vault-cortex 0.4.1 → 0.4.3

package/dist/docker.js

@@ -1,12 +1,12 @@
 import { spawnSync } from "node:child_process";
 /** The image whose `get-token` entrypoint issues Obsidian Sync auth tokens. */
-export const OBSIDIAN_SYNC_IMAGE = "ghcr.io/belphemur/obsidian-headless-sync-docker:latest";
+export const GET_TOKEN_IMAGE = "ghcr.io/aliasunder/vault-cortex:remote";
 export const createDockerRunner = () => ({
     isComposeAvailable: () => spawnSync("docker", ["compose", "version"]).status === 0,
     isDaemonRunning: () => spawnSync("docker", ["info"], { timeout: 5_000 }).status === 0,
     composeUp: (cwd) => spawnSync("docker", ["compose", "up", "-d"], { cwd, stdio: "inherit" })
         .status === 0,
-    runGetToken: () => spawnSync("docker", ["run", "--rm", "-it", "--entrypoint", "get-token", OBSIDIAN_SYNC_IMAGE], {
+    runGetToken: () => spawnSync("docker", ["run", "--rm", "-it", "--entrypoint", "get-token", GET_TOKEN_IMAGE], {
         stdio: "inherit",
     }).status === 0,
 });

package/dist/env.js

@@ -1,3 +1,4 @@
+import { GET_TOKEN_IMAGE } from "./docker.js";
 // The optional blocks mirror the canonical deploy/<mode>/.env.example files.
 // cli/src/templates.test.ts asserts every required `${VAR:?}` in the compose
 // templates has a matching line here, so a new required var breaks CI until
@@ -30,6 +31,18 @@ const LOCAL_OPTIONAL_BLOCK = `# Optional ─────────────
 # Memory folder name in your vault (default: About Me).
 # MEMORY_DIR=About Me
 
+# Comma-separated folders protected from deletion (default: MEMORY_DIR, Daily Notes).
+# If your daily notes folder has a custom name (e.g. "Journal"), override to include it.
+# PROTECTED_PATHS=About Me,Daily Notes
+
+# Comma-separated folders excluded from orphan detection
+# (default: Daily Notes, Templates, MEMORY_DIR).
+# ORPHAN_EXCLUDE_FOLDERS=Daily Notes,Templates,About Me
+
+# URL shown in OAuth discovery metadata
+# (default: https://github.com/aliasunder/vault-cortex).
+# SERVICE_DOCUMENTATION_URL=https://github.com/youruser/your-fork
+
 # Host port to expose (default: 8000).
 # PORT=8000
 
@@ -72,12 +85,30 @@ const REMOTE_OPTIONAL_BLOCK = `# Optional ────────────
 # Only takes effect when EMBEDDING_ENABLED=true.
 # RERANK_MODE=blended
 
+# Windows bind-mount mode (default: false).
+# Set to true when your vault is on a Windows drive (Docker Desktop).
+# Enables polling for the file watcher and rename-based moves across
+# the Docker Desktop/WSL2 bridge.
+# WINDOWS_MODE=false
+
 # Enable or disable the memory layer (default: true).
 # Set to false to hide memory tools and skip About Me/ creation.
 # MEMORY_ENABLED=true
 # Memory folder name in your vault (default: About Me).
 # MEMORY_DIR=About Me
 
+# Comma-separated folders protected from deletion (default: MEMORY_DIR, Daily Notes).
+# If your daily notes folder has a custom name (e.g. "Journal"), override to include it.
+# PROTECTED_PATHS=About Me,Daily Notes
+
+# Comma-separated folders excluded from orphan detection
+# (default: Daily Notes, Templates, MEMORY_DIR).
+# ORPHAN_EXCLUDE_FOLDERS=Daily Notes,Templates,About Me
+
+# URL shown in OAuth discovery metadata
+# (default: https://github.com/aliasunder/vault-cortex).
+# SERVICE_DOCUMENTATION_URL=https://github.com/youruser/your-fork
+
 # Host port to expose (default: 8000).
 # PORT=8000
 
