pi-vault-mind 0.14.2 → 0.16.3

package/dist/src/agent-queue.js

@@ -12,6 +12,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { loadConfig, resolveVaultFile } from "./utils.js";
 const queueSubscribers = new Set();
 /** Subscribe to queue events. Returns an unsubscribe function. */
 export const subscribeQueue = (cb) => {
@@ -35,8 +36,16 @@ const eventTypeFor = (status, prev) => {
         return "job-completed";
     return "job-updated";
 };
-const queueFileName = ".vault-mind/agent-queue.jsonl";
-const queuePath = (vaultPath) => path.join(vaultPath, queueFileName);
+/** Per-vault queue path, resolved from config once and memoized. */
+const queuePathCache = new Map();
+const queuePath = (vaultPath) => {
+    const cached = queuePathCache.get(vaultPath);
+    if (cached)
+        return cached;
+    const resolved = path.join(vaultPath, resolveVaultFile(loadConfig(vaultPath).vaultMind, "queue"));
+    queuePathCache.set(vaultPath, resolved);
+    return resolved;
+};
 const ensureQueueDir = (vaultPath) => {
     const dir = path.dirname(queuePath(vaultPath));
     if (!fs.existsSync(dir)) {
@@ -125,7 +134,7 @@ export const markJobRunning = (vaultPath, id) => {
 /** Mark a pending job as cancelled. */
 export const cancelJob = (vaultPath, id) => {
     const current = getJob(vaultPath, id);
-    if (!current || current.status !== "pending")
+    if (current?.status !== "pending")
         return undefined;
     return updateJob(vaultPath, id, "cancelled");
 };

package/dist/src/agents/BroadcasterAgent.d.ts

@@ -1,7 +1,7 @@
 /**
  * BroadcasterAgent — content distribution agent.
  *
- * Allowed tools: read, write, edit, vm_search, vm_fts_search
+ * Allowed tools: read, write, edit, vm_search
  * Cannot write to durable store or publish.
  * Writes output only under Agent/Presentations/.
  */

package/dist/src/agents/BroadcasterAgent.js

@@ -1,7 +1,7 @@
 /**
  * BroadcasterAgent — content distribution agent.
  *
- * Allowed tools: read, write, edit, vm_search, vm_fts_search
+ * Allowed tools: read, write, edit, vm_search
  * Cannot write to durable store or publish.
  * Writes output only under Agent/Presentations/.
  */
@@ -25,7 +25,7 @@ export class BroadcasterAgent extends Agent {
         if (!this.taskQueue.claim(taskId, this.config.id))
             return;
         try {
-            await this.executeJob(job);
+            await this.withDispatchContext(job.dispatchId, () => this.executeJob(job));
             this.taskQueue.complete(taskId, this.config.id, { dispatchId: job.dispatchId });
             await this.broadcast("JOB_COMPLETED", {
                 dispatchId: job.dispatchId,

package/dist/src/agents/HeavyLifterAgent.d.ts

@@ -1,7 +1,7 @@
 /**
  * HeavyLifterAgent — external CLI execution agent.
  *
- * Allowed tools: read, write, edit, grep, find, ls, bash, vm_search, vm_fts_search
+ * Allowed tools: read, write, edit, grep, find, ls, bash, vm_search
  * Cannot write to durable store or publish.
  * Runs bash in isolated worktree.
  */

package/dist/src/agents/HeavyLifterAgent.js

@@ -1,7 +1,7 @@
 /**
  * HeavyLifterAgent — external CLI execution agent.
  *
- * Allowed tools: read, write, edit, grep, find, ls, bash, vm_search, vm_fts_search
+ * Allowed tools: read, write, edit, grep, find, ls, bash, vm_search
  * Cannot write to durable store or publish.
  * Runs bash in isolated worktree.
  */
@@ -25,7 +25,7 @@ export class HeavyLifterAgent extends Agent {
         if (!this.taskQueue.claim(taskId, this.config.id))
             return;
         try {
-            await this.executeJob(job);
+            await this.withDispatchContext(job.dispatchId, () => this.executeJob(job));
             this.taskQueue.complete(taskId, this.config.id, { dispatchId: job.dispatchId });
             await this.broadcast("JOB_COMPLETED", {
                 dispatchId: job.dispatchId,

