@andespindola/brainlink 1.6.5 → 1.6.7

package/README.md

@@ -611,7 +611,19 @@ blink server --host 127.0.0.1 --port 4321
 ```
 
 By default, the server uses `$HOME/.brainlink/vault`. Pass `--vault ./vault` only when you want to inspect a custom vault.
-By default, the server watches Markdown files in local filesystem vaults and reindexes after note changes. Use `--no-watch` to disable realtime reindexing.
+By default, the server watches Markdown files in local filesystem vaults and reindexes after note changes. Use `--no-watch` to disable realtime reindexing. While the graph is open it polls `/api/graph-version` and re-fetches automatically, so notes an agent writes (via MCP) surface live without a manual reload.
+
+### Local vs exposed mode
+
+`blink server` has two modes, mirroring the local/remote split of the MCP server:
+
+- **Local (default):** loopback-only, no authentication — for your own machine.
+- **Exposed (`blink server --expose`):** intended to sit behind a TLS-terminating reverse proxy. Every route is gated behind a **branded login** (not the browser's Basic-auth prompt); it allows a non-loopback bind and serves a public `/healthz`. Credentials come from a persistent store (`<brainlink-home>/web-auth.json`, seeded once from `BRAINLINK_WEB_USER` + `BRAINLINK_WEB_PASSWORD`); the session is a signed HttpOnly cookie, and the password can be changed at `/change-password` (the change persists across restarts). Exposed mode refuses to start without configured credentials.
+
+```bash
+BRAINLINK_WEB_USER="you" BRAINLINK_WEB_PASSWORD="change-me" \
+blink server --host 127.0.0.1 --port 4321 --no-open --expose
+```
 By default, `blink server` tries to open the graph in a native desktop GUI window:
 - macOS: Swift + WebKit
 - Windows: PowerShell WinForms WebBrowser

package/dist/application/frontend/client/account-menu.js

@@ -0,0 +1,185 @@
+// Client module (served as a plain string, same pattern as live-refresh.ts) that
+// injects an account control into the graph page when server-side auth is
+// enabled. In local (no-auth) mode there is no account, so the control is never
+// shown. The bootstrap calls startAccountMenu(); the module only defines it.
+// Styling mirrors the branded auth pages: dark #08131d surfaces, subtle borders,
+// and the #5aa8ff accent, kept unobtrusive in the top-right corner.
+export const createAccountMenuJs = () => `
+const startAccountMenu = () => {
+  if (typeof fetch !== 'function' || typeof document === 'undefined' || !document.body) {
+    return
+  }
+  if (document.getElementById('bl-account')) {
+    return
+  }
+
+  const injectStyles = () => {
+    if (document.getElementById('bl-account-styles')) {
+      return
+    }
+    const style = document.createElement('style')
+    style.id = 'bl-account-styles'
+    style.textContent = [
+      '.bl-account {',
+      '  position: fixed;',
+      '  top: 12px;',
+      '  right: 12px;',
+      '  z-index: 2147483000;',
+      '  font-family: "Crowquill Mono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;',
+      '}',
+      '.bl-account-button {',
+      '  display: inline-flex;',
+      '  align-items: center;',
+      '  gap: 6px;',
+      '  height: 32px;',
+      '  padding: 0 12px;',
+      '  border: 1px solid rgba(143, 172, 204, 0.18);',
+      '  border-radius: 8px;',
+      '  background: rgba(13, 24, 35, 0.92);',
+      '  color: #edf4ff;',
+      '  font: inherit;',
+      '  font-size: 12px;',
+      '  cursor: pointer;',
+      '  transition: border-color 120ms ease;',
+      '}',
+      '.bl-account-button:hover,',
+      '.bl-account-button:focus {',
+      '  border-color: #5aa8ff;',
+      '  outline: none;',
+      '}',
+      '.bl-account-menu {',
+      '  position: absolute;',
+      '  top: 40px;',
+      '  right: 0;',
+      '  min-width: 168px;',
+      '  padding: 6px;',
+      '  border: 1px solid rgba(143, 172, 204, 0.18);',
+      '  border-radius: 10px;',
+      '  background: rgba(13, 24, 35, 0.98);',
+      '  box-shadow: 0 18px 60px rgba(1, 6, 13, 0.48);',
+      '  display: grid;',
+      '  gap: 2px;',
+      '}',
+      '.bl-account-menu[hidden] {',
+      '  display: none;',
+      '}',
+      '.bl-account-item {',
+      '  display: block;',
+      '  width: 100%;',
+      '  padding: 8px 10px;',
+      '  border: 0;',
+      '  border-radius: 6px;',
+      '  background: transparent;',