@@ -127,7 +158,7 @@ VAULT_PASSWORD=${answers.vaultPassword}`;
         ? `# Obsidian Sync auth token — FILL THIS IN before docker compose up.
 # Generate once with:
 #   docker run --rm -it --entrypoint get-token \\
-#     ghcr.io/belphemur/obsidian-headless-sync-docker:latest`
+#     ${GET_TOKEN_IMAGE}`
         : `# Obsidian Sync auth token.`;
     return `# vault-cortex — remote quickstart (Obsidian Sync)
 # Generated by \`npx vault-cortex init\`. Full option reference:

package/dist/init.js

@@ -1,7 +1,7 @@
 import { join, resolve } from "node:path";
 import { buildLocalEnv, buildRemoteEnv } from "./env.js";
 import { buildLocalConnectMessage, buildRemoteConnectMessage, } from "./messages.js";
-import { OBSIDIAN_SYNC_IMAGE, pollHealth } from "./docker.js";
+import { GET_TOKEN_IMAGE, pollHealth } from "./docker.js";
 import { buildFilesToWrite, readEnvPort, writeFiles, } from "./scaffold.js";
 import { generateToken } from "./token.js";
 import { expandTilde, validateVaultPath } from "./vault.js";
@@ -24,9 +24,9 @@ const askMode = async (prompts) => {
     return isMode(selected) ? selected : "local";
 };
 const GET_TOKEN_COMMAND = `docker run --rm -it --entrypoint get-token \\
-  ${OBSIDIAN_SYNC_IMAGE}`;
+  ${GET_TOKEN_IMAGE}`;
 /**
- * Offers to run the obsidian-headless-sync get-token flow in this terminal.
+ * Offers to run the vault-cortex image's get-token flow in this terminal.
  * Returns true only when it ran to completion (and so printed a token the
  * user can scroll up to). The handoff log exists because the clack UI gives
  * way to raw docker output — image pull, then the tool's own login prompts.
@@ -243,7 +243,7 @@ const runLocalInit = async (flags, deps) => {
 // Remote flow (VPS + Obsidian Sync): resolve target dir → PUBLIC_URL →
 // VAULT_NAME → Obsidian Sync token (optionally running get-token via
 // Docker) → optional E2E vault password → generate token → write the
-// three-service compose + .env → optionally start → print connect
+// single-service compose + .env → optionally start → print connect
 // instructions. Always interactive — the sync-token step can't be defaulted.
 const runRemoteInit = async (flags, deps) => {
     const { prompts, docker } = deps;
@@ -296,8 +296,8 @@ const runRemoteInit = async (flags, deps) => {
     if (tokenWritten)
         prompts.log("Generated MCP auth token (saved to .env).");
     const port = readEnvPort(join(targetDir, ".env"));
-    // Without the sync token the stack can't start (obsidian-sync exits), so
-    // only offer compose up when it was provided.
+    // Without the sync token the container can't start (init-check-auth fails
+    // and s6 stops it), so only offer compose up when it was provided.
     const started = obsidianAuthToken === ""
         ? false
         : await offerComposeUp({ targetDir, port }, deps);

