pi-vault-mind 0.16.10 → 0.16.12

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+
+## 0.16.12 / 0.6.16 — 2026-07-20
+
+### Fixed
+
+- **Minimal config before bridge start.** The setup wizard now writes a minimal `.vault-mind/vault-mind.config.json` with the vault path before starting the bridge, so `startServer` picks up the correct `vaultPath` immediately instead of falling back to `process.cwd()`.
+- **Model-router vault isolation.** `model-router.json` is now always vault-scoped under `<vault>/.vault-mind/.pi/model-router.json`. The global `~/.pi/model-router.json` fallback is removed.
+- **Stale `server.json` cleanup.** Dead PIDs and mismatched vault paths now delete the stale discovery file and spawn a fresh runtime instead of looping or throwing.
+- **Vault path re-resolution after setup.** `POST /vm/setup` now updates the running server's `vaultPath` from the newly written config, preventing stale path references until restart.
+- **Runtime files relocated.** `ensureVaultRuntime.ts` and `startFreshRuntime.ts` moved from `packages/obsidian/src/chat/` to `packages/obsidian/src/runtime/`.
+- **Agent folder creation on setup save.** The four default Agent/ folders (Inbox, Library, Presentations, Journal) are now created during `POST /vm/setup` using the user's configured paths or defaults.
+- **Expanded vault reset.** `reset-test-vault.sh` now also removes `Pi-Sessions/`, `AGENTS.md`, `.env.1pass`, `.omp/`, Agent/ subdirectories, and the entire `vault-mind` plugin directory.
+
+### Verification
+
+- Added stale-discovery cleanup tests (dead PID, mismatched vaultPath, healthy adoption).
+- Expanded reset-test-vault assertions for all newly removed artifacts.
+
+## 0.16.11 / 0.6.15 — 2026-07-20
+
+### Fixed
+
+- **Panel recovery after bridge startup.** A later panel reconciliation now rehydrates the same Queue, Activity, session, collection, pending-edit, and Git metadata that initial controller startup loads, so a bridge that becomes available after the panel mounted no longer leaves those surfaces permanently stale.
+- **Deterministic ReturnVape reset.** `reset-test-vault.sh` verifies the PID and port registered in `.vault-mind/server.json` serve the target vault before terminating and waiting for that runtime. A stale registry cannot signal an unrelated PID. The reset no longer copies local plugin artifacts; BRAT is the only test-vault update path.
+
+### Verification
+
+- Added focused regressions for panel metadata recovery after an initial bridge outage, verified runtime termination, and stale-registry safety.
+
+
 ## 0.16.10 / 0.6.14 — 2026-07-20
 
 ### Added

package/dist/src/config-keys.d.ts

@@ -11,6 +11,6 @@
  *   - VAULT_MIND_CONFIG_KEYS: fully-qualified dotted paths (for static access)
  */
 /** Bare key names on vaultMind.embedding — used by setup wizard, CLI, HTTP, and plugin. */
-export declare const EMBEDDING_FLAT_KEYS: readonly ["remoteUrl", "localUrl", "model", "apiKey", "dim", "useTransformers", "remoteApiKey", "remoteReadApiKey", "remoteWriteApiKey", "fallback", "sync", "collectionModels", "coalesce"];
+export declare const EMBEDDING_FLAT_KEYS: readonly ["remoteUrl", "localUrl", "model", "apiKey", "dim", "useTransformers", "remoteApiKey", "fallback", "sync", "collectionModels", "coalesce"];
 /** Fully-qualified dotted key paths that the plugin's reconfigure form reads/writes. */
 export declare const VAULT_MIND_CONFIG_KEYS: readonly ["vaultMind.embedding.remoteUrl", "vaultMind.embedding.localUrl", "vaultMind.embedding.model", "vaultMind.embedding.dim", "vaultMind.embedding.useTransformers", "vaultMind.embedding.remoteApiKey", "vaultMind.embedding.fallback", "vaultMind.embedding.sync", "vaultMind.ftsEnabled", "vaultMind.graph", "vaultMind.vaults.default.autoStart", "extensionCompatibility.pi-context.enabled"];

package/dist/src/config-keys.js

@@ -19,8 +19,6 @@ export const EMBEDDING_FLAT_KEYS = [
     "dim",
     "useTransformers",
     "remoteApiKey",
-    "remoteReadApiKey",
-    "remoteWriteApiKey",
     "fallback",
     "sync",
     "collectionModels",

