mindin 0.14.0__tar.gz

mindin-0.14.0/.dockerignore

@@ -0,0 +1,8 @@
+.git
+.venv
+tests
+dist
+build
+__pycache__
+.pytest_cache
+.ruff_cache

mindin-0.14.0/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --python ${{ matrix.python-version }}
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run pytest -q
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - run: uv export --frozen --all-groups --no-emit-project --format requirements-txt > "$RUNNER_TEMP/requirements.txt"
+      - run: uvx pip-audit --disable-pip --require-hashes -r "$RUNNER_TEMP/requirements.txt"

mindin-0.14.0/.github/workflows/release.yml

@@ -0,0 +1,171 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: The tag matches the package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          package=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml | head -1)
+          server=$(sed -n 's/^VERSION = "\(.*\)"/\1/p' mindin/server.py)
+          if [ "$package" != "$tag" ] || [ "$server" != "$tag" ]; then echo "::error::pyproject.toml says $package, server.py says $server, the tag says $tag"; exit 1; fi
+          former=$(sed -n 's/^version = "\(.*\)"/\1/p' shim/pyproject.toml | head -1)
+          pinned=$(grep -c "\"mindin\(\[semantic\]\)\?==$tag\"" shim/pyproject.toml || true)
+          if [ "$former" != "$tag" ] || [ "$pinned" != 2 ]; then echo "::error::shim/pyproject.toml says $former and pins mindin==$tag $pinned times, the tag says $tag"; exit 1; fi
+      - name: CHANGES.md says what the version brings
+        run: sh scripts/release-notes.sh "${GITHUB_REF_NAME#v}"
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen
+      - run: uv run ruff check .
+      - run: uv run pytest -q
+
+  pypi:
+    needs: [test]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - run: uv build --out-dir dist
+      - name: Build the former name, which installs mindin of the same version
+        run: uv build shim --out-dir dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  ghcr:
+    needs: [test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/gronare/mindin:${{ github.ref_name }}
+            ghcr.io/gronare/mindin:latest
+            ghcr.io/gronare/notes-vault-mcp:${{ github.ref_name }}
+            ghcr.io/gronare/notes-vault-mcp:latest
+          labels: io.modelcontextprotocol.server.name=io.github.gronare/mindin
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          build-args: EXTRAS=--extra semantic
+          tags: |
+            ghcr.io/gronare/mindin:${{ github.ref_name }}-semantic
+            ghcr.io/gronare/mindin:latest-semantic
+            ghcr.io/gronare/notes-vault-mcp:${{ github.ref_name }}-semantic
+            ghcr.io/gronare/notes-vault-mcp:latest-semantic
+          labels: io.modelcontextprotocol.server.name=io.github.gronare/mindin
+
+  registry:
+    needs: [pypi, ghcr]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Match server.json to the tag
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/v}"
+          jq --arg v "$VERSION" '.version = $v | .packages[0].version = $v' server.json > server.json.tmp
+          mv server.json.tmp server.json
+
+      - name: Install mcp-publisher
+        run: |
