vault-cortex 0.4.6-beta.26 → 0.5.0-beta.28

package/README.md

@@ -28,6 +28,26 @@ container; this CLI scaffolds the config so you don't have to.
 
 Existing files are never overwritten without asking.
 
+## Get Sync Token
+
+Generate an Obsidian Sync auth token without leaving the CLI:
+
+```bash
+npx vault-cortex get-sync-token
+```
+
+The command opens the Obsidian login inside Docker. Once you've signed
+in, it captures your token and prints it — nothing to dig out of the
+login output. Use `--dir` to write the token straight into an existing
+`.env` instead:
+
+```bash
+npx vault-cortex get-sync-token --dir ./vault-cortex
+```
+
+During `init --mode remote`, this flow is offered automatically when Docker
+is available.
+
 ## Upgrade
 
 Pull the latest image, re-create the container, and verify health:
@@ -36,7 +56,13 @@ Pull the latest image, re-create the container, and verify health:
 npx vault-cortex upgrade
 ```
 
-Also applies `.env` changes (`docker restart` does not re-read env files).
+Run it from the same directory where you ran `init` — it looks for your
+config in `./vault-cortex/.env` (pass `--dir <path>` if you scaffolded
+somewhere else).
+
+Your vault data, search index, and `.env` settings are preserved across
+upgrades — only the server image is replaced. Also applies `.env` changes
+(`docker restart` does not re-read env files).
 
 Prefer Docker Compose? The CLI uses `docker run` for simplicity, but the
 [deploy guides](https://github.com/aliasunder/vault-cortex/blob/main/deploy/)

package/dist/docker.js

@@ -2,6 +2,36 @@ import { spawnSync } from "node:child_process";
 export const LOCAL_IMAGE = "ghcr.io/aliasunder/vault-cortex:latest";
 export const REMOTE_IMAGE = "ghcr.io/aliasunder/vault-cortex:remote";
 export const CONTAINER_NAME = "vault-cortex";
+/**
+ * Builds the `docker run` args for the Obsidian login with a volume mount
+ * that captures the auth token file. Runs `ob login` directly instead of
+ * the image's get-sync-token script: the script's additions are locating and
+ * printing the token, and the mount makes both unnecessary — the CLI reads
+ * the token file itself, and not echoing a credential keeps it out of
+ * terminal scrollback. Pure function for testability.
+ *
+ * On Linux, includes `--user uid:gid` when uid/gid are provided — Node
+ * exposes process.getuid/getgid on every POSIX platform, so in practice the
+ * flag is always set there — keeping the token file host-user-owned. macOS
+ * Docker Desktop translates UIDs automatically, so no flag is needed.
+ */
+export const buildObsidianLoginArgs = (params) => {
+    const { configMountPath, platform = process.platform, uid, gid } = params;
+    const args = [
+        "run",
+        "--rm",
+        "-it",
+        "--entrypoint",
+        "ob",
+        "-v",
+        `${configMountPath}:/home/obsidian/.config`,
+    ];
+    if (platform === "linux" && uid !== undefined && gid !== undefined) {
+        args.push("--user", `${uid}:${gid}`);
+    }
+    args.push(REMOTE_IMAGE, "login");
+    return args;
+};
 /**
  * Container-internal env vars that must override the user's .env values.
  * VAULT_PATH in .env is the host path (for the -v mount); the container
@@ -70,7 +100,11 @@ export const createDockerRunner = () => ({
         .status === 0,
     pullImage: (image) => spawnSync("docker", ["pull", image], { stdio: "inherit" }).status === 0,
     stopAndRemoveContainer: () => spawnSync("docker", ["rm", "-f", CONTAINER_NAME]).status === 0,
-    runGetToken: () => spawnSync("docker", ["run", "--rm", "-it", "--entrypoint", "get-token", REMOTE_IMAGE], { stdio: "inherit" }).status === 0,
+    runObsidianLogin: (configMountPath) => spawnSync("docker", buildObsidianLoginArgs({
+        configMountPath,
+        uid: process.getuid?.(),
+        gid: process.getgid?.(),
+    }), { stdio: "inherit" }).status === 0,
 });
 /**
  * Polls the health endpoint until it responds OK or the timeout elapses.

package/dist/env.js

@@ -1,4 +1,3 @@
-import { REMOTE_IMAGE } from "./docker.js";
 // Optional env blocks are synced from deploy/<mode>/.env.example by
 // npm run sync:cli-env-blocks. Edit the deploy/ files, then re-run the script.