package/dist/src/embedding-probe.d.ts

@@ -5,8 +5,6 @@ export interface EmbeddingProbeRequest {
     model?: string;
     transientSecrets?: {
         apiKey?: string;
-        readApiKey?: string;
-        writeApiKey?: string;
     };
 }
 export interface EmbeddingModelOption {

package/dist/src/embedding-probe.js

@@ -99,17 +99,11 @@ const resolveAuthorizationHeader = (request, cfg) => {
             return resolveEmbeddingSecret(cfg, "localApiKey");
         return undefined;
     }
-    // Remote read path: never select write-scoped credentials.
-    if (request.transientSecrets?.readApiKey)
-        return request.transientSecrets.readApiKey;
+    // Remote path: use the single remote API key.
     if (request.transientSecrets?.apiKey)
         return request.transientSecrets.apiKey;
-    if (cfg) {
-        const readToken = resolveEmbeddingSecret(cfg, "remoteReadApiKey");
-        if (readToken)
-            return readToken;
+    if (cfg)
         return resolveEmbeddingSecret(cfg, "remoteApiKey");
-    }
     return undefined;
 };
 export async function probeEmbeddingEndpoint(request, options) {

package/dist/src/embedding-secrets.js

@@ -14,8 +14,6 @@ import { getTokenEnvPath } from "./utils.js";
 const DEFINITIONS = {
     localApiKey: { env: "PVM_LOCAL_EMBEDDING_API_KEY", legacy: "apiKey" },
     remoteApiKey: { env: "PVM_REMOTE_EMBEDDING_API_KEY", legacy: "remoteApiKey" },
-    remoteReadApiKey: { env: "PVM_MODAL_READ_TOKEN", legacy: "remoteReadApiKey" },
-    remoteWriteApiKey: { env: "PVM_MODAL_WRITE_TOKEN", legacy: "remoteWriteApiKey" },
 };
 export const EMBEDDING_SECRET_MASK = "••••••••";
 const getEnv = (opts, key) => {
@@ -76,12 +74,7 @@ const getSecretSource = (cfg, kind, envRecord, opts) => {
 };
 /** Return the status of all four embedding secret kinds in declaration order. */
 export const readEmbeddingSecretStatus = (cfg, opts) => {
-    const kinds = [
-        "localApiKey",
-        "remoteApiKey",
-        "remoteReadApiKey",
-        "remoteWriteApiKey",
-    ];
+    const kinds = ["localApiKey", "remoteApiKey"];
     const envRecord = readDotEnv(getEnvPath(opts));
     return {
         secrets: kinds.map((kind) => {

package/dist/src/lance.js

@@ -4,7 +4,8 @@ import * as lancedb from "@lancedb/lancedb";
 import { LanceSchema, TextEmbeddingFunction } from "@lancedb/lancedb/embedding";
 import * as arrow from "apache-arrow";
 import { EmbeddingCoalescer } from "./embed-queue.js";
-import { createProvider } from "./embedding-providers.js";
+import { createProvider, DEFAULT_OLLAMA_API_KEY, OpenAICompatibleProvider, } from "./embedding-providers.js";
+import { resolveEmbeddingSecret } from "./embedding-secrets.js";
 import { namespacedTableName, resolveDim, resolveModel } from "./modal-config.js";
 let db = null;
 // ── Connection ──────────────────────────────────────────────────────────────
@@ -261,9 +262,19 @@ const fallbackQueryEmbed = async (cfg, collection, text) => {
     const canonical = resolveModel(cfg, collection);
     if ((cfg.embedding.model || "embeddinggemma") !== canonical)
         return null;
+    const localCfg = {
+        ...cfg,
+        embedding: { ...cfg.embedding, remoteUrl: "" },
+    };
     try {
-        const fn = await createProvider(cfg, { collection });
-        const vecs = await fn.embed([text], "query");
+        const provider = new OpenAICompatibleProvider({
+            url: cfg.embedding.localUrl,
+            model: resolveModel(localCfg, collection),
+            apiKey: resolveEmbeddingSecret(localCfg, "localApiKey") ?? DEFAULT_OLLAMA_API_KEY,
+            dims: resolveDim(localCfg, collection),
+        });
+        await provider.init();
+        const vecs = await provider.embed([text], "query");
         return vecs[0];
     }
     catch (err) {
@@ -484,9 +495,19 @@ const fallbackDocumentEmbed = async (cfg, collection, text) => {
     const canonical = resolveModel(cfg, collection);
     if ((cfg.embedding.model || "embeddinggemma") !== canonical)
         return null;
+    const localCfg = {
+        ...cfg,
+        embedding: { ...cfg.embedding, remoteUrl: "" },
+    };
     try {
-        const fn = await createProvider(cfg, { collection });
-        const vecs = await fn.embed([text], "document");
+        const provider = new OpenAICompatibleProvider({
+            url: cfg.embedding.localUrl,
+            model: resolveModel(localCfg, collection),
+            apiKey: resolveEmbeddingSecret(localCfg, "localApiKey") ?? DEFAULT_OLLAMA_API_KEY,
+            dims: resolveDim(localCfg, collection),
+        });
+        await provider.init();
+        const vecs = await provider.embed([text], "document");
         return vecs[0];
     }
     catch (err) {

