0.7.8"],
+        publishedVersions: ["0.7.8", "0.7.9-rc.1"],
       },
       { branch: "main" },
     );
     expect(d).toMatchObject({ publish: true });
   });
 
+  test("a stable without a matching rc is refused — vault#697", () => {
+    // Hub 0.7.13–0.7.16 shipped @latest with no rc of the same X.Y.Z.
+    // Vault's previous plan (and the inline shell it replaced) did the same.
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+        publishedVersions: ["0.7.8", "0.7.8-rc.2"],
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ refuse: true });
+    expect("refuse" in d && d.reason).toMatch(/0\.7\.9-rc/);
+    expect("refuse" in d && d.reason).toMatch(/suffix-drop|Cut an rc first/i);
+  });
+
+  test("a stable whose only published rcs are a different X.Y.Z is still refused", () => {
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+        publishedVersions: ["0.7.8", "0.7.8-rc.1"],
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ refuse: true });
+  });
+
+  test("a stable with a matching rc publishes from main", () => {
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+        publishedVersions: ["0.7.8", "0.7.9-rc.1"],
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ publish: true });
+  });
+
+  test("omitted publishedVersions still refuses a stable when latest already exists", () => {
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ refuse: true });
+  });
+
+  test("an rc publishes even with no prior rc of the same core", () => {
+    const d = decidePublish(
+      "0.7.9-rc.1",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8-rc.5",
+        publishedVersions: ["0.7.8", "0.7.8-rc.5"],
+      },
+      { branch: "next" },
+    );
+    expect(d).toMatchObject({ publish: true });
+  });
+
   test("a tag push of a stable does NOT override the main-only gate", () => {
     const d = decidePublish(
       "0.7.9",
@@ -281,6 +351,25 @@ describe("readRegistry", () => {
   });
 });
 
+describe("matchingRcVersions", () => {
+  test("matches only the same X.Y.Z rc chain", () => {
+    expect(
+      matchingRcVersions("0.7.9", ["0.7.8", "0.7.8-rc.1", "0.7.9-rc.1", "0.7.9-rc.2"]),
+    ).toEqual(["0.7.9-rc.1", "0.7.9-rc.2"]);
+  });
+
+  test("a prerelease still matches siblings of its core", () => {
+    expect(matchingRcVersions("0.7.9-rc.3", ["0.7.9-rc.1", "0.7.8-rc.1"])).toEqual(["0.7.9-rc.1"]);
+  });
+});
+
+describe("coreVersion", () => {
+  test("strips the rc suffix and leaves a stable alone", () => {
+    expect(coreVersion("0.7.9-rc.1")).toBe("0.7.9");
+    expect(coreVersion("0.7.9")).toBe("0.7.9");
+  });
+});
+
 describe("unpublishedDrift", () => {
   test("no commits → not drifted", () => {
     expect(unpublishedDrift([]).drifted).toBe(false);