@cerefox/memory 1.11.0 → 1.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/bin/cerefox.js +792 -174
  2. package/dist/frontend/assets/{index-sef54G6W.js → index-P1F2Ldl9.js} +25 -25
  3. package/dist/frontend/assets/index-P1F2Ldl9.js.map +1 -0
  4. package/dist/frontend/index.html +1 -1
  5. package/dist/server-assets/_shared/ef-meta/index.ts +2 -2
  6. package/docs/guides/access-paths.md +1 -1
  7. package/docs/guides/configuration.md +2 -0
  8. package/package.json +1 -1
  9. package/dist/frontend/assets/index-sef54G6W.js.map +0 -1
package/dist/frontend/index.html CHANGED
@@ -15,7 +15,7 @@
15
15
  href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600;700&display=swap"
16
16
  />
17
17
  <title>Cerefox</title>
18
- <script type="module" crossorigin src="/app/assets/index-sef54G6W.js"></script>
18
+ <script type="module" crossorigin src="/app/assets/index-P1F2Ldl9.js"></script>
19
19
  <link rel="stylesheet" crossorigin href="/app/assets/index-Dm_zCch4.css">
20
20
  </head>
21
21
  <body>
package/dist/server-assets/_shared/ef-meta/index.ts CHANGED
@@ -18,7 +18,7 @@
18
18
  * doesn't touch `supabase/functions/` leaves it alone).
19
19
  */
20
20
 
21
- export const EF_VERSION = "1.11.0";
21
+ export const EF_VERSION = "1.12.0";
22
22
 
23
23
  /**
24
24
  * The Cerefox RELEASE version — what `cerefox --version` reports and what npm
@@ -36,7 +36,7 @@ export const EF_VERSION = "1.11.0";
36
36
  * is imported by the Deno Edge Functions, which cannot reach into the npm
37
37
  * package.
38
38
  */
39
- export const CEREFOX_VERSION = "1.11.0";
39
+ export const CEREFOX_VERSION = "1.12.0";
40
40
 
