@inkeep/open-knowledge 0.50.0-beta.1 → 0.50.0-beta.10

package/dist/config.project-local.schema.json

@@ -18,6 +18,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Show dot-prefixed entries (e.g. .ok/, .okignore) in the file tree. Per-machine (project-local) — not shared with collaborators."
             },
@@ -26,6 +27,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Show only markdown documents (.md/.mdx) and folders in the file tree, hiding other file types from view. View-only: hidden files stay on disk and remain reachable via links and search. Per-machine (project-local) — not shared with collaborators."
             },
@@ -34,6 +36,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Show the Skills section in the sidebar. Skill documents remain reachable via links and search while the section is hidden. Per-machine (project-local) — not shared with collaborators."
             },
@@ -42,6 +45,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Show .ok folders (skills, templates, and other OpenKnowledge-managed state) in the file tree as read-only entries. .ok/worktrees and .ok/local never appear. Per-machine (project-local) — not shared with collaborators."
             }
@@ -72,6 +76,7 @@
               ],
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "How this machine syncs this project with its git remote: 'off' (no sync), 'follow' (one-directional — pull remote changes, never push your own; 'pull' is accepted as a legacy alias), or 'full' (bidirectional pull and push). null = not chosen yet (onboarding asks). Per-machine (project-local) — not shared. Supersedes the legacy autoSync.enabled boolean."
             },
@@ -87,6 +92,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Legacy per-machine sync toggle, superseded by autoSync.mode. Read only when mode is absent (true = full, false = off). null = not chosen yet. Per-machine (project-local) — not shared."
             },
@@ -104,6 +110,7 @@
           ],
           "scope": "project-local",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project-local",
           "description": "When sync is paused (autoSync.mode 'off') after having been enabled, the active mode to resume into ('follow' | 'full'). Per-machine UI memory; ignored while a mode is active. Not shared."
         },
@@ -127,6 +134,7 @@
               ],
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Committed project default for a machine's sync mode on first open: 'off' | 'follow' | 'full', or the legacy boolean (true = full, false = off). null = ask (show the onboarding prompt). Shared via git. A per-machine autoSync.mode choice overrides it."
             },
@@ -151,6 +159,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Opt-out for the in-app terminal (a real OS shell at full user privilege). The terminal is on by default; set false to disable it for this project on this machine. Per-machine (project-local) — never shared via git, clone, or sync."
             },
@@ -185,6 +194,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Add semantic (embeddings) ranking to the MCP search tool, fused with the lexical engine so conceptually-related pages surface even with no shared keywords. When ON and an API key is set (`ok embeddings set-key`), the search query and matching document content are sent to the configured embeddings provider — content egress. Default OFF. Per-machine (project-local) — not shared with collaborators."
             },
@@ -193,6 +203,7 @@
               "type": "string",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Base URL of the OpenAI-compatible embeddings API (default https://api.openai.com/v1). Override to point at a self-hosted server (Ollama / vLLM / LM Studio) or another provider. The API key is NOT stored here — set it with `ok embeddings set-key` (`~/.ok/secrets.yml`); it is sent to whichever endpoint this names."
             },
@@ -201,6 +212,7 @@
               "type": "string",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Embeddings model id (default text-embedding-3-small). Must be served by the provider at baseUrl. Changing it re-embeds the corpus (the cache is keyed by provider + model + dimensions)."
             },
@@ -210,6 +222,7 @@
               "maximum": 9007199254740991,
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Optional output vector dimensions. Omit (recommended) to detect the model's native size from its first response — that is what lets a non-OpenAI model work without knowing its size up front. Set a smaller value (text-embedding-3 supports e.g. 512 / 1024) to shrink the on-disk cache, trading a little retrieval quality; a server that ignores the request param then fails loudly instead of silently. Changing it re-embeds the corpus."
             },
@@ -219,6 +232,7 @@
               "maximum": 1,
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Optional hard cutoff: drop any \"by meaning\" match whose cosine similarity is below this value. Off by default (0) because retrieval is rank-based (the closest pages are returned regardless of absolute score) and the right cutoff is model-specific. Set it only to suppress weak matches for a specific provider/model whose cosine scale you know. Most setups should leave it unset and rely on the result-count cap."
