@promptowl/contextnest-community 1.1.0 → 1.3.0

package/CONFIGURATION.md

@@ -49,7 +49,8 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `AUTH_MODE` | `key` | `key` or `open`. See above. |
 | `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
 | `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
-| `ENV_FILE_PATH` | `$cwd/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars). Override when your `.env` lives outside the working directory. |
+| `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
+| `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars), and which the server also reads at boot. Defaults **under `DATA_ROOT`** so the browser License Setup Page persists durably in containers — `$cwd` is `/app` in the official image (root-owned, discarded on container recreate), which silently lost the key. Override only if your writable, persisted `.env` lives elsewhere. In containers, providing `PROMPTOWL_KEY` directly via the environment also works and is read at boot. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
@@ -99,7 +100,7 @@ allowed_users:
   - "*.acme.com"                # email wildcard — anyone @acme.com
   - "partner@vendor.com"         # exact match
 super_admins:
-  - "ceo@acme.com"               # always allowed on every nest
+  - "ceo@acme.com"               # admin on every nest: visibility, collaborators, stewards (not owner-only delete/transfer)
 groups:
   engineering:
     default_permission: write

package/README.md

@@ -97,6 +97,10 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Per-nest sharing + collaborators | ✅ | ✅ |
 | Public read-only nests | ✅ | ✅ |
 | Custom logo / branding | ✅ | ✅ |
+| Admin password reset + user removal (in-platform) | ✅ | ✅ |
+| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace | ✅ | ✅ |
+| Steward version revert | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
 | SSO / SAML / SCIM | — | ✅ |
@@ -106,6 +110,35 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
+## What's new in 1.3.0
+
+- **Server super-admins** — emails listed in `access.yaml: super_admins` administer every nest (change visibility, manage collaborators and stewards) without being added per-nest. Owner-only operations (delete, transfer) still require the nest owner. See [STEWARDSHIP.md](./STEWARDSHIP.md).
+- **License persistence under `DATA_ROOT`** — `PROMPTOWL_KEY` now writes to `$DATA_ROOT/.env` (was `$cwd/.env`, which is root-owned `/app` in the official Docker image and silently lost the key on container recreate). The License Setup Page also surfaces write failures instead of failing quietly. Override via `ENV_FILE_PATH`. See [CONFIGURATION.md](./CONFIGURATION.md).
+- **Case-insensitive email** across registration, login, invite, and access checks. Migration dedupes existing accounts that differ only in case; fixes "I can't log in because I capitalized my email" and access-guard / lockout mismatches.
+- **Document version history + inline diff** — every saved version is browsable in the document detail view, and an inline diff highlights what changed between any two versions.
+- **Nest Overview / index landing** — every nest opens on a grouped table-of-contents with a "recently edited" strip instead of a flat list.
+- **Public/private toggle on the nest header** — visibility is set directly from the header, not buried in a dialog.
+- **Review queue surfaces submitted-for-review edits** — reviewers see the pending versions a contributor staged, not just net-new documents.
+- **Internal-folder sync over MCP** — agents can list a nest's unsynced filesystem folders and pull them into the nest on demand. New `unsynced-service.ts` + MCP tools, covered by `test/unsynced-folder.test.ts` and `test/mcp-unsynced.test.ts`.
+- **Telemetry `batch_id` + user email** — usage events carry a stable `batch_id` (de-duped on the receiver) and the authenticated user email alongside the user id, so the PromptOwl ingest bridge can meter credits to the right account.
+- **Hyperlink navigation fix** — hyperlinks in the editor and viewer navigate to their configured target URL correctly.
+- **Repo / DX** — `CLAUDE.md` at the repo root with project-specific guidance for Claude Code; `claude.yml` (PR assistant) and `claude-code-review.yml` (auto review on PRs) GitHub Actions workflows.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
+## What's new in 1.2.0
+
+- **Admin user management (no email server needed)** — `POST /auth/admin/reset-password/:userId` sets a user's password or returns a one-time temp password; `DELETE /auth/users/:userId` removes a user and revokes their API keys, sessions, and role rows. New self-service **Change password** in the user menu blocks reusing the current password.
+- **`PROMPTOWL_SIGN_IN_GATE`** — `open` / `admin-only` / `disabled` restricts "Sign in with PromptOwl" (admin reaches it via `?admin=1`). See [CONFIGURATION.md](./CONFIGURATION.md).
+- **Plain-text agent view** — `?format=markdown` on a node returns frontmatter + body as `text/markdown` for LLM-friendly consumption.
+- **Steward version revert** — `POST .../revert` restores an earlier version as a new one; pending-review docs are now editable (saving withdraws the review).
+- **Editor — always-editable surface** — Notion-style buttery headline, selection bubble toolbar (format-on-highlight), turn-into block conversion, Cmd+F find & replace, rich blocks (tables, callouts, toggles, syntax-highlighted code, columns), and wiki/code-safety fixes.
+- **Wiki usability** — backlinks panel ("Linked from N documents"), outline/TOC for 3+-heading docs, hover-preview on `[[wiki links]]`, multi-tag AND filtering with clickable chips, per-doc copy link, rename-safety warning for title-form links, link-health report (broken links + orphans), recently-edited strip.
+- **Sharing clarity** — share button reads "Share nest"; dialog clarifies nest-wide scope; deep links open documents directly.
+- **Security** — hardened scanner gate (PolinRider + Shai-Hulud preflight) in `bin/`.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
 ## What's new in 1.1.0
 
