pi-vault-mind 0.16.11 → 0.16.13

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+
+## 0.16.12 / 0.6.16 — 2026-07-20
+
+### Fixed
+
+- **Minimal config before bridge start.** The setup wizard now writes a minimal `.vault-mind/vault-mind.config.json` with the vault path before starting the bridge, so `startServer` picks up the correct `vaultPath` immediately instead of falling back to `process.cwd()`.
+- **Model-router vault isolation.** `model-router.json` is now always vault-scoped under `<vault>/.vault-mind/.pi/model-router.json`. The global `~/.pi/model-router.json` fallback is removed.
+- **Stale `server.json` cleanup.** Dead PIDs and mismatched vault paths now delete the stale discovery file and spawn a fresh runtime instead of looping or throwing.
+- **Vault path re-resolution after setup.** `POST /vm/setup` now updates the running server's `vaultPath` from the newly written config, preventing stale path references until restart.
+- **Runtime files relocated.** `ensureVaultRuntime.ts` and `startFreshRuntime.ts` moved from `packages/obsidian/src/chat/` to `packages/obsidian/src/runtime/`.
+- **Agent folder creation on setup save.** The four default Agent/ folders (Inbox, Library, Presentations, Journal) are now created during `POST /vm/setup` using the user's configured paths or defaults.
+- **Expanded vault reset.** `reset-test-vault.sh` now also removes `Pi-Sessions/`, `AGENTS.md`, `.env.1pass`, `.omp/`, Agent/ subdirectories, and the entire `vault-mind` plugin directory.
+
+### Verification
+
+- Added stale-discovery cleanup tests (dead PID, mismatched vaultPath, healthy adoption).
+- Expanded reset-test-vault assertions for all newly removed artifacts.
+
 ## 0.16.11 / 0.6.15 — 2026-07-20
 
 ### Fixed

package/dist/src/config-keys.d.ts

@@ -11,6 +11,6 @@
  *   - VAULT_MIND_CONFIG_KEYS: fully-qualified dotted paths (for static access)
  */
 /** Bare key names on vaultMind.embedding — used by setup wizard, CLI, HTTP, and plugin. */
-export declare const EMBEDDING_FLAT_KEYS: readonly ["remoteUrl", "localUrl", "model", "apiKey", "dim", "useTransformers", "remoteApiKey", "remoteReadApiKey", "remoteWriteApiKey", "fallback", "sync", "collectionModels", "coalesce"];
+export declare const EMBEDDING_FLAT_KEYS: readonly ["remoteUrl", "localUrl", "model", "apiKey", "dim", "useTransformers", "remoteApiKey", "fallback", "sync", "collectionModels", "coalesce"];
 /** Fully-qualified dotted key paths that the plugin's reconfigure form reads/writes. */
 export declare const VAULT_MIND_CONFIG_KEYS: readonly ["vaultMind.embedding.remoteUrl", "vaultMind.embedding.localUrl", "vaultMind.embedding.model", "vaultMind.embedding.dim", "vaultMind.embedding.useTransformers", "vaultMind.embedding.remoteApiKey", "vaultMind.embedding.fallback", "vaultMind.embedding.sync", "vaultMind.ftsEnabled", "vaultMind.graph", "vaultMind.vaults.default.autoStart", "extensionCompatibility.pi-context.enabled"];

package/dist/src/config-keys.js

@@ -19,8 +19,6 @@ export const EMBEDDING_FLAT_KEYS = [
     "dim",
     "useTransformers",
     "remoteApiKey",
-    "remoteReadApiKey",
-    "remoteWriteApiKey",
     "fallback",
     "sync",
     "collectionModels",

package/dist/src/embedding-probe.d.ts

@@ -5,8 +5,6 @@ export interface EmbeddingProbeRequest {
     model?: string;
     transientSecrets?: {
         apiKey?: string;
-        readApiKey?: string;
-        writeApiKey?: string;
     };
 }
 export interface EmbeddingModelOption {

package/dist/src/embedding-probe.js

@@ -99,17 +99,11 @@ const resolveAuthorizationHeader = (request, cfg) => {
             return resolveEmbeddingSecret(cfg, "localApiKey");
         return undefined;
     }
-    // Remote read path: never select write-scoped credentials.
-    if (request.transientSecrets?.readApiKey)
-        return request.transientSecrets.readApiKey;
+    // Remote path: use the single remote API key.
     if (request.transientSecrets?.apiKey)
         return request.transientSecrets.apiKey;
-    if (cfg) {
-        const readToken = resolveEmbeddingSecret(cfg, "remoteReadApiKey");
-        if (readToken)
-            return readToken;
+    if (cfg)
         return resolveEmbeddingSecret(cfg, "remoteApiKey");
-    }
     return undefined;
 };
 export async function probeEmbeddingEndpoint(request, options) {

package/dist/src/embedding-secrets.js

@@ -14,8 +14,6 @@ import { getTokenEnvPath } from "./utils.js";
 const DEFINITIONS = {
     localApiKey: { env: "PVM_LOCAL_EMBEDDING_API_KEY", legacy: "apiKey" },
     remoteApiKey: { env: "PVM_REMOTE_EMBEDDING_API_KEY", legacy: "remoteApiKey" },
-    remoteReadApiKey: { env: "PVM_MODAL_READ_TOKEN", legacy: "remoteReadApiKey" },
-    remoteWriteApiKey: { env: "PVM_MODAL_WRITE_TOKEN", legacy: "remoteWriteApiKey" },
 };
 export const EMBEDDING_SECRET_MASK = "••••••••";
 const getEnv = (opts, key) => {
@@ -76,12 +74,7 @@ const getSecretSource = (cfg, kind, envRecord, opts) => {
 };
 /** Return the status of all four embedding secret kinds in declaration order. */
 export const readEmbeddingSecretStatus = (cfg, opts) => {
-    const kinds = [
-        "localApiKey",
-        "remoteApiKey",
-        "remoteReadApiKey",
-        "remoteWriteApiKey",
-    ];
+    const kinds = ["localApiKey", "remoteApiKey"];
     const envRecord = readDotEnv(getEnvPath(opts));
     return {
         secrets: kinds.map((kind) => {

package/dist/src/lance.js

@@ -4,7 +4,8 @@ import * as lancedb from "@lancedb/lancedb";
 import { LanceSchema, TextEmbeddingFunction } from "@lancedb/lancedb/embedding";
 import * as arrow from "apache-arrow";
 import { EmbeddingCoalescer } from "./embed-queue.js";
-import { createProvider } from "./embedding-providers.js";
+import { createProvider, DEFAULT_OLLAMA_API_KEY, OpenAICompatibleProvider, } from "./embedding-providers.js";
+import { resolveEmbeddingSecret } from "./embedding-secrets.js";
 import { namespacedTableName, resolveDim, resolveModel } from "./modal-config.js";
 let db = null;
 // ── Connection ──────────────────────────────────────────────────────────────
@@ -261,9 +262,19 @@ const fallbackQueryEmbed = async (cfg, collection, text) => {
     const canonical = resolveModel(cfg, collection);
     if ((cfg.embedding.model || "embeddinggemma") !== canonical)
         return null;
+    const localCfg = {
+        ...cfg,
+        embedding: { ...cfg.embedding, remoteUrl: "" },
+    };
     try {
-        const fn = await createProvider(cfg, { collection });
-        const vecs = await fn.embed([text], "query");
+        const provider = new OpenAICompatibleProvider({
+            url: cfg.embedding.localUrl,
+            model: resolveModel(localCfg, collection),
+            apiKey: resolveEmbeddingSecret(localCfg, "localApiKey") ?? DEFAULT_OLLAMA_API_KEY,
+            dims: resolveDim(localCfg, collection),
+        });
+        await provider.init();
+        const vecs = await provider.embed([text], "query");
         return vecs[0];
     }
     catch (err) {
@@ -484,9 +495,19 @@ const fallbackDocumentEmbed = async (cfg, collection, text) => {
     const canonical = resolveModel(cfg, collection);
     if ((cfg.embedding.model || "embeddinggemma") !== canonical)
         return null;
+    const localCfg = {
+        ...cfg,
+        embedding: { ...cfg.embedding, remoteUrl: "" },
+    };
     try {
-        const fn = await createProvider(cfg, { collection });
-        const vecs = await fn.embed([text], "document");
+        const provider = new OpenAICompatibleProvider({
+            url: cfg.embedding.localUrl,
+            model: resolveModel(localCfg, collection),
+            apiKey: resolveEmbeddingSecret(localCfg, "localApiKey") ?? DEFAULT_OLLAMA_API_KEY,
+            dims: resolveDim(localCfg, collection),
+        });
+        await provider.init();
+        const vecs = await provider.embed([text], "document");
         return vecs[0];
     }
     catch (err) {

