vault-cortex 0.12.0-beta.61 → 0.13.0

package/README.md

@@ -60,9 +60,8 @@ What it does:
 Re-running init where a setup already exists asks first — declining leaves
 everything unchanged and points you at [`configure`](#configure), the right
 tool for changing settings in place. Existing files are never overwritten
-without asking. During a remote setup, init offers to run
-[`get-sync-token`](#get-sync-token) for you — sign in to your Obsidian
-account right from the terminal.
+without asking. During a remote setup, init offers to generate your
+[Obsidian Sync token](#get-sync-token) as part of the flow.
 
 Flags:
 
@@ -196,9 +195,8 @@ npx vault-cortex@latest get-sync-token
 ```
 
 The command prompts for your Obsidian account email, password, and MFA code
-(if enabled), signs in via the Obsidian API, and prints the token. No Docker
-required. Use `--dir <path>` to write the token straight into an existing
-`.env` instead:
+(if enabled), signs in via the Obsidian API, and prints the token. Use
+`--dir <path>` to write the token straight into an existing `.env` instead:
 
 ```bash
 npx vault-cortex@latest get-sync-token --dir ./vault-cortex
@@ -218,4 +216,5 @@ During `init --mode remote`, this flow is offered automatically.
 
 - [Local quickstart](https://github.com/aliasunder/vault-cortex/blob/main/deploy/local/README.md)
 - [Remote quickstart (VPS + Obsidian Sync)](https://github.com/aliasunder/vault-cortex/blob/main/deploy/remote/README.md)
+- [One-click deploy on Render or Railway](https://github.com/aliasunder/vault-cortex#one-click-deploy)
 - [Full project README](https://github.com/aliasunder/vault-cortex)

package/dist/env.js

@@ -324,11 +324,11 @@ export const buildRemoteEnv = (answers) => {
 # VAULT_PASSWORD=`
         : `# Vault end-to-end encryption password.
 VAULT_PASSWORD=${answers.vaultPassword}`;
-    const obsidianTokenComment = answers.obsidianAuthToken === ""
-        ? `# Obsidian Sync auth token — FILL THIS IN before starting the server.
+    const obsidianTokenComment = answers.obsidianAuthToken
+        ? `# Obsidian Sync auth token.`
+        : `# Obsidian Sync auth token — FILL THIS IN before starting the server.
 # Generate once with:
-#   npx vault-cortex@latest get-sync-token`
-        : `# Obsidian Sync auth token.`;
+#   npx vault-cortex@latest get-sync-token`;
     return `# vault-cortex — remote quickstart (Obsidian Sync)
 # Generated by \`npx vault-cortex@latest init\`. Full option reference:
 # https://github.com/aliasunder/vault-cortex/blob/main/deploy/remote/.env.example
@@ -343,7 +343,7 @@ MCP_AUTH_TOKEN=${answers.mcpAuthToken}
 PUBLIC_URL=${answers.publicUrl}
 
 ${obsidianTokenComment}
-OBSIDIAN_AUTH_TOKEN=${answers.obsidianAuthToken}
+OBSIDIAN_AUTH_TOKEN=${answers.obsidianAuthToken ?? ""}
 