package/dist/src/modal-client.d.ts

@@ -18,12 +18,8 @@
 export interface ModalClientConfig {
     /** Base URL of the deployed ASGI app (no trailing slash needed). */
     baseUrl: string;
-    /** Fallback bearer token (legacy single token for all operations). */
+    /** Bearer token for all operations. */
     apiToken?: string;
-    /** Read-scoped token for search/export operations. Falls back to `apiToken`. */
-    readToken?: string;
-    /** Write-scoped token for embed/reindex operations. Falls back to `apiToken`. */
-    writeToken?: string;
     /** Per-request timeout in ms (default 120s — bulk submits can be large). */
     timeoutMs?: number;
 }
@@ -105,12 +101,10 @@ export interface ExportPage {
 export declare class ModalEmbeddingClient {
     private baseUrl;
     private apiToken;
-    private readToken;
-    private writeToken;
     private timeoutMs;
     constructor(cfg: ModalClientConfig);
-    /** Return the bearer token to use for the requested operation scope. */
-    private tokenFor;
+    /** Return the bearer token to use for requests. */
+    private token;
     private request;
     /** Liveness check; also returns the server's default model. */
     health(): Promise<{
@@ -155,7 +149,7 @@ export declare class ModalEmbeddingClient {
         since?: number;
         limit?: number;
     }): Promise<ExportPage>;
-    /** Low-level binary request helper with scoped token selection. */
+    /** Low-level binary request helper. */
     private requestBuffer;
     /** Pull one page of rows with seq > since as an Arrow IPC stream.
      * Vectors are always included (no include_vectors flag). The watermark /