+          OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+          ARCH="$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')"
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_${OS}_${ARCH}.tar.gz" | tar xz mcp-publisher
+
+      - name: Log in to the MCP registry
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish
+        run: |
+          for attempt in 1 2 3 4 5; do
+            ./mcp-publisher publish && exit 0
+            echo "publish failed, PyPI may not have the release yet; retrying in 30s"
+            sleep 30
+          done
+          exit 1
+
+  plugin:
+    needs: [pypi]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: gronare/claude-plugins
+          ref: main
+          ssh-key: ${{ secrets.CLAUDE_PLUGINS_DEPLOY_KEY }}
+
+      - name: Point the vault plugin at this release
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/v}"
+          if grep -qE "(mindin|notes-vault-mcp)==${VERSION}\"" plugins/vault/.mcp.json; then
+            echo "the plugin already pins ${VERSION}"
+            exit 0
+          fi
+          sed -i -E "s/(mindin|notes-vault-mcp)==[0-9.]+/\1==${VERSION}/g" plugins/vault/.mcp.json plugins/vault/hooks/hooks.json
+          PLUGIN="$(jq -r '.version' plugins/vault/.claude-plugin/plugin.json | awk -F. '{print $1"."$2"."$3+1}')"
+          jq --arg v "$PLUGIN" '.version = $v' plugins/vault/.claude-plugin/plugin.json > plugin.json.tmp
+          mv plugin.json.tmp plugins/vault/.claude-plugin/plugin.json
+          git config user.name "mindin release"
+          git config user.email "release@mindin.invalid"
+          git add plugins/vault/.mcp.json plugins/vault/hooks/hooks.json plugins/vault/.claude-plugin/plugin.json
+          git commit -m "vault ${PLUGIN}: the server and the hooks pin ${VERSION}"
+          git push origin HEAD:main
+
+  release:
+    needs: [pypi, ghcr, registry, plugin]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          sparse-checkout: |
+            CHANGES.md
+            scripts/release-notes.sh
+            deploy/docker/compose.yml
+            deploy/docker/Caddyfile
+            deploy/docker/.env.example
+            scripts/install.sh
+          sparse-checkout-cone-mode: false
+      - name: The release notes, from the version's section of CHANGES.md
+        run: sh scripts/release-notes.sh "${GITHUB_REF_NAME#v}" > release-notes.md
+      - name: Publish the GitHub release with the version's notes, as latest
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          title="mindin ${GITHUB_REF_NAME#v}"
+          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+            gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --notes-file release-notes.md --title "$title" --draft=false --latest
+          else
+            gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --verify-tag --notes-file release-notes.md --title "$title" --latest
+          fi
+      - name: Attach the install script and the Docker Compose files, which the install docs fetch from the latest release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cp deploy/docker/.env.example example.env
+          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber scripts/install.sh deploy/docker/compose.yml deploy/docker/Caddyfile example.env

