pi-vault-mind 0.14.2 → 0.16.3

package/dist/src/graph.js

@@ -1,5 +1,10 @@
-import { connect } from "./lance.js";
-const RELATION_TYPES = ["relates-to", "depends-on", "contradicts", "is-a", "part-of"];
+import * as arrow from "apache-arrow";
+import { connect, filterByVisibility } from "./lance.js";
+function escapeWhereValue(value) {
+    const escaped = value.replace(/\\/g, "\\\\").replace(/'/g, "''");
+    return `'${escaped}'`;
+}
+const _RELATION_TYPES = ["relates-to", "depends-on", "contradicts", "is-a", "part-of"];
 const extractEntities = (fact) => {
     // Simple regex-based entity extraction as a lightweight alternative to LLM
     const entities = [];
@@ -92,7 +97,7 @@ export const graphUpsert = async (dataDir, cfg, entry) => {
     for (const entity of entities) {
         const existing = await entityTable
             .query()
-            .where(`name = '${entity.name.replace(/'/g, "''")}'`)
+            .where(`name = ${escapeWhereValue(entity.name)}`)
             .limit(1)
             .toArray();
         if (existing.length === 0) {
@@ -143,12 +148,12 @@ export const graphUpsert = async (dataDir, cfg, entry) => {
             continue;
         const fromExisting = await entityTable
             .query()
-            .where(`name = '${rel.from.replace(/'/g, "''")}'`)
+            .where(`name = ${escapeWhereValue(rel.from)}`)
             .limit(1)
             .toArray();
         const toExisting = await entityTable
             .query()
-            .where(`name = '${rel.to.replace(/'/g, "''")}'`)
+            .where(`name = ${escapeWhereValue(rel.to)}`)
             .limit(1)
             .toArray();
         if (fromExisting.length === 0 || toExisting.length === 0)
@@ -169,14 +174,14 @@ export const graphUpsert = async (dataDir, cfg, entry) => {
         ]);
     }
 };
-export const queryGraph = async (dataDir, cfg, entityQuery, depth) => {
+export const queryGraph = async (dataDir, cfg, entityQuery, depth, identity) => {
     const conn = await connect(dataDir);
     const entityTable = await getGraphTable(conn, dataDir, cfg, "entities");
     const relationTable = await getGraphTable(conn, dataDir, cfg, "relations");
     // Find seed entities
     const seedResults = await entityTable
         .query()
-        .where(`name LIKE '%${entityQuery.replace(/'/g, "''")}%'`)
+        .where(`name LIKE ${escapeWhereValue(`%${entityQuery}%`)}`)
         .limit(5)
         .toArray();
     if (seedResults.length === 0) {
@@ -196,12 +201,12 @@ export const queryGraph = async (dataDir, cfg, entityQuery, depth) => {
             // Find relations where this entity is source or target
             const outgoing = await relationTable
                 .query()
-                .where(`from_entity_id = '${eid}'`)
+                .where(`from_entity_id = ${escapeWhereValue(eid)}`)
                 .limit(20)
                 .toArray();
             const incoming = await relationTable
                 .query()
-                .where(`to_entity_id = '${eid}'`)
+                .where(`to_entity_id = ${escapeWhereValue(eid)}`)
                 .limit(20)
                 .toArray();
             for (const rel of [...outgoing, ...incoming]) {
@@ -212,7 +217,7 @@ export const queryGraph = async (dataDir, cfg, entityQuery, depth) => {
                 if (!visitedIds.has(otherId)) {
                     const otherEntity = await entityTable
                         .query()
-                        .where(`id = '${otherId}'`)
+                        .where(`id = ${escapeWhereValue(otherId)}`)
                         .limit(1)
                         .toArray();
                     if (otherEntity.length > 0) {
@@ -223,12 +228,41 @@ export const queryGraph = async (dataDir, cfg, entityQuery, depth) => {
         }
         frontier = nextFrontier;
     }
-    return { entities: seedResults, relations: allRelations };
+    const filteredEntities = filterByVisibility(seedResults, identity);
+    const filteredRelations = filterByVisibility(allRelations, identity);
+    return { entities: filteredEntities, relations: filteredRelations };
 };
-async function getGraphTable(conn, _dataDir, cfg, name) {
+function makeEntitySchema() {
+    return new arrow.Schema([
+        new arrow.Field("id", new arrow.Utf8(), true),
+        new arrow.Field("name", new arrow.Utf8(), true),
+        new arrow.Field("type", new arrow.Utf8(), true),
+        new arrow.Field("aliases", new arrow.Utf8(), true),
+        new arrow.Field("summary", new arrow.Utf8(), true),
+        new arrow.Field("collection_ids", new arrow.Utf8(), true),
+        new arrow.Field("created_at", new arrow.Utf8(), true),
+        new arrow.Field("updated_at", new arrow.Utf8(), true),
+    ]);
+}
+function makeRelationSchema() {
+    return new arrow.Schema([
+        new arrow.Field("id", new arrow.Utf8(), true),
+        new arrow.Field("from_entity_id", new arrow.Utf8(), true),
+        new arrow.Field("to_entity_id", new arrow.Utf8(), true),
+        new arrow.Field("relation_type", new arrow.Utf8(), true),
+        new arrow.Field("fact", new arrow.Utf8(), true),
+        new arrow.Field("fact_strength", new arrow.Float32(), true),
+        new arrow.Field("source_entry_ids", new arrow.Utf8(), true),
+        new arrow.Field("valid_at", new arrow.Utf8(), true),
+        new arrow.Field("expired_at", new arrow.Utf8(), true),
+        new arrow.Field("created_at", new arrow.Utf8(), true),
+    ]);
+}
+async function getGraphTable(conn, _dataDir, _cfg, name) {
     const existing = await conn.tableNames();
     if (existing.includes(name)) {
         return conn.openTable(name);
     }
-    return conn.openTable(name);
+    const schema = name === "entities" ? makeEntitySchema() : makeRelationSchema();
+    return conn.createEmptyTable(name, schema);
 }