 // cli/src/templates.test.ts asserts the CLI optional block vars match the
@@ -11,12 +10,13 @@ import { REMOTE_IMAGE } from "./docker.js";
 // └─────────────────────────────────────────────────────────────────────────┘
 // sync:local-optional:begin
 const LOCAL_OPTIONAL_BLOCK = `# Optional ──────────────────────────────────────────────────
-# To override a setting: uncomment it, set a value, then apply with
-# "npx vault-cortex upgrade" (restart alone does not re-read this file).
+# To change a setting: edit its value (uncommenting it first if needed),
+# then apply with "npx vault-cortex upgrade" (restart alone does not
+# re-read this file).
 
 # Public URL for OAuth issuer URL in discovery metadata (default: http://localhost:8000).
 # Override if you expose the server on a different URL (e.g. via a reverse proxy).
-# PUBLIC_URL=http://localhost:8000
+PUBLIC_URL=http://localhost:8000
 
 # Your IANA timezone — affects daily note resolution and memory timestamps.
 # TZ=America/New_York
@@ -27,20 +27,20 @@ const LOCAL_OPTIONAL_BLOCK = `# Optional ─────────────
 # similarity fused via RRF. First startup is slow (~5min for 700 notes);
 # subsequent starts are fast via content-hash caching.
 # Set to false to disable model download and use FTS5 search only.
-# EMBEDDING_ENABLED=true
+EMBEDDING_ENABLED=true
 
 # Reranking mode for hybrid search results (default: blended).
 # "blended" uses a cross-encoder to refine result ordering with
 # position-aware score blending (~200ms added latency).
 # "none" skips reranking for lower latency.
 # Only takes effect when EMBEDDING_ENABLED=true.
-# RERANK_MODE=blended
+RERANK_MODE=blended
 
 # Enable or disable the memory layer (default: true).
 # Set to false to hide memory tools and skip About Me/ creation.
-# MEMORY_ENABLED=true
+MEMORY_ENABLED=true
 # Memory folder name in your vault (default: About Me).
-# MEMORY_DIR=About Me
+MEMORY_DIR=About Me
 
 # Comma-separated folders protected from deletion (default: MEMORY_DIR, Daily Notes).
 # If your daily notes folder has a custom name (e.g. "Journal"), override to include it.
@@ -55,10 +55,10 @@ const LOCAL_OPTIONAL_BLOCK = `# Optional ─────────────
 # SERVICE_DOCUMENTATION_URL=https://github.com/youruser/your-fork
 
 # Host port to expose (default: 8000).
-# PORT=8000
+PORT=8000
 
 # Log verbosity: debug | info | warn | error (default: info).
-# LOG_LEVEL=info
+LOG_LEVEL=info
 
 # Directory for persistent log files inside the container.
 # Unset by default — logs go to stdout only. Set a path to also write
@@ -66,13 +66,13 @@ const LOCAL_OPTIONAL_BLOCK = `# Optional ─────────────
 # LOG_DIR=/data/logs
 
 # Days to retain persistent log files before cleanup (default: 30).
-# LOG_RETENTION_DAYS=30
+LOG_RETENTION_DAYS=30
 
 # Windows users: set this to true. Makes a vault stored on a C: drive work
 # through Docker Desktop (switches the file watcher to polling and note moves
 # to rename-based writes). Only strictly needed when your vault is on a C:
 # drive rather than inside WSL2, but harmless to enable for any Windows setup.
-# WINDOWS_MODE=true
+WINDOWS_MODE=false
 `;
 // sync:local-optional:end
 // ┌─────────────────────────────────────────────────────────────────────────┐
@@ -82,8 +82,9 @@ const LOCAL_OPTIONAL_BLOCK = `# Optional ─────────────
 // └─────────────────────────────────────────────────────────────────────────┘
 // sync:remote-optional:begin
 const REMOTE_OPTIONAL_BLOCK = `# Optional ──────────────────────────────────────────────────
-# To override a setting: uncomment it, set a value, then apply with
-# "npx vault-cortex upgrade" (restart alone does not re-read this file).
+# To change a setting: edit its value (uncommenting it first if needed),
+# then apply with "npx vault-cortex upgrade" (restart alone does not
+# re-read this file).