mindin-0.14.0/.gitignore

@@ -0,0 +1,11 @@
+.venv/
+__pycache__/
+*.pyc
+.env
+*.sqlite
+*.sqlite-shm
+*.sqlite-wal
+dist/
+build/
+.pytest_cache/
+.ruff_cache/

mindin-0.14.0/CHANGES.md

@@ -0,0 +1,149 @@
+# Changes
+
+What each mindin release brings, one line per change, as you would tell someone who uses it. scripts/release.sh moves the Unreleased entries under the new version, and the GitHub release shows that version's entries.
+
+## Unreleased
+
+### What's new
+
+### Fixed
+
+## 0.14.0
+
+### What's new
+- Renamed from notes-vault-mcp to mindin: the package, the command and the image are `mindin`. The `notes-vault-mcp` package and command keep working and run mindin, the image is published under both names, and `~/.config/notes-vault-mcp` and `~/.cache/notes-vault-mcp` move to `mindin` on the first run, so no machine is signed out or indexed again. Extensions register in the `mindin.extensions` entry point group and import from `mindin.extension_api`.
+- `mindin setup` asks where the vault lives, a folder, an S3 bucket or a vault server, and saves it for every command and client on the machine; `--folder`, `--s3` and `--server` do it from a script. The environment still wins, and the Claude Code plugin's settings are read when mindin has none. `status` names which one decided in `source`.
+- `curl -fsSL https://github.com/gronare/mindin/releases/latest/download/install.sh | sh` installs mindin with uv, runs `setup` and offers to add the vault to Claude Code, Codex and Cursor.
+- `mindin about --json` tells a tool the name, version, contract and the commands this install has.
+
+### Fixed
+
+## 0.13.0
+
+### What's new
+- The documentation lives in `docs/`, sorted into install guides, how-tos, reference and explanation, with a page listing every environment variable.
+- `deploy/docker/` holds the Docker Compose setup, and each GitHub release carries its `compose.yml`, `Caddyfile` and `example.env`, so a server installs with two `curl` lines. Its `.env` keeps the vaults in the container's volume unless you set a bucket.
+- `VAULT_HTTP_STATELESS=on` serves MCP without sessions, so a server restart drops no session a client holds.
+- `notes-vault-mcp embed-worker --listen host:port` runs the model for search by meaning in a process of its own that the server reaches through `VAULT_EMBED_URL`, with `VAULT_EMBED_TOKEN` as its secret, so the server restarts fast and stays small.
+- `GET /ready` answers `200` when the server is ready for requests and `503` with the names of the failing checks, for a load balancer or a readiness probe.
+- `VAULT_INDEX_SNAPSHOTS=on` keeps a sealed copy of each vault's search index in storage, so a restarted or moved server restores a vault's index instead of indexing and embedding every note again. A busy vault's copy is written at most once per `VAULT_INDEX_SNAPSHOT_MINUTES` (default 10) and only when the index changed, plus once when it goes idle and once when the server stops.
+- `VAULT_FORWARDED_ALLOW_IPS` names the reverse proxies, as addresses or CIDR ranges, whose `X-Forwarded-For` the server trusts, so rate limits count each real client; the limits are kept in the account store and survive a restart.
+- Extensions import what they build on from `notes_vault_mcp.extension_api`; [Extensions](docs/reference/extensions.md) describes each hook.
+- A vault server has one address, `/mcp`; another vault than the one picked when connecting is `/mcp?vault=<slug>`, and a slug is one lowercase word, unique among the vaults an account reaches. A new account's first vault is `notes`, and existing slugs that break the rule are rewritten on the first start.
+
+### Fixed
+- Two writes to one note at the same moment both land: `append_file`, `set_status`, `close`, `log_append`, `write_file` and the monthly log pages write over the version they read and read again when the note changed meanwhile, two `backlog_add` calls with one title get two notes, and a new vault's first files never overwrite a file already there.
+- WebDAV `PUT` honours `If-Match` and `If-None-Match: *` and answers `412` when the file changed.
+- A note's age counts calendar days in local time, so a note from five days back reads "5 days" also just after midnight.
+- A vault server's root address opens the account page instead of answering not found.
+- The access log leaves out query strings, so sign-in and invitation links never land in it.
+- An unknown vault address answers like a known one the caller cannot reach.
+- WebDAV opens vaults and talks to storage off the event loop, so a slow vault never stalls other requests or `/up`.
+- An edit from Obsidian over WebDAV shows in search at once instead of after up to 20 seconds.
