@codemem/server 0.22.0 → 0.22.1

package/dist/request-rate-limit.d.ts

@@ -0,0 +1,8 @@
+export interface InMemoryRequestRateLimiter {
+    check(key: string, limit: number): {
+        allowed: boolean;
+        retryAfterS: number;
+    };
+}
+export declare function createInMemoryRequestRateLimiter(windowMs?: number): InMemoryRequestRateLimiter;
+//# sourceMappingURL=request-rate-limit.d.ts.map

package/dist/request-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-rate-limit.d.ts","sourceRoot":"","sources":["../src/request-rate-limit.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,0BAA0B;IAC1C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,SAAS,GAAG,0BAA0B,CA2C9F"}

package/dist/routes/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAKN,KAAK,eAAe,EAKpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6D5B,MAAM,WAAW,kBAAkB;IAClC,UAAU,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;CAC1C;AAgLD,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,8EAkGzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAKN,KAAK,eAAe,EAKpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6E5B,MAAM,WAAW,kBAAkB;IAClC,UAAU,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;CAC1C;AAmOD,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,8EA6GzD"}

package/dist/routes/stats.d.ts

@@ -3,7 +3,7 @@
  *
  * Ports Python's viewer_routes/stats.py.
  */
-import type { MemoryStore } from "@codemem/core";
+import { type MemoryStore } from "@codemem/core";
 import { Hono } from "hono";
 /**
  * Create stats routes. The store factory is called per-request to get a

package/dist/routes/stats.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/routes/stats.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,WAAW,8EAqHtD"}
+{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/routes/stats.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAW,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,WAAW,8EA2HtD"}

package/dist/routes/sync.d.ts

@@ -3,11 +3,21 @@
  */
 import type { MemoryStore } from "@codemem/core";
 import { Hono } from "hono";
+import type { InMemoryRequestRateLimiter } from "../request-rate-limit.js";
 type StoreFactory = () => MemoryStore;
 type SyncRuntimeStatus = {
     phase: "starting" | "running" | "stopping" | "error" | "disabled" | "rebootstrapping" | "needs_attention" | null;
     detail?: string | null;
 };
+interface SyncProtocolRouteOptions {
+    routeRateLimit?: {
+        limiter: InMemoryRequestRateLimiter;
+        readLimit: number;
+        mutationLimit: number;
+        unauthenticatedReadLimit: number;
+        unauthenticatedMutationLimit: number;
+    };
+}
 /**
  * Peer-to-peer sync protocol routes (/v1/*).
  *
@@ -15,7 +25,7 @@ type SyncRuntimeStatus = {
  * network-accessible. All requests are auth-gated via signature
  * verification so unauthenticated callers are rejected.
  */
-export declare function syncProtocolRoutes(getStore: StoreFactory): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+export declare function syncProtocolRoutes(getStore: StoreFactory, opts?: SyncProtocolRouteOptions): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
 /**
  * Viewer-facing sync management routes (/api/sync/*).
  *

package/dist/routes/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/routes/sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AA2BhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,KAAK,YAAY,GAAG,MAAM,WAAW,CAAC;AACtC,KAAK,iBAAiB,GAAG;IACxB,KAAK,EACF,UAAU,GACV,SAAS,GACT,UAAU,GACV,OAAO,GACP,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,IAAI,CAAC;IACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAkoBF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,8EAwMxD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACzB,QAAQ,EAAE,YAAY,EACtB,oBAAoB,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,8EAyzBrD"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/routes/sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AA2BhE,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAE3E,KAAK,YAAY,GAAG,MAAM,WAAW,CAAC;AACtC,KAAK,iBAAiB,GAAG;IACxB,KAAK,EACF,UAAU,GACV,SAAS,GACT,UAAU,GACV,OAAO,GACP,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,IAAI,CAAC;IACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,UAAU,wBAAwB;IACjC,cAAc,CAAC,EAAE;QAChB,OAAO,EAAE,0BAA0B,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,wBAAwB,EAAE,MAAM,CAAC;QACjC,4BAA4B,EAAE,MAAM,CAAC;KACrC,CAAC;CACF;AA8pBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAE,wBAA6B,8EA+O7F;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACzB,QAAQ,EAAE,YAAY,EACtB,oBAAoB,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,8EAyzBrD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codemem/server",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -18,7 +18,8 @@
     "@hono/node-server": "^1.14.3",
     "drizzle-orm": "^0.45.1",
     "hono": "^4.7.10",
-    "@codemem/core": "^0.22.0"
+    "limiter": "^3.0.0",
+    "@codemem/core": "^0.22.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",

