vault-cortex 0.11.0 → 0.12.0-beta.60

package/dist/env.js

@@ -94,17 +94,28 @@ MEMORY_DIR=About Me
 # Host port to expose (default: 8000).
 PORT=8000
 
-# Client-IP trust for OAuth rate limiting and logs (defaults shown).
-# With nothing in front of the server, leave both untouched — each visitor
-# is identified by their own connection, and faked Forwarded/X-Forwarded-For
-# headers are ignored.
-# With a proxy or tunnel you control in front (Caddy, nginx, Cloudflare
-# Tunnel), set TRUST_PROXY_HOPS=1 so visitors are told apart by their real
-# IP — otherwise they all share one rate-limit budget.
-# Set TRUST_FORWARDED_HEADER=true only if the proxy reports each visitor's
-# IP in the RFC 7239 Forwarded header (e.g. AWS API Gateway).
+# These two settings choose the client IP used for OAuth rate limiting and
+# logs (defaults shown below). Without the right values, every visitor
+# behind a proxy shares one rate-limit budget. TRUST_PROXY_HOPS counts the
+# proxies you control that write X-Forwarded-For; TRUST_FORWARDED_HOPS
+# counts the ones that write the RFC 7239 Forwarded header
+# (https://www.rfc-editor.org/rfc/rfc7239), and 0 ignores that header.
+#
+#   What sits in front of the server       TRUST_PROXY_HOPS  TRUST_FORWARDED_HOPS  Client IP is
+#   Nothing (default)                      0                 0                     the visitor (socket peer)
+#   A proxy or tunnel you control          1                 0                     the visitor (X-Forwarded-For)
+#     (Caddy, nginx, Cloudflare Tunnel)
+#   A proxy that reports visitors in       1                 1                     the visitor (Forwarded)
+#     Forwarded (e.g. AWS API Gateway)
+#   A CDN in front of that proxy, and      1                 2                     the visitor (Forwarded)
+#     the CDN is the only way to reach it
+#
+# When the Forwarded header is read (TRUST_FORWARDED_HOPS above 0), it wins
+# and TRUST_PROXY_HOPS is not consulted; TRUST_PROXY_HOPS is the fallback
+# when that header is ignored or absent. Faked headers from visitors are
+# ignored in every row — only the counted proxies are trusted.
 # TRUST_PROXY_HOPS=0
-# TRUST_FORWARDED_HEADER=false
+# TRUST_FORWARDED_HOPS=0
 
 # Log verbosity: debug | info | warn | error (default: info).
 LOG_LEVEL=info
@@ -221,17 +232,28 @@ MEMORY_DIR=About Me
 # Host port to expose (default: 8000).
 PORT=8000
 
-# Client-IP trust for OAuth rate limiting and logs (defaults shown).
-# With nothing in front of the server, leave both untouched — each visitor
-# is identified by their own connection, and faked Forwarded/X-Forwarded-For
-# headers are ignored.
-# With a proxy or tunnel you control in front (Caddy, nginx, Cloudflare
-# Tunnel), set TRUST_PROXY_HOPS=1 so visitors are told apart by their real
-# IP — otherwise they all share one rate-limit budget.
-# Set TRUST_FORWARDED_HEADER=true only if the proxy reports each visitor's
-# IP in the RFC 7239 Forwarded header (e.g. AWS API Gateway).
+# These two settings choose the client IP used for OAuth rate limiting and
+# logs (defaults shown below). Without the right values, every visitor
+# behind a proxy shares one rate-limit budget. TRUST_PROXY_HOPS counts the
+# proxies you control that write X-Forwarded-For; TRUST_FORWARDED_HOPS
+# counts the ones that write the RFC 7239 Forwarded header
+# (https://www.rfc-editor.org/rfc/rfc7239), and 0 ignores that header.
+#
+#   What sits in front of the server       TRUST_PROXY_HOPS  TRUST_FORWARDED_HOPS  Client IP is
+#   Nothing (default)                      0                 0                     the visitor (socket peer)
+#   A proxy or tunnel you control          1                 0                     the visitor (X-Forwarded-For)
+#     (Caddy, nginx, Cloudflare Tunnel)
+#   A proxy that reports visitors in       1                 1                     the visitor (Forwarded)
+#     Forwarded (e.g. AWS API Gateway)
+#   A CDN in front of that proxy, and      1                 2                     the visitor (Forwarded)
+#     the CDN is the only way to reach it
+#
+# When the Forwarded header is read (TRUST_FORWARDED_HOPS above 0), it wins
+# and TRUST_PROXY_HOPS is not consulted; TRUST_PROXY_HOPS is the fallback
+# when that header is ignored or absent. Faked headers from visitors are
+# ignored in every row — only the counted proxies are trusted.
 # TRUST_PROXY_HOPS=0
-# TRUST_FORWARDED_HEADER=false
+# TRUST_FORWARDED_HOPS=0
 
