memtrails 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -5,6 +5,12 @@ versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.3] — 2026-11-05
+
+- Fixes: the first start no longer fails with "Qdrant exited (101) while starting" where the system has no CA
+  certificates, as in the official slim Node image. Qdrant will not start without them, though it makes no outside
+  call here: it now gets the host's `SSL_CERT_FILE`, or the certificates the library carries. All three languages.
+
 ## [0.4.2] — 2026-11-05
 
 - Fixes: the first start no longer fails when run as root (as in most containers) with "is not this user's alone":

package/dist/core/qdrant-process.js

@@ -4,6 +4,7 @@ import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, renameSync, rm
 import { createServer } from 'node:net';
 import { uptime } from 'node:os';
 import { join, resolve } from 'node:path';
+import { rootCertificates } from 'node:tls';
 /** A port the OS says is free on loopback. */
 async function freePort() {
     return new Promise((resolve, reject) => {
@@ -95,13 +96,15 @@ function commandOf(pid) {
     }
 }
 /** What Qdrant gets of the environment: what a process needs to run and the key. None of the host's secrets, and none
- *  of its QDRANT__* variables — they override the config (QDRANT__SERVICE__HOST=0.0.0.0 would open it to the network). */
-function childEnv(apiKey) {
+ *  of its QDRANT__* variables — they override the config (QDRANT__SERVICE__HOST=0.0.0.0 would open it to the network).
+ *  Qdrant does not start without CA certificates, though it makes no outside call here, and a slim container has none:
+ *  it gets the host's SSL_CERT_FILE, or `caFile`. */
+function childEnv(apiKey, caFile) {
     const env = {};
     for (const k of ['PATH', 'HOME', 'TMPDIR', 'TEMP', 'TMP', 'SystemRoot', 'USERPROFILE'])
         if (process.env[k] !== undefined)
             env[k] = process.env[k];
-    return { ...env, QDRANT__SERVICE__API_KEY: apiKey, QDRANT__TELEMETRY_DISABLED: 'true' };
+    return { ...env, SSL_CERT_FILE: process.env.SSL_CERT_FILE || caFile, QDRANT__SERVICE__API_KEY: apiKey, QDRANT__TELEMETRY_DISABLED: 'true' };
 }
 /** Every Qdrant this process started and has not seen exit: stopped when the host exits without `close()` (an 'exit'
  *  handler can only send the signal; a host killed outright leaves its Qdrant to the next start's reapLeftover). */
@@ -156,13 +159,15 @@ export class QdrantProcess {
         const apiKey = randomBytes(24).toString('hex');
         const config = join(this.opts.dir, 'config.yaml');
         writeFileSync(config, qdrantConfig(this.opts.dir, port), { mode: 0o600 });
+        const caFile = join(this.opts.dir, 'ca.pem');
+        writeFileSync(caFile, `${rootCertificates.join('\n')}\n`, { mode: 0o600 }); // the ones Node carries
         const fd = openLog(this.opts.dir);
         let child;
         try {
             child = spawn(this.opts.binary, ['--config-path', config, '--disable-telemetry'], {
                 cwd: this.opts.dir,
                 stdio: ['ignore', fd, fd],
-                env: childEnv(apiKey),
+                env: childEnv(apiKey, caFile),
             });
         }
         finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memtrails",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Retrieval and exploration for any text — e-mail, chat, notes, documents, news, commits, conversations. Searchable at once, on your own machine, in any language; optional consolidation into typed knowledge with a language model.",
   "keywords": [
     "retrieval",