+- `close` keeps a change that lands on the note while it is being archived.
+
+## 0.12.0
+
+### What's new
+- In a terminal, `search`, `backlog`, `read` and `lint` print for a person: titles first, paths whole, ages in words, colour for status, priority and kind, and rows cut at the terminal's width. In a pipe or with `--plain` they print as before; `NO_COLOR` drops the colour.
+- `context` shows what a session in this repo starts with: the system note, the commits newer than it, open tasks, the backlog, traps and the last log line. `--path` reads it for another folder.
+- `backlog --paths` shows each note's path, and a backlog of more than 20 ideas is grouped by priority; `--all` shows every row.
+- `read --raw` prints the note exactly as stored, also in a terminal.
+- `lint` in a terminal counts the findings per kind with a plain explanation, and `lint --kind <kind>` lists one kind.
+
+### Fixed
+- The session-start hook's repo log shows only log lines, never the log note's frontmatter.
+
+## 0.11.0
+
+### What's new
+- The stop hook asks the agent to save the decisions and ideas in your messages once you have written three since its last vault write, also outside a git repo; `VAULT_STOP_HOOK_PROMPTS` sets the number or turns the check `off`.
+- `VAULT_STOP_HOOK_COMMITS=off` turns off the stop hook's unlogged-commit and stale-note checks and keeps the message check, for sessions whose log another tool writes.
+- A vault server loads the extensions installed beside it, from the Python entry point group `notes_vault_mcp.extensions`.
+- An account on a vault server owns several vaults, each with its own name, address (`/v/<slug>/mcp`), keys, connections, layout and encryption key; a key, connector or signed-in computer reaches only the vault it was made for. An existing account's vault becomes its first vault, in place, on the first start.
+- `/account` lists your vaults and makes new ones; each vault has its own page to connect, see and revoke what reaches it, export, import and delete it. Who you are, ways in, support access and account deletion move to Account. A vault's layout is picked when it is made and switched on its own page.
+- `login --vault <slug>` signs a machine in to one vault, and `vault use <slug> [--dir <folder>]` picks the vault for this machine or for a folder and everything below it; the hooks and the stdio server follow the folder they run in.
+- A vault can be shared: its owner invites people by email, each signs in with their own account and makes their own keys and connections, and the owner removes members, hands the vault over or deletes it. A shared vault keeps only current notes (system, howto, decision, reference, trap) and refuses tasks, backlog and logs with a message the agent can act on.
+- Every write, move and delete in a shared vault, through MCP or WebDAV, is kept with who made it, through what and when; its page shows each change as a diff and restores the version before it as a new change. `accounts add-vault --shared`, `members`, `add-member` and `remove-member` do the same from the shell, and `whoami` and `status --probe` show each vault's kind and role.
+- Support access is granted per vault, and `support` and `accounts import` take `--vault` when the account has several. `accounts vaults`, `add-vault` and `rename-vault` manage an account's vaults from the shell.
+
+### Fixed
+
+## 0.10.3
+
+### What's new
+
+### Fixed
+- claude.ai connects with its published client identity, whose metadata lists a grant the server does not use.
+- A client that signs in is asked for read and write access, not only read, so a connector can write notes.
+
+## 0.10.2
+
+### What's new
+
+### Fixed
+- Obsidian's Remotely Save syncs the vault itself over WebDAV, with its default base folder, instead of uploading a copy into a folder named after the Obsidian vault.
+
+## 0.10.1
+
+### What's new
+
+### Fixed
+- search, backlog, lint and every other command find a vault server named in the Claude Code plugin's settings, not only the task and log commands.
+
+## 0.10.0
+
+### What's new
+- The HTTP server always serves accounts, one vault each, with an /account page. This breaks older setups: the --auth flag and the bearer, builtin, oidc and forwarded modes are removed, and so are the owner and tokens commands.
+- Sign in with a passkey, an email link over SMTP, GitHub, your OpenID Connect provider or a trusted proxy's signed identity header. Each method is on when its settings are present, and an account can use several.
+- The provider settings are called VAULT_OIDC_ISSUER, VAULT_OIDC_CLIENT_ID, VAULT_OIDC_CLIENT_SECRET and VAULT_OIDC_SCOPES. This breaks older setups: the VAULT_HOSTED_OIDC_* names are not read.
