vault-cortex 0.10.2 → 0.10.3-beta.54

package/README.md

@@ -49,9 +49,9 @@ What it does:
    - **Remote** — a VPS with [Obsidian Sync](https://obsidian.md/sync),
      reachable from any device
 2. Offers the most common optional settings — memory layer and folder,
-   daily notes folder and format, file tools, semantic search, port,
-   timezone (plus sync direction for remote) — press enter to keep the
-   defaults, or pick the ones you want to change
+   daily notes folder and format, file tools, read-only mode, semantic
+   search, port, timezone (plus sync direction for remote) — press enter
+   to keep the defaults, or pick the ones you want to change
 3. Generates a `.env` file with a securely generated `MCP_AUTH_TOKEN`
 4. Optionally starts the container and waits for the health check
 5. Prints your connection details — the MCP URL, your auth token, and how to

package/dist/docker.js

@@ -86,7 +86,10 @@ export const buildDockerRunArgs = (params) => {
         args.push("--health-interval", "15s");
         args.push("--health-timeout", "5s");
         args.push("--health-retries", "5");
-        args.push("--health-start-period", "60s");
+        // 180s: the remote image's init chain runs the first vault sync to
+        // completion before the MCP server boots, so /healthz appears late on
+        // fresh deploys.
+        args.push("--health-start-period", "180s");
         args.push("--log-driver", "json-file");
         args.push("--log-opt", "max-size=10m");
         args.push("--log-opt", "max-file=3");
@@ -191,6 +194,28 @@ export const probeHealth = async (params, fetchFn) => {
         return false;
     }
 };
+/**
+ * Health-poll budget by deployment mode. Remote gets a longer window because
+ * the container's init chain runs the first vault sync to completion before
+ * the server boots — /healthz can legitimately take minutes to appear on a
+ * fresh deploy (matches the 180s container health start period plus boot
+ * margin).
+ */
+export const healthPollTimeoutMs = (mode) => {
+    return mode === "remote" ? 240_000 : 120_000;
+};
+/** Health-poll failure message with the duration derived from the actual
+ *  timeout, so mode-specific budgets can't drift out of the copy. Remote
+ *  adds a first-sync hint: the container's init chain retries the first
+ *  sync with no upper time bound, so an expired poll does not mean the
+ *  server failed — it may flip healthy after the CLI stops waiting. */
+export const healthTimeoutMessage = (mode, timeoutMs) => {
+    const baseMessage = `Server did not respond within ${timeoutMs / 60_000} minutes — check: docker logs ${CONTAINER_NAME}`;
+    if (mode === "remote") {
+        return `${baseMessage} (a long first sync may still be running — the container keeps starting in the background)`;
+    }
+    return baseMessage;
+};
 /**
  * Polls the health endpoint until it responds OK or the timeout elapses.
  * The first `docker run` pulls the image, so the default window is generous.

package/dist/env.js

@@ -58,6 +58,15 @@ MEMORY_ENABLED=true
 # Enable or disable file tools — vault_read_file and vault_list_files (default: true).
 # Set to false when Obsidian Sync has attachment syncing disabled.
 FILE_TOOLS_ENABLED=true
+# Run the server in read-only mode (default: false).
+# Set to true to hide every tool that changes the vault — clients can only
+# read and search. The memory folder is not auto-created in this mode.
+READONLY_MODE=false
+# Hide individual tools by name, comma-separated (default: none hidden).
+# Names match the README tools table: https://github.com/aliasunder/vault-cortex#tools
+# Subtractive only — it cannot re-enable a tool another setting hides; an
+# unknown tool name stops the server at startup so typos surface immediately.
+# DISABLED_TOOLS=vault_delete_note,vault_move_note
 # Memory folder name in your vault (default: About Me).
 MEMORY_DIR=About Me
 
@@ -160,6 +169,15 @@ MEMORY_ENABLED=true
 # Enable or disable file tools — vault_read_file and vault_list_files (default: true).
 # Set to false when Obsidian Sync has attachment syncing disabled.
 FILE_TOOLS_ENABLED=true
+# Run the server in read-only mode (default: false).
+# Set to true to hide every tool that changes the vault — clients can only
+# read and search. The memory folder is not auto-created in this mode.
+READONLY_MODE=false
+# Hide individual tools by name, comma-separated (default: none hidden).
+# Names match the README tools table: https://github.com/aliasunder/vault-cortex#tools
+# Subtractive only — it cannot re-enable a tool another setting hides; an
+# unknown tool name stops the server at startup so typos surface immediately.
+# DISABLED_TOOLS=vault_delete_note,vault_move_note
 # Memory folder name in your vault (default: About Me).
 MEMORY_DIR=About Me
 

