@aliyunrds/ctxdb 1.0.8-beta.1 → 1.0.8-beta.3

package/README.md

@@ -11,7 +11,7 @@ Unified access layer for RDS ContextDatabase. One `ctxdb` CLI (memory + KB ops),
 | **claude** | ✅ UserPromptSubmit + Stop + SessionStart | `~/.claude/skills/ctxdb/` | hooks-driven (auto capture/recall) |
 | **opencode** | Plugin shim (`~/.config/opencode/plugins/ctxdb.ts`) | `~/.config/opencode/skills/` | in-process plugin (auto capture/recall + KB catalog injection) |
 | **hermes** | ✅ `pre_llm_call` + `post_llm_call` | `~/.hermes/skills/` | shell hooks (auto capture/recall + first-turn warmup) |
-| **workbuddy** | ✅ UserPromptSubmit + Stop + SessionStart | `~/.workbuddy/skills/ctxdb/` | hooks-driven (auto capture/recall); Claude-Code-isomorphic (exec form) |
+| **workbuddy** | ✅ UserPromptSubmit + Stop + SessionStart | `~/.workbuddy-ai/skills/ctxdb/` | hooks-driven (auto capture/recall); Claude-Code-isomorphic (exec form) |
 
 Config and logs live under `~/.ctxdb/`. `~/.ctxdb/ctxdb.json` is one file, but runtime config is isolated per agent under `agents.qoder`, `agents.qoderwork`, `agents.qwenwork`, `agents.codex`, `agents.claude`, `agents.opencode`, `agents.hermes`, and `agents.workbuddy`. (Pre-2026-05-23 installs used `~/.ctxdb.json` at the home root; running `ctxdb setup --agent <name>` migrates the file into the selected agent section.)
 
@@ -31,12 +31,14 @@ Internal login stores its single active connection in owner-only
 without writing an `api_key` field into the Agent or default profile; an
 existing field in either updated profile is removed. At runtime this managed
 credential overrides the API key and DATA URL in the existing v2
-`~/.ctxdb/ctxdb.json`; `CTXDB_API_KEY` and `CTXDB_BASE_URL` remain the highest
-priority overrides. Re-login replaces the active connection and revokes the
-previous key after setup succeeds. The public `@aliyunrds/ctxdb` build does not
-contain or advertise these commands and continues to use `ctxdb setup` and the
-v2 config exactly as before. Build the internal staging package with
-`pnpm build:internal`.
+`~/.ctxdb/ctxdb.json`; `CTXDB_ACCESS_TOKEN`, `CTXDB_API_KEY`, and
+`CTXDB_BASE_URL` remain higher-priority overrides. `ctxdb login` rejects all
+three while `ctxdb logout` rejects the two credential overrides, so command
+output cannot disagree with subsequent DATA requests. Re-login replaces the
+active connection and revokes the previous key after setup succeeds. The
+public `@aliyunrds/ctxdb` build does not contain or advertise these commands and
+continues to use `ctxdb setup` and the v2 config exactly as before. Build the
+internal staging package with `pnpm build:internal`.
 
