pi-vault-mind 0.8.0 → 0.8.3

package/dist/src/modal-client.d.ts

@@ -13,13 +13,17 @@
  * This client is the typed mirror of the server contract. The server (Agent A)
  * owns it; additive changes here are mirrored in the server's `modal/web.py`.
  * The local wiring lives in `src/lance.ts` (provider), `src/sync.ts`, and
- * `/wiki modal` commands (see docs/MODAL_EMBEDDING.md "Local integration").
+ * `/vm remote` commands (see docs/MODAL_EMBEDDING.md "Local integration").
  */
 export interface ModalClientConfig {
     /** Base URL of the deployed ASGI app (no trailing slash needed). */
     baseUrl: string;
-    /** Bearer token matching the `pi-vault-mind-auth` Modal secret. */
-    apiToken: string;
+    /** Fallback bearer token (legacy single token for all operations). */
+    apiToken?: string;
+    /** Read-scoped token for search/export operations. Falls back to `apiToken`. */
+    readToken?: string;
+    /** Write-scoped token for embed/reindex operations. Falls back to `apiToken`. */
+    writeToken?: string;
     /** Per-request timeout in ms (default 120s — bulk submits can be large). */
     timeoutMs?: number;
 }
@@ -101,8 +105,12 @@ export interface ExportPage {
 export declare class ModalEmbeddingClient {
     private baseUrl;
     private apiToken;
+    private readToken;
+    private writeToken;
     private timeoutMs;
     constructor(cfg: ModalClientConfig);
+    /** Return the bearer token to use for the requested operation scope. */
+    private tokenFor;
     private request;
     /** Liveness check; also returns the server's default model. */
     health(): Promise<{
@@ -128,7 +136,7 @@ export declare class ModalEmbeddingClient {
     }): Promise<JobSubmitResult>;
     jobStatus(jobId: string): Promise<JobStatus>;
     /** List recent jobs (newest first). Additive — surfaces GET /jobs so
-     * `/wiki modal jobs` can list, not just poll a known id. (Agent B request #1.) */
+     * `/vm remote jobs` can list, not just poll a known id. (Agent B request #1.) */
     listJobs(limit?: number): Promise<JobListResponse>;
     /** Cooperatively cancel a running/queued job. The worker stops after its
      * current batch and writes status=cancelled. */
@@ -147,6 +155,8 @@ export declare class ModalEmbeddingClient {
         since?: number;
         limit?: number;
     }): Promise<ExportPage>;
+    /** Low-level binary request helper with scoped token selection. */
+    private requestBuffer;
     /** Pull one page of rows with seq > since as an Arrow IPC stream.
      * Vectors are always included (no include_vectors flag). The watermark /
      * done / count come back as response headers (X-Next-Watermark, X-Done,