 # Log verbosity: debug | info | warn | error (default: info).
 LOG_LEVEL=info

package/dist/init.js

@@ -6,7 +6,7 @@ import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, buildLoca
 import { healthPollTimeoutMs, healthTimeoutMessage, pollHealth, } from "./docker.js";
 import { reportPublicUrlProbe } from "./lifecycle.js";
 import { applyOptionalSettings, askOptionalSettings, derivePublicUrlOverride, } from "./optional-settings.js";
-import { buildFilesToWrite, readEnvPort, readEnvPublicUrl, writeFiles, } from "./scaffold.js";
+import { buildFilesToWrite, readEnvPort, readEnvPublicUrl, stripEnvQuotedValues, writeFiles, } from "./scaffold.js";
 import { generateToken } from "./token.js";
 import { expandTilde, validateVaultPath } from "./vault.js";
 const DEFAULT_TARGET_DIR = "./vault-cortex";
@@ -174,9 +174,11 @@ const offerDockerRun = async (params, deps) => {
     const startNow = await prompts.confirm("Start the server now?", true);
     if (!startNow)
         return "not-started";
+    const envFilePath = join(targetDir, ".env");
+    stripEnvQuotedValues(envFilePath);
     const containerStarted = docker.dockerRun({
         mode,
-        envFilePath: join(targetDir, ".env"),
+        envFilePath,
         port,
         vaultPath,
     });

package/dist/lifecycle.js

@@ -1,7 +1,7 @@
 import { join, resolve } from "node:path";
 import { CONTAINER_NAME, healthPollTimeoutMs, healthTimeoutMessage, pollHealth, probeHealth, } from "./docker.js";
 import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, } from "./messages.js";
-import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, } from "./scaffold.js";
+import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, stripEnvQuotedValues, } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
 const DEFAULT_TARGET_DIR = "./vault-cortex";
 /**
@@ -110,6 +110,7 @@ export const recreateContainer = async (params, deps) => {
         prompts.error(`Could not remove the existing container — check: docker rm -f ${CONTAINER_NAME}`);
         return 1;
     }
+    stripEnvQuotedValues(deployment.envFilePath);
     prompts.log("Starting container...");
     const containerStarted = docker.dockerRun({
         mode: deployment.mode,