package/dist/src/identities-config.d.ts

@@ -0,0 +1,6 @@
+import type { IdentitiesConfig } from "./types.js";
+/**
+ * Write a partial identities config into the vault-local config layer.
+ * Deep-merges into vaultMind.identities so existing roles are preserved.
+ */
+export declare function writeIdentitiesLayer(cwd: string, identities: Partial<IdentitiesConfig>): void;

package/dist/src/identities-config.js

@@ -0,0 +1,39 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getConfigPath } from "./utils.js";
+/** Deep-merge two objects. Reused from server.ts pattern. */
+function deepMerge(base, overlay) {
+    const result = { ...base };
+    for (const key of Object.keys(overlay)) {
+        const ov = overlay[key];
+        if (ov &&
+            typeof ov === "object" &&
+            !Array.isArray(ov) &&
+            typeof result[key] === "object" &&
+            result[key] !== null &&
+            !Array.isArray(result[key])) {
+            result[key] = deepMerge(result[key], ov);
+        }
+        else {
+            result[key] = ov;
+        }
+    }
+    return result;
+}
+/**
+ * Write a partial identities config into the vault-local config layer.
+ * Deep-merges into vaultMind.identities so existing roles are preserved.
+ */
+export function writeIdentitiesLayer(cwd, identities) {
+    const configPath = getConfigPath(cwd);
+    const existing = fs.existsSync(configPath)
+        ? JSON.parse(fs.readFileSync(configPath, "utf-8"))
+        : {};
+    const vaultMind = existing.vaultMind || {};
+    vaultMind.identities = deepMerge(vaultMind.identities || {}, identities);
+    existing.vaultMind = vaultMind;
+    const dir = path.dirname(configPath);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(configPath, `${JSON.stringify(existing, null, 2)}\n`, "utf-8");
+}

package/dist/src/identity-injector.js

@@ -32,7 +32,7 @@ const BOUNDARY_PROMPTS = {
         "--- IDENTITY BOUNDARY: Broadcaster ---",
         "You are the Broadcaster agent. Your capability boundary:",
         "- You MAY: read files, write files, edit files.",
-        "- You MAY: search collections via vm_search, vm_fts_search.",
+        "- You MAY: search collections via vm_search.",
         "- You MUST NOT: run bash commands, grep, or find.",
         "- You MUST NOT: write to the durable knowledge store.",
         "- You MUST NOT: publish or spawn sub-agents.",