41
41
  /**
42
42
  * The most recent version whose EF-side SOURCE actually changed (#127).
package/docs/guides/access-paths.md CHANGED
@@ -216,7 +216,7 @@ single container with an internally-held token.
216
216
  | ChatGPT Custom GPT | HTTPS → primitive Edge Functions | Cerefox access token (`cfx_pat_…`) | AI assistant via GPT Actions |
217
217
  | curl / HTTP scripts | HTTPS → primitive Edge Functions | Cerefox access token (`cfx_pat_…`) | Ad-hoc queries, automation |
218
218
  | Web UI (`cerefox web`) | Supabase REST API | Secret key (or legacy service_role) | Web UI backend (TS Hono) |
219
- | **HTTP client → `/api/v1`** | Plain HTTP to `cerefox web` / Cerefox Local | **None** — loopback-bound by default | A local program or bot harness that wants HTTP rather than MCP. Names itself with `X-Cerefox-Author` / `X-Cerefox-Requestor` (v1.11.0): a declared label for attribution, not a verified identity. See [`api.md`](api.md) |
219
+ | **HTTP client → `/api/v1`** | Plain HTTP to `cerefox web` / Cerefox Local | **None from loopback; API key otherwise** (v1.12.0) — `cerefox api-key generate` / `cerefox-local api-key` | A local program or bot harness that wants HTTP rather than MCP. Names itself with `X-Cerefox-Author` / `X-Cerefox-Requestor` (v1.11.0): a declared label for attribution, not a verified identity. See [`api.md`](api.md) |
220
220
  | `cerefox` CLI (human) | Supabase REST API | Secret key (or legacy service_role) | Ingestion, search, reindex, backup |
221
221
  | Local coding agent via `cerefox` CLI | Supabase REST API | Secret key (or legacy service_role) | User-authorised agent (Claude Code, Codex CLI, opencode, OpenClaw, Hermes, …) acting on user's behalf via Bash tool |
222
222
  | `cerefox server deploy` / deployment scripts | Direct TCP | DB password | Schema deploy, data restore |
package/docs/guides/configuration.md CHANGED
@@ -43,6 +43,8 @@ Full rule documented in [`docs/specs/polish-and-distribution-design.md` §7](../
43
43
  | `CEREFOX_ACCESS_TOKENS` | `""` | Server-side (Function secret) | The **server-side accepted set** — a comma-separated list of Cerefox tokens, set as a Supabase **Function secret** (not local `.env`). A request is accepted if its Bearer matches any token in the set, enabling zero-downtime rotation. Managed by `cerefox token generate` / `rotate`. |
44
44
  | `CEREFOX_SUPABASE_ANON_KEY` | `""` | *(deprecated / unused)* | Formerly the legacy anon JWT Bearer for Edge Function calls. **Retired in iter-28E** — Edge Functions now authenticate the Cerefox access token in-function. Retained only so an old `.env` still parses; no longer read. |
45
45
  | `CEREFOX_DATABASE_URL` | `""` | For scripts | Direct Postgres URL for deployment scripts. **Use the Session Pooler** (port `5432`) — Transaction Pooler (`6543`) does not support DDL. Username must include the project-ref suffix (`postgres.<project-ref>`). Append `?sslmode=require`. See [`setup-supabase.md` → Connection pooling (2026)](setup-supabase.md#connection-pooling-2026). |
46
+ | `CEREFOX_API_KEY` | `""` | Local web server (#229) | **Local API key** (`cfx_lak_…`) for `/api/v1` and `/rest/v1` on the machine running `cerefox web`. Callers on **loopback need no credential**; callers arriving on any other interface must send `Authorization: Bearer <key>`. Unset means the gate is off and the server behaves exactly as it did before v1.12.0 — so upgrading never breaks a working install. Minted by `cerefox api-key generate`; Cerefox Local mints its own at first boot (`cerefox-local api-key`). **Never sent to Supabase**; distinct from `CEREFOX_ACCESS_TOKEN`, which is the *cloud* credential for the Edge Functions. |
47
+ | `CEREFOX_API_REQUIRE_KEY` | `""` | Local web server (#229) | Set to `1` to demand the API key from **every** caller, loopback included. The one topology that needs it: a same-host reverse proxy, which reconnects from `127.0.0.1`, so every proxied request would otherwise look local and be exempt. `X-Forwarded-For` is deliberately never consulted to recover the original address — it is caller-supplied, so trusting it would let anyone claim to be local. Has no effect when `CEREFOX_API_KEY` is unset (demanding a key that does not exist would lock you out of your own server). |
46
48
  | `SUPABASE_ACCESS_TOKEN` | *(unset)* | For EF deploys (optional) | Supabase **personal access token** (`sbp_…`, from [supabase.com/dashboard/account/tokens](https://supabase.com/dashboard/account/tokens)), read by the **Supabase CLI** that `cerefox server deploy` shells out to for Edge Function deploys. Optional — without it the CLI falls back to its `supabase login` credential, which on **macOS lives in the Keychain and triggers a password dialog per function deploy** (9 per full deploy; a denied dialog fails that function with `LegacyPlatformAuthRequiredError`). Setting it in `~/.cerefox/.env` avoids the dialogs entirely: Cerefox exports every key from its `.env` to the environment, so the child CLI inherits it. Not a `CEREFOX_` variable — the name is the Supabase CLI's own. **Keep secret** (it grants management access to your Supabase account). |
47
49
 
48
50
  **When each is needed:**
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cerefox/memory",
3
- "version": "1.11.0",
3
+ "version": "1.12.0",
4
4
  "description": "Cerefox — user-owned shared memory for AI agents. CLI + stdio MCP server + web UI + ingestion for a knowledge base on your own Supabase project (or fully self-hosted with Cerefox Local).",
5
5
  "license": "Apache-2.0",
6
6
  "homepage": "https://github.com/fstamatelopoulos/cerefox",