package/dist/src/modal-client.js

@@ -18,31 +18,26 @@
 export class ModalEmbeddingClient {
     baseUrl;
     apiToken;
-    readToken;
-    writeToken;
     timeoutMs;
     constructor(cfg) {
         this.baseUrl = cfg.baseUrl.replace(/\/$/, "");
         this.apiToken = cfg.apiToken;
-        this.readToken = cfg.readToken ?? cfg.apiToken;
-        this.writeToken = cfg.writeToken ?? cfg.apiToken;
         this.timeoutMs = cfg.timeoutMs ?? 120_000;
     }
-    /** Return the bearer token to use for the requested operation scope. */
-    tokenFor(operation) {
-        const token = operation === "read" ? this.readToken : this.writeToken;
-        if (!token)
-            throw new Error(`Modal ${operation} token not configured`);
-        return token;
+    /** Return the bearer token to use for requests. */
+    token() {
+        if (!this.apiToken)
+            throw new Error("Modal API token not configured");
+        return this.apiToken;
     }
-    async request(method, path, body, operation = "write") {
+    async request(method, path, body) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
             const resp = await fetch(`${this.baseUrl}${path}`, {
                 method,
                 headers: {
-                    Authorization: `Bearer ${this.tokenFor(operation)}`,
+                    Authorization: `Bearer ${this.token()}`,
                     ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
                 },
                 body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -60,17 +55,17 @@ export class ModalEmbeddingClient {
     }
     /** Liveness check; also returns the server's default model. */
     health() {
-        return this.request("GET", "/health", undefined, "read");
+        return this.request("GET", "/health", undefined);
     }
     /** Registry of available embedders (public; no auth). Use native_dim to
      * resolve a model's output dim up-front instead of waiting for the first
      * /embed response. (Additive — Agent B request #2.) */
     models() {
-        return this.request("GET", "/models", undefined, "read");
+        return this.request("GET", "/models", undefined);
     }
     /** Server-side store + compute stats (rows per namespace, index state, GPU). */
     stats() {
-        return this.request("GET", "/stats", undefined, "read");
+        return this.request("GET", "/stats", undefined);
     }
     /** Embed text on demand. Use task="query" for search, "document" for storage. */
     embed(texts, opts = {}) {
@@ -79,7 +74,7 @@ export class ModalEmbeddingClient {
             model: opts.model,
             dim: opts.dim,
             task: opts.task ?? "query",
-        }, "write");
+        });
     }
     /** Submit a bulk embedding job; embeds + stores server-side. */
     submitJob(collection, records, opts = {}) {
@@ -88,10 +83,10 @@ export class ModalEmbeddingClient {
             records,
             model: opts.model,
             dim: opts.dim,
-        }, "write");
+        });
     }
     jobStatus(jobId) {
-        return this.request("GET", `/jobs/${encodeURIComponent(jobId)}`, undefined, "read");
+        return this.request("GET", `/jobs/${encodeURIComponent(jobId)}`, undefined);
     }
     /** List recent jobs (newest first). Additive — surfaces GET /jobs so
      * `/vm remote jobs` can list, not just poll a known id. (Agent B request #1.) */
@@ -100,12 +95,12 @@ export class ModalEmbeddingClient {
         if (limit != null)
             p.set("limit", String(limit));
         const qs = p.toString();
-        return this.request("GET", `/jobs${qs ? `?${qs}` : ""}`, undefined, "read");
+        return this.request("GET", `/jobs${qs ? `?${qs}` : ""}`, undefined);
     }
     /** Cooperatively cancel a running/queued job. The worker stops after its
      * current batch and writes status=cancelled. */
     cancelJob(jobId) {
-        return this.request("POST", `/jobs/${encodeURIComponent(jobId)}/cancel`, undefined, "write");
+        return this.request("POST", `/jobs/${encodeURIComponent(jobId)}/cancel`, undefined);
     }
     /** Poll a job until it reaches a terminal state. */
     async waitForJob(jobId, pollMs = 2000) {
@@ -118,7 +113,7 @@ export class ModalEmbeddingClient {
     }
     /** List the collections/tables held in the server-side vector store. */
     async syncCollections() {
-        const out = await this.request("GET", "/sync/collections", undefined, "read");
+        const out = await this.request("GET", "/sync/collections", undefined);
         return out.collections;
     }
     /** Pull one page of rows with seq > since. Remember next_watermark. */
@@ -130,16 +125,16 @@ export class ModalEmbeddingClient {
             p.set("dim", String(opts.dim));
         p.set("since", String(opts.since ?? 0));
         p.set("limit", String(opts.limit ?? 500));
-        return this.request("GET", `/sync/export?${p.toString()}`, undefined, "read");
+        return this.request("GET", `/sync/export?${p.toString()}`, undefined);
     }
-    /** Low-level binary request helper with scoped token selection. */
-    async requestBuffer(method, path, operation = "read") {
+    /** Low-level binary request helper. */
+    async requestBuffer(method, path) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
             const resp = await fetch(`${this.baseUrl}${path}`, {
                 method,
-                headers: { Authorization: `Bearer ${this.tokenFor(operation)}` },
+                headers: { Authorization: `Bearer ${this.token()}` },
                 signal: controller.signal,
             });
             if (!resp.ok) {
@@ -166,7 +161,7 @@ export class ModalEmbeddingClient {
             p.set("dim", String(opts.dim));
         p.set("since", String(opts.since ?? 0));
         p.set("limit", String(opts.limit ?? 500));
-        const resp = await this.requestBuffer("GET", `/sync/export?${p.toString()}`, "read");
+        const resp = await this.requestBuffer("GET", `/sync/export?${p.toString()}`);
         const nextWatermark = Number(resp.headers.get("X-Next-Watermark") ?? opts.since ?? 0);
         const done = (resp.headers.get("X-Done") ?? "true") === "true";
         const count = Number(resp.headers.get("X-Count") ?? 0);

