@bcmyguest/openmem 0.0.0-stage → 0.8.0

package/scripts/check-pack.mjs

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+/**
+ * Pack-content gate: what `npm publish` would ship must contain the runtime files and
+ * nothing machine-specific. Used by CI (`npm run pack:check`) and by test_cli_package.mjs.
+ *
+ *   node scripts/check-pack.mjs                 inspect `npm pack --dry-run`
+ *   node scripts/check-pack.mjs --tarball X.tgz inspect a packed tarball (extracted to a tmp dir)
+ *   node scripts/check-pack.mjs --json          machine-readable result
+ *
+ * Exit 1 when any problem is found. Leak findings are reported, never silently allowed;
+ * the only allowlist is ALLOWED_PATH_MENTIONS below.
+ */
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { listShippedFiles } from "../cli/stack.mjs";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+/** Files the installed package cannot run without. */
+export const REQUIRED = [
+  "package.json",
+  "README.md",
+  "cli/openmem.mjs",
+  "cli/notebooklm-mcp.mjs",
+  "cli/cognee-mcp.mjs",
+  "cli/mem0-mcp.mjs",
+  "cli/install-memory-mcp.mjs",
+  "cli/switch-memory-provider.mjs",
+  "cli/stack.mjs",
+  "cli/roots.mjs",
+  ".agents/skills/openmem/SKILL.md",
+  "wizard/bin/setup.mjs",
+  "wizard/bin/pm.mjs",
+  "wizard/lib/run-wizard.mjs",
+  "wizard/lib/parse-args.mjs",
+  "providers/hindsight/manifest.json",
+  "providers/hindsight/wizard.mjs",
+  "compose.yaml",
+  "compose.bench.yaml",
+  "indexer/Dockerfile",
+  "indexer/watch.py",
+  "bin/hindsight-project-index",
+  "sync/Dockerfile",
+  "config/index.yml",
+  "config/notebooklm.yml",
+  "config/hindsight.env.example",
+  "config/litellm.lemond.yaml",
+  "config/openmem.toml.example",
+  "scripts/setup.mjs",
+  "scripts/gen-masks.mjs",
+];
+
+/** Paths that must never be packed. Tested against the posix path inside the package. */
+export const FORBIDDEN = [
+  [/(^|\/)\.env$/, ".env"],
+  [/(^|\/)\.env\.(?!example$)/, ".env.*"],
+  [/(^|\/)machine\.env$/, "machine.env"],
+  [/(^|\/)hindsight\.env$/, "hindsight.env"],
+  [/(^|\/)litellm\.env$/, "litellm.env"],
+  [/(^|\/)compose\.override\.ya?ml$/, "compose.override.yaml"],
+  [/(^|\/)\.build-hash$/, ".build-hash"],
+  [/(^|\/)\.pm-stack-manifest\.json$/, "stack manifest"],
+  [/\.pyc$/, "*.pyc"],
+  [/(^|\/)__pycache__(\/|$)/, "__pycache__"],
+  [/(^|\/)node_modules(\/|$)/, "node_modules"],
+  [/(^|\/)\.codegraph(\/|$)/, ".codegraph"],
+  [/(^|\/)\.git(\/|$)/, ".git"],
+  [/(^|\/)\.agents\/(?!skills\/openmem\/)/, ".agents except openmem skill"],
+  [/^site(\/|$)/, "site/"],
+  [/ROADMAP/, "ROADMAP*"],
+  [/WAVE2/, "WAVE2*"],
+  [/\.(tgz|tar|log)$/, "archives/logs"],
+];
+
+/**
+ * Operator path markers. Container-internal home of the Hindsight image is not a leak.
+ */
+const LEAK_RE = /\/(?:home|Users)\/[A-Za-z0-9._-]*/g;
+export const ALLOWED_PATH_MENTIONS = [/^\/home\/hindsight$/];
+
+/**
+ * @param {string} cwd
+ * @param {string[]} args
+ */
+function npm(cwd, args) {
+  const r = spawnSync("npm", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  if (r.status !== 0) throw new Error(`npm ${args.join(" ")} failed: ${r.stderr || r.stdout}`);
+  return r.stdout;
+}
+
+/**
+ * @param {string} root
+ * @returns {{ files: string[], dir: string, cleanup: () => void }}
+ */
+function listFromDryRun(root) {
+  const out = npm(root, ["pack", "--dry-run", "--json", "--ignore-scripts"]);
+  const j = JSON.parse(out);
+  return { files: j[0].files.map((/** @type {{path: string}} */ f) => f.path), dir: root, cleanup() {} };
+}
+
+/**
+ * @param {string} tgz
+ * @returns {{ files: string[], dir: string, cleanup: () => void }}
+ */
+function listFromTarball(tgz) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "pm-pack-"));