 # Exact name of your Obsidian vault (case-sensitive).
 VAULT_NAME=${answers.vaultName}

package/dist/get-sync-token.js

@@ -1,9 +1,16 @@
 import { join, resolve } from "node:path";
 import { patchEnvObsidianToken } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
-const OBSIDIAN_SIGNIN_URL = "https://api.obsidian.md/user/signin";
+const OBSIDIAN_SIGNIN_URL = process.env.OBSIDIAN_SIGNIN_URL ?? "https://api.obsidian.md/user/signin";
 const SIGNIN_TIMEOUT_MS = 30_000;
 const describeError = (error) => error instanceof Error ? error.message : String(error);
+class ObsidianApiError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ObsidianApiError";
+    }
+}
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
  * Calls the Obsidian Sync signin API. Returns the parsed JSON on success,
  * or throws on HTTP/network errors. The API returns { error: string } for
@@ -23,37 +30,37 @@ const callSigninApi = async (params, fetchFn) => {
         }),
         signal: AbortSignal.timeout(SIGNIN_TIMEOUT_MS),
     });
-    if (!response.ok) {
+    if (!response.ok)
         throw new Error(`HTTP Error ${response.status}`);
-    }
-    let body;
     try {
-        body = await response.json();
-    }
-    catch {
-        throw new Error("Unexpected response from Obsidian API (not JSON)");
-    }
-    const isRecord = (value) => typeof value === "object" && value !== null;
-    if (!isRecord(body)) {
-        throw new Error("Unexpected response from Obsidian API (not JSON)");
+        const body = await response.json();
+        if (!isJsonObject(body))
+            throw new Error("not a JSON object");
+        if (typeof body.error === "string")
+            throw new ObsidianApiError(body.error);
+        if (typeof body.token !== "string" || !body.token)
+            throw new Error("no token field");
+        return body.token;
     }
-    if ("error" in body && typeof body.error === "string") {
-        throw new ObsidianApiError(body.error);
-    }
-    const token = "token" in body && typeof body.token === "string" ? body.token : undefined;
-    if (!token) {
-        throw new Error("Unexpected response from Obsidian API (no token)");
+    catch (error) {
+        if (error instanceof ObsidianApiError)
+            throw error;
+        throw new Error(`Unexpected response from Obsidian API (${describeError(error)})`, { cause: error });
     }
-    const name = "name" in body && typeof body.name === "string" ? body.name : "";
-    const email = "email" in body && typeof body.email === "string" ? body.email : "";
-    return { token, name, email };
 };
-class ObsidianApiError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ObsidianApiError";
+/**
+ * Warns the user about a signin failure with a message tailored to the
+ * error type. Called by both the initial signin and MFA retry paths.
+ */
+const warnSigninError = (error, prompts, isMfaRetry) => {
+    if (error instanceof Error && error.name === "TimeoutError") {
+        prompts.warn("Request timed out — check your internet connection and try again.");
+        return;
     }
-}
+    const isMfaError = error instanceof ObsidianApiError && error.message.includes("2FA code");
+    const mfaHint = isMfaRetry && isMfaError ? "\n  Check your 2FA code and try again." : "";
+    prompts.warn(`Could not sign in: ${describeError(error)}${mfaHint}`);
+};
 /**
  * Signs in to the user's Obsidian account via the Sync API and returns
  * the auth token. Prompts for email, password, and MFA code (when 2FA