+- Registration is by invitation, or open to any verified email with VAULT_REGISTRATION=open.
+- Every account's vault is encrypted in storage, file contents and names, under its own key wrapped by a master key. This breaks older setups: the server needs VAULT_HOSTED_MASTER_KEY to start, made with notes-vault-mcp master-key generate.
+- Encrypted vaults are stored under new paths, so an existing plaintext vault is not read. Bring it in with notes-vault-mcp accounts import, or as a zip on /account.
+- master-key status and master-key rewrap rotate the master key, with the old one in VAULT_HOSTED_MASTER_KEY_PREVIOUS.
+- An account exports its vault as a zip, imports one, and deletes itself on /account. notes-vault-mcp accounts delete does the same from the shell.
+- An account can allow support access for an hour, a day or a week. The support files and support read commands and accounts import refuse without it, and every access shows in the account's log.
+- Layout presets: init --preset para, simple, journal or custom, each with its folders, kinds, tags and Bases views. An account picks its layout on /account and can switch later.
+- A schema can nest folders and is checked when loaded. One that does not hold leaves the vault on its preset, and context, lint and the account page list each problem.
+- notes-vault-mcp login signs a machine in to a vault server through the device flow, and whoami and logout go with it. With VAULT_SERVER_URL set, the stdio server, the hooks and every command work through the server.
+- The Claude Code plugin offers a vault server as a third choice beside a folder and a bucket.
+- New tools on a server: whoami for every connection, and claim, release and changelog for a signed-in machine. context answers JSON with format json.
+- lint --write and --park-stale run through a vault server when VAULT_SERVER_URL is set, so a scheduled lint can keep a hosted vault tidy.
+- snapshot --json answers a board's system and task notes, the openings of open tasks and the repo log tails in one call under an etag, and --since answers unchanged while nothing moved. log path takes --repo more than once.
+- read prints one note, from the local vault or through the vault server, and --body leaves out its frontmatter.
+
+### Fixed
+- A repo log that log_append creates is titled Log — <repo>.
+- A changelog period takes whole days at both ends, so it keeps commits from early on its first day and leaves out those from early on the next period's first day.
+
+## 0.9.2
+
+### What's new
+- The claim field on a task note is called kebbie. This breaks older claims: a note that carries the previous key is not read as claimed.
+
+### Fixed
+
+## 0.9.1
+
+### What's new
+- Search by meaning on a server. A query is answered beside a running embed instead of waiting behind it, and the model stays warm while the HTTP server runs, so searches use vectors during a first sync. A server starts embedding notes without vectors as soon as it starts.
+- Lower memory while embedding. VAULT_EMBED_BATCH (default 16), VAULT_EMBED_THREADS (half the usable cores, at most 4, counting a container's CPU limit) and VAULT_EMBED_MAX_TOKENS (default 256) bound the embedding process. The S3 connection pool matches the fetch workers.
+- Hosted mode. --auth hosted serves one vault per account, with sign-in through an OIDC provider, invitations, an /account page and API keys. A machine can get its key through the OAuth device flow at /device. OAuth clients can identify themselves with a client ID metadata document.
+
+### Fixed
+- WebDAV refuses writes from credentials that may only read.
+- Notes written through the claude.ai connector count as touched by the session-start hook.
+
+## 0.9.0
+
+### What's new
+- Search by meaning. With VAULT_SEMANTIC=on and the [semantic] extra installed, search also finds notes that match the question without sharing its words. Results say how many matched by meaning only. The default model is mpnet; set VAULT_SEMANTIC_MODEL to pick MiniLM instead.
+- One embedding process is shared by every session on a machine, so several agents searching at once load the model once.
+- Two images: ghcr.io/gronare/notes-vault-mcp:v0.9.0 without the model, and :v0.9.0-semantic with it.
+- The README is rewritten around what the server does and how to start it.
+
+## 0.8.0
+
+### What's new
+- A task note can carry a claim field naming the machine and task working on it. The server keeps the field as stored when a note is written, so an agent can claim a note without another machine overwriting the claim.
+- Every release checks that the tag matches the package version before anything is published.