 - **Vault import** — import an existing folder of markdown files into a new nest in one step, from the dashboard ("Import folder") or via the API. Frontmatter, wiki links, and folder structure are preserved.

package/dist/{chunk-7UTMBL6Z.js → chunk-6AXBB65N.js}

@@ -1,6 +1,6 @@
 import {
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-UEHFNBNR.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-S2EWN2VA.js → chunk-EDJRDWPL.js}

@@ -1,16 +1,16 @@
 import {
   createVersion,
   setApprovedVersion
-} from "./chunk-7UTMBL6Z.js";
+} from "./chunk-6AXBB65N.js";
 import {
   buildTitleMap,
   canUserApprove,
   engineCache,
   resolveStewardsForNode
-} from "./chunk-WCOUCBDJ.js";
+} from "./chunk-SO74PQWI.js";
 import {
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-UEHFNBNR.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-WCOUCBDJ.js → chunk-SO74PQWI.js}

@@ -2,7 +2,7 @@ import {
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-UEHFNBNR.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -26,9 +26,6 @@ function loadAccessConfig() {
   accessConfig = null;
   return null;
 }
-function getAccessConfig() {
-  return accessConfig;
-}
 function isSuperAdmin(email) {
   if (!accessConfig?.super_admins) return false;
   return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
@@ -136,6 +133,12 @@ var ConflictError = class extends AppError {
     this.name = "ConflictError";
   }
 };
+var LockedError = class extends AppError {
+  constructor(message = "Locked") {
+    super(423, message);
+    this.name = "LockedError";
+  }
+};
 
 // src/nodes/engine.ts
 import {
@@ -186,6 +189,11 @@ function discardImportDir(dest) {
 }
 