package/dist/src/modal-client.d.ts

@@ -18,12 +18,8 @@
 export interface ModalClientConfig {
     /** Base URL of the deployed ASGI app (no trailing slash needed). */
     baseUrl: string;
-    /** Fallback bearer token (legacy single token for all operations). */
+    /** Bearer token for all operations. */
     apiToken?: string;
-    /** Read-scoped token for search/export operations. Falls back to `apiToken`. */
-    readToken?: string;
-    /** Write-scoped token for embed/reindex operations. Falls back to `apiToken`. */
-    writeToken?: string;
     /** Per-request timeout in ms (default 120s — bulk submits can be large). */
     timeoutMs?: number;
 }
@@ -105,12 +101,10 @@ export interface ExportPage {
 export declare class ModalEmbeddingClient {
     private baseUrl;
     private apiToken;
-    private readToken;
-    private writeToken;
     private timeoutMs;
     constructor(cfg: ModalClientConfig);
-    /** Return the bearer token to use for the requested operation scope. */
-    private tokenFor;
+    /** Return the bearer token to use for requests. */
+    private token;
     private request;
     /** Liveness check; also returns the server's default model. */
     health(): Promise<{
@@ -155,7 +149,7 @@ export declare class ModalEmbeddingClient {
         since?: number;
         limit?: number;
     }): Promise<ExportPage>;
-    /** Low-level binary request helper with scoped token selection. */
+    /** Low-level binary request helper. */
     private requestBuffer;
     /** Pull one page of rows with seq > since as an Arrow IPC stream.
      * Vectors are always included (no include_vectors flag). The watermark /

package/dist/src/modal-client.js

@@ -18,31 +18,26 @@
 export class ModalEmbeddingClient {
     baseUrl;
     apiToken;
-    readToken;
-    writeToken;
     timeoutMs;
     constructor(cfg) {
         this.baseUrl = cfg.baseUrl.replace(/\/$/, "");
         this.apiToken = cfg.apiToken;
-        this.readToken = cfg.readToken ?? cfg.apiToken;
-        this.writeToken = cfg.writeToken ?? cfg.apiToken;
         this.timeoutMs = cfg.timeoutMs ?? 120_000;
     }
-    /** Return the bearer token to use for the requested operation scope. */
-    tokenFor(operation) {
-        const token = operation === "read" ? this.readToken : this.writeToken;
-        if (!token)
-            throw new Error(`Modal ${operation} token not configured`);
-        return token;
+    /** Return the bearer token to use for requests. */
+    token() {
+        if (!this.apiToken)
+            throw new Error("Modal API token not configured");
+        return this.apiToken;
     }
-    async request(method, path, body, operation = "write") {
+    async request(method, path, body) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
             const resp = await fetch(`${this.baseUrl}${path}`, {
                 method,
                 headers: {
-                    Authorization: `Bearer ${this.tokenFor(operation)}`,
+                    Authorization: `Bearer ${this.token()}`,
                     ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
                 },
                 body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -60,17 +55,17 @@ export class ModalEmbeddingClient {
     }
     /** Liveness check; also returns the server's default model. */
     health() {
-        return this.request("GET", "/health", undefined, "read");
+        return this.request("GET", "/health", undefined);
     }
     /** Registry of available embedders (public; no auth). Use native_dim to
      * resolve a model's output dim up-front instead of waiting for the first
      * /embed response. (Additive — Agent B request #2.) */
     models() {
-        return this.request("GET", "/models", undefined, "read");
+        return this.request("GET", "/models", undefined);
     }
     /** Server-side store + compute stats (rows per namespace, index state, GPU). */
     stats() {
-        return this.request("GET", "/stats", undefined, "read");
+        return this.request("GET", "/stats", undefined);
     }
     /** Embed text on demand. Use task="query" for search, "document" for storage. */
     embed(texts, opts = {}) {
@@ -79,7 +74,7 @@ export class ModalEmbeddingClient {
             model: opts.model,
             dim: opts.dim,
             task: opts.task ?? "query",
-        }, "write");
+        });
     }
     /** Submit a bulk embedding job; embeds + stores server-side. */
     submitJob(collection, records, opts = {}) {
@@ -88,10 +83,10 @@ export class ModalEmbeddingClient {
             records,
             model: opts.model,
             dim: opts.dim,
-        }, "write");
+        });
     }
     jobStatus(jobId) {
-        return this.request("GET", `/jobs/${encodeURIComponent(jobId)}`, undefined, "read");
+        return this.request("GET", `/jobs/${encodeURIComponent(jobId)}`, undefined);
     }
     /** List recent jobs (newest first). Additive — surfaces GET /jobs so
      * `/vm remote jobs` can list, not just poll a known id. (Agent B request #1.) */
@@ -100,12 +95,12 @@ export class ModalEmbeddingClient {
         if (limit != null)
             p.set("limit", String(limit));
         const qs = p.toString();
-        return this.request("GET", `/jobs${qs ? `?${qs}` : ""}`, undefined, "read");
+        return this.request("GET", `/jobs${qs ? `?${qs}` : ""}`, undefined);
     }
     /** Cooperatively cancel a running/queued job. The worker stops after its
      * current batch and writes status=cancelled. */
     cancelJob(jobId) {
-        return this.request("POST", `/jobs/${encodeURIComponent(jobId)}/cancel`, undefined, "write");
+        return this.request("POST", `/jobs/${encodeURIComponent(jobId)}/cancel`, undefined);
     }
     /** Poll a job until it reaches a terminal state. */
     async waitForJob(jobId, pollMs = 2000) {
@@ -118,7 +113,7 @@ export class ModalEmbeddingClient {
     }
     /** List the collections/tables held in the server-side vector store. */
     async syncCollections() {
-        const out = await this.request("GET", "/sync/collections", undefined, "read");
+        const out = await this.request("GET", "/sync/collections", undefined);
         return out.collections;
     }
     /** Pull one page of rows with seq > since. Remember next_watermark. */
@@ -130,16 +125,16 @@ export class ModalEmbeddingClient {
             p.set("dim", String(opts.dim));
         p.set("since", String(opts.since ?? 0));
         p.set("limit", String(opts.limit ?? 500));
-        return this.request("GET", `/sync/export?${p.toString()}`, undefined, "read");
+        return this.request("GET", `/sync/export?${p.toString()}`, undefined);
     }
-    /** Low-level binary request helper with scoped token selection. */
-    async requestBuffer(method, path, operation = "read") {
+    /** Low-level binary request helper. */
+    async requestBuffer(method, path) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
             const resp = await fetch(`${this.baseUrl}${path}`, {
                 method,
-                headers: { Authorization: `Bearer ${this.tokenFor(operation)}` },
+                headers: { Authorization: `Bearer ${this.token()}` },
                 signal: controller.signal,
             });
             if (!resp.ok) {
@@ -166,7 +161,7 @@ export class ModalEmbeddingClient {
             p.set("dim", String(opts.dim));
         p.set("since", String(opts.since ?? 0));
         p.set("limit", String(opts.limit ?? 500));
-        const resp = await this.requestBuffer("GET", `/sync/export?${p.toString()}`, "read");
+        const resp = await this.requestBuffer("GET", `/sync/export?${p.toString()}`);
         const nextWatermark = Number(resp.headers.get("X-Next-Watermark") ?? opts.since ?? 0);
         const done = (resp.headers.get("X-Done") ?? "true") === "true";
         const count = Number(resp.headers.get("X-Count") ?? 0);

