granola-toolkit 0.23.0 → 0.25.0

package/README.md

@@ -103,9 +103,11 @@ Run the local API server:
 granola serve
 granola serve --port 4096
 granola serve --hostname 0.0.0.0 --port 4096
+granola serve --network lan --password "change-me"
 
 granola web
 granola web --open=false --port 4096
+granola web --network lan --password "change-me" --trusted-origins "https://trusted.example"
 ```
 
 ## How It Works
@@ -193,10 +195,13 @@ The machine-readable `export` command includes:
 The initial server API includes:
 
 - `GET /health`
+- `POST /auth/unlock` for password-protected servers
+- `POST /auth/lock` to clear the browser/API unlock cookie
 - `GET /auth/status`
 - `GET /state`
 - `GET /events` for server-sent state updates
 - `GET /meetings`
+- `GET /meetings?refresh=true` to bypass the local meeting index and force a live refresh
 - `GET /meetings/resolve?q=<query>`
 - `GET /meetings/:id`
 - `GET /exports/jobs`
@@ -210,6 +215,14 @@ The initial server API includes:
 
 This is the foundation for the future `granola web` client and any attachable TUI flows.
 
+Server hardening now includes:
+
+- `local` network mode by default, which binds to `127.0.0.1`
+- `lan` network mode when you explicitly want other devices to connect
+- optional password protection for API routes and the browser client
+- trusted-origin checks for browser requests, with CORS headers only for allowed origins
+- a warning when you expose the server on `lan` without a password
+
 ### Web
 
 `web` starts the same local server as `serve`, enables the browser client at `/`, and opens that workspace in your default browser unless you pass `--open=false`.
@@ -217,6 +230,7 @@ This is the foundation for the future `granola web` client and any attachable TU
 The initial browser client includes:
 
 - a searchable meeting list
+- a fast local-index warm start for meeting browsing before live documents finish loading
 - sort and updated-date filters
 - quick open by meeting id or title
 - a focused meeting workspace with notes, transcript, metadata, and raw tabs
@@ -226,6 +240,19 @@ The initial browser client includes:
 - note and transcript export actions backed by the same local API
 - a recent export-jobs panel with rerun actions
 - stronger empty and error states for list/detail failures
+- a server-access panel that can unlock or lock a password-protected local server
+
+### Local Meeting Index
+
+Interactive meeting browsing now keeps a local index of meeting summaries and metadata.
+
+That index is used to:
+
+- make the web meeting list available quickly on startup
+- keep search, sort, and date filtering useful before every live document payload is fetched again
+- refresh itself after successful live loads so the next run starts warm
+
+The web client uses the index as a fast path and upgrades to live data automatically when the background refresh completes. The manual Refresh button bypasses the index and forces a live meeting fetch immediately.
 
 ### Export Jobs
 

package/dist/cli.js

@@ -1419,6 +1419,20 @@ function compareMeetingDocumentsBySort(left, right, sort) {
 		default: return compareMeetingDocuments(left, right);
 	}
 }
+function compareMeetingSummariesByUpdated(left, right) {
+	return compareTimestampsDescending(left.updatedAt, right.updatedAt) || compareTimestampsDescending(left.createdAt, right.createdAt) || compareStrings(left.title || left.id, right.title || right.id) || compareStrings(left.id, right.id);
+}
+function compareMeetingSummariesByTitle(left, right) {
+	return compareStrings(left.title || left.id, right.title || right.id) || compareTimestampsDescending(left.updatedAt, right.updatedAt) || compareStrings(left.id, right.id);
+}
+function compareMeetingSummariesBySort(left, right, sort) {
+	switch (sort) {
+		case "title-asc": return compareMeetingSummariesByTitle(left, right);
+		case "title-desc": return -compareMeetingSummariesByTitle(left, right);
+		case "updated-asc": return -compareMeetingSummariesByUpdated(left, right);
+		default: return compareMeetingSummariesByUpdated(left, right);
+	}
+}
 function serialiseNote(note) {
 	return {
 		content: note.content,
@@ -1482,6 +1496,15 @@ function matchesMeetingSearch(document, search) {
 		...document.tags
 	].some((value) => value.toLowerCase().includes(query));
 }
+function matchesMeetingSummarySearch(meeting, search) {
+	const query = search.trim().toLowerCase();
+	if (!query) return true;
+	return [
+		meeting.id,
+		meeting.title,
+		...meeting.tags
+	].some((value) => value.toLowerCase().includes(query));
+}
 function parseDateFilter(value, label) {
 	const trimmed = value?.trim();
 	if (!trimmed) return;
@@ -1499,6 +1522,15 @@ function matchesUpdatedRange(document, updatedFrom, updatedTo) {
 	if (to != null && updatedAt > to) return false;
 	return true;
 }
+function matchesMeetingSummaryUpdatedRange(meeting, updatedFrom, updatedTo) {
+	const from = parseDateFilter(updatedFrom, "updatedFrom");
+	const to = parseDateFilter(updatedTo, "updatedTo");
+	const updatedAt = parseTimestamp(meeting.updatedAt || meeting.createdAt);
+	if (updatedAt == null) return from == null && to == null;
+	if (from != null && updatedAt < from) return false;
+	if (to != null && updatedAt > to) return false;
+	return true;
+}
 function truncate(value, width) {
 	if (value.length <= width) return value.padEnd(width);
 	return `${value.slice(0, Math.max(0, width - 1))}…`;
@@ -1554,6 +1586,14 @@ function listMeetings(documents, options = {}) {
