@staix/vault-mem 0.2.3 → 0.3.0

package/src/ui/plugin.ts

@@ -0,0 +1,292 @@
+/**
+ * Console plugin (api 1) for acon: STAIxBWLB/agent-console contract, UX per vault-mem#48.
+ * The provider reuses the `vmem mcp` handlers in process, so the console acts with exactly the MCP rights and checks.
+ */
+import { readFileSync } from "node:fs";
+import type { ActionResult, Change, ConsolePlugin, ConsoleProvider, InboxItem } from "@staix/agent-console/contract";
+import { analysisInput } from "../analysis-input.ts";
+import { resolveHome } from "../home.ts";
+import { createVaultMcp } from "../mcp-vault.ts";
+import { validArguments } from "../mcp.ts";
+import { listPromotionCandidates } from "../promote.ts";
+import { loadRegistry } from "../registry.ts";
+import { lintVault } from "../vault-lint.ts";
+import type { LintCode } from "../analysis-types.ts";
+
+const asset = (name: string) => readFileSync(new URL(name, import.meta.url), "utf8");
+const VERSION = (JSON.parse(asset("../../package.json")) as { version: string }).version;
+const LINT_ERRORS: LintCode[] = ["L01", "L02", "L13"];
+const CACHE_MS = 60_000;
+
+type Args = Record<string, unknown>;
+const str = (v: unknown): string | undefined => typeof v === "string" && v.length > 0 ? v : undefined;
+const rec = (v: unknown): Record<string, unknown> => (v && typeof v === "object" ? v as Record<string, unknown> : {});
+/**
+ * The console's answer to a confirmed write. An applied write is done, together with any later step that failed
+ * (a log line, the agent-mem link, SYNC lines). A successful no-op (already linked, nothing to change, a retried
+ * confirmation) is success too, never a refusal. Anything else is refused with its first issue.
+ */
+export function confirmedOutcome(done: Args, verb: string): ActionResult {
+  if (done.applied === true) {
+    const missing = followUpProblems(done);
+    return { ok: true, message: missing.length ? `${verb}: applied, but ${missing.join("; ")}` : `${verb}: done` };
+  }
+  const issues = Array.isArray(done.issues) ? done.issues as { severity?: string }[] : [];
+  if (done.ok === true && !issues.some(i => i.severity !== "warning")) return { ok: true, message: `${verb}: already done, nothing changed` };
+  return { ok: false, error: firstIssue(done) };
+}
+const firstIssue = (r: Args): string => {
+  const issues = Array.isArray(r.issues) ? r.issues as { message?: string; severity?: string }[] : [];
+  return (issues.find(i => i.severity !== "warning") ?? issues[0])?.message ?? "refused";
+};
+
+/** `- 2026-10-31 09:12  LEARN  proj  src → dest  — note (vmem:agent)` as a row; unparsable lines keep their text. */
+export function parseLogLine(line: string): { at: string; type: string; project: string; source: string; dest?: string; note: string; agent: boolean } | { raw: string } {
+  const m = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2})  (\S+)  (\S+)  (.+?)(?: → (.+?))?  — (.*?)( \(vmem:agent\))?$/.exec(line.replace(/\n$/, ""));
+  if (!m) return { raw: line };
+  return { at: m[1]!, type: m[2]!, project: m[3]!, source: m[4]!, ...(m[5] ? { dest: m[5] } : {}), note: m[6]!, agent: m[7] !== undefined };
+}
+
+/** Lint strings carry the note path in the first backtick span; this turns them into typed findings. */
+export function typedFindings(findings: Record<string, string[]>): { code: string; severity: "error" | "warning"; path?: string; message: string }[] {
+  return Object.entries(findings).flatMap(([code, list]) => list.map(message => {
+    const path = /`(notes\/[^`]+\.md)`/.exec(message)?.[1];
+    return { code, severity: LINT_ERRORS.includes(code as LintCode) ? "error" as const : "warning" as const, ...(path ? { path } : {}), message };
+  }));
+}
+
+/** Failed steps after an applied write: the log receipt(s) of a write, a promotion or an org promotion, and the result's own issues. */
+export function followUpProblems(r: Args): string[] {
+  const out: string[] = [];
+  const failed = (x: unknown) => { const l = rec(x); if (l.ok === false) out.push(firstIssue(l)); };
+  const logs = rec(r.logs);
+  for (const receipt of [r.log, rec(r.note).log, logs.source, logs.target, r.provenance]) failed(receipt);
+  if (r.ok === false) out.push(firstIssue(r));
+  return [...new Set(out)];
+}
+
+/** Planned file changes of a vmem preview, as the shell's "What will change" list. */
+function changesOf(receipt: Args): Change[] {
+  const list = Array.isArray(receipt.changes) ? receipt.changes as { path: string; beforeSha: string | null; sha256: string | null }[] : [];
+  return list.map(c => ({ op: c.beforeSha === null ? "create" : c.sha256 === null ? "delete" : "modify", target: c.path }));
+}
+
+export const plugin: ConsolePlugin = {
+  manifest: {
+    api: 1, tool: "vmem", version: VERSION, title: "Vault", icon: "vault", pollMs: 15_000,
+    panels: [
+      { id: "overview", title: "Overview", order: 1 },
+      { id: "notes", title: "Search", order: 2 },
+      { id: "note", title: "Note", order: 3 },