package/dist/src/modal-config.d.ts

@@ -10,12 +10,8 @@
  */
 import { ModalEmbeddingClient } from "./modal-client.js";
 import type { VaultMindConfig } from "./types.js";
-/** Env var name for the unscoped remote embedding API key (preferred over config). */
+/** Env var name for the remote embedding API key (preferred over config). */
 export declare const MODAL_TOKEN_ENV = "PVM_REMOTE_EMBEDDING_API_KEY";
-/** Env var name for the read-scoped Modal token (search/export). */
-export declare const MODAL_READ_TOKEN_ENV = "PVM_MODAL_READ_TOKEN";
-/** Env var name for the write-scoped Modal token (embed/reindex). */
-export declare const MODAL_WRITE_TOKEN_ENV = "PVM_MODAL_WRITE_TOKEN";
 /**
  * Dotenv fallback path for the Modal token, resolved from the vault cwd:
  * `<vault>/.vault-mind/vault-mind.env`. Lazy so tests can override cwd.
@@ -35,23 +31,9 @@ export declare const MODAL_REMOTE_URL = "https://kylebrodeur--pi-vault-mind-embe
  * Never log the resolved token.
  */
 export declare const resolveModalToken: (cfg: VaultMindConfig) => string | undefined;
-/**
- * Resolve a scoped Modal token for the requested operation.
- * Resolution order:
- * 1. `PVM_MODAL_{READ|WRITE}_TOKEN` env var
- * 2. `<vault>/.vault-mind/vault-mind.env`
- * 3. `vaultMind.embedding.remoteReadApiKey` / `remoteWriteApiKey` in config
- * 4. Fallback to the unscoped `PVM_REMOTE_EMBEDDING_API_KEY` (env, dotenv, then config)
- *
- * `PVM_API_TOKEN` is intentionally not consulted — it is reserved for the
- * extension's bridge authentication.
- *
- * Never log the resolved token.
- */
-export declare const getModalToken: (cfg: VaultMindConfig, operation: "read" | "write") => string | undefined;
 /** Resolve only an explicitly configured remote URL. */
 export declare const resolveBaseUrl: (cfg: VaultMindConfig) => string | undefined;
-/** True when Modal is usable: an explicit remote URL and at least one resolvable scoped token are present. */
+/** True when Modal is usable: an explicit remote URL and a resolvable remote token are present. */
 export declare const isModalConfigured: (cfg: VaultMindConfig) => boolean;
 /**
  * Build a `ModalEmbeddingClient` from config. Returns null when Modal is not

package/dist/src/modal-config.js

@@ -11,12 +11,8 @@
 import * as fs from "node:fs";
 import { ModalEmbeddingClient } from "./modal-client.js";
 import { deriveCollectionNameFromVaultPath, getTokenEnvPath, normalizeCollectionName, } from "./utils.js";
-/** Env var name for the unscoped remote embedding API key (preferred over config). */
+/** Env var name for the remote embedding API key (preferred over config). */
 export const MODAL_TOKEN_ENV = "PVM_REMOTE_EMBEDDING_API_KEY";
-/** Env var name for the read-scoped Modal token (search/export). */
-export const MODAL_READ_TOKEN_ENV = "PVM_MODAL_READ_TOKEN";
-/** Env var name for the write-scoped Modal token (embed/reindex). */
-export const MODAL_WRITE_TOKEN_ENV = "PVM_MODAL_WRITE_TOKEN";
 /**
  * Dotenv fallback path for the Modal token, resolved from the vault cwd:
  * `<vault>/.vault-mind/vault-mind.env`. Lazy so tests can override cwd.
@@ -68,36 +64,10 @@ export const resolveModalToken = (cfg) => {
         return dotenv[MODAL_TOKEN_ENV];
     return cfg.embedding.remoteApiKey;
 };
-/**
- * Resolve a scoped Modal token for the requested operation.
- * Resolution order:
- * 1. `PVM_MODAL_{READ|WRITE}_TOKEN` env var
- * 2. `<vault>/.vault-mind/vault-mind.env`
- * 3. `vaultMind.embedding.remoteReadApiKey` / `remoteWriteApiKey` in config
- * 4. Fallback to the unscoped `PVM_REMOTE_EMBEDDING_API_KEY` (env, dotenv, then config)
- *
- * `PVM_API_TOKEN` is intentionally not consulted — it is reserved for the
- * extension's bridge authentication.
- *
- * Never log the resolved token.
- */
-export const getModalToken = (cfg, operation) => {
-    const dotenv = readDotEnv(modalTokenEnvPath());
-    if (operation === "read") {
-        return (process.env[MODAL_READ_TOKEN_ENV] ||
-            dotenv[MODAL_READ_TOKEN_ENV] ||
-            cfg.embedding.remoteReadApiKey ||
-            resolveModalToken(cfg));
-    }
-    return (process.env[MODAL_WRITE_TOKEN_ENV] ||
-        dotenv[MODAL_WRITE_TOKEN_ENV] ||
-        cfg.embedding.remoteWriteApiKey ||
-        resolveModalToken(cfg));
-};
 /** Resolve only an explicitly configured remote URL. */
 export const resolveBaseUrl = (cfg) => cfg.embedding.remoteUrl;
-/** True when Modal is usable: an explicit remote URL and at least one resolvable scoped token are present. */
-export const isModalConfigured = (cfg) => !!cfg.embedding.remoteUrl && (!!getModalToken(cfg, "read") || !!getModalToken(cfg, "write"));
+/** True when Modal is usable: an explicit remote URL and a resolvable remote token are present. */
+export const isModalConfigured = (cfg) => !!cfg.embedding.remoteUrl && !!resolveModalToken(cfg);
 /**
  * Build a `ModalEmbeddingClient` from config. Returns null when Modal is not
  * configured (no base URL / token) so callers can degrade gracefully.
@@ -107,11 +77,9 @@ export const createModalClient = (cfg) => {
     if (!baseUrl)
         return null;
     const apiToken = resolveModalToken(cfg);
-    const readToken = getModalToken(cfg, "read");
-    const writeToken = getModalToken(cfg, "write");
-    if (!apiToken && !readToken && !writeToken)
+    if (!apiToken)
         return null;
-    const clientCfg = { baseUrl, apiToken, readToken, writeToken };
+    const clientCfg = { baseUrl, apiToken };
     return new ModalEmbeddingClient(clientCfg);
 };
 /**

package/dist/src/personalize.js

@@ -1,8 +1,9 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import { enableACM } from "./context-capture.js";
 import { getStatus } from "./lance.js";
-import { expandHome, getPersonalizedMarkerPath, loadConfig, resolveAgentDir } from "./utils.js";
+import { expandHome, getPersonalizedMarkerPath, hasPiContextTools, isPersonalized, loadConfig, resolveAgentDir, } from "./utils.js";
 class PersonalizationCancelledError extends Error {
     constructor() {
         super("Personalization cancelled");
@@ -598,6 +599,8 @@ export const runPersonalize = async (ctx, pi) => {
         ctx.ui.notify(`Personalization failed: ${message}`, "error");
         return { completed: false };
     }
+    if (isPersonalized(vaultPath))
+        return { completed: true };
     const vaultKey = personalizationVaultKey(vaultPath);
     activePersonalizations.get(vaultKey)?.abort();
     const controller = new AbortController();
@@ -625,6 +628,11 @@ export const runPersonalize = async (ctx, pi) => {
         // abort check and synchronous write in one event-loop turn so cancellation
         // cannot report an aborted run after the marker has been committed.
         fs.writeFileSync(markerPath, JSON.stringify({ completed: true, completedAt: new Date().toISOString() }, null, 2));
+        const sessionCfg = loadConfig(ctx.cwd);
+        const piCtxCfg = sessionCfg.extensionCompatibility?.["pi-context"];
+        if (piCtxCfg?.enabled && piCtxCfg?.autoEnableAcm !== false && hasPiContextTools(pi)) {
+            enableACM(pi);
+        }
         if (activePersonalizations.get(vaultKey) === controller) {
             activePersonalizations.delete(vaultKey);
         }

package/dist/src/scaffold.js

@@ -200,6 +200,22 @@ export const scaffoldVaultConfig = (vaultPath, collectionOverride) => {
                 existing.vaultMind = {};
                 changed = true;
             }
+            if (!existing.vaultMind.graph) {
+                existing.vaultMind.graph = { enabled: true, canvasSync: false };
+                changed = true;
+            }
+            else if (typeof existing.vaultMind.graph === "object" &&
+                existing.vaultMind.graph !== null) {
+                // Preserve any provided canvasPath while ensuring default graph flags exist.
+                if (typeof existing.vaultMind.graph.enabled !== "boolean") {
+                    existing.vaultMind.graph.enabled = true;
+                    changed = true;
+                }
+                if (typeof existing.vaultMind.graph.canvasSync !== "boolean") {
+                    existing.vaultMind.graph.canvasSync = false;
+                    changed = true;
+                }
+            }
             if (changed) {
                 fs.writeFileSync(cfgDest, `${JSON.stringify(existing, null, 2)}\n`, "utf-8");
                 updated.push(cfgDest);