package/dist/src/modal-config.d.ts

@@ -10,12 +10,8 @@
  */
 import { ModalEmbeddingClient } from "./modal-client.js";
 import type { VaultMindConfig } from "./types.js";
-/** Env var name for the unscoped remote embedding API key (preferred over config). */
+/** Env var name for the remote embedding API key (preferred over config). */
 export declare const MODAL_TOKEN_ENV = "PVM_REMOTE_EMBEDDING_API_KEY";
-/** Env var name for the read-scoped Modal token (search/export). */
-export declare const MODAL_READ_TOKEN_ENV = "PVM_MODAL_READ_TOKEN";
-/** Env var name for the write-scoped Modal token (embed/reindex). */
-export declare const MODAL_WRITE_TOKEN_ENV = "PVM_MODAL_WRITE_TOKEN";
 /**
  * Dotenv fallback path for the Modal token, resolved from the vault cwd:
  * `<vault>/.vault-mind/vault-mind.env`. Lazy so tests can override cwd.
@@ -35,23 +31,9 @@ export declare const MODAL_REMOTE_URL = "https://kylebrodeur--pi-vault-mind-embe
  * Never log the resolved token.
  */
 export declare const resolveModalToken: (cfg: VaultMindConfig) => string | undefined;
-/**
- * Resolve a scoped Modal token for the requested operation.
- * Resolution order:
- * 1. `PVM_MODAL_{READ|WRITE}_TOKEN` env var
- * 2. `<vault>/.vault-mind/vault-mind.env`
- * 3. `vaultMind.embedding.remoteReadApiKey` / `remoteWriteApiKey` in config
- * 4. Fallback to the unscoped `PVM_REMOTE_EMBEDDING_API_KEY` (env, dotenv, then config)
- *
- * `PVM_API_TOKEN` is intentionally not consulted — it is reserved for the
- * extension's bridge authentication.
- *
- * Never log the resolved token.
- */
-export declare const getModalToken: (cfg: VaultMindConfig, operation: "read" | "write") => string | undefined;
 /** Resolve only an explicitly configured remote URL. */
 export declare const resolveBaseUrl: (cfg: VaultMindConfig) => string | undefined;
-/** True when Modal is usable: an explicit remote URL and at least one resolvable scoped token are present. */
+/** True when Modal is usable: an explicit remote URL and a resolvable remote token are present. */
 export declare const isModalConfigured: (cfg: VaultMindConfig) => boolean;
 /**
  * Build a `ModalEmbeddingClient` from config. Returns null when Modal is not