 The distinction is a compile-time distribution manifest, not a runtime
 environment-variable or file-existence check. The `public` manifest disables
@@ -210,7 +212,7 @@ ctxdb setup --agent codex --api-key 'ctxdb-new-...'
 ctxdb status --agent codex --json
 ```
 
-Setup first checks that the target agent home exists (`~/.qoder`, `~/.qoderwork`, `~/.qwenwork`, `~/.codex`, `~/.claude`, or `~/.workbuddy`; the declared CN variant home also satisfies this check). Setup writes hooks and skills only into homes that already exist, so a CN-only install does not create the international product home, and vice versa. If no home exists, install or start that agent once before running `ctxdb setup --agent <name>`. OpenCode and Hermes are config-dir style: setup creates `~/.config/opencode` / `~/.hermes` when they are missing.
+Setup first checks that the target agent home exists (`~/.qoder`, `~/.qoderwork`, `~/.qwenwork`, `~/.codex`, `~/.claude`, or `~/.workbuddy-ai`; the declared CN variant home also satisfies this check). Setup writes hooks and skills only into homes that already exist, so a CN-only install does not create the international product home, and vice versa. If no home exists, install or start that agent once before running `ctxdb setup --agent <name>`. OpenCode and Hermes are config-dir style: setup creates `~/.config/opencode` / `~/.hermes` when they are missing.
 
 For **qoder**, **qoderwork**, **qwenwork**, **codex**, **claude**, and **workbuddy**, restart the harness (CLI: just exit + restart; app: Cmd+R or quit/relaunch) so it picks up the new hooks/skill. For **codex**, setup also writes `[features].hooks = true` into `~/.codex/config.toml` (creating the file if missing) — Codex won't fire any hook entries without it. On first use Codex may prompt you to trust the new hook commands. For **opencode**, restart OpenCode so it loads `~/.config/opencode/plugins/ctxdb.ts`. For **hermes**, setup also checks `~/.hermes/shell-hooks-allowlist.json`; it reports setup as incomplete until both ctxdb hook commands are approved.
 
@@ -603,7 +605,9 @@ Field reference:
 | `knowledge_top_k` | int | `6` | KB chunks pulled per recall (only effective when `recall_knowledge: true`) |
 | `debug` | bool | `false` | Configured preference for verbose hook logging and full recall tracing. Effective debug is forced on for every final `base_url` outside the exact official-production allowlist; see “Debug control and recall replay”. General logs go to `~/.ctxdb/logs/ctxdb.log`, structured full-content recall records to `~/.ctxdb/logs/recall-trace.jsonl` |
 
-Env-var overrides apply to the selected agent config (env wins): `CTXDB_AGENT` / `CTXDB_API_KEY` / `CTXDB_BASE_URL` / `CTXDB_USER_ID` / `CTXDB_AGENT_ID` / `CTXDB_APP_ID`. The internal login command additionally reads `CTXDB_LOGIN_SERVER` as its provider-neutral login endpoint. The last two default to unset — the request body omits `agent_id`/`app_id` entirely; set them only when you want per-agent / per-app scope isolation on the server.
+Env-var overrides apply to the selected agent config (env wins): `CTXDB_AGENT` / `CTXDB_ACCESS_TOKEN` / `CTXDB_API_KEY` / `CTXDB_BASE_URL` / `CTXDB_USER_ID` / `CTXDB_AGENT_ID` / `CTXDB_APP_ID`. The internal login command additionally reads `CTXDB_LOGIN_SERVER` as its provider-neutral login endpoint. The last two default to unset — the request body omits `agent_id`/`app_id` entirely; set them only when you want per-agent / per-app scope isolation on the server.
+
+Downstream Agent hosts can set `CTXDB_ACCESS_TOKEN` to send `Authorization: Bearer <token>` to the Data API. It is runtime-only, never written to `~/.ctxdb/ctxdb.json`, and takes precedence over an API key for CLI, process hooks, and the in-process OpenCode plugin; a rejected token does not fall back to the API key. `ctxdb setup` remains API-key-only and never persists or validates an access token.
 
 Hook/plugin escape hatch: set `CTXDB_SKIP_HOOKS=TRUE` on the agent process to make all ctxdb hook entrypoints exit immediately before reading config or calling the API. Direct `ctxdb memory` / `ctxdb kb` / `ctxdb setup` CLI commands are unchanged.
 
