vault-cortex 0.11.0 → 0.12.0-beta.61

package/README.md

@@ -61,7 +61,8 @@ Re-running init where a setup already exists asks first — declining leaves
 everything unchanged and points you at [`configure`](#configure), the right
 tool for changing settings in place. Existing files are never overwritten
 without asking. During a remote setup, init offers to run
-[`get-sync-token`](#get-sync-token) for you when Docker is available.
+[`get-sync-token`](#get-sync-token) for you — sign in to your Obsidian
+account right from the terminal.
 
 Flags:
 
@@ -194,17 +195,16 @@ remote setups — without leaving the CLI:
 npx vault-cortex@latest get-sync-token
 ```
 
-The command opens the Obsidian login inside Docker. Once you've signed in, it
-captures your token and prints it — nothing to dig out of the login output.
-Use `--dir <path>` to write the token straight into an existing `.env`
-instead:
+The command prompts for your Obsidian account email, password, and MFA code
+(if enabled), signs in via the Obsidian API, and prints the token. No Docker
+required. Use `--dir <path>` to write the token straight into an existing
+`.env` instead:
 
 ```bash
 npx vault-cortex@latest get-sync-token --dir ./vault-cortex
 ```
 
-During `init --mode remote`, this flow is offered automatically when Docker
-is available.
+During `init --mode remote`, this flow is offered automatically.
 
 ## Requirements
 

package/dist/docker.js

@@ -2,36 +2,6 @@ import { spawn, spawnSync } from "node:child_process";
 export const LOCAL_IMAGE = "ghcr.io/aliasunder/vault-cortex:latest";
 export const REMOTE_IMAGE = "ghcr.io/aliasunder/vault-cortex:remote";
 export const CONTAINER_NAME = "vault-cortex";
-/**
- * Builds the `docker run` args for the Obsidian login with a volume mount
- * that captures the auth token file. Runs `ob login` directly instead of
- * the image's get-sync-token script: the script's additions are locating and
- * printing the token, and the mount makes both unnecessary — the CLI reads
- * the token file itself, and not echoing a credential keeps it out of
- * terminal scrollback. Pure function for testability.
- *
- * On Linux, includes `--user uid:gid` when uid/gid are provided — Node
- * exposes process.getuid/getgid on every POSIX platform, so in practice the
- * flag is always set there — keeping the token file host-user-owned. macOS
- * Docker Desktop translates UIDs automatically, so no flag is needed.
- */
-export const buildObsidianLoginArgs = (params) => {
-    const { configMountPath, platform = process.platform, uid, gid } = params;
-    const args = [
-        "run",
-        "--rm",
-        "-it",
-        "--entrypoint",
-        "ob",
-        "-v",
-        `${configMountPath}:/home/obsidian/.config`,
-    ];
-    if (platform === "linux" && uid !== undefined && gid !== undefined) {
-        args.push("--user", `${uid}:${gid}`);
-    }
-    args.push(REMOTE_IMAGE, "login");
-    return args;
-};
 /**
  * Container-internal env vars that must override the user's .env values.
  * VAULT_PATH in .env is the host path (for the -v mount); the container
@@ -130,10 +100,7 @@ export const createDockerRunner = () => ({
     // stdout is discarded: `docker run -d` prints only the container ID there,
     // which lands as a raw hex line between the wizard's prompts. stderr stays
     // inherited — image-pull progress and error output print live, which the
-    // "see output above" failure messages rely on. stdin is ignored on purpose:
-    // buildDockerRunArgs always runs detached (never -it), and the prompt
-    // library owns the terminal's stdin — interactive flows go through
-    // runObsidianLogin, which inherits all three streams.