package/dist/src/modal-config.js

@@ -11,12 +11,8 @@
 import * as fs from "node:fs";
 import { ModalEmbeddingClient } from "./modal-client.js";
 import { deriveCollectionNameFromVaultPath, getTokenEnvPath, normalizeCollectionName, } from "./utils.js";
-/** Env var name for the unscoped remote embedding API key (preferred over config). */
+/** Env var name for the remote embedding API key (preferred over config). */
 export const MODAL_TOKEN_ENV = "PVM_REMOTE_EMBEDDING_API_KEY";
-/** Env var name for the read-scoped Modal token (search/export). */
-export const MODAL_READ_TOKEN_ENV = "PVM_MODAL_READ_TOKEN";
-/** Env var name for the write-scoped Modal token (embed/reindex). */
-export const MODAL_WRITE_TOKEN_ENV = "PVM_MODAL_WRITE_TOKEN";
 /**
  * Dotenv fallback path for the Modal token, resolved from the vault cwd:
  * `<vault>/.vault-mind/vault-mind.env`. Lazy so tests can override cwd.
@@ -68,36 +64,10 @@ export const resolveModalToken = (cfg) => {
         return dotenv[MODAL_TOKEN_ENV];
     return cfg.embedding.remoteApiKey;
 };
-/**
- * Resolve a scoped Modal token for the requested operation.
- * Resolution order:
- * 1. `PVM_MODAL_{READ|WRITE}_TOKEN` env var
- * 2. `<vault>/.vault-mind/vault-mind.env`
- * 3. `vaultMind.embedding.remoteReadApiKey` / `remoteWriteApiKey` in config
- * 4. Fallback to the unscoped `PVM_REMOTE_EMBEDDING_API_KEY` (env, dotenv, then config)
- *
- * `PVM_API_TOKEN` is intentionally not consulted — it is reserved for the
- * extension's bridge authentication.
- *
- * Never log the resolved token.
- */
-export const getModalToken = (cfg, operation) => {
-    const dotenv = readDotEnv(modalTokenEnvPath());
-    if (operation === "read") {
-        return (process.env[MODAL_READ_TOKEN_ENV] ||
-            dotenv[MODAL_READ_TOKEN_ENV] ||
-            cfg.embedding.remoteReadApiKey ||
-            resolveModalToken(cfg));
-    }
-    return (process.env[MODAL_WRITE_TOKEN_ENV] ||
-        dotenv[MODAL_WRITE_TOKEN_ENV] ||
-        cfg.embedding.remoteWriteApiKey ||
-        resolveModalToken(cfg));
-};
 /** Resolve only an explicitly configured remote URL. */
 export const resolveBaseUrl = (cfg) => cfg.embedding.remoteUrl;
-/** True when Modal is usable: an explicit remote URL and at least one resolvable scoped token are present. */
-export const isModalConfigured = (cfg) => !!cfg.embedding.remoteUrl && (!!getModalToken(cfg, "read") || !!getModalToken(cfg, "write"));
+/** True when Modal is usable: an explicit remote URL and a resolvable remote token are present. */
+export const isModalConfigured = (cfg) => !!cfg.embedding.remoteUrl && !!resolveModalToken(cfg);
 /**
  * Build a `ModalEmbeddingClient` from config. Returns null when Modal is not
  * configured (no base URL / token) so callers can degrade gracefully.
@@ -107,11 +77,9 @@ export const createModalClient = (cfg) => {
     if (!baseUrl)
         return null;
     const apiToken = resolveModalToken(cfg);
-    const readToken = getModalToken(cfg, "read");
-    const writeToken = getModalToken(cfg, "write");
-    if (!apiToken && !readToken && !writeToken)
+    if (!apiToken)
         return null;
-    const clientCfg = { baseUrl, apiToken, readToken, writeToken };
+    const clientCfg = { baseUrl, apiToken };
     return new ModalEmbeddingClient(clientCfg);
 };
 /**

package/dist/src/personalize.js

@@ -1,8 +1,9 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import { enableACM } from "./context-capture.js";
 import { getStatus } from "./lance.js";
-import { expandHome, getPersonalizedMarkerPath, loadConfig, resolveAgentDir } from "./utils.js";
+import { expandHome, getPersonalizedMarkerPath, hasPiContextTools, isPersonalized, loadConfig, resolveAgentDir, } from "./utils.js";
 class PersonalizationCancelledError extends Error {
     constructor() {
         super("Personalization cancelled");
@@ -598,6 +599,8 @@ export const runPersonalize = async (ctx, pi) => {
         ctx.ui.notify(`Personalization failed: ${message}`, "error");
         return { completed: false };
     }
+    if (isPersonalized(vaultPath))
+        return { completed: true };
     const vaultKey = personalizationVaultKey(vaultPath);
     activePersonalizations.get(vaultKey)?.abort();
     const controller = new AbortController();
@@ -625,6 +628,11 @@ export const runPersonalize = async (ctx, pi) => {
         // abort check and synchronous write in one event-loop turn so cancellation
         // cannot report an aborted run after the marker has been committed.
         fs.writeFileSync(markerPath, JSON.stringify({ completed: true, completedAt: new Date().toISOString() }, null, 2));
+        const sessionCfg = loadConfig(ctx.cwd);
+        const piCtxCfg = sessionCfg.extensionCompatibility?.["pi-context"];
+        if (piCtxCfg?.enabled && piCtxCfg?.autoEnableAcm !== false && hasPiContextTools(pi)) {
+            enableACM(pi);
+        }
         if (activePersonalizations.get(vaultKey) === controller) {
             activePersonalizations.delete(vaultKey);
         }