package/dist/src/modal-client.js

@@ -13,25 +13,36 @@
  * This client is the typed mirror of the server contract. The server (Agent A)
  * owns it; additive changes here are mirrored in the server's `modal/web.py`.
  * The local wiring lives in `src/lance.ts` (provider), `src/sync.ts`, and
- * `/wiki modal` commands (see docs/MODAL_EMBEDDING.md "Local integration").
+ * `/vm remote` commands (see docs/MODAL_EMBEDDING.md "Local integration").
  */
 export class ModalEmbeddingClient {
     baseUrl;
     apiToken;
+    readToken;
+    writeToken;
     timeoutMs;
     constructor(cfg) {
         this.baseUrl = cfg.baseUrl.replace(/\/$/, "");
         this.apiToken = cfg.apiToken;
+        this.readToken = cfg.readToken ?? cfg.apiToken;
+        this.writeToken = cfg.writeToken ?? cfg.apiToken;
         this.timeoutMs = cfg.timeoutMs ?? 120_000;
     }
-    async request(method, path, body) {
+    /** Return the bearer token to use for the requested operation scope. */
+    tokenFor(operation) {
+        const token = operation === "read" ? this.readToken : this.writeToken;
+        if (!token)
+            throw new Error(`Modal ${operation} token not configured`);
+        return token;
+    }
+    async request(method, path, body, operation = "write") {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
             const resp = await fetch(`${this.baseUrl}${path}`, {
                 method,
                 headers: {
-                    Authorization: `Bearer ${this.apiToken}`,
+                    Authorization: `Bearer ${this.tokenFor(operation)}`,
                     ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
                 },
                 body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -49,17 +60,17 @@ export class ModalEmbeddingClient {
     }
     /** Liveness check; also returns the server's default model. */
     health() {
-        return this.request("GET", "/health");
+        return this.request("GET", "/health", undefined, "read");
     }
     /** Registry of available embedders (public; no auth). Use native_dim to
      * resolve a model's output dim up-front instead of waiting for the first
      * /embed response. (Additive — Agent B request #2.) */
     models() {
-        return this.request("GET", "/models");
+        return this.request("GET", "/models", undefined, "read");
     }
     /** Server-side store + compute stats (rows per namespace, index state, GPU). */
     stats() {
-        return this.request("GET", "/stats");
+        return this.request("GET", "/stats", undefined, "read");
     }
     /** Embed text on demand. Use task="query" for search, "document" for storage. */
     embed(texts, opts = {}) {
@@ -68,7 +79,7 @@ export class ModalEmbeddingClient {
             model: opts.model,
             dim: opts.dim,
             task: opts.task ?? "query",
-        });
+        }, "write");
     }
     /** Submit a bulk embedding job; embeds + stores server-side. */
     submitJob(collection, records, opts = {}) {
@@ -77,24 +88,24 @@ export class ModalEmbeddingClient {
             records,
             model: opts.model,
             dim: opts.dim,
-        });
+        }, "write");
     }
     jobStatus(jobId) {
-        return this.request("GET", `/jobs/${encodeURIComponent(jobId)}`);
+        return this.request("GET", `/jobs/${encodeURIComponent(jobId)}`, undefined, "read");
     }
     /** List recent jobs (newest first). Additive — surfaces GET /jobs so
-     * `/wiki modal jobs` can list, not just poll a known id. (Agent B request #1.) */
+     * `/vm remote jobs` can list, not just poll a known id. (Agent B request #1.) */
     listJobs(limit) {
         const p = new URLSearchParams();
         if (limit != null)
             p.set("limit", String(limit));
         const qs = p.toString();
-        return this.request("GET", `/jobs${qs ? `?${qs}` : ""}`);
+        return this.request("GET", `/jobs${qs ? `?${qs}` : ""}`, undefined, "read");
     }
     /** Cooperatively cancel a running/queued job. The worker stops after its
      * current batch and writes status=cancelled. */
     cancelJob(jobId) {
-        return this.request("POST", `/jobs/${encodeURIComponent(jobId)}/cancel`);
+        return this.request("POST", `/jobs/${encodeURIComponent(jobId)}/cancel`, undefined, "write");
     }
     /** Poll a job until it reaches a terminal state. */
     async waitForJob(jobId, pollMs = 2000) {
@@ -107,7 +118,7 @@ export class ModalEmbeddingClient {
     }
     /** List the collections/tables held in the server-side vector store. */
     async syncCollections() {
-        const out = await this.request("GET", "/sync/collections");
+        const out = await this.request("GET", "/sync/collections", undefined, "read");
         return out.collections;
     }
     /** Pull one page of rows with seq > since. Remember next_watermark. */
@@ -119,7 +130,27 @@ export class ModalEmbeddingClient {
             p.set("dim", String(opts.dim));
         p.set("since", String(opts.since ?? 0));
         p.set("limit", String(opts.limit ?? 500));
-        return this.request("GET", `/sync/export?${p.toString()}`);
+        return this.request("GET", `/sync/export?${p.toString()}`, undefined, "read");
+    }
+    /** Low-level binary request helper with scoped token selection. */
+    async requestBuffer(method, path, operation = "read") {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const resp = await fetch(`${this.baseUrl}${path}`, {
+                method,
+                headers: { Authorization: `Bearer ${this.tokenFor(operation)}` },
+                signal: controller.signal,
+            });
+            if (!resp.ok) {
+                const detail = await resp.text().catch(() => "");
+                throw new Error(`Modal ${method} ${path} failed: ${resp.status} ${detail}`);
+            }
+            return resp;
+        }
+        finally {
+            clearTimeout(timer);
+        }
     }
     /** Pull one page of rows with seq > since as an Arrow IPC stream.
      * Vectors are always included (no include_vectors flag). The watermark /
@@ -135,26 +166,11 @@ export class ModalEmbeddingClient {
             p.set("dim", String(opts.dim));
         p.set("since", String(opts.since ?? 0));
         p.set("limit", String(opts.limit ?? 500));
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-        try {
-            const resp = await fetch(`${this.baseUrl}/sync/export?${p.toString()}`, {
-                method: "GET",
-                headers: { Authorization: `Bearer ${this.apiToken}` },
-                signal: controller.signal,
-            });
-            if (!resp.ok) {
-                const detail = await resp.text().catch(() => "");
-                throw new Error(`Modal GET /sync/export failed: ${resp.status} ${detail}`);
-            }
-            const nextWatermark = Number(resp.headers.get("X-Next-Watermark") ?? opts.since ?? 0);
-            const done = (resp.headers.get("X-Done") ?? "true") === "true";
-            const count = Number(resp.headers.get("X-Count") ?? 0);
-            return { data: await resp.arrayBuffer(), nextWatermark, done, count };
-        }
-        finally {
-            clearTimeout(timer);
-        }
+        const resp = await this.requestBuffer("GET", `/sync/export?${p.toString()}`, "read");
+        const nextWatermark = Number(resp.headers.get("X-Next-Watermark") ?? opts.since ?? 0);
+        const done = (resp.headers.get("X-Done") ?? "true") === "true";
+        const count = Number(resp.headers.get("X-Count") ?? 0);
+        return { data: await resp.arrayBuffer(), nextWatermark, done, count };
     }
     /**
      * Drain every remaining page for a collection, invoking `onPage` for each.

