@cerefox/memory 1.12.0 → 1.12.1

package/dist/bin/cerefox.js

@@ -7440,7 +7440,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "1.12.0";
+var PKG_VERSION = "1.12.1";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -26003,7 +26003,7 @@ var init_bundled_docs = __esm(() => {
 });
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.12.0", CEREFOX_VERSION = "1.12.0", EF_LAST_CHANGED = "1.11.0";
+var EF_VERSION = "1.12.1", CEREFOX_VERSION = "1.12.1", EF_LAST_CHANGED = "1.11.0";
 var init_ef_meta = () => {};
 
 // ../../_shared/compatibility/index.ts
@@ -81393,6 +81393,9 @@ function envGitignoreWarning(path) {
   }
 }
 
+// src/web/auth.ts
+import { existsSync as existsSync15 } from "node:fs";
+
 // ../../node_modules/.bun/@hono+node-server@2.0.12+19b9adbcbc3b652f/node_modules/@hono/node-server/dist/conninfo.mjs
 var getConnInfo = (c2) => {
   const bindings = c2.env.server ? c2.env.server : c2.env;
@@ -81454,6 +81457,27 @@ var LOOPBACK_ADDRESSES = new Set([
   "::1",
   "::ffff:127.0.0.1"
 ]);
+function isContainerised() {
+  try {
+    return existsSync15("/.dockerenv");
+  } catch {
+    return false;
+  }
+}
+function containerGateWarning(env4 = process.env) {
+  const hasKey = (env4.CEREFOX_API_KEY ?? "").trim() !== "";
+  const requireAll = (env4.CEREFOX_API_REQUIRE_KEY ?? "") === "1";
+  if (!hasKey || requireAll || !isContainerised())
+    return null;
+  return `
+⚠  CEREFOX_API_KEY is set inside a container without CEREFOX_API_REQUIRE_KEY=1.
+` + `   Docker rewrites the source address of every published-port request, so the
+` + `   loopback exemption cannot match and EVERY caller will get a 401 — including
+` + `   the web UI. In a container the gate must be all-or-nothing:
+` + `     • publishing on 127.0.0.1 → leave CEREFOX_API_KEY unset (the bind is the boundary)
+` + `     • publishing wider        → also set CEREFOX_API_REQUIRE_KEY=1
+`;
+}
 function isLoopbackAddress(address) {
   if (!address)
     return false;
@@ -83159,7 +83183,7 @@ var _baseMimes = {
 var baseMimes = _baseMimes;
 
 // ../../node_modules/.bun/@hono+node-server@2.0.12+19b9adbcbc3b652f/node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, existsSync as existsSync15, statSync as statSync5 } from "node:fs";
+import { createReadStream, existsSync as existsSync16, statSync as statSync5 } from "node:fs";
 import { join as join13 } from "node:path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
@@ -83233,7 +83257,7 @@ var tryDecodeURI = (str) => tryDecode(str, decodeURI);
 var serveStatic = (options = { root: "" }) => {
   const root = options.root || "";
   const optionPath = options.path;
-  if (root !== "" && !existsSync15(root))
+  if (root !== "" && !existsSync16(root))
     console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
   return async (c2, next) => {
     if (c2.finalized)
@@ -83316,7 +83340,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // src/web/server.ts
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 import { readFileSync as readFileSync18 } from "node:fs";
 import { join as join17 } from "node:path";
 
@@ -86580,7 +86604,7 @@ import { execFileSync } from "node:child_process";
 
