feat(cli): add get-sync-token subcommand with auto-capture via volume mount

.env.example

@@ -23,7 +23,7 @@ PUBLIC_URL=
 
 # Obsidian Sync credentials
 # Generate OBSIDIAN_AUTH_TOKEN once with:
-#   docker run --rm -it --entrypoint get-token \
+#   docker run --rm -it --entrypoint get-sync-token \
 #     ghcr.io/aliasunder/vault-cortex:remote
 OBSIDIAN_AUTH_TOKEN=
 VAULT_NAME=

AGENTS.md

@@ -52,7 +52,7 @@ obsidian-headless/                     # Lockfile-pinned obsidian-headless for D
   package-lock.json                    #   sha512 integrity hashes (supply-chain security)
 rootfs/                                # Container filesystem overlay (remote target)
   etc/s6-overlay/                      #   init chain + svc-obsidian-sync + svc-vault-mcp
-  usr/local/bin/get-token              #   interactive Obsidian Sync token helper
+  usr/local/bin/get-sync-token         #   interactive Obsidian Sync token helper (manual flow)
 docker-compose.yml                     # Lightsail: single vault-cortex:remote service
 docker-compose.local.yml               # Contributor dev: builds from source
 .env.example                           # template for Lightsail .env
@@ -85,6 +85,7 @@ cli/                                   # npx vault-cortex CLI (published as vaul
     scaffold.ts                        # File generation (.env)
     docker.ts                          # Container management (docker run, health-check wait)
     upgrade.ts                         # Upgrade command (pull + re-create + health check)
+    get-sync-token.ts                  # Get-sync-token subcommand (Sync token auto-capture via volume mount)
     env.ts                             # Environment file handling (.env generation)
     token.ts                           # Secure token generation (openssl rand)
     vault.ts                           # Vault path validation

DEPLOY.md

@@ -62,7 +62,13 @@ Then open `~/.config/vault-cortex/.env` and fill in the remaining values:
 The [`.env.example`](./.env.example) file also includes optional configuration for the embedding pipeline (`EMBEDDING_ENABLED`), the reranker (`RERANK_MODE`), the memory system (`MEMORY_ENABLED`, `MEMORY_DIR`, `PROTECTED_PATHS`, `ORPHAN_EXCLUDE_FOLDERS`), timezone (`TZ`), and OAuth metadata (`SERVICE_DOCUMENTATION_URL`). All have sensible defaults — see the [Configuration](./README.md#configuration) section in the README.
 
 ```bash
-docker run --rm -it --entrypoint get-token ghcr.io/aliasunder/vault-cortex:remote
+npx vault-cortex get-sync-token
+```
+
+Or run the Docker image directly:
+
+```bash
+docker run --rm -it --entrypoint get-sync-token ghcr.io/aliasunder/vault-cortex:remote
 ```
 
 **4. Authenticate to GHCR** (once per machine):
@@ -280,7 +286,7 @@ To find your stage: `cat .sst/stage` (after your first deploy).
 | `GHCR_TOKEN`             | Personal access token (classic) with `write:packages` + `read:packages`. Used by `docker login` both at build-push and on-instance pull. Persists across runs; rotate when stale.                                 |
 | `DOCKERHUB_TOKEN`        | Optional. Docker Hub access token with `Read & Write` repository permissions. Used by deploy (image push) and dockerhub-description (DOCKERHUB.md sync). Only needed when `DOCKERHUB_USERNAME` is set.            |
 | `MCP_AUTH_TOKEN`         | Same value as the SST secret of the same name. Written into the instance `.env` for the Express auth layer.                                                                                                       |
-| `OBSIDIAN_AUTH_TOKEN`    | Output of `docker run --rm -it --entrypoint get-token ghcr.io/aliasunder/vault-cortex:remote`.                                                                                                                    |
+| `OBSIDIAN_AUTH_TOKEN`    | Output of `npx vault-cortex get-sync-token` — see [One-time setup](#one-time-setup).                                                                                                                              |
 | `VAULT_PASSWORD`         | Optional. Only set if your vault uses end-to-end encryption. Empty value is fine and ships through to `.env` as `VAULT_PASSWORD=`.                                                                                |
 | `SSH_PUBKEY`             | Public key contents of your `~/.ssh/vault-cortex.pub` (literal, single line). Same key local dev and CI use — see [Prerequisites](#prerequisites).                                                                |
 | `SSH_PRIVATE_KEY`        | Private half (`~/.ssh/vault-cortex`, full multi-line block including BEGIN/END markers). Loaded by `webfactory/ssh-agent` for SCP/SSH to the instance.                                                            |

Dockerfile

@@ -74,7 +74,7 @@ EXPOSE 8000
 # ---------------------------------------------------------------------------
 # remote: s6-overlay supervises obsidian-sync + vault-mcp in one container.
 # Absorbed from aliasunder/obsidian-headless-sync-docker (rootfs/, including
-# the get-token helper), adapted from Alpine to Debian.
+# the interactive token helper, since rewritten as get-sync-token), adapted from Alpine to Debian.
 # ---------------------------------------------------------------------------
 FROM base AS remote
 
