@aliyunrds/ctxdb 1.0.8-beta.2 → 1.0.8-beta.3

package/README.md

@@ -31,12 +31,14 @@ Internal login stores its single active connection in owner-only
 without writing an `api_key` field into the Agent or default profile; an
 existing field in either updated profile is removed. At runtime this managed
 credential overrides the API key and DATA URL in the existing v2
-`~/.ctxdb/ctxdb.json`; `CTXDB_API_KEY` and `CTXDB_BASE_URL` remain the highest
-priority overrides. Re-login replaces the active connection and revokes the
-previous key after setup succeeds. The public `@aliyunrds/ctxdb` build does not
-contain or advertise these commands and continues to use `ctxdb setup` and the
-v2 config exactly as before. Build the internal staging package with
-`pnpm build:internal`.
+`~/.ctxdb/ctxdb.json`; `CTXDB_ACCESS_TOKEN`, `CTXDB_API_KEY`, and
+`CTXDB_BASE_URL` remain higher-priority overrides. `ctxdb login` rejects all
+three while `ctxdb logout` rejects the two credential overrides, so command
+output cannot disagree with subsequent DATA requests. Re-login replaces the
+active connection and revokes the previous key after setup succeeds. The
+public `@aliyunrds/ctxdb` build does not contain or advertise these commands and
+continues to use `ctxdb setup` and the v2 config exactly as before. Build the
+internal staging package with `pnpm build:internal`.
 
 The distinction is a compile-time distribution manifest, not a runtime
 environment-variable or file-existence check. The `public` manifest disables
@@ -603,7 +605,9 @@ Field reference:
 | `knowledge_top_k` | int | `6` | KB chunks pulled per recall (only effective when `recall_knowledge: true`) |
 | `debug` | bool | `false` | Configured preference for verbose hook logging and full recall tracing. Effective debug is forced on for every final `base_url` outside the exact official-production allowlist; see “Debug control and recall replay”. General logs go to `~/.ctxdb/logs/ctxdb.log`, structured full-content recall records to `~/.ctxdb/logs/recall-trace.jsonl` |
 
-Env-var overrides apply to the selected agent config (env wins): `CTXDB_AGENT` / `CTXDB_API_KEY` / `CTXDB_BASE_URL` / `CTXDB_USER_ID` / `CTXDB_AGENT_ID` / `CTXDB_APP_ID`. The internal login command additionally reads `CTXDB_LOGIN_SERVER` as its provider-neutral login endpoint. The last two default to unset — the request body omits `agent_id`/`app_id` entirely; set them only when you want per-agent / per-app scope isolation on the server.
+Env-var overrides apply to the selected agent config (env wins): `CTXDB_AGENT` / `CTXDB_ACCESS_TOKEN` / `CTXDB_API_KEY` / `CTXDB_BASE_URL` / `CTXDB_USER_ID` / `CTXDB_AGENT_ID` / `CTXDB_APP_ID`. The internal login command additionally reads `CTXDB_LOGIN_SERVER` as its provider-neutral login endpoint. The last two default to unset — the request body omits `agent_id`/`app_id` entirely; set them only when you want per-agent / per-app scope isolation on the server.
+
+Downstream Agent hosts can set `CTXDB_ACCESS_TOKEN` to send `Authorization: Bearer <token>` to the Data API. It is runtime-only, never written to `~/.ctxdb/ctxdb.json`, and takes precedence over an API key for CLI, process hooks, and the in-process OpenCode plugin; a rejected token does not fall back to the API key. `ctxdb setup` remains API-key-only and never persists or validates an access token.
 
 Hook/plugin escape hatch: set `CTXDB_SKIP_HOOKS=TRUE` on the agent process to make all ctxdb hook entrypoints exit immediately before reading config or calling the API. Direct `ctxdb memory` / `ctxdb kb` / `ctxdb setup` CLI commands are unchanged.
 