 	const sort = options.sort ?? "updated-desc";
 	return documents.filter((document) => options.search ? matchesMeetingSearch(document, options.search) : true).filter((document) => matchesUpdatedRange(document, options.updatedFrom, options.updatedTo)).sort((left, right) => compareMeetingDocumentsBySort(left, right, sort)).slice(0, limit).map((document) => buildMeetingSummary(document, options.cacheData));
 }
+function filterMeetingSummaries(meetings, options = {}) {
+	const limit = options.limit ?? 20;
+	const sort = options.sort ?? "updated-desc";
+	return meetings.filter((meeting) => options.search ? matchesMeetingSummarySearch(meeting, options.search) : true).filter((meeting) => matchesMeetingSummaryUpdatedRange(meeting, options.updatedFrom, options.updatedTo)).sort((left, right) => compareMeetingSummariesBySort(left, right, sort)).slice(0, limit).map((meeting) => ({
+		...meeting,
+		tags: [...meeting.tags]
+	}));
+}
 function resolveMeetingQuery(documents, query) {
 	const trimmed = query.trim();
 	if (!trimmed) throw new Error("meeting query is required");
@@ -1640,6 +1680,48 @@ function renderMeetingTranscript(document, cacheData, format = "text") {
 	return renderTranscriptExport(transcript, format);
 }
 //#endregion
+//#region src/meeting-index.ts
+const MEETING_INDEX_VERSION = 1;
+var FileMeetingIndexStore = class {
+	constructor(filePath = defaultMeetingIndexFilePath()) {
+		this.filePath = filePath;
+	}
+	async readIndex() {
+		try {
+			const parsed = parseJsonString(await readFile(this.filePath, "utf8"));
+			if (!parsed || parsed.version !== MEETING_INDEX_VERSION || !Array.isArray(parsed.meetings)) return [];
+			return parsed.meetings.map((meeting) => ({
+				...meeting,
+				tags: [...meeting.tags]
+			}));
+		} catch {
+			return [];
+		}
+	}
+	async writeIndex(meetings) {
+		await mkdir(dirname(this.filePath), { recursive: true });
+		const payload = {
+			meetings: meetings.map((meeting) => ({
+				...meeting,
+				tags: [...meeting.tags]
+			})),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			version: MEETING_INDEX_VERSION
+		};
+		await writeFile(this.filePath, `${JSON.stringify(payload, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+	}
+};
+function defaultMeetingIndexFilePath() {
+	const home = homedir();
+	return platform() === "darwin" ? join(home, "Library", "Application Support", "granola-toolkit", "meeting-index.json") : join(home, ".config", "granola-toolkit", "meeting-index.json");
+}
+function createDefaultMeetingIndexStore() {
+	return new FileMeetingIndexStore();
+}
+//#endregion
 //#region src/app/core.ts
 function transcriptCount(cacheData) {
 	return Object.values(cacheData.transcripts).filter((segments) => segments.length > 0).length;
@@ -1665,6 +1747,7 @@ function cloneState(state) {
 			notes: cloneExportState(state.exports.notes),
 			transcripts: cloneExportState(state.exports.transcripts)
 		},
+		index: { ...state.index },
 		ui: { ...state.ui }
 	};
 }
@@ -1688,6 +1771,12 @@ function defaultState(config, auth, surface) {
 			loaded: false
 		},
 		exports: { jobs: [] },
+		index: {
+			available: false,
+			filePath: defaultMeetingIndexFilePath(),
+			loaded: false,
+			meetingCount: 0
+		},
 		ui: {
 			surface,
 			view: "idle"
@@ -1699,13 +1788,26 @@ var GranolaApp = class {
 	#cacheResolved = false;
 	#granolaClient;
 	#documents;
+	#meetingIndex;
 	#listeners = /* @__PURE__ */ new Set();
+	#refreshingMeetingIndex;
 	#state;
 	constructor(config, deps, options = {}) {
 		this.config = config;
 		this.deps = deps;
 		this.#state = defaultState(config, deps.auth, options.surface ?? "cli");
 		this.#state.exports.jobs = (deps.exportJobs ?? []).map((job) => cloneExportJob(job));
+		this.#meetingIndex = (deps.meetingIndex ?? []).map((meeting) => ({
+			...meeting,
+			tags: [...meeting.tags]
+		}));
+		this.#state.index = {
+			available: this.#meetingIndex.length > 0,
+			filePath: defaultMeetingIndexFilePath(),
+			loaded: this.#meetingIndex.length > 0,
+			loadedAt: this.#meetingIndex.length > 0 ? this.nowIso() : void 0,
+			meetingCount: this.#meetingIndex.length
+		};
 	}
 	getState() {
 		return cloneState(this.#state);
@@ -1742,6 +1844,41 @@ var GranolaApp = class {
 		this.emitStateUpdate();
 		return { ...auth };
 	}
+	async persistMeetingIndex(meetings) {
+		this.#meetingIndex = meetings.map((meeting) => ({
+			...meeting,
+			tags: [...meeting.tags]
+		}));
+		this.#state.index = {
+			available: this.#meetingIndex.length > 0,
+			filePath: this.#state.index.filePath,
+			loaded: this.#meetingIndex.length > 0,
+			loadedAt: this.#meetingIndex.length > 0 ? this.nowIso() : void 0,
+			meetingCount: this.#meetingIndex.length
+		};
+		if (this.deps.meetingIndexStore) await this.deps.meetingIndexStore.writeIndex(this.#meetingIndex);
+		this.emitStateUpdate();
+	}
+	async refreshMeetingIndexFromLiveData() {
+		const cacheData = await this.loadCache();
+		const documents = await this.listDocuments();
+		const meetings = listMeetings(documents, {
+			cacheData,
+			limit: documents.length || 1,
+			sort: "updated-desc"
+		});
+		await this.persistMeetingIndex(meetings);
+	}
+	triggerMeetingIndexRefresh() {
+		if (this.#refreshingMeetingIndex) return;
+		this.#refreshingMeetingIndex = (async () => {
+			try {
+				await this.refreshMeetingIndexFromLiveData();
+			} catch {} finally {
+				this.#refreshingMeetingIndex = void 0;
+			}
+		})();
+	}
 	nowIso() {
 		return (this.deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