package/static/app.js

@@ -252,6 +252,9 @@
 	async function loadStats() {
 		return fetchJson("/api/stats");
 	}
+	async function loadRuntimeInfo() {
+		return fetchJson("/api/runtime");
+	}
 	async function loadUsage(project) {
 		return fetchJson(`/api/usage?project=${encodeURIComponent(project)}`);
 	}
@@ -2366,6 +2369,10 @@
 		if (peer?.status?.fresh) return "connected";
 		return "waiting";
 	}
+	function isOfflineTeamDevice(device) {
+		if (!device.discovered?.stale) return false;
+		return device.peer ? derivePeerUiStatus(device.peer) !== "connected" : true;
+	}
 	function peerErrorText(peer) {
 		return cleanText(peer?.last_error).toLowerCase();
 	}
@@ -2627,7 +2634,7 @@
 			summary: {
 				connectedDeviceCount: peers.filter((peer) => derivePeerUiStatus(peer) === "connected").length,
 				seenOnTeamCount: discoveredDevices.length,
-				offlineTeamDeviceCount: discoveredDevices.filter((device) => Boolean(device?.stale)).length
+				offlineTeamDeviceCount: mergedDevices.filter((device) => isOfflineTeamDevice(device)).length
 			},
 			duplicatePeople,
 			attentionItems: attentionItems.sort((a, b) => a.priority - b.priority || a.title.localeCompare(b.title))
@@ -4145,11 +4152,6 @@
 	function assignedActorCount(actorId) {
 		return (Array.isArray(state.lastSyncPeers) ? state.lastSyncPeers : []).filter((peer) => String(peer?.actor_id || "") === actorId).length;
 	}
-	function assignmentNote(actorId) {
-		if (!actorId) return "Unassigned devices keep legacy fallback attribution until you choose a person.";
-		if ((Array.isArray(state.lastSyncActors) ? state.lastSyncActors : []).find((item) => String(item?.actor_id || "") === actorId)?.is_local) return "Assigning this device to you keeps it in your identity across your devices, including private sync.";
-		return "This person receives memories from allowed projects by default. Use Only me on a memory when it should stay local.";
-	}
 	function visibleSyncActors() {
 		return deriveVisiblePeopleActors({
 			actors: state.lastSyncActors,
@@ -4763,7 +4765,10 @@
 				children: [/* @__PURE__ */ u("div", {
 					className: "actor-title",
 					children: [
-						/* @__PURE__ */ u("strong", { children: row.displayName }),
+						/* @__PURE__ */ u("strong", {
+							title: row.displayTitle || void 0,
+							children: row.displayName
+						}),
 						/* @__PURE__ */ u("span", {
 							className: `badge actor-badge${row.availabilityLabel === "Offline" ? "" : " local"}`,
 							children: row.availabilityLabel
@@ -9957,7 +9962,12 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 		ensureJoinPanelInSetupSection();
 		const coordinator = state.lastSyncCoordinator;
 		const syncView = state.lastSyncViewModel || {
-			summary: {},
+			summary: {
+				connectedDeviceCount: 0,
+				seenOnTeamCount: 0,
+				offlineTeamDeviceCount: 0
+			},
+			duplicatePeople: [],
 			attentionItems: []
 		};
 		const focusAttentionTarget = (item) => {
@@ -10080,7 +10090,11 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 		const attentionItems = Array.isArray(syncView.attentionItems) ? syncView.attentionItems : [];
 		const discoveredRows = (Array.isArray(coordinator.discovered_devices) ? coordinator.discovered_devices : []).map((device) => {
 			const deviceId = String(device.device_id || "").trim();
-			const displayName = String(device.display_name || "").trim() || deviceId || "Discovered device";
+			const displayName = resolveFriendlyDeviceName({
+				coordinatorName: String(device.display_name || "").trim(),
+				deviceId
+			}) || "Discovered device";
+			const displayTitle = deviceId && displayName !== deviceId ? deviceId : null;
 			const fingerprint = String(device.fingerprint || "").trim();
 			const hasAmbiguousCoordinatorGroup = (Array.isArray(device.groups) ? device.groups.map((value) => String(value || "").trim()).filter(Boolean) : []).length > 1;
 			const pairedPeer = localPeers.find((peer) => String(peer?.peer_device_id || "") === deviceId);
@@ -10092,7 +10106,8 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 			const hasConflict = Boolean(pairedPeer) && Boolean(fingerprint) && Boolean(pairedFingerprint) && pairedFingerprint !== fingerprint;
 			const canAccept = Boolean(deviceId) && Boolean(fingerprint) && !pairedPeer && !device.stale && !hasAmbiguousCoordinatorGroup;