package/dist/{chunk-CULTDVI2.js → chunk-3NJ37TEY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CtxdbError
-} from "./chunk-DMS5YHIK.js";
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/kb.ts
 import {

package/dist/{chunk-H33NUAHP.js → chunk-7OX6UVPB.js}

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
 import {
   listKnowledgeBases
-} from "./chunk-CULTDVI2.js";
+} from "./chunk-3NJ37TEY.js";
 import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-X75B57M2.js";
+} from "./chunk-EI63DQX3.js";
 import {
-  CtxdbError
-} from "./chunk-DMS5YHIK.js";
+  CtxdbError,
+  isDataApiReady,
+  resolveDataApiCredential
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/kb-catalog.ts
 function sanitizeKeyEntities(raw) {
@@ -152,12 +154,13 @@ async function recallTurn(prompt, cfg, client, agentOrOptions = "default") {
   const options = typeof agentOrOptions === "string" ? { agent: agentOrOptions } : agentOrOptions;
   const agent = options.agent ?? "default";
   if (!prompt.trim()) return { ...EMPTY, reason: "empty_prompt" };
-  if (!cfg.apiKey || !cfg.baseUrl) {
+  if (!isDataApiReady(cfg)) {
     return { ...EMPTY, reason: "config_incomplete" };
   }
   if (!cfg.autoRecall) {
     return { ...EMPTY, reason: "auto_recall_disabled" };
   }
+  const credential = resolveDataApiCredential(cfg);
   const query = stripSystemReminders(prompt);
   const trace = cfg.debug ? {
     agent,
@@ -175,7 +178,11 @@ async function recallTurn(prompt, cfg, client, agentOrOptions = "default") {
     },
     store: {
       ...options.traceStore,
-      secrets: [...options.traceStore?.secrets ?? [], cfg.apiKey]
+      secrets: [
+        ...options.traceStore?.secrets ?? [],
+        cfg.apiKey,
+        credential.value
+      ]
     }
   } : null;
   if (trace) {

package/dist/{chunk-4FCZ2TZM.js → chunk-AUBVVYQL.js}

@@ -2,7 +2,7 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-H33NUAHP.js";
+} from "./chunk-7OX6UVPB.js";
 
 // src/lib/user-prompt-submit-compose.ts
 async function composeUserPromptSubmit(cfg, agent, client, prompt, sessionId = null) {

package/dist/{chunk-DMS5YHIK.js → chunk-BUK4SZC2.js}

@@ -3,6 +3,19 @@ import {
   DISTRIBUTION_MANIFEST
 } from "./chunk-R67JELM7.js";
 
+// src/lib/credentials.ts
+function apiKeyCredential(apiKey) {
+  return { type: "api-key", value: apiKey };
+}
+function resolveDataApiCredential(cfg, env = process.env) {
+  const accessToken = env.CTXDB_ACCESS_TOKEN?.trim();
+  if (accessToken) return { type: "access-token", value: accessToken };
+  return cfg.apiKey ? apiKeyCredential(cfg.apiKey) : null;
+}
+function isDataApiReady(cfg, env = process.env) {
+  return Boolean(cfg.baseUrl && resolveDataApiCredential(cfg, env));
+}
+
 // src/lib/logger.ts
 import { appendFileSync, mkdirSync } from "fs";
 import { homedir } from "os";
@@ -82,7 +95,7 @@ var AuthError = class extends CtxdbError {
   errorMessage;
   data;
   responseBody;
-  constructor(message = "Unauthorized (HTTP 401) \u2014 check api_key", fields = {}) {
+  constructor(message = "Unauthorized (HTTP 401) \u2014 check Data API credential", fields = {}) {
     super(message);
     this.name = "AuthError";
     this.errorCode = fields.errorCode;
@@ -147,6 +160,7 @@ var CtxdbHttpError = class extends CtxdbError {
 };
 var HttpClient = class {
   baseUrl;
+  credential;
   apiKey;
   timeoutMs;
   userAgent;
@@ -154,10 +168,12 @@ var HttpClient = class {
   fetchImpl;
   authorizationProvider;
   constructor(opts) {
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    if (!opts.apiKey && !opts.authorizationProvider) {
-      throw new Error("HttpClient requires apiKey or authorizationProvider");
+    const credential = opts.credential ?? (opts.apiKey ? apiKeyCredential(opts.apiKey) : null);
+    if (!credential && !opts.authorizationProvider) {
+      throw new CtxdbError("DATA API credential is required");
     }
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.credential = credential;
     this.apiKey = opts.apiKey ?? "";
     this.authorizationProvider = opts.authorizationProvider;
     this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
@@ -178,12 +194,19 @@ var HttpClient = class {
     return h;
   }
   async doRequest(method, path, init = {}) {
-    const authorization = this.authorizationProvider ? await this.authorizationProvider.resolve() : {
-      scheme: "Token",
-      value: this.apiKey,
-      baseUrl: this.baseUrl,
-      expiresAt: null
-    };
+    let authorization;
+    if (this.authorizationProvider) {
+      authorization = await this.authorizationProvider.resolve();
+    } else {
+      const credential = this.credential;
+      if (!credential) throw new CtxdbError("DATA API credential is required");
+      authorization = {
+        scheme: credential.type === "access-token" ? "Bearer" : "Token",
+        value: credential.value,
+        baseUrl: this.baseUrl,
+        expiresAt: null
+      };
+    }
     let url = `${authorization.baseUrl.replace(/\/+$/, "")}${path}`;
     if (init.params) {
       const qs = new URLSearchParams();
@@ -816,9 +839,6 @@ var DEFAULT_TOP_K = 5;
 var DEFAULT_THRESHOLD = 0.4;
 var DEFAULT_KNOWLEDGE_TOP_K = 6;
 var DEFAULT_KB_CATALOG_INJECTION = "session_start";
-function isComplete(cfg) {
-  return Boolean(cfg.apiKey && cfg.baseUrl);
-}
 function resolveConfigAgent(options = {}, preloadedRaw) {
   if (isAgentSlug(options.agent)) return options.agent;
   return agentFromEnv(options.env);
@@ -1061,6 +1081,9 @@ function writeInstalledPkgVersion(version, path) {
 }
 