 	}
@@ -1875,7 +2012,16 @@ var GranolaApp = class {
 			throw error;
 		}
 	}
-	async listDocuments() {
+	async listDocuments(options = {}) {
+		if (options.forceRefresh) {
+			this.#granolaClient = void 0;
+			this.#documents = void 0;
+			this.#state.documents = {
+				count: 0,
+				loaded: false
+			};
+			this.emitStateUpdate();
+		}
 		if (this.#documents) return this.#documents;
 		const documents = await (await this.getGranolaClient()).listDocuments({ timeoutMs: this.config.notes.timeoutMs });
 		this.#documents = documents;
@@ -1915,15 +2061,41 @@ var GranolaApp = class {
 		return cacheData;
 	}
 	async listMeetings(options = {}) {
-		const meetings = listMeetings(await this.listDocuments(), {
-			cacheData: await this.loadCache(),
+		const preferIndex = options.preferIndex ?? (this.#state.ui.surface === "web" || this.#state.ui.surface === "server");
+		if (!options.forceRefresh && preferIndex && !this.#documents && this.#meetingIndex.length > 0) {
+			const meetings = filterMeetingSummaries(this.#meetingIndex, options);
+			this.setUiState({
+				meetingListSource: "index",
+				meetingSearch: options.search,
+				meetingSort: options.sort,
+				meetingUpdatedFrom: options.updatedFrom,
+				meetingUpdatedTo: options.updatedTo,
+				selectedMeetingId: void 0,
+				view: "meeting-list"
+			});
+			this.triggerMeetingIndexRefresh();
+			return {
+				meetings,
+				source: "index"
+			};
+		}
+		const cacheData = await this.loadCache();
+		const documents = await this.listDocuments({ forceRefresh: options.forceRefresh });
+		const meetings = listMeetings(documents, {
+			cacheData,
 			limit: options.limit,
 			search: options.search,
 			sort: options.sort,
 			updatedFrom: options.updatedFrom,
 			updatedTo: options.updatedTo
 		});
+		await this.persistMeetingIndex(listMeetings(documents, {
+			cacheData,
+			limit: Math.max(documents.length, 1),
+			sort: "updated-desc"
+		}));
 		this.setUiState({
+			meetingListSource: "live",
 			meetingSearch: options.search,
 			meetingSort: options.sort,
 			meetingUpdatedFrom: options.updatedFrom,
@@ -1931,7 +2103,10 @@ var GranolaApp = class {
 			selectedMeetingId: void 0,
 			view: "meeting-list"
 		});
-		return meetings;
+		return {
+			meetings,
+			source: "live"
+		};
 	}
 	async getMeeting(id, options = {}) {
 		const documents = await this.listDocuments();
@@ -2076,13 +2251,17 @@ async function createGranolaApp(config, options = {}) {
 	const auth = await inspectDefaultGranolaAuth(config);
 	const authController = createDefaultGranolaAuthController(config);
 	const exportJobStore = createDefaultExportJobStore();
+	const exportJobs = await exportJobStore.readJobs();
+	const meetingIndexStore = createDefaultMeetingIndexStore();
 	return new GranolaApp(config, {
 		auth,
 		authController,
 		cacheLoader: loadOptionalGranolaCache,
 		createGranolaClient: async (mode) => await createDefaultGranolaRuntime(config, options.logger, { preferredMode: mode }),
-		exportJobs: await exportJobStore.readJobs(),
+		exportJobs,
 		exportJobStore,
+		meetingIndex: await meetingIndexStore.readIndex(),
+		meetingIndexStore,
 		now: options.now
 	}, { surface: options.surface });
 }
@@ -2176,6 +2355,22 @@ function parsePort(value) {
 function pickHostname(value, fallback = "127.0.0.1") {
 	return typeof value === "string" && value.trim() ? value.trim() : fallback;
 }
+function parseNetworkMode(value, fallback = "local") {
+	switch (value) {
+		case void 0: return fallback;
+		case "lan":
+		case "local": return value;
+		default: throw new Error("invalid network mode: expected local or lan");
+	}
+}
+function resolveServerHostname(networkMode, hostnameFlag) {
+	if (hostnameFlag !== void 0) return pickHostname(hostnameFlag, networkMode === "lan" ? "0.0.0.0" : "127.0.0.1");
+	return networkMode === "lan" ? "0.0.0.0" : "127.0.0.1";
+}
+function parseTrustedOrigins(value) {
+	if (typeof value !== "string" || !value.trim()) return [];
+	return value.split(",").map((origin) => origin.trim()).filter(Boolean);
+}
 async function waitForShutdown(close) {
 	await new Promise((resolve, reject) => {
 		let closing = false;
@@ -2527,12 +2722,13 @@ async function list(commandFlags, globalFlags) {
 	debug(config.debug, "timeoutMs", config.notes.timeoutMs);
 	const app = await createGranolaApp(config);
 	debug(config.debug, "authMode", app.getState().auth.mode);
-	console.log("Fetching meetings from Granola API...");
-	const meetings = await app.listMeetings({
+	console.log("Loading meetings...");
+	const result = await app.listMeetings({
 		limit,
 		search
 	});
-	console.log(renderMeetingList(meetings, format).trimEnd());
+	console.log(result.source === "index" ? "Loaded meetings from the local index" : "Fetched meetings from Granola API");
+	console.log(renderMeetingList(result.meetings, format).trimEnd());
 	return 0;
 }
 async function view(id, commandFlags, globalFlags) {
@@ -2665,6 +2861,8 @@ function resolveNoteFormat(value) {
 //#endregion
 //#region src/web/client-script.ts
 const granolaWebClientScript = String.raw`
+const serverConfig = window.__GRANOLA_SERVER__ || { passwordRequired: false };
+
 const state = {
   appState: null,
   detailError: "",
@@ -2675,6 +2873,8 @@ const state = {
   selectedMeeting: null,
   selectedMeetingBundle: null,
   selectedMeetingId: null,
+  meetingSource: "live",
+  serverLocked: Boolean(serverConfig.passwordRequired),
   sort: "updated-desc",
   updatedFrom: "",
   updatedTo: "",
