granola-toolkit 0.24.0 → 0.26.0

package/dist/cli.js

@@ -8,6 +8,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { createHash, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
+import { Input, ProcessTerminal, TUI, matchesKey, truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@mariozechner/pi-tui";
 //#region src/utils.ts
 const INVALID_FILENAME_CHARS = /[<>:"/\\|?*]/g;
 const CONTROL_CHARACTERS = /\p{Cc}/gu;
@@ -2355,6 +2356,22 @@ function parsePort(value) {
 function pickHostname(value, fallback = "127.0.0.1") {
 	return typeof value === "string" && value.trim() ? value.trim() : fallback;
 }
+function parseNetworkMode(value, fallback = "local") {
+	switch (value) {
+		case void 0: return fallback;
+		case "lan":
+		case "local": return value;
+		default: throw new Error("invalid network mode: expected local or lan");
+	}
+}
+function resolveServerHostname(networkMode, hostnameFlag) {
+	if (hostnameFlag !== void 0) return pickHostname(hostnameFlag, networkMode === "lan" ? "0.0.0.0" : "127.0.0.1");
+	return networkMode === "lan" ? "0.0.0.0" : "127.0.0.1";
+}
+function parseTrustedOrigins(value) {
+	if (typeof value !== "string" || !value.trim()) return [];
+	return value.split(",").map((origin) => origin.trim()).filter(Boolean);
+}
 async function waitForShutdown(close) {
 	await new Promise((resolve, reject) => {
 		let closing = false;
@@ -2845,6 +2862,8 @@ function resolveNoteFormat(value) {
 //#endregion
 //#region src/web/client-script.ts
 const granolaWebClientScript = String.raw`
+const serverConfig = window.__GRANOLA_SERVER__ || { passwordRequired: false };
+
 const state = {
   appState: null,
   detailError: "",
@@ -2856,6 +2875,7 @@ const state = {
   selectedMeetingBundle: null,
   selectedMeetingId: null,
   meetingSource: "live",
+  serverLocked: Boolean(serverConfig.passwordRequired),
   sort: "updated-desc",
   updatedFrom: "",
   updatedTo: "",
@@ -2875,9 +2895,13 @@ const els = {
   quickOpenButton: document.querySelector("[data-quick-open-button]"),
   refreshButton: document.querySelector("[data-refresh]"),
   search: document.querySelector("[data-search]"),
+  securityPanel: document.querySelector("[data-security-panel]"),
+  serverPassword: document.querySelector("[data-server-password]"),
+  lockServerButton: document.querySelector("[data-lock-server]"),
   sort: document.querySelector("[data-sort]"),
   stateBadge: document.querySelector("[data-state-badge]"),
   transcriptButton: document.querySelector("[data-export-transcripts]"),
+  unlockServerButton: document.querySelector("[data-unlock-server]"),
   updatedFrom: document.querySelector("[data-updated-from]"),
   updatedTo: document.querySelector("[data-updated-to]"),
   workspaceTabs: document.querySelectorAll("[data-workspace-tab]"),
@@ -2932,6 +2956,7 @@ function renderAppState() {
   if (!state.appState) {
     els.appState.innerHTML = "<p>Waiting for server state…</p>";
     els.authPanel.innerHTML = "<p>Waiting for auth state…</p>";
+    renderSecurityPanel();
     return;
   }
 
@@ -2960,10 +2985,15 @@ function renderAppState() {
     "</div>",
   ].join("");
 
+  renderSecurityPanel();
   renderAuthPanel();
   renderExportJobs();
 }
 
+function renderSecurityPanel() {
+  els.securityPanel.hidden = !state.serverLocked;
+}
+
 function authActionButton(label, action, disabled) {
   return (
     '<button class="button button--secondary" data-auth-action="' +
@@ -3181,7 +3211,14 @@ async function fetchJson(path, init) {
   const response = await fetch(path, init);
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    throw new Error(payload.error || response.statusText || "Request failed");
+    if (payload.authRequired) {
+      state.serverLocked = true;
+      renderSecurityPanel();
+    }
+
+    const error = new Error(payload.error || response.statusText || "Request failed");
+    error.authRequired = Boolean(payload.authRequired);
+    throw error;
   }
   return payload;
 }
@@ -3289,17 +3326,28 @@ async function quickOpenMeeting() {
 
 async function refreshAll(forceLiveMeetings = false) {
   setStatus("Refreshing…", "busy");
-  const [appState, authState] = await Promise.all([
-    fetchJson("/state"),
-    fetchJson("/auth/status"),
-    loadMeetings({ refresh: forceLiveMeetings }),
-  ]);
-  state.appState = {
-    ...appState,
-    auth: authState,
-  };
-  renderAppState();
-  setStatus(forceLiveMeetings ? "Live data refreshed" : state.meetingSource === "index" ? "Loaded from index" : "Connected", "ok");
+  try {
+    const [appState, authState] = await Promise.all([
+      fetchJson("/state"),
+      fetchJson("/auth/status"),
+      loadMeetings({ refresh: forceLiveMeetings }),
+    ]);
+    state.serverLocked = false;
+    state.appState = {
+      ...appState,
+      auth: authState,
+    };
+    renderAppState();
+    setStatus(forceLiveMeetings ? "Live data refreshed" : state.meetingSource === "index" ? "Loaded from index" : "Connected", "ok");
+  } catch (error) {
+    if (error.authRequired) {
+      setStatus("Server locked", "error");
+      renderSecurityPanel();
+      return;
+    }
+
+    throw error;
+  }
 }
 
 async function syncAuthState() {
@@ -3401,6 +3449,50 @@ async function switchAuthMode(mode) {
   }
 }
 
+async function unlockServer() {
+  const password = els.serverPassword.value;
+  if (!password.trim()) {
+    setStatus("Enter the server password", "error");
+    return;
+  }
+
+  setStatus("Unlocking server…", "busy");
+  try {
+    await fetchJson("/auth/unlock", {
+      body: JSON.stringify({ password }),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    els.serverPassword.value = "";
+    state.serverLocked = false;
+    await refreshAll(true);
+  } catch (error) {
+    setStatus("Unlock failed", "error");
+    state.detailError = error instanceof Error ? error.message : String(error);
+    renderMeetingDetail();
+  }
+}
+
+async function lockServer() {
+  try {
+    await fetchJson("/auth/lock", {
+      method: "POST",
+    });
+  } catch {}
+
+  state.serverLocked = true;
+  state.appState = null;
+  state.meetings = [];
+  state.selectedMeeting = null;
+  state.selectedMeetingBundle = null;
+  state.detailError = "";
+  els.serverPassword.value = "";
+  renderSecurityPanel();
+  renderMeetingList();
+  renderMeetingDetail();
+  setStatus("Server locked", "error");
+}
+
 els.list.addEventListener("click", (event) => {
   if (!(event.target instanceof Element)) {
     return;
@@ -3454,6 +3546,25 @@ els.authPanel.addEventListener("click", (event) => {
   void switchAuthMode(modeButton.dataset.authMode);
 });
 