package/dist/src/modal-config.d.ts

@@ -9,9 +9,13 @@
  * No HTTP is reimplemented here — `ModalEmbeddingClient` owns that.
  */
 import { ModalEmbeddingClient } from "./modal-client.js";
-import type { WikiConfig } from "./types.js";
+import type { VaultMindConfig } from "./types.js";
 /** Env var name for the Modal bearer token (preferred over config). */
 export declare const MODAL_TOKEN_ENV = "PVM_API_TOKEN";
+/** Env var name for the read-scoped Modal token (search/export). */
+export declare const MODAL_READ_TOKEN_ENV = "PVM_MODAL_READ_TOKEN";
+/** Env var name for the write-scoped Modal token (embed/reindex). */
+export declare const MODAL_WRITE_TOKEN_ENV = "PVM_MODAL_WRITE_TOKEN";
 /** Dotenv-style fallback path for the Modal token. */
 export declare const MODAL_TOKEN_ENV_PATH: string;
 /** Canonical deployed Modal app name. */
@@ -22,33 +26,45 @@ export declare const modalUrl: (workspace: string) => string;
  * Resolve the Modal API token. Resolution order:
  * 1. `PVM_API_TOKEN` env var
  * 2. `~/.pi/agent/vault-mind.env`
- * 3. `wiki.embedding.modal.apiToken` in config
+ * 3. `vaultMind.embedding.modal.apiToken` in config
+ *
+ * Never log the resolved token.
+ */
+export declare const resolveModalToken: (cfg: VaultMindConfig) => string | undefined;
+/**
+ * Resolve a scoped Modal token for the requested operation.
+ * Resolution order:
+ * 1. `PVM_MODAL_{READ|WRITE}_TOKEN` env var
+ * 2. `~/.pi/agent/vault-mind.env`
+ * 3. `vaultMind.embedding.modal.{readToken|writeToken}` in config
+ * 4. Fallback to the unscoped `apiToken` (env, dotenv, then config)
+ *
  * Never log the resolved token.
  */
-export declare const resolveModalToken: (cfg: WikiConfig) => string | undefined;
+export declare const getModalToken: (cfg: VaultMindConfig, operation: "read" | "write") => string | undefined;
 /** Resolve the explicit baseUrl or derive it from workspace. */
-export declare const resolveBaseUrl: (cfg: WikiConfig) => string | undefined;
+export declare const resolveBaseUrl: (cfg: VaultMindConfig) => string | undefined;
 /** Resolve the configured workspace slug, if any. */
-export declare const resolveWorkspace: (cfg: WikiConfig) => string | undefined;
-/** True when Modal is usable: a base URL (explicit or derived) and a resolvable token are present. */
-export declare const isModalConfigured: (cfg: WikiConfig) => boolean;
+export declare const resolveWorkspace: (cfg: VaultMindConfig) => string | undefined;
+/** True when Modal is usable: a base URL (explicit or derived) and at least one resolvable scoped token are present. */
+export declare const isModalConfigured: (cfg: VaultMindConfig) => boolean;
 /**
  * Build a `ModalEmbeddingClient` from config. Returns null when Modal is not
  * configured (no base URL / token) so callers can degrade gracefully.
  */
-export declare const createModalClient: (cfg: WikiConfig) => ModalEmbeddingClient | null;
+export declare const createModalClient: (cfg: VaultMindConfig) => ModalEmbeddingClient | null;
 /**
  * The canonical embedder key for a collection. Per-collection overrides win;
  * otherwise the global Modal config model; otherwise "embeddinggemma"
  * (the eval-confirmed baseline — kept as the default *model name*, never as a
  * hard-coded dimension).
  */
-export declare const resolveModel: (cfg: WikiConfig, collection?: string) => string;
+export declare const resolveModel: (cfg: VaultMindConfig, collection?: string) => string;
 /**
  * The configured output dimension for a collection, if known. Per-collection
  * overrides win; otherwise the global Modal config `dim`. Returns undefined
  * when unset — callers resolve the native dim lazily via `/models`.
  */
-export declare const resolveDim: (cfg: WikiConfig, collection?: string) => number | undefined;
+export declare const resolveDim: (cfg: VaultMindConfig, collection?: string) => number | undefined;
 /** Namespaced local table name mirroring the server's ADR-3 scheme. */
 export declare const namespacedTableName: (collection: string, model: string, dim: number) => string;