 			const addresses = Array.isArray(device.addresses) ? device.addresses : [];
-			const noteParts = [deviceId, addresses.length ? addresses.map((address) => isSyncRedactionEnabled() ? redactAddress(String(address || "")) : String(address || "")).filter(Boolean).join(" · ") : "No fresh addresses"];
+			const noteParts = [addresses.length ? addresses.map((address) => isSyncRedactionEnabled() ? redactAddress(String(address || "")) : String(address || "")).filter(Boolean).join(" · ") : "No fresh addresses"];
+			if (displayTitle) noteParts.push(`device id: ${deviceId}`);
 			let actionMessage = null;
 			let mode = canAccept ? "accept" : "none";
 			let pairedMessage = null;
@@ -10127,6 +10142,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 				connectionLabel: hasConflict ? SYNC_TERMINOLOGY.conflicts : pairedPeer ? SYNC_TERMINOLOGY.pairedLocally : "Not connected on this device",
 				deviceId,
 				displayName,
+				displayTitle,
 				fingerprint,
 				mode,
 				note: noteParts.join(" · "),
@@ -10544,9 +10560,6 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 	function listText(value) {
 		return Array.isArray(value) ? value.map((item) => String(item || "").trim()).filter(Boolean) : [];
 	}
-	function summaryText(prefix, values, emptyLabel) {
-		return `${prefix}: ${values.join(", ") || emptyLabel}`;
-	}
 	function ExistingElementSlot({ element }) {
 		const hostRef = A$1(null);
 		_(() => {
@@ -10569,9 +10582,9 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 		const scope = peer.project_scope || {};
 		const includeList = listText(scope.include);
 		const excludeList = listText(scope.exclude);
-		const effectiveInclude = listText(scope.effective_include);
-		const effectiveExclude = listText(scope.effective_exclude);
-		const inheritsGlobal = Boolean(scope.inherits_global);
+		listText(scope.effective_include);
+		listText(scope.effective_exclude);
+		Boolean(scope.inherits_global);
 		const primaryAddress = pickPrimaryAddress(peer.addresses);
 		const peerAddresses = Array.isArray(peer.addresses) ? Array.from(new Set(peer.addresses.filter(Boolean).map((value) => String(value)))) : [];
 		const addressLine = peerAddresses.length ? peerAddresses.map((address) => isSyncRedactionEnabled() ? redactAddress(address) : address).join(" · ") : "No addresses";
@@ -10876,18 +10889,6 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 								children: applyActorLabel
 							})]
 						}),
-						/* @__PURE__ */ u("div", {
-							className: "peer-scope-effective",
-							children: assignmentNote(selectedActorId)
-						}),
-						/* @__PURE__ */ u("div", {
-							className: "peer-scope-summary",
-							children: inheritsGlobal ? "Using global sync scope" : `Device override · include: ${includeList.join(", ") || "all"} · exclude: ${excludeList.join(", ") || "none"}`
-						}),
-						/* @__PURE__ */ u("div", {
-							className: "peer-scope-effective",
-							children: `Effective scope · ${summaryText("include", effectiveInclude, "all")} · ${summaryText("exclude", effectiveExclude, "none")}`
-						}),
 						/* @__PURE__ */ u("div", { ref: setScopeHost })
 					]
 				})
@@ -11157,6 +11158,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 	//#region src/tabs/sync/index.ts
 	var lastSyncHash = "";
 	var cachedSyncStatus = null;
+	var latestSyncLoadRequestId = 0;
 	var HEALTH_SYNC_STATUS_CACHE_TTL_MS = 15e3;
 	function syncStatusCacheKey(project) {
 		return `project:${project || ""}|includeJoinRequests:false`;
@@ -11183,20 +11185,22 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 		};
 	}
 	async function loadSyncData() {
+		const requestId = ++latestSyncLoadRequestId;
 		try {
 			const project = state.currentProject || "";
 			const includeJoinRequests = state.activeTab === "sync";
 			const useCache = state.activeTab === "health";
+			let fetchedFreshSyncStatus = false;
 			let payload;
 			if (useCache) {
 				payload = readCachedSyncStatus(project);
 				if (!payload) {
 					payload = await loadSyncStatus(true, project, { includeJoinRequests: false });
-					writeCachedSyncStatus(project, normalizeSyncStatusForCache(payload));
+					fetchedFreshSyncStatus = true;
 				}
 			} else {
 				payload = await loadSyncStatus(true, project, { includeJoinRequests });
-				writeCachedSyncStatus(project, normalizeSyncStatusForCache(payload));