package/dist/src/index.js

@@ -13,7 +13,7 @@ import { registerIntakeTool } from "./intake.js";
 import { startServer, stopServer } from "./server.js";
 import { clearEngineStatus, clearWatcherStatus, registerStatusCapture, setEngineStatus, } from "./status.js";
 import { registerTools } from "./tools.js";
-import { EXT_ROOT, findConfig, loadConfig } from "./utils.js";
+import { EXT_ROOT, isVaultMindReady, loadConfig } from "./utils.js";
 import { registerVaultTools } from "./vault-tools.js";
 import { registerAllExtensionTools } from "./vm-handlers.js";
 import { startWatcher, stopWatcher, subscribeJobCompleted } from "./watcher.js";
@@ -37,30 +37,13 @@ export default function (pi) {
      * during extension loading — the runtime must be initialized first. */
     pi.on("session_start", async (_event, ctx) => {
         updateActiveCollectionWidget(ctx);
-        /* Only enable ACM when THIS vault has been configured (setup has been run).
-         * Check the PROJECT config only — not the merged global+project config.
-         * The global config may have remoteUrl/localUrl from other vaults, which
-         * would incorrectly trigger ACM on a fresh vault. */
-        const paths = findConfig(ctx.cwd);
-        const projectCfg = paths.project
-            ? (() => {
-                try {
-                    return JSON.parse(fs.readFileSync(paths.project, "utf-8"));
-                }
-                catch {
-                    return {};
-                }
-            })()
-            : {};
-        const projectEmbed = projectCfg.vaultMind?.embedding;
-        const projectAgentLLM = projectCfg.vaultMind?.agentLLM;
-        const isSetup = !!(projectEmbed?.remoteUrl ||
-            projectEmbed?.localUrl ||
-            projectEmbed?.model ||
-            projectAgentLLM?.model);
+        /* Auto-enable ACM only when this vault is completely configured and
+         * ready. isVaultMindReady reads the RAW config file (not the merged
+         * config, whose DEFAULT_CONFIG always populates embedding.localUrl and
+         * would make a fresh vault look ready). */
         const sessionCfg = loadConfig(ctx.cwd);
         const piCtxCfg = sessionCfg.extensionCompatibility?.["pi-context"];
-        if (isSetup && piCtxCfg?.enabled && piCtxCfg?.autoEnableAcm !== false) {
+        if (isVaultMindReady(ctx.cwd) && piCtxCfg?.enabled && piCtxCfg?.autoEnableAcm !== false) {
             enableACM(pi);
         }
         /* register shortcut */
@@ -122,9 +105,9 @@ export default function (pi) {
                     startWatcher(pi, autoVaultMap, watcherState);
                 }, 2000);
             }
-            if (cfg.vaultMind.embedding.remoteUrl && cfg.vaultMind.embedding.modal?.sync?.autoSync) {
-                stopAutoSync = startAutoSync(cfg.vaultMind.embedding.modal?.sync?.autoSyncIntervalMs ?? 300000);
-                console.log(`[pi-vault-mind] Modal auto-sync enabled (every ${cfg.vaultMind.embedding.modal?.sync?.autoSyncIntervalMs ?? 300000}ms)`);
+            if (cfg.vaultMind.embedding.remoteUrl && cfg.vaultMind.embedding.sync?.autoSync) {
+                stopAutoSync = startAutoSync(cfg.vaultMind.embedding.sync?.autoSyncIntervalMs ?? 300000);
+                console.log(`[pi-vault-mind] Modal auto-sync enabled (every ${cfg.vaultMind.embedding.sync?.autoSyncIntervalMs ?? 300000}ms)`);
             }
         }
         catch {

package/dist/src/lance.d.ts

@@ -11,6 +11,9 @@ export declare const upsertEntry: (dataDir: string, collectionName: string, entr
  * text + metadata. Idempotent (re-fetching a boundary row is a no-op).
  */
 export declare const upsertPrecomputed: (dataDir: string, collectionName: string, model: string, dim: number, rows: Array<Record<string, unknown>>, cfg: VaultMindConfig, identity?: AgentIdentity) => Promise<void>;
+/** Filter results by visibility: show public entries + entries owned by the reader. No identity = no filter (backward compat).
+ * Records without visibility/origin_identity fields (e.g. graph entities/relations) are treated as public. */
+export declare function filterByVisibility(results: unknown[], identity?: AgentIdentity): unknown[];
 /**
  * Deterministic JSONL query for a collection. Applies optional substring search,
  * exact field filters, identity visibility filter, and pagination.
@@ -18,4 +21,10 @@ export declare const upsertPrecomputed: (dataDir: string, collectionName: string
 export declare const queryCollection: (collectionPath: string, schema: string[], query: string | null | undefined, filters: Record<string, string> | undefined, limit: number, offset: number, identity?: AgentIdentity) => Promise<unknown[]>;
 export declare const searchHybrid: (dataDir: string, collectionName: string, query: string, limit: number, cfg: VaultMindConfig, identity?: AgentIdentity) => Promise<unknown[]>;
 export declare const searchFts: (dataDir: string, collectionName: string, query: string, limit: number, cfg: VaultMindConfig, identity?: AgentIdentity) => Promise<unknown[]>;
+/**
+ * Rank-merge vector and FTS results: vector hits score higher, deduplicated by
+ * id or fact. Each result is tagged with `_source: "vector" | "fts"`. Falls
+ * back gracefully — if either path fails, the other still contributes.
+ */
+export declare const searchHybridRanked: (dataDir: string, collectionName: string, query: string, limit: number, cfg: VaultMindConfig, identity?: AgentIdentity) => Promise<unknown[]>;
 export declare const getStatus: (dataDir: string) => Promise<Record<string, unknown>>;