package/dist/src/agents/ManagerAgent.js

@@ -26,7 +26,7 @@ export class ManagerAgent extends Agent {
         if (!this.taskQueue.claim(taskId, this.config.id))
             return;
         try {
-            await this.executeJob(job);
+            await this.withDispatchContext(job.dispatchId, () => this.executeJob(job));
             this.taskQueue.complete(taskId, this.config.id, { dispatchId: job.dispatchId });
             await this.broadcast("JOB_COMPLETED", {
                 dispatchId: job.dispatchId,

package/dist/src/agents/MinerAgent.d.ts

@@ -1,7 +1,7 @@
 /**
  * MinerAgent — knowledge extraction and storage agent.
  *
- * Allowed tools: read, write, edit, grep, find, ls, vm_search, vm_fts_search, vm_append
+ * Allowed tools: read, write, edit, grep, find, ls, vm_search, vm_append
  * Write collections: main, research
  * Cannot publish (vm_sync disabled).
  */

package/dist/src/agents/MinerAgent.js

@@ -1,7 +1,7 @@
 /**
  * MinerAgent — knowledge extraction and storage agent.
  *
- * Allowed tools: read, write, edit, grep, find, ls, vm_search, vm_fts_search, vm_append
+ * Allowed tools: read, write, edit, grep, find, ls, vm_search, vm_append
  * Write collections: main, research
  * Cannot publish (vm_sync disabled).
  */
@@ -25,7 +25,7 @@ export class MinerAgent extends Agent {
         if (!this.taskQueue.claim(taskId, this.config.id))
             return;
         try {
-            await this.executeJob(job);
+            await this.withDispatchContext(job.dispatchId, () => this.executeJob(job));
             this.taskQueue.complete(taskId, this.config.id, { dispatchId: job.dispatchId });
             await this.broadcast("JOB_COMPLETED", {
                 dispatchId: job.dispatchId,

package/dist/src/agents/index.d.ts

@@ -1,4 +1,4 @@
-export { HeavyLifterAgent, type DispatchJob } from "./HeavyLifterAgent.js";
-export { MinerAgent } from "./MinerAgent.js";
 export { BroadcasterAgent } from "./BroadcasterAgent.js";
+export { type DispatchJob, HeavyLifterAgent } from "./HeavyLifterAgent.js";
 export { ManagerAgent } from "./ManagerAgent.js";
+export { MinerAgent } from "./MinerAgent.js";

package/dist/src/agents/index.js

@@ -1,4 +1,4 @@
-export { HeavyLifterAgent } from "./HeavyLifterAgent.js";
-export { MinerAgent } from "./MinerAgent.js";
 export { BroadcasterAgent } from "./BroadcasterAgent.js";
+export { HeavyLifterAgent } from "./HeavyLifterAgent.js";
 export { ManagerAgent } from "./ManagerAgent.js";
+export { MinerAgent } from "./MinerAgent.js";