+  const r = spawnSync("tar", ["-xzf", path.resolve(tgz), "-C", tmp], { encoding: "utf8" });
+  if (r.status !== 0) throw new Error(`tar failed: ${r.stderr}`);
+  const dir = path.join(tmp, "package");
+  /** @type {string[]} */
+  const files = [];
+  const walk = (/** @type {string} */ rel) => {
+    for (const e of fs.readdirSync(path.join(dir, rel), { withFileTypes: true })) {
+      const child = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) walk(child);
+      else files.push(child);
+    }
+  };
+  walk("");
+  return { files: files.sort(), dir, cleanup: () => fs.rmSync(tmp, { recursive: true, force: true }) };
+}
+
+/** @param {Buffer} buf */
+function isText(buf) {
+  return !buf.subarray(0, 8000).includes(0);
+}
+
+/**
+ * @typedef {{ ok: boolean, count: number, topLevel: Record<string, number>, problems: string[], files: string[] }} PackResult
+ */
+
+/**
+ * Check a list of packed files against the gate.
+ *
+ * @param {{ files: string[], dir: string, license?: string, root?: string }} input
+ * @returns {PackResult}
+ */
+export function evaluatePack({ files, dir, license, root = ROOT }) {
+  /** @type {string[]} */
+  const problems = [];
+  const set = new Set(files);
+
+  for (const req of REQUIRED) {
+    if (!set.has(req)) problems.push(`missing required file: ${req}`);
+  }
+  if (license && license !== "UNLICENSED" && !set.has("LICENSE")) {
+    problems.push(`package.json license is ${license} but LICENSE is not packed`);
+  }
+  // Everything the stack materializer copies must be in the package.
+  for (const rel of listShippedFiles(root)) {
+    if (!set.has(rel)) problems.push(`stack asset is not packed (update package.json "files"): ${rel}`);
+  }
+  for (const f of files) {
+    for (const [re, label] of FORBIDDEN) {
+      if (re.test(f)) problems.push(`forbidden file packed (${label}): ${f}`);
+    }
+  }
+  for (const f of files) {
+    const abs = path.join(dir, f);
+    let buf;
+    try {
+      buf = fs.readFileSync(abs);
+    } catch {
+      problems.push(`cannot read packed file: ${f}`);
+      continue;
+    }
+    if (!isText(buf)) continue;
+    const lines = buf.toString("utf8").split("\n");
+    lines.forEach((line, i) => {
+      for (const m of line.matchAll(LEAK_RE)) {
+        if (ALLOWED_PATH_MENTIONS.some((re) => re.test(m[0]))) continue;
+        problems.push(`machine path "${m[0]}" in ${f}:${i + 1}`);
+      }
+    });
+  }
+
+  /** @type {Record<string, number>} */
+  const topLevel = {};
+  for (const f of files) {
+    const top = f.includes("/") ? `${f.split("/")[0]}/` : f;
+    topLevel[top] = (topLevel[top] || 0) + 1;
+  }
+  return { ok: problems.length === 0, count: files.length, topLevel, problems, files };
+}
+
+/**
+ * @param {{ root?: string, tarball?: string }} [opts]
+ * @returns {PackResult}
+ */
+export function checkPack({ root = ROOT, tarball } = {}) {
+  const listing = tarball ? listFromTarball(tarball) : listFromDryRun(root);
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+    return evaluatePack({ files: listing.files, dir: listing.dir, license: pkg.license, root });
+  } finally {
+    listing.cleanup();
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const argv = process.argv.slice(2);
+  const ti = argv.indexOf("--tarball");
+  const tarball = ti >= 0 ? argv[ti + 1] : undefined;
+  const result = checkPack({ tarball });
+  if (argv.includes("--json")) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    const dirs = Object.entries(result.topLevel)
+      .map(([k, v]) => `${k} ${v}`)
+      .join(", ");
+    console.log(`pack: ${result.count} files (${dirs})`);
+    for (const p of result.problems) console.log(`FAIL  ${p}`);
+    if (result.ok) console.log("pack check passed");
+  }
+  process.exit(result.ok ? 0 : 1);
+}