+      '  color: #edf4ff;',
+      '  font: inherit;',
+      '  font-size: 12px;',
+      '  text-align: left;',
+      '  cursor: pointer;',
+      '}',
+      '.bl-account-item:hover,',
+      '.bl-account-item:focus {',
+      '  background: rgba(90, 168, 255, 0.18);',
+      '  outline: none;',
+      '}'
+    ].join('\\n')
+    document.head.appendChild(style)
+  }
+
+  const build = (user) => {
+    injectStyles()
+
+    const root = document.createElement('div')
+    root.id = 'bl-account'
+    root.className = 'bl-account'
+
+    const button = document.createElement('button')
+    button.type = 'button'
+    button.className = 'bl-account-button'
+    button.textContent = typeof user === 'string' && user.length > 0 ? user : 'Account'
+    button.setAttribute('aria-haspopup', 'true')
+    button.setAttribute('aria-expanded', 'false')
+
+    const menu = document.createElement('div')
+    menu.className = 'bl-account-menu'
+    menu.setAttribute('role', 'menu')
+    menu.hidden = true
+
+    const addItem = (label, onSelect) => {
+      const item = document.createElement('button')
+      item.type = 'button'
+      item.className = 'bl-account-item'
+      item.setAttribute('role', 'menuitem')
+      item.textContent = label
+      item.addEventListener('click', onSelect)
+      menu.appendChild(item)
+    }
+
+    const closeMenu = () => {
+      menu.hidden = true
+      button.setAttribute('aria-expanded', 'false')
+    }
+
+    const openMenu = () => {
+      menu.hidden = false
+      button.setAttribute('aria-expanded', 'true')
+    }
+
+    addItem('Settings', () => {
+      closeMenu()
+      window.location.href = '/settings'
+    })
+    addItem('Change password', () => {
+      closeMenu()
+      window.location.href = '/change-password'
+    })
+    addItem('Sign out', () => {
+      closeMenu()
+      fetch('/api/logout', { method: 'POST' })
+        .catch(() => {})
+        .then(() => {
+          window.location.href = '/login'
+        })
+    })
+
+    button.addEventListener('click', (event) => {
+      event.stopPropagation()
+      if (menu.hidden) {
+        openMenu()
+      } else {
+        closeMenu()
+      }
+    })
+
+    document.addEventListener('click', (event) => {
+      if (!root.contains(event.target)) {
+        closeMenu()
+      }
+    })
+
+    document.addEventListener('keydown', (event) => {
+      if (event.key === 'Escape') {
+        closeMenu()
+      }
+    })
+
+    root.appendChild(button)
+    root.appendChild(menu)
+    document.body.appendChild(root)
+  }
+
+  fetch('/api/auth-status', { headers: { accept: 'application/json' } })
+    .then((response) => {
+      if (!response.ok) {
+        return null
+      }
+      return response.json().catch(() => null)
+    })
+    .then((payload) => {
+      if (!payload || payload.enabled !== true) {
+        return
+      }
+      build(payload.user)
+    })
+    .catch(() => {})
+}
+`;

package/dist/application/frontend/client/elements.js

@@ -71,6 +71,7 @@ const state = {
   workerReady: false,
   rendererMode: 'worker',
   renderWorker: null,
+  graphVersion: null,
   agentId: '',
   contextId: '',
   graphSignature: '',

package/dist/application/frontend/client/live-refresh.js

@@ -0,0 +1,42 @@
+export const createLiveRefreshJs = () => `
+// Poll a cheap generation counter so the graph reflects vault changes live:
+// when an agent writes notes via MCP, the watcher bumps the version and the
+// client re-fetches the current viewport and refreshes the context list, so new
+// nodes and contexts surface without a manual reload.
+const liveRefreshIntervalMs = 3000
+
+const pollGraphVersion = async () => {
+  try {
+    const response = await fetch('/api/graph-version', { headers: { accept: 'application/json' } })
+    if (!response.ok) {
+      return
+    }
+    const payload = await response.json()
+    const version = typeof payload?.version === 'number' ? payload.version : null
+    if (version === null) {
+      return
+    }
+    if (state.graphVersion === null) {
+      state.graphVersion = version
+      return
+    }
+    if (version !== state.graphVersion) {
+      state.graphVersion = version
+      await loadContexts().catch((error) => console.error(error))
+      scheduleChunkFetch()
+    }
+  } catch (error) {
+    // Transient poll failures (offline, redeploy) are non-fatal; the next tick retries.