 // src/telemetry/tracker.ts
+import { createHash } from "crypto";
+function computeBatchId(ids) {
+  const key = ids.slice().sort((a, b) => a - b).join(",");
+  return createHash("sha256").update(key).digest("hex").slice(0, 32);
+}
 function trackEvent(event, data) {
   if (!config.TELEMETRY_ENABLED) return;
   try {
@@ -204,31 +212,61 @@ async function flushTelemetry() {
   const events = db.prepare(
     "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
   ).all();
-  if (events.length === 0 && userCount === 0) return;
+  if (events.length === 0 && userCount === 0) {
+    console.log("[telemetry] skip flush: no events and no users");
+    return;
+  }
+  const emailStmt = db.prepare("SELECT email FROM users WHERE id = ?");
+  const emailCache = /* @__PURE__ */ new Map();
+  const resolveEmail = (userId) => {
+    if (typeof userId !== "string" || !userId) return null;
+    if (emailCache.has(userId)) return emailCache.get(userId) ?? null;
+    const row = emailStmt.get(userId);
+    const email = row?.email ?? null;
+    emailCache.set(userId, email);
+    return email;
+  };
+  const batchId = events.length > 0 ? computeBatchId(events.map((e) => e.id)) : null;
   const payload = {
     server_key: config.PROMPTOWL_KEY,
+    batch_id: batchId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     stats: { users: userCount, nests: nestCount },
-    events: events.map((e) => ({
-      event: e.event,
-      data: e.data_json ? JSON.parse(e.data_json) : null,
-      at: e.created_at
-    }))
+    events: events.map((e) => {
+      const data = e.data_json ? JSON.parse(e.data_json) : null;
+      if (data && data.userId && !data.userEmail) {
+        const email = resolveEmail(data.userId);
+        if (email) data.userEmail = email;
+      }
+      return {
+        event: e.event,
+        data,
+        at: e.created_at
+      };
+    })
   };
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  const url = `${promptowlUrl}/api/telemetry/ingest`;
+  console.log(
+    `[telemetry] POST ${url} events=${events.length} users=${userCount} nests=${nestCount}`
+  );
+  console.log("[telemetry] payload:", JSON.stringify(payload, null, 2));
   try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/telemetry/ingest`, {
+    const res = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload)
     });
+    console.log(`[telemetry] response: ${res.status} ${res.statusText}`);
     if (res.ok && events.length > 0) {
       const ids = events.map((e) => e.id);
       db.prepare(
         `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
       ).run(...ids);
+      console.log(`[telemetry] marked ${ids.length} events as sent`);
     }
-  } catch {
+  } catch (err) {
+    console.error("[telemetry] flush failed:", err);
   }
 }
 var telemetryTimer = null;
@@ -289,14 +327,18 @@ async function installLicenseKey(key) {
     if (previousKey) {
       await validateLicense({ forceFresh: true });
     }
-    return info;
+    return { ...info, persisted: false };
   }
   try {
     upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
+    return { ...info, persisted: true };
   } catch (err) {
-    console.warn("[license] failed to write .env:", err);
+    const persistError = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `[license] validated but FAILED to persist to ${config.ENV_FILE_PATH}: ${persistError}`
+    );
+    return { ...info, persisted: false, persistError };
   }
-  return info;
 }
 var safetyPollHandle = null;
 var SAFETY_POLL_INTERVAL_MS = 60 * 1e3;
@@ -542,6 +584,22 @@ function isImportedNest(nestId) {
 function toSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+function uniqueNestName(userId, baseName) {
+  const db = getDb();
+  const slugTaken = db.prepare(
+    "SELECT 1 FROM nests WHERE user_id = ? AND slug = ? LIMIT 1"
+  );
+  let candidate = baseName;
+  let n = 0;
+  while (n < 1e3) {
+    const slug = toSlug(candidate);
+    const hit = slugTaken.get(userId, slug);
+    if (!hit) return candidate;
+    n++;
+    candidate = `${baseName} (${n})`;
+  }
+  return candidate;
+}
 function isStewardshipEnabled(nestId) {
   const db = getDb();
   const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
@@ -578,6 +636,43 @@ function disableStewardshipAndWipeGovernance(nestId) {
   });
   return wipe(nestId);
 }
+function renameNest(nestId, patch) {
+  const db = getDb();
+  const existing = db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId);
+  if (!existing) {
+    throw new ValidationError("Nest not found");
+  }
+  const updates = [];
+  const params = [];
+  if (patch.name !== void 0) {
+    const trimmed = patch.name.trim();
+    if (!trimmed) throw new ValidationError("Name cannot be empty");
+    const slug = toSlug(trimmed);
+    if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
+    const conflict = db.prepare(
+      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1"
+    ).get(existing.user_id, slug, nestId);
+    if (conflict) {
+      throw new ValidationError(
+        `Another nest already uses this name. Pick a different one.`
+      );
+    }
+    updates.push("name = ?", "slug = ?");
+    params.push(trimmed, slug);