package/dist/src/auth.d.ts

@@ -3,18 +3,20 @@
  *
  * Token resolution order:
  *   1. `process.env.PVM_API_TOKEN`
- *   2. `<homedir>/.pi/agent/vault-mind.env` (key=value, # comments)
- *   3. `vaultMind.embedding.modal.apiToken` in the loaded config
+ *   2. `<vault>/.vault-mind/vault-mind.env` (key=value, # comments)
  *
  * Returns `null` if no token is configured (auth is off until set).
  *
- * Cross-platform: `os.homedir()` (never `~/`); `chmod 600` on the
- * dotenv file is the caller's responsibility and is a no-op on
- * win32 (the file system doesn't honor POSIX modes there).
+ * The token env path is resolved from the vault cwd via `getTokenEnvPath`;
+ * `chmod 600` on the dotenv file is best-effort and a no-op on win32 (the file
+ * system doesn't honor POSIX modes there).
+ *
+ * Provider credentials (PVM_REMOTE_EMBEDDING_API_KEY, PVM_MODAL_*_TOKEN,
+ * PVM_LOCAL_EMBEDDING_API_KEY) are intentionally never consulted for bridge
+ * authentication — see `src/embedding-secrets.ts` for provider secrets.
  */
-import type { UniversalConfig } from "./types.js";
-/** Resolve the bearer token. `cfg` is optional; pass the loaded config to fall back to it. */
-export declare const resolveAuthToken: (cfg?: UniversalConfig) => string | null;
+/** Resolve the bearer token from env or dotenv only. */
+export declare const resolveAuthToken: () => string | null;
 /** Resolved identity for a per-role bearer token. */
 export interface TokenIdentity {
     token: string;
@@ -49,7 +51,7 @@ export interface AuthResult {
  * 2. Legacy `PVM_API_TOKEN` — returns `ok: true` with no identity (full access).
  * 3. No token configured → `ok: true` (auth is off).
  */
-export declare const authoriseRequest: (req: IncomingLike, cfg?: UniversalConfig) => AuthResult;
+export declare const authoriseRequest: (req: IncomingLike) => AuthResult;
 /** Test-only: forget the cached token so tests get a fresh resolve on each call. */
 export declare const _resetAuthCache: () => void;
 /** Set an in-memory token override for the current process. Invalidates any cached value. */
@@ -58,16 +60,16 @@ export declare const setToken: (value: string) => void;
 export declare const clearToken: () => void;
 /**
  * Revoke a role-specific bearer token by removing `PVM_TOKEN_<IDENTITY>`
- * from `~/.pi/agent/vault-mind.env`. Preserves all other lines and comments.
- * Returns `true` if the variable was found and removed.
+ * from `<vault>/.vault-mind/vault-mind.env`. Preserves all other lines and
+ * comments. Returns `true` if the variable was found and removed.
  */
 export declare const revokeToken: (identity: string) => boolean;
 /**
  * Generate a fresh 32-byte base64url token, persist it to
- * `<os.homedir()>/.pi/agent/vault-mind.env` (replacing any existing
- * `PVM_API_TOKEN` line while preserving all other lines and comments), create
- * the directory + file if missing, apply `chmod 600` (best-effort; no-op on
- * win32), update the in-process cache, and return the new token.
+ * `<vault>/.vault-mind/vault-mind.env` (replacing any existing `PVM_API_TOKEN`
+ * line while preserving all other lines and comments), create the directory +
+ * file if missing, apply `chmod 600` (best-effort; no-op on win32), update the
+ * in-process cache, and return the new token.
  *
  * **Env-var precedence note:** if `PVM_API_TOKEN` is exported as an environment
  * variable it takes precedence over the dotenv file at resolution time, so the

