@openparachute/vault 0.7.9-rc.6 → 0.7.9-rc.8

package/core/src/history-capture.test.ts

@@ -86,9 +86,17 @@ it("P5 restore reads its source before a one-version prune", async () => {
   });
   const n = await store.createNote("one");
   await store.updateNote(n.id, { content: "two" });
-  expect((await store.restoreNoteVersion(n.id, 0, {})).content).toBe("one");
+  expect((await store.restoreNoteVersion(n.id, 0, { if_updated_at: (await store.getNote(n.id))!.updatedAt })).content).toBe("one");
   expect(await store.listNoteVersions(n.id)).toHaveLength(1);
 });
+it("live restore requires a precondition and leaves current note and history unchanged without one", async () => {
+  const n = await store.createNote("old");
+  await store.updateNote(n.id, { content: "new" });
+  const before = await store.getNote(n.id), versions = await store.listNoteVersions(n.id);
+  await expect(store.restoreNoteVersion(n.id, 0, {})).rejects.toMatchObject({ code: "PRECONDITION_REQUIRED" });
+  expect(await store.getNote(n.id)).toEqual(before);
+  expect(await store.listNoteVersions(n.id)).toEqual(versions);
+});
 it("P8a tag rename captures only rewritten notes", async () => {
   await store.upsertTagRecord("old", {});
   const a = await store.createNote("#old a"),

package/core/src/history-visibility.test.ts

@@ -0,0 +1,11 @@
+import { test, expect } from "bun:test";
+import { projectHistoryProvenance } from "./history-visibility.ts";
+
+test("history redaction removes only transport provenance without mutating stored data", () => {
+  const row = Object.freeze({ actor: "editor", via: "api", content: "editor mentioned in text",
+    metadata: { actor: "user-authored value" }, origin: "git-import", import_ix: 0 });
+  expect(projectHistoryProvenance(row, false)).toBe(row);
+  expect(projectHistoryProvenance(row, true)).toEqual({ content: row.content, metadata: row.metadata,
+    origin: "git-import", import_ix: 0 });
+  expect(row.actor).toBe("editor");
+});

package/core/src/history-visibility.ts

@@ -0,0 +1,9 @@
+/** Response-only redaction; never remove stored provenance or rewrite note content.
+ * Tag-restricted sessions do not receive historical editor/interface identities.
+ * The transport must establish note visibility before applying this projection.
+ */
+export function projectHistoryProvenance<T extends object>(row: T, restricted: boolean): T | Omit<T, "actor" | "via"> {
+  if (!restricted) return row;
+  const { actor: _actor, via: _via, ...visible } = row as T & { actor?: unknown; via?: unknown };
+  return visible;
+}

package/core/src/history.test.ts

@@ -227,3 +227,60 @@ describe("vault#524 history retention and blob integrity", () => {
     expect(await store.getNote(n.id)).toBeNull();
   });
 });
+
+describe("vault#743 whole-blob integrity", () => {
+  it("reads valid whole blobs including empty and multibyte text", async () => {
+    const empty = await store.createNote("placeholder");
+    await store.updateNote(empty.id, { content: "" });
+    await store.updateNote(empty.id, { content: "final" });
+    expect((await store.getNoteVersion(empty.id, 1))!.content).toBe("");
+
+    const multi = await store.createNote("é".repeat(1000));
+    await store.updateNote(multi.id, { content: "next" });
+    expect((await store.getNoteVersion(multi.id, 0))!.content).toBe("é".repeat(1000));
+
+    const plain = await store.createNote("whole body");
+    await store.updateNote(plain.id, { content: "updated" });
+    expect((await store.getNoteVersion(plain.id, 0))!.content).toBe("whole body");
+  });
+  it("rejects a corrupted whole blob on direct read", async () => {
+    const n = await store.createNote("original");
+    await store.updateNote(n.id, { content: "live" });
+    const hash = (await store.listNoteVersions(n.id))[0]!.content_hash;
+    db.prepare("UPDATE note_blobs SET content = ? WHERE hash = ?").run(
+      "tampered",
+      hash,
+    );
+    expect(() => history!.readBlobContent(db, hash!)).toThrow(
+      history!.HistoryDeltaOrphanError,
+    );
+  });
+  it("rejects a corrupted whole blob through version read", async () => {
+    const n = await store.createNote("original");
+    await store.updateNote(n.id, { content: "live" });
+    const hash = (await store.listNoteVersions(n.id))[0]!.content_hash;
+    db.prepare("UPDATE note_blobs SET content = ? WHERE hash = ?").run(
+      "tampered",
+      hash,
+    );
+    await expect(store.getNoteVersion(n.id, 0)).rejects.toMatchObject({
+      code: "HISTORY_UNRECOVERABLE",
+      reason: "delta_orphan",
+    });
+  });
+  it("rejects restoring a corrupted whole blob and leaves live note and history unchanged", async () => {
+    const n = await store.createNote("original");
+    await store.updateNote(n.id, { content: "live" });
+    const versionsBefore = await store.listNoteVersions(n.id);
+    const hash = versionsBefore[0]!.content_hash;
+    db.prepare("UPDATE note_blobs SET content = ? WHERE hash = ?").run(
+      "tampered",
+      hash,
+    );
+    await expect(store.restoreNoteVersion(n.id, 0, {})).rejects.toMatchObject({
+      code: "HISTORY_UNRECOVERABLE",
+    });
+    expect((await store.getNote(n.id))!.content).toBe("live");
+    expect(await store.listNoteVersions(n.id)).toEqual(versionsBefore);
+  });
+});