             }
@@ -239,11 +253,58 @@
           "type": "boolean",
           "scope": "project-local",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project-local",
           "description": "Show a rich preview card (site name, page title, description, favicon) when you hover an external link in the editor. When ON, hovering an external link sends that link's URL to the destination site to fetch its preview metadata — outbound egress, one request per previewed link. Default ON; set to false to turn external previews off. Per-machine (project-local) — not shared with collaborators. Previews of links to other documents in this project are read from the local index with no network request and are always on."
         }
       },
       "additionalProperties": {}
+    },
+    "server": {
+      "default": {
+        "bind": [
+          "127.0.0.1"
+        ],
+        "allowExternal": false
+      },
+      "type": "object",
+      "properties": {
+        "allowExternal": {
+          "default": false,
+          "type": "boolean",
+          "scope": "project-local",
+          "agentSettable": false,
+          "reload": "boot",
+          "defaultScope": "project-local",
+          "description": "Exposure consent interlock. Once the unified server boot lands, a non-loopback server.bind or a server.publicUrl without allowExternal: true will be refused at boot with a one-line fix. Default off. Per-machine (project-local) — consent never travels via git, clone, or share; containers consent via the environment instead."
+        },
+        "openBrowser": {
+          "type": "boolean",
+          "scope": "project-local",
+          "agentSettable": false,
+          "reload": "boot",
+          "defaultScope": "project-local",
+          "description": "Open the UI in a browser when the server starts. Default derived: true when every bind address is loopback (a laptop start pops the UI), false otherwise (a container or exposed bind is headless and must never try). Acts once at start. Per-machine (project-local) — not shared."
+        },
+        "idleShutdown": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "off"
+            },
+            {
+              "type": "string",
+              "pattern": "^[1-9]\\d*(s|m|h)$"
+            }
+          ],
+          "scope": "project-local",
+          "agentSettable": false,
+          "reload": "live",
+          "defaultScope": "project-local",
+          "description": "Shut the server down after this long with no activity: a duration like '30m' (positive integer with unit s, m, or h), or 'off'. Default derived: '30m' when every bind address is loopback, 'off' otherwise (an exposed or containerized server stays up). Reloadable — a valid change applies without a restart. Per-machine (project-local) — not shared."
+        }
+      },
+      "additionalProperties": {}
     }
   },
   "additionalProperties": {}

package/dist/config.project.schema.json

@@ -14,14 +14,16 @@
           "type": "string",
           "scope": "project",
           "agentSettable": false,
+          "reload": "boot",
           "defaultScope": "project",
-          "description": "Folder OpenKnowledge reads and writes documents under, relative to the project root (the folder that contains .ok/). Defaults to the project root. Exclude paths with .okignore."
+          "description": "Folder OpenKnowledge reads and writes documents under, relative to the project root (the folder that contains .ok/). Defaults to the project root. Exclude paths with .okignore. Read at server start; changing it requires a restart."
         },
         "attachmentFolderPath": {
           "default": "./",
           "type": "string",
           "scope": "project",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project",
           "description": "Where pasted and dropped assets are stored, relative to the content root. './' colocates beside the current document (default); '/' targets the content root; './subdir' targets a subfolder under the current document folder; 'folder' targets a fixed folder under the content root. Whitespace-only values are treated as './'."
         }
@@ -49,6 +51,7 @@
               ],
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "How this machine syncs this project with its git remote: 'off' (no sync), 'follow' (one-directional — pull remote changes, never push your own; 'pull' is accepted as a legacy alias), or 'full' (bidirectional pull and push). null = not chosen yet (onboarding asks). Per-machine (project-local) — not shared. Supersedes the legacy autoSync.enabled boolean."
             },
@@ -64,6 +67,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Legacy per-machine sync toggle, superseded by autoSync.mode. Read only when mode is absent (true = full, false = off). null = not chosen yet. Per-machine (project-local) — not shared."
             },
@@ -92,6 +96,7 @@
               ],
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Committed project default for a machine's sync mode on first open: 'off' | 'follow' | 'full', or the legacy boolean (true = full, false = off). null = ask (show the onboarding prompt). Shared via git. A per-machine autoSync.mode choice overrides it."
