ocean-brain 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,58 +1,90 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { execSync } from "child_process";
-import fs from "fs";
+import fs2 from "fs";
 import os from "os";
 import path from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 import { Command } from "commander";
+
+// src/auth-options.ts
+var isTruthy = (value) => {
+  if (!value) {
+    return false;
+  }
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+};
+var ensurePasswordModeRequirements = (env) => {
+  if (!env.OCEAN_BRAIN_PASSWORD) {
+    throw new Error(
+      "Missing OCEAN_BRAIN_PASSWORD. Set OCEAN_BRAIN_PASSWORD before running password auth mode."
+    );
+  }
+  if (!env.OCEAN_BRAIN_SESSION_SECRET) {
+    throw new Error(
+      "Missing OCEAN_BRAIN_SESSION_SECRET. Set OCEAN_BRAIN_SESSION_SECRET before running password auth mode."
+    );
+  }
+};
+var resolveServeAuthEnvironment = (options, env) => {
+  const allowInsecureNoAuth = options.allowInsecureNoAuth || isTruthy(env.OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH);
+  if (!allowInsecureNoAuth && env.OCEAN_BRAIN_PASSWORD) {
+    ensurePasswordModeRequirements(env);
+  }
+  return {
+    OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH: allowInsecureNoAuth ? "true" : void 0
+  };
+};
+
+// src/mcp-auth.ts
+import fs from "fs";
+var resolveMcpBearerToken = (options) => {
+  if (options.tokenFile) {
+    const token = fs.readFileSync(options.tokenFile, "utf-8").trim();
+    return token || void 0;
+  }
+  return options.token?.trim() || void 0;
+};
+
+// src/index.ts
 var __dirname = path.dirname(fileURLToPath(import.meta.url));
 var serverRoot = path.resolve(__dirname, "..", "server");
-function findBin(name, fromDir) {
-  let dir = path.resolve(fromDir, "..");
-  while (true) {
-    const bin = path.resolve(dir, "node_modules", ".bin", name);
-    if (fs.existsSync(bin)) return bin;
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error(`Could not find "${name}" binary. Make sure it is installed.`);
-}
 var pkg = JSON.parse(
-  fs.readFileSync(path.resolve(__dirname, "..", "package.json"), "utf-8")
+  fs2.readFileSync(path.resolve(__dirname, "..", "package.json"), "utf-8")
 );
 var program = new Command();
 program.name("ocean-brain").description("Self-hosted, open-source note-taking app with bi-directional links").version(pkg.version);
-program.command("serve", { isDefault: true }).description("Start the Ocean Brain server").option("-p, --port <port>", "port to listen on", "6683").option("-H, --host <host>", "host to bind to", "0.0.0.0").action(async (opts) => {
-  const defaultRoot = path.resolve(os.homedir(), ".ocean-brain");
-  const dataDir = process.env.OCEAN_BRAIN_DATA_DIR || path.resolve(defaultRoot, "data");
-  const imageDir = process.env.OCEAN_BRAIN_IMAGE_DIR || path.resolve(defaultRoot, "assets/images");
-  const dbPath = path.resolve(dataDir, "db.sqlite3");
-  fs.mkdirSync(dataDir, { recursive: true });
-  fs.mkdirSync(imageDir, { recursive: true });
-  process.env.DATABASE_URL = process.env.DATABASE_URL || `file:${dbPath}`;
-  process.env.OCEAN_BRAIN_PACKAGE_ROOT = serverRoot;
-  process.env.OCEAN_BRAIN_DATA_DIR = dataDir;
-  process.env.OCEAN_BRAIN_IMAGE_DIR = imageDir;
-  process.env.PORT = process.env.PORT || opts.port;
-  process.env.HOST = process.env.HOST || opts.host;
-  const schemaPath = path.resolve(serverRoot, "prisma/schema.prisma");
-  const prisma = findBin("prisma", __dirname);
-  execSync(`"${prisma}" generate --schema="${schemaPath}"`, {
-    stdio: "inherit",
-    env: { ...process.env }
-  });
-  execSync(`"${prisma}" migrate deploy --schema="${schemaPath}"`, {
-    stdio: "inherit",
-    env: { ...process.env }
-  });
-  const serverEntry = pathToFileURL(path.resolve(serverRoot, "dist/main.js")).href;
-  await import(serverEntry);
+program.command("serve", { isDefault: true }).description("Start the Ocean Brain server").option("-p, --port <port>", "port to listen on", "6683").option("-H, --host <host>", "host to bind to", "0.0.0.0").option("--allow-insecure-no-auth", "explicitly disable auth protection for local or trusted environments").action(async (opts) => {
+  try {
+    const defaultRoot = path.resolve(os.homedir(), ".ocean-brain");
+    const dataDir = process.env.OCEAN_BRAIN_DATA_DIR || path.resolve(defaultRoot, "data");
+    const imageDir = process.env.OCEAN_BRAIN_IMAGE_DIR || path.resolve(defaultRoot, "assets/images");
+    const dbPath = path.resolve(dataDir, "db.sqlite3");
+    fs2.mkdirSync(dataDir, { recursive: true });
+    fs2.mkdirSync(imageDir, { recursive: true });
+    process.env.DATABASE_URL = process.env.DATABASE_URL || `file:${dbPath}`;
+    process.env.OCEAN_BRAIN_PACKAGE_ROOT = serverRoot;
+    process.env.OCEAN_BRAIN_DATA_DIR = dataDir;
+    process.env.OCEAN_BRAIN_IMAGE_DIR = imageDir;
+    process.env.PORT = process.env.PORT || opts.port;
+    process.env.HOST = process.env.HOST || opts.host;
+    const authEnvironment = resolveServeAuthEnvironment(opts, process.env);
+    if (authEnvironment.OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH) {
+      process.env.OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH = authEnvironment.OCEAN_BRAIN_ALLOW_INSECURE_NO_AUTH;
+    }
+    const serverEntry = pathToFileURL(path.resolve(serverRoot, "dist/start.js")).href;
+    await import(serverEntry);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown CLI auth configuration error";
+    process.stderr.write(`[auth] Serve startup failed: ${message}
+`);
+    process.exit(1);
+  }
 });
-program.command("mcp").description("Start MCP server for AI integration").option("-s, --server <url>", "Ocean Brain server URL", "http://localhost:6683").action(async (opts) => {
+program.command("mcp").description("Start MCP server for AI integration").option("-s, --server <url>", "Ocean Brain server URL", "http://localhost:6683").option("--token-file <path>", "read the MCP bearer token from a file").option("--token <token>", "explicit MCP bearer token fallback").option("--write-safety-dir <path>", "directory for pending MCP write confirmations and operation logs").action(async (opts) => {
   const { startMcpServer } = await import("./mcp.js");
-  await startMcpServer(opts.server);
+  const token = resolveMcpBearerToken(opts);
+  const writeSafetyDir = opts.writeSafetyDir || process.env.OCEAN_BRAIN_MCP_WRITE_SAFETY_DIR;
+  await startMcpServer(opts.server, token, { writeSafetyDir });
 });
 program.parse();