@otto-code/brain 0.7.5 → 0.7.6

package/dist/commands/config.js

@@ -45,6 +45,15 @@ function applyKey(config, key, value) {
             config.runtime.source = value;
             return;
         case "auth.mode":
+            // mode=token without a stored token would serve ungated (withAuth has no
+            // key to check), so refuse to persist that state. Set auth.token first.
+            if (value === "token" && !config.auth.token) {
+                throw new CommandError({
+                    code: "TOKEN_REQUIRED",
+                    message: "auth.mode=token requires auth.token to be set first",
+                    details: "run `otto brain config set auth.token <token>` before enabling token auth",
+                });
+            }
             config.auth.mode = value;
             return;
         case "auth.token":

package/dist/commands/ui.js

@@ -4,14 +4,46 @@ import { resolveRuntime } from "../runtime/index.js";
 export function addUiOptions(cmd) {
     return cmd.description("Launch the interactive full-screen UI");
 }
-export async function runUiCommand(_options, _command) {
-    if (!process.stdout.isTTY) {
-        throw new CommandError({
+const NON_INTERACTIVE_HINT = "use `scan`, `serve`, `calibrate`, or `sweep` instead";
+/**
+ * The bundled Windows `otto` runs the CLI inside Otto.exe with
+ * ELECTRON_RUN_AS_NODE=1. Otto.exe is an IMAGE_SUBSYSTEM_WINDOWS_GUI binary, so
+ * Node classifies its inherited stdio as non-TTY even from a real console:
+ * measured in a freshly allocated console, Otto.exe reports
+ * stdout/stdin.isTTY=false where node.exe in the same console reports true.
+ * stdin is the fatal half: the TUI needs setRawMode and there is no console
+ * input to switch. No launcher change fixes this while Otto.exe is the only
+ * Node host shipped in the installer, so point the user at the npm CLI, which
+ * runs on console-subsystem node.exe.
+ */
+function isBundledWindowsCli() {
+    return process.platform === "win32" && Boolean(process.versions.electron);
+}
+function noTtyError() {
+    if (isBundledWindowsCli()) {
+        return new CommandError({
             code: "NO_TTY",
-            message: "the interactive UI needs a TTY",
-            details: "use `scan`, `serve`, `calibrate`, or `sweep` instead",
+            message: "the bundled Windows CLI cannot run the interactive UI",
+            details: [
+                "`otto` from the desktop app runs inside Otto.exe, a GUI-subsystem binary",
+                "with no console input, so the full-screen UI cannot start.",
+                "For interactive commands install the standalone CLI: npm i -g @otto-code/cli",
+                "Every non-interactive command still works here: `scan`, `serve`, `calibrate`, `sweep`.",
+            ].join("\n  "),
         });
     }
+    return new CommandError({
+        code: "NO_TTY",
+        message: "the interactive UI needs a TTY",
+        details: NON_INTERACTIVE_HINT,
+    });
+}
+export async function runUiCommand(_options, _command) {
+    // Both streams matter: the screen needs stdout, and onKeys() needs stdin raw
+    // mode. Gating on stdout alone let a stdin-less run start and then hang.
+    if (!process.stdout.isTTY || !process.stdin.isTTY) {
+        throw noTtyError();
+    }
     const config = loadBrainConfig();
     const runtime = resolveRuntime(config);
     if (!runtime) {

package/dist/service/serve.d.ts

@@ -19,6 +19,13 @@ import { Supervisor } from "./supervisor.js";
  * what the relay accepted), or the brain's own `x-otto-brain-token`.
  */
 export declare function extractToken(req: http.IncomingMessage): string | null;
+/**
+ * The one derivation of the effective auth token. `mode: "token"` with a null or
+ * empty token is NO auth — the bind guard and withAuth both read this, so they
+ * cannot disagree (a mode-only guard once let mode=token + token=null bind
+ * non-loopback and then serve every route ungated).
+ */
+export declare function effectiveAuthToken(config: BrainConfig): string | null;
 export interface StartServiceOptions {
     config: BrainConfig;
     modelNeedle?: string;

