Fix: Use JSON config files for ESM compatibility

- Replace @simpleworkjs/conf with simple custom loader
- Use JSON config files (base, development, production, secrets)
- Add config.js with ESM-compatible deep merge
- Support env var overrides for critical settings
- Auth disabled in dev mode via development.json

server/config.js

@@ -0,0 +1,75 @@
+/**
+ * Simple ESM-compatible configuration loader
+ * Loads JSON files: base.json -> environment.json -> secrets.json
+ */
+
+import { readFileSync, existsSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+function deepMerge(target, source) {
+  const result = { ...target };
+  for (const key of Object.keys(source)) {
+    if (source[key] && typeof source[key] === 'object' && !Array.isArray(source[key])) {
+      result[key] = deepMerge(result[key] || {}, source[key]);
+    } else {
+      result[key] = source[key];
+    }
+  }
+  return result;
+}
+
+function loadJsonFile(filename) {
+  const path = join(__dirname, '..', 'conf', filename);
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, 'utf-8'));
+  } catch (err) {
+    console.warn(`Warning: Failed to load ${filename}:`, err.message);
+    return {};
+  }
+}
+
+// Load configuration
+const environment = process.env.NODE_ENV || 'development';
+
+const base = loadJsonFile('base.json');
+const envConfig = loadJsonFile(`${environment}.json`);
+const secrets = loadJsonFile('secrets.json');
+
+// Merge all configs
+const config = deepMerge(deepMerge(base, envConfig), secrets);
+
+// Add environment info
+config.environment = environment;
+
+// Allow env var overrides for critical settings
+if (process.env.PORT) {
+  config.server = config.server || {};
+  config.server.port = parseInt(process.env.PORT);
+}
+
+if (process.env.OPENCLAW_GATEWAY) {
+  config.gateway = config.gateway || {};
+  config.gateway.url = process.env.OPENCLAW_GATEWAY;
+}
+
+if (process.env.OPENCLAW_TOKEN) {
+  config.gateway = config.gateway || {};
+  config.gateway.token = process.env.OPENCLAW_TOKEN;
+}
+
+if (process.env.SESSION_SECRET) {
+  config.session = config.session || {};
+  config.session.secret = process.env.SESSION_SECRET;
+}
+
+if (process.env.LDAP_ENABLED === 'true') {
+  config.auth = config.auth || {};
+  config.auth.ldap = config.auth.ldap || {};
+  config.auth.ldap.enabled = true;
+}
+
+export default config;

server/index.js

@@ -18,11 +18,11 @@ import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import ldap from 'ldapjs';
 import { v4 as uuidv4 } from 'uuid';
-import conf from '@simpleworkjs/conf';
+import conf from './config.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// Configuration via @simpleworkjs/conf
+// Configuration
 const CONFIG = {
   port: conf.server?.port || 3000,
   gatewayUrl: conf.gateway?.url || 'http://127.0.0.1:18789',
@@ -38,7 +38,8 @@ const CONFIG = {
     bindPassword: conf.auth?.ldap?.bindPassword || '',
     searchFilter: conf.auth?.ldap?.searchFilter || '(uid={{username}})'
   },
-  dataDir: conf.data?.dir || join(__dirname, '../data')
+  dataDir: conf.data?.dir || join(__dirname, '../data'),
+  environment: conf.environment
 };
 
 // Ensure data directory exists