+els.unlockServerButton.addEventListener("click", () => {
+  void unlockServer();
+});
+
+els.lockServerButton.addEventListener("click", () => {
+  void lockServer();
+});
+
+els.serverPassword.addEventListener("keydown", (event) => {
+  if (!(event.target instanceof HTMLInputElement)) {
+    return;
+  }
+
+  if (event.key === "Enter") {
+    event.preventDefault();
+    void unlockServer();
+  }
+});
+
 els.refreshButton.addEventListener("click", () => {
   void refreshAll(true);
 });
@@ -3600,6 +3711,7 @@ events.addEventListener("error", () => {
 });
 
 syncFilterInputs();
+renderSecurityPanel();
 
 void refreshAll().catch((error) => {
   setStatus("Error", "error");
@@ -3663,6 +3775,19 @@ const granolaWebMarkup = String.raw`
       </div>
       <p>Initial beta web client. It speaks to the same local API that future TUI and attach flows will use.</p>
     </section>
+    <section class="security-panel" data-security-panel hidden>
+      <div class="security-panel__head">
+        <h3>Server Access</h3>
+        <p>This server is locked with a password. Unlock it to load meetings and live state.</p>
+      </div>
+      <div class="security-panel__body">
+        <input class="field-input" data-server-password type="password" placeholder="Server password" />
+        <div class="toolbar-actions">
+          <button class="button button--primary" data-unlock-server>Unlock</button>
+          <button class="button button--secondary" data-lock-server>Lock</button>
+        </div>
+      </div>
+    </section>
     <section class="auth-panel">
       <div class="auth-panel__head">
         <h3>Auth Session</h3>
@@ -3900,10 +4025,12 @@ body {
 }
 
 .auth-panel,
+.security-panel,
 .jobs-panel {
   padding: 0 24px 18px;
 }
 
+.security-panel__head h3,
 .auth-panel__head h3,
 .jobs-panel__head h3 {
   margin: 0;
@@ -3912,6 +4039,7 @@ body {
   text-transform: uppercase;
 }
 
+.security-panel__head p,
 .auth-panel__head p,
 .jobs-panel__head p {
   margin: 6px 0 0;
@@ -3919,6 +4047,7 @@ body {
   font-size: 0.9rem;
 }
 