+      { id: "promote", title: "Promote", order: 4 },
+      { id: "lint", title: "Lint", order: 5 },
+      { id: "log", title: "Log", order: 6 },
+    ],
+    capabilities: { actions: ["delete", "move", "promote", "promote-from-amem"], confirm: true, inbox: true, search: true },
+  },
+  async open(ctx): Promise<ConsoleProvider> {
+    const home = resolveHome().home;
+    const mcp = createVaultMcp(home);
+    const call = async (name: string, args: Args): Promise<Args> => rec(await mcp.handlers[name]!(args));
+    // The shell's tabs navigate without params, so the vault chosen on one panel is kept for the others.
+    // ponytail: one choice per provider; fine for H0's single person, per session once H1 serves several.
+    let chosen: string | undefined;
+    // An explicit vault must exist (undefined otherwise, like MCP's own check); only an omitted one falls back.
+    const vaultOf = (args: Args) => {
+      const asked = str(args.vault);
+      if (asked) { const spec = mcp.vaults.find(v => v.id === asked); if (spec) chosen = spec.id; return spec; }
+      return mcp.vaults.find(v => v.id === (chosen ?? mcp.defaultVault));
+    };
+    // The vault argument for an MCP call: an explicit id goes through unchanged so the handler refuses an unknown one.
+    const vaultArg = (args: Args) => str(args.vault) ?? vaultOf(args)?.id;
+    const pass = (args: Args) => { vaultOf(args); const v = vaultArg(args); return v ? { vault: v } : {}; };
+    /**
+     * Every option the MCP tool declares reaches it: the console never hand-picks arguments, so a supported
+     * operation cannot be lost on the way. Form text for array options is split on commas; the result is checked
+     * against the tool's own schema before anything runs.
+     */
+    const forward = (tool: string, args: Args, fixed: Args = {}): Args | string => {
+      const schema = mcp.tools.find(t => t.name === tool)?.inputSchema as { properties?: Record<string, { type?: unknown }> } | undefined;
+      const out: Args = {};
+      for (const [key, spec] of Object.entries(schema?.properties ?? {})) {
+        if (key === "confirm" || key === "fingerprint") continue;
+        let value = key in fixed ? fixed[key] : key === "vault" ? vaultArg(args) : args[key];
+        if (value === undefined || value === "") continue;
+        const types = Array.isArray(spec.type) ? spec.type : [spec.type];
+        if (typeof value === "string" && types.includes("array") && !types.includes("string")) value = value.split(",").map(v => v.trim()).filter(Boolean);
+        if (value === "true" && types.includes("boolean")) value = true;
+        out[key] = value;
+      }
+      return validArguments(out, schema ?? { type: "object" }) ? out : `invalid input for ${tool}`;
+    };
+
+    // ponytail: lint reads every note, so inbox polls reuse one result per vault for 60 s; invalidate on writes if it lags.
+    const lintCache = new Map<string, { at: number; report: ReturnType<typeof lintVault> }>();
+    const lint = (id: string) => {
+      const hit = lintCache.get(id);
+      if (hit && Date.now() - hit.at < CACHE_MS) return hit.report;
+      const spec = mcp.vaults.find(v => v.id === id)!;
+      const report = lintVault(analysisInput(home, id, { expectedVault: spec }).snapshot);
+      lintCache.set(id, { at: Date.now(), report });
+      return report;
+    };
+    const projectOf = new Map<string, string>();
+    const candidates = async () => {
+      try {
+        const { projects } = await listPromotionCandidates({ allProjects: true, limit: 50, piiPatterns: loadRegistry(home).piiPatterns });
+        for (const p of projects) for (const c of p.candidates) projectOf.set(c.id, c.project);
+        return { projects };
+      }
+      catch (error) { ctx.log(`vmem: promotion candidates unavailable: ${error instanceof Error ? error.message : String(error)}`); return { projects: [], unavailable: "agent-mem candidates are unavailable; see System" }; }
+    };
+
+    // The shell keys snooze and oldest-first order on `at`, so an item keeps the time it was first seen.
+    const firstSeen = new Map<string, string>();
+    const since = (id: string) => { const at = firstSeen.get(id) ?? new Date().toISOString(); firstSeen.set(id, at); return at; };
+    async function inbox(): Promise<InboxItem[]> {
+      const items: InboxItem[] = [];
+      for (const p of (await candidates()).projects) for (const c of p.candidates) items.push({
+        id: `mem:${c.id}`, group: "candidate", kind: "promotion", title: c.title ?? c.kind, detail: `${c.kind} memory to promote into a vault note`,
+        project: c.project, at: new Date(c.at).toISOString(),
+        // Promotion needs a domain and topics, so the item opens the Promote panel instead of offering a one-key verb.
+        verbs: [],
+        link: { panel: "promote", params: { id: c.id, project: c.project } },
+      });
+      for (const v of mcp.vaults.filter(x => x.kind === "personal")) {
