@openparachute/vault 0.7.9-rc.7 → 0.7.9-rc.8

package/core/src/history-capture.test.ts

@@ -86,9 +86,17 @@ it("P5 restore reads its source before a one-version prune", async () => {
   });
   const n = await store.createNote("one");
   await store.updateNote(n.id, { content: "two" });
-  expect((await store.restoreNoteVersion(n.id, 0, {})).content).toBe("one");
+  expect((await store.restoreNoteVersion(n.id, 0, { if_updated_at: (await store.getNote(n.id))!.updatedAt })).content).toBe("one");
   expect(await store.listNoteVersions(n.id)).toHaveLength(1);
 });
+it("live restore requires a precondition and leaves current note and history unchanged without one", async () => {
+  const n = await store.createNote("old");
+  await store.updateNote(n.id, { content: "new" });
+  const before = await store.getNote(n.id), versions = await store.listNoteVersions(n.id);
+  await expect(store.restoreNoteVersion(n.id, 0, {})).rejects.toMatchObject({ code: "PRECONDITION_REQUIRED" });
+  expect(await store.getNote(n.id)).toEqual(before);
+  expect(await store.listNoteVersions(n.id)).toEqual(versions);
+});
 it("P8a tag rename captures only rewritten notes", async () => {
   await store.upsertTagRecord("old", {});
   const a = await store.createNote("#old a"),

package/core/src/history-visibility.test.ts

@@ -0,0 +1,11 @@
+import { test, expect } from "bun:test";
+import { projectHistoryProvenance } from "./history-visibility.ts";
+
+test("history redaction removes only transport provenance without mutating stored data", () => {
+  const row = Object.freeze({ actor: "editor", via: "api", content: "editor mentioned in text",
+    metadata: { actor: "user-authored value" }, origin: "git-import", import_ix: 0 });
+  expect(projectHistoryProvenance(row, false)).toBe(row);
+  expect(projectHistoryProvenance(row, true)).toEqual({ content: row.content, metadata: row.metadata,
+    origin: "git-import", import_ix: 0 });
+  expect(row.actor).toBe("editor");
+});

package/core/src/history-visibility.ts

@@ -0,0 +1,9 @@
+/** Response-only redaction; never remove stored provenance or rewrite note content.
+ * Tag-restricted sessions do not receive historical editor/interface identities.
+ * The transport must establish note visibility before applying this projection.
+ */
+export function projectHistoryProvenance<T extends object>(row: T, restricted: boolean): T | Omit<T, "actor" | "via"> {
+  if (!restricted) return row;
+  const { actor: _actor, via: _via, ...visible } = row as T & { actor?: unknown; via?: unknown };
+  return visible;
+}

package/core/src/history.ts

@@ -119,6 +119,14 @@ export class HistoryUnrecoverableError extends Error {
     this.name = "HistoryUnrecoverableError";
   }
 }
+export class HistoryPreconditionRequiredError extends Error {
+  readonly code = "PRECONDITION_REQUIRED";
+  readonly error_type = "precondition_required";
+  constructor(readonly note_id: string) {
+    super("Restoring an existing note requires if_updated_at from the note you reviewed.");
+  }
+}
+
 export class HistoryNotFoundError extends Error {
   code = "HISTORY_NOT_FOUND" as const;
   note_id: string;

package/core/src/store.ts

@@ -1,4 +1,5 @@
 import { Database } from "bun:sqlite";
+import { HistoryPreconditionRequiredError } from "./history.js";
 import type { Store, Note, Link, Attachment, QueryOpts, QueryNotesPage, AggregateRow, SemanticSearchResult } from "./types.js";
 import { compactNote, compactVault, countNoteVersions, type CompactResult, type CompactSummary, captureVersion, readPriorNoteRow, resolveHistoryPolicy, appendRestoreMarker, listVersions, getVersion, latestTombstone, eraseHistory, sweepDeletedHistory, deletedHistoryStats, HistoryNotFoundError, HistoryOverflowError, HistoryUnrecoverableError, DEFAULT_HISTORY_POLICY, VERSION_MAX_BYTES, type VersionRow, type HistoryPolicy, type HistoryOp } from "./history.js";
 import { initSchema } from "./schema.js";
@@ -834,6 +835,7 @@ export class BunSqliteStore implements Store {
       const v = getVersion(this.db, id, versionIx);
       if (!v) throw new HistoryNotFoundError(id, versionIx);
       if (v.encoding === "overflow") throw new HistoryUnrecoverableError(id, versionIx);
+      if (opts.if_updated_at === undefined) throw new HistoryPreconditionRequiredError(id);
       return await this.updateNote(id, {
         content: v.content!, metadata: v.metadata, extension: v.extension ?? undefined,
         actor: opts.actor ?? null, via: opts.via ?? null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.9-rc.7",
+  "version": "0.7.9-rc.8",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/history-import-routes.test.ts