+    // "see output above" failure messages rely on.
     dockerRun: (params) => spawnSync("docker", buildDockerRunArgs(params), {
         stdio: ["ignore", "ignore", "inherit"],
     }).status === 0,
@@ -166,11 +133,6 @@ export const createDockerRunner = () => ({
         // convention for ctrl-C (128 + SIGINT = 130).
         child.once("close", (code) => resolveExitCode(code ?? 130));
     }),
-    runObsidianLogin: (configMountPath) => spawnSync("docker", buildObsidianLoginArgs({
-        configMountPath,
-        uid: process.getuid?.(),
-        gid: process.getgid?.(),
-    }), { stdio: "inherit" }).status === 0,
 });
 /** Default bound on a single health request (shared by probe and poll). */
 const PROBE_TIMEOUT_MS = 10_000;

package/dist/env.js

@@ -94,17 +94,28 @@ MEMORY_DIR=About Me
 # Host port to expose (default: 8000).
 PORT=8000
 
-# Client-IP trust for OAuth rate limiting and logs (defaults shown).
-# With nothing in front of the server, leave both untouched — each visitor
-# is identified by their own connection, and faked Forwarded/X-Forwarded-For
-# headers are ignored.
-# With a proxy or tunnel you control in front (Caddy, nginx, Cloudflare
-# Tunnel), set TRUST_PROXY_HOPS=1 so visitors are told apart by their real
-# IP — otherwise they all share one rate-limit budget.
-# Set TRUST_FORWARDED_HEADER=true only if the proxy reports each visitor's
-# IP in the RFC 7239 Forwarded header (e.g. AWS API Gateway).
+# These two settings choose the client IP used for OAuth rate limiting and
+# logs (defaults shown below). Without the right values, every visitor
+# behind a proxy shares one rate-limit budget. TRUST_PROXY_HOPS counts the
+# proxies you control that write X-Forwarded-For; TRUST_FORWARDED_HOPS
+# counts the ones that write the RFC 7239 Forwarded header
+# (https://www.rfc-editor.org/rfc/rfc7239), and 0 ignores that header.
+#
+#   What sits in front of the server       TRUST_PROXY_HOPS  TRUST_FORWARDED_HOPS  Client IP is
+#   Nothing (default)                      0                 0                     the visitor (socket peer)
+#   A proxy or tunnel you control          1                 0                     the visitor (X-Forwarded-For)
+#     (Caddy, nginx, Cloudflare Tunnel)
+#   A proxy that reports visitors in       1                 1                     the visitor (Forwarded)
+#     Forwarded (e.g. AWS API Gateway)
+#   A CDN in front of that proxy, and      1                 2                     the visitor (Forwarded)
+#     the CDN is the only way to reach it
+#
+# When the Forwarded header is read (TRUST_FORWARDED_HOPS above 0), it wins
+# and TRUST_PROXY_HOPS is not consulted; TRUST_PROXY_HOPS is the fallback
+# when that header is ignored or absent. Faked headers from visitors are
+# ignored in every row — only the counted proxies are trusted.
 # TRUST_PROXY_HOPS=0
-# TRUST_FORWARDED_HEADER=false
+# TRUST_FORWARDED_HOPS=0
 
 # Log verbosity: debug | info | warn | error (default: info).
 LOG_LEVEL=info
@@ -221,17 +232,28 @@ MEMORY_DIR=About Me
 # Host port to expose (default: 8000).
 PORT=8000
 
-# Client-IP trust for OAuth rate limiting and logs (defaults shown).
-# With nothing in front of the server, leave both untouched — each visitor
-# is identified by their own connection, and faked Forwarded/X-Forwarded-For
-# headers are ignored.
-# With a proxy or tunnel you control in front (Caddy, nginx, Cloudflare
-# Tunnel), set TRUST_PROXY_HOPS=1 so visitors are told apart by their real
-# IP — otherwise they all share one rate-limit budget.
-# Set TRUST_FORWARDED_HEADER=true only if the proxy reports each visitor's
-# IP in the RFC 7239 Forwarded header (e.g. AWS API Gateway).