package/scripts/gen-masks.mjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+// compose.override.yaml belongs to the mutable stack root (PM_STACK_ROOT), not the code root.
+const repo = path.resolve(
+  process.env.PM_STACK_ROOT || path.join(path.dirname(fileURLToPath(import.meta.url)), ".."),
+);
+const home = process.env.HOME || os.homedir();
+const out = path.join(repo, "compose.override.yaml");
+
+const dirs = [
+  ".ssh",
+  ".gnupg",
+  ".config/hindsight",
+  // Provider env files with API keys (mem0.env, ...). The indexer never reads it.
+  ".config/personal-memory",
+  ".config/notebooklm",
+  ".notebooklm",
+  ".aws",
+  ".config/gcloud",
+  ".config/gh",
+  ".config/glab-cli",
+  ".kube",
+  ".docker",
+  ".mozilla",
+  ".config/google-chrome",
+  ".config/chromium",
+  ".password-store",
+  ".local/share/keyrings",
+  ".config/fnox",
+  ".local/share/fnox",
+  ".secrets",
+];
+const files = [
+  ".codex/auth.json",
+  ".claude/.credentials.json",
+  ".claude.json",
+  ".netrc",
+  ".git-credentials",
+  ".npmrc",
+  ".pypirc",
+];
+
+const tmpfsLines = [];
+for (const d of dirs) {
+  if (fs.existsSync(path.join(home, d)) && fs.statSync(path.join(home, d)).isDirectory()) {
+    tmpfsLines.push(`      - "${path.join(home, d)}"`);
+  }
+}
+const volumeLines = [];
+for (const f of files) {
+  if (fs.existsSync(path.join(home, f)) && fs.statSync(path.join(home, f)).isFile()) {
+    volumeLines.push(`      - "/dev/null:${path.join(home, f)}:ro"`);
+  }
+}
+const userIndex = path.join(home, ".config/hindsight/index.yml");
+const envLines = [];
+if (fs.existsSync(userIndex)) {
+  volumeLines.push(`      - "${userIndex}:/etc/hindsight/index.yml:ro"`);
+  envLines.push("      HINDSIGHT_INDEX_CONFIG: /etc/hindsight/index.yml");
+}
+
+const parts = [
+  "# Generated by scripts/gen-masks.mjs for this host. Do not commit.",
+  "services:",
+  "  indexer:",
+];
+if (tmpfsLines.length) {
+  parts.push("    tmpfs:", ...tmpfsLines);
+}
+if (volumeLines.length) {
+  parts.push("    volumes:", ...volumeLines);
+}
+if (envLines.length) {
+  parts.push("    environment:", ...envLines);
+}
+parts.push("");
+
+fs.writeFileSync(out, parts.join("\n"));
+console.log(`wrote ${out}`);

package/scripts/gen-masks.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec node "${SCRIPT_DIR}/gen-masks.mjs"