package/dist/src/server.js

@@ -46,7 +46,7 @@ import { cancelPersonalization } from "./personalize.js";
 import { scaffoldVaultConfig } from "./scaffold.js";
 import { archiveSession, deleteSession, exportSession, getSession, listSessions, renameSession, resolveSessionsDir, searchSessions, } from "./session-search.js";
 import { listAllTools } from "./tool-catalog.js";
-import { ensureDir, expandHome, findConfig, getConfigPath, isPersonalized, loadConfig, resolveVaultFile, resolveVaultMindPaths, shrinkHome, } from "./utils.js";
+import { ensureDir, expandHome, findConfig, getConfigPath, isPersonalized, loadConfig, resolveVaultFile, resolveVaultFolder, resolveVaultMindPaths, shrinkHome, } from "./utils.js";
 import { classifySearchMode, normalizeGraphResult, searchVaultNative } from "./vault-tools.js";
 import { createManualDispatch, processQueue, scanFile, startWatcher, stopWatcher, } from "./watcher.js";
 export function createServerState(port = 11435) {
@@ -339,7 +339,7 @@ export function startServer(pi, serverState, watcherState, readinessCallback) {
                         res.end(JSON.stringify({ error: "Method not allowed" }));
                         return;
                     }
-                    withAuth(req, res, () => handleVmSetup(req, res), { requireWrite: true });
+                    withAuth(req, res, () => handleVmSetup(req, res, serverState), { requireWrite: true });
                     break;
                 case "/vm/token":
                     if (req.method !== "POST") {
@@ -1266,7 +1266,7 @@ function handleWatcherToggle(res, serverState) {
     res.writeHead(200);
     res.end(JSON.stringify({ ok: true, watcher: true }));
 }
-function handleVmSetup(req, res) {
+function handleVmSetup(req, res, serverState) {
     readBody(req)
         .then((raw) => {
         let parsed;
@@ -1291,7 +1291,12 @@ function handleVmSetup(req, res) {
             !Array.isArray(config.vaultMind.vaults.default)
             ? { ...config.vaultMind.vaults.default }
             : {};
-        if (parsed.vault || typeof parsed.preferences?.autoStart === "boolean") {
+        if (parsed.vault ||
+            typeof parsed.preferences?.autoStart === "boolean" ||
+            typeof parsed.preferences?.autoSync === "boolean" ||
+            typeof parsed.preferences?.autoSyncMinLength === "number" ||
+            parsed.folders?.collectionPrefix?.trim() ||
+            parsed.folders?.canvasPath?.trim()) {
             const nextDefaultVault = { ...existingDefaultVault };
             if (parsed.vault) {
                 nextDefaultVault.path = shrinkHome(parsed.vault);
@@ -1303,7 +1308,23 @@ function handleVmSetup(req, res) {
             if (typeof parsed.preferences?.autoStart === "boolean") {
                 nextDefaultVault.autoStart = parsed.preferences.autoStart;
             }
+            if (typeof parsed.preferences?.autoSync === "boolean") {
+                nextDefaultVault.autoSync = parsed.preferences.autoSync;
+            }
+            if (typeof parsed.preferences?.autoSyncMinLength === "number") {
+                nextDefaultVault.autoSyncMinLength = parsed.preferences.autoSyncMinLength;
+            }
+            if (parsed.folders?.collectionPrefix?.trim()) {
+                nextDefaultVault.collectionPrefix = parsed.folders.collectionPrefix.trim();
+            }
             config.vaultMind.vaults.default = nextDefaultVault;
+            if (parsed.folders?.canvasPath?.trim()) {
+                config.vaultMind.graph = config.vaultMind.graph || {
+                    enabled: true,
+                    canvasSync: false,
+                };
+                config.vaultMind.graph.canvasPath = parsed.folders.canvasPath.trim();
+            }
         }
         if (parsed.remoteUrl) {
             config.vaultMind.embedding.remoteUrl = parsed.remoteUrl;
@@ -1339,6 +1360,26 @@ function handleVmSetup(req, res) {
         // regardless of whether this config write happened first.
         const scaffold = scaffoldVaultConfig(process.cwd(), parsed.collection);
         scaffoldModelRouterConfig(process.cwd());
+        // Re-resolve vault path from the newly written config
+        const updatedCfg = loadConfig(process.cwd());
+        const defaultVault = updatedCfg.vaultMind.vaults?.default?.path;
+        if (defaultVault && fs.existsSync(defaultVault)) {
+            try {
+                serverState.vaultPath = fs.realpathSync.native(defaultVault);
+            }
+            catch {
+                serverState.vaultPath = path.resolve(defaultVault);
+            }
+        }
+        // Create configured Agent/ folders if they don't exist
+        const folderKeys = ["inbox", "library", "presentations", "journal"];
+        for (const key of folderKeys) {
+            const folderRel = resolveVaultFolder(updatedCfg.vaultMind, key);
+            const folderAbs = path.join(process.cwd(), folderRel);
+            if (!fs.existsSync(folderAbs)) {
+                fs.mkdirSync(folderAbs, { recursive: true });
+            }
+        }
         res.writeHead(200);
         res.end(JSON.stringify({ ok: true, ...scaffold }));
     })
@@ -1418,8 +1459,6 @@ function handleVaultMindConfig(res) {
 const EMBEDDING_SECRET_KINDS = [
     "localApiKey",
     "remoteApiKey",
-    "remoteReadApiKey",
-    "remoteWriteApiKey",
 ];
 async function handlePutEmbeddingSecrets(req, res) {
     try {

package/dist/src/settings-ui.js

@@ -494,7 +494,7 @@ export const setupWizard = async (ctx, cliArgs) => {
         ctx.ui.notify([
             "Modal endpoint discovery:",
             `- Remote URL: ${remoteUrl}`,
-            "- Set token with: /vm remote token  or  ./scripts/fetch-modal-token.sh --write",
+            "- Paste the Modal token into the Remote API key field to save it.",
         ].join("\n"), "info");
     }
     else if (provider.startsWith("Custom")) {

package/dist/src/types.d.ts

@@ -103,16 +103,10 @@ export interface EmbeddingConfig {
     useTransformers?: boolean;
     /**
      * Bearer token for the remote endpoint. Prefer
-     * `PVM_REMOTE_EMBEDDING_API_KEY` / `PVM_MODAL_*_TOKEN` env vars over
-     * committing this to config; env vars always win. Falls back to
-     * `remoteReadApiKey` for read paths and `remoteWriteApiKey` for
-     * write paths when those scoped overrides are set.
+     * `PVM_REMOTE_EMBEDDING_API_KEY` env var over committing this to config;
+     * env vars always win.
      */
     remoteApiKey?: string;
-    /** Read-scoped remote token (search/export). Falls back to `remoteApiKey`. */
-    remoteReadApiKey?: string;
-    /** Write-scoped remote token (embed/reindex). Falls back to `remoteApiKey`. */
-    remoteWriteApiKey?: string;
     /**
      * Offline fallback policy. When the remote endpoint is unreachable
      * the search/append paths try a same-space local provider
@@ -355,7 +349,7 @@ export interface AskIntakeResult {
         path: string;
     };
 }
-export type EmbeddingSecretKind = "localApiKey" | "remoteApiKey" | "remoteReadApiKey" | "remoteWriteApiKey";
+export type EmbeddingSecretKind = "localApiKey" | "remoteApiKey";
 export interface EmbeddingSecretStatus {
     kind: EmbeddingSecretKind;
     configured: boolean;
@@ -368,8 +362,6 @@ export interface EmbeddingSecretStatusResponse {
 export interface PutEmbeddingSecretsRequest {
     localApiKey?: string | null;
     remoteApiKey?: string | null;
-    remoteReadApiKey?: string | null;
-    remoteWriteApiKey?: string | null;
 }
 export interface PutEmbeddingSecretsResponse {
     ok: boolean;

package/dist/src/utils.js

@@ -230,7 +230,7 @@ export const resolveVaultMindPaths = (cwd) => {
     const configPath = getConfigPath(cwd);
     const tokenEnvPath = getTokenEnvPath(cwd);
     const modelsJsonPath = path.join(agentDir, "models.json");
-    const modelRouterPath = path.join(path.dirname(agentDir), "model-router.json");
+    const modelRouterPath = path.join(resolveVaultMindDir(cwd), ".pi", "model-router.json");
     return {
         vaultPath: cwd,
         agentDir,