+  }
+}
+
+const startLiveRefresh = () => {
+  if (typeof fetch !== 'function') {
+    return
+  }
+  pollGraphVersion().catch(() => {})
+  setInterval(() => {
+    pollGraphVersion().catch(() => {})
+  }, liveRefreshIntervalMs)
+}
+`;

package/dist/application/frontend/client/worker-bootstrap.js

@@ -211,6 +211,8 @@ const bootstrap = async () => {
   updateTotals()
 
   scheduleChunkFetch({ fit: true })
+  startLiveRefresh()
+  startAccountMenu()
 }
 
 bootstrap().catch((error) => {

package/dist/application/frontend/client-js.js

@@ -8,6 +8,8 @@ import { createChunkFetchJs } from './client/chunk-fetch.js';
 import { createInputJs } from './client/input.js';
 import { createUploadJs } from './client/upload.js';
 import { createControlsJs } from './client/controls.js';
+import { createLiveRefreshJs } from './client/live-refresh.js';
+import { createAccountMenuJs } from './client/account-menu.js';
 import { createGraphRendererJs } from './client/graph-renderer.js';
 import { createWorkerBootstrapJs } from './client/worker-bootstrap.js';
 export const createClientJs = () => [
@@ -21,6 +23,8 @@ export const createClientJs = () => [
     createInputJs(),
     createUploadJs(),
     createControlsJs(),
+    createLiveRefreshJs(),
+    createAccountMenuJs(),
     createGraphRendererJs(),
     createWorkerBootstrapJs()
 ].join('');

package/dist/application/frontend/settings-page.js

@@ -0,0 +1,322 @@
+// Self-contained branded Settings page for the graph web server. Served as a
+// plain string (inline <style> + inline <script>, no external assets, no
+// framework) so it works identically for a global npm install. The visual
+// identity mirrors the auth pages (see login-page.ts / oauth-authorize-page.ts):
+// dark theme on #08131d, the same grid/radial gradient, Crowquill Mono with a
+// monospace fallback, and the #5aa8ff accent used for graph nodes.
+const settingsStyles = () => `:root {
+  color-scheme: dark;
+  --bg: #08131d;
+  --panel: #0d1823;
+  --panel-strong: #112130;
+  --line: rgba(143, 172, 204, 0.18);
+  --text: #edf4ff;
+  --muted: #97a9bd;
+  --accent: #5aa8ff;
+  --accent-weak: rgba(90, 168, 255, 0.18);
+  --danger: #ff6b6b;
+  --success: #57d9a3;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  width: 100%;
+  min-height: 100%;
+  margin: 0;
+}
+
+body {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 100vh;
+  min-height: 100dvh;
+  padding: 24px;
+  color: var(--text);
+  font-family: "Crowquill Mono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace;
+  background:
+    linear-gradient(rgba(164, 197, 230, 0.05) 1px, transparent 1px),
+    linear-gradient(90deg, rgba(164, 197, 230, 0.05) 1px, transparent 1px),
+    radial-gradient(circle at top, rgba(43, 93, 143, 0.22), transparent 44%),
+    #08131d;
+  background-size: 28px 28px, 28px 28px, auto;
+}
+
+button,
+input,
+select {
+  font: inherit;
+}
+
+.settings-card {
+  width: 100%;
+  max-width: 440px;
+  padding: 32px 28px;
+  border: 1px solid var(--line);
+  border-radius: 14px;
+  background: rgba(13, 24, 35, 0.92);
+  box-shadow: 0 24px 80px rgba(1, 6, 13, 0.48);
+  backdrop-filter: blur(8px);
+}
+
+.settings-brand {
+  display: grid;
+  gap: 4px;
+  margin-bottom: 24px;
+}
+
+.settings-brand strong {
+  font-size: 26px;
+  letter-spacing: 0.01em;
+}
+
+.settings-brand span {
+  color: var(--muted);
+  font-size: 13px;
+}
+
+.settings-form {
+  display: grid;
+  gap: 16px;
+}
+
+.settings-field {
+  display: grid;
+  gap: 7px;
+}
+
+.settings-field label {