package/dist/service/serve.js

@@ -68,9 +68,17 @@ export function extractToken(req) {
     const header = req.headers["x-otto-brain-token"];
     return typeof header === "string" ? header : null;
 }
+/**
+ * The one derivation of the effective auth token. `mode: "token"` with a null or
+ * empty token is NO auth — the bind guard and withAuth both read this, so they
+ * cannot disagree (a mode-only guard once let mode=token + token=null bind
+ * non-loopback and then serve every route ungated).
+ */
+export function effectiveAuthToken(config) {
+    return config.auth.mode === "token" && config.auth.token ? config.auth.token : null;
+}
 /** Gate the router with a bearer token when configured; /health stays open. */
-function withAuth(inner, config) {
-    const token = config.auth.mode === "token" ? config.auth.token : null;
+function withAuth(inner, token) {
     if (!token)
         return inner;
     return (req, res) => {
@@ -102,19 +110,21 @@ export async function startService({ config, modelNeedle, env = process.env, onL
         : config.listen.host;
     const displayHost = tlsOptions?.hostname ?? bindHost;
     // Auth is orthogonal to transport: TLS encrypts the pipe, a token authorizes the
-    // caller. A non-loopback bind still needs a token even over HTTPS.
+    // caller. A non-loopback bind still needs an actual token even over HTTPS —
+    // gate on the token itself, not auth.mode, or mode=token with no token binds open.
+    const authToken = effectiveAuthToken(config);
     if (!isLoopback(bindHost) &&
-        config.auth.mode !== "token" &&
+        !authToken &&
         !config.allowInsecureBind &&
         env.OTTO_BRAIN_ALLOW_INSECURE !== "1") {
         throw new CommandError({
             code: "INSECURE_BIND",
             message: `refusing to bind ${bindHost} without auth`,
-            details: "set auth.mode=token, or allowInsecureBind=true for an open trusted-network share " +
-                "(or OTTO_BRAIN_ALLOW_INSECURE=1 to override)",
+            details: "set auth.mode=token with a non-empty auth.token, or allowInsecureBind=true for an " +
+                "open trusted-network share (or OTTO_BRAIN_ALLOW_INSECURE=1 to override)",
         });
     }
-    const store = loadProfilesStore();
+    const store = loadProfilesStore(paths);
     const catalog = scanModels(config, env);
     const needle = modelNeedle ?? config.defaultModel ?? store.lastModelId ?? undefined;
     const model = pickModel(catalog, needle);
@@ -165,7 +175,7 @@ export async function startService({ config, modelNeedle, env = process.env, onL
         }
         await supervisor.start(target, fitProfile);
         store.lastModelId = target.id;
-        saveProfilesStore(store);
+        saveProfilesStore(store, paths);
     };
     const loadModel = (target) => {
         const run = modelSwitchChain.then(() => loadModelUnsafe(target));
@@ -221,7 +231,7 @@ export async function startService({ config, modelNeedle, env = process.env, onL
         getDefaultModel: () => config.defaultModel,
         applyConfigPatch,
         getAllowConfigWrite: () => config.allowRemoteConfig,
-    }), config);
+    }), authToken);
     // TLS terminates in-process when configured; otherwise plain HTTP. The cert
     // manager issues/generates the first keypair before we listen, and hot-swaps
     // the secure context on renewal without dropping connections.
@@ -249,7 +259,7 @@ export async function startService({ config, modelNeedle, env = process.env, onL
     certManager?.start();
     await supervisor.start(model, profile);
     store.lastModelId = model.id;
-    saveProfilesStore(store);
+    saveProfilesStore(store, paths);
     writePidFile({
         pid: process.pid,
         host: bindHost,

package/dist/tui/app.js

@@ -11,6 +11,7 @@ import * as archive from "../ops/archive.js";
 import { Supervisor } from "../service/supervisor.js";
 import { createRouter, Telemetry } from "../service/router.js";
 import * as sysmon from "../sysmon.js";
+import { resolveVersion } from "../version.js";
 import http from "node:http";
 // The config panel holds short fields, so keep it compact and give the rest of
 // the width to the model list (long model names need the room).
@@ -1394,7 +1395,7 @@ export class App {
         this.renderFitted(lines);
     }
     header(cols) {
-        const title = `${style.bold}${style.brightCyan}Otto Brain${style.reset}`;
+        const title = `${style.bold}${style.brightCyan}Otto Brain${style.reset}${style.grey} v${resolveVersion()}${style.reset}`;
         const rt = `${style.grey}llama.cpp ${this.runtime.label} v${this.runtime.version}${style.reset}`;
         const g = this.gpuInfo
             ? `${style.grey}${this.gpuInfo.name} · ${vram.formatGiB(this.gpuInfo.usedBytes)}/${vram.formatGiB(this.gpuInfo.totalBytes)}${style.reset}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-code/brain",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Otto Brain - self-contained host for local GGUF models, with measured VRAM budgeting and reasoning-budget control",
   "license": "AGPL-3.0-or-later",
   "bin": {