@@ -2694,9 +2894,13 @@ const els = {
   quickOpenButton: document.querySelector("[data-quick-open-button]"),
   refreshButton: document.querySelector("[data-refresh]"),
   search: document.querySelector("[data-search]"),
+  securityPanel: document.querySelector("[data-security-panel]"),
+  serverPassword: document.querySelector("[data-server-password]"),
+  lockServerButton: document.querySelector("[data-lock-server]"),
   sort: document.querySelector("[data-sort]"),
   stateBadge: document.querySelector("[data-state-badge]"),
   transcriptButton: document.querySelector("[data-export-transcripts]"),
+  unlockServerButton: document.querySelector("[data-unlock-server]"),
   updatedFrom: document.querySelector("[data-updated-from]"),
   updatedTo: document.querySelector("[data-updated-to]"),
   workspaceTabs: document.querySelectorAll("[data-workspace-tab]"),
@@ -2751,6 +2955,7 @@ function renderAppState() {
   if (!state.appState) {
     els.appState.innerHTML = "<p>Waiting for server state…</p>";
     els.authPanel.innerHTML = "<p>Waiting for auth state…</p>";
+    renderSecurityPanel();
     return;
   }
 
@@ -2762,6 +2967,11 @@ function renderAppState() {
     : appState.cache.configured
       ? "configured"
       : "not configured";
+  const indexStatus = appState.index.loaded
+    ? appState.index.meetingCount + " meetings"
+    : appState.index.available
+      ? "available"
+      : "not built";
 
   els.appState.innerHTML = [
     '<div class="status-grid">',
@@ -2770,13 +2980,19 @@ function renderAppState() {
     '<div><span class="status-label">Auth</span><strong>' + escapeHtml(authMode) + "</strong></div>",
     '<div><span class="status-label">Documents</span><strong>' + escapeHtml(docs) + "</strong></div>",
     '<div><span class="status-label">Cache</span><strong>' + escapeHtml(cache) + "</strong></div>",
+    '<div><span class="status-label">Index</span><strong>' + escapeHtml(indexStatus) + "</strong></div>",
     "</div>",
   ].join("");
 
+  renderSecurityPanel();
   renderAuthPanel();
   renderExportJobs();
 }
 
+function renderSecurityPanel() {
+  els.securityPanel.hidden = !state.serverLocked;
+}
+
 function authActionButton(label, action, disabled) {
   return (
     '<button class="button button--secondary" data-auth-action="' +
@@ -2994,12 +3210,19 @@ async function fetchJson(path, init) {
   const response = await fetch(path, init);
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    throw new Error(payload.error || response.statusText || "Request failed");
+    if (payload.authRequired) {
+      state.serverLocked = true;
+      renderSecurityPanel();
+    }
+
+    const error = new Error(payload.error || response.statusText || "Request failed");
+    error.authRequired = Boolean(payload.authRequired);
+    throw error;
   }
   return payload;
 }
 
-function buildMeetingsQuery(limit = 100) {
+function buildMeetingsQuery(limit = 100, refresh = false) {
   const params = new URLSearchParams();
   params.set("limit", String(limit));
   params.set("sort", state.sort);
@@ -3016,16 +3239,22 @@ function buildMeetingsQuery(limit = 100) {
     params.set("updatedTo", state.updatedTo);
   }
 
+  if (refresh) {
+    params.set("refresh", "true");
+  }
+
   return "?" + params.toString();
 }
 
 async function loadMeetings(options = {}) {
   const preferredMeetingId = options.preferredMeetingId || state.selectedMeetingId;
+  const refresh = options.refresh === true;
 
   try {
     state.listError = "";
-    const payload = await fetchJson("/meetings" + buildMeetingsQuery());
+    const payload = await fetchJson("/meetings" + buildMeetingsQuery(100, refresh));
     state.meetings = payload.meetings || [];
+    state.meetingSource = payload.source || "live";
 
     if (preferredMeetingId && state.meetings.some((meeting) => meeting.id === preferredMeetingId)) {
       state.selectedMeetingId = preferredMeetingId;
@@ -3094,15 +3323,30 @@ async function quickOpenMeeting() {
   }
 }
 
-async function refreshAll() {
+async function refreshAll(forceLiveMeetings = false) {
   setStatus("Refreshing…", "busy");
-  const [appState, authState] = await Promise.all([fetchJson("/state"), fetchJson("/auth/status"), loadMeetings()]);
-  state.appState = {
-    ...appState,
-    auth: authState,
-  };
-  renderAppState();
-  setStatus("Connected", "ok");
+  try {
+    const [appState, authState] = await Promise.all([
+      fetchJson("/state"),
+      fetchJson("/auth/status"),
+      loadMeetings({ refresh: forceLiveMeetings }),
+    ]);
+    state.serverLocked = false;
+    state.appState = {
+      ...appState,
+      auth: authState,
+    };
+    renderAppState();
+    setStatus(forceLiveMeetings ? "Live data refreshed" : state.meetingSource === "index" ? "Loaded from index" : "Connected", "ok");
+  } catch (error) {
+    if (error.authRequired) {
+      setStatus("Server locked", "error");
+      renderSecurityPanel();
+      return;
+    }
+
+    throw error;
+  }
 }
 
 async function syncAuthState() {
@@ -3204,6 +3448,50 @@ async function switchAuthMode(mode) {
   }
 }
 
+async function unlockServer() {
+  const password = els.serverPassword.value;
+  if (!password.trim()) {
+    setStatus("Enter the server password", "error");
+    return;
+  }
+
+  setStatus("Unlocking server…", "busy");
+  try {
+    await fetchJson("/auth/unlock", {
+      body: JSON.stringify({ password }),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    els.serverPassword.value = "";
+    state.serverLocked = false;