+.security-panel__body,
 .auth-panel__body {
   display: grid;
   gap: 12px;
@@ -4169,7 +4298,7 @@ body {
 `;
 //#endregion
 //#region src/server/web.ts
-function renderGranolaWebPage() {
+function renderGranolaWebPage(options = {}) {
 	return `<!doctype html>
 <html lang="en">
   <head>
@@ -4183,6 +4312,7 @@ ${granolaWebStyles}
   <body>
 ${granolaWebMarkup}
     <script type="module">
+window.__GRANOLA_SERVER__ = ${JSON.stringify({ passwordRequired: options.serverPasswordRequired ?? false })};
 ${granolaWebClientScript}
     <\/script>
   </body>
@@ -4190,6 +4320,7 @@ ${granolaWebClientScript}
 }
 //#endregion
 //#region src/server/http.ts
+const PASSWORD_COOKIE_NAME = "granola_toolkit_password";
 function parseInteger(value) {
 	if (!value?.trim()) return;
 	if (!/^\d+$/.test(value)) throw new Error("invalid limit: expected a positive integer");
@@ -4219,24 +4350,31 @@ function sendJson(response, body, init = {}) {
 	const payload = `${JSON.stringify(body, null, 2)}\n`;
 	response.writeHead(init.status ?? 200, {
 		"content-length": Buffer.byteLength(payload),
-		"content-type": "application/json; charset=utf-8"
+		"content-type": "application/json; charset=utf-8",
+		...init.headers
 	});
 	response.end(payload);
 }
-function sendText(response, body, status = 200) {
+function sendText(response, body, status = 200, headers = {}) {
 	response.writeHead(status, {
 		"content-length": Buffer.byteLength(body),
-		"content-type": "text/plain; charset=utf-8"
+		"content-type": "text/plain; charset=utf-8",
+		...headers
 	});
 	response.end(body);
 }
-function sendHtml(response, body, status = 200) {
+function sendHtml(response, body, status = 200, headers = {}) {
 	response.writeHead(status, {
 		"content-length": Buffer.byteLength(body),
-		"content-type": "text/html; charset=utf-8"
+		"content-type": "text/html; charset=utf-8",
+		...headers
 	});
 	response.end(body);
 }
+function sendNoContent(response, status = 204, headers = {}) {
+	response.writeHead(status, headers);
+	response.end();
+}
 async function readJsonBody(request) {
 	const chunks = [];
 	for await (const chunk of request) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
@@ -4272,17 +4410,90 @@ function transcriptFormatFromBody(value) {
 		default: throw new Error("invalid transcript format: expected text, json, yaml, or raw");
 	}
 }
+function parseCookies(request) {
+	const header = request.headers.cookie;
+	if (!header) return {};
+	const cookies = {};
+	for (const chunk of header.split(";")) {
+		const [name, ...valueParts] = chunk.trim().split("=");
+		if (!name) continue;
+		cookies[name] = decodeURIComponent(valueParts.join("="));
+	}
+	return cookies;
+}
+function passwordCookieHeader(password) {
+	return `${PASSWORD_COOKIE_NAME}=${encodeURIComponent(password)}; HttpOnly; Path=/; SameSite=Strict`;
+}
+function clearPasswordCookieHeader() {
+	return `${PASSWORD_COOKIE_NAME}=; HttpOnly; Path=/; Max-Age=0; SameSite=Strict`;
+}
+function allowedOriginHeaders(origin) {
+	return {
+		"access-control-allow-credentials": "true",
+		"access-control-allow-headers": "content-type, x-granola-password",
+		"access-control-allow-methods": "GET, POST, OPTIONS",
+		"access-control-allow-origin": origin,
+		vary: "Origin"
+	};
+}
+function isTrustedOrigin(origin, request, trustedOrigins) {
+	if (!origin) return true;
+	try {
+		const parsed = new URL(origin);
+		const host = request.headers.host;
+		if (host && parsed.host === host) return true;
+	} catch {
+		return false;
+	}
+	return trustedOrigins.includes(origin);
+}
+function isPasswordAuthenticated(request, password) {
+	const headerPassword = request.headers["x-granola-password"];
+	if (typeof headerPassword === "string" && headerPassword === password) return true;
+	const authorization = request.headers.authorization;
+	if (authorization?.startsWith("Bearer ")) return authorization.slice(7) === password;
+	return parseCookies(request)[PASSWORD_COOKIE_NAME] === password;
+}
+function publicRoute(path, enableWebClient) {
+	return path === "/health" || path === "/auth/unlock" || enableWebClient && path === "/";
+}
 async function startGranolaServer(app, options = {}) {
 	const enableWebClient = options.enableWebClient ?? false;
 	const hostname = options.hostname ?? "127.0.0.1";
 	const port = options.port ?? 0;
+	const security = {
+		password: options.security?.password?.trim() || void 0,
+		trustedOrigins: (options.security?.trustedOrigins ?? []).map((origin) => origin.trim()).filter(Boolean)
+	};
 	const server = createServer(async (request, response) => {
 		const method = request.method ?? "GET";
 		const url = new URL(request.url ?? "/", `http://${hostname}`);
 		const path = url.pathname;
+		const origin = request.headers.origin?.trim();
+		const trustedOrigin = isTrustedOrigin(origin, request, security.trustedOrigins);
+		const originHeaders = origin && trustedOrigin ? allowedOriginHeaders(origin) : {};
 		try {
+			if (origin && !trustedOrigin) {
+				sendJson(response, { error: `origin not trusted: ${origin}` }, {
+					headers: originHeaders,
+					status: 403
+				});
+				return;
+			}
+			if (method === "OPTIONS") {
+				if (!origin) {
+					sendNoContent(response, 204);
+					return;
+				}
+				if (!trustedOrigin) {
+					sendNoContent(response, 403);
+					return;
+				}
+				sendNoContent(response, 204, originHeaders);
+				return;
+			}
 			if (method === "GET" && path === "/" && enableWebClient) {
-				sendHtml(response, renderGranolaWebPage());
+				sendHtml(response, renderGranolaWebPage({ serverPasswordRequired: Boolean(security.password) }), 200, originHeaders);
 				return;
 			}
 			if (method === "GET" && path === "/health") {
@@ -4290,22 +4501,69 @@ async function startGranolaServer(app, options = {}) {
 					ok: true,
 					service: "granola-toolkit",
 					version: app.config ? void 0 : void 0
+				}, { headers: originHeaders });
+				return;
+			}
+			if (method === "POST" && path === "/auth/unlock") {
+				if (!security.password) {
+					sendJson(response, {
+						ok: true,
+						passwordRequired: false
+					}, { headers: originHeaders });
+					return;
+				}
+				const body = await readJsonBody(request);
+				const password = typeof body.password === "string" && body.password.trim() ? body.password : void 0;
+				if (!password || password !== security.password) {
+					sendJson(response, {
+						authRequired: true,
+						error: "invalid server password"
+					}, {
+						headers: originHeaders,
+						status: 401
+					});
+					return;
+				}
+				sendJson(response, {
+					ok: true,
+					passwordRequired: true
+				}, { headers: {
+					...originHeaders,
+					"set-cookie": passwordCookieHeader(security.password)
+				} });
+				return;
+			}
+			if (security.password && !publicRoute(path, enableWebClient) && !isPasswordAuthenticated(request, security.password)) {
+				sendJson(response, {
+					authRequired: true,
+					error: "server password required"
+				}, {
+					headers: originHeaders,
+					status: 401
 				});
 				return;
 			}
 			if (method === "GET" && path === "/state") {
-				sendJson(response, app.getState());
+				sendJson(response, app.getState(), { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path === "/auth/status") {
-				sendJson(response, await app.inspectAuth());
+				sendJson(response, await app.inspectAuth(), { headers: originHeaders });
+				return;
+			}
+			if (method === "POST" && path === "/auth/lock") {
+				sendJson(response, { ok: true }, { headers: {
+					...originHeaders,
+					"set-cookie": clearPasswordCookieHeader()
+				} });
 				return;
 			}
 			if (method === "GET" && path === "/events") {
 				response.writeHead(200, {
 					"cache-control": "no-cache, no-transform",
 					connection: "keep-alive",
-					"content-type": "text/event-stream; charset=utf-8"
+					"content-type": "text/event-stream; charset=utf-8",
+					...originHeaders
 				});
 				response.write(formatSseEvent({
 					state: app.getState(),
@@ -4344,64 +4602,76 @@ async function startGranolaServer(app, options = {}) {
 					sort,
 					updatedFrom,
 					updatedTo
-				});
+				}, { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path === "/meetings/resolve") {
 				const query = url.searchParams.get("q")?.trim();
 				if (!query) throw new Error("meeting query is required");
-				sendJson(response, await app.findMeeting(query, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
+				sendJson(response, await app.findMeeting(query, { requireCache: url.searchParams.get("includeTranscript") === "true" }), { headers: originHeaders });
 				return;
 			}
 			if (method === "GET" && path.startsWith("/meetings/")) {
 				const id = decodeURIComponent(path.slice(10));
 				if (!id) throw new Error("meeting id is required");
-				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }));
+				sendJson(response, await app.getMeeting(id, { requireCache: url.searchParams.get("includeTranscript") === "true" }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/login") {
 				const body = await readJsonBody(request);
 				const supabasePath = typeof body.supabasePath === "string" && body.supabasePath.trim() ? body.supabasePath.trim() : void 0;
-				sendJson(response, await app.loginAuth({ supabasePath }));
+				sendJson(response, await app.loginAuth({ supabasePath }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/logout") {
-				sendJson(response, await app.logoutAuth());
+				sendJson(response, await app.logoutAuth(), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/refresh") {
-				sendJson(response, await app.refreshAuth());
+				sendJson(response, await app.refreshAuth(), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/auth/mode") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)));
+				sendJson(response, await app.switchAuthMode(parseAuthMode(body.mode)), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path === "/exports/notes") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), { status: 202 });
+				sendJson(response, await app.exportNotes(noteFormatFromBody(body.format)), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
 			if (method === "GET" && path === "/exports/jobs") {
 				const limit = parseInteger(url.searchParams.get("limit"));
-				sendJson(response, await app.listExportJobs({ limit }));
+				sendJson(response, await app.listExportJobs({ limit }), { headers: originHeaders });
 				return;
 			}
 			if (method === "POST" && path.startsWith("/exports/jobs/") && path.endsWith("/rerun")) {
 				const id = decodeURIComponent(path.slice(14, -6));
 				if (!id) throw new Error("export job id is required");
-				sendJson(response, await app.rerunExportJob(id), { status: 202 });
+				sendJson(response, await app.rerunExportJob(id), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
 			if (method === "POST" && path === "/exports/transcripts") {
 				const body = await readJsonBody(request);
-				sendJson(response, await app.exportTranscripts(transcriptFormatFromBody(body.format)), { status: 202 });
+				sendJson(response, await app.exportTranscripts(transcriptFormatFromBody(body.format)), {
+					headers: originHeaders,
+					status: 202
+				});
 				return;
 			}
-			sendText(response, "Not found\n", 404);
+			sendText(response, "Not found\n", 404, originHeaders);
 		} catch (error) {
-			sendJson(response, { error: error instanceof Error ? error.message : String(error) }, { status: 400 });
+			sendJson(response, { error: error instanceof Error ? error.message : String(error) }, {
+				headers: originHeaders,
+				status: 400
+			});
 		}
 	});
 	await new Promise((resolve, reject) => {
@@ -4443,14 +4713,17 @@ Usage:
   granola serve [options]
 