+        let report;
+        try { report = lint(v.id); } catch (error) { ctx.log(`vmem: lint ${v.id} failed: ${error instanceof Error ? error.message : String(error)}`); continue; }
+        if (report.errors > 0) items.push({ id: `lint:${v.id}`, group: "alert", kind: "lint", title: `${report.errors} lint errors in ${v.id}`, detail: report.summary, at: since(`lint:${v.id}`),
+          chip: { text: `${report.errors} errors`, tone: "err" }, verbs: [], link: { panel: "lint", params: { vault: v.id } } });
+        const stale = report.findings.L11 ?? [];
+        if (stale.length) items.push({ id: `stale:${v.id}`, group: "alert", kind: "lint", title: `Graph report is stale in ${v.id}`, detail: stale[0]!, at: since(`stale:${v.id}`),
+          chip: { text: "stale", tone: "warn" }, verbs: [], link: { panel: "lint", params: { vault: v.id } } });
+      }
+      for (const id of firstSeen.keys()) if (!items.some(i => i.id === id)) firstSeen.delete(id);
+      return items;
+    }
+
+    /** One two-step operation: preview, and with the console's confirmation recompute and write only on the same fingerprint. */
+    async function twoStep(tool: string, args: Args | string, confirmed: boolean, fingerprint: string | undefined, describe: (preview: Args) => { verb: string; preview: string[]; changes: Change[]; warnings: string[] }): Promise<ActionResult> {
+      if (typeof args === "string") return { ok: false, error: args };
+      const preview = await call(tool, args);
+      if (preview.refused || preview.ok === false || typeof preview.fingerprint !== "string") return { ok: false, error: firstIssue(preview) };
+      if (!confirmed || fingerprint !== preview.fingerprint) {
+        const d = describe(preview);
+        return { ok: false, needsConfirm: true, fingerprint: preview.fingerprint, verb: d.verb, preview: d.preview, changes: d.changes, ...(d.warnings.length ? { warnings: d.warnings } : {}) };
+      }
+      const done = await call(tool, { ...args, confirm: true, fingerprint });
+      if (done.applied === true) lintCache.clear();
+      return confirmedOutcome(done, describe(preview).verb);
+    }
+
+    return {
+      assets: { js: asset("./panel.js"), css: asset("./panel.css") },
+      async snapshot(input) {
+        const args = input as Args;
+        switch (input.panel) {
+          case "inbox": return { items: await inbox() };
+          case "search": {
+            const q = str(args.q);
+            if (!q) return { hits: [], total: 0 };
+            const limit = Math.min(10, Math.max(1, Number(args.limit) || 10));
+            const r = await call("vmem_search", { query: q, limit, ...pass(args) });
+            const hits = (Array.isArray(r.hits) ? r.hits as { path: string; title: string; description: string }[] : []).map(h => ({
+              id: h.path, kind: "note", title: h.title, detail: h.description, link: { panel: "note", params: { path: h.path } } }));
+            return { hits, total: hits.length };
+          }
+          case "overview": {
+            const status = await call("vmem_status", {});
+            const vault = vaultOf(args);
+            if (!vault) return { status, vault: null };
+            const [notes, mocs, log] = await Promise.all([call("vmem_list", { vault: vault.id, limit: 500 }), call("vmem_mocs", { vault: vault.id }), call("vmem_log_tail", { vault: vault.id, n: 8 })]);
+            const count = Array.isArray(notes.notes) ? notes.notes.length : 0;
+            return { status, vault: vault.id, noteCount: count, noteCountCapped: count >= 500, mocs: mocs.mocs ?? [], log: (Array.isArray(log.lines) ? log.lines as string[] : []).map(parseLogLine) };
+          }
+          case "notes": {
+            const q = str(args.q);
+            const r = q ? await call("vmem_search", { query: q, limit: 50, ...pass(args) }) : await call("vmem_list", { limit: 100, ...pass(args) });
+            return { q: q ?? "", notes: r.hits ?? r.notes ?? [], ...(r.refused ? { error: firstIssue(r) } : {}) };
+          }
+          case "note": {
+            const path = str(args.path);
+            if (!path) return { note: null };
+            const note = await call("vmem_read", { path, ...pass(args) });
+            if (note.refused) return { note: null, error: firstIssue(note) };
+            const links = await call("vmem_links", { path, ...pass(args) });
+            // vmem_promote always reads from the default personal vault, so offer it only there.
+            const promotable = vaultOf(args)?.id === mcp.defaultVault && vaultOf(args)?.kind === "personal";
+            return { note, links, orgVaults: promotable ? mcp.vaults.filter(v => v.kind === "org").map(v => v.id) : [] };
+          }
+          case "promote": return { ...(await candidates()), selected: str(args.id) ?? null };
+          case "lint": {
+            const vault = vaultOf(args);
+            if (!vault) return { findings: [] };