+    await refreshAll(true);
+  } catch (error) {
+    setStatus("Unlock failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
+async function lockServer() {
+  try {
+    await fetchJson("/auth/lock", {
+      method: "POST",
+    });
+  } catch {}
+
+  state.serverLocked = true;
+  state.appState = null;
+  state.meetings = [];
+  state.selectedMeeting = null;
+  state.selectedMeetingBundle = null;
+  state.detailError = "";
+  els.serverPassword.value = "";
+  renderSecurityPanel();
+  renderMeetingList();
+  renderMeetingDetail();
+  setStatus("Server locked", "error");
+}
+
 els.list.addEventListener("click", (event) => {
   if (!(event.target instanceof Element)) {
     return;
@@ -3257,8 +3545,27 @@ els.authPanel.addEventListener("click", (event) => {
   void switchAuthMode(modeButton.dataset.authMode);
 });
 
+els.unlockServerButton.addEventListener("click", () => {
+  void unlockServer();
+});
+
+els.lockServerButton.addEventListener("click", () => {
+  void lockServer();
+});
+
+els.serverPassword.addEventListener("keydown", (event) => {
+  if (!(event.target instanceof HTMLInputElement)) {
+    return;
+  }
+
+  if (event.key === "Enter") {
+    event.preventDefault();
+    void unlockServer();
+  }
+});
+
 els.refreshButton.addEventListener("click", () => {
-  void refreshAll();
+  void refreshAll(true);
 });
 
 els.noteButton.addEventListener("click", () => {
@@ -3383,15 +3690,27 @@ document.addEventListener("keydown", (event) => {
 
 const events = new EventSource("/events");
 events.addEventListener("state.updated", (event) => {
+  const previousLoadedAt = state.appState?.documents?.loadedAt;
   const payload = JSON.parse(event.data);
   state.appState = payload.state;
   renderAppState();
+
+  if (
+    state.meetingSource === "index" &&
+    payload.state.documents?.loadedAt &&
+    payload.state.documents.loadedAt !== previousLoadedAt
+  ) {
+    void loadMeetings({
+      preferredMeetingId: state.selectedMeetingId,
+    });
+  }
 });
 events.addEventListener("error", () => {
   setStatus("Disconnected", "error");
 });
 
 syncFilterInputs();
+renderSecurityPanel();
 
 void refreshAll().catch((error) => {
   setStatus("Error", "error");
@@ -3455,6 +3774,19 @@ const granolaWebMarkup = String.raw`
       </div>
       <p>Initial beta web client. It speaks to the same local API that future TUI and attach flows will use.</p>
     </section>
+    <section class="security-panel" data-security-panel hidden>
+      <div class="security-panel__head">
+        <h3>Server Access</h3>
+        <p>This server is locked with a password. Unlock it to load meetings and live state.</p>
+      </div>
+      <div class="security-panel__body">
+        <input class="field-input" data-server-password type="password" placeholder="Server password" />
+        <div class="toolbar-actions">
+          <button class="button button--primary" data-unlock-server>Unlock</button>
+          <button class="button button--secondary" data-lock-server>Lock</button>
+        </div>
+      </div>
+    </section>
     <section class="auth-panel">
       <div class="auth-panel__head">
         <h3>Auth Session</h3>
@@ -3692,10 +4024,12 @@ body {
 }
 
 .auth-panel,
+.security-panel,
 .jobs-panel {
   padding: 0 24px 18px;
 }
 
+.security-panel__head h3,
 .auth-panel__head h3,
 .jobs-panel__head h3 {
   margin: 0;
@@ -3704,6 +4038,7 @@ body {
   text-transform: uppercase;
 }
 
+.security-panel__head p,
 .auth-panel__head p,
 .jobs-panel__head p {
   margin: 6px 0 0;
@@ -3711,6 +4046,7 @@ body {
   font-size: 0.9rem;
 }
 
+.security-panel__body,
 .auth-panel__body {
   display: grid;
   gap: 12px;
@@ -3961,7 +4297,7 @@ body {
 `;
 //#endregion
 //#region src/server/web.ts
-function renderGranolaWebPage() {
+function renderGranolaWebPage(options = {}) {
 	return `<!doctype html>
 <html lang="en">
   <head>
@@ -3975,6 +4311,7 @@ ${granolaWebStyles}
   <body>
 ${granolaWebMarkup}
     <script type="module">
+window.__GRANOLA_SERVER__ = ${JSON.stringify({ passwordRequired: options.serverPasswordRequired ?? false })};
 ${granolaWebClientScript}
     <\/script>
   </body>
@@ -3982,6 +4319,7 @@ ${granolaWebClientScript}
 }
 //#endregion
 //#region src/server/http.ts
+const PASSWORD_COOKIE_NAME = "granola_toolkit_password";
 function parseInteger(value) {
 	if (!value?.trim()) return;
 	if (!/^\d+$/.test(value)) throw new Error("invalid limit: expected a positive integer");
@@ -4011,24 +4349,31 @@ function sendJson(response, body, init = {}) {
 	const payload = `${JSON.stringify(body, null, 2)}\n`;
 	response.writeHead(init.status ?? 200, {
 		"content-length": Buffer.byteLength(payload),
-		"content-type": "application/json; charset=utf-8"
+		"content-type": "application/json; charset=utf-8",
+		...init.headers
 	});
 	response.end(payload);
 }
-function sendText(response, body, status = 200) {
+function sendText(response, body, status = 200, headers = {}) {
 	response.writeHead(status, {
 		"content-length": Buffer.byteLength(body),
-		"content-type": "text/plain; charset=utf-8"
+		"content-type": "text/plain; charset=utf-8",
+		...headers
 	});
 	response.end(body);
 }
-function sendHtml(response, body, status = 200) {
+function sendHtml(response, body, status = 200, headers = {}) {
 	response.writeHead(status, {
 		"content-length": Buffer.byteLength(body),
-		"content-type": "text/html; charset=utf-8"
+		"content-type": "text/html; charset=utf-8",
+		...headers
 	});
 	response.end(body);
