granola-toolkit 0.24.0 → 0.25.0

package/README.md

@@ -103,9 +103,11 @@ Run the local API server:
 granola serve
 granola serve --port 4096
 granola serve --hostname 0.0.0.0 --port 4096
+granola serve --network lan --password "change-me"
 
 granola web
 granola web --open=false --port 4096
+granola web --network lan --password "change-me" --trusted-origins "https://trusted.example"
 ```
 
 ## How It Works
@@ -193,6 +195,8 @@ The machine-readable `export` command includes:
 The initial server API includes:
 
 - `GET /health`
+- `POST /auth/unlock` for password-protected servers
+- `POST /auth/lock` to clear the browser/API unlock cookie
 - `GET /auth/status`
 - `GET /state`
 - `GET /events` for server-sent state updates
@@ -211,6 +215,14 @@ The initial server API includes:
 
 This is the foundation for the future `granola web` client and any attachable TUI flows.
 
+Server hardening now includes:
+
+- `local` network mode by default, which binds to `127.0.0.1`
+- `lan` network mode when you explicitly want other devices to connect
+- optional password protection for API routes and the browser client
+- trusted-origin checks for browser requests, with CORS headers only for allowed origins
+- a warning when you expose the server on `lan` without a password
+
 ### Web
 
 `web` starts the same local server as `serve`, enables the browser client at `/`, and opens that workspace in your default browser unless you pass `--open=false`.
@@ -228,6 +240,7 @@ The initial browser client includes:
 - note and transcript export actions backed by the same local API
 - a recent export-jobs panel with rerun actions
 - stronger empty and error states for list/detail failures
+- a server-access panel that can unlock or lock a password-protected local server
 
 ### Local Meeting Index
 

package/dist/cli.js

@@ -2355,6 +2355,22 @@ function parsePort(value) {
 function pickHostname(value, fallback = "127.0.0.1") {
 	return typeof value === "string" && value.trim() ? value.trim() : fallback;
 }
+function parseNetworkMode(value, fallback = "local") {
+	switch (value) {
+		case void 0: return fallback;
+		case "lan":
+		case "local": return value;
+		default: throw new Error("invalid network mode: expected local or lan");
+	}
+}
+function resolveServerHostname(networkMode, hostnameFlag) {
+	if (hostnameFlag !== void 0) return pickHostname(hostnameFlag, networkMode === "lan" ? "0.0.0.0" : "127.0.0.1");
+	return networkMode === "lan" ? "0.0.0.0" : "127.0.0.1";
+}
+function parseTrustedOrigins(value) {
+	if (typeof value !== "string" || !value.trim()) return [];
+	return value.split(",").map((origin) => origin.trim()).filter(Boolean);
+}
 async function waitForShutdown(close) {
 	await new Promise((resolve, reject) => {
 		let closing = false;
@@ -2845,6 +2861,8 @@ function resolveNoteFormat(value) {
 //#endregion
 //#region src/web/client-script.ts
 const granolaWebClientScript = String.raw`
+const serverConfig = window.__GRANOLA_SERVER__ || { passwordRequired: false };
+
 const state = {
   appState: null,
   detailError: "",
@@ -2856,6 +2874,7 @@ const state = {
   selectedMeetingBundle: null,
   selectedMeetingId: null,
   meetingSource: "live",
+  serverLocked: Boolean(serverConfig.passwordRequired),
   sort: "updated-desc",
   updatedFrom: "",
   updatedTo: "",
@@ -2875,9 +2894,13 @@ const els = {
   quickOpenButton: document.querySelector("[data-quick-open-button]"),
   refreshButton: document.querySelector("[data-refresh]"),
   search: document.querySelector("[data-search]"),
+  securityPanel: document.querySelector("[data-security-panel]"),
+  serverPassword: document.querySelector("[data-server-password]"),
+  lockServerButton: document.querySelector("[data-lock-server]"),
   sort: document.querySelector("[data-sort]"),
   stateBadge: document.querySelector("[data-state-badge]"),
   transcriptButton: document.querySelector("[data-export-transcripts]"),