 
 # Your IANA timezone — affects daily note resolution and memory timestamps.
 # TZ=America/New_York
@@ -94,26 +95,26 @@ const REMOTE_OPTIONAL_BLOCK = `# Optional ────────────
 # similarity fused via RRF. First startup is slow (~5min for 700 notes);
 # subsequent starts are fast via content-hash caching.
 # Set to false to disable model download and use FTS5 search only.
-# EMBEDDING_ENABLED=true
+EMBEDDING_ENABLED=true
 
 # Reranking mode for hybrid search results (default: blended).
 # "blended" uses a cross-encoder to refine result ordering with
 # position-aware score blending (~200ms added latency).
 # "none" skips reranking for lower latency.
 # Only takes effect when EMBEDDING_ENABLED=true.
-# RERANK_MODE=blended
+RERANK_MODE=blended
 
 # Windows bind-mount mode (default: false).
 # Set to true when your vault is on a Windows drive (Docker Desktop).
 # Enables polling for the file watcher and rename-based moves across
 # the Docker Desktop/WSL2 bridge.
-# WINDOWS_MODE=false
+WINDOWS_MODE=false
 
 # Enable or disable the memory layer (default: true).
 # Set to false to hide memory tools and skip About Me/ creation.
-# MEMORY_ENABLED=true
+MEMORY_ENABLED=true
 # Memory folder name in your vault (default: About Me).
-# MEMORY_DIR=About Me
+MEMORY_DIR=About Me
 
 # Comma-separated folders protected from deletion (default: MEMORY_DIR, Daily Notes).
 # If your daily notes folder has a custom name (e.g. "Journal"), override to include it.
@@ -128,31 +129,31 @@ const REMOTE_OPTIONAL_BLOCK = `# Optional ────────────
 # SERVICE_DOCUMENTATION_URL=https://github.com/youruser/your-fork
 
 # Host port to expose (default: 8000).
-# PORT=8000
+PORT=8000
 
 # Log verbosity: debug | info | warn | error (default: info).
-# LOG_LEVEL=info
+LOG_LEVEL=info
 
 # Directory for persistent log files inside the container (default: /data/logs).
 # Set to empty to disable file logging (logs still go to stdout either way).
-# LOG_DIR=/data/logs
+LOG_DIR=/data/logs
 
 # Days to retain persistent log files before cleanup (default: 30).
-# LOG_RETENTION_DAYS=30
+LOG_RETENTION_DAYS=30
 
 # User/group IDs for obsidian-sync (default: 1000).
-# PUID=1000
-# PGID=1000
+PUID=1000
+PGID=1000
 
 # Device name shown in Obsidian Sync settings.
-# DEVICE_NAME=vault-cortex
+DEVICE_NAME=vault-cortex
 
 # Obsidian Sync conflict resolution: merge | conflict (default: merge).
 # 'merge' integrates changes automatically; 'conflict' writes a separate conflict file.
-# CONFLICT_STRATEGY=merge
+CONFLICT_STRATEGY=merge
 
 # Sync direction: bidirectional | pull-only | push-only (default: bidirectional).
-# SYNC_MODE=bidirectional
+SYNC_MODE=bidirectional
 `;
 // sync:remote-optional:end
 export const buildLocalEnv = (answers) => `# vault-cortex — local quickstart
@@ -181,8 +182,7 @@ VAULT_PASSWORD=${answers.vaultPassword}`;
     const obsidianTokenComment = answers.obsidianAuthToken === ""
         ? `# Obsidian Sync auth token — FILL THIS IN before starting the server.
 # Generate once with:
-#   docker run --rm -it --entrypoint get-token \\
-#     ${REMOTE_IMAGE}`
+#   npx vault-cortex get-sync-token`
         : `# Obsidian Sync auth token.`;
     return `# vault-cortex — remote quickstart (Obsidian Sync)
 # Generated by \`npx vault-cortex init\`. Full option reference:

package/dist/get-sync-token.js

@@ -0,0 +1,150 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { patchEnvObsidianToken } from "./scaffold.js";
+import { expandTilde } from "./vault.js";
+/** Message from an unknown throw — Error instances keep their message. */
+const describeError = (error) => error instanceof Error ? error.message : String(error);
+/**
+ * Creates the temp dir the container's config mount writes into.
+ * Returns undefined (after warning) when creation fails.