package/scripts/promotion-provider-smoke.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * Promotion bar for experimental → supported: run contract tests; optional live Docker stacks.
+ * CI runs the Node tests only. Maintainers: MEM0_PROMOTION=1 COGNEE_PROMOTION=1 with stacks up.
+ */
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const tests = [
+  "scripts/tests/test_memory_facade.mjs",
+  "scripts/tests/test_memory_portability.mjs",
+  "scripts/tests/test_compose_profiles.mjs",
+  "scripts/tests/test_coding_agents.mjs",
+  "scripts/tests/test_wiring_report.mjs",
+  "scripts/tests/test_install_coding_agent.mjs",
+  "scripts/tests/test_session_shim.mjs",
+];
+
+let failed = 0;
+for (const t of tests) {
+  const r = spawnSync(process.execPath, [path.join(root, t)], { stdio: "inherit" });
+  if (r.status !== 0) failed++;
+}
+
+if (process.env.MEM0_PROMOTION === "1") {
+  console.log("MEM0_PROMOTION=1: run live mem0 stack + wizard smoke manually (see providers/mem0/OPERATOR.md)");
+}
+if (process.env.COGNEE_PROMOTION === "1") {
+  console.log("COGNEE_PROMOTION=1: run live Cognee cognify+search manually (see docs/cognee.md)");
+}
+
+process.exit(failed ? 1 : 0);

package/scripts/run-setup.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Non-interactive checkout bootstrap (CI, remote shells without a TTY).
+# Prefer: npx openmem  or  cd checkout && npx . setup
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${REPO}"
+
+npm install --no-fund --no-audit
+
+if [ -f "${HOME}/.config/hindsight/wizard.conf" ]; then
+  exec npx . setup --yes --no-smoke "$@"
+fi
+
+if [ -t 0 ] && [ -t 1 ]; then
+  exec npx . setup --no-smoke "$@"
+fi
+
+cat <<EOF
+openmem checkout: ${REPO}
+
+Run the wizard on a terminal (Docker, provider, indexing):
+
+  cd ${REPO}
+  mkdir -p ~/.config/personal-memory
+  cp config/openmem.toml.example ~/.config/personal-memory/config.toml
+  npx . setup
+
+Or from npm (no clone): npx openmem
+EOF
+exit 0