package/dist/test/embedding-probe.test.js

@@ -8,8 +8,6 @@ const PROVIDER_ENV_KEYS = [
     "PVM_API_TOKEN",
     "PVM_LOCAL_EMBEDDING_API_KEY",
     "PVM_REMOTE_EMBEDDING_API_KEY",
-    "PVM_MODAL_READ_TOKEN",
-    "PVM_MODAL_WRITE_TOKEN",
 ];
 const configWith = (embedding = {}) => ({
     dataDir: ".lancedb",
@@ -253,43 +251,19 @@ describe("probeEmbeddingEndpoint", () => {
                 request: {
                     target: "local",
                     url: "http://127.0.0.1:11434",
-                    transientSecrets: {
-                        apiKey: "LOCAL_TRANSIENT_SENTINEL",
-                        readApiKey: "REMOTE_READ_TRANSIENT_SENTINEL",
-                        writeApiKey: "REMOTE_WRITE_TRANSIENT_SENTINEL",
-                    },
+                    transientSecrets: { apiKey: "LOCAL_TRANSIENT_SENTINEL" },
                 },
                 config: configWith({ apiKey: "LOCAL_CONFIG_SENTINEL" }),
                 expectedAuthorization: "Bearer LOCAL_TRANSIENT_SENTINEL",
             },
             {
-                name: "remote prefers the transient readApiKey over unscoped and write keys",
+                name: "remote uses only the transient apiKey",
                 request: {
                     target: "remote",
                     url: "https://probe.example.test",
-                    transientSecrets: {
-                        apiKey: "REMOTE_TRANSIENT_SENTINEL",
-                        readApiKey: "REMOTE_READ_TRANSIENT_SENTINEL",
-                        writeApiKey: "REMOTE_WRITE_TRANSIENT_SENTINEL",
-                    },
-                },
-                config: configWith({
-                    remoteApiKey: "REMOTE_CONFIG_SENTINEL",
-                    remoteReadApiKey: "REMOTE_READ_CONFIG_SENTINEL",
-                }),
-                expectedAuthorization: "Bearer REMOTE_READ_TRANSIENT_SENTINEL",
-            },
-            {
-                name: "remote falls back to the transient unscoped apiKey when readApiKey is absent",
-                request: {
-                    target: "remote",
-                    url: "https://probe.example.test",
-                    transientSecrets: {
-                        apiKey: "REMOTE_TRANSIENT_SENTINEL",
-                        writeApiKey: "REMOTE_WRITE_TRANSIENT_SENTINEL",
-                    },
+                    transientSecrets: { apiKey: "REMOTE_TRANSIENT_SENTINEL" },
                 },
-                config: configWith({ remoteReadApiKey: "REMOTE_READ_CONFIG_SENTINEL" }),
+                config: configWith({ remoteApiKey: "REMOTE_CONFIG_SENTINEL" }),
                 expectedAuthorization: "Bearer REMOTE_TRANSIENT_SENTINEL",
             },
         ];
@@ -315,8 +289,6 @@ describe("probeEmbeddingEndpoint", () => {
                 'PVM_API_TOKEN="BRIDGE_TOKEN_SENTINEL"',
                 'PVM_LOCAL_EMBEDDING_API_KEY="LOCAL_STORED_SENTINEL"',
                 'PVM_REMOTE_EMBEDDING_API_KEY="REMOTE_STORED_SENTINEL"',
-                'PVM_MODAL_READ_TOKEN="REMOTE_READ_STORED_SENTINEL"',
-                'PVM_MODAL_WRITE_TOKEN="REMOTE_WRITE_STORED_SENTINEL"',
                 'UNRELATED_SETTING="keep-me"',
                 "",
             ].join("\n");
@@ -332,12 +304,11 @@ describe("probeEmbeddingEndpoint", () => {
             };
             const transientRequest = {
                 ...remoteRequest,
-                transientSecrets: { readApiKey: "REMOTE_READ_TRANSIENT_SENTINEL" },
+                transientSecrets: { apiKey: "REMOTE_TRANSIENT_SENTINEL" },
             };
             const config = configWith({
                 apiKey: "LOCAL_LEGACY_SENTINEL",
                 remoteApiKey: "REMOTE_LEGACY_SENTINEL",
-                remoteReadApiKey: "REMOTE_READ_LEGACY_SENTINEL",
             });
             const originalRequests = structuredClone({ localRequest, remoteRequest, transientRequest });
             const originalConfig = structuredClone(config);
@@ -460,11 +431,11 @@ describe("probeEmbeddingEndpoint", () => {
             const result = await probeEmbeddingEndpoint({
                 target: "remote",
                 url: "https://probe.example.test",
-                transientSecrets: { readApiKey: transientSentinel },
+                transientSecrets: { apiKey: transientSentinel },
             }, {
                 fetch,
                 now: () => 12,
-                config: configWith({ remoteReadApiKey: storedSentinel }),
+                config: configWith({ remoteApiKey: storedSentinel }),
             });
             assert.equal(result.ok, false);
             assert.equal(result.error?.code, "provider_error");