@@ -68,45 +75,35 @@ export const captureObsidianToken = async (deps) => {
     const spinner = prompts.spinner();
     spinner.start("Signing in to Obsidian...");
     try {
-        const result = await callSigninApi({ email, password, mfa: "" }, fetchFn);
-        spinner.stop(`Signed in as ${result.name} (${result.email}).`);
-        return result.token;
+        const token = await callSigninApi({ email, password, mfa: "" }, fetchFn);
+        spinner.stop(`Signed in as ${email}.`);
+        return token;
     }
     catch (error) {
         // MFA required: the API returns an error containing "2FA code" — prompt
         // and retry. "2FA code is incorrect" is a wrong-code rejection, not a
         // prompt-for-code signal. Mirrors the obsidian-headless v0.0.14 logic.
-        if (error instanceof ObsidianApiError &&
+        const needsMfa = error instanceof ObsidianApiError &&
             error.message.includes("2FA code") &&
-            !error.message.includes("2FA code is incorrect")) {
-            spinner.stop("Two-factor authentication required.");
-            const mfaCode = await prompts.text("2FA code:");
-            spinner.start("Verifying...");
-            try {
-                const result = await callSigninApi({ email, password, mfa: mfaCode }, fetchFn);
-                spinner.stop(`Signed in as ${result.name} (${result.email}).`);
-                return result.token;
-            }
-            catch (retryError) {
-                spinner.stop("Sign-in failed.");
-                if (retryError instanceof Error && retryError.name === "TimeoutError") {
-                    prompts.warn("Request timed out — check your internet connection and try again.");
-                    return undefined;
-                }
-                const retryHint = retryError instanceof ObsidianApiError
-                    ? "\n  Check your 2FA code and try again."
-                    : "";
-                prompts.warn(`Could not sign in: ${describeError(retryError)}${retryHint}`);
-                return undefined;
-            }
+            !error.message.includes("2FA code is incorrect");
+        if (!needsMfa) {
+            spinner.stop("Sign-in failed.");
+            warnSigninError(error, prompts, false);
+            return undefined;
+        }
+        spinner.stop("Two-factor authentication required.");
+        const mfaCode = await prompts.text("2FA code:");
+        spinner.start("Verifying...");
+        try {
+            const token = await callSigninApi({ email, password, mfa: mfaCode }, fetchFn);
+            spinner.stop(`Signed in as ${email}.`);
+            return token;
         }
-        spinner.stop("Sign-in failed.");
-        if (error instanceof Error && error.name === "TimeoutError") {
-            prompts.warn("Request timed out — check your internet connection and try again.");
+        catch (retryError) {
+            spinner.stop("Sign-in failed.");
+            warnSigninError(retryError, prompts, true);
             return undefined;
         }
-        prompts.warn(`Could not sign in: ${describeError(error)}`);
-        return undefined;
     }
 };
 /**
@@ -137,7 +134,8 @@ export const runGetSyncToken = async (flags, deps) => {
             "OBSIDIAN_AUTH_TOKEN line. Run init first.");
         return 1;
     }
-    prompts.log(`Token written to ${envFilePath}`);
+    prompts.log(`Token written to ${envFilePath}\n\n` +
+        `Start the server:\n  npx vault-cortex start --dir "${flags.dir}"`);
     prompts.outro("Done.");
     return 0;
 };