package/scripts/setup.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+/**
+ * Write the stack .env (HOST_UID, HOST_GID and provider entries) and compose.override.yaml.
+ *
+ * PM_STACK_ROOT (default: this checkout) is the mutable stack directory; the provider
+ * comes from MEMORY_PROVIDER (default: hindsight) and is loaded from the read-only code
+ * root (PM_PACKAGE_ROOT, else this checkout). A provider contributes through optional
+ * exports of providers/<id>/wizard.mjs:
+ *   prepareStackEnv({ repo, home, env }) -> { entries, drop, report }
+ *   migrateEnv({ repo, home, env })      (for --migrate-env)
+ *   setupNotices({ repo, home, env })    -> string[]
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import {
+  DEFAULT_PROVIDER_ID,
+  loadManifest,
+} from "../wizard/lib/providers/registry.mjs";
+import { wizardModulePath } from "../wizard/lib/provider-wizard/run-steps.mjs";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(process.env.PM_PACKAGE_ROOT || path.join(scriptDir, ".."));
+const repo = path.resolve(process.env.PM_STACK_ROOT || packageRoot);
+const home = process.env.HOME || os.homedir();
+const envFile = path.join(repo, ".env");
+const tmp = `${envFile}.tmp`;
+const migrate = process.argv.includes("--migrate-env");
+process.env.PM_PACKAGE_ROOT = packageRoot;
+
+const providerId = process.env.MEMORY_PROVIDER || DEFAULT_PROVIDER_ID;
+const manifest = loadManifest(providerId);
+if (!manifest) {
+  console.error(`unknown memory provider '${providerId}' (see providers/*/manifest.json)`);
+  process.exit(1);
+}
+const modFile = wizardModulePath(manifest);
+const provider = modFile && fs.existsSync(modFile) ? await import(pathToFileURL(modFile).href) : {};
+const opts = { repo, home, env: process.env };
+
+/** @type {{ entries: [string, string][], drop: string[], report: string[] }} */
+let spec = { entries: [], drop: [], report: [] };
+try {
+  fs.mkdirSync(path.join(home, ".config/hindsight"), { recursive: true, mode: 0o700 });
+  if (typeof provider.prepareStackEnv === "function") {
+    spec = { ...spec, ...(await provider.prepareStackEnv(opts)) };
+  }
+} catch (e) {
+  console.error(/** @type {Error} */ (e).message);
+  process.exit(1);
+}
+
+// Context-proxy settings from config.toml ([context_proxy], [compaction]) for compose; keys the
+// config leaves unset keep any hand-written .env line. Shell env still overrides at `compose up`.
+/** @type {Record<string, string>} */
+let proxyEnv = {};
+try {
+  // Imported here: pm-config needs npm dependencies, and setup.mjs also runs from bare checkouts.
+  const { contextProxyStackEnvFromPmConfig, loadPmConfig } = await import("../wizard/lib/pm-config.mjs");
+  proxyEnv = contextProxyStackEnvFromPmConfig(loadPmConfig(home, repo).merged);
+} catch (e) {
+  console.warn(`skipped context-proxy settings: ${/** @type {Error} */ (e).message}`);
+}
+
+const dropRe = new RegExp(`^(${["HOST_UID", "HOST_GID", ...spec.drop, ...Object.keys(proxyEnv)].join("|")})=`);
+
+const kept = [];
+if (fs.existsSync(envFile)) {
+  for (const line of fs.readFileSync(envFile, "utf8").split("\n")) {
+    if (line && !dropRe.test(line)) kept.push(line);
+  }
+}
+const uid = os.userInfo().uid;
+const gid = os.userInfo().gid;
+kept.push(`HOST_UID=${uid}`, `HOST_GID=${gid}`);
+for (const [key, value] of spec.entries) kept.push(`${key}=${value}`);
+for (const [key, value] of Object.entries(proxyEnv)) kept.push(`${key}=${value}`);
+fs.mkdirSync(repo, { recursive: true });
+fs.writeFileSync(tmp, `${kept.filter(Boolean).join("\n")}\n`, { mode: 0o644 });
+fs.renameSync(tmp, envFile);
+console.log(`wrote ${envFile}: ${[`HOST_UID=${uid}`, `HOST_GID=${gid}`, ...spec.report].join(" ")}`);
+
+const gen = spawnSync(process.execPath, [path.join(scriptDir, "gen-masks.mjs")], {
+  stdio: "inherit",
+  env: { ...process.env, PM_STACK_ROOT: repo },
+});
+if (gen.status !== 0) process.exit(gen.status ?? 1);
+
+if (migrate) {
+  if (typeof provider.migrateEnv !== "function") {
+    console.error(`provider ${providerId} has no --migrate-env step`);
+    process.exit(1);
+  }
+  try {
+    await provider.migrateEnv(opts);
+  } catch (e) {
+    console.error(/** @type {Error} */ (e).message);
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
+if (typeof provider.setupNotices === "function") {
+  for (const line of await provider.setupNotices(opts)) console.log(line);
+}

package/scripts/setup.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Cross-platform wrapper; logic lives in scripts/setup.mjs.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec node "${SCRIPT_DIR}/setup.mjs" "$@"