package/dist/messages.js

@@ -1,13 +1,18 @@
 import { styleText } from "node:util";
-// Strip styling when stdout isn't a color TTY (piped output, NO_COLOR, CI) so
+// Strip styling when stdout isn't a color TTY (piped output, CI) or NO_COLOR
+// is set (any value, including empty — per the NO_COLOR spec) so
 // captured/redirected output stays plain — no stray escape codes in copied
 // commands or logs.
-const paint = (style, text) => process.stdout.isTTY && !process.env.NO_COLOR ? styleText(style, text) : text;
-// Section header that replaces the old clack note box: a bold title over a
-// dim rule. The rule is its own line (not a per-line prefix), so it never
-// touches a copyable command.
-const connectHeader = () => `${paint("bold", "Connect")}\n${paint("dim", "─".repeat(56))}`;
-const composeUpCommand = (targetDir) => `cd ${targetDir} && docker compose up -d`;
+const paint = (style, text) => process.stdout.isTTY && !("NO_COLOR" in process.env)
+    ? styleText(style, text)
+    : text;
+const RULE_WIDTH = 56;
+const topRule = (label) => paint("dim", `╭── ${label} ${"─".repeat(Math.max(0, RULE_WIDTH - label.length - 6))}╮`);
+const bottomRule = () => paint("dim", `╰${"─".repeat(RULE_WIDTH - 2)}╯`);
+const sectionRule = (label) => paint("dim", `── ${label} ${"─".repeat(Math.max(0, RULE_WIDTH - label.length - 4))}`);
+// targetDir is quoted: these lines are meant to be copy-pasted into a
+// shell, and an unquoted path breaks on spaces or special characters.
+const composeUpCommand = (targetDir) => `cd "${targetDir}" && docker compose up -d`;
 const startServerLine = (targetDir) => `Start the server:\n  ${composeUpCommand(targetDir)}`;
 /** Remote start line: running, blocked on the missing sync token, or ready to start. */
 const remoteStartLine = (params) => {
@@ -57,6 +62,10 @@ const curlGuidance = (mcpUrl) => `Clients without OAuth, scripts, and curl send
   curl -H "Authorization: Bearer <token>" ${mcpUrl}`;
 const smokeTest = (healthUrl) => `Smoke test:
   curl ${healthUrl}`;
+// Compose does not pull new images on `up` — without this hint users stay
+// on the image from init day forever while believing they track releases.
+const updateGuidance = (targetDir) => `Update to the latest release:
+  cd "${targetDir}" && docker compose pull && docker compose up -d`;
 /**
  * Local-mode "Connect" message. port comes from the .env on disk: a kept file
  * may override the default, so the message must describe the server that will
@@ -75,10 +84,12 @@ export const buildLocalConnectMessage = (params) => {
     // that claude.ai can't reach localhost at all and Claude Desktop needs the
     // mcp-remote bridge (the dialog rejects http, but mcp-remote exempts
     // localhost, so no --allow-http).
-    const connectMessage = `${connectHeader()}
+    const connectMessage = `${topRule("Connect")}
 
 ${startLine}
 
+${sectionRule("MCP client")}
+
 ${connectUrlBlock(`${baseUrl}/mcp`, tokenLine)}
 
 ${connectGuidance(`${baseUrl}/mcp`)}
@@ -93,15 +104,23 @@ it with mcp-remote:
       "--header", "Authorization: Bearer <token above>"]
   }
 
+${sectionRule("Non-OAuth")}
+
 ${curlGuidance(`${baseUrl}/mcp`)}
 
 ${smokeTest(`${baseUrl}/healthz`)}
 
+${sectionRule("Settings")}
+
 Optional settings (timezone, memory folder, port, logging) are commented
 out in ${targetDir}/.env — uncomment, set a value, then apply with
 "docker compose up -d" (restart alone does not re-read .env).
 
-Full docs: https://github.com/aliasunder/vault-cortex/blob/main/deploy/local/README.md`;
+${updateGuidance(targetDir)}
+
+Full docs: https://github.com/aliasunder/vault-cortex/blob/main/deploy/local/README.md
+
+${bottomRule()}`;
     return connectMessage;
 };
 /**
@@ -135,24 +154,34 @@ Claude Desktop only accept https URLs — set up HTTPS for those clients
 (see the HTTPS section in the remote guide).`;
     // Flush-left on purpose: this is printed as plain text (see paint), so
     // leading whitespace would render as literal indentation.
-    const connectMessage = `${connectHeader()}
+    const connectMessage = `${topRule("Connect")}
 