package/dist/test/embedding-secrets.test.js

@@ -46,7 +46,7 @@ describe("embedding secret resolution and mutation", () => {
         assert.equal(resolveEmbeddingSecret(cfg, "remoteApiKey", { cwd, environment: {} }), "REMOTE_LEGACY_SENTINEL");
     });
     it("secret status reports environment store legacy and none without fragments", () => {
-        const cfg = makeVaultConfig({ remoteReadApiKey: "LEGACY_READ_SENTINEL" });
+        const cfg = makeVaultConfig({ remoteApiKey: "LEGACY_REMOTE_SENTINEL" });
         writeVaultFile(envPath(cwd), 'PVM_REMOTE_EMBEDDING_API_KEY="REMOTE_PROVIDER_SENTINEL"\n');
         const result = readEmbeddingSecretStatus(cfg, {
             cwd,
@@ -66,47 +66,29 @@ describe("embedding secret resolution and mutation", () => {
                     masked: EMBEDDING_SECRET_MASK,
                     source: "extension-secret-store",
                 },
-                {
-                    kind: "remoteReadApiKey",
-                    configured: true,
-                    masked: EMBEDDING_SECRET_MASK,
-                    source: "legacy-config",
-                },
-                {
-                    kind: "remoteWriteApiKey",
-                    configured: false,
-                    masked: null,
-                    source: "none",
-                },
             ],
         });
         const serialized = JSON.stringify(result);
         assert.equal(serialized.includes("ENV_LOCAL_SENTINEL"), false);
         assert.equal(serialized.includes("REMOTE_PROVIDER_SENTINEL"), false);
-        assert.equal(serialized.includes("LEGACY_READ_SENTINEL"), false);
+        assert.equal(serialized.includes("LEGACY_REMOTE_SENTINEL"), false);
     });
     it("redactEmbeddingSecrets masks all provider credentials without mutating config", () => {
         const config = makeUniversalConfig({
             apiKey: "LOCAL_PROVIDER_SENTINEL",
             remoteApiKey: "REMOTE_PROVIDER_SENTINEL",
-            remoteReadApiKey: "REMOTE_READ_SENTINEL",
-            remoteWriteApiKey: "REMOTE_WRITE_SENTINEL",
         });
         const result = redactEmbeddingSecrets(config);
         assert.deepEqual(result.vaultMind.embedding, {
             remoteUrl: "https://pvm.modal.run",
             apiKey: EMBEDDING_SECRET_MASK,
             remoteApiKey: EMBEDDING_SECRET_MASK,
-            remoteReadApiKey: EMBEDDING_SECRET_MASK,
-            remoteWriteApiKey: EMBEDDING_SECRET_MASK,
         });
         assert.equal(config.vaultMind.embedding.apiKey, "LOCAL_PROVIDER_SENTINEL");
         assert.equal(config.vaultMind.embedding.remoteApiKey, "REMOTE_PROVIDER_SENTINEL");
         const serialized = JSON.stringify(result);
         assert.equal(serialized.includes("LOCAL_PROVIDER_SENTINEL"), false);
         assert.equal(serialized.includes("REMOTE_PROVIDER_SENTINEL"), false);
-        assert.equal(serialized.includes("REMOTE_READ_SENTINEL"), false);
-        assert.equal(serialized.includes("REMOTE_WRITE_SENTINEL"), false);
     });
     it("writeEmbeddingSecrets preserves unrelated dotenv entries and writes mode 0600 on POSIX", () => {
         writeVaultFile(envPath(cwd), '# operator note\nPVM_API_TOKEN="BRIDGE_ONLY_SENTINEL"\nUNRELATED_SETTING="keep-me"\n');
@@ -126,11 +108,11 @@ describe("embedding secret resolution and mutation", () => {
         assert.equal(serialized.includes("REMOTE_PROVIDER_SENTINEL"), false);
     });
     it("successful mutation response retains untouched legacy secret status", () => {
-        writeConfig(cwd, makeUniversalConfig({ remoteReadApiKey: "UNTOUCHED_LEGACY_SENTINEL" }));
+        writeConfig(cwd, makeUniversalConfig({ apiKey: "UNTOUCHED_LEGACY_SENTINEL" }));
         const result = writeEmbeddingSecrets({ remoteApiKey: "REMOTE_REPLACEMENT_SENTINEL" }, { cwd, environment: {} });
         assert.equal(result.ok, true);
-        assert.deepEqual(result.secrets.find(({ kind }) => kind === "remoteReadApiKey"), {
-            kind: "remoteReadApiKey",
+        assert.deepEqual(result.secrets.find(({ kind }) => kind === "localApiKey"), {
+            kind: "localApiKey",
             configured: true,
             masked: EMBEDDING_SECRET_MASK,
             source: "legacy-config",
@@ -143,8 +125,6 @@ describe("embedding secret resolution and mutation", () => {
         const originalConfig = makeUniversalConfig({
             apiKey: "LOCAL_LEGACY_SENTINEL",
             remoteApiKey: "REMOTE_LEGACY_SENTINEL",
-            remoteReadApiKey: "READ_LEGACY_SENTINEL",
-            remoteWriteApiKey: "WRITE_LEGACY_SENTINEL",
         });
         originalConfig.vaultMind.graph = { enabled: true };
         writeConfig(cwd, originalConfig);
@@ -152,19 +132,14 @@ describe("embedding secret resolution and mutation", () => {
             "# preserve me",
             'PVM_LOCAL_EMBEDDING_API_KEY="LOCAL_STORE_SENTINEL"',
             'PVM_REMOTE_EMBEDDING_API_KEY="REMOTE_STORE_SENTINEL"',
-            'PVM_MODAL_READ_TOKEN="READ_STORE_SENTINEL"',
-            'PVM_MODAL_WRITE_TOKEN="WRITE_STORE_SENTINEL"',
             'UNRELATED_SETTING="keep-me"',
             "",
         ].join("\n"));
-        const result = writeEmbeddingSecrets({ remoteApiKey: null, remoteReadApiKey: "READ_REPLACEMENT_SENTINEL" }, { cwd, environment: {} });
+        const result = writeEmbeddingSecrets({ remoteApiKey: null }, { cwd, environment: {} });
         assert.equal(result.ok, true);
         const updatedEnv = fs.readFileSync(envPath(cwd), "utf-8");
         assert.equal(updatedEnv.includes('PVM_LOCAL_EMBEDDING_API_KEY="LOCAL_STORE_SENTINEL"'), true);
         assert.equal(updatedEnv.includes("PVM_REMOTE_EMBEDDING_API_KEY="), false);
-        assert.equal(updatedEnv.includes('PVM_MODAL_READ_TOKEN="READ_REPLACEMENT_SENTINEL"'), true);
-        assert.equal(updatedEnv.includes("READ_STORE_SENTINEL"), false);
-        assert.equal(updatedEnv.includes('PVM_MODAL_WRITE_TOKEN="WRITE_STORE_SENTINEL"'), true);
         assert.equal(updatedEnv.includes('UNRELATED_SETTING="keep-me"'), true);
         const parsedConfig = JSON.parse(fs.readFileSync(configPath(cwd), "utf-8"));
         assert.deepEqual(parsedConfig, {
@@ -176,23 +151,20 @@ describe("embedding secret resolution and mutation", () => {
                 embedding: {
                     remoteUrl: "https://pvm.modal.run",
                     apiKey: "LOCAL_LEGACY_SENTINEL",
-                    remoteWriteApiKey: "WRITE_LEGACY_SENTINEL",
                 },
                 graph: { enabled: true },
             },
         });
         const serialized = JSON.stringify(result);
-        assert.equal(serialized.includes("READ_REPLACEMENT_SENTINEL"), false);
         assert.equal(serialized.includes("REMOTE_STORE_SENTINEL"), false);
         const envBeforeRejectedWrite = fs.readFileSync(envPath(cwd), "utf-8");
         const configBeforeRejectedWrite = fs.readFileSync(configPath(cwd), "utf-8");
-        const rejected = writeEmbeddingSecrets({ localApiKey: "", remoteWriteApiKey: "SHOULD_NOT_COMMIT_SENTINEL" }, { cwd, environment: {} });
+        const rejected = writeEmbeddingSecrets({ localApiKey: "" }, { cwd, environment: {} });
         assert.equal(rejected.ok, false);
         assert.match(rejected.error ?? "", /empty/i);
         assert.equal(fs.readFileSync(envPath(cwd), "utf-8"), envBeforeRejectedWrite);
         assert.equal(fs.readFileSync(configPath(cwd), "utf-8"), configBeforeRejectedWrite);
         const rejectedSerialized = JSON.stringify(rejected);
-        assert.equal(rejectedSerialized.includes("SHOULD_NOT_COMMIT_SENTINEL"), false);
         assert.equal(rejectedSerialized.includes("LOCAL_LEGACY_SENTINEL"), false);
     });
     it("config-cleanup failure restores the previous env file", () => {

package/dist/test/modal-config.test.js

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { afterEach, beforeEach, describe, it } from "node:test";
-import { createModalClient, getModalToken, isModalConfigured, modalTokenEnvPath, namespacedTableName, resolveBaseUrl, resolveDim, resolveModalToken, resolveModel, } from "../src/modal-config.js";
+import { createModalClient, isModalConfigured, modalTokenEnvPath, namespacedTableName, resolveBaseUrl, resolveDim, resolveModalToken, resolveModel, } from "../src/modal-config.js";
 const makeCfg = (over = {}) => ({
     dataDir: ".lancedb",
     embedding: { remoteUrl: "https://pvm.modal.run" },
@@ -14,12 +14,7 @@ const makeCfg = (over = {}) => ({
 const legacyEmbedding = (fields) => fields;
 const REMOTE_ENV = "PVM_REMOTE_EMBEDDING_API_KEY";
 const BRIDGE_ENV = "PVM_API_TOKEN";
-const PROVIDER_ENV_KEYS = [
-    REMOTE_ENV,
-    BRIDGE_ENV,
-    "PVM_MODAL_READ_TOKEN",
-    "PVM_MODAL_WRITE_TOKEN",
-];
+const PROVIDER_ENV_KEYS = [REMOTE_ENV, BRIDGE_ENV];
 describe("modal-config", () => {
     let originalCwd;
     let testDir;
@@ -67,23 +62,15 @@ describe("modal-config", () => {
     it("PVM_API_TOKEN never resolves a remote provider credential", () => {
         const cfg = makeCfg();
         process.env[BRIDGE_ENV] = "BRIDGE_ONLY_SENTINEL";
-        const fromProcess = [
-            resolveModalToken(cfg),
-            getModalToken(cfg, "read"),
-            getModalToken(cfg, "write"),
-        ];
+        const fromProcess = resolveModalToken(cfg);
         delete process.env[BRIDGE_ENV];
         fs.mkdirSync(path.dirname(modalTokenEnvPath()), { recursive: true });
         fs.writeFileSync(modalTokenEnvPath(), 'PVM_API_TOKEN="BRIDGE_ONLY_SENTINEL"\n', "utf-8");
-        const fromStore = [
-            resolveModalToken(cfg),
-            getModalToken(cfg, "read"),
-            getModalToken(cfg, "write"),
-        ];
+        const fromStore = resolveModalToken(cfg);
         const result = { fromProcess, fromStore };
         assert.deepEqual(result, {
-            fromProcess: [undefined, undefined, undefined],
-            fromStore: [undefined, undefined, undefined],
+            fromProcess: undefined,
+            fromStore: undefined,
         });
         assert.equal(JSON.stringify(result).includes("BRIDGE_ONLY_SENTINEL"), false);
         assert.equal(JSON.stringify(result).includes("REMOTE_PROVIDER_SENTINEL"), false);