package/scripts/spin-up.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+# openmem: test pack/install and optional GitHub release (clean subshell).
+set -eu
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+LOG="${RUN_LOG:-/tmp/openmem-spin-$(date +%Y%m%d-%H%M%S).log}"
+
+usage() {
+  cat <<EOF
+Usage: sh scripts/spin-up.sh <target>
+
+  test           npm test (pack + install + coding-agent wiring)
+  release        merge wip/revamp -> main if needed, run Prepare release workflow
+  help
+
+Log: \$RUN_LOG ($LOG)
+EOF
+}
+
+run() {
+  (cd "$ROOT" && "$@") 2>&1 | tee "$LOG"
+  echo "log: $LOG"
+}
+
+target=${1:-help}
+case $target in
+  help|-h|--help) usage; exit 0 ;;
+  test) run npm test ;;
+  release)
+    run git fetch origin main wip/revamp
+    branch=$(git -C "$ROOT" rev-parse --abbrev-ref HEAD)
+    if [ "$branch" != main ]; then
+      git -C "$ROOT" checkout main
+      git -C "$ROOT" pull origin main
+      git -C "$ROOT" merge --no-edit origin/wip/revamp
+      git -C "$ROOT" push origin main
+    fi
+    gh workflow run "Prepare release" --repo bcmyguest/openmem -f dry_run=false
+    echo "Prepare release dispatched; watch: gh run list --repo bcmyguest/openmem --workflow Release"
+    ;;
+  *)
+    echo "unknown: $target" >&2
+    usage >&2
+    exit 2
+    ;;
+esac

package/scripts/wizard.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Deprecated: use ./setup or node wizard/bin/setup.mjs. Kept for scripts that still invoke wizard.sh.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec node "${SCRIPT_DIR}/../wizard/bin/setup.mjs" "$@"

package/server.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.bcmyguest/openmem",
+  "title": "OpenMem",
+  "description": "Memory interface for coding agents \u2014 stable memory_* tools over Hindsight, mem0, or Cognee.",
+  "version": "0.6.4",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@bcmyguest/openmem",
+      "version": "0.6.4",
+      "transport": {
+        "type": "stdio"
+      },
+      "packageArguments": [],
+      "environmentVariables": [
+        {
+          "name": "MEMORY_PROVIDER",
+          "description": "Active backend: hindsight (default), mem0, or cognee",
+          "isRequired": false
+        },
+        {
+          "name": "PM_STACK_ROOT",
+          "description": "OpenMem stack directory (compose project, .env)",
+          "isRequired": false
+        }
+      ]
+    }
+  ],
+  "repository": {
+    "url": "https://github.com/bcmyguest/openmem",
+    "source": "github"
+  }
+}

package/sync/Dockerfile

@@ -0,0 +1,27 @@
+# NotebookLM -> Hindsight sync (opt-in compose profile "notebooklm"). No browser: login runs on the host.
+FROM python:3.12-slim
+
+# Pinned: the unofficial notebooklm-py client changes without notice. google-auth and requests serve the optional
+# enterprise backend only.
+# [markdown] pulls markdownify — sources.get_fulltext(..., output_format="markdown") needs it.
+RUN pip install --no-cache-dir 'notebooklm-py[markdown]==0.8.5' pyyaml==6.0.3 google-auth==2.62.0 requests==2.34.2
+
+COPY sync/notebooklm_sync.py sync/memory_backend.py /opt/notebooklm/
+COPY indexer/sinks/ /opt/indexer/sinks/
+# Shipped default config. The per-machine override is mounted at /etc/notebooklm/override.yml by compose.
+COPY config/notebooklm.yml /opt/config/notebooklm.yml
+RUN chmod 0755 /opt/notebooklm/notebooklm_sync.py
+
+# The compose user is the host's UID/GID, which has no passwd entry here. HOME must be writable and must not be the
+# host's home. The state directory is 0777 so a fresh named volume (which copies the image's mode) is writable.
+RUN mkdir -p /data/state /data/notebooklm /tmp/nlm-home && chmod 0777 /data/state /data/notebooklm /tmp/nlm-home
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONNOUSERSITE=1 \
+    PYTHONPATH=/opt/indexer \
+    HOME=/tmp/nlm-home \
+    NOTEBOOKLM_HOME=/data/notebooklm \
+    NOTEBOOKLM_STATE=/data/state/state.json \
+    HINDSIGHT_URL=http://hindsight:8888 \
+    MEMORY_SINK=hindsight
+
+CMD ["python3", "/opt/notebooklm/notebooklm_sync.py"]