package/dist/src/modal-config.js

@@ -13,6 +13,10 @@ import * as path from "node:path";
 import { ModalEmbeddingClient } from "./modal-client.js";
 /** Env var name for the Modal bearer token (preferred over config). */
 export const MODAL_TOKEN_ENV = "PVM_API_TOKEN";
+/** Env var name for the read-scoped Modal token (search/export). */
+export const MODAL_READ_TOKEN_ENV = "PVM_MODAL_READ_TOKEN";
+/** Env var name for the write-scoped Modal token (embed/reindex). */
+export const MODAL_WRITE_TOKEN_ENV = "PVM_MODAL_WRITE_TOKEN";
 /** Dotenv-style fallback path for the Modal token. */
 export const MODAL_TOKEN_ENV_PATH = path.join(process.env.HOME || process.env.USERPROFILE || "", ".pi", "agent", "vault-mind.env");
 /** Canonical deployed Modal app name. */
@@ -48,7 +52,8 @@ export const modalUrl = (workspace) => `https://${workspace}--${MODAL_APP_NAME}-
  * Resolve the Modal API token. Resolution order:
  * 1. `PVM_API_TOKEN` env var
  * 2. `~/.pi/agent/vault-mind.env`
- * 3. `wiki.embedding.modal.apiToken` in config
+ * 3. `vaultMind.embedding.modal.apiToken` in config
+ *
  * Never log the resolved token.
  */
 export const resolveModalToken = (cfg) => {
@@ -59,6 +64,30 @@ export const resolveModalToken = (cfg) => {
         return dotenv[MODAL_TOKEN_ENV];
     return cfg.embedding.modal?.apiToken;
 };
+/**
+ * Resolve a scoped Modal token for the requested operation.
+ * Resolution order:
+ * 1. `PVM_MODAL_{READ|WRITE}_TOKEN` env var
+ * 2. `~/.pi/agent/vault-mind.env`
+ * 3. `vaultMind.embedding.modal.{readToken|writeToken}` in config
+ * 4. Fallback to the unscoped `apiToken` (env, dotenv, then config)
+ *
+ * Never log the resolved token.
+ */
+export const getModalToken = (cfg, operation) => {
+    const modal = cfg.embedding.modal;
+    const dotenv = readDotEnv(MODAL_TOKEN_ENV_PATH);
+    if (operation === "read") {
+        return (process.env[MODAL_READ_TOKEN_ENV] ||
+            dotenv[MODAL_READ_TOKEN_ENV] ||
+            modal?.readToken ||
+            resolveModalToken(cfg));
+    }
+    return (process.env[MODAL_WRITE_TOKEN_ENV] ||
+        dotenv[MODAL_WRITE_TOKEN_ENV] ||
+        modal?.writeToken ||
+        resolveModalToken(cfg));
+};
 /** Resolve the explicit baseUrl or derive it from workspace. */
 export const resolveBaseUrl = (cfg) => {
     const modal = cfg.embedding.modal;
@@ -70,8 +99,8 @@ export const resolveBaseUrl = (cfg) => {
 };
 /** Resolve the configured workspace slug, if any. */
 export const resolveWorkspace = (cfg) => cfg.embedding.modal?.workspace;
-/** True when Modal is usable: a base URL (explicit or derived) and a resolvable token are present. */
-export const isModalConfigured = (cfg) => cfg.embedding.provider === "modal" && !!resolveBaseUrl(cfg) && !!resolveModalToken(cfg);
+/** True when Modal is usable: a base URL (explicit or derived) and at least one resolvable scoped token are present. */
+export const isModalConfigured = (cfg) => !!cfg.embedding.remoteUrl && (!!getModalToken(cfg, "read") || !!getModalToken(cfg, "write"));
 /**
  * Build a `ModalEmbeddingClient` from config. Returns null when Modal is not
  * configured (no base URL / token) so callers can degrade gracefully.
@@ -81,9 +110,11 @@ export const createModalClient = (cfg) => {
     if (!baseUrl)
         return null;
     const apiToken = resolveModalToken(cfg);
-    if (!apiToken)
+    const readToken = getModalToken(cfg, "read");
+    const writeToken = getModalToken(cfg, "write");
+    if (!apiToken && !readToken && !writeToken)
         return null;
-    const clientCfg = { baseUrl, apiToken };
+    const clientCfg = { baseUrl, apiToken, readToken, writeToken };
     return new ModalEmbeddingClient(clientCfg);
 };
 /**