+ */
+const makeTempMountDir = (prompts) => {
+    try {
+        return mkdtempSync(join(tmpdir(), "vault-cortex-sync-token-"));
+    }
+    catch (error) {
+        prompts.warn(`Could not create a temp directory for token capture — ${describeError(error)}`);
+        return undefined;
+    }
+};
+/**
+ * Runs the interactive Obsidian login container. A throw from the Docker
+ * runner is reported and treated the same as a non-zero exit.
+ */
+const runLoginContainer = (configMountPath, deps) => {
+    const { docker, prompts } = deps;
+    try {
+        return docker.runObsidianLogin(configMountPath);
+    }
+    catch (error) {
+        prompts.warn(`Docker run failed — ${describeError(error)}`);
+        return false;
+    }
+};
+/**
+ * Reads the captured token file from the config mount. Returns undefined
+ * when the file is missing, empty, or unreadable — the caller treats all
+ * three as "no token captured".
+ */
+const readCapturedTokenFile = (configMountPath) => {
+    const tokenPath = join(configMountPath, "obsidian-headless", "auth_token");
+    try {
+        if (!existsSync(tokenPath))
+            return undefined;
+        const token = readFileSync(tokenPath, "utf8").trim();
+        return token || undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Best-effort removal of the temp mount dir. Failing to remove it (e.g.
+ * root-owned files left by the container) must not turn a successful
+ * capture into a failure, so it warns instead of throwing.
+ */
+const removeTempMountDir = (configMountPath, prompts) => {
+    try {
+        rmSync(configMountPath, { recursive: true, force: true });
+    }
+    catch (error) {
+        prompts.warn(`Could not remove temp directory ${configMountPath} — ${describeError(error)}`);
+    }
+};
+/**
+ * Runs the Obsidian login (`ob login`) inside a Docker container with a
+ * volume mount that captures the auth token file. The interactive login
+ * (email, password, MFA) shows in the terminal, but the resulting token is
+ * read from the mounted config dir — never printed, so it stays out of
+ * terminal scrollback.
+ *
+ * tokenDestinationMessage finishes the handoff message by telling the user
+ * where the captured token ends up — the destination differs per flow
+ * (init stores it in the generated .env; the subcommand prints it, or
+ * writes it to an existing .env with --dir).
+ *
+ * Returns the token string on success, undefined on any failure — each
+ * fallible operation is wrapped individually by the helpers above, so no
+ * catch-all is needed here. The bare try/finally only scopes the temp dir
+ * (acquire → release); it has no catch and swallows nothing.
+ */
+export const captureObsidianToken = (deps, tokenDestinationMessage) => {
+    const { prompts } = deps;
+    const configMountPath = makeTempMountDir(prompts);
+    if (!configMountPath)
+        return undefined;
+    try {
+        prompts.log("Handing the terminal to the Obsidian login — it will ask for your " +
+            `account email, password, and MFA code. ${tokenDestinationMessage}`);
+        const loginSucceeded = runLoginContainer(configMountPath, deps);
+        if (!loginSucceeded) {
+            prompts.warn("The Obsidian login did not complete — you can run it later with:\n" +
+                "  npx vault-cortex get-sync-token");
+            return undefined;
+        }
+        const token = readCapturedTokenFile(configMountPath);
+        if (!token) {
+            prompts.warn("The Obsidian login finished, but no token was captured — the " +
+                "token file was missing, empty, or unreadable. You can retry with:\n" +
+                "  npx vault-cortex get-sync-token");
+            return undefined;
+        }
+        return token;
+    }
+    finally {
+        removeTempMountDir(configMountPath, prompts);
+    }
+};
+/**
+ * Subcommand entry: generate an Obsidian Sync token via Docker.
+ * Without --dir, prints the token to stdout.
+ * With --dir, writes it directly to `<dir>/.env`.
+ */
+export const runGetSyncToken = async (flags, deps) => {
+    const { prompts, docker } = deps;
+    if (!docker.isDaemonRunning()) {
+        prompts.error("Container runtime not running — start Docker Desktop, Colima,\n" +
+            "OrbStack, or another Docker-compatible runtime and try again.");
+        return 1;
+    }
+    prompts.intro("vault-cortex get-sync-token");
+    // Resolve the destination up front so the login handoff message can tell
+    // the user where the token will end up.