package/dist/init.js

@@ -6,7 +6,7 @@ import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, buildLoca
 import { healthPollTimeoutMs, healthTimeoutMessage, pollHealth, } from "./docker.js";
 import { reportPublicUrlProbe } from "./lifecycle.js";
 import { applyOptionalSettings, askOptionalSettings, derivePublicUrlOverride, } from "./optional-settings.js";
-import { buildFilesToWrite, readEnvPort, readEnvPublicUrl, writeFiles, } from "./scaffold.js";
+import { buildFilesToWrite, readEnvObsidianToken, readEnvPort, readEnvPublicUrl, stripEnvQuotedValues, writeFiles, } from "./scaffold.js";
 import { generateToken } from "./token.js";
 import { expandTilde, validateVaultPath } from "./vault.js";
 const DEFAULT_TARGET_DIR = "./vault-cortex";
@@ -29,9 +29,12 @@ const askMode = async (prompts) => {
 /**
  * Offers to sign in to the Obsidian account and capture the Sync token.
  * Returns the captured token string, or undefined when the user declines
- * or the capture fails (the caller falls back to a paste prompt).
+ * or the capture fails (the caller falls back to any token already in the
+ * on-disk .env, or shows get-sync-token guidance).
  */
 const offerSyncTokenCapture = async (prompts, fetchFn) => {
+    prompts.log("Your server needs an Obsidian Sync token to access your vault.\n" +
+        "You can sign in to your Obsidian account now to generate one.");
     const runNow = await prompts.confirm("Generate the token now?", true);
     if (!runNow)
         return undefined;
@@ -174,9 +177,11 @@ const offerDockerRun = async (params, deps) => {
     const startNow = await prompts.confirm("Start the server now?", true);
     if (!startNow)
         return "not-started";
+    const envFilePath = join(targetDir, ".env");
+    stripEnvQuotedValues(envFilePath);
     const containerStarted = docker.dockerRun({
         mode,
-        envFilePath: join(targetDir, ".env"),
+        envFilePath,
         port,
         vaultPath,
     });
@@ -304,13 +309,16 @@ const runRemoteInit = async (flags, deps) => {
     const publicUrl = await askPublicUrl(prompts);
     const vaultName = await askVaultName(prompts);
     // Sign in to Obsidian and capture the Sync token directly via the API.
-    // Falls back to a paste prompt when the user declines or capture fails.
+    // When the user declines or capture fails, fall back to any token already
+    // in the on-disk .env (a re-init over an existing deployment). Only show
+    // the "run get-sync-token later" guidance when neither source has a token.
     const capturedToken = await offerSyncTokenCapture(prompts, fetchFn);
-    // Masked prompt: the sync token is a credential and must not echo into
-    // the terminal or scrollback. An empty submission still means "fill in
-    // .env later" — clack's password prompt accepts blank input.
-    const obsidianAuthToken = capturedToken ??
-        (await prompts.password("Paste the Obsidian Sync token (leave blank to fill in .env later):")).trim();
+    const existingEnvToken = readEnvObsidianToken(join(targetDir, ".env"));
+    const hasExistingToken = Boolean(capturedToken ?? existingEnvToken);
+    if (!hasExistingToken) {
+        prompts.log("No token yet — run this later to add it to your .env:\n" +
+            `  npx vault-cortex@latest get-sync-token --dir "${targetDir}"`);
+    }
     const usesEncryption = await prompts.confirm("Does your vault use end-to-end encryption?", false);
     const vaultPassword = usesEncryption
         ? await prompts.password("Vault encryption password:")
@@ -324,7 +332,7 @@ const runRemoteInit = async (flags, deps) => {
     const defaultEnvContent = buildRemoteEnv({
         mcpAuthToken: token,
         publicUrl,
-        obsidianAuthToken,
+        obsidianAuthToken: capturedToken ?? existingEnvToken,
         vaultName,
         vaultPassword,
     });
@@ -349,7 +357,7 @@ const runRemoteInit = async (flags, deps) => {
     const effectivePublicUrl = readEnvPublicUrl(join(targetDir, ".env")) ?? publicUrl;
     // Without the sync token the container can't start (init-check-auth fails
     // and s6 stops it), so only offer docker run when it was provided.
-    const startStatus = obsidianAuthToken === ""
+    const startStatus = !hasExistingToken
         ? "not-started"
         : await offerDockerRun({ targetDir, port, mode: "remote" }, deps);
     // The container check above hit localhost on this machine; the public URL
@@ -365,7 +373,7 @@ const runRemoteInit = async (flags, deps) => {
         token,
         publicUrl: effectivePublicUrl,
         startStatus,
-        obsidianTokenMissing: obsidianAuthToken === "",
+        obsidianTokenMissing: !hasExistingToken,
         tokenWritten,
     }));
     return 0;