@@ -45,6 +45,24 @@ async function call(path: string, method = "GET", body?: unknown, verb = "admin"
 }
 
 import { applyImportedNote, beginImportRun, importTargetDigest } from "../core/src/history-import.ts";
+test("authenticated history REST redacts scoped provenance for read/write/admin tokens", async () => {
+  const note = await store.createNote("before", { tags: ["journal"] });
+  await store.updateNote(note.id, { content: "after", actor: "HISTORICAL_EDITOR", via: "HISTORICAL_INTERFACE" });
+  for (const verb of ["read", "write", "admin"]) {
+    for (const scoped of [false, true]) {
+      for (const suffix of ["/versions", "/versions/0"]) {
+        const got = await call(`/notes/${note.id}${suffix}`, "GET", undefined, verb, scoped);
+        expect(got.status).toBe(200);
+        const row = got.body.versions?.[0] ?? got.body;
+        expect(Object.hasOwn(row, "actor")).toBe(!scoped);
+        expect(Object.hasOwn(row, "via")).toBe(!scoped);
+        if (!scoped) expect(row.actor).toBe("HISTORICAL_EDITOR");
+        expect(row.version_ix).toBe(0);
+      }
+    }
+  }
+  expect((await store.getNoteVersion(note.id, 0))!.actor).toBe("HISTORICAL_EDITOR");
+});
 test("imported REST references restore by ID or encoded path and preserve native keys", async () => {
   const note = await store.createNote("native", { path: "folder/imported", tags: ["journal"] });
   await store.updateNote(note.id, { content: "current" });
@@ -66,7 +84,11 @@ test("imported REST references restore by ID or encoded path and preserve native
   expect(list.body.versions.map((v: any) => v.version_ix ?? v.origin)).toEqual([0, "git-import"]);
   for (const body of [{ origin: "git-import" }, { import_ix: 0 }, { origin: "git-import", import_ix: 0, version_ix: 0 }, { origin: "git-import", import_ix: -1 }]) expect((await call(`/notes/${note.id}/restore`, "POST", body)).status).toBe(400);
   expect((await call(`/notes/${note.id}/versions/-1`)).status).toBe(400);
-  const restored = await call(`/notes/${note.id}/restore`, "POST", { origin: "git-import", import_ix: 0 });
+  const beforeRestore = await store.getNote(note.id);
+  const missingStamp = await call(`/notes/${note.id}/restore`, "POST", { origin: "git-import", import_ix: 0 });
+  expect(missingStamp.status).toBe(428);
+  expect(await store.getNote(note.id)).toEqual(beforeRestore);
+  const restored = await call(`/notes/${note.id}/restore`, "POST", { origin: "git-import", import_ix: 0, if_updated_at: beforeRestore!.updatedAt });
   expect(restored.status).toBe(200);
   expect(restored.body.restored_from).toEqual({ origin: "git-import", import_ix: 0 });
   expect((await store.getNote(note.id))!.content).toBe("archive");

package/src/history-import.test.ts

@@ -1,6 +1,6 @@
-import { test, expect } from "bun:test";
+import { test, expect, spyOn } from "bun:test";
 import { createHash } from "node:crypto";
-import { Database } from "bun:sqlite";
+import { Database, SQLiteError } from "bun:sqlite";
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -119,6 +119,38 @@ test("ambiguous sidecars quarantine both identities; malformed YAML diagnostics
   } finally { stage.close(); rmSync(dir, { recursive: true, force: true }); }
 });
 