@@ -140,9 +140,9 @@ RUN userdel -r node \
     && chown -R obsidian:obsidian /vault /home/obsidian
 
 # s6 service definitions (init chain + svc-obsidian-sync + svc-vault-mcp)
-# and the interactive get-token helper (rootfs/usr/local/bin/get-token).
+# and the interactive get-sync-token helper (rootfs/usr/local/bin/get-sync-token).
 COPY rootfs/ /
-RUN chmod +x /usr/local/bin/get-token \
+RUN chmod +x /usr/local/bin/get-sync-token \
     && chmod +x /etc/s6-overlay/scripts/* \
     && chmod +x /etc/s6-overlay/s6-rc.d/svc-obsidian-sync/run \
        /etc/s6-overlay/s6-rc.d/svc-vault-mcp/run

cli/README.md

@@ -28,6 +28,26 @@ container; this CLI scaffolds the config so you don't have to.
 
 Existing files are never overwritten without asking.
 
+## Get Sync Token
+
+Generate an Obsidian Sync auth token without leaving the CLI:
+
+```bash
+npx vault-cortex get-sync-token
+```
+
+The command opens the Obsidian login inside Docker. Once you've signed
+in, it captures your token and prints it — nothing to dig out of the
+login output. Use `--dir` to write the token straight into an existing
+`.env` instead:
+
+```bash
+npx vault-cortex get-sync-token --dir ./vault-cortex
+```
+
+During `init --mode remote`, this flow is offered automatically when Docker
+is available.
+
 ## Upgrade
 
 Pull the latest image, re-create the container, and verify health:

cli/src/__tests__/docker.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest"
 
 import {
   buildDockerRunArgs,
+  buildObsidianLoginArgs,
   CONTAINER_NAME,
   LOCAL_IMAGE,
   pollHealth,
@@ -187,6 +188,71 @@ describe("buildDockerRunArgs", () => {
   })
 })
 
+describe("buildObsidianLoginArgs", () => {
+  it("produces the correct args on macOS (no --user flag)", () => {
+    const args = buildObsidianLoginArgs({
+      configMountPath: "/tmp/vault-cortex-sync-token-abc",
+      platform: "darwin",
+      uid: 501,
+      gid: 20,
+    })
+
+    expect(args).toEqual([
+      "run",
+      "--rm",
+      "-it",
+      "--entrypoint",
+      "ob",
+      "-v",
+      "/tmp/vault-cortex-sync-token-abc:/home/obsidian/.config",
+      REMOTE_IMAGE,
+      "login",
+    ])
+  })
+
+  it("includes --user uid:gid on Linux", () => {
+    const args = buildObsidianLoginArgs({
+      configMountPath: "/tmp/vault-cortex-sync-token-abc",
+      platform: "linux",
+      uid: 1000,
+      gid: 1000,
+    })
+
+    expect(args).toEqual([
+      "run",
+      "--rm",
+      "-it",
+      "--entrypoint",
+      "ob",
+      "-v",
+      "/tmp/vault-cortex-sync-token-abc:/home/obsidian/.config",
+      "--user",
+      "1000:1000",
+      REMOTE_IMAGE,
+      "login",
+    ])
+  })
+
+  it("omits --user on Linux when uid/gid are not provided", () => {
+    const args = buildObsidianLoginArgs({
+      configMountPath: "/tmp/test",
+      platform: "linux",
+    })
+
+    expect(args).toEqual([
+      "run",
+      "--rm",
+      "-it",
+      "--entrypoint",
+      "ob",
+      "-v",
+      "/tmp/test:/home/obsidian/.config",
+      REMOTE_IMAGE,
+      "login",
+    ])
+  })
+})
+
 describe("pollHealth", () => {
   it("returns true as soon as the endpoint responds ok", async () => {
     const fetchStub = async (): Promise<Response> => okResponse

cli/src/__tests__/env.test.ts

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "vitest"
 
-import { REMOTE_IMAGE } from "../docker.js"
 import { buildLocalEnv, buildRemoteEnv } from "../env.js"
 
 describe("buildLocalEnv", () => {
@@ -81,9 +80,7 @@ describe("buildRemoteEnv", () => {
 
     expect(env).toMatch(/^OBSIDIAN_AUTH_TOKEN=$/m)
     expect(env).toContain("FILL THIS IN")
-    // The guidance must name the actual get-token image, not just the
-    // subcommand — "get-token" alone would pass with a stale image name.
-    expect(env).toContain(`get-token \\\n#     ${REMOTE_IMAGE}`)
+    expect(env).toContain("npx vault-cortex get-sync-token")
   })
 
   it("states defaulted sync settings as uncommented lines", () => {