+  unlockServerButton: document.querySelector("[data-unlock-server]"),
   updatedFrom: document.querySelector("[data-updated-from]"),
   updatedTo: document.querySelector("[data-updated-to]"),
   workspaceTabs: document.querySelectorAll("[data-workspace-tab]"),
@@ -2932,6 +2955,7 @@ function renderAppState() {
   if (!state.appState) {
     els.appState.innerHTML = "<p>Waiting for server state…</p>";
     els.authPanel.innerHTML = "<p>Waiting for auth state…</p>";
+    renderSecurityPanel();
     return;
   }
 
@@ -2960,10 +2984,15 @@ function renderAppState() {
     "</div>",
   ].join("");
 
+  renderSecurityPanel();
   renderAuthPanel();
   renderExportJobs();
 }
 
+function renderSecurityPanel() {
+  els.securityPanel.hidden = !state.serverLocked;
+}
+
 function authActionButton(label, action, disabled) {
   return (
     '<button class="button button--secondary" data-auth-action="' +
@@ -3181,7 +3210,14 @@ async function fetchJson(path, init) {
   const response = await fetch(path, init);
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    throw new Error(payload.error || response.statusText || "Request failed");
+    if (payload.authRequired) {
+      state.serverLocked = true;
+      renderSecurityPanel();
+    }
+
+    const error = new Error(payload.error || response.statusText || "Request failed");
+    error.authRequired = Boolean(payload.authRequired);
+    throw error;
   }
   return payload;
 }
@@ -3289,17 +3325,28 @@ async function quickOpenMeeting() {
 
 async function refreshAll(forceLiveMeetings = false) {
   setStatus("Refreshing…", "busy");
-  const [appState, authState] = await Promise.all([
-    fetchJson("/state"),
-    fetchJson("/auth/status"),
-    loadMeetings({ refresh: forceLiveMeetings }),
-  ]);
-  state.appState = {
-    ...appState,
-    auth: authState,
-  };
-  renderAppState();
-  setStatus(forceLiveMeetings ? "Live data refreshed" : state.meetingSource === "index" ? "Loaded from index" : "Connected", "ok");
+  try {
+    const [appState, authState] = await Promise.all([
+      fetchJson("/state"),
+      fetchJson("/auth/status"),
+      loadMeetings({ refresh: forceLiveMeetings }),
+    ]);
+    state.serverLocked = false;
+    state.appState = {
+      ...appState,
+      auth: authState,
+    };
+    renderAppState();
+    setStatus(forceLiveMeetings ? "Live data refreshed" : state.meetingSource === "index" ? "Loaded from index" : "Connected", "ok");
+  } catch (error) {
+    if (error.authRequired) {
+      setStatus("Server locked", "error");
+      renderSecurityPanel();
+      return;
+    }
+
+    throw error;
+  }
 }
 
 async function syncAuthState() {
@@ -3401,6 +3448,50 @@ async function switchAuthMode(mode) {
   }
 }
 
+async function unlockServer() {
+  const password = els.serverPassword.value;
+  if (!password.trim()) {
+    setStatus("Enter the server password", "error");
+    return;
+  }
+
+  setStatus("Unlocking server…", "busy");
+  try {
+    await fetchJson("/auth/unlock", {
+      body: JSON.stringify({ password }),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    els.serverPassword.value = "";
+    state.serverLocked = false;
+    await refreshAll(true);
+  } catch (error) {
+    setStatus("Unlock failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
+async function lockServer() {
+  try {
+    await fetchJson("/auth/lock", {
+      method: "POST",
+    });
+  } catch {}
+
+  state.serverLocked = true;
+  state.appState = null;
+  state.meetings = [];
+  state.selectedMeeting = null;
+  state.selectedMeetingBundle = null;
+  state.detailError = "";
+  els.serverPassword.value = "";
+  renderSecurityPanel();
+  renderMeetingList();
+  renderMeetingDetail();
+  setStatus("Server locked", "error");
+}
+
 els.list.addEventListener("click", (event) => {
   if (!(event.target instanceof Element)) {
     return;
@@ -3454,6 +3545,25 @@ els.authPanel.addEventListener("click", (event) => {
