fix(vault): use default vault dir for age key/path fallback

CHANGELOG.md

@@ -14,6 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Fixed
 - Outdated config keys in default.toml: removed nonexistent `repo_id`, renamed `provider_type` to `type`, corrected candle defaults, fixed observability exporter default
 - Add `wait(true)` to Qdrant upsert and delete operations for read-after-write consistency, fixing flaky `ingested_chunks_have_correct_payload` integration test (#567)
+- Vault age backend now falls back to default directory for key/path when `--vault-key`/`--vault-path` are not provided, matching `zeph vault init` behavior (#613)
 
 ### Changed
 - Orchestrator sub-providers now resolve `base_url` and `embedding_model` via fallback chain: per-provider, parent section, global default

crates/zeph-core/src/bootstrap.rs

@@ -316,14 +316,39 @@ pub fn parse_vault_args(
         .unwrap_or_else(|| config.vault.backend.clone());
 
     let env_key = std::env::var("ZEPH_VAULT_KEY").ok();
+    let default_dir = crate::vault::default_vault_dir();
     let key_path = cli_key_path
         .map(|p| p.to_string_lossy().into_owned())
-        .or(env_key);
+        .or(env_key)
+        .or_else(|| {
+            if backend == "age" {
+                Some(
+                    default_dir
+                        .join("vault-key.txt")
+                        .to_string_lossy()
+                        .into_owned(),
+                )
+            } else {
+                None
+            }
+        });
 
     let env_vault = std::env::var("ZEPH_VAULT_PATH").ok();
     let vault_path = cli_vault_path
         .map(|p| p.to_string_lossy().into_owned())
-        .or(env_vault);
+        .or(env_vault)
+        .or_else(|| {
+            if backend == "age" {
+                Some(
+                    default_dir
+                        .join("secrets.age")
+                        .to_string_lossy()
+                        .into_owned(),
+                )
+            } else {
+                None
+            }
+        });
 
     VaultArgs {
         backend,

crates/zeph-core/src/vault.rs

@@ -206,6 +206,19 @@ impl AgeVaultProvider {
     }
 }
 
+/// Default vault directory: `$XDG_CONFIG_HOME/zeph`, `$APPDATA/zeph`, or `~/.config/zeph`.
+#[must_use]
+pub fn default_vault_dir() -> PathBuf {
+    if let Ok(xdg) = std::env::var("XDG_CONFIG_HOME") {
+        return PathBuf::from(xdg).join("zeph");
+    }
+    if let Ok(appdata) = std::env::var("APPDATA") {
+        return PathBuf::from(appdata).join("zeph");
+    }
+    let home = std::env::var("HOME").unwrap_or_else(|_| ".".to_owned());
+    PathBuf::from(home).join(".config").join("zeph")
+}
+
 fn parse_identity(key_str: &str) -> Result<age::x25519::Identity, AgeVaultError> {
     let key_line = key_str
         .lines()

docs/src/reference/cli.md

@@ -67,8 +67,8 @@ zeph vault rm ZEPH_TELEGRAM_TOKEN
 | `--tui` | Run with the TUI dashboard (requires the `tui` feature) |
 | `--config <PATH>` | Path to a TOML config file (overrides `ZEPH_CONFIG` env var) |
 | `--vault <BACKEND>` | Secrets backend: `env` or `age` (overrides `ZEPH_VAULT_BACKEND` env var) |
-| `--vault-key <PATH>` | Path to age identity (private key) file (overrides `ZEPH_VAULT_KEY` env var) |
-| `--vault-path <PATH>` | Path to age-encrypted secrets file (overrides `ZEPH_VAULT_PATH` env var) |
+| `--vault-key <PATH>` | Path to age identity (private key) file (default: `~/.config/zeph/vault-key.txt`, overrides `ZEPH_VAULT_KEY` env var) |
+| `--vault-path <PATH>` | Path to age-encrypted secrets file (default: `~/.config/zeph/secrets.age`, overrides `ZEPH_VAULT_PATH` env var) |
 | `--version` | Print version and exit |
 | `--help` | Print help and exit |
 

src/main.rs

@@ -690,15 +690,7 @@ async fn main() -> anyhow::Result<()> {
 }
 
 fn default_vault_dir() -> PathBuf {
-    // XDG_CONFIG_HOME or ~/.config on Unix, %APPDATA% on Windows
-    if let Ok(xdg) = std::env::var("XDG_CONFIG_HOME") {
-        return PathBuf::from(xdg).join("zeph");
-    }
-    if let Ok(appdata) = std::env::var("APPDATA") {
-        return PathBuf::from(appdata).join("zeph");
-    }
-    let home = std::env::var("HOME").unwrap_or_else(|_| ".".to_owned());
-    PathBuf::from(home).join(".config").join("zeph")
+    zeph_core::vault::default_vault_dir()
 }
 
 fn handle_vault_command(