 export {
+  apiKeyCredential,
+  resolveDataApiCredential,
+  isDataApiReady,
   setDebug,
   isDebug,
   debug,
@@ -1083,7 +1106,6 @@ export {
   configDir,
   DEFAULT_BASE_URL,
   DEFAULT_USER_ID,
-  isComplete,
   load,
   removeAgent,
   save,

package/dist/{chunk-X75B57M2.js → chunk-EI63DQX3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   configDir
-} from "./chunk-DMS5YHIK.js";
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/circuit.ts
 import { statSync, writeFileSync, unlinkSync, mkdirSync, readdirSync, readFileSync } from "fs";

package/dist/{chunk-5ZSZMN2T.js → chunk-LZ2LOWZL.js}

@@ -2,10 +2,10 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-H33NUAHP.js";
+} from "./chunk-7OX6UVPB.js";
 import {
   debug
-} from "./chunk-DMS5YHIK.js";
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/warmup-recall.ts
 import { execSync } from "child_process";

package/dist/{chunk-LYHGJOHM.js → chunk-ZFS6OMWE.js}

@@ -4,12 +4,13 @@ import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-X75B57M2.js";
+} from "./chunk-EI63DQX3.js";
 import {
   CtxdbError,
   debug,
+  isDataApiReady,
   isDebug
-} from "./chunk-DMS5YHIK.js";
+} from "./chunk-BUK4SZC2.js";
 
 // src/lib/capture-orchestrator.ts
 import {
@@ -398,7 +399,7 @@ async function captureParsedMessages(parsed, cfg, client, agent = "default", ses
   };
 }
 function capturePreflight(cfg, agent) {
-  if (!cfg.apiKey || !cfg.baseUrl) {
+  if (!isDataApiReady(cfg)) {
     return { captured: false, reason: "config_incomplete", messageCount: 0 };
   }
   if (!cfg.autoCapture) {