   void switchAuthMode(modeButton.dataset.authMode);
 });
 
+els.unlockServerButton.addEventListener("click", () => {
+  void unlockServer();
+});
+
+els.lockServerButton.addEventListener("click", () => {
+  void lockServer();
+});
+
+els.serverPassword.addEventListener("keydown", (event) => {
+  if (!(event.target instanceof HTMLInputElement)) {
+    return;
+  }
+
+  if (event.key === "Enter") {
+    event.preventDefault();
+    void unlockServer();
+  }
+});
+
 els.refreshButton.addEventListener("click", () => {
   void refreshAll(true);
 });
@@ -3600,6 +3710,7 @@ events.addEventListener("error", () => {
 });
 
 syncFilterInputs();
+renderSecurityPanel();
 
 void refreshAll().catch((error) => {
   setStatus("Error", "error");
@@ -3663,6 +3774,19 @@ const granolaWebMarkup = String.raw`
       </div>
       <p>Initial beta web client. It speaks to the same local API that future TUI and attach flows will use.</p>
     </section>
+    <section class="security-panel" data-security-panel hidden>
+      <div class="security-panel__head">
+        <h3>Server Access</h3>
+        <p>This server is locked with a password. Unlock it to load meetings and live state.</p>
+      </div>
+      <div class="security-panel__body">
+        <input class="field-input" data-server-password type="password" placeholder="Server password" />
+        <div class="toolbar-actions">
+          <button class="button button--primary" data-unlock-server>Unlock</button>
+          <button class="button button--secondary" data-lock-server>Lock</button>
+        </div>
+      </div>
+    </section>
     <section class="auth-panel">
       <div class="auth-panel__head">
         <h3>Auth Session</h3>
@@ -3900,10 +4024,12 @@ body {
 }
 
 .auth-panel,
+.security-panel,
 .jobs-panel {
   padding: 0 24px 18px;
 }
 
+.security-panel__head h3,
 .auth-panel__head h3,
 .jobs-panel__head h3 {
   margin: 0;
@@ -3912,6 +4038,7 @@ body {
   text-transform: uppercase;
 }
 
+.security-panel__head p,
 .auth-panel__head p,
 .jobs-panel__head p {
   margin: 6px 0 0;
@@ -3919,6 +4046,7 @@ body {
   font-size: 0.9rem;
 }
 
+.security-panel__body,
 .auth-panel__body {
   display: grid;
   gap: 12px;
@@ -4169,7 +4297,7 @@ body {
 `;
 //#endregion
 //#region src/server/web.ts
-function renderGranolaWebPage() {
+function renderGranolaWebPage(options = {}) {
 	return `<!doctype html>
 <html lang="en">
   <head>
@@ -4183,6 +4311,7 @@ ${granolaWebStyles}
   <body>
 ${granolaWebMarkup}
     <script type="module">
+window.__GRANOLA_SERVER__ = ${JSON.stringify({ passwordRequired: options.serverPasswordRequired ?? false })};
 ${granolaWebClientScript}
     <\/script>
   </body>
@@ -4190,6 +4319,7 @@ ${granolaWebClientScript}
 }
 //#endregion
 //#region src/server/http.ts
+const PASSWORD_COOKIE_NAME = "granola_toolkit_password";
 function parseInteger(value) {
 	if (!value?.trim()) return;
 	if (!/^\d+$/.test(value)) throw new Error("invalid limit: expected a positive integer");
@@ -4219,24 +4349,31 @@ function sendJson(response, body, init = {}) {
 	const payload = `${JSON.stringify(body, null, 2)}\n`;
 	response.writeHead(init.status ?? 200, {
 		"content-length": Buffer.byteLength(payload),
-		"content-type": "application/json; charset=utf-8"
+		"content-type": "application/json; charset=utf-8",
+		...init.headers
 	});
 	response.end(payload);
 }
-function sendText(response, body, status = 200) {
+function sendText(response, body, status = 200, headers = {}) {
 	response.writeHead(status, {
 		"content-length": Buffer.byteLength(body),
-		"content-type": "text/plain; charset=utf-8"
+		"content-type": "text/plain; charset=utf-8",
+		...headers
 	});
 	response.end(body);
 }
-function sendHtml(response, body, status = 200) {
+function sendHtml(response, body, status = 200, headers = {}) {
 	response.writeHead(status, {
 		"content-length": Buffer.byteLength(body),