package/dist/test/personalize.test.js

@@ -5,6 +5,7 @@ import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { afterEach, beforeEach, describe, it } from "node:test";
 import { cancelPersonalization, runPersonalize } from "../src/personalize.js";
+import { getPersonalizedMarkerPath } from "../src/utils.js";
 const setupConfig = (dir) => {
     const configDir = path.join(dir, ".vault-mind");
     fs.mkdirSync(configDir, { recursive: true });
@@ -320,6 +321,30 @@ describe("personalize", () => {
         const markerPath = path.join(testDir, ".vault-mind", "personalized.json");
         assert.strictEqual(fs.existsSync(markerPath), false, "runPersonalize must not leave a completion marker after a failed personalization");
     });
+    it("resolves as completed without invoking assistant or confirmation when a durable personalization marker already exists", async () => {
+        const markerPath = getPersonalizedMarkerPath(testDir);
+        fs.mkdirSync(path.dirname(markerPath), { recursive: true });
+        fs.writeFileSync(markerPath, JSON.stringify({ completed: true, completedAt: new Date().toISOString() }, null, 2), "utf-8");
+        let assistantInvoked = false;
+        let confirmInvoked = false;
+        const pi = {
+            on: () => { },
+            sendMessage: () => {
+                assistantInvoked = true;
+                throw new Error("assistant must not be invoked when marker exists");
+            },
+        };
+        const ctx = makeCtx(testDir, []);
+        ctx.ui.confirm = async () => {
+            confirmInvoked = true;
+            throw new Error("confirmation must not be invoked when marker exists");
+        };
+        const result = await runPersonalize(ctx, pi);
+        assert.strictEqual(assistantInvoked, false, "runPersonalize must not invoke the assistant when a durable marker already exists");
+        assert.strictEqual(confirmInvoked, false, "runPersonalize must not invoke confirmation UI when a durable marker already exists");
+        assert.ok(result, "runPersonalize must return a result, not void");
+        assert.strictEqual(result.completed, true, "an existing durable marker must resolve personalization as already completed");
+    });
     it("presentAndApplyDiff creates missing directories for new files", async () => {
         const { presentAndApplyDiff } = await import("../src/personalize.js");
         const ctx = makeCtx(testDir, [true]);

package/dist/test/rest-setup.test.js

@@ -10,8 +10,6 @@ const managerToken = "manager-route-token";
 const isolatedEnvVars = [
     "PVM_LOCAL_EMBEDDING_API_KEY",
     "PVM_REMOTE_EMBEDDING_API_KEY",
-    "PVM_MODAL_READ_TOKEN",
-    "PVM_MODAL_WRITE_TOKEN",
     "PVM_TOKEN_MANAGER",
     "PVM_TOKEN_MINER",
 ];
@@ -170,6 +168,23 @@ describe("REST setup routes", () => {
         const cfg = JSON.parse(fs.readFileSync(getConfigPath(vaultPath), "utf-8"));
         assert.equal(cfg.vaultMind.vaults.default.autoStart, false);
     });
+    it("POST /vm/setup persists new setup fields on config", async () => {
+        const { status, body } = await fetchJson(port, "POST", "/vm/setup", {
+            body: {
+                vault: vaultPath,
+                folders: { collectionPrefix: "notes", canvasPath: "Graph/Canvas.canvas" },
+                preferences: { autoSync: false, autoSyncMinLength: 200 },
+            },
+            token: TEST_TOKEN,
+        });
+        assert.equal(status, 200);
+        assert.equal(body.ok, true);
+        const cfg = JSON.parse(fs.readFileSync(getConfigPath(vaultPath), "utf-8"));
+        assert.equal(cfg.vaultMind.vaults.default.autoSync, false);
+        assert.equal(cfg.vaultMind.vaults.default.autoSyncMinLength, 200);
+        assert.equal(cfg.vaultMind.vaults.default.collectionPrefix, "notes");
+        assert.equal(cfg.vaultMind.graph.canvasPath, "Graph/Canvas.canvas");
+    });
     it("POST /vm/setup preserves default-vault siblings when toggling autoStart", async () => {
         writeVaultConfig(vaultPath, {
             version: 2,
@@ -182,8 +197,10 @@ describe("REST setup routes", () => {
                         autoStart: false,
                         autoSync: false,
                         collectionPrefix: "research",
+                        autoSyncMinLength: 150,
                     },
                 },
+                graph: { enabled: true, canvasSync: false, canvasPath: "Old/Canvas.canvas" },
             },
         });
         const { status, body } = await fetchJson(port, "POST", "/vm/setup", {
@@ -196,6 +213,8 @@ describe("REST setup routes", () => {
         assert.equal(cfg.vaultMind.vaults.default.autoStart, true);
         assert.equal(cfg.vaultMind.vaults.default.autoSync, false);
         assert.equal(cfg.vaultMind.vaults.default.collectionPrefix, "research");
+        assert.equal(cfg.vaultMind.vaults.default.autoSyncMinLength, 150);
+        assert.equal(cfg.vaultMind.graph.canvasPath, "Old/Canvas.canvas");
     });
     it("POST /vm/setup returns 401 without token", async () => {
         const { status } = await fetchJson(port, "POST", "/vm/setup", {
@@ -245,8 +264,6 @@ describe("REST setup routes", () => {
                     localUrl: "http://127.0.0.1:11434/v1",
                     apiKey: sentinels[0],
                     remoteApiKey: sentinels[1],
-                    remoteReadApiKey: sentinels[2],
-                    remoteWriteApiKey: sentinels[3],
                 },
             },
         });
@@ -255,23 +272,19 @@ describe("REST setup routes", () => {
         });
         assert.equal(status, 200);
         const response = body;
-        for (const key of ["apiKey", "remoteApiKey", "remoteReadApiKey", "remoteWriteApiKey"]) {
+        for (const key of ["apiKey", "remoteApiKey"]) {
             assert.equal(response.config.vaultMind.embedding[key], "••••••••");
         }
         assertResponseExcludes(body, sentinels);
     });
-    it("GET /vault-mind/config returns four fixed-mask secret statuses", async () => {
+    it("GET /vault-mind/config returns two fixed-mask secret statuses", async () => {
         const sentinels = [
             "LOCAL-STATUS-SECRET-PREFIX-opaque-END-LOCAL",
             "REMOTE-STATUS-SECRET-PREFIX-opaque-END-REMOTE",
-            "READ-STATUS-SECRET-PREFIX-opaque-END-READ",
-            "WRITE-STATUS-SECRET-PREFIX-opaque-END-WRITE",
         ];
         writeSecretEnv(vaultPath, [
             `PVM_LOCAL_EMBEDDING_API_KEY="${sentinels[0]}"`,
             `PVM_REMOTE_EMBEDDING_API_KEY="${sentinels[1]}"`,
-            `PVM_MODAL_READ_TOKEN="${sentinels[2]}"`,
-            `PVM_MODAL_WRITE_TOKEN="${sentinels[3]}"`,
             "",
         ].join("\n"));
         const { status, body } = await fetchJson(port, "GET", "/vault-mind/config", {
@@ -293,18 +306,6 @@ describe("REST setup routes", () => {
                     masked: "••••••••",
                     source: "extension-secret-store",
                 },
-                {
-                    kind: "remoteReadApiKey",
-                    configured: true,
-                    masked: "••••••••",
-                    source: "extension-secret-store",
-                },
-                {
-                    kind: "remoteWriteApiKey",
-                    configured: true,
-                    masked: "••••••••",
-                    source: "extension-secret-store",
-                },
             ],
         });
         assertResponseExcludes(body, sentinels);
@@ -348,7 +349,7 @@ describe("REST setup routes", () => {
             injectors: [],
             vaultMind: {
                 dataDir: ".lancedb",
-                embedding: { remoteReadApiKey: legacySecret },
+                embedding: { remoteApiKey: legacySecret },
                 graph: { enabled: true },
             },
         });
@@ -356,7 +357,7 @@ describe("REST setup routes", () => {
         const envBefore = fs.readFileSync(secretEnvPath(vaultPath), "utf-8");
         const configBefore = fs.readFileSync(getConfigPath(vaultPath), "utf-8");
         const { status, body } = await fetchJson(port, "PUT", "/vm/embedding/secrets", {
-            body: { localApiKey: attemptedSecret, remoteWriteApiKey: "" },
+            body: { remoteApiKey: "" },
             token: managerToken,
         });
         assert.equal(status, 400);
@@ -406,10 +407,8 @@ describe("REST setup routes", () => {
     });
     it("PUT /vm/embedding/secrets migrates legacy JSON and preserves unrelated env entries", async () => {
         const legacyRemote = "LEGACY-REMOTE-SECRET-PREFIX-opaque-END-REMOTE";
-        const legacyRead = "LEGACY-READ-SECRET-PREFIX-opaque-END-READ";
-        const untouchedLegacyWrite = "UNTOUCHED-WRITE-SECRET-PREFIX-opaque-END-WRITE";
+        const untouchedLegacyLocal = "UNTOUCHED-LOCAL-SECRET-PREFIX-opaque-END-LOCAL";
         const replacementRemote = "MIGRATED-REMOTE-SECRET-PREFIX-opaque-END-REMOTE";
-        const replacementRead = "MIGRATED-READ-SECRET-PREFIX-opaque-END-READ";
         const bridgeToken = "BRIDGE-STORE-SECRET-PREFIX-opaque-END-BRIDGE";
         process.env.PVM_TOKEN_MANAGER = managerToken;
         writeVaultConfig(vaultPath, {
@@ -420,16 +419,15 @@ describe("REST setup routes", () => {
                 dataDir: ".lancedb",
                 embedding: {
                     remoteUrl: "https://embedding.example.test",
+                    apiKey: untouchedLegacyLocal,
                     remoteApiKey: legacyRemote,
-                    remoteReadApiKey: legacyRead,
-                    remoteWriteApiKey: untouchedLegacyWrite,
                 },
                 graph: { enabled: true },
             },
         });
         writeSecretEnv(vaultPath, ["# operator note", `PVM_API_TOKEN="${bridgeToken}"`, 'UNRELATED_SETTING="keep-me"', ""].join("\n"));
         const { status, body } = await fetchJson(port, "PUT", "/vm/embedding/secrets", {
-            body: { remoteApiKey: replacementRemote, remoteReadApiKey: replacementRead },
+            body: { remoteApiKey: replacementRemote },
             token: managerToken,
         });
         assert.equal(status, 200);
@@ -438,25 +436,21 @@ describe("REST setup routes", () => {
         assert.equal(stored.includes(`PVM_API_TOKEN="${bridgeToken}"`), true);
         assert.equal(stored.includes('UNRELATED_SETTING="keep-me"'), true);
         assert.equal(stored.includes(replacementRemote), true);
-        assert.equal(stored.includes(replacementRead), true);
         const migrated = JSON.parse(fs.readFileSync(getConfigPath(vaultPath), "utf-8"));
         assert.equal("remoteApiKey" in migrated.vaultMind.embedding, false);
-        assert.equal("remoteReadApiKey" in migrated.vaultMind.embedding, false);
-        assert.equal(migrated.vaultMind.embedding.remoteWriteApiKey, untouchedLegacyWrite);
+        assert.equal(migrated.vaultMind.embedding.apiKey, untouchedLegacyLocal);
         assert.deepEqual(migrated.vaultMind.graph, { enabled: true });
         const response = body;
-        assert.deepEqual(response.secrets.find(({ kind }) => kind === "remoteWriteApiKey"), {
-            kind: "remoteWriteApiKey",
+        assert.deepEqual(response.secrets.find(({ kind }) => kind === "localApiKey"), {
+            kind: "localApiKey",
             configured: true,
             masked: "••••••••",
             source: "legacy-config",
         });
         assertResponseExcludes(body, [
             legacyRemote,
-            legacyRead,
-            untouchedLegacyWrite,
+            untouchedLegacyLocal,
             replacementRemote,
-            replacementRead,
             bridgeToken,
         ]);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-vault-mind",
-	"version": "0.16.11",
+	"version": "0.16.13",
 	"description": "Passive Obsidian vault extension for pi. Watches @agent markers, dispatches forked subagents (Miner, Broadcaster, Heavy-Lifter), stores in LanceDB with vector + FTS + graph. Multi-agent 'Drop & Forget' workflow for the pi agent ecosystem.",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/scripts/fetch-modal-token.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Fetch the Modal API token from 1Password and export or persist it.
+# Fetch the Modal embedding API token from 1Password and export or persist it.
 # Usage:
 #   ./scripts/fetch-modal-token.sh --export              # prints an export line
 #   ./scripts/fetch-modal-token.sh --write [vault-path]  # writes to <vault>/.vault-mind/vault-mind.env
@@ -32,10 +32,10 @@ if ! command -v op >/dev/null 2>&1; then
 fi
 