+				fetchedFreshSyncStatus = true;
 			}
 			let actorsPayload = null;
 			let actorLoadError = false;
@@ -11206,6 +11210,8 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 			} catch {
 				actorLoadError = true;
 			}
+			if (requestId !== latestSyncLoadRequestId) return;
+			if (fetchedFreshSyncStatus) writeCachedSyncStatus(project, normalizeSyncStatusForCache(payload));
 			const hash = JSON.stringify([
 				payload,
 				actorsPayload,
@@ -11250,6 +11256,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 				if (actorMeta) actorMeta.textContent = "People controls are temporarily unavailable. Device status and sync health still loaded.";
 			}
 		} catch {
+			if (requestId !== latestSyncLoadRequestId) return;
 			hideSkeleton("syncTeamSkeleton");
 			hideSkeleton("syncActorsSkeleton");
 			hideSkeleton("syncPeersSkeleton");
@@ -11285,6 +11292,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 	var settingsEnvOverrides = {};
 	var settingsTouchedKeys = /* @__PURE__ */ new Set();
 	var settingsShellMounted = false;
+	var settingsProtectedKeys = /* @__PURE__ */ new Set();
 	var settingsStartPolling = null;
 	var settingsRefresh = null;
 	var SETTINGS_ADVANCED_KEY = "codemem-settings-advanced";
@@ -11317,6 +11325,14 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 		syncCoordinatorTimeout: "sync_coordinator_timeout_s",
 		syncCoordinatorPresenceTtl: "sync_coordinator_presence_ttl_s"
 	};
+	var PROTECTED_VIEWER_CONFIG_KEYS = new Set([
+		"claude_command",
+		"observer_base_url",
+		"observer_auth_file",
+		"observer_auth_command",
+		"observer_headers",
+		"sync_coordinator_url"
+	]);
 	var settingsRenderState = {
 		effectiveText: "",
 		isSaving: false,
@@ -11802,6 +11818,12 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 			type: hasWarning ? "warning" : "success"
 		};
 	}
+	function isProtectedConfigKey(key) {
+		return settingsProtectedKeys.has(key) || PROTECTED_VIEWER_CONFIG_KEYS.has(key);
+	}
+	function protectedConfigHelp(key) {
+		return `${key} is read-only in the viewer for security. Edit the config file or environment instead.`;
+	}
 	function formStateFromPayload(payload) {
 		const config = payload.config || {};
 		const effective = payload.effective || {};
@@ -11842,8 +11864,10 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 		const defaults = payload.defaults || {};
 		const config = payload.config || {};
 		const envOverrides = payload.env_overrides && typeof payload.env_overrides === "object" ? payload.env_overrides : {};
+		const protectedKeys = Array.isArray(payload.protected_keys) ? payload.protected_keys.filter((value) => typeof value === "string" && value.trim().length > 0) : [];
 		const values = formStateFromPayload(payload);
 		settingsEnvOverrides = envOverrides;
+		settingsProtectedKeys = new Set(protectedKeys);
 		state.configDefaults = defaults;
 		state.configPath = payload.path || "";
 		updateRenderState({
@@ -11996,6 +12020,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 			const current = collectSettingsPayload({ allowUntouchedParseErrors: true });
 			const changed = {};
 			Object.entries(current).forEach(([key, value]) => {
+				if (isProtectedConfigKey(key)) return;
 				if (hasOwn(settingsEnvOverrides, key) && !settingsTouchedKeys.has(key)) return;
 				if (!isEqualValue(value, settingsBaseline[key])) changed[key] = value;
 			});
@@ -12398,15 +12423,15 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 													children: "Claude command (JSON argv)"
 												}),
 												/* @__PURE__ */ u("textarea", {
+													disabled: true,
 													id: "claudeCommand",
-													onInput: onTextInput("claudeCommand"),
 													placeholder: "[\"claude\"]",
 													rows: 2,
 													value: values.claudeCommand
 												}),
 												/* @__PURE__ */ u("div", {
 													className: "small",
-													children: "Used by `claude_sidecar` runtime. Example wrapper: `[\"wrapper\", \"claude\", \"--\"]`."
+													children: protectedConfigHelp("claude_command")
 												})
 											]
 										}),
@@ -12496,14 +12521,14 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 													children: "Token file path"
 												}),
 												/* @__PURE__ */ u("input", {
+													disabled: true,
 													id: "observerAuthFile",