 // src/web/docs.ts
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   readFileSync as readFileSync16,
   readdirSync as readdirSync6,
   statSync as statSync6
@@ -86613,7 +86637,7 @@ function resolveDocsRoots() {
   let pkgTopLevel = null;
   for (const pkg of pkgRootCandidates) {
     const guides = join14(pkg, "docs", "guides");
-    if (existsSync16(guides) && statSync6(guides).isDirectory()) {
+    if (existsSync17(guides) && statSync6(guides).isDirectory()) {
       pkgGuides = guides;
       pkgTopLevel = pkg;
       break;
@@ -86625,8 +86649,8 @@ function resolveDocsRoots() {
   return {
     pkgGuides,
     pkgTopLevel,
-    repoGuides: existsSync16(repoGuides) ? repoGuides : null,
-    repoTopLevel: existsSync16(join14(repoTopLevel, "README.md")) ? repoTopLevel : null
+    repoGuides: existsSync17(repoGuides) ? repoGuides : null,
+    repoTopLevel: existsSync17(join14(repoTopLevel, "README.md")) ? repoTopLevel : null
   };
 }
 function readH1(filePath) {
@@ -86652,7 +86676,7 @@ function listBundledDocs2() {
   if (topRoot) {
     for (const t of TOP_LEVEL_DOCS) {
       const abs = join14(topRoot, t.filename);
-      if (existsSync16(abs)) {
+      if (existsSync17(abs)) {
         entries.push(entryForFile(abs, t.path, t.category));
       }
     }
@@ -86679,7 +86703,7 @@ function readDoc(docPath) {
   if (!candidate.startsWith(rootResolved + "/") && candidate !== rootResolved) {
     return null;
   }
-  if (existsSync16(candidate) && statSync6(candidate).isFile()) {
+  if (existsSync17(candidate) && statSync6(candidate).isFile()) {
     try {
       return readFileSync16(candidate, "utf8");
     } catch {
@@ -86730,7 +86754,7 @@ function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/schema-version", async (c2) => {
     let bundled = null;
     try {
-      const { readFileSync: readFileSync17, existsSync: existsSync17 } = await import("node:fs");
+      const { readFileSync: readFileSync17, existsSync: existsSync18 } = await import("node:fs");
       const { fileURLToPath: fileURLToPath4 } = await import("node:url");
       const { dirname: dirname7, join: join15 } = await import("node:path");
       const here = dirname7(fileURLToPath4(import.meta.url));
@@ -86739,7 +86763,7 @@ function registerMetaRoutes(app, ctx) {
         join15(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
       ];
       for (const path of candidates) {
-        if (existsSync17(path)) {
+        if (existsSync18(path)) {
           const sql = readFileSync17(path, "utf8");
           const match2 = sql.match(SCHEMA_VERSION_RE3);
           bundled = match2 ? match2[1] : null;
@@ -86836,7 +86860,7 @@ function registerPostgrestProxy(app) {
 
 // src/web/routes/preferences.ts
 init_config();
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join15 } from "node:path";
 function isTheme(v) {
   return v === "auto" || v === "light" || v === "dark";
@@ -86862,7 +86886,7 @@ function registerPreferencesRoutes(app) {
     const next = { ...readPrefs(), theme: body.theme };
     try {
       const dir = userStateDir();
-      if (!existsSync17(dir))
+      if (!existsSync18(dir))
         mkdirSync5(dir, { recursive: true });
       writeFileSync6(prefsFile(), `${JSON.stringify(next, null, 2)}
 `);
@@ -86999,14 +87023,14 @@ function registerProjectsRoutes(app, ctx) {
 }
 