+  }
+  if (patch.description !== void 0) {
+    updates.push("description = ?");
+    params.push(patch.description || null);
+  }
+  if (updates.length === 0) {
+    return existing;
+  }
+  params.push(nestId);
+  db.prepare(`UPDATE nests SET ${updates.join(", ")} WHERE id = ?`).run(
+    ...params
+  );
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId);
+}
 async function createNest(userId, name, description) {
   const id = uuid();
   const slug = toSlug(name);
@@ -635,6 +730,13 @@ function listNests(userId) {
 }
 function listSharedNests(userId) {
   const db = getDb();
+  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const isServerAdmin = isLicenseAdminUserId(userId) || (caller?.email ? isSuperAdmin(caller.email) : false);
+  if (isServerAdmin) {
+    return db.prepare(
+      "SELECT * FROM nests WHERE user_id != ? ORDER BY created_at DESC"
+    ).all(userId);
+  }
   return db.prepare(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
@@ -783,6 +885,11 @@ function resolveNestPermission(nestId, userId) {
   if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
     return "owner";
   }
+  if (isLicenseAdminUserId(userId)) return "admin";
+  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  if (caller?.email && isSuperAdmin(caller.email)) {
+    return "admin";
+  }
   const directGrant = db.prepare(
     "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
   ).get(nestId, userId);
@@ -811,6 +918,9 @@ function isPublicReader(nestId, userId) {
     "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
   ).get(nestId, userId);
   if (directGrant) return false;
+  if (isLicenseAdminUserId(userId)) return false;
+  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  if (caller?.email && isSuperAdmin(caller.email)) return false;
   const stewardGrant = db.prepare(
     `SELECT 1 FROM stewards s
          JOIN users u ON u.id = ?
@@ -1147,7 +1257,7 @@ function getCollaboratorRole(nestId, userEmail) {
 }
 function resolveUserRoles(nestId, userEmail, opts) {
   const roles = /* @__PURE__ */ new Set();
-  if (isSuperAdmin2(userEmail)) roles.add("admin");
+  if (isSuperAdmin(userEmail)) roles.add("admin");
   const owner = getNestOwnerEmail(nestId);
   if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
     roles.add("owner");
@@ -1163,16 +1273,12 @@ function resolveUserRoles(nestId, userEmail, opts) {
   for (const role of stewardRoles) roles.add(role);
   return [...roles];
 }
-function isSuperAdmin2(userEmail) {
-  const cfg = getAccessConfig();
-  return !!cfg?.super_admins?.includes(userEmail);
-}
 function canManageStewards(userEmail) {
   if (config.AUTH_MODE === "open") return true;
-  return isLicenseAdminEmail(userEmail) || isSuperAdmin2(userEmail);
+  return isLicenseAdminEmail(userEmail) || isSuperAdmin(userEmail);
 }
 function canCreateInNest(nestId, userEmail) {
-  if (config.AUTH_MODE === "open" || isSuperAdmin2(userEmail)) return true;
+  if (config.AUTH_MODE === "open" || isSuperAdmin(userEmail)) return true;
   const userId = userIdForEmail(userEmail);
   if (userId) {
     const perm = resolveNestPermission(nestId, userId);
@@ -1196,7 +1302,7 @@ function canUserEdit(nestId, nodeId, userEmail) {
   if (roles.includes("owner")) {
     return { allowed: true, reason: "nest owner", role: "owner" };
   }
-  if (isSuperAdmin2(userEmail)) {
+  if (isSuperAdmin(userEmail)) {
     return { allowed: true, reason: "super admin", role: "super_admin" };
   }
   if (canEditWith(roles)) {
@@ -1229,7 +1335,7 @@ function getPendingReviewRequester(nestId, nodeId) {
 function canUserApprove(nestId, nodeId, userEmail) {
   const roles = resolveUserRoles(nestId, userEmail, { nodeId });
   const isOwner = roles.includes("owner");
-  const isSuper = isSuperAdmin2(userEmail);
+  const isSuper = isSuperAdmin(userEmail);
   const allowSelf = nestAllowsSelfApprove(nestId);
   const hasStewardApprove = roles.includes("admin") || roles.includes("reviewer");
   const actor = getPendingReviewRequester(nestId, nodeId) ?? getCurrentVersionAuthor(nestId, nodeId);
@@ -1274,7 +1380,7 @@ function canUserAccess(nestId, nodeId, userEmail) {
   if (roles.includes("owner")) {
     return { allowed: true, reason: "nest owner", role: "owner" };
   }
-  if (isSuperAdmin2(userEmail)) {
+  if (isSuperAdmin(userEmail)) {
     return { allowed: true, reason: "super admin", role: "super_admin" };
   }
   if (canViewWith(roles)) {
@@ -1352,6 +1458,7 @@ export {
   ForbiddenError,
   ValidationError,
   ConflictError,
+  LockedError,
   trackEvent,
   startTelemetryLoop,
   getCurrentLicense,
@@ -1362,14 +1469,18 @@ export {
   isSuspended,
   getSuspensionReason,
   validateLicense,
+  loadAccessConfig,
+  isSuperAdmin,
   resolveNestPermission,
   permissionLevel,
   isPublicReader,
+  uniqueNestName,
   isStewardshipEnabled,
   setStewardshipEnabled,
   nestAllowsSelfApprove,
   setAllowSelfApprove,
   disableStewardshipAndWipeGovernance,
+  renameNest,
   createNest,
   importNest,
   listNests,
@@ -1378,8 +1489,6 @@ export {
   getNest,
   deleteNest,
   engineCache,
-  loadAccessConfig,
-  isSuperAdmin,
   buildTitleMap,
   canManageWith,
   assignSteward,

