Fix entrypoint shell splitting and mcp-serve arg mismatch

Quote all env var expansions to handle special characters in connection
strings and credentials. Only pass --db to mcp-serve (it doesn't accept
--connection, --username, --password, or --port).

Author: nicosuave

docker-entrypoint.sh

@@ -4,40 +4,46 @@ set -e
 # SIDEMANTIC_MODE: "serve" (default), "mcp", or "both"
 MODE="${SIDEMANTIC_MODE:-serve}"
 
-# Build shared args from environment variables
-ARGS=""
+# Build arg arrays for each command.
+# serve accepts: --connection, --db, --host, --port, --username, --password
+# mcp-serve accepts: --db only
+
+# Serve args
+SERVE_ARGS="--host 0.0.0.0"
 if [ -n "$SIDEMANTIC_CONNECTION" ]; then
-    ARGS="$ARGS --connection $SIDEMANTIC_CONNECTION"
+    SERVE_ARGS="$SERVE_ARGS --connection \"$SIDEMANTIC_CONNECTION\""
 fi
 if [ -n "$SIDEMANTIC_DB" ]; then
-    ARGS="$ARGS --db $SIDEMANTIC_DB"
+    SERVE_ARGS="$SERVE_ARGS --db \"$SIDEMANTIC_DB\""
 fi
-
-# Serve-specific args
-SERVE_ARGS=""
 if [ -n "$SIDEMANTIC_USERNAME" ]; then
-    SERVE_ARGS="$SERVE_ARGS --username $SIDEMANTIC_USERNAME"
+    SERVE_ARGS="$SERVE_ARGS --username \"$SIDEMANTIC_USERNAME\""
 fi
 if [ -n "$SIDEMANTIC_PASSWORD" ]; then
-    SERVE_ARGS="$SERVE_ARGS --password $SIDEMANTIC_PASSWORD"
+    SERVE_ARGS="$SERVE_ARGS --password \"$SIDEMANTIC_PASSWORD\""
 fi
 if [ -n "$SIDEMANTIC_PORT" ]; then
-    SERVE_ARGS="$SERVE_ARGS --port $SIDEMANTIC_PORT"
+    SERVE_ARGS="$SERVE_ARGS --port \"$SIDEMANTIC_PORT\""
+fi
+
+# MCP args (only --db is supported)
+MCP_ARGS=""
+if [ -n "$SIDEMANTIC_DB" ]; then
+    MCP_ARGS="$MCP_ARGS --db \"$SIDEMANTIC_DB\""
 fi
 
 case "$MODE" in
     serve)
-        exec sidemantic serve --host 0.0.0.0 $ARGS $SERVE_ARGS "$@"
+        eval exec sidemantic serve $SERVE_ARGS "$@"
         ;;
     mcp)
-        exec sidemantic mcp-serve $ARGS "$@"
+        eval exec sidemantic mcp-serve $MCP_ARGS "$@"
         ;;
     both)
-        # Start PG server in background, MCP on stdio in foreground
-        sidemantic serve --host 0.0.0.0 $ARGS $SERVE_ARGS &
+        eval sidemantic serve $SERVE_ARGS &
         SERVE_PID=$!
         trap "kill $SERVE_PID 2>/dev/null" EXIT
-        exec sidemantic mcp-serve $ARGS "$@"
+        eval exec sidemantic mcp-serve $MCP_ARGS "$@"
         ;;
     *)
         echo "Unknown SIDEMANTIC_MODE: $MODE (use serve, mcp, or both)" >&2