+for (const format of ["inline", "sidecar"] as const) for (const cache of ["object_cache", "parsed_cache"] as const) {
+  test(`staging SQLite failure in ${format} ${cache} aborts without blaming source notes`, () => {
+    const dir = mkdtempSync(join(tmpdir(), "import-stage-failure-")), stage = new Database(":memory:");
+    const exec = stage.exec.bind(stage);
+    const setup = spyOn(stage, "exec").mockImplementation((sql) => {
+      const result = exec(sql);
+      if (sql.startsWith("CREATE TABLE selection_failures")) {
+        exec(`CREATE TRIGGER fail_cache BEFORE INSERT ON ${cache} BEGIN SELECT RAISE(ABORT, 'staging write failed'); END`);
+      }
+      return result;
+    });
+    try {
+      const repo = repoAt(join(dir, "repo"));
+      if (format === "inline") commit(repo, "valid body");
+      else {
+        mkdirSync(join(repo, ".parachute/notes-meta"), { recursive: true });
+        writeFileSync(join(repo, `.parachute/notes-meta/${noteId}.yaml`), `id: ${noteId}\npath: entry\nextension: json\n`);
+        writeFileSync(join(repo, "entry.json"), '{"valid":true}');
+        git(repo, "add", "."); git(repo, "commit", "-m", "valid sidecar");
+      }
+      let failure: unknown;
+      try { stageArchive(repo, git(repo, "rev-parse", "HEAD"), stage); }
+      catch (error) { failure = error; }
+      expect(failure).toBeInstanceOf(SQLiteError);
+      expect((failure as Error).message).toContain("staging write failed");
+      expect(stage.query("SELECT * FROM issues").all()).toEqual([]);
+      expect(stage.query("SELECT * FROM quarantine").all()).toEqual([]);
+      expect(stage.query("SELECT * FROM observations").all()).toEqual([]);
+    } finally { setup.mockRestore(); stage.close(); rmSync(dir, { recursive: true, force: true }); }
+  });
+}
+
 test("running daemon refuses prepare before creating a pause marker or backup", async () => {
   const dir = mkdtempSync(join(tmpdir(), "import-busy-")), saved = process.env.PARACHUTE_HOME;
   process.env.PARACHUTE_HOME = dir;

package/src/history-import.ts

@@ -1,5 +1,5 @@
 /** Offline git-history import. Git objects are data; no working tree is checked out. */
-import { Database } from "bun:sqlite";
+import { Database, SQLiteError } from "bun:sqlite";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fsyncSync, mkdirSync, mkdtempSync, openSync, readSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -182,6 +182,9 @@ export function stageArchive(repo: string, tip: string, stage: Database, inputSe
       collect(id, state, () => JSON.parse((parsedBody.get(cacheKey) as { row_json: string }).row_json), { git_path: entry.path, blob: entry.hash, sidecar });
     };
     const failure = (entry: typeof entries[number], error: unknown, id?: unknown) => {
+      // Staging/cache failures are operational, not evidence of malformed source.
+      // Abort so no diagnostic manifest can bless an incomplete archive walk.
+      if (error instanceof SQLiteError) throw error;
       const message = error instanceof Error ? error.message : "invalid_observation";
       const reason = /^[a-z_]+$/.test(message) ? message : "invalid_metadata_or_utf8";
       if (error instanceof GitArchiveError || message === "Archive byte limit exceeded" || message === "Archive note limit exceeded") throw error;

package/src/mcp-tools.ts

@@ -6,6 +6,7 @@
  */
 
 import { generateMcpTools, resolveNote } from "../core/src/mcp.ts";
+import { projectHistoryProvenance } from "../core/src/history-visibility.js";
 import type { McpToolDef, GenerateMcpToolsOpts } from "../core/src/mcp.ts";
 import { getNote, getNoteTags, getVaultMap } from "../core/src/notes.ts";
 import { narrowLinkWarningsForVisibility } from "../core/src/wikilinks.ts";
@@ -579,8 +580,13 @@ function applyTagScopeWrappers(
     )) {
       const id = (params as any).versions.note_id;
       const note = resolveNote(store.db, id);
-      return note && noteWithinTagScope(note, allowed, rawTags)
-        ? result : { error: "Note not found", error_type: "not_found", id };
+      if (!note || !noteWithinTagScope(note, allowed, rawTags)) {
+        return { error: "Note not found", error_type: "not_found", id };
+      }
+      if ("versions" in result && Array.isArray(result.versions)) {
+        return { ...result, versions: result.versions.map(row => projectHistoryProvenance(row, true)) };
+      }
+      return projectHistoryProvenance(result, true);
     }
     // Possible response shapes (vault#550 added the `warnings` variants):
     //   - Array (legacy list, no cursor, no warnings)