package/dist/src/scaffold.js

@@ -200,6 +200,22 @@ export const scaffoldVaultConfig = (vaultPath, collectionOverride) => {
                 existing.vaultMind = {};
                 changed = true;
             }
+            if (!existing.vaultMind.graph) {
+                existing.vaultMind.graph = { enabled: true, canvasSync: false };
+                changed = true;
+            }
+            else if (typeof existing.vaultMind.graph === "object" &&
+                existing.vaultMind.graph !== null) {
+                // Preserve any provided canvasPath while ensuring default graph flags exist.
+                if (typeof existing.vaultMind.graph.enabled !== "boolean") {
+                    existing.vaultMind.graph.enabled = true;
+                    changed = true;
+                }
+                if (typeof existing.vaultMind.graph.canvasSync !== "boolean") {
+                    existing.vaultMind.graph.canvasSync = false;
+                    changed = true;
+                }
+            }
             if (changed) {
                 fs.writeFileSync(cfgDest, `${JSON.stringify(existing, null, 2)}\n`, "utf-8");
                 updated.push(cfgDest);

package/dist/src/server.js

@@ -46,7 +46,7 @@ import { cancelPersonalization } from "./personalize.js";
 import { scaffoldVaultConfig } from "./scaffold.js";
 import { archiveSession, deleteSession, exportSession, getSession, listSessions, renameSession, resolveSessionsDir, searchSessions, } from "./session-search.js";
 import { listAllTools } from "./tool-catalog.js";
-import { ensureDir, expandHome, findConfig, getConfigPath, isPersonalized, loadConfig, resolveVaultFile, resolveVaultMindPaths, shrinkHome, } from "./utils.js";
+import { ensureDir, expandHome, findConfig, getConfigPath, isPersonalized, loadConfig, resolveVaultFile, resolveVaultFolder, resolveVaultMindPaths, shrinkHome, } from "./utils.js";
 import { classifySearchMode, normalizeGraphResult, searchVaultNative } from "./vault-tools.js";
 import { createManualDispatch, processQueue, scanFile, startWatcher, stopWatcher, } from "./watcher.js";
 export function createServerState(port = 11435) {
@@ -339,7 +339,7 @@ export function startServer(pi, serverState, watcherState, readinessCallback) {
                         res.end(JSON.stringify({ error: "Method not allowed" }));
                         return;
                     }
-                    withAuth(req, res, () => handleVmSetup(req, res), { requireWrite: true });
+                    withAuth(req, res, () => handleVmSetup(req, res, serverState), { requireWrite: true });
                     break;
                 case "/vm/token":
                     if (req.method !== "POST") {
@@ -1266,7 +1266,7 @@ function handleWatcherToggle(res, serverState) {
     res.writeHead(200);
     res.end(JSON.stringify({ ok: true, watcher: true }));
 }
-function handleVmSetup(req, res) {
+function handleVmSetup(req, res, serverState) {
     readBody(req)
         .then((raw) => {
         let parsed;
@@ -1291,7 +1291,12 @@ function handleVmSetup(req, res) {
             !Array.isArray(config.vaultMind.vaults.default)
             ? { ...config.vaultMind.vaults.default }
             : {};
-        if (parsed.vault || typeof parsed.preferences?.autoStart === "boolean") {
+        if (parsed.vault ||
+            typeof parsed.preferences?.autoStart === "boolean" ||
+            typeof parsed.preferences?.autoSync === "boolean" ||
+            typeof parsed.preferences?.autoSyncMinLength === "number" ||
+            parsed.folders?.collectionPrefix?.trim() ||
+            parsed.folders?.canvasPath?.trim()) {
             const nextDefaultVault = { ...existingDefaultVault };
             if (parsed.vault) {
                 nextDefaultVault.path = shrinkHome(parsed.vault);
@@ -1303,7 +1308,23 @@ function handleVmSetup(req, res) {
             if (typeof parsed.preferences?.autoStart === "boolean") {
                 nextDefaultVault.autoStart = parsed.preferences.autoStart;
             }
+            if (typeof parsed.preferences?.autoSync === "boolean") {
+                nextDefaultVault.autoSync = parsed.preferences.autoSync;
+            }
+            if (typeof parsed.preferences?.autoSyncMinLength === "number") {
+                nextDefaultVault.autoSyncMinLength = parsed.preferences.autoSyncMinLength;
+            }
+            if (parsed.folders?.collectionPrefix?.trim()) {
+                nextDefaultVault.collectionPrefix = parsed.folders.collectionPrefix.trim();
+            }
             config.vaultMind.vaults.default = nextDefaultVault;
+            if (parsed.folders?.canvasPath?.trim()) {
+                config.vaultMind.graph = config.vaultMind.graph || {
+                    enabled: true,
+                    canvasSync: false,
+                };
+                config.vaultMind.graph.canvasPath = parsed.folders.canvasPath.trim();
+            }
         }
         if (parsed.remoteUrl) {
             config.vaultMind.embedding.remoteUrl = parsed.remoteUrl;
@@ -1339,6 +1360,26 @@ function handleVmSetup(req, res) {
         // regardless of whether this config write happened first.
         const scaffold = scaffoldVaultConfig(process.cwd(), parsed.collection);
         scaffoldModelRouterConfig(process.cwd());
+        // Re-resolve vault path from the newly written config
+        const updatedCfg = loadConfig(process.cwd());
+        const defaultVault = updatedCfg.vaultMind.vaults?.default?.path;
+        if (defaultVault && fs.existsSync(defaultVault)) {
+            try {
+                serverState.vaultPath = fs.realpathSync.native(defaultVault);
+            }
+            catch {
+                serverState.vaultPath = path.resolve(defaultVault);
+            }
+        }
+        // Create configured Agent/ folders if they don't exist
+        const folderKeys = ["inbox", "library", "presentations", "journal"];
+        for (const key of folderKeys) {
+            const folderRel = resolveVaultFolder(updatedCfg.vaultMind, key);
+            const folderAbs = path.join(process.cwd(), folderRel);
+            if (!fs.existsSync(folderAbs)) {
+                fs.mkdirSync(folderAbs, { recursive: true });
+            }
+        }
         res.writeHead(200);
         res.end(JSON.stringify({ ok: true, ...scaffold }));
     })
@@ -1418,8 +1459,6 @@ function handleVaultMindConfig(res) {
 const EMBEDDING_SECRET_KINDS = [
     "localApiKey",
     "remoteApiKey",
-    "remoteReadApiKey",
-    "remoteWriteApiKey",
 ];
 async function handlePutEmbeddingSecrets(req, res) {
     try {