+            const report = lint(vault.id);
+            return { vault: vault.id, errors: report.errors, warnings: report.warnings, summary: report.summary, findings: typedFindings(report.findings) };
+          }
+          case "log": {
+            const vault = vaultOf(args);
+            if (!vault) return { rows: [] };
+            const r = await call("vmem_log_tail", { vault: vault.id, n: 100, ...(str(args.type) ? { type: args.type } : {}) });
+            return { vault: vault.id, rows: (Array.isArray(r.lines) ? r.lines as string[] : []).map(parseLogLine).reverse(), ...(r.ok === false ? { error: firstIssue(r) } : {}) };
+          }
+          default: return { error: `unknown panel ${input.panel}` };
+        }
+      },
+      async action(input) {
+        const args = input as Args, confirmed = input.confirmed === true, fingerprint = str(input.fingerprint);
+        switch (input.action) {
+          case "delete": {
+            const path = str(args.path) ?? str(args.id);
+            if (!path) return { ok: false, error: "path is required" };
+            return twoStep("vmem_delete", forward("vmem_delete", args, { path }), confirmed, fingerprint, p => {
+              const backlinks = Array.isArray(p.backlinks) ? p.backlinks as { source: string }[] : [];
+              return { verb: "Delete note", preview: [`delete ${path}`], changes: changesOf(p),
+                warnings: backlinks.length ? [`${backlinks.length} links point here: ${[...new Set(backlinks.map(b => b.source))].slice(0, 5).join(", ")}`] : [] };
+            });
+          }
+          case "move": {
+            const from = str(args.from), to = str(args.to);
+            if (!from || !to) return { ok: false, error: "from and to are required" };
+            return twoStep("vmem_move", forward("vmem_move", args), confirmed, fingerprint, p => ({ verb: "Move note", preview: [`move ${from} → ${to}`], changes: changesOf(p), warnings: [] }));
+          }
+          case "promote": {
+            const path = str(args.path), to = str(args.to);
+            if (!path || !to) return { ok: false, error: "path and to are required" };
+            if (vaultOf(args)?.id !== mcp.defaultVault) return { ok: false, error: `promotion to an org vault reads from ${mcp.defaultVault}; open the note there` };
+            return twoStep("vmem_promote", forward("vmem_promote", args), confirmed, fingerprint, p => {
+              const screen = rec(p.screen), dropped = Array.isArray(p.droppedLinks) ? p.droppedLinks as string[] : [];
+              const target = String(p.target ?? `${to}:${path}`);
+              // A rerun after an interrupted promotion only restores the source provenance.
+              const changes: Change[] = p.recovery === "provenance-only"
+                ? [{ op: "modify", target: path, note: `provenance → ${target}` }]
+                : [{ op: "create", target }, { op: "modify", target: path, note: "provenance" }, { op: "log", target: "log", note: "SYNC lines in both vaults" }];
+              return { verb: p.recovery === "provenance-only" ? "Restore provenance" : "Promote note", preview: String(p.text ?? "").split("\n"),
+                changes,
+                warnings: [...(dropped.length ? [`${dropped.length} links become plain text: ${dropped.slice(0, 5).join(", ")}`] : []), ...(screen.passed === false ? ["screen reported issues"] : [])] };
+            });
+          }
+          case "promote-from-amem": {
+            const id = (str(args.id) ?? "").replace(/^mem:/, "");
+            if (!/^[0-9a-f-]{32,36}$/i.test(id)) return { ok: false, error: "a memory id is required" };
+            if (!projectOf.has(id)) await candidates();
+            const project = str(args.project) ?? projectOf.get(id);
+            return twoStep("vmem_promote_from_amem", forward("vmem_promote_from_amem", args, { id, ...(project ? { project } : {}) }), confirmed, fingerprint, p => {
+              const dupes = Array.isArray(p.possibleDuplicates) ? p.possibleDuplicates as string[] : [];
+              // Linking an existing note writes no vault file; it records the link in agent-mem only.
+              const changes: Change[] = p.action === "link"
+                ? [{ op: "modify", target: `agent-mem mem:${id}`, note: `vault link → ${String(p.path)}` }]
+                : [{ op: "create", target: String(p.path ?? "note") }, { op: "log", target: "log", note: "LEARN line" }, { op: "modify", target: `agent-mem mem:${id}`, note: "vault link" }];
+              return { verb: p.action === "link" ? "Link memory" : "Promote memory", preview: String(p.text ?? `link mem:${id} → ${String(p.path)}`).split("\n"),
+                changes,
+                warnings: dupes.length ? [`possible duplicates: ${dupes.slice(0, 5).join(", ")}`] : [] };
+            });
+          }
+          default: return { ok: false, error: `unknown action ${input.action}` };
+        }
+      },
+    };
+  },
+};
+
+export default plugin;