package/dist/cli/main.js

@@ -16,7 +16,7 @@ import {
   uploadFile,
   uploadText,
   validateLocalFile
-} from "../chunk-CULTDVI2.js";
+} from "../chunk-3NJ37TEY.js";
 import {
   AGENT_CHOICES,
   CtxdbError,
@@ -31,19 +31,20 @@ import {
   agentHomeDir,
   agentHomeDirs,
   agentPlatformSupport,
+  apiKeyCredential,
   configuredAgents,
   detectInstalledAgents,
   hasConfiguredAgent,
   inspectAgentHomes,
   isAgentSlug,
   isBuiltinAgent,
-  isComplete,
   load,
   removeAgent,
+  resolveDataApiCredential,
   save,
   updateConfiguredDebug,
   writeInstalledPkgVersion
-} from "../chunk-DMS5YHIK.js";
+} from "../chunk-BUK4SZC2.js";
 import {
   beginUpdateNotification,
   completeUpdateNotification,
@@ -275,6 +276,8 @@ function formatStatusResult(r) {
     ["base_url", r.base_url],
     ["user_id", r.user_id],
     ["api_key", r.api_key_set ? "set" : "not set"],
+    ["access_token", r.access_token_set ? "set" : "not set"],
+    ["credential_type", r.credential_type ?? "none"],
     ["auto_capture", r.auto_capture],
     ["auto_recall", r.auto_recall],
     ["top_k", r.top_k],
@@ -323,15 +326,16 @@ function agentFromFlags(flags) {
 function buildContext(args) {
   const agent = agentFromFlags(args?.flags ?? {});
   const cfg = load({ agent });
-  if (!isComplete(cfg)) {
-    const hint = agent === "default" ? "run `ctxdb setup --api-key=<key> --base-url=<url>` or set CTXDB_API_KEY / CTXDB_BASE_URL env vars" : `run \`ctxdb setup --agent ${agent}\` or set CTXDB_API_KEY / CTXDB_BASE_URL / CTXDB_USER_ID env vars`;
+  const credential = resolveDataApiCredential(cfg);
+  if (!cfg.baseUrl || !credential) {
+    const hint = agent === "default" ? "run `ctxdb setup --api-key=<key> --base-url=<url>` or set CTXDB_ACCESS_TOKEN / CTXDB_API_KEY / CTXDB_BASE_URL env vars" : `run \`ctxdb setup --agent ${agent}\` or set CTXDB_ACCESS_TOKEN / CTXDB_API_KEY / CTXDB_BASE_URL / CTXDB_USER_ID env vars`;
     process.stderr.write(`config incomplete for agent ${agent}: ${hint}
 `);
     process.exit(2);
   }
   const client = new HttpClient({
     baseUrl: cfg.baseUrl,
-    apiKey: cfg.apiKey
+    credential
   });
   return { cfg, client, agent };
 }
@@ -724,7 +728,10 @@ async function runSetup(options) {
       });
     } else {
       try {
-        const client = new HttpClient({ baseUrl: cfg.baseUrl, apiKey: cfg.apiKey });
+        const client = new HttpClient({
+          baseUrl: cfg.baseUrl,
+          credential: apiKeyCredential(cfg.apiKey)
+        });
         await client.get("/v1/ping/");
         steps.push({ step: "validate-ping", ok: true });
       } catch (err) {
@@ -2090,12 +2097,13 @@ FLAGS
 `;
 async function inspectStatus(agent) {
   const cfg = load({ agent });
-  const complete = isComplete(cfg);
+  const credential = resolveDataApiCredential(cfg);
+  const complete = Boolean(cfg.baseUrl && credential);
   let connected = false;
   let pingError = null;
-  if (complete) {
+  if (complete && credential) {
     try {
-      const client = new HttpClient({ baseUrl: cfg.baseUrl, apiKey: cfg.apiKey });
+      const client = new HttpClient({ baseUrl: cfg.baseUrl, credential });
       await client.get("/v1/ping/");
       connected = true;
     } catch (err) {
@@ -2110,6 +2118,8 @@ async function inspectStatus(agent) {
       base_url: cfg.baseUrl,
       user_id: cfg.userId,
       api_key_set: Boolean(cfg.apiKey),
+      access_token_set: Boolean(process.env.CTXDB_ACCESS_TOKEN?.trim()),
+      credential_type: credential?.type ?? null,
       auto_capture: cfg.autoCapture,
       auto_recall: cfg.autoRecall,
       top_k: cfg.topK,
@@ -2192,12 +2202,13 @@ ${hint}
 async function ping(args) {
   const agent = agentFromFlags(args.flags);
   const cfg = load({ agent });
-  if (!isComplete(cfg)) {
+  const credential = resolveDataApiCredential(cfg);
+  if (!cfg.baseUrl || !credential) {
     fail(
-      `config incomplete for agent ${agent} \u2014 run \`ctxdb setup --agent ${agent}\` or set CTXDB_API_KEY / CTXDB_BASE_URL / CTXDB_USER_ID`
+      `config incomplete for agent ${agent} \u2014 run \`ctxdb setup --agent ${agent}\` or set CTXDB_ACCESS_TOKEN / CTXDB_API_KEY / CTXDB_BASE_URL / CTXDB_USER_ID`
     );
   }
-  const client = new HttpClient({ baseUrl: cfg.baseUrl, apiKey: cfg.apiKey });
+  const client = new HttpClient({ baseUrl: cfg.baseUrl, credential });
   const resp = await client.get("/v1/ping/");
   printResult(resp, !!args.flags.json);
   return 0;
@@ -4474,6 +4485,7 @@ AGENT RESOLUTION (when --agent is omitted):
 ENV VARS (override selected ~/.ctxdb/ctxdb.json agent config):
   CTXDB_AGENT  CTXDB_API_KEY  CTXDB_BASE_URL  CTXDB_USER_ID
   CTXDB_AGENT_ID  CTXDB_APP_ID
+  CTXDB_ACCESS_TOKEN  Runtime-only Data API Bearer credential; takes precedence over API key
 