-		"content-type": "text/html; charset=utf-8"
+		"content-type": "text/html; charset=utf-8",
+		...headers
 	});
 	response.end(body);
 }
+function sendNoContent(response, status = 204, headers = {}) {
+	response.writeHead(status, headers);
+	response.end();
+}
 async function readJsonBody(request) {
 	const chunks = [];
 	for await (const chunk of request) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
@@ -4272,17 +4409,90 @@ function transcriptFormatFromBody(value) {
 		default: throw new Error("invalid transcript format: expected text, json, yaml, or raw");
 	}
 }
+function parseCookies(request) {
+	const header = request.headers.cookie;
+	if (!header) return {};
+	const cookies = {};
+	for (const chunk of header.split(";")) {
+		const [name, ...valueParts] = chunk.trim().split("=");
+		if (!name) continue;
+		cookies[name] = decodeURIComponent(valueParts.join("="));
+	}
+	return cookies;
+}
+function passwordCookieHeader(password) {
+	return `${PASSWORD_COOKIE_NAME}=${encodeURIComponent(password)}; HttpOnly; Path=/; SameSite=Strict`;
+}
+function clearPasswordCookieHeader() {
+	return `${PASSWORD_COOKIE_NAME}=; HttpOnly; Path=/; Max-Age=0; SameSite=Strict`;
+}
+function allowedOriginHeaders(origin) {
+	return {
+		"access-control-allow-credentials": "true",
+		"access-control-allow-headers": "content-type, x-granola-password",
+		"access-control-allow-methods": "GET, POST, OPTIONS",
+		"access-control-allow-origin": origin,
+		vary: "Origin"
+	};
+}
+function isTrustedOrigin(origin, request, trustedOrigins) {
+	if (!origin) return true;
+	try {
+		const parsed = new URL(origin);
+		const host = request.headers.host;
+		if (host && parsed.host === host) return true;
+	} catch {
+		return false;
+	}
+	return trustedOrigins.includes(origin);
+}
+function isPasswordAuthenticated(request, password) {
+	const headerPassword = request.headers["x-granola-password"];
+	if (typeof headerPassword === "string" && headerPassword === password) return true;
+	const authorization = request.headers.authorization;
+	if (authorization?.startsWith("Bearer ")) return authorization.slice(7) === password;
+	return parseCookies(request)[PASSWORD_COOKIE_NAME] === password;
+}
+function publicRoute(path, enableWebClient) {
+	return path === "/health" || path === "/auth/unlock" || enableWebClient && path === "/";
+}
 async function startGranolaServer(app, options = {}) {
 	const enableWebClient = options.enableWebClient ?? false;
 	const hostname = options.hostname ?? "127.0.0.1";
 	const port = options.port ?? 0;
+	const security = {
+		password: options.security?.password?.trim() || void 0,
+		trustedOrigins: (options.security?.trustedOrigins ?? []).map((origin) => origin.trim()).filter(Boolean)
+	};
 	const server = createServer(async (request, response) => {
 		const method = request.method ?? "GET";
 		const url = new URL(request.url ?? "/", `http://${hostname}`);
 		const path = url.pathname;
+		const origin = request.headers.origin?.trim();
+		const trustedOrigin = isTrustedOrigin(origin, request, security.trustedOrigins);
+		const originHeaders = origin && trustedOrigin ? allowedOriginHeaders(origin) : {};
 		try {
+			if (origin && !trustedOrigin) {
+				sendJson(response, { error: `origin not trusted: ${origin}` }, {
+					headers: originHeaders,
+					status: 403
+				});
+				return;
+			}
+			if (method === "OPTIONS") {
+				if (!origin) {
+					sendNoContent(response, 204);
+					return;
+				}
+				if (!trustedOrigin) {
+					sendNoContent(response, 403);
+					return;
+				}
+				sendNoContent(response, 204, originHeaders);
+				return;
+			}
 			if (method === "GET" && path === "/" && enableWebClient) {
-				sendHtml(response, renderGranolaWebPage());
+				sendHtml(response, renderGranolaWebPage({ serverPasswordRequired: Boolean(security.password) }), 200, originHeaders);
 				return;
 			}
 			if (method === "GET" && path === "/health") {