package/src/vault-index.ts

@@ -9,8 +9,13 @@ import { normalizeTarget, noteKey, proseLines, resolveLinks, type LinkNote, type
 
 export const MAX_NOTE_BYTES = 2 * 1024 * 1024;
 export const MAX_RESULTS = 500;
-/** Bump when link resolution changes, so caches written by an older version recompute every link. 2 = path-only. */
-const LINK_RESOLUTION = 2;
+/**
+ * Bump when link resolution changes. 2 = path-only. The index file is named per value, so two installed versions
+ * that resolve links differently keep separate indexes instead of rebuilding each other's links. 0.2.4 and older
+ * share the unversioned `<digest>.sqlite`; the first run of a newer version builds its own file once.
+ */
+export const LINK_RESOLUTION = 2;
+const indexName = (root: string) => `${digest(root)}-links${LINK_RESOLUTION}.sqlite`;
 export const MAX_READ_BYTES = 64 * 1024;
 export interface IndexedNote extends LinkNote { hash: string; description: string; type: string; domain: string }
 export interface NoteReadResult {
@@ -118,7 +123,7 @@ export class VaultIndex {
     if (!options.memory) {
       mkdirSync(cache, { recursive: true, mode: 0o700 });
       if (lstatSync(cache).isSymbolicLink() || !lstatSync(cache).isDirectory()) throw new Error("index: expected plain cache directory");
-      this.file = join(cache, `${digest(this.root)}.sqlite`);
+      this.file = join(cache, indexName(this.root));
       try {
         const fd = openSync(this.file, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
         closeSync(fd);
@@ -136,7 +141,7 @@ export class VaultIndex {
       CREATE TABLE IF NOT EXISTS links (source TEXT NOT NULL, ordinal INTEGER NOT NULL, data TEXT NOT NULL, PRIMARY KEY(source, ordinal));`);
     // Dry runs reuse the derived cache via a readonly connection, then refresh only changed notes in memory.
     if (options.memory) {
-      const file = join(cache, `${digest(this.root)}.sqlite`);
+      const file = join(cache, indexName(this.root));
       let exists = false;
       try { const stat = lstatSync(file); if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("index: expected plain database file"); exists = true; }
       catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }

package/src/vault-log.ts

@@ -8,6 +8,7 @@ import { formatLogEvent, LOG_TYPES } from "./log-format.ts";
 import type { LogBinding, LogContext, LogReadOptions, LogReadResult, LogReceipt, LogRequest } from "./log-types.ts";
 import type { WriteIssue } from "./write-types.ts";
 import type { VaultSpec, VmemConfig } from "./config.ts";
+import { unenforceablePii } from "./config.ts";
 export const LOG_LOCK = "log.lock";
 export const MAX_LOG_READ_BYTES = 32 * 1024 * 1024;
 export const LARGE_LOG_LINES = 20000;
@@ -60,6 +61,8 @@ function context(home: string, id: string, channel: "cli" | "mcp" | undefined, w
   if (!vault) refuse("L09", "unknown vault id");
   if (channel !== undefined && channel !== "cli" && channel !== "mcp") refuse("POLICY", "unknown log channel");
   if (write && (vault.write === "none" || (channel === "mcp" && vault.write !== "mcp"))) refuse("POLICY", "vault write policy refuses log append");
+  const unenforceable = write ? unenforceablePii(vault) : undefined;
+  if (unenforceable) refuse("PII_POLICY", unenforceable);
   if (realpathSync(vault.path) !== vault.path || !lstatSync(vault.path).isDirectory()) refuse("L09", "registered vault path changed");
   if (isDenied(join(vault.path, "log"), config.denyPaths)) refuse("V06", "log path is denied");
   return { vault, config, channel, ...(write && vault.registry ? { projectIds: registryIds(vault.registry, config.denyPaths) } : {}) };

package/src/write-validation.ts

@@ -28,7 +28,7 @@ const KEYS = new Set([
 export const TYPED_KEYS: Readonly<Record<string, string>> = { decided_at: "decision", decided_by: "decision", email: "person", phone: "person" };
 export const SCHEMA_KEYS: ReadonlySet<string> = KEYS;
 const WIKI_FIELDS = ["topics", "project", "superseded_by", "supersedes", "source_ref"];
-// Exact regex set from @staix/agent-mem v0.11.0 src/memory/screen.ts; parity-tested against its root export.
+// Exact regex set from @staix/agent-mem v0.17.0 src/memory/screen.ts; parity-tested against its root export.
 const SECRETS = [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, /\bAKIA[0-9A-Z]{16}\b/, /\bgh[pousr]_[A-Za-z0-9]{30,}/, /\bgithub_pat_[A-Za-z0-9_]{40,}/, /\bsk-[A-Za-z0-9_-]{20,}/,
   /\bxox[abprs]-[A-Za-z0-9-]{10,}/, /\bAIza[0-9A-Za-z_-]{35}\b/, /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, /\b(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*\S{8,}/i];
 export const SECRET_PATTERNS: readonly RegExp[] = SECRETS;

package/src/writer.ts

@@ -12,6 +12,7 @@ import { canonicalPath, isDenied } from "./platform.ts";
 import { moveSourcePath, notePath, planOperation, refuse, WriteRefusal } from "./write-operations.ts";
 import { MAX_REPORT_BYTES, validateWrite } from "./write-validation.ts";
 import type { PiiSurface } from "./config.ts";
+import { unenforceablePii } from "./config.ts";
 import type { LogBinding } from "./log-types.ts";
 import type { ChangeReceipt, PlannedChange, WriteIssue, WriteReceipt, WriteRequest } from "./write-types.ts";
 export const MUTATION_LOCK = "mutation.lock";
@@ -129,6 +130,8 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
     const config = loadRegistry(home), vault = config.vaults.find(value => value.id === request.vault);
     if (options.binding && !matchesBinding(config, request.vault, options.binding)) refuse("VAULT_DRIFT", "vault identity or policy changed since the run started; nothing written");
     if (!vault) refuse("V04", "unknown vault id");
+    const unenforceable = unenforceablePii(vault);
+    if (unenforceable) refuse("PII_POLICY", unenforceable);
     if (request.operation.op !== "check" && (vault.write === "none" || (request.channel === "mcp" && vault.write !== "mcp"))) refuse("POLICY", "vault write policy refuses this channel");
     root = realpathSync(vault.path);
     if (root !== vault.path || isDenied(root, config.denyPaths)) refuse("V06", "vault path denied or changed");