gin_trgm_ops only applies to text, not text[]. The plain GIN index on
tags is sufficient for the `@>` / `<@` / `&&` set-containment operators
used by memory.list. pg_trgm stays loaded for future fuzzy search over
content.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When esbuild bundles migrate.ts to apps/web/migrate.mjs (one directory
higher than the source location), the relative `..` path in the previous
implementation pointed at apps/, not apps/web/. Try both layouts and
allow an explicit MIGRATIONS_DIR override.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
pnpm --filter runs in the package directory, so the input and output
paths must be relative to apps/web, not the repo root.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Dockerfile uses `pnpm exec esbuild` to bundle the migrator into a
single ESM file before copying it into the runtime image. pnpm exec only
resolves binaries from declared dependencies, so the transitive esbuild
that tsx pulls in wasn't visible to the build stage.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Local pnpm builds worked because all workspace packages had their
node_modules populated by `pnpm install`. The Docker builder stage was
only restoring `apps/web/node_modules` from the deps stage, leaving
`packages/schemas/node_modules` empty — so `next build` couldn't resolve
`zod` when transpiling the shared schemas package.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign
into the Web UI (/me debug page), and an MCP client with an Authentik-
issued bearer token can call memory.write / memory.list / memory.get /
memory.delete plus project.identify against /api/mcp.
Stack:
- Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces
- Drizzle ORM + Postgres 16 + pgvector + pg_trgm
- Auth.js v5 with Authentik provider (Web UI)
- jose + Authentik JWKS for MCP bearer-token validation
- JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain
HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a
later phase if server-initiated events are needed)
- bge-small embeddings sidecar deferred to Phase 2; the schema already
reserves the vector(384) column + IVFFlat index, FTS via a STORED
tsvector column, and the visibility enum (private/shared/team) so
cross-user memory sharing can be added without a future migration
Deployment supports two modes (set in .env, never committed):
- Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel /
Traefik) — DEFAULT; the app exposes APP_PORT on the host with
X-Forwarded-* trusted, no in-container TLS
- Built-in TLS via Caddy — opt-in with `docker compose --profile tls up`
Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728)
points MCP clients at the Authentik authorization server after a 401.
README walks through both Authentik providers (Web UI + MCP resource
server), the audience scope mapping, redirect URIs, and includes a worked
HAProxy config snippet.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Establishes the secrets-handling contract for this repo: real env values
live in a local .env (gitignored from the first commit), and only the
sanitized .env.example with placeholder values is tracked.
.env.example documents the env surface for the v1 deployment: PUBLIC_URL,
Authentik OIDC clients (web + MCP resource server), Postgres connection,
embedder sidecar, NextAuth secret, and log level.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
shadowdaoandClaude Opus 4.7