 }
+function sendNoContent(response, status = 204, headers = {}) {
+	response.writeHead(status, headers);
+	response.end();
+}
 async function readJsonBody(request) {
 	const chunks = [];
 	for await (const chunk of request) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
@@ -4064,17 +4409,90 @@ function transcriptFormatFromBody(value) {
 		default: throw new Error("invalid transcript format: expected text, json, yaml, or raw");
 	}
 }
+function parseCookies(request) {
+	const header = request.headers.cookie;
+	if (!header) return {};
+	const cookies = {};
+	for (const chunk of header.split(";")) {
+		const [name, ...valueParts] = chunk.trim().split("=");
+		if (!name) continue;
+		cookies[name] = decodeURIComponent(valueParts.join("="));
+	}
+	return cookies;
+}
+function passwordCookieHeader(password) {
+	return `${PASSWORD_COOKIE_NAME}=${encodeURIComponent(password)}; HttpOnly; Path=/; SameSite=Strict`;
+}
+function clearPasswordCookieHeader() {
+	return `${PASSWORD_COOKIE_NAME}=; HttpOnly; Path=/; Max-Age=0; SameSite=Strict`;
+}
+function allowedOriginHeaders(origin) {
+	return {
+		"access-control-allow-credentials": "true",
+		"access-control-allow-headers": "content-type, x-granola-password",
+		"access-control-allow-methods": "GET, POST, OPTIONS",
+		"access-control-allow-origin": origin,
+		vary: "Origin"
+	};
+}
+function isTrustedOrigin(origin, request, trustedOrigins) {
+	if (!origin) return true;
+	try {
+		const parsed = new URL(origin);
+		const host = request.headers.host;
+		if (host && parsed.host === host) return true;
+	} catch {
+		return false;
+	}
+	return trustedOrigins.includes(origin);
+}
+function isPasswordAuthenticated(request, password) {
+	const headerPassword = request.headers["x-granola-password"];
+	if (typeof headerPassword === "string" && headerPassword === password) return true;
+	const authorization = request.headers.authorization;
+	if (authorization?.startsWith("Bearer ")) return authorization.slice(7) === password;
+	return parseCookies(request)[PASSWORD_COOKIE_NAME] === password;
+}
+function publicRoute(path, enableWebClient) {
+	return path === "/health" || path === "/auth/unlock" || enableWebClient && path === "/";
+}
 async function startGranolaServer(app, options = {}) {
 	const enableWebClient = options.enableWebClient ?? false;
 	const hostname = options.hostname ?? "127.0.0.1";
 	const port = options.port ?? 0;
+	const security = {
+		password: options.security?.password?.trim() || void 0,
+		trustedOrigins: (options.security?.trustedOrigins ?? []).map((origin) => origin.trim()).filter(Boolean)
+	};
 	const server = createServer(async (request, response) => {
 		const method = request.method ?? "GET";
 		const url = new URL(request.url ?? "/", `http://${hostname}`);
 		const path = url.pathname;
+		const origin = request.headers.origin?.trim();
+		const trustedOrigin = isTrustedOrigin(origin, request, security.trustedOrigins);
+		const originHeaders = origin && trustedOrigin ? allowedOriginHeaders(origin) : {};
 		try {
+			if (origin && !trustedOrigin) {
+				sendJson(response, { error: `origin not trusted: ${origin}` }, {
+					headers: originHeaders,
+					status: 403
+				});
+				return;
+			}
+			if (method === "OPTIONS") {
+				if (!origin) {
+					sendNoContent(response, 204);
+					return;
+				}
+				if (!trustedOrigin) {
+					sendNoContent(response, 403);
+					return;
+				}
+				sendNoContent(response, 204, originHeaders);
+				return;
+			}
 			if (method === "GET" && path === "/" && enableWebClient) {
-				sendHtml(response, renderGranolaWebPage());
+				sendHtml(response, renderGranolaWebPage({ serverPasswordRequired: Boolean(security.password) }), 200, originHeaders);
 				return;
 			}
 			if (method === "GET" && path === "/health") {
@@ -4082,22 +4500,69 @@ async function startGranolaServer(app, options = {}) {
 					ok: true,
 					service: "granola-toolkit",
 					version: app.config ? void 0 : void 0
+				}, { headers: originHeaders });
+				return;
+			}
+			if (method === "POST" && path === "/auth/unlock") {
+				if (!security.password) {
+					sendJson(response, {
+						ok: true,
+						passwordRequired: false
+					}, { headers: originHeaders });
+					return;
+				}
+				const body = await readJsonBody(request);
+				const password = typeof body.password === "string" && body.password.trim() ? body.password : void 0;
+				if (!password || password !== security.password) {
+					sendJson(response, {
+						authRequired: true,
+						error: "invalid server password"
+					}, {
+						headers: originHeaders,
+						status: 401
+					});
+					return;
+				}
+				sendJson(response, {
+					ok: true,
+					passwordRequired: true
+				}, { headers: {
+					...originHeaders,
+					"set-cookie": passwordCookieHeader(security.password)
+				} });
+				return;
+			}
+			if (security.password && !publicRoute(path, enableWebClient) && !isPasswordAuthenticated(request, security.password)) {
+				sendJson(response, {
+					authRequired: true,
+					error: "server password required"
+				}, {
+					headers: originHeaders,
+					status: 401
 				});
 				return;
 			}
 			if (method === "GET" && path === "/state") {
-				sendJson(response, app.getState());
+				sendJson(response, app.getState(), { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path === "/auth/status") {
-				sendJson(response, await app.inspectAuth());
+				sendJson(response, await app.inspectAuth(), { headers: originHeaders });