package/src/routes.ts

@@ -13,6 +13,7 @@ import { getImportedVersion, importStorageIndex, parseHistorySelector, projectHi
  */
 
 import { HistoryNotFoundError, latestTombstone } from "../core/src/history.js";
+import { projectHistoryProvenance } from "../core/src/history-visibility.js";
 import { ULID_REGEX } from "../core/src/ulid.js";
 import type { Database } from "bun:sqlite";
 import type { Store, Note, QueryOpts, AggregateSpec } from "../core/src/types.ts";
@@ -268,6 +269,7 @@ function conflictResponse(e: any): Response | null {
       400,
     );
   }
+  if (e && e.code === "PRECONDITION_REQUIRED") return json({ error_type: "precondition_required", note_id: e.note_id, message: e.message }, 428);
   if (e && e.code === "HISTORY_NOT_FOUND") return json({ error: e.message, error_type: "not_found" }, 404);
   if (e && e.code === "HISTORY_OVERFLOW") return json({
     error_type: "history_overflow", note_id: e.note_id, byte_size: e.byte_size, limit: e.limit, message: e.message,
@@ -2942,7 +2944,7 @@ async function handleNotesInner(
         const offset = Math.max(0, Number.parseInt(url.searchParams.get("offset") ?? "0", 10) || 0);
         const versions = await store.listNoteVersions(id, { limit, offset });
         const total = await store.countNoteVersions(id);
-        return json({ versions: versions.map(projectHistoryRow), total });
+        return json({ versions: versions.map(row => projectHistoryProvenance(projectHistoryRow(row), tagScope.allowed !== null)), total });
       }
       if (method === "DELETE") {
         const result = await store.eraseNoteHistory(id);
@@ -2953,7 +2955,7 @@ async function handleNotesInner(
       if (!/^\d+$/.test(importMatch[1]!) || !Number.isSafeInteger(index) || index < 0) return json({ error: "Invalid import_ix", error_type: "invalid_request" }, 400);
       try {
         const version = getImportedVersion(db, id, index);
-        return version ? json(projectHistoryRow(version)) : json({ error: "Not found", error_type: "not_found", origin: "git-import", import_ix: index }, 404);
+        return version ? json(projectHistoryProvenance(projectHistoryRow(version), tagScope.allowed !== null)) : json({ error: "Not found", error_type: "not_found", origin: "git-import", import_ix: index }, 404);
       } catch (e) {
         const response = conflictResponse(e);
         if (response) return response;
@@ -2964,7 +2966,7 @@ async function handleNotesInner(
       if (!/^\d+$/.test(verMatch[1]!) || !Number.isInteger(ix) || ix < 0) return json({ error: "Invalid version_ix", error_type: "invalid_request" }, 400);
       try {
         const version = await store.getNoteVersion(id, ix);
-        return version ? json(version) : json({ error: "Not found", error_type: "not_found" }, 404);
+        return version ? json(projectHistoryProvenance(version, tagScope.allowed !== null)) : json({ error: "Not found", error_type: "not_found" }, 404);
       } catch (e) {
         const response = conflictResponse(e);
         if (response) return response;

package/src/vault-compact-routes.test.ts

@@ -64,7 +64,7 @@ test("P9/P18 compacted REST and MCP versions roundtrip with exact keys", async (
   expect(mcp).toEqual(get.body);
   const ml = await query()({ versions: { note_id: n.id, limit: 2 } }) as any;
   expect(ml.total).toBe(list.body.total);
-  const restore = await call(`/notes/${n.id}/restore`, "POST", { version_ix: 0 });
+  const restore = await call(`/notes/${n.id}/restore`, "POST", { version_ix: 0, if_updated_at: (await store.getNote(n.id))!.updatedAt });
   expect(restore.status).toBe(200);
   expect((await store.getNote(n.id))!.content).toBe(before.content);
 });

