@jhizzard/termdeck 0.3.6 → 0.3.7

package/README.md

@@ -161,7 +161,7 @@ Honest limits, stated upfront so the skeptic has nothing to chase:
 - **Not a replacement for reading docs.** It's the shortest path to a memory you already wrote. If the memory isn't there, the feature does nothing.
 - **Not fully local by default.** Tier 2+ reaches out to Supabase for storage and OpenAI for embeddings. Tier 1 is fully local. A fully-local Tier 2 (local Postgres + local embeddings) is on the roadmap.
 - **Not free forever.** Tier 2+ pays OpenAI fractions of a cent per memory for embeddings. Self-hosted embeddings via Ollama are on the roadmap.
-- **Not proven at scale.** v0.3.5, validated against 3,527 memories in one developer's production store. First full Rumen kickstart on 2026-04-15 processed 111 sessions into 111 insights in one pass. No multi-user data yet. Bug reports and issues welcome.
+- **Not proven at scale.** v0.3.7, validated against 3,527 memories in one developer's production store. First full Rumen kickstart on 2026-04-15 processed 111 sessions into 111 insights in one pass. No multi-user data yet. Bug reports and issues welcome.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jhizzard/termdeck",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Browser-based terminal multiplexer with metadata overlays, panel flashback memory recall, and AI-aware session management",
   "bin": {
     "termdeck": "./packages/cli/src/index.js"

package/packages/cli/src/index.js

@@ -106,10 +106,22 @@ const port = config.port || 3000;
 const host = config.host || '127.0.0.1';
 const url = `http://${host}:${port}`;
 
+// Bind guardrail: refuse non-loopback without auth token
+const LOOPBACK = new Set(['127.0.0.1', 'localhost', '::1']);
+if (!LOOPBACK.has(host)) {
+  const authToken = config.auth?.token || process.env.TERMDECK_AUTH_TOKEN;
+  if (!authToken) {
+    console.error('[security] Refusing to bind to ' + host + ' without auth.token set.');
+    console.error('[security] Set auth.token in ~/.termdeck/config.yaml or TERMDECK_AUTH_TOKEN env var.');
+    console.error('[security] To bind locally only, set host: 127.0.0.1 in config.yaml');
+    process.exit(1);
+  }
+}
+
 server.listen(port, host, async () => {
   console.log(`
   ╔══════════════════════════════════════╗
-  ║            TermDeck v0.2.0           ║
+  ║            TermDeck v${require(path.join(__dirname, '..', '..', '..', 'package.json')).version.padEnd(14)}║
   ╠══════════════════════════════════════╣
   ║  ${url.padEnd(34)}  ║
   ║                                      ║

package/packages/client/public/app.js

@@ -2565,9 +2565,13 @@
     const TIER23_CHECKS = new Set(['mnestra_reachable', 'mnestra_has_memories', 'rumen_recent', 'database_url']);
 
     function filterChecksByTier(checks) {
-      const hasDb = checks.some(c => c.name === 'database_url' && c.passed);
-      if (hasDb) return checks; // full stack configured — show everything
-      // No DATABASE_URL: only show Tier 1 checks
+      // Show Tier 2/3 checks if DATABASE_URL was ATTEMPTED (exists in results),
+      // regardless of pass/fail. Only hide higher-tier checks when the user
+      // has no DATABASE_URL at all (detail says "not set").
+      const dbCheck = checks.find(c => c.name === 'database_url');
+      const dbConfigured = dbCheck && !/not set/i.test(dbCheck.detail || '');
+      if (dbConfigured) return checks; // full stack configured — show everything
+      // No DATABASE_URL configured: only show Tier 1 checks
       return checks.filter(c => TIER1_CHECKS.has(c.name));
     }