@@ -4290,22 +4500,69 @@ async function startGranolaServer(app, options = {}) {
 					ok: true,
 					service: "granola-toolkit",
 					version: app.config ? void 0 : void 0
+				}, { headers: originHeaders });
+				return;
+			}
+			if (method === "POST" && path === "/auth/unlock") {
+				if (!security.password) {
+					sendJson(response, {
+						ok: true,
+						passwordRequired: false
+					}, { headers: originHeaders });
+					return;
+				}
+				const body = await readJsonBody(request);
+				const password = typeof body.password === "string" && body.password.trim() ? body.password : void 0;
+				if (!password || password !== security.password) {
+					sendJson(response, {
+						authRequired: true,
+						error: "invalid server password"
+					}, {
+						headers: originHeaders,
+						status: 401
+					});
+					return;
+				}
+				sendJson(response, {
+					ok: true,
+					passwordRequired: true
+				}, { headers: {
+					...originHeaders,
+					"set-cookie": passwordCookieHeader(security.password)
+				} });
+				return;
+			}
+			if (security.password && !publicRoute(path, enableWebClient) && !isPasswordAuthenticated(request, security.password)) {
+				sendJson(response, {
+					authRequired: true,
+					error: "server password required"
+				}, {
+					headers: originHeaders,
+					status: 401
 				});
 				return;
 			}
 			if (method === "GET" && path === "/state") {
-				sendJson(response, app.getState());
+				sendJson(response, app.getState(), { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path === "/auth/status") {
-				sendJson(response, await app.inspectAuth());
+				sendJson(response, await app.inspectAuth(), { headers: originHeaders });
+				return;
+			}
+			if (method === "POST" && path === "/auth/lock") {
+				sendJson(response, { ok: true }, { headers: {
+					...originHeaders,
+					"set-cookie": clearPasswordCookieHeader()
+				} });
 				return;
 			}
 			if (method === "GET" && path === "/events") {
 				response.writeHead(200, {
 					"cache-control": "no-cache, no-transform",
 					connection: "keep-alive",
-					"content-type": "text/event-stream; charset=utf-8"
+					"content-type": "text/event-stream; charset=utf-8",
+					...originHeaders
 				});
 				response.write(formatSseEvent({
 					state: app.getState(),
@@ -4344,64 +4601,76 @@ async function startGranolaServer(app, options = {}) {
 					sort,
 					updatedFrom,
 					updatedTo
-				});
+				}, { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path === "/meetings/resolve") {
 				const query = url.searchParams.get("q")?.trim();
 				if (!query) throw new Error("meeting query is required");
-				sendJson(response, await app.findMeeting(query, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
+				sendJson(response, await app.findMeeting(query, { requireCache: url.searchParams.get("includeTranscript") === "true" }), { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path.startsWith("/meetings/")) {
 				const id = decodeURIComponent(path.slice(10));
 				if (!id) throw new Error("meeting id is required");
-				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
+				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/login") {
 				const body = await readJsonBody(request);
 				const supabasePath = typeof body.supabasePath === "string" && body.supabasePath.trim() ? body.supabasePath.trim() : void 0;
-				sendJson(response, await app.loginAuth({ supabasePath }));
+				sendJson(response, await app.loginAuth({ supabasePath }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/logout") {
-				sendJson(response, await app.logoutAuth());
+				sendJson(response, await app.logoutAuth(), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/refresh") {
-				sendJson(response, await app.refreshAuth());
+				sendJson(response, await app.refreshAuth(), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/mode") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)));