 UPDATE CHECK ENV VARS:
   CTXDB_DISABLE_UPDATE_CHECK=1

package/dist/hooks/hermes-post-llm-call.js

@@ -1,15 +1,16 @@
 #!/usr/bin/env node
 import {
   captureParsedMessages
-} from "../chunk-LYHGJOHM.js";
-import "../chunk-X75B57M2.js";
+} from "../chunk-ZFS6OMWE.js";
+import "../chunk-EI63DQX3.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
   debug,
   load,
+  resolveDataApiCredential,
   setDebug
-} from "../chunk-DMS5YHIK.js";
+} from "../chunk-BUK4SZC2.js";
 import {
   shouldSkipHooks
 } from "../chunk-5ML4VSXN.js";
@@ -170,19 +171,20 @@ async function main() {
     }
     const input = extractHermesPostLlmCall(event);
     const cfg = load({ agent });
+    const credential = resolveDataApiCredential(cfg);
     setDebug(cfg.debug);
     debug("hermes.post_llm_call", "start", {
       sessionId: input.sessionId,
       messageCount: input.messages.length,
       userId: cfg.userId
     });
-    if (!cfg.apiKey || !cfg.baseUrl) {
+    if (!cfg.baseUrl || !credential) {
       debug("hermes.post_llm_call", "skip (config incomplete)");
       return 0;
     }
     const client = new HttpClient({
       baseUrl: cfg.baseUrl,
-      apiKey: cfg.apiKey,
+      credential,
       timeoutMs: 5e3
     });
     const result = await captureParsedMessages(

package/dist/hooks/hermes-pre-llm-call.js

@@ -2,25 +2,25 @@
 import {
   HOOK_TIMEOUT_MS,
   composeSessionStart
-} from "../chunk-5ZSZMN2T.js";
+} from "../chunk-LZ2LOWZL.js";
 import {
   composeUserPromptSubmit
-} from "../chunk-4FCZ2TZM.js";
+} from "../chunk-AUBVVYQL.js";
 import {
   fetchKbCatalogBlock
-} from "../chunk-H33NUAHP.js";
-import "../chunk-CULTDVI2.js";
+} from "../chunk-7OX6UVPB.js";
+import "../chunk-3NJ37TEY.js";
 import {
   isCircuitOpen
-} from "../chunk-X75B57M2.js";
+} from "../chunk-EI63DQX3.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
   debug,
-  isComplete,
   load,
+  resolveDataApiCredential,
   setDebug
-} from "../chunk-DMS5YHIK.js";
+} from "../chunk-BUK4SZC2.js";
 import {
   shouldSkipHooks
 } from "../chunk-5ML4VSXN.js";
@@ -109,6 +109,7 @@ async function main() {
     }
     const input = extractHermesPreLlmCall(event);
     const cfg = load({ agent });
+    const credential = resolveDataApiCredential(cfg);
     setDebug(cfg.debug);
     debug("hermes.pre_llm_call", "start", {
       prompt: input.prompt.slice(0, 200),
@@ -120,7 +121,7 @@ async function main() {
     const wantsRecall = cfg.autoRecall && Boolean(input.prompt.trim());
     const wantsSessionStart = input.isFirstTurn && Boolean(input.cwd) && (cfg.warmupRecall || cfg.kbCatalogInjection === "session_start");
     const wantsRepeatedSessionCatalog = cfg.kbCatalogInjection === "session_start";
-    if (!isComplete(cfg) || !wantsRecall && !wantsSessionStart && !wantsRepeatedSessionCatalog) {
+    if (!cfg.baseUrl || !credential || !wantsRecall && !wantsSessionStart && !wantsRepeatedSessionCatalog) {
       debug("hermes.pre_llm_call", "skip (config incomplete or no enabled injection)");
       return 0;
     }
@@ -132,7 +133,7 @@ async function main() {
     }
     const client = new HttpClient({
       baseUrl: cfg.baseUrl,
-      apiKey: cfg.apiKey,
+      credential,
       timeoutMs: HOOK_TIMEOUT_MS
     });
     const composed = await composeHermesPreLlmCall(cfg, agent, client, input);