@@ -664,7 +668,7 @@ ctxdb uninstall --purge-logs     # also deletes ~/.ctxdb/logs/
 
 ### What uninstall does (and doesn't) touch
 
-- **Hook entries in `~/.qoder/settings.json`, `~/.qoderwork/settings.json`, `~/.qwenwork/settings.json`, `~/.codex/hooks.json`, `~/.claude/settings.json`, `~/.workbuddy/settings.json`, and `~/.hermes/config.yaml`**: stripped precisely by marker (`_ctxdb = @aliyunrds/ctxdb`, plus legacy keys `_ctxdbQoder` / `_ctxdbPackage` and the legacy `@aliyunrds/ctxdb-qoder` value for installs predating the unified marker). Any hooks you added yourself stay. A timestamped `*.bak-ctxdb-<TS>` is written before each modification (rotation keeps the 5 most recent).
+- **Hook entries in `~/.qoder/settings.json`, `~/.qoderwork/settings.json`, `~/.qwenwork/settings.json`, `~/.codex/hooks.json`, `~/.claude/settings.json`, `~/.workbuddy-ai/settings.json`, and `~/.hermes/config.yaml`**: stripped precisely by marker (`_ctxdb = @aliyunrds/ctxdb`, plus legacy keys `_ctxdbQoder` / `_ctxdbPackage` and the legacy `@aliyunrds/ctxdb-qoder` value for installs predating the unified marker). Any hooks you added yourself stay. A timestamped `*.bak-ctxdb-<TS>` is written before each modification (rotation keeps the 5 most recent).
 - **Skill directories**: `~/.<agent>/skills/ctxdb/` for each set-up agent, plus legacy dirs (`ctxdb-qoder`, `rds-ctxdb-qoder`, `qoder-ctxdb`) under `~/.qoder/skills/` from older package names.
 - **`~/.ctxdb/` state**: only with `--purge-config` / `--purge-logs` / `--purge-all`. Defensive: `--purge-all` removes the `~/.ctxdb/` root only if it's empty after the named files are deleted (won't blanket-rm an unknown directory).
 - **`~/.codex/config.toml` `[features].hooks`**: **NOT** reverted. Setup adds `hooks = true` so Codex will fire ctxdb's hook entries; uninstall leaves the flag alone because (a) the user may have wanted it on for non-ctxdb hooks, and (b) it's harmless when `~/.codex/hooks.json` is empty. If you want it off, edit the file by hand.

package/dist/{chunk-NFAPLK4C.js → chunk-3NJ37TEY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CtxdbError
-} from "./chunk-KYW76CL7.js";
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/kb.ts
 import {

package/dist/{chunk-NF5KFV2P.js → chunk-7OX6UVPB.js}

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
+import {
+  listKnowledgeBases
+} from "./chunk-3NJ37TEY.js";
 import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-3B7J5VUT.js";
-import {
-  listKnowledgeBases
-} from "./chunk-NFAPLK4C.js";
+} from "./chunk-EI63DQX3.js";
 import {
-  CtxdbError
-} from "./chunk-KYW76CL7.js";
+  CtxdbError,
+  isDataApiReady,
+  resolveDataApiCredential
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/kb-catalog.ts
 function sanitizeKeyEntities(raw) {
@@ -152,12 +154,13 @@ async function recallTurn(prompt, cfg, client, agentOrOptions = "default") {
   const options = typeof agentOrOptions === "string" ? { agent: agentOrOptions } : agentOrOptions;
   const agent = options.agent ?? "default";
   if (!prompt.trim()) return { ...EMPTY, reason: "empty_prompt" };
-  if (!cfg.apiKey || !cfg.baseUrl) {
+  if (!isDataApiReady(cfg)) {
     return { ...EMPTY, reason: "config_incomplete" };
   }
   if (!cfg.autoRecall) {
     return { ...EMPTY, reason: "auto_recall_disabled" };
   }
+  const credential = resolveDataApiCredential(cfg);
   const query = stripSystemReminders(prompt);
   const trace = cfg.debug ? {
     agent,
@@ -175,7 +178,11 @@ async function recallTurn(prompt, cfg, client, agentOrOptions = "default") {
     },
     store: {
       ...options.traceStore,
-      secrets: [...options.traceStore?.secrets ?? [], cfg.apiKey]
+      secrets: [
+        ...options.traceStore?.secrets ?? [],
+        cfg.apiKey,
+        credential.value
+      ]
     }
   } : null;
   if (trace) {

package/dist/{chunk-LTAO6USK.js → chunk-AUBVVYQL.js}

@@ -2,7 +2,7 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-NF5KFV2P.js";
+} from "./chunk-7OX6UVPB.js";
 
 // src/lib/user-prompt-submit-compose.ts
 async function composeUserPromptSubmit(cfg, agent, client, prompt, sessionId = null) {