             },
@@ -116,6 +121,7 @@
               "type": "boolean",
               "scope": "project-local",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project-local",
               "description": "Opt-out for the in-app terminal (a real OS shell at full user privilege). The terminal is on by default; set false to disable it for this project on this machine. Per-machine (project-local) — never shared via git, clone, or sync."
             },
@@ -181,6 +187,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Write local diagnostic spans + logs under .ok/local/ for `ok diagnose bundle`. Local-only — never leaves the machine until you run bundle. Set false for sensitive workspaces. Shared across collaborators."
             },
@@ -195,6 +202,7 @@
                   "type": "number",
                   "scope": "project",
                   "agentSettable": false,
+                  "reload": "live",
                   "defaultScope": "project",
                   "description": "Maximum size, in bytes, of the local diagnostic spans file before it rotates (default ~50 MB)."
                 }
@@ -212,6 +220,7 @@
                   "type": "number",
                   "scope": "project",
                   "agentSettable": false,
+                  "reload": "live",
                   "defaultScope": "project",
                   "description": "Maximum size, in bytes, of the local diagnostic logs file before it rotates (default ~25 MB)."
                 }
@@ -235,6 +244,7 @@
               },
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Telemetry attribute keys whose values are redacted before any local span/log is written (credential / secret guard). Extends the built-in denylist."
             }
@@ -256,6 +266,7 @@
           "type": "boolean",
           "scope": "project",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project",
           "description": "Record bridge loss-class events (content-free) under .ok/local/loss-capture/ for `ok diagnose bundle`. Local-only — never leaves the machine until you run bundle. Set false for sensitive workspaces. Shared across collaborators."
         },
@@ -264,6 +275,7 @@
           "type": "number",
           "scope": "project",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project",
           "description": "Maximum size, in bytes, of the local loss-capture file before it rotates (default ~12 MB)."
         }
@@ -304,6 +316,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Keep the desktop window's timers running at full rate while it holds unsynced work, so backgrounding the app never starves sync or recovery; when the window is idle the OS-default background throttling is restored (battery). Honored by the desktop app. Default ON — disable only to isolate a suspected regression."
             }
@@ -321,6 +334,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Defer a drain-shaped Observer B re-derive when the WYSIWYG fragment holds an un-propagated keystroke Y.Text lacks, so the keystroke survives instead of being stomped. Default ON — disable only to isolate a suspected regression."
             }
@@ -338,6 +352,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Detect content the bridge silently dropped at its reconciliation boundary (an Observer-A apply arm or a paired agent-undo derive) and write a recovery checkpoint plus a content-free loss event. Detection only — never blocks a write. Default ON — disable only to isolate a suspected regression."
             }
@@ -355,6 +370,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Bound the Y.Text→WYSIWYG re-derive loop with a drain-count backstop: a run of re-derive drains that never reaches a raw-byte fixed point freezes the re-derive loop and writes a recovery checkpoint plus a content-free loss event, instead of churning unbounded. Default ON — disable only to isolate a suspected regression."
             }
@@ -372,6 +388,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Before an agent write or undo rebuilds the WYSIWYG fragment, flush an un-propagated keystroke that provably does not overlap the operation into Y.Text so the keystroke survives instead of needing recovery; overlapping or unmodellable cases fall back to the checkpoint floor. Scope: appending writes and single-frame undos — a write that replaces the whole body (replace / edit) overwrites the keystroke either way, so those always take the checkpoint floor. Default ON — disable only to isolate a suspected regression."
             }
@@ -389,6 +406,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "On tab hide/unload, force-send each doc's unsynced work to the server and commit its local cache, and re-sync on return to foreground, so a backgrounded tab never strands edits that IndexedDB alone would lose on recycle. Honored client-side. Default ON — disable only to isolate a suspected regression."
             }
@@ -421,6 +439,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Whether the markdownlint plugin (body rules) contributes diagnostics."
             }
@@ -438,6 +457,7 @@
               "type": "boolean",
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Whether the frontmatter plugin (JSON-Schema validation of document frontmatter) contributes diagnostics."