package/dist/init.js

@@ -3,7 +3,7 @@ import { join, resolve } from "node:path";
 import { buildLocalEnv, buildRemoteEnv } from "./env.js";
 import { captureObsidianToken } from "./get-sync-token.js";
 import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, buildLocalConnectMessage, buildRemoteConnectMessage, startCommand, } from "./messages.js";
-import { pollHealth } from "./docker.js";
+import { healthPollTimeoutMs, healthTimeoutMessage, pollHealth, } from "./docker.js";
 import { reportPublicUrlProbe } from "./lifecycle.js";
 import { applyOptionalSettings, askOptionalSettings, derivePublicUrlOverride, } from "./optional-settings.js";
 import { buildFilesToWrite, readEnvPort, readEnvPublicUrl, writeFiles, } from "./scaffold.js";
@@ -185,9 +185,10 @@ const offerDockerRun = async (params, deps) => {
     }
     const spinner = prompts.spinner();
     spinner.start("Waiting for the server to come up (first run may take a moment)");
-    const healthy = await pollHealth({ url: `http://127.0.0.1:${port}/healthz` }, fetchFn);
+    const timeoutMs = healthPollTimeoutMs(mode);
+    const healthy = await pollHealth({ url: `http://127.0.0.1:${port}/healthz`, timeoutMs }, fetchFn);
     if (!healthy) {
-        spinner.stop("Server did not respond within 2 minutes — check: docker logs vault-cortex");
+        spinner.stop(healthTimeoutMessage(mode, timeoutMs));
         return false;
     }
     spinner.stop("Server is up — health check passed.");

package/dist/lifecycle.js

@@ -1,5 +1,5 @@
 import { join, resolve } from "node:path";
-import { CONTAINER_NAME, pollHealth, probeHealth, } from "./docker.js";
+import { CONTAINER_NAME, healthPollTimeoutMs, healthTimeoutMessage, pollHealth, probeHealth, } from "./docker.js";
 import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, } from "./messages.js";
 import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
@@ -123,12 +123,13 @@ export const recreateContainer = async (params, deps) => {
     }
     const spinner = prompts.spinner();
     spinner.start("Waiting for the server to come up");
+    const timeoutMs = healthTimeoutMs ?? healthPollTimeoutMs(deployment.mode);
     const healthy = await pollHealth({
         url: `http://127.0.0.1:${deployment.port}/healthz`,
-        timeoutMs: healthTimeoutMs,
+        timeoutMs,
     }, fetchFn);
     if (!healthy) {
-        spinner.stop(`Server did not respond within 2 minutes — check: docker logs ${CONTAINER_NAME}`);
+        spinner.stop(healthTimeoutMessage(deployment.mode, timeoutMs));
         return 1;
     }
     spinner.stop("Server is up — health check passed.");

package/dist/optional-settings.js

@@ -37,6 +37,13 @@ const OPTIONAL_SETTINGS = [
         label: "File tools",
         question: "Enable file tools (read images, PDFs, and other non-Markdown files)?",
     },
+    {
+        kind: "toggle",
+        name: "READONLY_MODE",
+        label: "Read-only mode",
+        question: "Run the server in read-only mode (hide all tools that change the vault)?",
+        defaultEnabled: false,
+    },
     {
         kind: "toggle",
         name: "EMBEDDING_ENABLED",
@@ -127,11 +134,12 @@ export const derivePublicUrlOverride = (envContent, overrides) => {
     return { ...overrides, PUBLIC_URL: `http://localhost:${newPort}` };
 };
 /**
- * The .env spellings the server reads as "off" — env-var's asBool accepts
- * 0/1 alongside true/false. An absent or unrecognized value falls to the
- * server default, which is enabled for every curated toggle.
+ * True unless the .env value is an explicit "off" spelling — env-var's asBool
+ * accepts 0/1 alongside true/false. An absent or unrecognized value falls to
+ * the server default, declared per-toggle via defaultEnabled (enabled unless
+ * stated otherwise).
  */
-const isDisabledToggleValue = (value) => ["false", "0"].includes((value ?? "").toLowerCase());
+const isEnabledToggleValue = (value) => !["false", "0"].includes((value ?? "").toLowerCase());
 /**
  * Plain digits in the TCP port range. Number() coercion is not enough:
  * it accepts "1e4"/"0x1F40"/"+9000", which readEnvPort's /^PORT=(\d+)/
@@ -222,7 +230,15 @@ const askSettingValue = async (params, prompts) => {
     const { setting, currentValue } = params;
     switch (setting.kind) {
         case "toggle": {
-            const enabled = await prompts.confirm(setting.question, !isDisabledToggleValue(currentValue));
+            // An unset or empty var means the server default applies — seed the
+            // confirm from defaultEnabled, not from the enabled-unless-"false"
+            // heuristic (wrong for default-off toggles like READONLY_MODE).
+            // Empty string matters: `READONLY_MODE=` in .env is read as unset
+            // by Compose's `${VAR:-default}` and env-var's `.default()`.
+            const currentlyEnabled = !currentValue
+                ? (setting.defaultEnabled ?? true)
+                : isEnabledToggleValue(currentValue);
+            const enabled = await prompts.confirm(setting.question, currentlyEnabled);
             return String(enabled);
         }
         case "port":
@@ -258,7 +274,7 @@ export const askOptionalSettings = async (params, prompts) => {
         const currentValue = readOptionalValue(envContent, setting.name);
         const requiredToggle = OPTIONAL_SETTINGS.find((candidate) => candidate.name === setting.requiresToggle);
         const dependencyNote = requiredToggle &&
-            isDisabledToggleValue(readOptionalValue(envContent, requiredToggle.name))
+            !isEnabledToggleValue(readOptionalValue(envContent, requiredToggle.name))
             ? ` · not used while ${requiredToggle.label} is off`
             : "";
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.10.2",
+  "version": "0.10.3-beta.54",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex@latest init",
   "license": "MIT",
   "type": "module",