mindin-0.14.0/Dockerfile

@@ -0,0 +1,17 @@
+FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim
+
+LABEL org.opencontainers.image.source="https://github.com/gronare/mindin"
+LABEL io.modelcontextprotocol.server.name="io.github.gronare/mindin"
+
+WORKDIR /app
+ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy PATH="/app/.venv/bin:$PATH"
+
+COPY pyproject.toml uv.lock README.md ./
+COPY mindin ./mindin
+ARG EXTRAS=""
+RUN uv sync --frozen --no-dev $EXTRAS && ln -s mindin /app/.venv/bin/notes-vault-mcp
+
+ENV VAULT_AUTH_DIR=/data/auth VAULT_CACHE_DIR=/data/cache
+VOLUME /data
+
+ENTRYPOINT ["mindin"]

mindin-0.14.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carl Green / Grönare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mindin-0.14.0/PKG-INFO

@@ -0,0 +1,87 @@
+Metadata-Version: 2.5
+Name: mindin
+Version: 0.14.0
+Summary: MCP server for a markdown notes vault on S3 or a local directory, with a SQLite index, schema-aware writes and session hooks.
+Project-URL: Homepage, https://github.com/gronare/mindin
+Project-URL: Repository, https://github.com/gronare/mindin
+Author-email: Carl Green <carl.green@gronare.se>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: mcp,notes,obsidian,s3,vault
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Text Processing :: Markup :: Markdown
+Requires-Python: >=3.11
+Requires-Dist: boto3>=1.34.0
+Requires-Dist: cryptography>=50.0.2
+Requires-Dist: httpx2>=2.5
+Requires-Dist: mcp>=2.2
+Requires-Dist: pyjwt[crypto]>=2.15
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: snowballstemmer>=3.1.1
+Requires-Dist: webauthn>=3.0.1
+Provides-Extra: semantic
+Requires-Dist: fastembed>=0.7; extra == 'semantic'
+Requires-Dist: numpy>=1.26; extra == 'semantic'
+Description-Content-Type: text/markdown
+
+<!-- mcp-name: io.github.gronare/mindin -->
+
+# mindin
+
+Memory for Claude and coding agents, kept as markdown notes you own, with a schema that holds and a tie to your git history.
+
+## Install
+
+```sh
+curl -fsSL https://github.com/gronare/mindin/releases/latest/download/install.sh | sh
+```
+
+It installs the `mindin` command with [uv](https://docs.astral.sh/uv/), asks where your vault lives (a folder, an S3 bucket or a vault server), and offers to add the vault to Claude Code, Codex and Cursor; it changes nothing in them without a yes. mindin was called notes-vault-mcp: the `notes-vault-mcp` package and command still work, and install and run mindin.
+
+### A vault server
+
+A vault server with Docker Compose, for claude.ai, Claude Desktop, mobile and every machine you work on. You need a domain pointing at the machine, ports 80 and 443 open, and an SMTP account for sign-in links.
+
+```sh
+mkdir notes-vault && cd notes-vault
+curl -fsSL -O https://github.com/gronare/mindin/releases/latest/download/compose.yml -O https://github.com/gronare/mindin/releases/latest/download/Caddyfile
+curl -fsSL -o .env https://github.com/gronare/mindin/releases/latest/download/example.env
+docker compose run --rm --no-deps vault master-key generate   # paste into .env, with VAULT_HOST and SMTP
+docker compose up -d
+docker compose exec vault mindin accounts invite you@example.com
+```
+
+Then open `https://VAULT_HOST/account` and sign in. [Install with Docker](https://github.com/gronare/mindin/blob/main/docs/install/docker.md) walks through each step.
+
+Without the script, on one machine: `uv tool install mindin`, then `mindin setup`.
+
+## Use
+
+Add the server's address, `https://VAULT_HOST/mcp`, as a custom connector in claude.ai. Claude searches, reads and writes your notes. The same search from a shell on a [signed-in machine](https://github.com/gronare/mindin/blob/main/docs/how-to/sign-in-a-machine.md):
+
+```console
+$ mindin search "signing in"
+1 note · archive and superseded hidden
+
+myapp  system  3 days
+Areas/myapp.md
+  ## Sign-in Users sign in with passkeys; email links are the fallback.
+```
+
+## What you get
+
+- **Notes you own.** Plain markdown in a folder or an S3 bucket; open them in Obsidian, keep them in git.
+- **A schema with teeth.** Required fields, legal statuses and kinds, a tag vocabulary; a write that breaks the contract is refused. Start from PARA, a simple vault, a journal or your own layout.
+- **A lifecycle.** `close` archives finished work, `backlog_add` files what was deferred, `log_append` writes one line per repo per session, `lint` reports drift.
+- **Memory tied to code.** A note names the paths it describes; the session-start hook prints the commits newer than the note.
+- **Search that reads your languages.** Stemming, folded diacritics, synonyms, and optional search by meaning that runs on your machine.
+- **Your own vault server.** Accounts with passkeys, email links, GitHub or your identity provider, several vaults each, shared vaults, sealed in storage.
+
+## Documentation
+
+[docs/](https://github.com/gronare/mindin/blob/main/docs/README.md) has the install guides, the how-tos for each client, the reference for every tool, command and setting, and how it works.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