+  color: var(--muted);
+  font-size: 12px;
+  letter-spacing: 0.02em;
+}
+
+.settings-field input,
+.settings-field select {
+  width: 100%;
+  height: 42px;
+  padding: 0 14px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  outline: none;
+  background: rgba(12, 24, 36, 0.94);
+  color: var(--text);
+}
+
+.settings-field input:focus,
+.settings-field select:focus {
+  border-color: var(--accent);
+}
+
+.settings-check {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.settings-check input {
+  width: 18px;
+  height: 18px;
+  margin: 0;
+  accent-color: var(--accent);
+}
+
+.settings-check label {
+  color: var(--text);
+  font-size: 13px;
+  letter-spacing: 0;
+}
+
+.settings-submit {
+  height: 44px;
+  margin-top: 4px;
+  border: 1px solid var(--accent);
+  border-radius: 8px;
+  background: var(--accent-weak);
+  color: var(--text);
+  cursor: pointer;
+  transition: background 120ms ease, opacity 120ms ease;
+}
+
+.settings-submit:hover:not(:disabled),
+.settings-submit:focus:not(:disabled) {
+  background: rgba(90, 168, 255, 0.3);
+}
+
+.settings-submit:disabled {
+  cursor: progress;
+  opacity: 0.6;
+}
+
+.settings-message {
+  min-height: 18px;
+  margin: 0;
+  font-size: 12px;
+  line-height: 1.4;
+  overflow-wrap: anywhere;
+}
+
+.settings-message[hidden] {
+  display: none;
+}
+
+.settings-message.is-error {
+  color: var(--danger);
+}
+
+.settings-message.is-success {
+  color: var(--success);
+}
+
+.settings-back {
+  display: inline-block;
+  margin-top: 20px;
+  color: var(--muted);
+  font-size: 12px;
+  text-decoration: none;
+}
+
+.settings-back:hover,
+.settings-back:focus {
+  color: var(--accent);
+}`;
+const settingsScript = () => `(function () {
+  var form = document.getElementById('settingsForm');
+  var button = document.getElementById('submit');
+  var message = document.getElementById('message');
+  var searchMode = document.getElementById('defaultSearchMode');
+  var contextStrategy = document.getElementById('defaultContextStrategy');
+  var contextTokens = document.getElementById('defaultContextTokens');
+  var autoVersion = document.getElementById('autoVersion');
+  var defaultAgent = document.getElementById('defaultAgent');
+
+  function show(text, kind) {
+    message.textContent = text;
+    message.className = 'settings-message ' + (kind === 'success' ? 'is-success' : 'is-error');
+    message.hidden = false;
+  }
+
+  function clearMessage() {
+    message.textContent = '';
+    message.className = 'settings-message';
+    message.hidden = true;
+  }
+
+  function setValue(select, value) {
+    if (typeof value === 'string' && value.length > 0) {
+      select.value = value;
+    }
+  }
+
+  fetch('/api/settings', { headers: { accept: 'application/json' } })
+    .then(function (response) {
+      if (!response.ok) {
+        return {};
+      }
+      return response.json().catch(function () {
+        return {};
+      });
+    })
+    .then(function (data) {
+      data = data || {};
+      setValue(searchMode, data.defaultSearchMode);
+      setValue(contextStrategy, data.defaultContextStrategy);
+      if (typeof data.defaultContextTokens === 'number') {
+        contextTokens.value = String(data.defaultContextTokens);
+      }
+      autoVersion.checked = data.autoVersion === true;
+      if (typeof data.defaultAgent === 'string') {
+        defaultAgent.value = data.defaultAgent;
+      }
+    })
+    .catch(function () {
+      // A failed prefetch leaves the defaults in place; the form is still usable.