package/src/vault-history-routes.test.ts

@@ -11,6 +11,8 @@ import {
 import { getVaultStore, clearVaultStoreCache } from "./vault-store.ts";
 import { generateScopedMcpTools } from "./mcp-tools.ts";
 import { runDoctorScan } from "../core/src/doctor.ts";
+import { applyImportedNote, beginImportRun, importTargetDigest } from "../core/src/history-import.ts";
+import { resolveHistoryPolicy } from "../core/src/history.ts";
 let taskDir: string,
   savedHome: string | undefined,
   store: ReturnType<typeof getVaultStore>;
@@ -78,9 +80,56 @@ async function fixture() {
   await store.updateNote(n.id, { content: "two" });
   return n;
 }
+test("tag-scoped REST and MCP history omit provenance without changing stored rows", async () => {
+  const n = await store.createNote("original", { path: "history-visible", tags: ["journal"] });
+  await store.updateNote(n.id, { content: "current", actor: "PRIVATE_EDITOR", via: "PRIVATE_INTERFACE" });
+  const run = { run_id: "visibility", source_fingerprint: "source", tip: "tip", options_digest: "options" };
+  beginImportRun(store.db, run);
+  applyImportedNote(store.db, { run, noteId: n.id, targetDigest: importTargetDigest(store.db, n.id),
+    policy: resolveHistoryPolicy({ min_versions: 20 }), now: Date.now(),
+    observations: [{ content: "archive", path: "old/path", metadata: {}, extension: "md", created_at: null,
+      observed_at: new Date().toISOString(), commit: "commit", blob: "blob" }] });
+  const before = await store.listNoteVersions(n.id);
+  const full = (await call(n.id, "/versions")).body;
+  expect(full.versions[0]).toMatchObject({ actor: "PRIVATE_EDITOR", via: "PRIVATE_INTERFACE" });
+  for (const scoped of [false, true]) {
+    const rest = (await call(n.id, "/versions", "GET", undefined, scoped)).body;
+    const mcp = await query(scoped ? ["journal"] : null)({ versions: { note_id: n.id } });
+    expect(mcp).toEqual(rest);
+    expect(rest.total).toBe(2);
+    expect(rest.versions[0].version_ix).toBe(0);
+    expect(rest.versions[1]).toMatchObject({ origin: "git-import", import_ix: 0 });
+    for (const row of rest.versions) {
+      expect(Object.hasOwn(row, "actor")).toBe(!scoped);
+      expect(Object.hasOwn(row, "via")).toBe(!scoped);
+    }
+    for (const [path, selector, content] of [
+      ["/versions/0", { version_ix: 0 }, "original"],
+      ["/imports/0", { origin: "git-import", import_ix: 0 }, "archive"],
+    ] as const) {
+      const one = await call(n.id, path, "GET", undefined, scoped);
+      expect(one.status).toBe(200);
+      expect(one.body.content).toBe(content);
+      expect(await query(scoped ? ["journal"] : null)({ versions: { note_id: n.id, ...selector } })).toEqual(one.body);
+      expect(Object.hasOwn(one.body, "actor")).toBe(!scoped);
+      expect(Object.hasOwn(one.body, "via")).toBe(!scoped);
+    }
+  }
+  expect(await store.listNoteVersions(n.id)).toEqual(before);
+  expect((await store.getNote(n.id))!.content).toBe("current");
+  // Empty tag lists mean unrestricted in the existing authorization contract.
+  expect(await query([])({ versions: { note_id: n.id } })).toEqual(full);
+  const denied = await query(["unrelated"])({ versions: { note_id: n.id } });
+  expect(denied).toMatchObject({ error_type: "not_found" });
+});
 test("P5 REST restore rejects stale optimistic tokens without capture", async () => {
   const n = await fixture();
   const before = await store.listNoteVersions(n.id);
+  for (const extra of [{}, { force: true }]) {
+    const missing = await call(n.id, "/restore", "POST", { version_ix: 0, ...extra });
+    expect(missing.status).toBe(428);
+    expect(missing.body.error_type).toBe("precondition_required");
+  }
   const r = await call(n.id, "/restore", "POST", {
     version_ix: 0,
     if_updated_at: "1999-01-01T00:00:00.000Z",
@@ -393,7 +442,7 @@ test("P24 migration bypass restores, captures once, and emits the bypass log", a
   const n = await strictFixture();
   const log = spyOn(console, "warn").mockImplementation(() => {});
   try {
-    const r = await call(n.id, "/restore", "POST", { version_ix: 0 }, false, {
+    const r = await call(n.id, "/restore", "POST", { version_ix: 0, if_updated_at: (await store.getNote(n.id))!.updatedAt }, false, {
       actor: "migrator",
       via: "api",
       bypassStrict: true,