Ship Vault MCP V2 private-alpha platform - #8
Merged
Conversation
Add a private-alpha fresh-install smoke script that validates the Obsidian plugin release bundle from the release manifest, checksum, zip, and release notes, installs it into a disposable vault, enables vault-mcp through community-plugins.json, verifies runtime files and manifest metadata, and catches double-nested installs. Document the fresh-user zip install path in the plugin private-alpha guide and 0.1.0 release notes, then regenerate the source wiki so the new smoke gate is included in the hosted reference. Verification: npm run plugin:package; npm run plugin:verify-package; npm run plugin:smoke-fresh-install -- --report dist/obsidian-plugin/fresh-install-smoke.json; npm run wiki:generate; npm run build; npm run check:api; npm test; npm audit --audit-level=low; clean-env npm run smoke:local; npm run smoke:oauth-local; vault structural validator.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Add a private-alpha lifecycle smoke script that validates upgrade and uninstall behavior from the packaged Obsidian plugin release. The smoke creates a disposable vault with an existing plugin install, sentinel data.json, normal note, and write-audit note; upgrades runtime files from the release zip; verifies data.json is preserved exactly; then uninstalls the plugin while confirming vault notes and audit notes remain. Document the lifecycle gate in the private-alpha plugin guide and release notes, add the npm script, and regenerate the source wiki so the lifecycle smoke has a hosted reference page. Verification: npm run plugin:package; npm run plugin:smoke-lifecycle -- --report dist/obsidian-plugin/lifecycle-smoke.json; npm run plugin:verify-package; npm run plugin:smoke-fresh-install; npm run plugin:smoke-lifecycle; npm run wiki:generate; npm run build; npm run check:api; npm test; npm audit --audit-level=low; clean-env npm run smoke:local; npm run smoke:oauth-local; vault structural validator.
Improve the ChatGPT/MCP Apps results-v2 template with richer read-only rendering for search results, note lists, fetched notes, vault lists, index/vault status, diagnostics, structured errors, and future proposal-shaped data. Fetched notes now get frontmatter summary rendering, Markdown headings/lists/tasks/code/link handling, citation links, and Obsidian links. The component also retries for delayed ChatGPT globals so first render is less fragile. Advertise the output template for index status and structured error results, update connector/threat-model docs to reference results-v2, and regenerate the source wiki. Server contract tests now assert the shipped component includes the new render paths and delayed-global retry. Verification: npx vitest run apps/server/src/app.test.ts; npm run wiki:generate; npm run build; npm run check:api; npm test; npm audit --audit-level=low; npm run plugin:verify-package; npm run plugin:smoke-fresh-install; npm run plugin:smoke-lifecycle; clean-env npm run smoke:local; npm run smoke:oauth-local; vault structural validator.
Add a tested pluginSetupGuide helper that turns current plugin settings into first-run setup steps, hosting options, client setup cards, copyable MCP endpoint/test prompt data, and recovery actions. Render the guide in both the Obsidian dashboard and settings so users see a Start here path before dealing with low-level settings. Style the new setup surface and document the plugin-first no-terminal private-alpha direction. Update generated wiki reference pages after the plugin helper/UI/docs changes. Verification: npx vitest run apps/obsidian-plugin/src/plugin-helpers.test.ts; npm run build:plugin; npm run wiki:generate; npm run build; npm run check:api; npm test; npm audit --audit-level=low; npm run plugin:package; npm run plugin:verify-package; npm run plugin:smoke-fresh-install; npm run plugin:smoke-lifecycle; env -i HOME="/Users/tjt" PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Users/tjt/.codex/tmp/arg0/codex-arg0UaXs4Z:/Users/tjt/.cache/codex-runtimes/codex-primary-runtime/dependencies/bin:/Users/tjt/.antigravity-ide/antigravity-ide/bin:/Users/tjt/.local/state/fnm_multishells/94336_1782575692722/bin:/Applications/Codex.app/Contents/Resources" SHELL="/bin/zsh" TMPDIR="/var/folders/nf/pn6s1_713zl5tvhpt35w001c0000gn/T/" npm run smoke:local; npm run smoke:oauth-local; npm run plugin:install-copy -- --vault "/Users/tjt/Documents/Tristan's Personal vault copy".