+    });
+
+  form.addEventListener('submit', function (event) {
+    event.preventDefault();
+    clearMessage();
+    button.disabled = true;
+
+    var payload = {
+      defaultSearchMode: searchMode.value,
+      defaultContextStrategy: contextStrategy.value,
+      defaultContextTokens: Number(contextTokens.value),
+      autoVersion: autoVersion.checked,
+      defaultAgent: defaultAgent.value
+    };
+
+    fetch('/api/settings', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(payload)
+    })
+      .then(function (response) {
+        if (response.ok) {
+          show('Saved', 'success');
+        } else {
+          show('Unable to save settings. Please try again.', 'error');
+        }
+        button.disabled = false;
+      })
+      .catch(function () {
+        show('Something went wrong. Please try again.', 'error');
+        button.disabled = false;
+      });
+  });
+})();`;
+export const createSettingsPageHtml = () => `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Settings · Brainlink</title>
+    <style>${settingsStyles()}</style>
+  </head>
+  <body>
+    <main class="settings-card">
+      <div class="settings-brand">
+        <strong>Brainlink</strong>
+        <span>Settings</span>
+      </div>
+      <form id="settingsForm" class="settings-form" novalidate>
+        <div class="settings-field">
+          <label for="defaultSearchMode">Default search mode</label>
+          <select id="defaultSearchMode" name="defaultSearchMode">
+            <option value="fts">fts</option>
+            <option value="semantic">semantic</option>
+            <option value="hybrid">hybrid</option>
+          </select>
+        </div>
+        <div class="settings-field">
+          <label for="defaultContextStrategy">Default context strategy</label>
+          <select id="defaultContextStrategy" name="defaultContextStrategy">
+            <option value="rag">rag</option>
+            <option value="cag">cag</option>
+            <option value="auto">auto</option>
+          </select>
+        </div>
+        <div class="settings-field">
+          <label for="defaultContextTokens">Default context tokens</label>
+          <input id="defaultContextTokens" name="defaultContextTokens" type="number" min="1" />
+        </div>
+        <div class="settings-check">
+          <input id="autoVersion" name="autoVersion" type="checkbox" />
+          <label for="autoVersion">Auto-version vault</label>
+        </div>
+        <div class="settings-field">
+          <label for="defaultAgent">Default agent</label>
+          <input id="defaultAgent" name="defaultAgent" type="text" autocomplete="off" />
+        </div>
+        <p id="message" class="settings-message" role="alert" aria-live="polite" hidden></p>
+        <button id="submit" class="settings-submit" type="submit">Save</button>
+      </form>
+      <a class="settings-back" href="/">&larr; Back</a>
+    </main>
+    <script>${settingsScript()}</script>
+  </body>
+</html>`;

package/dist/application/server/graph-version.js

@@ -0,0 +1,11 @@
+// Monotonic generation counter for the graph. The vault watcher bumps it after
+// every reindex, and the web client polls /api/graph-version to know when to
+// re-fetch — so nodes and contexts written by an agent (via MCP) surface live
+// in an open graph without a manual reload. Process-local by design: a restart
+// resets it, which the client simply treats as one more change.
+let version = 0;
+export const bumpGraphVersion = () => {
+    version += 1;
+    return version;
+};
+export const getGraphVersion = () => version;

package/dist/application/server/routes.js

@@ -24,6 +24,9 @@ import { createClientWorkerJs } from '../frontend/client-worker-js.js';
 import { createClientRenderWorkerJs } from '../frontend/client-render-worker-js.js';
 import { createLoginPageHtml, createChangePasswordPageHtml } from '../frontend/login-page.js';
 import { buildClearSessionCookie, buildSessionSetCookie, changeWebPassword, createSessionToken, parseCookies, resolveWebAuth, SESSION_COOKIE_NAME, verifySessionToken, verifyWebPassword } from './web-auth.js';
+import { getGraphVersion } from './graph-version.js';
+import { readAuthStatus, readEditableSettings, updateEditableSettings } from './settings-store.js';
+import { createSettingsPageHtml } from '../frontend/settings-page.js';
 import { contentTypes, createJsonResponse, isReadMethod, parsePositiveInteger } from './http.js';
 import { parseMultipartForm } from './multipart.js';
 const readRuntimeDefaults = async (url) => {
@@ -519,6 +522,28 @@ export const route = async (request, url, vaultPath, options = {}) => {
     if (isReadMethod(request) && url.pathname === '/api/agents') {
         return createResponse(createJsonResponse({ agents: await listAgents(vaultPath) }), 200, contentTypes['.json']);
     }
+    // Cheap generation counter the client polls to auto-refresh when the vault
+    // changes (new nodes/contexts written via MCP surface live).
+    if (isReadMethod(request) && url.pathname === '/api/graph-version') {
+        return createResponse(createJsonResponse({ version: getGraphVersion() }), 200, contentTypes['.json']);
+    }
+    // Account: whether the exposed-mode login is active (drives the graph's
+    // account menu) plus the settings the hosted account can edit.
