@andespindola/brainlink 1.6.1 → 1.6.3

package/dist/cli/commands/write/server-commands.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { platform, tmpdir } from 'node:os';
 import { spawn, spawnSync } from 'node:child_process';
 import { startServer } from '../../../application/start-server.js';
+import { resolveWebAuth } from '../../../application/server/web-auth.js';
 import { isBucketVaultPath } from '../../../infrastructure/file-system-vault.js';
 import { startRemoteMcpServer } from '../../../mcp/http-server.js';
 import { parsePositiveInteger, print, resolveOptions } from '../../runtime.js';
@@ -489,32 +490,43 @@ export const registerServerCommands = (program) => {
         .option('--no-open', 'do not open the graph UI automatically')
         .option('-w, --watch', 'watch markdown files and reindex on changes', true)
         .option('--no-watch', 'disable markdown file watching')
+        .option('--expose', 'expose an authenticated remote graph UI (branded login) instead of the local loopback UI')
         .option('--json', 'print machine-readable JSON')
-        .description('start a local web UI for the knowledge graph')
+        .description('start a web UI for the knowledge graph (local by default, or authenticated remote with --expose)')
         .action(async (options) => {
         const resolved = await resolveOptions(options);
+        const expose = options.expose === true;
+        // Exposed mode must never serve the vault unauthenticated: require credentials
+        // (persistent web-auth store or BRAINLINK_WEB_USER/PASSWORD env) before binding.
+        if (expose && (await resolveWebAuth()) === null) {
+            throw new Error('Refusing to expose the graph UI without authentication. Configure credentials first (BRAINLINK_WEB_USER + BRAINLINK_WEB_PASSWORD, or a persisted web-auth store).');
+        }
         const shouldWatch = options.watch !== false && !isBucketVaultPath(resolved.vault);
         const server = await startServer({
             vaultPath: resolved.vault,
             host: options.host ?? resolved.config.host,
             port: parsePositiveInteger(options.port ?? String(resolved.config.port), resolved.config.port),
             shouldIndex: options.index,
-            shouldWatch
+            shouldWatch,
+            expose
         });
-        const openResult = options.open !== false ? openUrlInUi(server.url, process.pid) : { opened: false, mode: 'none' };
+        // Never auto-open a browser in exposed mode (it runs headless behind a proxy).
+        const openResult = options.open !== false && !expose ? openUrlInUi(server.url, process.pid) : { opened: false, mode: 'none' };
         print(options.json, {
             url: server.url,
+            mode: expose ? 'exposed' : 'local',
+            auth: expose ? 'branded-login' : 'none',
             watch: shouldWatch,
             readonly: true,
             openedUi: openResult.opened,
             openMode: openResult.mode
-        }, () => `Brainlink graph server running at ${server.url} (${shouldWatch ? 'watching for changes' : 'watch disabled'})${openResult.opened
+        }, () => `Brainlink graph server running at ${server.url} (${expose ? 'exposed, branded login' : 'local'}${shouldWatch ? ', watching for changes' : ', watch disabled'})${openResult.opened
             ? openResult.mode === 'native-gui'
                 ? ' (opened in native desktop GUI)'
                 : openResult.mode === 'app-window'
                     ? ' (opened in dedicated app window)'
                     : ' (opened in browser)'
-            : options.open === false
+            : options.open === false || expose
                 ? ' (auto-open disabled)'
                 : ''}`);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andespindola/brainlink",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "Local-first knowledge memory for agents with Markdown, backlinks, indexing and context retrieval.",
   "type": "module",
   "license": "MIT",