package/dist/src/personalize.d.ts

@@ -0,0 +1,47 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+export interface VaultProfile {
+    vaultPath: string;
+    topFolders: Array<{
+        name: string;
+        noteCount: number;
+    }>;
+    totalNotes: number;
+    commonTags: Array<{
+        tag: string;
+        count: number;
+    }>;
+    domains: string[];
+    lancedbSummary?: string;
+}
+export interface ConfigFiles {
+    systemMd: string | null;
+    agentsMd: string | null;
+}
+export interface FileSuggestion {
+    path: string;
+    current: string | null;
+    proposed: string;
+    action: "create" | "update" | "skip";
+}
+export interface SuggestionResult {
+    commentary?: string;
+    files: FileSuggestion[];
+}
+/** Resolve the vault path: configured default vault wins, otherwise ctx.cwd. */
+export declare const resolveVaultPath: (ctx: ExtensionContext) => string;
+/** Load current agent configuration files if they exist. */
+export declare const loadCurrentConfig: (vaultPath: string) => ConfigFiles;
+/** Analyze the vault structure, tags, and LanceDB state. */
+export declare const analyzeVaultProfile: (ctx: ExtensionContext) => Promise<VaultProfile>;
+export declare const parseSuggestionJson: (text: string) => SuggestionResult;
+/** Ask the current session model to suggest personalized config updates. */
+export declare const generateSuggestions: (pi: ExtensionAPI, profile: VaultProfile, currentConfig: ConfigFiles) => Promise<SuggestionResult>;
+/** Format old vs new as a markdown diff block. */
+export declare const formatDiff: (current: string | null, proposed: string) => string;
+/** Present each suggestion diff to the user and write approved files. */
+export declare const presentAndApplyDiff: (suggestions: SuggestionResult, ctx: ExtensionContext, currentConfig: ConfigFiles) => Promise<{
+    approved: string[];
+    rejected: string[];
+}>;
+/** Orchestrate /vm personalize: analyze, suggest, confirm, apply. */
+export declare const runPersonalize: (ctx: ExtensionContext, pi: ExtensionAPI) => Promise<void>;