 Options:
-  --hostname <value>  Hostname to bind (default: 127.0.0.1)
-  --port <value>      Port to bind (default: 0 for any available port)
-  --cache <path>      Path to Granola cache JSON
-  --timeout <value>   Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
-  --supabase <path>   Path to supabase.json
-  --debug             Enable debug logging
-  --config <path>     Path to .granola.toml
-  -h, --help          Show help
+  --network <mode>        Network mode: local or lan (default: local)
+  --hostname <value>      Hostname to bind (overrides network default)
+  --port <value>          Port to bind (default: 0 for any available port)
+  --password <value>      Optional server password for API and browser access
+  --trusted-origins <v>   Comma-separated extra browser origins to trust
+  --cache <path>          Path to Granola cache JSON
+  --timeout <value>       Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
+  --supabase <path>       Path to supabase.json
+  --debug                 Enable debug logging
+  --config <path>         Path to .granola.toml
+  -h, --help              Show help
 `;
 }
 const serveCommand = {
@@ -4459,8 +4732,11 @@ const serveCommand = {
 		cache: { type: "string" },
 		help: { type: "boolean" },
 		hostname: { type: "string" },
+		network: { type: "string" },
+		password: { type: "string" },
 		port: { type: "string" },
-		timeout: { type: "string" }
+		timeout: { type: "string" },
+		"trusted-origins": { type: "string" }
 	},
 	help: serveHelp,
 	name: "serve",
@@ -4473,13 +4749,29 @@ const serveCommand = {
 		debug(config.debug, "supabase", config.supabase);
 		debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
 		debug(config.debug, "timeoutMs", config.notes.timeoutMs);
-		const server = await startGranolaServer(await createGranolaApp(config, { surface: "server" }), {
-			hostname: pickHostname(commandFlags.hostname),
-			port: parsePort(commandFlags.port)
+		const app = await createGranolaApp(config, { surface: "server" });
+		const networkMode = parseNetworkMode(commandFlags.network);
+		const hostname = resolveServerHostname(networkMode, commandFlags.hostname);
+		const port = parsePort(commandFlags.port);
+		const password = typeof commandFlags.password === "string" && commandFlags.password.trim() ? commandFlags.password : void 0;
+		const trustedOrigins = parseTrustedOrigins(commandFlags["trusted-origins"]);
+		const server = await startGranolaServer(app, {
+			hostname,
+			port,
+			security: {
+				password,
+				trustedOrigins
+			}
 		});
 		console.log(`Granola server listening on ${server.url.href}`);
+		console.log(`Network mode: ${networkMode}`);
+		if (password) console.log("Server password protection: enabled");
+		else if (networkMode === "lan") console.log("Warning: LAN mode is enabled without a server password");
+		if (trustedOrigins.length > 0) console.log(`Trusted origins: ${trustedOrigins.join(", ")}`);
 		console.log("Endpoints:");
 		console.log("  GET  /health");
+		console.log("  POST /auth/unlock");
+		console.log("  POST /auth/lock");
 		console.log("  GET  /auth/status");
 		console.log("  GET  /state");
 		console.log("  GET  /events");
@@ -4498,6 +4790,649 @@ const serveCommand = {
 	}
 };
 //#endregion
+//#region src/tui/helpers.ts
+function splitQuery(query) {
+	return query.trim().toLowerCase().split(/\s+/).filter(Boolean);
+}
+function scoreMeetingTerm(meeting, term) {
+	const title = meeting.title.toLowerCase();
+	const id = meeting.id.toLowerCase();
+	const tags = meeting.tags.map((tag) => tag.toLowerCase());
+	if (title === term || id === term) return 0;
+	if (title.startsWith(term)) return 1;
+	if (id.startsWith(term)) return 2;
+	if (title.includes(term)) return 3;
+	if (id.includes(term)) return 4;
+	if (tags.some((tag) => tag.includes(term))) return 5;
+}
+function buildGranolaTuiQuickOpenItems(meetings, query) {
+	const terms = splitQuery(query);
+	return meetings.map((meeting) => {
+		const score = terms.reduce((current, term) => {
+			const termScore = scoreMeetingTerm(meeting, term);
+			if (termScore === void 0) return;
+			return (current ?? 0) + termScore;
+		}, 0);
+		if (terms.length > 0 && score === void 0) return;
+		const tags = meeting.tags.length > 0 ? meeting.tags.map((tag) => `#${tag}`).join(" ") : "untagged";
+		return {
+			description: `${meeting.updatedAt.slice(0, 10)} | ${tags} | ${meeting.id}`,
+			id: meeting.id,
+			label: meeting.title || meeting.id,
+			score: score ?? 99
+		};
+	}).filter((item) => item !== void 0).sort((left, right) => {
+		if (left.score !== right.score) return left.score - right.score;
+		if (left.description !== right.description) return right.description.localeCompare(left.description);
+		return left.label.localeCompare(right.label);
+	});
+}
+function renderGranolaTuiMeetingTab(bundle, tab) {
+	const summary = bundle.meeting.meeting;
+	switch (tab) {
+		case "metadata": return [
+			`Title: ${summary.title || summary.id}`,
+			`ID: ${summary.id}`,
+			`Created: ${summary.createdAt}`,
+			`Updated: ${summary.updatedAt}`,
+			`Tags: ${summary.tags.length > 0 ? summary.tags.join(", ") : "none"}`,
+			`Notes source: ${summary.noteContentSource}`,
+			`Transcript loaded: ${summary.transcriptLoaded ? "yes" : "no"}`,
+			`Transcript segments: ${summary.transcriptSegmentCount}`
+		].join("\n");
+		case "raw": return JSON.stringify(bundle, null, 2);
+		case "transcript": {
+			const transcript = renderMeetingTranscript(bundle.document, bundle.cacheData, "text").trim();
+			if (transcript) return transcript;
+			return bundle.cacheData ? "(Transcript unavailable)" : "(Granola cache not loaded)";
+		}
+		default: return renderMeetingNotes(bundle.document, "markdown").trim();
+	}
+}
+function buildGranolaTuiSummary(state, meetingSource) {
+	return `auth ${state.auth.mode === "stored-session" ? "stored" : "supabase"} | ${state.documents.loaded ? `${state.documents.count} docs` : "docs pending"} | ${state.cache.loaded ? `${state.cache.transcriptCount} transcript sets` : state.cache.configured ? "cache configured" : "cache missing"} | ${state.index.loaded ? `${state.index.meetingCount} indexed` : "index pending"} | list ${meetingSource}`;
+}
+//#endregion
+//#region src/tui/theme.ts
+const RESET = "\x1B[0m";
+function colour(code, text) {
+	return `\x1b[${code}m${text}${RESET}`;
+}
+const granolaTuiTheme = {
+	accent(text) {
+		return colour("36", text);
+	},
+	dim(text) {
+		return colour("2", text);
+	},
+	error(text) {
+		return colour("31", text);
+	},
+	info(text) {
+		return colour("32", text);
+	},
+	selected(text) {
+		return colour("7", text);
+	},
+	strong(text) {
+		return colour("1", text);
+	},
+	warning(text) {
+		return colour("33", text);
+	}
+};
+//#endregion