package/dist/src/settings-ui.js

@@ -494,7 +494,7 @@ export const setupWizard = async (ctx, cliArgs) => {
         ctx.ui.notify([
             "Modal endpoint discovery:",
             `- Remote URL: ${remoteUrl}`,
-            "- Set token with: /vm remote token  or  ./scripts/fetch-modal-token.sh --write",
+            "- Paste the Modal token into the Remote API key field to save it.",
         ].join("\n"), "info");
     }
     else if (provider.startsWith("Custom")) {

package/dist/src/types.d.ts

@@ -103,16 +103,10 @@ export interface EmbeddingConfig {
     useTransformers?: boolean;
     /**
      * Bearer token for the remote endpoint. Prefer
-     * `PVM_REMOTE_EMBEDDING_API_KEY` / `PVM_MODAL_*_TOKEN` env vars over
-     * committing this to config; env vars always win. Falls back to
-     * `remoteReadApiKey` for read paths and `remoteWriteApiKey` for
-     * write paths when those scoped overrides are set.
+     * `PVM_REMOTE_EMBEDDING_API_KEY` env var over committing this to config;
+     * env vars always win.
      */
     remoteApiKey?: string;
-    /** Read-scoped remote token (search/export). Falls back to `remoteApiKey`. */
-    remoteReadApiKey?: string;
-    /** Write-scoped remote token (embed/reindex). Falls back to `remoteApiKey`. */
-    remoteWriteApiKey?: string;
     /**
      * Offline fallback policy. When the remote endpoint is unreachable
      * the search/append paths try a same-space local provider
@@ -355,7 +349,7 @@ export interface AskIntakeResult {
         path: string;
     };
 }
-export type EmbeddingSecretKind = "localApiKey" | "remoteApiKey" | "remoteReadApiKey" | "remoteWriteApiKey";
+export type EmbeddingSecretKind = "localApiKey" | "remoteApiKey";
 export interface EmbeddingSecretStatus {
     kind: EmbeddingSecretKind;
     configured: boolean;
@@ -368,8 +362,6 @@ export interface EmbeddingSecretStatusResponse {
 export interface PutEmbeddingSecretsRequest {
     localApiKey?: string | null;
     remoteApiKey?: string | null;
-    remoteReadApiKey?: string | null;
-    remoteWriteApiKey?: string | null;
 }
 export interface PutEmbeddingSecretsResponse {
     ok: boolean;