+				return;
+			}
+			if (method === "POST" && path === "/auth/lock") {
+				sendJson(response, { ok: true }, { headers: {
+					...originHeaders,
+					"set-cookie": clearPasswordCookieHeader()
+				} });
 				return;
 			}
 			if (method === "GET" && path === "/events") {
 				response.writeHead(200, {
 					"cache-control": "no-cache, no-transform",
 					connection: "keep-alive",
-					"content-type": "text/event-stream; charset=utf-8"
+					"content-type": "text/event-stream; charset=utf-8",
+					...originHeaders
 				});
 				response.write(formatSseEvent({
 					state: app.getState(),
@@ -4115,80 +4580,97 @@ async function startGranolaServer(app, options = {}) {
 			}
 			if (method === "GET" && path === "/meetings") {
 				const limit = parseInteger(url.searchParams.get("limit"));
+				const refresh = url.searchParams.get("refresh") === "true";
 				const search = url.searchParams.get("search")?.trim() || void 0;
 				const sort = parseMeetingSort(url.searchParams.get("sort"));
 				const updatedFrom = url.searchParams.get("updatedFrom")?.trim() || void 0;
 				const updatedTo = url.searchParams.get("updatedTo")?.trim() || void 0;
-				sendJson(response, {
-					meetings: await app.listMeetings({
-						limit,
-						search,
-						sort,
-						updatedFrom,
-						updatedTo
-					}),
+				const result = await app.listMeetings({
+					forceRefresh: refresh,
+					limit,
 					search,
 					sort,
 					updatedFrom,
 					updatedTo
 				});
+				sendJson(response, {
+					meetings: result.meetings,
+					refresh,
+					search,
+					source: result.source,
+					sort,
+					updatedFrom,
+					updatedTo
+				}, { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path === "/meetings/resolve") {
 				const query = url.searchParams.get("q")?.trim();
 				if (!query) throw new Error("meeting query is required");
-				sendJson(response, await app.findMeeting(query, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
+				sendJson(response, await app.findMeeting(query, { requireCache: url.searchParams.get("includeTranscript") === "true" }), { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path.startsWith("/meetings/")) {
 				const id = decodeURIComponent(path.slice(10));
 				if (!id) throw new Error("meeting id is required");
-				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
+				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/login") {
 				const body = await readJsonBody(request);
 				const supabasePath = typeof body.supabasePath === "string" && body.supabasePath.trim() ? body.supabasePath.trim() : void 0;
-				sendJson(response, await app.loginAuth({ supabasePath }));
+				sendJson(response, await app.loginAuth({ supabasePath }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/logout") {
-				sendJson(response, await app.logoutAuth());
+				sendJson(response, await app.logoutAuth(), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/refresh") {
-				sendJson(response, await app.refreshAuth());
+				sendJson(response, await app.refreshAuth(), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/mode") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)));
+				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/exports/notes") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), { status: 202 });
+				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
 			if (method === "GET" && path === "/exports/jobs") {
 				const limit = parseInteger(url.searchParams.get("limit"));
-				sendJson(response, await app.listExportJobs({ limit }));
+				sendJson(response, await app.listExportJobs({ limit }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path.startsWith("/exports/jobs/") && path.endsWith("/rerun")) {
 				const id = decodeURIComponent(path.slice(14, -6));
 				if (!id) throw new Error("export job id is required");
-				sendJson(response, await app.rerunExportJob(id), { status: 202 });
+				sendJson(response, await app.rerunExportJob(id), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
 			if (method === "POST" && path === "/exports/transcripts") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.exportTranscripts(transcriptFormatFromBody(body.format)), { status: 202 });
+				sendJson(response, await app.exportTranscripts(transcriptFormatFromBody(body.format)), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
-			sendText(response, "Not found\n", 404);
+			sendText(response, "Not found\n", 404, originHeaders);
 		} catch (error) {
-			sendJson(response, { error: error instanceof Error ? error.message : String(error) }, { status: 400 });
+			sendJson(response, { error: error instanceof Error ? error.message : String(error) }, {
+				headers: originHeaders,
+				status: 400
+			});
 		}
 	});
 	await new Promise((resolve, reject) => {
@@ -4230,14 +4712,17 @@ Usage:
   granola serve [options]
 
 Options:
-  --hostname <value>  Hostname to bind (default: 127.0.0.1)
-  --port <value>      Port to bind (default: 0 for any available port)
-  --cache <path>      Path to Granola cache JSON
-  --timeout <value>   Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
-  --supabase <path>   Path to supabase.json
-  --debug             Enable debug logging
-  --config <path>     Path to .granola.toml
-  -h, --help          Show help
+  --network <mode>        Network mode: local or lan (default: local)
+  --hostname <value>      Hostname to bind (overrides network default)
+  --port <value>          Port to bind (default: 0 for any available port)