package/dist/hooks/session-start.js

@@ -3,20 +3,20 @@ import {
   HOOK_TIMEOUT_MS,
   composeSessionStart,
   formatSessionStartStdout
-} from "../chunk-5ZSZMN2T.js";
-import "../chunk-H33NUAHP.js";
-import "../chunk-CULTDVI2.js";
+} from "../chunk-LZ2LOWZL.js";
+import "../chunk-7OX6UVPB.js";
+import "../chunk-3NJ37TEY.js";
 import {
   isCircuitOpen
-} from "../chunk-X75B57M2.js";
+} from "../chunk-EI63DQX3.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
   debug,
-  isComplete,
   load,
+  resolveDataApiCredential,
   setDebug
-} from "../chunk-DMS5YHIK.js";
+} from "../chunk-BUK4SZC2.js";
 import {
   shouldSkipHooks
 } from "../chunk-5ML4VSXN.js";
@@ -51,10 +51,11 @@ async function main() {
     const sessionId = typeof event.session_id === "string" ? event.session_id : typeof event.sessionId === "string" ? event.sessionId : null;
     if (!cwd) return 0;
     const cfg = load({ agent });
+    const credential = resolveDataApiCredential(cfg);
     setDebug(cfg.debug);
     debug("warmup", "start", { cwd, userId: cfg.userId });
     const kbInjectHere = cfg.kbCatalogInjection === "session_start";
-    if (!isComplete(cfg) || !cfg.warmupRecall && !kbInjectHere) {
+    if (!cfg.baseUrl || !credential || !cfg.warmupRecall && !kbInjectHere) {
       debug("warmup", "skip (config incomplete or both warmup+kb off)");
       return 0;
     }
@@ -64,7 +65,7 @@ async function main() {
     }
     const client = new HttpClient({
       baseUrl: cfg.baseUrl,
-      apiKey: cfg.apiKey,
+      credential,
       timeoutMs: HOOK_TIMEOUT_MS
     });
     const composed = await composeSessionStart(

package/dist/hooks/stop.js

@@ -1,15 +1,16 @@
 #!/usr/bin/env node
 import {
   captureTurn
-} from "../chunk-LYHGJOHM.js";
-import "../chunk-X75B57M2.js";
+} from "../chunk-ZFS6OMWE.js";
+import "../chunk-EI63DQX3.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
   debug,
   load,
+  resolveDataApiCredential,
   setDebug
-} from "../chunk-DMS5YHIK.js";
+} from "../chunk-BUK4SZC2.js";
 import {
   shouldSkipHooks
 } from "../chunk-5ML4VSXN.js";
@@ -47,13 +48,14 @@ async function main() {
     if (typeof transcriptPath !== "string" || !transcriptPath) return 0;
     const sessionId = extractHookSessionId(event);
     const cfg = load({ agent });
+    const credential = resolveDataApiCredential(cfg);
     setDebug(cfg.debug);
     debug("capture", "start", { transcriptPath, userId: cfg.userId });
-    if (!cfg.apiKey || !cfg.baseUrl) {
+    if (!cfg.baseUrl || !credential) {
       debug("capture", "skip (config incomplete)");
       return 0;
     }
-    const client = new HttpClient({ baseUrl: cfg.baseUrl, apiKey: cfg.apiKey, timeoutMs: 5e3 });
+    const client = new HttpClient({ baseUrl: cfg.baseUrl, credential, timeoutMs: 5e3 });
     const result = await captureTurn(transcriptPath, cfg, client, agent, sessionId);
     if (result.captured) {
       debug("capture", `ok (${result.messageCount} msgs)`, result);