package/core/src/history.ts

@@ -119,6 +119,14 @@ export class HistoryUnrecoverableError extends Error {
     this.name = "HistoryUnrecoverableError";
   }
 }
+export class HistoryPreconditionRequiredError extends Error {
+  readonly code = "PRECONDITION_REQUIRED";
+  readonly error_type = "precondition_required";
+  constructor(readonly note_id: string) {
+    super("Restoring an existing note requires if_updated_at from the note you reviewed.");
+  }
+}
+
 export class HistoryNotFoundError extends Error {
   code = "HISTORY_NOT_FOUND" as const;
   note_id: string;
@@ -438,8 +446,11 @@ interface BlobReadRow {
 function materialise(db: Database, hash: string, row: BlobReadRow): string | null {
   if (row.content === null)
     return null;
-  if (row.blob_encoding === null)
+  if (row.blob_encoding === null) {
+    if (hashContent(row.content) !== hash)
+      throw new HistoryDeltaOrphanError(hash, row.delta_of, "identity_mismatch");
     return row.content;
+  }
   if (row.blob_encoding !== "fossil-delta")
     throw new HistoryDeltaOrphanError(hash, row.delta_of, "unknown_encoding");
   const base = row.delta_of ? db.prepare("SELECT content, encoding FROM note_blobs WHERE hash = ?").get(row.delta_of) as {

package/core/src/store.ts

@@ -1,4 +1,5 @@
 import { Database } from "bun:sqlite";
+import { HistoryPreconditionRequiredError } from "./history.js";
 import type { Store, Note, Link, Attachment, QueryOpts, QueryNotesPage, AggregateRow, SemanticSearchResult } from "./types.js";
 import { compactNote, compactVault, countNoteVersions, type CompactResult, type CompactSummary, captureVersion, readPriorNoteRow, resolveHistoryPolicy, appendRestoreMarker, listVersions, getVersion, latestTombstone, eraseHistory, sweepDeletedHistory, deletedHistoryStats, HistoryNotFoundError, HistoryOverflowError, HistoryUnrecoverableError, DEFAULT_HISTORY_POLICY, VERSION_MAX_BYTES, type VersionRow, type HistoryPolicy, type HistoryOp } from "./history.js";
 import { initSchema } from "./schema.js";
@@ -834,6 +835,7 @@ export class BunSqliteStore implements Store {
       const v = getVersion(this.db, id, versionIx);
       if (!v) throw new HistoryNotFoundError(id, versionIx);
       if (v.encoding === "overflow") throw new HistoryUnrecoverableError(id, versionIx);
+      if (opts.if_updated_at === undefined) throw new HistoryPreconditionRequiredError(id);
       return await this.updateNote(id, {
         content: v.content!, metadata: v.metadata, extension: v.extension ?? undefined,
         actor: opts.actor ?? null, via: opts.via ?? null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.9-rc.6",
+  "version": "0.7.9-rc.8",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/attachment-tickets.test.ts