+//#region src/tui/palette.ts
+function padLine$1(text, width) {
+	const clipped = truncateToWidth(text, width, "");
+	return clipped + " ".repeat(Math.max(0, width - visibleWidth(clipped)));
+}
+function frameLine(text, width) {
+	return `| ${padLine$1(text, Math.max(1, width - 4))} |`;
+}
+var GranolaTuiQuickOpenPalette = class {
+	focused = false;
+	#input = new Input();
+	#matches;
+	#selectedIndex = 0;
+	constructor(options) {
+		this.options = options;
+		this.#matches = buildGranolaTuiQuickOpenItems(this.options.meetings, "");
+		this.#input.onEscape = () => {
+			this.options.onCancel();
+		};
+		this.#input.onSubmit = () => {
+			this.chooseSelection();
+		};
+	}
+	get query() {
+		return this.#input.getValue();
+	}
+	updateMatches() {
+		this.#matches = buildGranolaTuiQuickOpenItems(this.options.meetings, this.query);
+		this.#selectedIndex = Math.max(0, Math.min(this.#selectedIndex, this.#matches.length - 1));
+	}
+	async chooseSelection() {
+		const selected = this.#matches[this.#selectedIndex];
+		if (selected) {
+			await this.options.onPick(selected.id);
+			return;
+		}
+		if (this.query.trim()) {
+			await this.options.onResolveQuery(this.query.trim());
+			return;
+		}
+		this.options.onCancel();
+	}
+	invalidate() {}
+	handleInput(data) {
+		if (matchesKey(data, "up")) {
+			this.#selectedIndex = Math.max(0, this.#selectedIndex - 1);
+			return;
+		}
+		if (matchesKey(data, "down")) {
+			this.#selectedIndex = Math.min(this.#matches.length - 1, this.#selectedIndex + 1);
+			return;
+		}
+		if (matchesKey(data, "pageUp")) {
+			this.#selectedIndex = Math.max(0, this.#selectedIndex - 5);
+			return;
+		}
+		if (matchesKey(data, "pageDown")) {
+			this.#selectedIndex = Math.min(this.#matches.length - 1, this.#selectedIndex + 5);
+			return;
+		}
+		const before = this.query;
+		this.#input.focused = this.focused;
+		this.#input.handleInput(data);
+		if (before !== this.query) {
+			this.#selectedIndex = 0;
+			this.updateMatches();
+		}
+	}
+	render(width) {
+		const lines = [];
+		const bodyWidth = Math.max(32, width);
+		const visibleMatches = this.#matches.slice(0, 8);
+		lines.push(`+${"-".repeat(bodyWidth - 2)}+`);
+		lines.push(frameLine(granolaTuiTheme.strong("Quick Open") + granolaTuiTheme.dim("  title, id, or tag"), bodyWidth));
+		lines.push(frameLine("", bodyWidth));
+		for (const inputLine of this.#input.render(Math.max(1, bodyWidth - 4))) lines.push(frameLine(inputLine, bodyWidth));
+		for (const hintLine of wrapTextWithAnsi(granolaTuiTheme.dim("Enter to open, Esc to cancel, arrows to move"), Math.max(1, bodyWidth - 4))) lines.push(frameLine(hintLine, bodyWidth));
+		lines.push(frameLine("", bodyWidth));
+		if (visibleMatches.length === 0) lines.push(frameLine(granolaTuiTheme.warning("No matching meetings"), bodyWidth));
+		else for (const [index, item] of visibleMatches.entries()) {
+			const selected = index === this.#selectedIndex;
+			const title = `${selected ? "> " : "  "}${item.label}`;
+			const titleLine = selected ? granolaTuiTheme.selected(title) : title;
+			const detailLine = granolaTuiTheme.dim(`  ${item.description}`);
+			lines.push(frameLine(titleLine, bodyWidth));
+			lines.push(frameLine(detailLine, bodyWidth));
+		}
+		lines.push(`+${"-".repeat(bodyWidth - 2)}+`);
+		return lines;
+	}
+};
+//#endregion
+//#region src/tui/workspace.ts
+function padLine(text, width) {
+	const clipped = truncateToWidth(text, width, "");
+	return clipped + " ".repeat(Math.max(0, width - visibleWidth(clipped)));
+}
+function wrapBlock(text, width) {
+	const lines = [];
+	for (const line of text.split("\n")) {
+		const wrapped = wrapTextWithAnsi(line, Math.max(1, width));
+		if (wrapped.length === 0) {
+			lines.push("");
+			continue;
+		}
+		lines.push(...wrapped);
+	}
+	return lines;
+}
+function toneText(tone, text) {
+	switch (tone) {
+		case "error": return granolaTuiTheme.error(text);
+		case "warning": return granolaTuiTheme.warning(text);
+		default: return granolaTuiTheme.info(text);
+	}
+}
+var GranolaTuiWorkspace = class {
+	focused = false;
+	#maxMeetings;
+	#appState;
+	#detailError = "";
+	#detailScroll = 0;
+	#detailToken = 0;
+	#listError = "";
+	#listToken = 0;
+	#loadingDetail = false;
+	#loadingMeetings = false;
+	#meetingSource = "live";
+	#meetings = [];
+	#overlay;
+	#selectedMeeting;
+	#selectedMeetingId;
+	#statusMessage = "Loading meetings…";
+	#statusTone = "info";
+	#tab = "notes";
+	#unsubscribe;
+	constructor(tui, app, options) {
+		this.tui = tui;
+		this.app = app;
+		this.options = options;
+		this.#appState = app.getState();
+		this.#maxMeetings = options.maxMeetings ?? 200;
+	}
+	async initialise() {
+		this.#unsubscribe = this.app.subscribe((event) => {
+			this.handleAppUpdate(event);
+		});
+		await this.loadMeetings({
+			preferredMeetingId: this.options.initialMeetingId,
+			setStatus: true
+		});
+		if (this.options.initialMeetingId) await this.loadMeeting(this.options.initialMeetingId, { ensureMeetingVisible: true });
+		else if (this.#selectedMeetingId) this.loadMeeting(this.#selectedMeetingId);
+	}
+	dispose() {
+		this.#unsubscribe?.();
+		this.#unsubscribe = void 0;
+	}
+	invalidate() {}
+	handleAppUpdate(event) {
+		const previousDocumentsLoadedAt = this.#appState.documents.loadedAt;
+		this.#appState = event.state;
+		if (this.#meetingSource === "index" && event.state.documents.loadedAt && event.state.documents.loadedAt !== previousDocumentsLoadedAt && !this.#loadingMeetings) this.loadMeetings({ preferredMeetingId: this.#selectedMeetingId });
+		this.tui.requestRender();
+	}
+	setStatus(message, tone = "info") {
+		this.#statusMessage = message;
+		this.#statusTone = tone;
+		this.tui.requestRender();
+	}
+	normaliseSelectedIndex() {
+		if (this.#meetings.length === 0) return -1;
+		const selectedIndex = this.#selectedMeetingId ? this.#meetings.findIndex((meeting) => meeting.id === this.#selectedMeetingId) : -1;
+		return selectedIndex >= 0 ? selectedIndex : 0;
+	}
+	ensureMeetingVisible(meeting) {
+		const existingIndex = this.#meetings.findIndex((item) => item.id === meeting.id);
+		if (existingIndex >= 0) this.#meetings[existingIndex] = meeting;
+		else this.#meetings.push(meeting);
+		this.#meetings.sort((left, right) => {
+			if (left.updatedAt !== right.updatedAt) return right.updatedAt.localeCompare(left.updatedAt);
+			return left.title.localeCompare(right.title);
+		});
+	}
+	async loadMeetings(options = {}) {
+		const token = ++this.#listToken;
+		this.#loadingMeetings = true;
+		this.#listError = "";
+		if (options.setStatus !== false) this.setStatus(options.forceRefresh ? "Refreshing meetings…" : "Loading meetings…");
+		try {
+			const result = await this.app.listMeetings({
+				forceRefresh: options.forceRefresh,
+				limit: this.#maxMeetings,