+    const envFilePath = flags.dir
+        ? join(resolve(expandTilde(flags.dir)), ".env")
+        : undefined;
+    const tokenDestinationMessage = envFilePath
+        ? `The token is captured automatically and written to ${envFilePath}.`
+        : "The token is captured automatically and printed at the end.";
+    const token = captureObsidianToken({ docker, prompts }, tokenDestinationMessage);
+    if (!token) {
+        prompts.error("Could not capture the auth token.");
+        return 1;
+    }
+    if (!envFilePath) {
+        prompts.log("Your OBSIDIAN_AUTH_TOKEN:");
+        prompts.print(`\n  ${token}\n`);
+        prompts.outro("Done.");
+        return 0;
+    }
+    const patched = patchEnvObsidianToken(envFilePath, token);
+    if (!patched) {
+        prompts.error(`Could not patch ${envFilePath} — the file is missing or has no ` +
+            "OBSIDIAN_AUTH_TOKEN line. Run init first.");
+        return 1;
+    }
+    prompts.log(`Token written to ${envFilePath}`);
+    prompts.outro("Done.");
+    return 0;
+};

package/dist/init.js

@@ -1,7 +1,8 @@
 import { join, resolve } from "node:path";
 import { buildLocalEnv, buildRemoteEnv } from "./env.js";
+import { captureObsidianToken } from "./get-sync-token.js";
 import { buildLocalConnectMessage, buildRemoteConnectMessage, } from "./messages.js";
-import { REMOTE_IMAGE, pollHealth } from "./docker.js";
+import { pollHealth } from "./docker.js";
 import { buildFilesToWrite, readEnvPort, writeFiles, } from "./scaffold.js";
 import { generateToken } from "./token.js";
 import { expandTilde, validateVaultPath } from "./vault.js";
@@ -22,26 +23,16 @@ const askMode = async (prompts) => {
     ], "local");
     return isMode(selected) ? selected : "local";
 };
-const GET_TOKEN_COMMAND = `docker run --rm -it --entrypoint get-token \\
-  ${REMOTE_IMAGE}`;
 /**
- * Offers to run the vault-cortex image's get-token flow in this terminal.
- * Returns true only when it ran to completion (and so printed a token the
- * user can scroll up to). The handoff log exists because the clack UI gives
- * way to raw docker output — image pull, then the tool's own login prompts.
+ * Offers to auto-capture the Obsidian Sync token via a Docker volume mount.
+ * Returns the captured token string, or undefined when the user declines or
+ * the capture fails (the caller falls back to a paste prompt).
  */
-const offerGetTokenRun = async (prompts, docker) => {
-    const runNow = await prompts.confirm("Run the get-token command now?", true);
+const offerSyncTokenCapture = async (prompts, docker) => {
+    const runNow = await prompts.confirm("Generate the token now?", true);
     if (!runNow)
-        return false;
-    prompts.log("Handing the terminal to get-token — it will ask for your Obsidian " +
-        "account login and print a token at the end.");
-    const tokenGenerated = docker.runGetToken();
-    if (!tokenGenerated) {
-        prompts.warn("get-token did not complete — you can run it later and edit .env.");
-        return false;
-    }
-    return true;
+        return undefined;
+    return captureObsidianToken({ docker, prompts }, "The token is captured automatically and stored in your .env — nothing to copy.");
 };
 /**
  * Asks for the vault path, recursing to re-prompt until it gets a usable
@@ -240,7 +231,7 @@ const runLocalInit = async (flags, deps) => {
     return 0;
 };
 // Remote flow (VPS + Obsidian Sync): resolve target dir → PUBLIC_URL →
-// VAULT_NAME → Obsidian Sync token (optionally running get-token via
+// VAULT_NAME → Obsidian Sync token (optionally running the Obsidian login via
 // Docker) → optional E2E vault password → generate token → write .env →
 // optionally start → print connect instructions. Always interactive —
 // the sync-token step can't be defaulted.
@@ -255,21 +246,17 @@ const runRemoteInit = async (flags, deps) => {
         }))));
     const publicUrl = await askPublicUrl(prompts);
     const vaultName = await askVaultName(prompts);
-    // The Obsidian Sync token comes from an interactive docker run (the
-    // get-token entrypoint logs into Obsidian). We print the command, offer to
-    // run it when Docker is usable, then ask the user to paste the result —
-    // get-token writes to the terminal, so it can't be captured automatically.
-    // A blank answer is allowed: the .env is written with an empty
-    // OBSIDIAN_AUTH_TOKEN and a fill-this-in comment.