+# These two settings choose the client IP used for OAuth rate limiting and
+# logs (defaults shown below). Without the right values, every visitor
+# behind a proxy shares one rate-limit budget. TRUST_PROXY_HOPS counts the
+# proxies you control that write X-Forwarded-For; TRUST_FORWARDED_HOPS
+# counts the ones that write the RFC 7239 Forwarded header
+# (https://www.rfc-editor.org/rfc/rfc7239), and 0 ignores that header.
+#
+#   What sits in front of the server       TRUST_PROXY_HOPS  TRUST_FORWARDED_HOPS  Client IP is
+#   Nothing (default)                      0                 0                     the visitor (socket peer)
+#   A proxy or tunnel you control          1                 0                     the visitor (X-Forwarded-For)
+#     (Caddy, nginx, Cloudflare Tunnel)
+#   A proxy that reports visitors in       1                 1                     the visitor (Forwarded)
+#     Forwarded (e.g. AWS API Gateway)
+#   A CDN in front of that proxy, and      1                 2                     the visitor (Forwarded)
+#     the CDN is the only way to reach it
+#
+# When the Forwarded header is read (TRUST_FORWARDED_HOPS above 0), it wins
+# and TRUST_PROXY_HOPS is not consulted; TRUST_PROXY_HOPS is the fallback
+# when that header is ignored or absent. Faked headers from visitors are
+# ignored in every row — only the counted proxies are trusted.
 # TRUST_PROXY_HOPS=0
-# TRUST_FORWARDED_HEADER=false
+# TRUST_FORWARDED_HOPS=0
 
 # Log verbosity: debug | info | warn | error (default: info).
 LOG_LEVEL=info

package/dist/get-sync-token.js

@@ -1,140 +1,130 @@
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, } from "./messages.js";
 import { patchEnvObsidianToken } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
-/** Message from an unknown throw — Error instances keep their message. */
+const OBSIDIAN_SIGNIN_URL = "https://api.obsidian.md/user/signin";
+const SIGNIN_TIMEOUT_MS = 30_000;
 const describeError = (error) => error instanceof Error ? error.message : String(error);
 /**
- * Creates the temp dir the container's config mount writes into.
- * Returns undefined (after warning) when creation fails.
+ * Calls the Obsidian Sync signin API. Returns the parsed JSON on success,
+ * or throws on HTTP/network errors. The API returns { error: string } for
+ * auth failures (200 with an error field), and non-200 for server errors.
  */
-const makeTempMountDir = (prompts) => {
-    try {
-        return mkdtempSync(join(tmpdir(), "vault-cortex-sync-token-"));
+const callSigninApi = async (params, fetchFn) => {
+    const response = await fetchFn(OBSIDIAN_SIGNIN_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Origin: "https://obsidian.md",
+        },
+        body: JSON.stringify({
+            email: params.email,
+            password: params.password,
+            mfa: params.mfa,
+        }),
+        signal: AbortSignal.timeout(SIGNIN_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`HTTP Error ${response.status}`);
     }
-    catch (error) {
-        prompts.warn(`Could not create a temp directory for token capture — ${describeError(error)}`);
-        return undefined;
-    }
-};
-/**
- * Runs the interactive Obsidian login container. A throw from the Docker
- * runner is reported and treated the same as a non-zero exit.
- */
-const runLoginContainer = (configMountPath, deps) => {
-    const { docker, prompts } = deps;
+    let body;
     try {
-        return docker.runObsidianLogin(configMountPath);
+        body = await response.json();
     }
-    catch (error) {
-        prompts.warn(`Docker run failed — ${describeError(error)}`);
-        return false;
+    catch {
+        throw new Error("Unexpected response from Obsidian API (not JSON)");
     }
-};
-/**
- * Reads the captured token file from the config mount. Returns undefined
- * when the file is missing, empty, or unreadable — the caller treats all
- * three as "no token captured".