Serve a browser-first no-terminal Vercel setup page at /setup/vercel and cover it with a server route regression test. Link the public landing page to setup as the primary onboarding path. Wire the Obsidian plugin guided Vercel self-host card to the hosted setup URL with open/copy actions, and update the private-alpha docs to explain the current browser-based handoff and remaining one-click template gap. Regenerate the source wiki so the new setup page and route are documented. Verification: npx vitest run apps/server/src/app.test.ts apps/obsidian-plugin/src/plugin-helpers.test.ts; npm run build:plugin; npm run wiki:generate; npm run build; npm run check:api; npm test; npm audit --audit-level=low; npm run plugin:package; npm run plugin:verify-package; npm run plugin:smoke-fresh-install; npm run plugin:smoke-lifecycle; env -i HOME="/Users/tjt" PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Users/tjt/.codex/tmp/arg0/codex-arg0UaXs4Z:/Users/tjt/.cache/codex-runtimes/codex-primary-runtime/dependencies/bin:/Users/tjt/.antigravity-ide/antigravity-ide/bin:/Users/tjt/.local/state/fnm_multishells/94336_1782575692722/bin:/Applications/Codex.app/Contents/Resources" SHELL="/bin/zsh" TMPDIR="/var/folders/nf/pn6s1_713zl5tvhpt35w001c0000gn/T/" npm run smoke:local; npm run smoke:oauth-local; npm run plugin:install-copy -- --vault "/Users/tjt/Documents/Tristan's Personal vault copy".
Generate a browser-only setup bundle from the hosted Vercel walkthrough and let the Obsidian plugin import it into settings. This moves the private-alpha no-terminal path from manual field copying toward a single copy/paste handoff while keeping external account consent explicit. Changes: - Add PluginSetupBundle parsing and validation with tests. - Add an Import setup bundle control in the Obsidian plugin settings. - Update /setup/vercel to generate env values plus a vault-mcp-plugin-setup JSON bundle entirely in-browser. - Update private-alpha setup docs, route test expectations, and generated wiki pages. Verification: - npx vitest run apps/server/src/app.test.ts apps/obsidian-plugin/src/plugin-helpers.test.ts - npm run wiki:generate - npm run build - npm run check:api - npm test - npm audit --audit-level=low - npm run plugin:package - npm run plugin:verify-package - npm run plugin:smoke-fresh-install - npm run plugin:smoke-lifecycle - env -i HOME="/Users/tjt" PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Users/tjt/.codex/tmp/arg0/codex-arg0UaXs4Z:/Users/tjt/.cache/codex-runtimes/codex-primary-runtime/dependencies/bin:/Users/tjt/.antigravity-ide/antigravity-ide/bin:/Users/tjt/.local/state/fnm_multishells/94336_1782575692722/bin:/Applications/Codex.app/Contents/Resources" SHELL="/bin/zsh" TMPDIR="/var/folders/nf/pn6s1_713zl5tvhpt35w001c0000gn/T/" npm run smoke:local - npm run smoke:oauth-local - npm run plugin:install-copy -- --vault "/Users/tjt/Documents/Tristan's Personal vault copy"
Add a dependency-free smoke test for the ChatGPT/MCP Apps result component. The script imports the compiled component HTML, runs the inline script in a small fake DOM, and verifies delayed openai:set_globals, retry rendering, fetched-note Markdown rendering, status cards, structured errors, and future proposal-shaped cards without depending on live ChatGPT. This keeps the real client acceptance gate separate while making the first-render regression locally testable. Generated wiki updates are intentionally paused for now per user direction; this commit does not update public/wiki files. Verification: - npm run smoke:mcp-ui - npm run build - npm run check:api - npm test - npm audit --audit-level=low - env -i HOME="/Users/tjt" PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Users/tjt/.codex/tmp/arg0/codex-arg0FAGd8s:/Users/tjt/.cache/codex-runtimes/codex-primary-runtime/dependencies/bin:/Users/tjt/.antigravity-ide/antigravity-ide/bin:/Users/tjt/.local/state/fnm_multishells/8955_1782745319344/bin:/Applications/Codex.app/Contents/Resources" SHELL="/bin/zsh" TMPDIR="/var/folders/nf/pn6s1_713zl5tvhpt35w001c0000gn/T/" npm run smoke:local - npm run smoke:oauth-local
Add npm run release:check:local as the repeatable local private-alpha release gate. The runner executes build, API check, tests, MCP UI smoke, dependency audit, plugin package/verify/fresh-install/lifecycle checks, clean-env local smoke, and OAuth local smoke in a deterministic order. It intentionally skips wiki generation unless explicitly requested, and reports production OAuth, production multi-vault, and real MCP client acceptance as separate external gates. Docs now point users to the one-command local gate before private-alpha package sharing. Verification: - npm run release:check:local - output confirmed 55 tests, zero vulnerabilities, plugin checksum c83f4034faf6306ae0ecdaf5828ce114aae199c808f082254d517f7662cf2749, clean-env local smoke with 240 documents, and OAuth local smoke in oauth-jwt mode
Add prepare and verify scripts for BRAT GitHub release assets so the Obsidian plugin can stage manifest.json, main.js, and styles.css under dist/brat/vault-mcp and validate that the release tag/name match the plugin manifest version. Wire the BRAT prepare/verify checks into the wiki-free local release gate and document the remaining real BRAT copied-vault install as an external acceptance gate. Update README, acceptance docs, private-alpha plugin docs, and 0.1.0 release notes with the BRAT workflow, private repository token caveat, and the distinction between zip package proof, BRAT asset proof, and actual BRAT UI install proof. Verification: npm run plugin:brat:prepare -- --skip-build; npm run plugin:brat:verify; npm run release:check:local passed with build, API check, 55 tests, MCP UI smoke, audit, plugin package/verify, BRAT prepare/verify, fresh-install smoke, lifecycle smoke, clean-env local smoke at 240 copied-vault documents, and OAuth local smoke.
