feat(cli): replace Docker-based get-sync-token with native Obsidian API call

AGENTS.md

@@ -98,7 +98,7 @@ cli/                                   # npx vault-cortex CLI (published as vaul
     docker.ts                          # Container management (docker run, health-check wait)
     upgrade.ts                         # Upgrade command (pull + re-create + health check)
     lifecycle.ts                       # Down/logs/restart commands + shared deployment resolution and re-create plumbing
-    get-sync-token.ts                  # Get-sync-token subcommand (Sync token auto-capture via volume mount)
+    get-sync-token.ts                  # Get-sync-token subcommand (Sync token capture via Obsidian API)
     env.ts                             # Environment file handling (.env generation)
     token.ts                           # Secure token generation (openssl rand)
     vault.ts                           # Vault path validation

cli/README.md

@@ -60,8 +60,8 @@ What it does:
 Re-running init where a setup already exists asks first — declining leaves
 everything unchanged and points you at [`configure`](#configure), the right
 tool for changing settings in place. Existing files are never overwritten
-without asking. During a remote setup, init offers to run
-[`get-sync-token`](#get-sync-token) for you when Docker is available.
+without asking. During a remote setup, init offers to generate your
+[Obsidian Sync token](#get-sync-token) as part of the flow.
 
 Flags:
 
@@ -194,17 +194,15 @@ remote setups — without leaving the CLI:
 npx vault-cortex@latest get-sync-token
 ```
 
-The command opens the Obsidian login inside Docker. Once you've signed in, it
-captures your token and prints it — nothing to dig out of the login output.
-Use `--dir <path>` to write the token straight into an existing `.env`
-instead:
+The command prompts for your Obsidian account email, password, and MFA code
+(if enabled), signs in via the Obsidian API, and prints the token. Use
+`--dir <path>` to write the token straight into an existing `.env` instead:
 
 ```bash
 npx vault-cortex@latest get-sync-token --dir ./vault-cortex
 ```
 
-During `init --mode remote`, this flow is offered automatically when Docker
-is available.
+During `init --mode remote`, this flow is offered automatically.
 
 ## Requirements
 

cli/src/__tests__/command-stubs.ts

@@ -174,7 +174,6 @@ export const dockerReady: DockerRunner = {
   stopAndRemoveContainer: () => true,
   containerExists: () => true,
   streamLogs: async () => 0,
-  runObsidianLogin: () => false,
 }
 
 /** Daemon installed but not running — every operation fails. */
@@ -185,7 +184,6 @@ export const dockerDown: DockerRunner = {
   stopAndRemoveContainer: () => false,
   containerExists: () => false,
   streamLogs: async () => 1,
-  runObsidianLogin: () => false,
 }
 
 /** Docker binary absent entirely — every operation fails. */

cli/src/__tests__/docker.test.ts

@@ -3,7 +3,6 @@ import { describe, expect, it } from "vitest"
 import {
   buildDockerLogsArgs,
   buildDockerRunArgs,
-  buildObsidianLoginArgs,
   classifyDaemonStatus,
   CONTAINER_NAME,
   healthPollTimeoutMs,
@@ -193,71 +192,6 @@ describe("buildDockerRunArgs", () => {
   })
 })
 
-describe("buildObsidianLoginArgs", () => {
-  it("produces the correct args on macOS (no --user flag)", () => {
-    const args = buildObsidianLoginArgs({
-      configMountPath: "/tmp/vault-cortex-sync-token-abc",
-      platform: "darwin",
-      uid: 501,
-      gid: 20,
-    })
-
-    expect(args).toEqual([
-      "run",
-      "--rm",
-      "-it",
-      "--entrypoint",
-      "ob",
-      "-v",
-      "/tmp/vault-cortex-sync-token-abc:/home/obsidian/.config",
-      REMOTE_IMAGE,
-      "login",
-    ])
-  })
-
-  it("includes --user uid:gid on Linux", () => {
-    const args = buildObsidianLoginArgs({
-      configMountPath: "/tmp/vault-cortex-sync-token-abc",
-      platform: "linux",
-      uid: 1000,
-      gid: 1000,
-    })
-
-    expect(args).toEqual([
-      "run",
-      "--rm",
-      "-it",
-      "--entrypoint",
-      "ob",
-      "-v",
-      "/tmp/vault-cortex-sync-token-abc:/home/obsidian/.config",
-      "--user",
-      "1000:1000",
-      REMOTE_IMAGE,
-      "login",
-    ])
-  })
-
-  it("omits --user on Linux when uid/gid are not provided", () => {
-    const args = buildObsidianLoginArgs({
-      configMountPath: "/tmp/test",
-      platform: "linux",
-    })
-
-    expect(args).toEqual([
-      "run",
-      "--rm",
-      "-it",
-      "--entrypoint",
-      "ob",
-      "-v",
-      "/tmp/test:/home/obsidian/.config",
-      REMOTE_IMAGE,
-      "login",
-    ])
-  })
-})
-
 describe("healthPollTimeoutMs", () => {
   it("gives remote mode a 4-minute budget for the first-sync gate", () => {
     expect(healthPollTimeoutMs("remote")).toBe(240_000)