-													onInput: onTextInput("observerAuthFile"),
 													placeholder: "~/.codemem/work-token.txt",
 													value: values.observerAuthFile
 												}),
 												/* @__PURE__ */ u("div", {
 													className: "small",
-													children: "Reads token text from this file when method is `file`."
+													children: protectedConfigHelp("observer_auth_file")
 												})
 											]
 										}),
@@ -12525,15 +12550,15 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 													})]
 												}),
 												/* @__PURE__ */ u("textarea", {
+													disabled: true,
 													id: "observerAuthCommand",
-													onInput: onTextInput("observerAuthCommand"),
 													placeholder: "[\"iap-auth\", \"--audience\", \"gateway\"]",
 													rows: 3,
 													value: values.observerAuthCommand
 												}),
 												/* @__PURE__ */ u("div", {
 													className: "small",
-													children: "When method is `command`, command stdout is used as the token."
+													children: protectedConfigHelp("observer_auth_command")
 												})
 											]
 										}),
@@ -12589,15 +12614,15 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 													})]
 												}),
 												/* @__PURE__ */ u("textarea", {
+													disabled: true,
 													id: "observerHeaders",
-													onInput: onTextInput("observerHeaders"),
 													placeholder: "{\"Authorization\":\"Bearer ${auth.token}\"}",
 													rows: 4,
 													value: values.observerHeaders
 												}),
 												/* @__PURE__ */ u("div", {
 													className: "small",
-													children: ["Template variables: ", "`${auth.token}`, `${auth.type}`, `${auth.source}`."]
+													children: protectedConfigHelp("observer_headers")
 												})
 											]
 										})
@@ -12781,14 +12806,14 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 												children: "Coordinator URL"
 											}),
 											/* @__PURE__ */ u("input", {
+												disabled: true,
 												id: "syncCoordinatorUrl",
-												onInput: onTextInput("syncCoordinatorUrl"),
 												placeholder: "https://coord.example.com",
 												value: values.syncCoordinatorUrl
 											}),
 											/* @__PURE__ */ u("div", {
 												className: "small",
-												children: "Optional self-hosted/operator-run discovery service. Direct peer-to-peer sync remains the data path."
+												children: protectedConfigHelp("sync_coordinator_url")
 											})
 										]
 									}),
@@ -12888,6 +12913,20 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 	}
 	//#endregion
 	//#region src/app.ts
+	function setRuntimeLabel(version, commit) {
+		const el = $$2("runtimeLabel");
+		if (!el) return;
+		el.textContent = commit ? `v${version} (${commit})` : `v${version}`;
+		el.title = commit ? `codemem ${version} (${commit})` : `codemem ${version}`;
+		el.hidden = false;
+	}
+	async function loadRuntimeLabel() {
+		try {
+			const runtime = await loadRuntimeInfo();
+			if (!runtime?.version) return;
+			setRuntimeLabel(runtime.version, "4a76585");
+		} catch {}
+	}
 	var lastAnnouncedRefreshState = null;
 	function setRefreshStatus(rs, detail) {
 		state.refreshState = rs;
@@ -13022,6 +13061,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
 	initSyncTab(() => refresh());
 	initSettings(stopPolling, startPolling, () => refresh());
 	loadProjects();
+	loadRuntimeLabel();
 	refresh();
 	startPolling();
 	//#endregion

package/static/index.html

@@ -346,6 +346,13 @@
         max-width: 300px;
       }
 
+      .runtime-label {
+        font-size: 11px;
+        color: var(--text-tertiary);
+        opacity: 0.8;
+        white-space: nowrap;
+      }
+
       /* ── Tab bar ───────────────────────────────────────────── */
 
       .tab-bar {
@@ -1625,6 +1632,7 @@
           <span class="sr-only" id="refreshAnnouncer" aria-live="polite"></span>
         </div>
         <div class="header-right">
+          <span class="runtime-label" id="runtimeLabel" hidden></span>
           <span class="meta-line" id="metaLine"></span>
           <select class="project-filter" id="projectFilter" aria-label="Project filter">
             <option value="">All Projects</option>