package/dist/{chunk-TDAX3JOT.js → chunk-UEHFNBNR.js}

@@ -14,9 +14,15 @@ var isTestRun = !!process.env.VITEST;
 if (envFileLoaded && !isTestRun) {
   dotenv.config({ path: envFileLoaded, override: true });
 }
+var canonicalEnvFile = process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
+var canonicalEnvLoaded = null;
+if (!isTestRun && canonicalEnvFile !== envFileLoaded && existsSync(canonicalEnvFile)) {
+  dotenv.config({ path: canonicalEnvFile, override: true });
+  canonicalEnvLoaded = canonicalEnvFile;
+}
 if (!isTestRun) {
   console.log(
-    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
+    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}` + (canonicalEnvLoaded ? ` + ${canonicalEnvLoaded}` : "")
   );
 }
 function dataRoot() {
@@ -39,12 +45,29 @@ var config = {
     return process.env.PROMPTOWL_KEY || "";
   },
   /**
-   * Path to the .env file the server reads its config from. Used by
-   * the license install flow to persist PROMPTOWL_KEY alongside any
-   * existing env vars, instead of a separate sidecar file.
+   * Restrict "Sign in with PromptOwl":
+   *   "open"       — anyone may sign in with PromptOwl (default)
+   *   "admin-only" — only the license owner (admin) may; everyone else
+   *                  uses email/password. Admin reaches it via the login
+   *                  page's admin route (?admin=1).
+   *   "disabled"   — nobody may sign in with PromptOwl.
+   * Enforced server-side at the device entry points (POST /auth/device,
+   * GET /auth/device/poll) and the identity point (POST /auth/promptowl).
+   */
+  get PROMPTOWL_SIGN_IN_GATE() {
+    const v = (process.env.PROMPTOWL_SIGN_IN_GATE || "open").trim().toLowerCase();
+    return v === "admin-only" || v === "disabled" ? v : "open";
+  },
+  /**
+   * Path to the .env file the server reads its config from and the license
+   * install flow persists PROMPTOWL_KEY into. Defaults UNDER DATA_ROOT (not
+   * $cwd) so it lands on the writable, volume-mounted, restart-surviving path
+   * in containers — $cwd is /app in the official image: root-owned and
+   * discarded on container recreate, which silently lost the key. The boot
+   * dotenv loader reads this same path (see top of file).
    */
   get ENV_FILE_PATH() {
-    return process.env.ENV_FILE_PATH || join(process.cwd(), ".env");
+    return process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
   },
   get TELEMETRY_ENABLED() {
     return process.env.TELEMETRY_ENABLED !== "false";
@@ -545,6 +568,41 @@ function runMigrations(db2) {
       recordMigration("008_drop_steward_folder_scope");
     })();
   }
+  if (!hasMigration("009_lowercase_emails")) {
+    db2.transaction(() => {
+      const collisions = db2.prepare(
+        `SELECT GROUP_CONCAT(email, ', ') AS emails
+             FROM users GROUP BY LOWER(email) HAVING COUNT(*) > 1`
+      ).all();
+      for (const c of collisions) {
+        console.warn(
+          `[migration 009] case-collision user rows NOT auto-merged: ${c.emails} \u2014 reconcile manually (pick the row the person logs into; reset its password; ensure collaborator/steward grants point at that user_id).`
+        );
+      }
+      db2.exec(
+        `UPDATE users SET email = LOWER(email)
+           WHERE email <> LOWER(email)
+             AND LOWER(email) NOT IN (
+               SELECT LOWER(email) FROM users GROUP BY LOWER(email) HAVING COUNT(*) > 1
+             )`
+      );
+      const remaining = db2.prepare(
+        `SELECT COUNT(*) AS c FROM (
+               SELECT 1 FROM users GROUP BY LOWER(email) HAVING COUNT(*) > 1
+             )`
+      ).get().c;
+      if (remaining === 0) {
+        db2.exec(
+          "CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email_nocase ON users(email COLLATE NOCASE)"
+        );
+      } else {
+        console.warn(
+          `[migration 009] ${remaining} case-collision group(s) remain \u2014 skipping the NOCASE unique index until reconciled.`
+        );
+      }
+    })();
+    recordMigration("009_lowercase_emails");
+  }
 }
 
 // src/db/client.ts