 ${startLine}
 
+${sectionRule("MCP client")}
+
 ${connectUrlBlock(`${publicUrl}/mcp`, tokenLine)}
 
 ${clientGuidance}
 
+${sectionRule("Non-OAuth")}
+
 ${curlGuidance(`${publicUrl}/mcp`)}
 
 ${smokeTest(`${publicUrl}/healthz`)}
 
+${sectionRule("Settings")}
+
 Optional settings (timezone, memory folder, port, logging, sync
 behavior) are commented out in ${targetDir}/.env — uncomment, set a
 value, then apply with "docker compose up -d" (restart alone does not
 re-read .env).
 
+${updateGuidance(targetDir)}
+
 For HTTPS options (API Gateway, Caddy, Cloudflare Tunnel), see:
-https://github.com/aliasunder/vault-cortex/blob/main/deploy/remote/README.md#https-access`;
+https://github.com/aliasunder/vault-cortex/blob/main/deploy/remote/README.md#https-access
+
+${bottomRule()}`;
     return connectMessage;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex init",
   "license": "MIT",
   "type": "module",

package/templates/local/docker-compose.yml

@@ -14,9 +14,9 @@
 name: vault-cortex
 
 services:
-  vault-mcp:
-    image: ghcr.io/aliasunder/vault-mcp:latest
-    container_name: vault-mcp
+  vault-cortex:
+    image: ghcr.io/aliasunder/vault-cortex:latest
+    container_name: vault-cortex
     restart: unless-stopped
     environment:
       PORT: "8000"
@@ -41,9 +41,9 @@ services:
       #   PROTECTED_PATHS           default: "<MEMORY_DIR>, Daily Notes" (blocked from vault_delete_note)
       #   ORPHAN_EXCLUDE_FOLDERS    default: "Daily Notes, Templates, <MEMORY_DIR>" (excluded from vault_find_orphans)
       #   SERVICE_DOCUMENTATION_URL default: https://github.com/aliasunder/vault-cortex
-      # PROTECTED_PATHS: ${PROTECTED_PATHS:-}
-      # ORPHAN_EXCLUDE_FOLDERS: ${ORPHAN_EXCLUDE_FOLDERS:-}
-      # SERVICE_DOCUMENTATION_URL: ${SERVICE_DOCUMENTATION_URL:-}
+      PROTECTED_PATHS: ${PROTECTED_PATHS:-}
+      ORPHAN_EXCLUDE_FOLDERS: ${ORPHAN_EXCLUDE_FOLDERS:-}
+      SERVICE_DOCUMENTATION_URL: ${SERVICE_DOCUMENTATION_URL:-}
     volumes:
       - "${VAULT_PATH:?Set VAULT_PATH to your Obsidian vault folder}:/vault:rw"
       - mcp_data:/data

package/templates/remote/docker-compose.yml

@@ -1,23 +1,28 @@
 # vault-cortex — remote quickstart (Obsidian Sync)
 #
 # Run vault-cortex on a VPS with Obsidian Sync for remote access from any device.
-# Two services: obsidian-sync → vault-mcp.
+# One container: the :remote image bundles Obsidian Sync and the MCP server
+# under s6-overlay supervision.
 #
 # 1. cp .env.example .env   (then fill in required values)
 # 2. docker compose up -d
 # 3. Connect your MCP client to http://<your-server>:8000/mcp
 #
+# Compose is optional — the same container runs with plain `docker run`
+# (or podman/nerdctl); see the README for the one-liner.
+#
 # Full docs: https://github.com/aliasunder/vault-cortex
 