 // src/web/static.ts
-import { existsSync as existsSync18, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync19, statSync as statSync7 } from "node:fs";
 import { dirname as dirname7, join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function moduleDir3() {
   return dirname7(fileURLToPath4(import.meta.url));
 }
 function isUsableSpaDir(dir) {
-  return existsSync18(dir) && statSync7(dir).isDirectory() && existsSync18(join16(dir, "index.html"));
+  return existsSync19(dir) && statSync7(dir).isDirectory() && existsSync19(join16(dir, "index.html"));
 }
 function resolveSpaDist() {
   const here = moduleDir3();
@@ -87028,7 +87052,7 @@ function resolveStaticDir() {
     join16(here, "..", "..", "..", "..", "web", "static")
   ];
   for (const c2 of candidates) {
-    if (existsSync18(c2) && statSync7(c2).isDirectory())
+    if (existsSync19(c2) && statSync7(c2).isDirectory())
       return c2;
   }
   return null;
@@ -87119,7 +87143,7 @@ function buildApp(ctx = buildWebContext()) {
       rewriteRequestPath: (path) => path.replace(/^\/app/, "") || "/"
     }));
     const indexPath = join17(spaDist, "index.html");
-    if (existsSync19(indexPath)) {
+    if (existsSync20(indexPath)) {
       const indexHtml = readFileSync18(indexPath, "utf8");
       app.get("/app/*", (c2) => c2.html(indexHtml));
     }
@@ -87164,6 +87188,9 @@ async function buildWebServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 8000;
   await assertServerCompatible();
+  const containerWarning = containerGateWarning();
+  if (containerWarning)
+    console.warn(containerWarning);
   if (!isLoopbackAddress(host) && !(process.env.CEREFOX_API_KEY ?? "").trim()) {
     console.warn(`
 ⚠  Binding ${host} with NO API key configured.
@@ -87186,7 +87213,7 @@ async function buildWebServer(options = {}) {
 // src/web/daemon.ts
 import { spawn } from "node:child_process";
 import {
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync6,
   openSync,
   readFileSync as readFileSync19,
@@ -87206,11 +87233,11 @@ var PID_FILE = join18(STATE_DIR, "web.pid");
 var LOG_FILE = join18(STATE_DIR, "web.log");
 var daemonPaths = { stateDir: STATE_DIR, pidFile: PID_FILE, logFile: LOG_FILE };
 function ensureStateDir() {
-  if (!existsSync20(STATE_DIR))
+  if (!existsSync21(STATE_DIR))
     mkdirSync6(STATE_DIR, { recursive: true });
 }
 function readPidFile() {
-  if (!existsSync20(PID_FILE))
+  if (!existsSync21(PID_FILE))
     return null;
   try {
     const parsed = JSON.parse(readFileSync19(PID_FILE, "utf8"));
@@ -87607,7 +87634,7 @@ Learn more:
 
 // src/bin/cerefox.ts
 async function bareEntryPoint() {
-  const { existsSync: existsSync21 } = await import("node:fs");
+  const { existsSync: existsSync22 } = await import("node:fs");
   const { resolveEnvFile: resolveEnvFile2 } = await Promise.resolve().then(() => (init_config(), exports_config));
   const { c: c2, println: println2 } = await Promise.resolve().then(() => (init_cli_core(), exports_cli_core));
   const { PKG_VERSION: PKG_VERSION2 } = await Promise.resolve().then(() => (init_meta(), exports_meta));
@@ -87616,7 +87643,7 @@ async function bareEntryPoint() {
   println2("");
   let configExists = false;
   try {
-    configExists = existsSync21(resolveEnvFile2());
+    configExists = existsSync22(resolveEnvFile2());
   } catch {}
   if (!configExists) {
     println2(c2.yellow("⚠ No config detected."));

package/dist/server-assets/_shared/ef-meta/index.ts

@@ -18,7 +18,7 @@
  * doesn't touch `supabase/functions/` leaves it alone).
  */
 
-export const EF_VERSION = "1.12.0";
+export const EF_VERSION = "1.12.1";
 
 /**
  * The Cerefox RELEASE version — what `cerefox --version` reports and what npm
@@ -36,7 +36,7 @@ export const EF_VERSION = "1.12.0";
  * is imported by the Deno Edge Functions, which cannot reach into the npm
  * package.
  */
-export const CEREFOX_VERSION = "1.12.0";
+export const CEREFOX_VERSION = "1.12.1";
 
 /**
  * The most recent version whose EF-side SOURCE actually changed (#127).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cerefox/memory",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "Cerefox — user-owned shared memory for AI agents. CLI + stdio MCP server + web UI + ingestion for a knowledge base on your own Supabase project (or fully self-hosted with Cerefox Local).",
   "license": "Apache-2.0",
   "homepage": "https://github.com/fstamatelopoulos/cerefox",