@@ -29,6 +29,7 @@ const { handleScopedMcp } = await import("./mcp-http.ts");
 const { getServerInstruction } = await import("./mcp-tools.ts");
 const { writeVaultConfig } = await import("./config.ts");
 const { getVaultStore } = await import("./vault-store.ts");
+const { clearScribeUrlCache } = await import("./scribe-discovery.ts");
 const {
   getSharedAttachmentTicketProvider,
   InProcessAttachmentTicketProvider,
@@ -275,33 +276,54 @@ describe("attachment tickets — upload lifecycle", () => {
   // exactly what a new box looks like. The upload must not come back looking
   // like an ordinary file: it carries a `failed` status and an actionable
   // reason, so the state is visible in the API and the admin SPA.
-  test("audio + auto-transcribe on + NO provider → attachment records the failure, not silence", async () => {
-    const vaultName = freshVault("tickets-no-provider");
-    const store = getVaultStore(vaultName);
-    const note = await store.createNote("# Voice memo\n", { path: "memo-noprov" });
-
-    const mint = await callTool(vaultName, "request-attachment-upload", {
-      note: note.id,
-      filename: "memo.webm",
-      size_bytes: 4,
-      // NO `transcribe: true` — this is the AUTO path, the one that used to
-      // silently do nothing.
-    });
-    const res = await routeReq(
-      new Request(mint.url, {
-        method: "PUT",
-        headers: { "content-type": "audio/webm" },
-        body: new Uint8Array([1, 2, 3, 4]),
-      }),
-    );
-    expect(res.status).toBe(201);
-    const attachment = (await res.json()) as any;
-    expect(attachment.metadata.transcribe_status).toBe("failed");
-    expect(attachment.metadata.transcribe_error).toMatch(/no transcription provider configured/i);
-    // The reason has to be actionable — naming both routes out of it.
-    expect(attachment.metadata.transcribe_error).toMatch(/TRANSCRIPTION_PROVIDER/);
-    expect(attachment.metadata.transcribe_error).toMatch(/SCRIBE_URL/);
-    expect(attachment.metadata.transcribe_origin).toBe("auto");
+  //
+  // Fixture: select the remote provider so the presence/absence of a local
+  // whisper-cpp install on the host cannot change the message. With no
+  // SCRIBE_URL configured, auto-transcribe is still unavailable and reports
+  // the same actionable no-provider error on every box.
+  test("audio + auto-transcribe on + scribe-http without URL → attachment records the failure, not silence", async () => {
+    const prevProvider = process.env.TRANSCRIPTION_PROVIDER;
+    const prevScribeUrl = process.env.SCRIBE_URL;
+    process.env.TRANSCRIPTION_PROVIDER = "scribe-http";
+    delete process.env.SCRIBE_URL;
+    clearScribeUrlCache();
+    try {
+      const vaultName = freshVault("tickets-no-provider");
+      const store = getVaultStore(vaultName);
+      const note = await store.createNote("# Voice memo\n", { path: "memo-noprov" });
+
+      const mint = await callTool(vaultName, "request-attachment-upload", {
+        note: note.id,
+        filename: "memo.webm",
+        size_bytes: 4,
+        // NO `transcribe: true` — this is the AUTO path, the one that used to
+        // silently do nothing.
+      });
+      const res = await routeReq(
+        new Request(mint.url, {
+          method: "PUT",
+          headers: { "content-type": "audio/webm" },
+          body: new Uint8Array([1, 2, 3, 4]),
+        }),
+      );
+      expect(res.status).toBe(201);
+      const attachment = (await res.json()) as any;
+      expect(attachment.metadata.transcribe_status).toBe("failed");
+      expect(attachment.metadata.transcribe_error).toMatch(/no transcription provider configured/i);
+      // The reason has to be actionable — naming both routes out of it.
+      expect(attachment.metadata.transcribe_error).toMatch(/TRANSCRIPTION_PROVIDER/);
+      expect(attachment.metadata.transcribe_error).toMatch(/SCRIBE_URL/);
+      expect(attachment.metadata.transcribe_origin).toBe("auto");
+      const unchanged = await store.getNote(note.id);
+      expect(unchanged!.content).toBe("# Voice memo\n");
+      expect((unchanged!.metadata as any)?.transcribe_stub).toBeUndefined();
+    } finally {
+      if (prevProvider === undefined) delete process.env.TRANSCRIPTION_PROVIDER;
+      else process.env.TRANSCRIPTION_PROVIDER = prevProvider;
+      if (prevScribeUrl === undefined) delete process.env.SCRIBE_URL;
+      else process.env.SCRIBE_URL = prevScribeUrl;
+      clearScribeUrlCache();
+    }
   });
 