+				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/exports/notes") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), { status: 202 });
+				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
 			if (method === "GET" && path === "/exports/jobs") {
 				const limit = parseInteger(url.searchParams.get("limit"));
-				sendJson(response, await app.listExportJobs({ limit }));
+				sendJson(response, await app.listExportJobs({ limit }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path.startsWith("/exports/jobs/") && path.endsWith("/rerun")) {
 				const id = decodeURIComponent(path.slice(14, -6));
 				if (!id) throw new Error("export job id is required");
-				sendJson(response, await app.rerunExportJob(id), { status: 202 });
+				sendJson(response, await app.rerunExportJob(id), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
 			if (method === "POST" && path === "/exports/transcripts") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.exportTranscripts(transcriptFormatFromBody(body.format)), { status: 202 });
+				sendJson(response, await app.exportTranscripts(transcriptFormatFromBody(body.format)), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
-			sendText(response, "Not found\n", 404);
+			sendText(response, "Not found\n", 404, originHeaders);
 		} catch (error) {
-			sendJson(response, { error: error instanceof Error ? error.message : String(error) }, { status: 400 });
+			sendJson(response, { error: error instanceof Error ? error.message : String(error) }, {
+				headers: originHeaders,
+				status: 400
+			});
 		}
 	});
 	await new Promise((resolve, reject) => {
@@ -4443,14 +4712,17 @@ Usage:
   granola serve [options]
 
 Options:
-  --hostname <value>  Hostname to bind (default: 127.0.0.1)
-  --port <value>      Port to bind (default: 0 for any available port)
-  --cache <path>      Path to Granola cache JSON
-  --timeout <value>   Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
-  --supabase <path>   Path to supabase.json
-  --debug             Enable debug logging
-  --config <path>     Path to .granola.toml
-  -h, --help          Show help
+  --network <mode>        Network mode: local or lan (default: local)
+  --hostname <value>      Hostname to bind (overrides network default)
+  --port <value>          Port to bind (default: 0 for any available port)
+  --password <value>      Optional server password for API and browser access
+  --trusted-origins <v>   Comma-separated extra browser origins to trust
+  --cache <path>          Path to Granola cache JSON
+  --timeout <value>       Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
+  --supabase <path>       Path to supabase.json
+  --debug                 Enable debug logging
+  --config <path>         Path to .granola.toml
+  -h, --help              Show help
 `;
 }
 const serveCommand = {
@@ -4459,8 +4731,11 @@ const serveCommand = {
 		cache: { type: "string" },
 		help: { type: "boolean" },
 		hostname: { type: "string" },
+		network: { type: "string" },
+		password: { type: "string" },
 		port: { type: "string" },
-		timeout: { type: "string" }
+		timeout: { type: "string" },
+		"trusted-origins": { type: "string" }
 	},
 	help: serveHelp,
 	name: "serve",
@@ -4473,13 +4748,29 @@ const serveCommand = {
 		debug(config.debug, "supabase", config.supabase);
 		debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
 		debug(config.debug, "timeoutMs", config.notes.timeoutMs);
-		const server = await startGranolaServer(await createGranolaApp(config, { surface: "server" }), {
-			hostname: pickHostname(commandFlags.hostname),
-			port: parsePort(commandFlags.port)
+		const app = await createGranolaApp(config, { surface: "server" });
+		const networkMode = parseNetworkMode(commandFlags.network);
+		const hostname = resolveServerHostname(networkMode, commandFlags.hostname);
+		const port = parsePort(commandFlags.port);