- */
-const readCapturedTokenFile = (configMountPath) => {
-    const tokenPath = join(configMountPath, "obsidian-headless", "auth_token");
-    try {
-        if (!existsSync(tokenPath))
-            return undefined;
-        const token = readFileSync(tokenPath, "utf8").trim();
-        return token || undefined;
+    const isRecord = (value) => typeof value === "object" && value !== null;
+    if (!isRecord(body)) {
+        throw new Error("Unexpected response from Obsidian API (not JSON)");
     }
-    catch {
-        return undefined;
+    if ("error" in body && typeof body.error === "string") {
+        throw new ObsidianApiError(body.error);
+    }
+    const token = "token" in body && typeof body.token === "string" ? body.token : undefined;
+    if (!token) {
+        throw new Error("Unexpected response from Obsidian API (no token)");
     }
+    const name = "name" in body && typeof body.name === "string" ? body.name : "";
+    const email = "email" in body && typeof body.email === "string" ? body.email : "";
+    return { token, name, email };
 };
+class ObsidianApiError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ObsidianApiError";
+    }
+}
 /**
- * Best-effort removal of the temp mount dir. Failing to remove it (e.g.
- * root-owned files left by the container) must not turn a successful
- * capture into a failure, so it warns instead of throwing.
+ * Signs in to the user's Obsidian account via the Sync API and returns
+ * the auth token. Prompts for email, password, and MFA code (when 2FA
+ * is enabled). Returns the token on success, undefined on any failure.
  */
-const removeTempMountDir = (configMountPath, prompts) => {
+export const captureObsidianToken = async (deps) => {
+    const { prompts, fetchFn } = deps;
+    const email = await prompts.text("Obsidian account email:", {
+        placeholder: "you@example.com",
+    });
+    const password = await prompts.password("Password:");
+    const spinner = prompts.spinner();
+    spinner.start("Signing in to Obsidian...");
     try {
-        rmSync(configMountPath, { recursive: true, force: true });
+        const result = await callSigninApi({ email, password, mfa: "" }, fetchFn);
+        spinner.stop(`Signed in as ${result.name} (${result.email}).`);
+        return result.token;
     }
     catch (error) {
-        prompts.warn(`Could not remove temp directory ${configMountPath} — ${describeError(error)}`);
-    }
-};
-/**
- * Runs the Obsidian login (`ob login`) inside a Docker container with a
- * volume mount that captures the auth token file. The interactive login
- * (email, password, MFA) shows in the terminal, but the resulting token is
- * read from the mounted config dir — never printed, so it stays out of
- * terminal scrollback.
- *
- * tokenDestinationMessage finishes the handoff message by telling the user
- * where the captured token ends up — the destination differs per flow
- * (init stores it in the generated .env; the subcommand prints it, or
- * writes it to an existing .env with --dir).
- *
- * Returns the token string on success, undefined on any failure — each
- * fallible operation is wrapped individually by the helpers above, so no
- * catch-all is needed here. The bare try/finally only scopes the temp dir
- * (acquire → release); it has no catch and swallows nothing.
- */
-export const captureObsidianToken = (deps, tokenDestinationMessage) => {
-    const { prompts } = deps;
-    const configMountPath = makeTempMountDir(prompts);
-    if (!configMountPath)
-        return undefined;
-    try {
-        prompts.log("Handing the terminal to the Obsidian login — it will ask for your " +
-            `account email, password, and MFA code. ${tokenDestinationMessage}`);
-        const loginSucceeded = runLoginContainer(configMountPath, deps);
-        if (!loginSucceeded) {
-            prompts.warn("The Obsidian login did not complete — you can run it later with:\n" +
-                "  npx vault-cortex@latest get-sync-token");
-            return undefined;
+        // MFA required: the API returns an error containing "2FA code" — prompt
+        // and retry. "2FA code is incorrect" is a wrong-code rejection, not a
+        // prompt-for-code signal. Mirrors the obsidian-headless v0.0.14 logic.