   // The counter-case: turning auto-transcribe OFF must stay silent. The

package/src/auto-transcribe-integration.test.ts

@@ -0,0 +1,82 @@
+import { test, expect } from "bun:test";
+import { writeVaultConfig } from "./config.ts";
+import { getVaultStore, defaultHookRegistry } from "./vault-store.ts";
+import { handleNotes } from "./routes.ts";
+import { handleScopedMcp } from "./mcp-http.ts";
+import { route } from "./routing.ts";
+import { registerTranscriptionHook } from "./transcription-worker.ts";
+import { getTranscriptionWorker, getTranscriptionWorkerProvider, setTranscriptionWorker } from "./transcription-registry.ts";
+
+// Fake the wired worker, not module imports or real ASR. Exercise both upload
+// doors and the actual attachment-created hook without network/subprocess work.
+for (const door of ["rest", "ticket"] as const) {
+  for (const mode of ["local", "remote", "missing", "mismatch", "unready", "disabled", "explicit", "non-audio"] as const) {
+    test(`${door}: ${mode} automatic worker eligibility`, async () => {
+      const previous = { provider: process.env.TRANSCRIPTION_PROVIDER, url: process.env.SCRIBE_URL, model: process.env.TRANSCRIPTION_MODEL, assets: process.env.ASSETS_DIR };
+      const oldWorker = getTranscriptionWorker();
+      const oldProvider = getTranscriptionWorkerProvider();
+      const vault = `auto-worker-${crypto.randomUUID()}`;
+      const kicks: string[] = [];
+      const worker = { stop: async () => {}, tick: async () => 0,
+        kick: async (_vault: string, attachment: { id: string }) => { kicks.push(attachment.id); } };
+      writeVaultConfig({ name: vault, api_keys: [], created_at: new Date().toISOString(),
+        auto_transcribe: { enabled: mode !== "disabled" && mode !== "explicit" } });
+      const store = getVaultStore(vault);
+      const unregister = registerTranscriptionHook(defaultHookRegistry, worker, (s) => s === store ? vault : undefined);
+      try {
+        // Sibling files may set a process-global storage root. These uploads
+        // belong only to this unique vault, not that shared test directory.
+        delete process.env.ASSETS_DIR;
+        process.env.TRANSCRIPTION_PROVIDER = mode === "remote" ? "scribe-http" : mode === "unready" ? "whisper-cpp" : "transcribe-cpp";
+        // A stale URL must never make an absent/mismatched local worker ready.
+        if (mode === "local") delete process.env.SCRIBE_URL;
+        else process.env.SCRIBE_URL = "http://unused.invalid";
+        if (mode === "unready") process.env.TRANSCRIPTION_MODEL = "not-a-real-model";
+        setTranscriptionWorker(mode === "missing" ? null : worker,
+          mode === "mismatch" ? "scribe-http" : process.env.TRANSCRIPTION_PROVIDER);
+        const note = await store.createNote("original body", { path: "memo" });
+        const mime = mode === "non-audio" ? "image/png" : "audio/wav";
+        let response: Response;
+        if (door === "rest") {
+          response = await handleNotes(new Request(`http://localhost/notes/${note.id}/attachments`, {
+            method: "POST", headers: { "content-type": "application/json" },
+            body: JSON.stringify({ path: "memos/audio.wav", mimeType: mime,
+              ...(mode === "explicit" ? { transcribe: true } : {}) }),
+          }), store, `/${note.id}/attachments`, vault);
+        } else {
+          const mint = await handleScopedMcp(new Request(`http://localhost/vault/${vault}/mcp`, {
+            method: "POST", headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: {
+              name: "request-attachment-upload", arguments: { note: note.id, filename: "memo.wav", size_bytes: 4,
+                mime_type: mime, ...(mode === "explicit" ? { transcribe: true } : {}) },
+            } }),
+          }), vault, { permission: "full", scopes: ["vault:read", "vault:write"], legacyDerived: false, scoped_tags: null } as any);
+          const rpc = await mint.json() as any;
+          expect(rpc.error).toBeUndefined();
+          const ticket = JSON.parse(rpc.result.content[0].text);
+          const req = new Request(ticket.url, { method: "PUT", headers: { "content-type": mime }, body: new Uint8Array([1, 2, 3, 4]) });
+          response = await route(req, new URL(req.url).pathname);
+        }
+        expect(response.status).toBe(201);
+        const attachment = await response.json() as any;
+        await defaultHookRegistry.drain();
+        const eligible = ["local", "remote", "explicit"].includes(mode);
+        const unavailable = ["missing", "mismatch", "unready"].includes(mode);
+        expect(attachment.metadata?.transcribe_status).toBe(eligible ? "pending" : unavailable ? "failed" : undefined);
+        expect(kicks).toEqual(eligible ? [attachment.id] : []);
+        if (unavailable) expect(attachment.metadata.transcribe_error).toContain("transcription status");
+        if (eligible || unavailable) expect(attachment.metadata.transcribe_origin).toBe(mode === "explicit" ? "legacy" : "auto");
+        const current = await store.getNote(note.id);
+        expect(current!.content).toBe("original body");
+        if (mode !== "explicit") expect((current!.metadata as any)?.transcribe_stub).toBeUndefined();
+      } finally {
+        await defaultHookRegistry.drain();
+        unregister();
+        setTranscriptionWorker(oldWorker, oldProvider);
+        for (const [key, value] of [["TRANSCRIPTION_PROVIDER", previous.provider], ["SCRIBE_URL", previous.url], ["TRANSCRIPTION_MODEL", previous.model], ["ASSETS_DIR", previous.assets]] as const) {
+          if (value === undefined) delete process.env[key]; else process.env[key] = value;
+        }
+      }
+    });
+  }
+}