+  --password <value>      Optional server password for API and browser access
+  --trusted-origins <v>   Comma-separated extra browser origins to trust
+  --cache <path>          Path to Granola cache JSON
+  --timeout <value>       Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
+  --supabase <path>       Path to supabase.json
+  --debug                 Enable debug logging
+  --config <path>         Path to .granola.toml
+  -h, --help              Show help
 `;
 }
 const serveCommand = {
@@ -4246,8 +4731,11 @@ const serveCommand = {
 		cache: { type: "string" },
 		help: { type: "boolean" },
 		hostname: { type: "string" },
+		network: { type: "string" },
+		password: { type: "string" },
 		port: { type: "string" },
-		timeout: { type: "string" }
+		timeout: { type: "string" },
+		"trusted-origins": { type: "string" }
 	},
 	help: serveHelp,
 	name: "serve",
@@ -4260,13 +4748,29 @@ const serveCommand = {
 		debug(config.debug, "supabase", config.supabase);
 		debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
 		debug(config.debug, "timeoutMs", config.notes.timeoutMs);
-		const server = await startGranolaServer(await createGranolaApp(config, { surface: "server" }), {
-			hostname: pickHostname(commandFlags.hostname),
-			port: parsePort(commandFlags.port)
+		const app = await createGranolaApp(config, { surface: "server" });
+		const networkMode = parseNetworkMode(commandFlags.network);
+		const hostname = resolveServerHostname(networkMode, commandFlags.hostname);
+		const port = parsePort(commandFlags.port);
+		const password = typeof commandFlags.password === "string" && commandFlags.password.trim() ? commandFlags.password : void 0;
+		const trustedOrigins = parseTrustedOrigins(commandFlags["trusted-origins"]);
+		const server = await startGranolaServer(app, {
+			hostname,
+			port,
+			security: {
+				password,
+				trustedOrigins
+			}
 		});
 		console.log(`Granola server listening on ${server.url.href}`);
+		console.log(`Network mode: ${networkMode}`);
+		if (password) console.log("Server password protection: enabled");
+		else if (networkMode === "lan") console.log("Warning: LAN mode is enabled without a server password");
+		if (trustedOrigins.length > 0) console.log(`Trusted origins: ${trustedOrigins.join(", ")}`);
 		console.log("Endpoints:");
 		console.log("  GET  /health");
+		console.log("  POST /auth/unlock");
+		console.log("  POST /auth/lock");
 		console.log("  GET  /auth/status");
 		console.log("  GET  /state");
 		console.log("  GET  /events");
@@ -4379,8 +4883,11 @@ Usage:
   granola web [options]
 
 Options:
-  --hostname <value>      Hostname to bind (default: 127.0.0.1)
+  --network <mode>        Network mode: local or lan (default: local)
+  --hostname <value>      Hostname to bind (overrides network default)
   --port <value>          Port to bind (default: 0 for any available port)
+  --password <value>      Optional server password for API and browser access
+  --trusted-origins <v>   Comma-separated extra browser origins to trust
   --cache <path>          Path to Granola cache JSON
   --timeout <value>       Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
   --supabase <path>       Path to supabase.json
@@ -4405,9 +4912,12 @@ const commands = [
 			cache: { type: "string" },
 			help: { type: "boolean" },
 			hostname: { type: "string" },
+			network: { type: "string" },
 			open: { type: "boolean" },
+			password: { type: "string" },
 			port: { type: "string" },
-			timeout: { type: "string" }
+			timeout: { type: "string" },
+			"trusted-origins": { type: "string" }
 		},
 		help: webHelp,
 		name: "web",
@@ -4421,18 +4931,31 @@ const commands = [
 			debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
 			debug(config.debug, "timeoutMs", config.notes.timeoutMs);
 			const app = await createGranolaApp(config, { surface: "web" });
-			const hostname = pickHostname(commandFlags.hostname);
+			const networkMode = parseNetworkMode(commandFlags.network);
+			const hostname = resolveServerHostname(networkMode, commandFlags.hostname);
 			const port = parsePort(commandFlags.port);
 			const openBrowser = commandFlags.open !== false;
+			const password = typeof commandFlags.password === "string" && commandFlags.password.trim() ? commandFlags.password : void 0;
+			const trustedOrigins = parseTrustedOrigins(commandFlags["trusted-origins"]);
 			const server = await startGranolaServer(app, {
 				enableWebClient: true,
 				hostname,
-				port
+				port,
+				security: {
+					password,
+					trustedOrigins
+				}
 			});
 			console.log(`Granola Toolkit web workspace listening on ${server.url.href}`);
+			console.log(`Network mode: ${networkMode}`);
+			if (password) console.log("Server password protection: enabled");
+			else if (networkMode === "lan") console.log("Warning: LAN mode is enabled without a server password");
+			if (trustedOrigins.length > 0) console.log(`Trusted origins: ${trustedOrigins.join(", ")}`);
 			console.log("Routes:");
 			console.log("  GET  /");
 			console.log("  GET  /health");
+			console.log("  POST /auth/unlock");
+			console.log("  POST /auth/lock");
 			console.log("  GET  /auth/status");
 			console.log("  GET  /state");
 			console.log("  GET  /events");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granola-toolkit",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Toolkit for exporting and working with Granola meetings, notes, and transcripts",
   "keywords": [
     "cli",