package/dist/src/auth.js

@@ -3,28 +3,27 @@
  *
  * Token resolution order:
  *   1. `process.env.PVM_API_TOKEN`
- *   2. `<homedir>/.pi/agent/vault-mind.env` (key=value, # comments)
- *   3. `vaultMind.embedding.modal.apiToken` in the loaded config
+ *   2. `<vault>/.vault-mind/vault-mind.env` (key=value, # comments)
  *
  * Returns `null` if no token is configured (auth is off until set).
  *
- * Cross-platform: `os.homedir()` (never `~/`); `chmod 600` on the
- * dotenv file is the caller's responsibility and is a no-op on
- * win32 (the file system doesn't honor POSIX modes there).
+ * The token env path is resolved from the vault cwd via `getTokenEnvPath`;
+ * `chmod 600` on the dotenv file is best-effort and a no-op on win32 (the file
+ * system doesn't honor POSIX modes there).
+ *
+ * Provider credentials (PVM_REMOTE_EMBEDDING_API_KEY, PVM_MODAL_*_TOKEN,
+ * PVM_LOCAL_EMBEDDING_API_KEY) are intentionally never consulted for bridge
+ * authentication — see `src/embedding-secrets.ts` for provider secrets.
  */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
+import { getTokenEnvPath } from "./utils.js";
 const ENV_VAR = "PVM_API_TOKEN";
-const DOTENV_REL = path.join(".pi", "agent", "vault-mind.env");
 /** Cached token resolution. The cache is invalidated by `setToken` / `clearToken`. */
 let cached = null;
 const readDotenvToken = () => {
-    const home = os.homedir();
-    if (!home)
-        return null;
-    const p = path.join(home, DOTENV_REL);
+    const p = getTokenEnvPath(process.cwd());
     try {
         const text = fs.readFileSync(p, "utf-8");
         for (const line of text.split(/\r?\n/)) {
@@ -41,11 +40,8 @@ const readDotenvToken = () => {
     }
     return null;
 };
-const readConfigToken = (cfg) => {
-    return cfg?.vaultMind?.embedding?.modal?.apiToken;
-};
-/** Resolve the bearer token. `cfg` is optional; pass the loaded config to fall back to it. */
-export const resolveAuthToken = (cfg) => {
+/** Resolve the bearer token from env or dotenv only. */
+export const resolveAuthToken = () => {
     if (process.env[ENV_VAR])
         return process.env[ENV_VAR] ?? null;
     if (cached && cached.value !== null)
@@ -55,11 +51,6 @@ export const resolveAuthToken = (cfg) => {
         cached = { value: fromFile };
         return fromFile;
     }
-    const fromCfg = readConfigToken(cfg);
-    if (fromCfg) {
-        cached = { value: fromCfg };
-        return fromCfg;
-    }
     return null;
 };
 /**
@@ -106,16 +97,14 @@ const safeEqual = (a, b) => {
  * 2. Legacy `PVM_API_TOKEN` — returns `ok: true` with no identity (full access).
  * 3. No token configured → `ok: true` (auth is off).
  */
-export const authoriseRequest = (req, cfg) => {
+export const authoriseRequest = (req) => {
     const raw = req.headers.authorization;
     const header = Array.isArray(raw) ? raw[0] : raw;
     // Auth off: no tokens configured at all → allow everything
-    const hasPerRole = resolveTokenIdentity("") !== undefined || true; // check env vars
-    const hasLegacy = resolveAuthToken(cfg) !== null;
+    const hasLegacy = resolveAuthToken() !== null;
     if (!hasLegacy && !hasAnyPerRoleToken()) {
-        // No tokens configured — auth is off, allow all requests
-        if (!header)
-            return { ok: true };
+        // No tokens configured — auth is off, allow all requests regardless of header
+        return { ok: true };
     }
     if (!header)
         return { ok: false, reason: "missing" };
@@ -128,9 +117,9 @@ export const authoriseRequest = (req, cfg) => {
     if (identity)
         return { ok: true, identity };
     // 2. Legacy single-token fallback
-    const expected = resolveAuthToken(cfg);
+    const expected = resolveAuthToken();
     if (!expected)
-        return { ok: true }; // auth off — no tokens configured
+        return { ok: false, reason: "mismatch" }; // tokens are configured but none matched
     if (!safeEqual(token, expected))
         return { ok: false, reason: "mismatch" };
     return { ok: true };
@@ -149,12 +138,12 @@ export const clearToken = () => {
 };
 /**
  * Revoke a role-specific bearer token by removing `PVM_TOKEN_<IDENTITY>`
- * from `~/.pi/agent/vault-mind.env`. Preserves all other lines and comments.
- * Returns `true` if the variable was found and removed.
+ * from `<vault>/.vault-mind/vault-mind.env`. Preserves all other lines and
+ * comments. Returns `true` if the variable was found and removed.
  */
 export const revokeToken = (identity) => {
     const varName = `PVM_TOKEN_${identity.toUpperCase()}`;
-    const dotenvPath = path.join(os.homedir(), DOTENV_REL);
+    const dotenvPath = getTokenEnvPath(process.cwd());
     let lines = [];
     try {
         lines = fs.readFileSync(dotenvPath, "utf-8").split(/\r?\n/);
@@ -183,10 +172,10 @@ export const revokeToken = (identity) => {
 };
 /**
  * Generate a fresh 32-byte base64url token, persist it to
- * `<os.homedir()>/.pi/agent/vault-mind.env` (replacing any existing
- * `PVM_API_TOKEN` line while preserving all other lines and comments), create
- * the directory + file if missing, apply `chmod 600` (best-effort; no-op on
- * win32), update the in-process cache, and return the new token.
+ * `<vault>/.vault-mind/vault-mind.env` (replacing any existing `PVM_API_TOKEN`
+ * line while preserving all other lines and comments), create the directory +
+ * file if missing, apply `chmod 600` (best-effort; no-op on win32), update the
+ * in-process cache, and return the new token.
  *
  * **Env-var precedence note:** if `PVM_API_TOKEN` is exported as an environment
  * variable it takes precedence over the dotenv file at resolution time, so the
@@ -195,7 +184,7 @@ export const revokeToken = (identity) => {
  */
 export const rotateToken = () => {
     const newToken = crypto.randomBytes(32).toString("base64url");
-    const dotenvPath = path.join(os.homedir(), DOTENV_REL);
+    const dotenvPath = getTokenEnvPath(process.cwd());
     const dir = path.dirname(dotenvPath);
     if (!fs.existsSync(dir))
         fs.mkdirSync(dir, { recursive: true });