package/dist/scaffold.js

@@ -2,8 +2,8 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "
 import { join } from "node:path";
 /** Default host port — matches the container's internal port. */
 export const DEFAULT_PORT = 8000;
-/** Matches an active (uncommented) PORT line in a .env file. */
-const ENV_PORT_LINE = /^PORT=(\d+)\s*$/m;
+/** Matches an active (uncommented) PORT line, with optional surrounding quotes. */
+const ENV_PORT_LINE = /^PORT=["']?(\d+)["']?\s*$/m;
 /** Matches an active (uncommented) VAULT_PATH line in a .env file. */
 const ENV_VAULT_PATH_LINE = /^VAULT_PATH=(.+)\s*$/m;
 /** Matches an active (uncommented) PUBLIC_URL line. */
@@ -12,6 +12,17 @@ const ENV_PUBLIC_URL_LINE = /^PUBLIC_URL=/m;
 const ENV_PUBLIC_URL_VALUE_LINE = /^PUBLIC_URL=(.+)\s*$/m;
 /** Matches an active (uncommented) OBSIDIAN_AUTH_TOKEN line. */
 const OBSIDIAN_AUTH_TOKEN_LINE = /^OBSIDIAN_AUTH_TOKEN=/m;
+/** Matches an env line whose value is wrapped in matching quotes. */
+const QUOTED_ENV_VALUE = /^([A-Za-z_][A-Za-z0-9_]*=)(["'])(.*)\2(\s*)$/gm;
+/**
+ * Strips matching surrounding quotes from a value — `"foo"` → `foo`,
+ * `'bar'` → `bar`, `unquoted` → `unquoted`. Only strips when the
+ * opening and closing quote characters match.
+ */
+const stripSurroundingQuotes = (value) => {
+    const quoteMatch = /^(["'])(.*)\1$/.exec(value);
+    return quoteMatch ? quoteMatch[2] : value;
+};
 export const buildFilesToWrite = (envContent) => [
     // .env holds the bearer token (and possibly a vault password) — owner-only.
     { name: ".env", content: envContent, mode: 0o600 },
@@ -36,7 +47,8 @@ export const readEnvVaultPath = (envFilePath) => {
     if (!existsSync(envFilePath))
         return undefined;
     const match = ENV_VAULT_PATH_LINE.exec(readFileSync(envFilePath, "utf8"));
-    return match?.[1].trim();
+    const rawValue = match?.[1].trim();
+    return rawValue ? stripSurroundingQuotes(rawValue) : undefined;
 };
 /**
  * Returns true when the .env file has an active (uncommented) PUBLIC_URL line.
@@ -63,11 +75,12 @@ export const readEnvPublicUrl = (envFilePath) => {
     const match = ENV_PUBLIC_URL_VALUE_LINE.exec(readFileSync(envFilePath, "utf8"));
     // A whitespace-only line matches the regex and trims to "" — normalize to
     // undefined so the non-empty contract holds ("" is never a legitimate URL).
-    const publicUrlValue = match?.[1].trim();
+    const rawValue = match?.[1].trim();
+    const unquotedValue = rawValue ? stripSurroundingQuotes(rawValue) : undefined;
     // Strip trailing slashes (mirroring askPublicUrl's prompt-side
     // normalization): consumers append paths to this base, and a hand-edited
     // `https://host/` would otherwise print broken `//mcp` connect URLs.
-    const normalizedPublicUrl = publicUrlValue?.replace(/\/+$/, "");
+    const normalizedPublicUrl = unquotedValue?.replace(/\/+$/, "");
     return normalizedPublicUrl || undefined;
 };
 /**
@@ -100,6 +113,25 @@ export const patchEnvObsidianToken = (envFilePath, token) => {
     writeFileSync(envFilePath, patched);
     return true;
 };
+/**
+ * Strips surrounding quotes from env values in the file. `docker run
+ * --env-file` passes quotes literally (`VAULT_NAME="My Vault"` becomes
+ * the value `"My Vault"` with embedded quotes), while Compose strips
+ * them. Removing quotes makes the file work correctly for both paths.
+ * Returns true when the file was modified.
+ */
+export const stripEnvQuotedValues = (envFilePath) => {
+    if (!existsSync(envFilePath))
+        return false;
+    const content = readFileSync(envFilePath, "utf8");
+    // Reset lastIndex — the /g flag makes the regex stateful.
+    QUOTED_ENV_VALUE.lastIndex = 0;
+    const sanitized = content.replace(QUOTED_ENV_VALUE, "$1$3$4");
+    if (sanitized === content)
+        return false;
+    writeFileSync(envFilePath, sanitized);
+    return true;
+};
 /**
  * Writes the files into targetDir (created if missing). Existing files
  * are never overwritten silently: identical content is skipped, and differing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.11.0",
+  "version": "0.12.0-beta.60",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex@latest init",
   "license": "MIT",
   "type": "module",