+				preferIndex: true
+			});
+			if (token !== this.#listToken) return;
+			this.#meetings = result.meetings;
+			this.#meetingSource = result.source;
+			this.#selectedMeetingId = options.preferredMeetingId && this.#meetings.some((meeting) => meeting.id === options.preferredMeetingId) ? options.preferredMeetingId : this.#selectedMeetingId && this.#meetings.some((meeting) => meeting.id === this.#selectedMeetingId) ? this.#selectedMeetingId : this.#meetings[0]?.id;
+			this.#listError = "";
+			this.setStatus(result.source === "index" ? "Loaded meetings from the local index" : "Connected to Granola");
+		} catch (error) {
+			if (token !== this.#listToken) return;
+			const message = error instanceof Error ? error.message : String(error);
+			this.#listError = message;
+			this.setStatus(message, "error");
+			throw error;
+		} finally {
+			if (token === this.#listToken) {
+				this.#loadingMeetings = false;
+				this.tui.requestRender();
+			}
+		}
+	}
+	async loadMeeting(meetingId, options = {}) {
+		const token = ++this.#detailToken;
+		this.#loadingDetail = true;
+		this.#detailError = "";
+		this.#selectedMeetingId = meetingId;
+		this.#detailScroll = 0;
+		this.setStatus(`Opening ${meetingId}…`);
+		try {
+			const bundle = options.resolveQuery ? await this.app.findMeeting(meetingId) : await this.app.getMeeting(meetingId);
+			if (token !== this.#detailToken) return;
+			this.#selectedMeeting = bundle;
+			this.#selectedMeetingId = bundle.document.id;
+			if (options.ensureMeetingVisible) this.ensureMeetingVisible(bundle.meeting.meeting);
+			this.setStatus(`Opened ${bundle.meeting.meeting.title || bundle.meeting.meeting.id}`);
+		} catch (error) {
+			if (token !== this.#detailToken) return;
+			const message = error instanceof Error ? error.message : String(error);
+			this.#selectedMeeting = void 0;
+			this.#detailError = message;
+			this.setStatus(message, "error");
+		} finally {
+			if (token === this.#detailToken) {
+				this.#loadingDetail = false;
+				this.tui.requestRender();
+			}
+		}
+	}
+	async refresh(forceRefresh) {
+		try {
+			await this.loadMeetings({
+				forceRefresh,
+				preferredMeetingId: this.#selectedMeetingId
+			});
+			if (this.#selectedMeetingId) await this.loadMeeting(this.#selectedMeetingId, { ensureMeetingVisible: true });
+		} catch {}
+	}
+	async moveSelection(delta) {
+		if (this.#meetings.length === 0) return;
+		const currentIndex = this.normaliseSelectedIndex();
+		const nextIndex = Math.max(0, Math.min(this.#meetings.length - 1, currentIndex + delta));
+		const nextMeeting = this.#meetings[nextIndex];
+		if (!nextMeeting || nextMeeting.id === this.#selectedMeetingId) return;
+		await this.loadMeeting(nextMeeting.id);
+	}
+	currentDetailBody(width) {
+		if (this.#detailError) return wrapBlock(this.#detailError, width);
+		if (this.#loadingDetail && !this.#selectedMeeting) return wrapBlock("Loading meeting details…", width);
+		if (!this.#selectedMeeting) return wrapBlock("Select a meeting to inspect its notes, transcript, and metadata.", width);
+		return wrapBlock(renderGranolaTuiMeetingTab(this.#selectedMeeting, this.#tab), width);
+	}
+	detailScrollStep(width, height) {
+		const bodyHeight = Math.max(1, height - 2);
+		const totalLines = this.currentDetailBody(width).length;
+		if (totalLines <= bodyHeight) return 0;
+		return Math.max(1, Math.min(bodyHeight - 1, totalLines - bodyHeight));
+	}
+	scrollDetail(delta) {
+		const totalWidth = this.tui.terminal.columns;
+		const totalHeight = this.tui.terminal.rows;
+		const { detailWidth } = this.resolveLayout(totalWidth);
+		const bodyHeight = Math.max(1, totalHeight - 6);
+		const detailLines = this.currentDetailBody(Math.max(1, detailWidth - 2));
+		const visibleBodyLines = Math.max(1, bodyHeight - 2);
+		const maxScroll = Math.max(0, detailLines.length - visibleBodyLines);
+		this.#detailScroll = Math.max(0, Math.min(maxScroll, this.#detailScroll + delta));
+		this.tui.requestRender();
+	}
+	cycleTab(delta) {
+		const tabs = [
+			"notes",
+			"transcript",
+			"metadata",
+			"raw"
+		];
+		this.#tab = tabs[(tabs.indexOf(this.#tab) + delta + tabs.length) % tabs.length] ?? "notes";
+		this.#detailScroll = 0;
+		this.tui.requestRender();
+	}
+	openQuickOpen() {
+		if (this.#overlay) return;
+		const closeOverlay = () => {
+			this.#overlay?.hide();
+			this.#overlay = void 0;
+			this.tui.setFocus(this);
+			this.tui.requestRender();
+		};
+		const palette = new GranolaTuiQuickOpenPalette({
+			meetings: this.#meetings,
+			onCancel: closeOverlay,
+			onPick: async (meetingId) => {
+				closeOverlay();
+				await this.loadMeeting(meetingId, { ensureMeetingVisible: true });
+			},
+			onResolveQuery: async (query) => {
+				closeOverlay();
+				await this.loadMeeting(query, {
+					ensureMeetingVisible: true,
+					resolveQuery: true
+				});
+			}
+		});
+		this.#overlay = this.tui.showOverlay(palette, {
+			anchor: "center",
+			maxHeight: "60%",
+			minWidth: 48,
+			width: "70%"
+		});
+		this.setStatus("Quick open");
+	}
+	handleInput(data) {
+		if (matchesKey(data, "ctrl+c") || matchesKey(data, "q")) {
+			this.options.onExit();
+			return;
+		}
+		if (matchesKey(data, "r")) {
+			this.refresh(true);
+			return;
+		}
+		if (matchesKey(data, "/") || matchesKey(data, "ctrl+p")) {
+			this.openQuickOpen();
+			return;
+		}
+		if (matchesKey(data, "up") || matchesKey(data, "k")) {
+			this.moveSelection(-1);
+			return;
+		}
+		if (matchesKey(data, "down") || matchesKey(data, "j")) {
+			this.moveSelection(1);
+			return;
+		}
+		if (matchesKey(data, "pageUp")) {
+			this.scrollDetail(-Math.max(1, this.detailScrollStep(this.tui.terminal.columns, this.tui.terminal.rows)));
+			return;
+		}
+		if (matchesKey(data, "pageDown")) {
+			this.scrollDetail(this.detailScrollStep(this.tui.terminal.columns, this.tui.terminal.rows));
+			return;
+		}
+		if (matchesKey(data, "1")) {
+			this.#tab = "notes";
+			this.#detailScroll = 0;
+			this.tui.requestRender();
+			return;
+		}
+		if (matchesKey(data, "2")) {
+			this.#tab = "transcript";
+			this.#detailScroll = 0;
+			this.tui.requestRender();
+			return;
+		}
+		if (matchesKey(data, "3")) {
+			this.#tab = "metadata";
+			this.#detailScroll = 0;
+			this.tui.requestRender();
+			return;
+		}
+		if (matchesKey(data, "4")) {
+			this.#tab = "raw";
+			this.#detailScroll = 0;
+			this.tui.requestRender();
+			return;
+		}
+		if (matchesKey(data, "]")) {
+			this.cycleTab(1);
+			return;
+		}
+		if (matchesKey(data, "[")) this.cycleTab(-1);
+	}
+	resolveLayout(width) {
+		const minimumDetailWidth = 24;
+		const minimumListWidth = 24;
+		const available = Math.max(1, width - 3);
+		let listWidth = Math.max(minimumListWidth, Math.min(42, Math.floor(available * .34)));