mindin-0.14.0/README.md

@@ -0,0 +1,60 @@
+<!-- mcp-name: io.github.gronare/mindin -->
+
+# mindin
+
+Memory for Claude and coding agents, kept as markdown notes you own, with a schema that holds and a tie to your git history.
+
+## Install
+
+```sh
+curl -fsSL https://github.com/gronare/mindin/releases/latest/download/install.sh | sh
+```
+
+It installs the `mindin` command with [uv](https://docs.astral.sh/uv/), asks where your vault lives (a folder, an S3 bucket or a vault server), and offers to add the vault to Claude Code, Codex and Cursor; it changes nothing in them without a yes. mindin was called notes-vault-mcp: the `notes-vault-mcp` package and command still work, and install and run mindin.
+
+### A vault server
+
+A vault server with Docker Compose, for claude.ai, Claude Desktop, mobile and every machine you work on. You need a domain pointing at the machine, ports 80 and 443 open, and an SMTP account for sign-in links.
+
+```sh
+mkdir notes-vault && cd notes-vault
+curl -fsSL -O https://github.com/gronare/mindin/releases/latest/download/compose.yml -O https://github.com/gronare/mindin/releases/latest/download/Caddyfile
+curl -fsSL -o .env https://github.com/gronare/mindin/releases/latest/download/example.env
+docker compose run --rm --no-deps vault master-key generate   # paste into .env, with VAULT_HOST and SMTP
+docker compose up -d
+docker compose exec vault mindin accounts invite you@example.com
+```
+
+Then open `https://VAULT_HOST/account` and sign in. [Install with Docker](https://github.com/gronare/mindin/blob/main/docs/install/docker.md) walks through each step.
+
+Without the script, on one machine: `uv tool install mindin`, then `mindin setup`.
+
+## Use
+
+Add the server's address, `https://VAULT_HOST/mcp`, as a custom connector in claude.ai. Claude searches, reads and writes your notes. The same search from a shell on a [signed-in machine](https://github.com/gronare/mindin/blob/main/docs/how-to/sign-in-a-machine.md):
+
+```console
+$ mindin search "signing in"
+1 note · archive and superseded hidden
+
+myapp  system  3 days
+Areas/myapp.md
+  ## Sign-in Users sign in with passkeys; email links are the fallback.
+```
+
+## What you get
+
+- **Notes you own.** Plain markdown in a folder or an S3 bucket; open them in Obsidian, keep them in git.
+- **A schema with teeth.** Required fields, legal statuses and kinds, a tag vocabulary; a write that breaks the contract is refused. Start from PARA, a simple vault, a journal or your own layout.
+- **A lifecycle.** `close` archives finished work, `backlog_add` files what was deferred, `log_append` writes one line per repo per session, `lint` reports drift.
+- **Memory tied to code.** A note names the paths it describes; the session-start hook prints the commits newer than the note.
+- **Search that reads your languages.** Stemming, folded diacritics, synonyms, and optional search by meaning that runs on your machine.
+- **Your own vault server.** Accounts with passkeys, email links, GitHub or your identity provider, several vaults each, shared vaults, sealed in storage.
+
+## Documentation
+
+[docs/](https://github.com/gronare/mindin/blob/main/docs/README.md) has the install guides, the how-tos for each client, the reference for every tool, command and setting, and how it works.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