 # Check if already exported to avoid clobbering a live session.
-if [ -n "${PVM_API_TOKEN:-}" ]; then
-	echo "⚠️ PVM_API_TOKEN is already exported; skipping 1Password fetch." >&2
+if [ -n "${PVM_REMOTE_EMBEDDING_API_KEY:-}" ]; then
+	echo "⚠️ PVM_REMOTE_EMBEDDING_API_KEY is already exported; skipping 1Password fetch." >&2
 	if [ "$mode" = "export" ]; then
-		echo "export PVM_API_TOKEN=\"${PVM_API_TOKEN}\""
+		echo "export PVM_REMOTE_EMBEDDING_API_KEY=\"${PVM_REMOTE_EMBEDDING_API_KEY}\""
 	else
 		echo "Token already available in environment."
 	fi
@@ -55,13 +55,13 @@ if [ -z "$TOKEN" ]; then
 fi
 
 if [ "$mode" = "export" ]; then
-	echo "export PVM_API_TOKEN=\"${TOKEN}\""
+	echo "export PVM_REMOTE_EMBEDDING_API_KEY=\"${TOKEN}\""
 else
 	mkdir -p "$ENV_DIR"
-	printf 'PVM_API_TOKEN="%s"\n' "$TOKEN" > "$ENV_FILE"
+	printf 'PVM_REMOTE_EMBEDDING_API_KEY="%s"\n' "$TOKEN" > "$ENV_FILE"
 	# chmod is a no-op on Windows (Git Bash / MINGW); skip it to avoid errors.
 	if [[ "$(uname -s)" != MINGW* ]]; then
 		chmod 600 "$ENV_FILE"
 	fi
-	echo "✅ Wrote PVM_API_TOKEN to ${ENV_FILE}"
+	echo "✅ Wrote PVM_REMOTE_EMBEDDING_API_KEY to ${ENV_FILE}"
 fi

package/scripts/reset-test-vault.sh

@@ -2,7 +2,7 @@
 # scripts/reset-test-vault.sh
 #
 # Completely reset a vault for walkthrough testing.
-# Removes all pi-vault-mind state while preserving vault content and Obsidian plugins.
+# Removes all pi-vault-mind state and runtime artifacts while preserving vault content and Obsidian plugins.
 #
 # Usage:
 #   ./scripts/reset-test-vault.sh [vault-path]
@@ -71,19 +71,32 @@ rm -rf "$VAULT/.lancedb"
 rm -rf "$VAULT/collections"
 rm -f  "$VAULT/_sync_state.json"
 rm -rf "$VAULT/.vault-mind"
-rm -f  "$VAULT/.obsidian/plugins/vault-mind/data.json"
-rm -f  "$HOME/.pi/agent/vault-mind.config.json"   # remove global config — vault-scoped only
+rm -rf "$VAULT/.omp"
+rm -rf "$VAULT/Pi-Sessions"
+rm -f  "$VAULT/AGENTS.md"
+rm -f  "$VAULT/.env.1pass"
+# Remove Agent subdirectories scaffolded by setup, preserving user content
+for dir in Inbox Library Presentations Journal; do
+  rm -rf "$VAULT/Agent/$dir"
+done
+# Remove Agent root only if empty after subdirectory cleanup
+rmdir "$VAULT/Agent" 2>/dev/null || true
+rm -rf "$VAULT/.obsidian/plugins/vault-mind"
 
 
 echo ""
 echo "✓ Vault reset complete. State removed:"
+echo "  - .omp/ (harness runtime state)"
 echo "  - .vault-mind/ (config, token, framework agent dir, queue)"
+echo "  - .obsidian/plugins/vault-mind/ (plugin, reinstall via BRAT)"
 echo "  - .pi/ (legacy agent dir, if present)"
 echo "  - .lancedb/ (vector index)"
 echo "  - collections/ (JSONL data)"
+echo "  - Pi-Sessions/ (session files)"
+echo "  - AGENTS.md (personalized agent delegation)"
+echo "  - .env.1pass (runtime config)"
+echo "  - Agent/ subdirectories (Inbox, Library, Presentations, Journal)"
 echo ""
 echo "Preserved:"
 echo "  - Vault content (notes, folders)"
-echo "  - .obsidian/ (plugins, themes, settings; BRAT owns plugin updates)"
-echo ""
 echo "Next: Pull the released plugin through BRAT, then open Vault Mind → Setup tab"