+		let detailWidth = available - listWidth;
+		if (detailWidth < minimumDetailWidth) {
+			detailWidth = minimumDetailWidth;
+			listWidth = Math.max(minimumListWidth, available - detailWidth);
+		}
+		if (listWidth + detailWidth > available) detailWidth = Math.max(minimumDetailWidth, available - listWidth);
+		return {
+			detailWidth,
+			listWidth
+		};
+	}
+	renderListPane(width, height) {
+		const lines = [];
+		const innerWidth = Math.max(1, width - 2);
+		const header = `${granolaTuiTheme.strong("Meetings")} ${granolaTuiTheme.dim(`(${this.#meetings.length})`)}`;
+		lines.push(padLine(header, innerWidth));
+		if (this.#listError) {
+			lines.push(...wrapBlock(granolaTuiTheme.error(this.#listError), innerWidth).slice(0, height - 1));
+			while (lines.length < height) lines.push(" ".repeat(innerWidth));
+			return lines;
+		}
+		if (this.#meetings.length === 0) {
+			lines.push(...wrapBlock("No meetings available yet.", innerWidth).slice(0, height - 1));
+			while (lines.length < height) lines.push(" ".repeat(innerWidth));
+			return lines;
+		}
+		const selectedIndex = this.normaliseSelectedIndex();
+		const windowSize = Math.max(1, height - 1);
+		const startIndex = Math.max(0, Math.min(selectedIndex - Math.floor(windowSize / 2), this.#meetings.length - windowSize));
+		const visibleMeetings = this.#meetings.slice(startIndex, startIndex + windowSize);
+		for (const [offset, meeting] of visibleMeetings.entries()) {
+			const selected = startIndex + offset === selectedIndex;
+			const dateLabel = meeting.updatedAt.slice(0, 10);
+			const prefix = selected ? "> " : "  ";
+			const maxTitleWidth = Math.max(6, innerWidth - visibleWidth(prefix) - dateLabel.length - 1);
+			const titleBlock = `${prefix}${truncateToWidth(meeting.title || meeting.id, maxTitleWidth, "")}`;
+			const line = `${titleBlock}${" ".repeat(Math.max(1, innerWidth - visibleWidth(titleBlock) - visibleWidth(dateLabel)))}${granolaTuiTheme.dim(dateLabel)}`;
+			lines.push(selected ? padLine(granolaTuiTheme.selected(line), innerWidth) : padLine(line, innerWidth));
+		}
+		while (lines.length < height) lines.push(" ".repeat(innerWidth));
+		return lines;
+	}
+	renderDetailPane(width, height) {
+		const lines = [];
+		const innerWidth = Math.max(1, width - 2);
+		const tabs = [
+			{
+				id: "notes",
+				label: "1 Notes"
+			},
+			{
+				id: "transcript",
+				label: "2 Transcript"
+			},
+			{
+				id: "metadata",
+				label: "3 Metadata"
+			},
+			{
+				id: "raw",
+				label: "4 Raw"
+			}
+		];
+		const title = this.#selectedMeeting?.meeting.meeting.title || this.#selectedMeetingId || "Meeting";
+		const titleLine = `${granolaTuiTheme.strong(title)} ${granolaTuiTheme.dim(this.#selectedMeeting ? this.#selectedMeeting.meeting.meeting.id : "")}`.trim();
+		lines.push(padLine(titleLine, innerWidth));
+		const tabLine = tabs.map((tab) => tab.id === this.#tab ? granolaTuiTheme.selected(` ${tab.label} `) : ` ${tab.label} `).join(" ");
+		lines.push(padLine(tabLine, innerWidth));
+		const bodyLines = this.currentDetailBody(innerWidth);
+		const bodyHeight = Math.max(1, height - 2);
+		const visibleBody = bodyLines.slice(this.#detailScroll, this.#detailScroll + bodyHeight);
+		lines.push(...visibleBody.map((line) => padLine(line, innerWidth)));
+		while (lines.length < height) lines.push(" ".repeat(innerWidth));
+		return lines;
+	}
+	render(width) {
+		const totalHeight = Math.max(12, this.tui.terminal.rows);
+		const { detailWidth, listWidth } = this.resolveLayout(width);
+		const bodyHeight = Math.max(6, totalHeight - 2 - 2);
+		const selectedLabel = this.#selectedMeeting?.meeting.meeting.title || this.#selectedMeetingId || "none";
+		const headerTitle = padLine(`${granolaTuiTheme.accent("Granola Toolkit TUI")} ${granolaTuiTheme.dim(this.#loadingMeetings ? "loading…" : selectedLabel)}`, width);
+		const headerSummary = padLine(granolaTuiTheme.dim(buildGranolaTuiSummary(this.#appState, this.#meetingSource)), width);
+		const listLines = this.renderListPane(listWidth, bodyHeight);
+		const detailLines = this.renderDetailPane(detailWidth, bodyHeight);
+		const bodyLines = [];
+		for (let index = 0; index < bodyHeight; index += 1) bodyLines.push(`${padLine(listLines[index] ?? "", listWidth)} | ${padLine(detailLines[index] ?? "", detailWidth)}`);
+		const footerStatus = padLine(toneText(this.#statusTone, this.#statusMessage), width);
+		const footerHints = padLine(granolaTuiTheme.dim("/ quick open  r refresh  1-4 tabs  PgUp/PgDn scroll  q quit"), width);
+		return [
+			headerTitle,
+			headerSummary,
+			...bodyLines,
+			footerStatus,
+			footerHints
+		];
+	}
+};
+async function runGranolaTui(app, options = {}) {
+	const tui = new TUI(new ProcessTerminal());
+	return await new Promise((resolve, reject) => {
+		const workspace = new GranolaTuiWorkspace(tui, app, {
+			initialMeetingId: options.initialMeetingId,
+			onExit: () => {
+				workspace.dispose();
+				tui.stop();
+				resolve(0);
+			}
+		});
+		(async () => {
+			try {
+				await workspace.initialise();
+			} catch (error) {
+				workspace.dispose();
+				reject(error);
+				return;
+			}
+			tui.addChild(workspace);
+			tui.setFocus(workspace);
+			tui.start();
+			tui.requestRender(true);
+		})();
+	});
+}
+//#endregion
+//#region src/commands/tui.ts
+function tuiHelp() {
+	return `Granola tui
+
+Usage:
+  granola tui [options]
+
+Options:
+  --meeting <id>     Open the workspace focused on a specific meeting
+  --cache <path>     Path to Granola cache JSON
+  --timeout <value>  Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
+  --supabase <path>  Path to supabase.json
+  --debug            Enable debug logging
+  --config <path>    Path to .granola.toml
+  -h, --help         Show help
+`;
+}
+const tuiCommand = {
+	description: "Start the Granola Toolkit terminal workspace",
+	flags: {
+		cache: { type: "string" },
+		help: { type: "boolean" },
+		meeting: { type: "string" },
+		timeout: { type: "string" }
+	},
+	help: tuiHelp,
+	name: "tui",
+	async run({ commandFlags, globalFlags }) {
+		const config = await loadConfig({
+			globalFlags,
+			subcommandFlags: commandFlags
+		});
+		debug(config.debug, "using config", config.configFileUsed ?? "(none)");
+		debug(config.debug, "supabase", config.supabase);
+		debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
+		debug(config.debug, "timeoutMs", config.notes.timeoutMs);
+		return await runGranolaTui(await createGranolaApp(config, { surface: "tui" }), { initialMeetingId: typeof commandFlags.meeting === "string" && commandFlags.meeting.trim() ? commandFlags.meeting.trim() : void 0 });
+	}
+};
+//#endregion
 //#region src/commands/transcripts.ts
 function transcriptsHelp() {
 	return `Granola transcripts
@@ -4592,8 +5527,11 @@ Usage:
   granola web [options]
 