-    prompts.note(GET_TOKEN_COMMAND, "Obsidian Sync token — generate once with");
-    const getTokenRan = docker.isDaemonRunning()
-        ? await offerGetTokenRun(prompts, docker)
-        : false;
-    // "printed above" is only true when get-token actually ran to completion.
-    const pastePrompt = getTokenRan
-        ? "Paste the Obsidian Sync token printed above (leave blank to fill in .env later):"
-        : "Paste the Obsidian Sync token (leave blank to fill in .env later):";
-    const obsidianAuthToken = (await prompts.text(pastePrompt, { defaultValue: "" })).trim();
+    // Auto-capture the Obsidian Sync token via a Docker volume mount when
+    // the daemon is reachable. Falls back to a paste prompt when capture
+    // fails or the user declines.
+    const capturedToken = docker.isDaemonRunning()
+        ? await offerSyncTokenCapture(prompts, docker)
+        : undefined;
+    // Masked prompt: the sync token is a credential and must not echo into
+    // the terminal or scrollback. An empty submission still means "fill in
+    // .env later" — clack's password prompt accepts blank input.
+    const obsidianAuthToken = capturedToken ??
+        (await prompts.password("Paste the Obsidian Sync token (leave blank to fill in .env later):")).trim();
     const usesEncryption = await prompts.confirm("Does your vault use end-to-end encryption?", false);
     const vaultPassword = usesEncryption
         ? await prompts.password("Vault encryption password:")

package/dist/main.js

@@ -1,4 +1,5 @@
 import { createDockerRunner } from "./docker.js";
+import { runGetSyncToken } from "./get-sync-token.js";
 import { runInit } from "./init.js";
 import { buildProgram } from "./program.js";
 import { createPrompts } from "./prompts.js";
@@ -16,6 +17,10 @@ export const run = async (version) => {
             docker: createDockerRunner(),
             fetchFn: fetch,
         }),
+        runGetSyncToken: (flags) => runGetSyncToken(flags, {
+            prompts: createPrompts(),
+            docker: createDockerRunner(),
+        }),
     });
     await program.parseAsync();
 };

package/dist/program.js

@@ -22,6 +22,13 @@ export const buildProgram = (options) => {
         .action(async (flags) => {
         process.exitCode = await options.runUpgrade(flags);
     });
+    program
+        .command("get-sync-token")
+        .description("Generate an Obsidian Sync auth token via Docker and print it or write it to .env")
+        .option("--dir <path>", "directory containing .env to update with the token")
+        .action(async (flags) => {
+        process.exitCode = await options.runGetSyncToken(flags);
+    });
     program.action(() => {
         program.help();
     });

package/dist/scaffold.js

@@ -57,6 +57,25 @@ export const detectMode = (envFilePath) => {
     const content = readFileSync(envFilePath, "utf8");
     return OBSIDIAN_AUTH_TOKEN_LINE.test(content) ? "remote" : "local";
 };
+/**
+ * Patches the OBSIDIAN_AUTH_TOKEN value in an existing .env file.
+ * Returns true when the patch succeeded, false when the file is missing
+ * or has no active OBSIDIAN_AUTH_TOKEN line (e.g. a local-mode .env).
+ */
+export const patchEnvObsidianToken = (envFilePath, token) => {
+    if (!existsSync(envFilePath))
+        return false;
+    const content = readFileSync(envFilePath, "utf8");
+    /** Matches the full OBSIDIAN_AUTH_TOKEN line for replacement. */
+    const fullTokenLine = /^OBSIDIAN_AUTH_TOKEN=.*$/m;
+    if (!fullTokenLine.test(content))
+        return false;
+    // Function replacement avoids $ pattern interpretation ($&, $', etc.)
+    // that String.prototype.replace applies to string replacements.
+    const patched = content.replace(fullTokenLine, () => `OBSIDIAN_AUTH_TOKEN=${token}`);
+    writeFileSync(envFilePath, patched);
+    return true;
+};
 /**
  * Writes the files into targetDir (created if missing). Existing files
  * are never overwritten silently: identical content is skipped, and differing

package/dist/upgrade.js

@@ -60,6 +60,7 @@ export const runUpgrade = async (flags, deps) => {
         return 1;
     }
     spinner.stop("Server is up — health check passed.");
+    prompts.log("Your vault data, search index, and settings are preserved.");
     prompts.outro("Upgrade complete.");
     return 0;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.4.6-beta.26",
+  "version": "0.5.0-beta.28",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex init",
   "license": "MIT",
   "type": "module",