             },
@@ -473,6 +493,7 @@
               },
               "scope": "project",
               "agentSettable": false,
+              "reload": "live",
               "defaultScope": "project",
               "description": "Frontmatter schema mappings: which docs (appliesTo globs) validate against which JSON Schema file (project-root-relative path)."
             }
@@ -498,6 +519,7 @@
           ],
           "scope": "project",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project",
           "description": "How broken internal links are reported on the validation plane: 'off' hides them, 'warning' (default) or 'error' sets their severity."
         },
@@ -506,6 +528,7 @@
           "type": "boolean",
           "scope": "project",
           "agentSettable": false,
+          "reload": "live",
           "defaultScope": "project",
           "description": "Whether the file tree tints and badges files that have validation problems."
         }
@@ -513,27 +536,73 @@
       "additionalProperties": {}
     },
     "remote": {
-      "default": {
-        "port": 24550
-      },
+      "default": {},
       "type": "object",
       "properties": {
         "url": {
           "type": "string",
           "scope": "project",
           "agentSettable": false,
+          "reload": "boot",
           "defaultScope": "project",
-          "description": "Public URL your tunnel gives you, e.g. https://myproject.ngrok.app. Used only with `ok start --remote` (config alone never enables remote access); its host is admitted through the Host-header allowlist. There is no server-side auth, so restrict access at the tunnel (ngrok OAuth, Cloudflare Access, Tailscale ACLs)."
+          "description": "Superseded by server.publicUrl — read only while server.publicUrl is absent. Public URL your tunnel gives you, e.g. https://myproject.ngrok.app. Used only with `ok start --remote` (config alone never enables remote access); its host is admitted through the Host-header allowlist. There is no server-side auth, so restrict access at the tunnel (ngrok OAuth, Cloudflare Access, Tailscale ACLs)."
         },
         "port": {
-          "default": 24550,
           "type": "integer",
           "minimum": 1,
           "maximum": 65535,
           "scope": "project",
           "agentSettable": false,
+          "reload": "boot",
+          "defaultScope": "project",
+          "description": "Superseded by server.port — read only while server.port is absent. TCP port the server binds when remote access is enabled (default 24550). Fixed so the tunnel's port mapping survives restarts. Set it only on a conflict. An explicit --port still wins; the PORT env var is ignored in remote mode."
+        }
+      },
+      "additionalProperties": {}
+    },
+    "server": {
+      "default": {
+        "bind": [
+          "127.0.0.1"
+        ],
+        "allowExternal": false
+      },
+      "type": "object",
+      "properties": {
+        "port": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 65535,
+          "scope": "project",
+          "agentSettable": false,
+          "reload": "boot",
+          "defaultScope": "project",
+          "description": "TCP port the server listens on. Unset by default: a local start picks a free port dynamically, and deployment platforms inject the PORT environment variable instead. Supersedes remote.port (still read while this key is absent). Read at server start; changing it requires a restart."
+        },
+        "bind": {
+          "default": [
+            "127.0.0.1"
+          ],
+          "minItems": 1,
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "scope": "project",
+          "agentSettable": false,
+          "reload": "boot",
+          "defaultScope": "project",
+          "description": "Addresses the server binds, e.g. [127.0.0.1] or [0.0.0.0]. Default loopback-only ([127.0.0.1]): nothing off this machine can connect. A non-loopback bind additionally requires the server.allowExternal consent interlock. Lists replace, never merge. Read at server start; changing it requires a restart."
+        },
+        "publicUrl": {
+          "type": "string",
+          "pattern": "^https?:\\/\\/",
+          "scope": "project",
+          "agentSettable": false,
+          "reload": "boot",
           "defaultScope": "project",
-          "description": "TCP port the server binds when remote access is enabled (default 24550). Fixed so the tunnel's port mapping survives restarts. Set it only on a conflict. An explicit --port still wins; the PORT env var is ignored in remote mode."
+          "description": "Canonical external origin the server is reached at, e.g. https://kb.example.com — drives issued URLs and CORS. Unset by default: a loopback server derives http://localhost:<port>. Setting it declares external exposure, which additionally requires the server.allowExternal consent interlock. Supersedes remote.url (still read while this key is absent). Read at server start; changing it requires a restart."
         }
       },
       "additionalProperties": {}