+    if (isReadMethod(request) && url.pathname === '/api/auth-status') {
+        const user = options.requireAuth ? (await resolveWebAuth())?.user ?? null : null;
+        return createResponse(createJsonResponse(await readAuthStatus(options.requireAuth === true, user)), 200, contentTypes['.json']);
+    }
+    if (isReadMethod(request) && url.pathname === '/api/settings') {
+        return createResponse(createJsonResponse(await readEditableSettings()), 200, contentTypes['.json']);
+    }
+    if (request.method === 'POST' && url.pathname === '/api/settings') {
+        const body = await readJsonBody(request);
+        const updated = await updateEditableSettings((body ?? {}));
+        return createResponse(createJsonResponse(updated), 200, contentTypes['.json']);
+    }
+    if (isReadMethod(request) && url.pathname === '/settings') {
+        return createResponse(createSettingsPageHtml(), 200, contentTypes['.html']);
+    }
     if (isReadMethod(request) && url.pathname === '/api/graph-contexts') {
         return createResponse(createJsonResponse({ contexts: await getGraphContexts(vaultPath, readAgentQuery(url)) }), 200, contentTypes['.json']);
     }

package/dist/application/server/settings-store.js

@@ -0,0 +1,51 @@
+import { readFile } from 'node:fs/promises';
+import { getGlobalConfigPath, loadBrainlinkConfig, sanitizeContextStrategy, sanitizeSearchMode, writeRawConfig } from '../../infrastructure/config.js';
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const readRawGlobalConfig = async () => {
+    try {
+        const raw = await readFile(getGlobalConfigPath(), 'utf8');
+        const parsed = JSON.parse(raw);
+        return isRecord(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+};
+const searchModes = new Set(['fts', 'semantic', 'hybrid']);
+const contextStrategies = new Set(['rag', 'cag', 'auto']);
+const buildSanitizedPatch = (patch) => ({
+    ...(typeof patch.defaultSearchMode === 'string' && searchModes.has(patch.defaultSearchMode)
+        ? { defaultSearchMode: sanitizeSearchMode(patch.defaultSearchMode) }
+        : {}),
+    ...(typeof patch.defaultContextStrategy === 'string' && contextStrategies.has(patch.defaultContextStrategy)
+        ? { defaultContextStrategy: sanitizeContextStrategy(patch.defaultContextStrategy) }
+        : {}),
+    ...(typeof patch.defaultContextTokens === 'number' &&
+        Number.isFinite(patch.defaultContextTokens) &&
+        patch.defaultContextTokens > 0
+        ? { defaultContextTokens: Math.floor(patch.defaultContextTokens) }
+        : {}),
+    ...(typeof patch.autoVersion === 'boolean' ? { autoVersion: patch.autoVersion } : {}),
+    ...(typeof patch.defaultAgent === 'string' && patch.defaultAgent.trim().length > 0
+        ? { defaultAgent: patch.defaultAgent.trim() }
+        : {})
+});
+const projectEditableSettings = (config) => ({
+    defaultSearchMode: config.defaultSearchMode,
+    defaultContextStrategy: config.defaultContextStrategy,
+    defaultContextTokens: config.defaultContextTokens,
+    autoVersion: config.autoVersion,
+    defaultAgent: config.defaultAgent ?? ''
+});
+export const readEditableSettings = async () => projectEditableSettings(await loadBrainlinkConfig());
+export const updateEditableSettings = async (patch) => {
+    const sanitizedPatch = buildSanitizedPatch(patch);
+    const rawConfig = await readRawGlobalConfig();
+    const merged = { ...rawConfig, ...sanitizedPatch };
+    await writeRawConfig('global', merged);
+    return readEditableSettings();
+};
+export const readAuthStatus = async (requireAuth, user) => ({
+    enabled: requireAuth,
+    user
+});

package/dist/application/start-server.js

@@ -2,6 +2,7 @@ import { createServer } from 'node:http';
 import { brotliCompressSync, constants, gzipSync } from 'node:zlib';
 import { indexVault } from './index-vault.js';
 import { startVaultWatcher } from './watch-vault.js';
+import { bumpGraphVersion } from './server/graph-version.js';
 import { assertLoopbackHost } from './server/host-security.js';
 import { contentTypes, createJsonResponse, isHttpError } from './server/http.js';
 import { route } from './server/routes.js';
@@ -82,10 +83,16 @@ export const startServer = async (input) => {
     }
     if (input.shouldIndex) {
         await indexVault(input.vaultPath);
+        bumpGraphVersion();
     }
     const watcher = input.shouldWatch
         ? startVaultWatcher({
             vaultPath: input.vaultPath,
+            // Signal the web client (via /api/graph-version) that the graph changed
+            // so it can re-fetch and surface new nodes/contexts live.
+            onIndex: () => {
+                bumpGraphVersion();
+            },
             onError: (error) => console.error(error)
         })
         : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andespindola/brainlink",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "description": "Local-first knowledge memory for agents with Markdown, backlinks, indexing and context retrieval.",
   "type": "module",
   "license": "MIT",