+        if (error instanceof ObsidianApiError &&
+            error.message.includes("2FA code") &&
+            !error.message.includes("2FA code is incorrect")) {
+            spinner.stop("Two-factor authentication required.");
+            const mfaCode = await prompts.text("2FA code:");
+            spinner.start("Verifying...");
+            try {
+                const result = await callSigninApi({ email, password, mfa: mfaCode }, fetchFn);
+                spinner.stop(`Signed in as ${result.name} (${result.email}).`);
+                return result.token;
+            }
+            catch (retryError) {
+                spinner.stop("Sign-in failed.");
+                if (retryError instanceof Error && retryError.name === "TimeoutError") {
+                    prompts.warn("Request timed out — check your internet connection and try again.");
+                    return undefined;
+                }
+                const retryHint = retryError instanceof ObsidianApiError
+                    ? "\n  Check your 2FA code and try again."
+                    : "";
+                prompts.warn(`Could not sign in: ${describeError(retryError)}${retryHint}`);
+                return undefined;
+            }
         }
-        const token = readCapturedTokenFile(configMountPath);
-        if (!token) {
-            prompts.warn("The Obsidian login finished, but no token was captured — the " +
-                "token file was missing, empty, or unreadable. You can retry with:\n" +
-                "  npx vault-cortex@latest get-sync-token");
+        spinner.stop("Sign-in failed.");
+        if (error instanceof Error && error.name === "TimeoutError") {
+            prompts.warn("Request timed out — check your internet connection and try again.");
             return undefined;
         }
-        return token;
-    }
-    finally {
-        removeTempMountDir(configMountPath, prompts);
+        prompts.warn(`Could not sign in: ${describeError(error)}`);
+        return undefined;
     }
 };
 /**
- * Subcommand entry: generate an Obsidian Sync token via Docker.
+ * Subcommand entry: generate an Obsidian Sync token via the Obsidian API.
  * Without --dir, prints the token to stdout.
  * With --dir, writes it directly to `<dir>/.env`.
  */
 export const runGetSyncToken = async (flags, deps) => {
-    const { prompts, docker } = deps;
-    const daemonStatus = docker.daemonStatus();
-    if (daemonStatus !== "running") {
-        prompts.error(daemonStatus === "not-installed"
-            ? buildDockerNotInstalledMessage({ nextStep: "\nThen try again." })
-            : buildDaemonNotRunningMessage(" and try again."));
-        return 1;
-    }
+    const { prompts } = deps;
     prompts.intro("vault-cortex get-sync-token");
-    // Resolve the destination up front so the login handoff message can tell
-    // the user where the token will end up.
-    const envFilePath = flags.dir
-        ? join(resolve(expandTilde(flags.dir)), ".env")
-        : undefined;
-    const tokenDestinationMessage = envFilePath
-        ? `The token is captured automatically and written to ${envFilePath}.`
-        : "The token is captured automatically and printed at the end.";
-    const token = captureObsidianToken({ docker, prompts }, tokenDestinationMessage);
+    const token = await captureObsidianToken(deps);
     if (!token) {
         prompts.error("Could not capture the auth token.");
         return 1;
     }
+    const envFilePath = flags.dir
+        ? join(resolve(expandTilde(flags.dir)), ".env")
+        : undefined;
     if (!envFilePath) {
         prompts.log("Your OBSIDIAN_AUTH_TOKEN:");
         prompts.print(`\n  ${token}\n`);

package/dist/init.js

@@ -27,15 +27,15 @@ const askMode = async (prompts) => {
     return isMode(selected) ? selected : "local";
 };
 /**
- * Offers to auto-capture the Obsidian Sync token via a Docker volume mount.
- * Returns the captured token string, or undefined when the user declines or
- * the capture fails (the caller falls back to a paste prompt).
+ * Offers to sign in to the Obsidian account and capture the Sync token.
+ * Returns the captured token string, or undefined when the user declines
+ * or the capture fails (the caller falls back to a paste prompt).