package/dist/lifecycle.js

@@ -1,7 +1,7 @@
 import { join, resolve } from "node:path";
 import { CONTAINER_NAME, healthPollTimeoutMs, healthTimeoutMessage, pollHealth, probeHealth, } from "./docker.js";
 import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, } from "./messages.js";
-import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, } from "./scaffold.js";
+import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, stripEnvQuotedValues, } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
 const DEFAULT_TARGET_DIR = "./vault-cortex";
 /**
@@ -110,6 +110,7 @@ export const recreateContainer = async (params, deps) => {
         prompts.error(`Could not remove the existing container — check: docker rm -f ${CONTAINER_NAME}`);
         return 1;
     }
+    stripEnvQuotedValues(deployment.envFilePath);
     prompts.log("Starting container...");
     const containerStarted = docker.dockerRun({
         mode: deployment.mode,

package/dist/scaffold.js

@@ -2,8 +2,8 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "
 import { join } from "node:path";
 /** Default host port — matches the container's internal port. */
 export const DEFAULT_PORT = 8000;
-/** Matches an active (uncommented) PORT line in a .env file. */
-const ENV_PORT_LINE = /^PORT=(\d+)\s*$/m;
+/** Matches an active (uncommented) PORT line, with optional surrounding quotes. */
+const ENV_PORT_LINE = /^PORT=["']?(\d+)["']?\s*$/m;
 /** Matches an active (uncommented) VAULT_PATH line in a .env file. */
 const ENV_VAULT_PATH_LINE = /^VAULT_PATH=(.+)\s*$/m;
 /** Matches an active (uncommented) PUBLIC_URL line. */
@@ -12,6 +12,17 @@ const ENV_PUBLIC_URL_LINE = /^PUBLIC_URL=/m;
 const ENV_PUBLIC_URL_VALUE_LINE = /^PUBLIC_URL=(.+)\s*$/m;
 /** Matches an active (uncommented) OBSIDIAN_AUTH_TOKEN line. */
 const OBSIDIAN_AUTH_TOKEN_LINE = /^OBSIDIAN_AUTH_TOKEN=/m;
+/** Matches an env line whose value is wrapped in matching quotes. */
+const QUOTED_ENV_VALUE = /^([A-Za-z_][A-Za-z0-9_]*=)(["'])(.*)\2(\s*)$/gm;
+/**
+ * Strips matching surrounding quotes from a value — `"foo"` → `foo`,
+ * `'bar'` → `bar`, `unquoted` → `unquoted`. Only strips when the
+ * opening and closing quote characters match.
+ */
+const stripSurroundingQuotes = (value) => {
+    const quoteMatch = /^(["'])(.*)\1$/.exec(value);
+    return quoteMatch ? quoteMatch[2] : value;
+};
 export const buildFilesToWrite = (envContent) => [
     // .env holds the bearer token (and possibly a vault password) — owner-only.
     { name: ".env", content: envContent, mode: 0o600 },
@@ -36,7 +47,8 @@ export const readEnvVaultPath = (envFilePath) => {
     if (!existsSync(envFilePath))
         return undefined;
     const match = ENV_VAULT_PATH_LINE.exec(readFileSync(envFilePath, "utf8"));
-    return match?.[1].trim();
+    const rawValue = match?.[1].trim();
+    return rawValue ? stripSurroundingQuotes(rawValue) : undefined;
 };
 /**
  * Returns true when the .env file has an active (uncommented) PUBLIC_URL line.
@@ -63,11 +75,12 @@ export const readEnvPublicUrl = (envFilePath) => {
     const match = ENV_PUBLIC_URL_VALUE_LINE.exec(readFileSync(envFilePath, "utf8"));
     // A whitespace-only line matches the regex and trims to "" — normalize to
     // undefined so the non-empty contract holds ("" is never a legitimate URL).
-    const publicUrlValue = match?.[1].trim();
+    const rawValue = match?.[1].trim();
+    const unquotedValue = rawValue ? stripSurroundingQuotes(rawValue) : undefined;
     // Strip trailing slashes (mirroring askPublicUrl's prompt-side
     // normalization): consumers append paths to this base, and a hand-edited
     // `https://host/` would otherwise print broken `//mcp` connect URLs.
-    const normalizedPublicUrl = publicUrlValue?.replace(/\/+$/, "");
+    const normalizedPublicUrl = unquotedValue?.replace(/\/+$/, "");
     return normalizedPublicUrl || undefined;
 };
 /**
@@ -100,6 +113,36 @@ export const patchEnvObsidianToken = (envFilePath, token) => {
     writeFileSync(envFilePath, patched);
     return true;
 };
+/**
+ * Reads the OBSIDIAN_AUTH_TOKEN value from an existing .env file. Returns
+ * undefined when the file is missing, has no active line, or the value is
+ * empty — an empty `OBSIDIAN_AUTH_TOKEN=` line is not a valid token.
+ */
+export const readEnvObsidianToken = (envFilePath) => {
+    if (!existsSync(envFilePath))
+        return undefined;
+    const match = /^OBSIDIAN_AUTH_TOKEN=(.+)$/m.exec(readFileSync(envFilePath, "utf8"));
+    return match?.[1].trim() || undefined;
+};
+/**
+ * Strips surrounding quotes from env values in the file. `docker run
+ * --env-file` passes quotes literally (`VAULT_NAME="My Vault"` becomes
+ * the value `"My Vault"` with embedded quotes), while Compose strips
+ * them. Removing quotes makes the file work correctly for both paths.
+ * Returns true when the file was modified.
+ */
+export const stripEnvQuotedValues = (envFilePath) => {
+    if (!existsSync(envFilePath))
+        return false;
+    const content = readFileSync(envFilePath, "utf8");
+    // Reset lastIndex — the /g flag makes the regex stateful.
+    QUOTED_ENV_VALUE.lastIndex = 0;
+    const sanitized = content.replace(QUOTED_ENV_VALUE, "$1$3$4");
+    if (sanitized === content)
+        return false;
+    writeFileSync(envFilePath, sanitized);
+    return true;
+};
 /**
  * Writes the files into targetDir (created if missing). Existing files
  * are never overwritten silently: identical content is skipped, and differing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.12.0-beta.61",
+  "version": "0.13.0",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex@latest init",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,6 @@
     "obsidian-vault",
     "obsidian-sync",
     "ai-agents",
-    "ai-memory",
     "ai-memory-system",
     "knowledge-base",
     "note-taking",
@@ -42,7 +41,7 @@
     "task-management",
     "semantic-search",
     "attachments",
-    "pdf",
+    "one-click-deploy",
     "self-hosted",
     "docker",
     "claude",