 Options:
-  --hostname <value>      Hostname to bind (default: 127.0.0.1)
+  --network <mode>        Network mode: local or lan (default: local)
+  --hostname <value>      Hostname to bind (overrides network default)
   --port <value>          Port to bind (default: 0 for any available port)
+  --password <value>      Optional server password for API and browser access
+  --trusted-origins <v>   Comma-separated extra browser origins to trust
   --cache <path>          Path to Granola cache JSON
   --timeout <value>       Request timeout, e.g. 2m, 30s, 120000 (default: 2m)
   --supabase <path>       Path to supabase.json
@@ -4611,6 +5549,7 @@ const commands = [
 	meetingCommand,
 	notesCommand,
 	serveCommand,
+	tuiCommand,
 	transcriptsCommand,
 	{
 		description: "Start the Granola Toolkit web workspace",
@@ -4618,9 +5557,12 @@ const commands = [
 			cache: { type: "string" },
 			help: { type: "boolean" },
 			hostname: { type: "string" },
+			network: { type: "string" },
 			open: { type: "boolean" },
+			password: { type: "string" },
 			port: { type: "string" },
-			timeout: { type: "string" }
+			timeout: { type: "string" },
+			"trusted-origins": { type: "string" }
 		},
 		help: webHelp,
 		name: "web",
@@ -4634,18 +5576,31 @@ const commands = [
 			debug(config.debug, "cacheFile", config.transcripts.cacheFile || "(none)");
 			debug(config.debug, "timeoutMs", config.notes.timeoutMs);
 			const app = await createGranolaApp(config, { surface: "web" });
-			const hostname = pickHostname(commandFlags.hostname);
+			const networkMode = parseNetworkMode(commandFlags.network);
+			const hostname = resolveServerHostname(networkMode, commandFlags.hostname);
 			const port = parsePort(commandFlags.port);
 			const openBrowser = commandFlags.open !== false;
+			const password = typeof commandFlags.password === "string" && commandFlags.password.trim() ? commandFlags.password : void 0;
+			const trustedOrigins = parseTrustedOrigins(commandFlags["trusted-origins"]);
 			const server = await startGranolaServer(app, {
 				enableWebClient: true,
 				hostname,
-				port
+				port,
+				security: {
+					password,
+					trustedOrigins
+				}
 			});
 			console.log(`Granola Toolkit web workspace listening on ${server.url.href}`);
+			console.log(`Network mode: ${networkMode}`);
+			if (password) console.log("Server password protection: enabled");
+			else if (networkMode === "lan") console.log("Warning: LAN mode is enabled without a server password");
+			if (trustedOrigins.length > 0) console.log(`Trusted origins: ${trustedOrigins.join(", ")}`);
 			console.log("Routes:");
 			console.log("  GET  /");
 			console.log("  GET  /health");
+			console.log("  POST /auth/unlock");
+			console.log("  POST /auth/lock");
 			console.log("  GET  /auth/status");
 			console.log("  GET  /state");
 			console.log("  GET  /events");