Add a networked verifier for the private-alpha BRAT prerelease. The script reads the GitHub release metadata, confirms the release is a non-draft prerelease, checks that manifest.json, main.js, and styles.css are present and uploaded, downloads those assets, runs the local BRAT asset verifier against the downloaded files, and compares GitHub SHA256 digests to the downloaded hashes. Document the published 0.1.0 prerelease URL in README, acceptance docs, private-alpha plugin docs, and release notes, while keeping the actual copied-vault BRAT UI install as the remaining manual gate for private-repo testing. Verification: npm run plugin:brat:verify-github passed against vault-mcp/platform release 0.1.0; npm run release:check:local passed with build, API check, 55 tests, MCP UI smoke, audit, plugin package/verify, BRAT prepare/verify, fresh-install smoke, lifecycle smoke, clean-env local smoke, and OAuth local smoke.
Add a copied-vault BRAT readiness script that verifies BRAT installation, version compatibility, community-plugin enablement, BRAT repository configuration, GitHub release assets, and remaining setup blockers without printing secrets. The script can intentionally prepare the copied vault with --enable-brat and --add-repo, pinning vault-mcp/platform to the plugin manifest version for BRAT private-alpha testing. Docs now include the copied-vault readiness step before the remaining manual BRAT UI install and screenshot gate. Verification: npm run plugin:brat:check-copy -- --enable-brat --add-repo --check-github-release prepared the copied vault; npm run plugin:brat:check-copy -- --check-github-release --write-report dist/brat/copied-vault-readiness.json passed with no blocks; npm run release:check:local passed with build, API check, 55 tests, MCP UI smoke, audit, plugin package/verify, BRAT prepare/verify, fresh-install smoke, lifecycle smoke, clean-env local smoke, and OAuth local smoke.
Add a plugin:brat:verify-copy-install command that downloads the GitHub 0.1.0 BRAT release assets, reuses the BRAT release verifier, and confirms the copied-vault installed Vault MCP runtime files match the release by SHA256. Document the new copied-vault install gate in the README, acceptance runbook, private-alpha plugin guide, and 0.1.0 release notes so BRAT readiness includes release assets, BRAT configuration, and installed-file evidence.
Add a screenshot-backed BRAT private-alpha walkthrough that defines the copied-vault evidence folder, required screenshots, report JSON shape, and pass/fail criteria for the human Obsidian BRAT install/update pass. Add plugin:brat:verify-ui-evidence to validate that report without committing screenshots, including checks for release tag, repo, copied/disposable vault use, required prior BRAT commands, required screenshot files, and obvious secret-like values.
Add plugin:brat:prepare-ui-evidence to run the prerequisite GitHub release, copied-vault BRAT config, and copied-vault installed-file checks, then generate the ignored dist/brat/ui-evidence/report.json scaffold for screenshot capture. Update the BRAT walkthrough, acceptance runbook, README, plugin private-alpha guide, and release notes so the human BRAT UI pass is a concrete prepare, capture, verify flow rather than a manually assembled report.
Add plugin:brat:evidence-status to report the current screenshot evidence state without failing by default. It validates report metadata, prerequisite command flags, copied/disposable vault use, and lists present or missing screenshot files, with --strict available for final gating. Document the status command in the BRAT walkthrough, acceptance runbook, README, private-alpha plugin guide, and release notes so testers can see exactly what remains before the strict UI evidence verifier can pass.
TristanEDU
changed the title
TristanEDU
marked this pull request as ready for review
July 13, 2026 19:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope\n\nLands the accumulated Vault MCP V2 private-alpha platform work:\n\n- plugin-first onboarding, indexing controls, write-proposal review, and BRAT packaging\n- plugin-managed localhost sidecar with scoped read/write/God filesystem policy\n- local filesystem search, bytes, metadata, copy/move/delete, exact edit, expiry, intent checks, symlink hardening, and audit\n- outbound hosted ChatGPT desktop bridge with tenant/vault/installation scoping\n- MCP Apps UI, self-hosting, acceptance, security, and release gates\n\n## Safety\n\n- hosted write proposals remain disabled unless MCP_WRITE_PROPOSALS_ENABLED=true and the caller has vault:write\n- hosted desktop tools remain disabled unless MCP_REMOTE_LOCAL_FS_ENABLED=true and the caller has local:access\n- the Obsidian plugin bridge is opt-in and the localhost sidecar remains authoritative for all filesystem policy\n- no live vault was used for destructive testing\n\n## Verification\n\n- npm run release:check:local: 73 tests and all 16 steps passed\n- disposable Obsidian vault install/settings/bridge prerequisite UI acceptance passed\n- GitHub Actions run 29278041262 passed\n- Vercel preview passed on 12bce2b\n