package/dist/src/autosync.js

@@ -20,14 +20,14 @@ export const startAutoSync = (intervalMs = 300_000) => {
     const tick = async () => {
         try {
             const cfg = loadConfig(process.cwd());
-            const sync = cfg.vaultMind.embedding.modal?.sync;
+            const sync = cfg.vaultMind.embedding.sync;
             if (!sync?.autoSync)
                 return; // off by default
             if (!isModalConfigured(cfg.vaultMind))
                 return; // nothing to sync
             const ms = sync.autoSyncIntervalMs ?? intervalMs;
             void ms; // cadence is fixed at start; tick honors config toggle
-            await syncAll(cfg);
+            await syncAll(cfg, process.cwd());
             console.log("[pi-vault-mind] auto-sync tick complete");
         }
         catch (err) {

package/dist/src/commands.d.ts

@@ -1,27 +1,10 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ServerState } from "./server.js";
+import { type ServerState } from "./server.js";
 export declare const auditConfig: (ctx: ExtensionContext) => Promise<void>;
 export declare const selectActiveCollection: (ctx: ExtensionContext) => Promise<void>;
-/**
- * Vault-root `.gitignore` entries that keep pi-vault-mind compatible with
- * `obsidian-git` (and, transitively, Obsidian Sync setups that also back up via
- * git): the LanceDB index is a large, per-device, rebuildable binary and must
- * never be committed; Obsidian's workspace UI state churns constantly. See
- * docs/OBSIDIAN_SETUP.md §6.
- */
-export declare const GITIGNORE_ENTRIES: string[];
-/**
- * Decide what to do with the vault `.gitignore`, given its current contents
- * (`null` if absent). Pure — does no I/O — so it is unit-testable. Creates the
- * file when missing, appends only the entries that aren't already present
- * (line-exact match, trimmed), and skips when everything is covered.
- */
-export declare const planGitignore: (existing: string | null) => {
-    action: "create" | "append" | "skip";
-    content: string;
-};
 export declare const watcherState: import("./watcher.js").WatcherState;
 /** Module-level server state, referenced by the /vm server command.
  *  Port is set when the server starts in index.ts. */
 export declare const serverState: ServerState;
+export declare const writeTokenEnv: (token: string, cwd: string, varName?: string) => void;
 export declare const registerCommands: (pi: ExtensionAPI) => void;