 name: vault-cortex
 
 services:
-  obsidian-sync:
-    image: ghcr.io/belphemur/obsidian-headless-sync-docker:latest
-    container_name: obsidian-sync
+  vault-cortex:
+    image: ghcr.io/aliasunder/vault-cortex:remote
+    container_name: vault-cortex
     hostname: ${DEVICE_NAME:-vault-cortex}
     restart: unless-stopped
     environment:
+      # --- Obsidian Sync (s6 init chain + sync service) ---
       OBSIDIAN_AUTH_TOKEN: "${OBSIDIAN_AUTH_TOKEN:?Set OBSIDIAN_AUTH_TOKEN — see .env.example}"
       VAULT_NAME: "${VAULT_NAME:?Set VAULT_NAME to your Obsidian vault name (case-sensitive)}"
       VAULT_PASSWORD: ${VAULT_PASSWORD:-}
@@ -26,28 +31,7 @@ services:
       DEVICE_NAME: ${DEVICE_NAME:-vault-cortex}
       CONFLICT_STRATEGY: ${CONFLICT_STRATEGY:-merge}
       SYNC_MODE: ${SYNC_MODE:-bidirectional}
-      TZ: ${TZ:-UTC}
-    volumes:
-      - vault_data:/vault
-      - obsidian_config:/home/obsidian/.config
-    healthcheck:
-      test: ["CMD-SHELL", "test -d /vault && pgrep -f 'ob sync' >/dev/null"]
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 60s
-    logging:
-      driver: json-file
-      options: { max-size: "10m", max-file: "3" }
-
-  vault-mcp:
-    image: ghcr.io/aliasunder/vault-mcp:latest
-    container_name: vault-mcp
-    restart: unless-stopped
-    depends_on:
-      obsidian-sync:
-        condition: service_healthy
-    environment:
+      # --- MCP server ---
       PORT: "8000"
       HOST: "0.0.0.0"
       VAULT_PATH: /vault
@@ -62,19 +46,23 @@ services:
       LOG_DIR: ${LOG_DIR:-/data/logs}
       LOG_RETENTION_DAYS: ${LOG_RETENTION_DAYS:-30}
       TZ: ${TZ:-UTC}
+      WINDOWS_MODE: ${WINDOWS_MODE:-false}
       # Optional overrides. When unset, the server applies smart defaults
       # (<MEMORY_DIR> below is the resolved MEMORY_DIR value, default "About Me"):
       #   PROTECTED_PATHS           default: "<MEMORY_DIR>, Daily Notes" (blocked from vault_delete_note)
       #   ORPHAN_EXCLUDE_FOLDERS    default: "Daily Notes, Templates, <MEMORY_DIR>" (excluded from vault_find_orphans)
       #   SERVICE_DOCUMENTATION_URL default: https://github.com/aliasunder/vault-cortex
-      # PROTECTED_PATHS: ${PROTECTED_PATHS:-}
-      # ORPHAN_EXCLUDE_FOLDERS: ${ORPHAN_EXCLUDE_FOLDERS:-}
-      # SERVICE_DOCUMENTATION_URL: ${SERVICE_DOCUMENTATION_URL:-}
+      PROTECTED_PATHS: ${PROTECTED_PATHS:-}
+      ORPHAN_EXCLUDE_FOLDERS: ${ORPHAN_EXCLUDE_FOLDERS:-}
+      SERVICE_DOCUMENTATION_URL: ${SERVICE_DOCUMENTATION_URL:-}
     volumes:
-      - vault_data:/vault:rw
+      - vault_data:/vault
       - mcp_data:/data
+      - obsidian_config:/home/obsidian/.config
     ports:
       - "0.0.0.0:${PORT:-8000}:8000"
+    # start_period covers the s6 init chain (Obsidian login + sync-setup)
+    # that runs before the MCP server boots.
     healthcheck:
       test:
         [
@@ -85,8 +73,8 @@ services:
         ]
       interval: 15s
       timeout: 5s
-      retries: 3
-      start_period: 20s
+      retries: 5
+      start_period: 60s
     logging:
       driver: json-file
       options: { max-size: "10m", max-file: "3" }