feat: let JARVIS search an Obsidian vault, read-only

[luca-71]

Ask "what did I write about X?" and JARVIS searches your Obsidian vault and reads the note back.

Stacked on #23. It extends the action vocabulary that PR introduces, so it is branched from it rather than from main to avoid a guaranteed conflict. Review #23 first.

Why the filesystem

A vault is a folder of Markdown files. This reads it directly — no AppleScript, no TCC permission prompt, no Local REST API plugin to keep running, no sync daemon. It is the simplest integration in the project, and the only one that cannot be broken by a macOS update.

OBSIDIAN_VAULT switches it on. Unset, every function returns empty and JARVIS simply has no vault; the settings panel shows the row greyed rather than red, because an unconfigured vault is opt-in, not broken.

Read-only, by design

Following mail_access: no create, edit, move, or delete function exists. Not disabled — absent. A voice assistant that mishears one word in ten must not be able to alter the user's own knowledge base.

Two guards back that up:

• read_vault_note resolves its path from search results and then re-checks it against the vault root. The query arrives from a speech transcript by way of an LLM, so it is untrusted, and a note name is not a licence to read the disk. Verified against ../../.ssh/id_rsa, ../../../etc/passwd, and /etc/passwd — none escape.
• Machinery folders (.obsidian, .git, _attachments) are skipped, and oversized files are ignored.

Search

Walks the notes rather than keeping an index — an index can go stale, and a vault is small enough that walking it is imperceptible (110 notes, 466KB, ~30ms). Title matches outweigh body matches ten to one, since notes are named deliberately: memoria in a filename is a stronger signal than the same word buried in a paragraph.

Exposed as [ACTION:VAULT] search terms. Measured 0/21 misroutes across Italian and English phrasings, including conversational controls that must produce no tag at all. The extracted queries are clean: "Cosa ho scritto nelle mie note sul marketing della piramide?" → piramide marketing.

A bug this exposed

The lookup collision guard suppressed any result arriving within 3s of the last utterance — but the utterance it measured was the one that ordered the lookup. Every fast lookup therefore silenced itself:

LLM embedded action: {"action": "vault", "target": "piramide marketing"}
Skipping lookup audio for vault — user spoke recently
Lookup vault complete: Your note "la-piramide-marketing" says: Piano Marketing …

The search worked perfectly and the answer was thrown away. Calendar and mail hid this by being slow enough to fall outside the window; a 30ms vault search never once got through. The guard now compares against the requesting turn, so it fires only when the user has genuinely started a new one — which is what it was always meant to mean.

Known nit

With a lookup this fast, the result can occasionally beat the acknowledgement out of the socket, so the two arrive in the wrong order. It reads oddly but loses nothing. Fixing it properly means signalling the lookup task once the main response has been sent, which is more restructuring than the symptom justifies here.

Testing

pytest tests/ gives 35 passed, 8 failed — identical to this branch's base, so no regressions. The 8 pre-existing failures are unrelated: 7 need playwright install, and test_browse_action_keywords imports ACTION_KEYWORDS, a symbol that no longer exists in server.py. tsc --noEmit clean.

Verified end to end against a real 110-note vault: the disabled path, a non-existent path, path traversal, routing, and the spoken result.

🤖 Generated with Claude Code