mindin-0.14.0/deploy/docker/.env.example

@@ -0,0 +1,76 @@
+# mindin server settings. docs/reference/configuration.md describes every variable.
+
+# ---- Required: edit these ----
+
+# The domain the server answers on. Point it at this machine and open ports 80 and 443; Caddy fetches the certificate. The server's address is https://VAULT_HOST.
+VAULT_HOST=vault.example.com
+
+# Seals every vault. Make one with: docker compose run --rm --no-deps vault master-key generate
+# Back it up outside this machine: without it no vault can be read.
+VAULT_HOSTED_MASTER_KEY=
+
+# At least one way to sign in. Email links are below; GitHub, an identity provider and a trusted proxy are further down.
+VAULT_SMTP_HOST=smtp.example.com
+VAULT_SMTP_FROM=Vault <vault@example.com>
+VAULT_SMTP_USERNAME=REPLACE_ME
+VAULT_SMTP_PASSWORD=REPLACE_ME
+# VAULT_SMTP_SECURITY=starttls
+# VAULT_SMTP_PORT=587
+
+# ---- Storage ----
+
+# The vaults live in the container's /data volume. To keep them in an S3 bucket instead, delete this line and fill in the S3 block.
+VAULT_PATH=/data/vaults
+
+# S3_ENDPOINT=https://s3.example.com
+# S3_BUCKET=vault
+# S3_ACCESS_KEY=
+# S3_SECRET_KEY=
+# S3_REGION=us-east-1
+# S3_PREFIX=
+
+# ---- Optional: other ways to sign in ----
+
+# GitHub: an OAuth app with the callback https://VAULT_HOST/signin/github/callback
+# VAULT_GITHUB_CLIENT_ID=
+# VAULT_GITHUB_CLIENT_SECRET=
+
+# An OpenID Connect provider: a confidential client with the callback https://VAULT_HOST/oidc/callback
+# VAULT_OIDC_ISSUER=
+# VAULT_OIDC_CLIENT_ID=
+# VAULT_OIDC_CLIENT_SECRET=
+# VAULT_OIDC_NAME=your organisation
+# VAULT_OIDC_SCOPES=openid email profile
+
+# A proxy in front that signs in people and forwards a signed identity token
+# VAULT_IDENTITY_PUBLIC_KEY=
+# VAULT_IDENTITY_ISSUER=
+# VAULT_IDENTITY_HEADER=X-Forwarded-Identity
+# VAULT_IDENTITY_TYP=
+# VAULT_IDENTITY_WRITE_CLAIMS=vault:write
+# VAULT_IDENTITY_READ_CLAIMS=vault:read
+# VAULT_IDENTITY_NAME=your company's sign-in
+
+# ---- Optional: accounts and access ----
+
+# VAULT_REGISTRATION=invite
+# VAULT_PASSKEYS=on
+# VAULT_ALLOWED_HOSTS=
+# VAULT_SUBJECT_PREFIX=users
+
+# ---- Optional: rotating the master key ----
+
+# VAULT_HOSTED_MASTER_KEY_PREVIOUS=
+
+# ---- Optional: importing a vault from another bucket ----
+
+# IMPORT_S3_ACCESS_KEY=
+# IMPORT_S3_SECRET_KEY=
+
+# ---- Optional: search by meaning ----
+
+# docs/install/semantic-search.md turns it on with a compose.override.yml; these tune it.
+# VAULT_SEMANTIC_MODEL=sentence-transformers/paraphrase-multilingual-mpnet-base-v2
+# VAULT_EMBED_BATCH=16
+# VAULT_EMBED_THREADS=
+# VAULT_EMBED_MAX_TOKENS=256

mindin-0.14.0/deploy/docker/Caddyfile

@@ -0,0 +1,3 @@
+{$VAULT_HOST} {
+	reverse_proxy vault:8765
+}