+		const password = typeof commandFlags.password === "string" && commandFlags.password.trim() ? commandFlags.password : void 0;
+		const trustedOrigins = parseTrustedOrigins(commandFlags["trusted-origins"]);
+		const server = await startGranolaServer(app, {
+			hostname,
+			port,
+			security: {
+				password,
+				trustedOrigins
+			}
 		});
 		console.log(`Granola server listening on ${server.url.href}`);
+		console.log(`Network mode: ${networkMode}`);
+		if (password) console.log("Server password protection: enabled");
+		else if (networkMode === "lan") console.log("Warning: LAN mode is enabled without a server password");
+		if (trustedOrigins.length > 0) console.log(`Trusted origins: ${trustedOrigins.join(", ")}`);
 		console.log("Endpoints:");
 		console.log("  GET  /health");
+		console.log("  POST /auth/unlock");
+		console.log("  POST /auth/lock");
 		console.log("  GET  /auth/status");
 		console.log("  GET  /state");
 		console.log("  GET  /events");
@@ -4592,8 +4883,11 @@ Usage:
   granola web [options]
 
 Options:
-  --hostname <value>      Hostname to bind (default: 127.0.0.1)
+  --network <mode>        Network mode: local or lan (default: local)
+  --hostname <value>      Hostname to bind (overrides network default)
   --port <value>          Port to bind (default: 0 for any available port)
+  --password <value>      Optional server password for API and browser access
+  --trusted-origins <v>   Comma-separated extra browser origins to trust
   --cache <path>          Path to Granola cache JSON
   --timeout <value>       Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
   --supabase <path>       Path to supabase.json
@@ -4618,9 +4912,12 @@ const commands = [
 			cache: { type: "string" },
 			help: { type: "boolean" },
 			hostname: { type: "string" },
+			network: { type: "string" },
 			open: { type: "boolean" },
+			password: { type: "string" },
 			port: { type: "string" },
-			timeout: { type: "string" }
+			timeout: { type: "string" },
+			"trusted-origins": { type: "string" }
 		},
 		help: webHelp,
 		name: "web",
@@ -4634,18 +4931,31 @@ const commands = [
 			debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
 			debug(config.debug, "timeoutMs", config.notes.timeoutMs);
 			const app = await createGranolaApp(config, { surface: "web" });
-			const hostname = pickHostname(commandFlags.hostname);
+			const networkMode = parseNetworkMode(commandFlags.network);
+			const hostname = resolveServerHostname(networkMode, commandFlags.hostname);
 			const port = parsePort(commandFlags.port);
 			const openBrowser = commandFlags.open !== false;
+			const password = typeof commandFlags.password === "string" && commandFlags.password.trim() ? commandFlags.password : void 0;
+			const trustedOrigins = parseTrustedOrigins(commandFlags["trusted-origins"]);
 			const server = await startGranolaServer(app, {
 				enableWebClient: true,
 				hostname,
-				port
+				port,
+				security: {
+					password,
+					trustedOrigins
+				}
 			});
 			console.log(`Granola Toolkit web workspace listening on ${server.url.href}`);
+			console.log(`Network mode: ${networkMode}`);
+			if (password) console.log("Server password protection: enabled");
+			else if (networkMode === "lan") console.log("Warning: LAN mode is enabled without a server password");
+			if (trustedOrigins.length > 0) console.log(`Trusted origins: ${trustedOrigins.join(", ")}`);
 			console.log("Routes:");
 			console.log("  GET  /");
 			console.log("  GET  /health");
+			console.log("  POST /auth/unlock");
+			console.log("  POST /auth/lock");
 			console.log("  GET  /auth/status");
 			console.log("  GET  /state");
 			console.log("  GET  /events");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granola-toolkit",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Toolkit for exporting and working with Granola meetings, notes, and transcripts",
   "keywords": [
     "cli",