  */
-const offerSyncTokenCapture = async (prompts, docker) => {
+const offerSyncTokenCapture = async (prompts, fetchFn) => {
     const runNow = await prompts.confirm("Generate the token now?", true);
     if (!runNow)
         return undefined;
-    return captureObsidianToken({ docker, prompts }, "The token is captured automatically and stored in your .env — nothing to copy.");
+    return captureObsidianToken({ prompts, fetchFn });
 };
 /**
  * Asks for the vault path, recursing to re-prompt until it gets a usable
@@ -285,12 +285,12 @@ const runLocalInit = async (flags, deps) => {
     return 0;
 };
 // Remote flow (VPS + Obsidian Sync): resolve target dir → PUBLIC_URL →
-// VAULT_NAME → Obsidian Sync token (optionally running the Obsidian login via
-// Docker) → optional E2E vault password → generate token → write .env →
-// optionally start → print connect instructions. Always interactive —
-// the sync-token step can't be defaulted.
+// VAULT_NAME → Obsidian Sync token (sign in via the Obsidian API) → optional
+// E2E vault password → generate token → write .env → optionally start → print
+// connect instructions. Always interactive — the sync-token step can't be
+// defaulted.
 const runRemoteInit = async (flags, deps) => {
-    const { prompts, docker } = deps;
+    const { prompts, fetchFn } = deps;
     // expandTilde before resolve: resolve() treats a leading `~` as a literal
     // path segment, so a quoted "~/path" would create a directory named "~".
     const targetDir = resolve(expandTilde(flags.dir ??
@@ -303,14 +303,9 @@ const runRemoteInit = async (flags, deps) => {
         return 0;
     const publicUrl = await askPublicUrl(prompts);
     const vaultName = await askVaultName(prompts);
-    // Auto-capture the Obsidian Sync token via a Docker volume mount when
-    // the daemon is reachable. Falls back to a paste prompt when capture
-    // fails or the user declines. Both non-running states stay silent here —
-    // the paste fallback is fully functional without Docker, and the start
-    // offer surfaces the differentiated runtime guidance later in the flow.
-    const capturedToken = docker.daemonStatus() === "running"
-        ? await offerSyncTokenCapture(prompts, docker)
-        : undefined;
+    // Sign in to Obsidian and capture the Sync token directly via the API.
+    // Falls back to a paste prompt when the user declines or capture fails.
+    const capturedToken = await offerSyncTokenCapture(prompts, fetchFn);
     // Masked prompt: the sync token is a credential and must not echo into
     // the terminal or scrollback. An empty submission still means "fill in
     // .env later" — clack's password prompt accepts blank input.

package/dist/main.js

@@ -44,7 +44,7 @@ export const run = async (version) => {
         }),
         runGetSyncToken: (flags) => runGetSyncToken(flags, {
             prompts: createPrompts(),
-            docker: createDockerRunner(),
+            fetchFn: fetch,
         }),
     });
     await program.parseAsync();

package/dist/messages.js

@@ -33,7 +33,7 @@ const dockerInstallLine = (platform) => {
 /**
  * "No runtime at all" guidance — distinct from the daemon-stopped message so
  * the user isn't told to start something that isn't installed. platform is a
- * defaulted param (mirroring buildObsidianLoginArgs) so each branch stays
+ * defaulted param so each branch stays
  * testable; `nextStep` is appended verbatim, as in
  * buildDaemonNotRunningMessage.
  */

package/dist/program.js

@@ -61,7 +61,7 @@ export const buildProgram = (options) => {
     });
     program
         .command("get-sync-token")
-        .description("Generate an Obsidian Sync auth token via Docker and print it or write it to .env")
+        .description("Sign in to your Obsidian account and print the Sync auth token, or write it to .env")
         .option("--dir <path>", "directory containing .env to update with the token")
         .action(async (flags) => {
         process.exitCode = await options.runGetSyncToken(flags);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.11.0",
+  "version": "0.12.0-beta.61",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex@latest init",
   "license": "MIT",
   "type": "module",