package/dist/hooks/user-prompt-submit.js

@@ -2,20 +2,20 @@
 import {
   composeUserPromptSubmit,
   formatUserPromptSubmitStdout
-} from "../chunk-4FCZ2TZM.js";
-import "../chunk-H33NUAHP.js";
-import "../chunk-CULTDVI2.js";
+} from "../chunk-AUBVVYQL.js";
+import "../chunk-7OX6UVPB.js";
+import "../chunk-3NJ37TEY.js";
 import {
   isCircuitOpen
-} from "../chunk-X75B57M2.js";
+} from "../chunk-EI63DQX3.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
   debug,
-  isComplete,
   load,
+  resolveDataApiCredential,
   setDebug
-} from "../chunk-DMS5YHIK.js";
+} from "../chunk-BUK4SZC2.js";
 import {
   shouldSkipHooks
 } from "../chunk-5ML4VSXN.js";
@@ -50,9 +50,10 @@ async function main() {
     const sessionId = typeof event.session_id === "string" ? event.session_id : typeof event.sessionId === "string" ? event.sessionId : null;
     if (!prompt.trim()) return 0;
     const cfg = load({ agent });
+    const credential = resolveDataApiCredential(cfg);
     setDebug(cfg.debug);
     debug("recall", "start", { prompt: prompt.slice(0, 200), userId: cfg.userId });
-    if (!isComplete(cfg) || !cfg.autoRecall) {
+    if (!cfg.baseUrl || !credential || !cfg.autoRecall) {
       debug("recall", "skip (config incomplete or autoRecall=false)");
       return 0;
     }
@@ -62,7 +63,7 @@ async function main() {
 `);
       return 0;
     }
-    const client = new HttpClient({ baseUrl: cfg.baseUrl, apiKey: cfg.apiKey, timeoutMs: 5e3 });
+    const client = new HttpClient({ baseUrl: cfg.baseUrl, credential, timeoutMs: 5e3 });
     const { ctx, recall, kbBlock } = await composeUserPromptSubmit(
       cfg,
       agent,

package/dist/opencode/index.js

@@ -892,6 +892,9 @@ function agentRaw(raw) {
   if (!section || typeof section !== "object" || Array.isArray(section)) return {};
   return section;
 }
+function accessTokenFromEnv(env = process.env) {
+  return env.CTXDB_ACCESS_TOKEN?.trim() || null;
+}
 function applyEnv(cfg, env) {
   if (env.CTXDB_API_KEY) cfg.apiKey = env.CTXDB_API_KEY;
   if (env.CTXDB_BASE_URL) cfg.baseUrl = env.CTXDB_BASE_URL.replace(/\/+$/, "");
@@ -976,8 +979,8 @@ function loadOpencodeConfig(options = {}) {
   }
   return applyEnv(cfg, env);
 }
-function isConfigured(cfg) {
-  return Boolean(cfg.apiKey && cfg.baseUrl);
+function isConfigured(cfg, env = process.env) {
+  return Boolean((accessTokenFromEnv(env) || cfg.apiKey) && cfg.baseUrl);
 }
 
 // src/http-client.ts
@@ -995,11 +998,13 @@ var CtxdbHttpError = class extends Error {
 var HttpClient = class {
   baseUrl;
   apiKey;
+  accessToken;
   userAgent;
   fetchImpl;
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
     this.apiKey = opts.apiKey;
+    this.accessToken = opts.accessToken ?? null;
     this.userAgent = opts.userAgent ?? "ctxdb-opencode-plugin/0.0.0";
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
@@ -1008,7 +1013,8 @@ var HttpClient = class {
       "User-Agent": this.userAgent,
       Connection: "close"
     };
-    if (this.apiKey) h.Authorization = `Token ${this.apiKey}`;
+    if (this.accessToken) h.Authorization = `Bearer ${this.accessToken}`;
+    else if (this.apiKey) h.Authorization = `Token ${this.apiKey}`;
     if (contentType) h["Content-Type"] = contentType;
     return h;
   }
@@ -1125,7 +1131,11 @@ async function searchAndFormatRecall(prompt, cfg, client, timeoutMs, traceOption
     },
     store: {
       ...traceOptions.traceStore,
-      secrets: [...traceOptions.traceStore?.secrets ?? [], cfg.apiKey]
+      secrets: [
+        ...traceOptions.traceStore?.secrets ?? [],
+        cfg.apiKey,
+        client.accessToken
+      ]
     }
   } : null;
   if (trace) {
@@ -1454,10 +1464,14 @@ var SESSION_TTL_MS = 15 * 60 * 1e3;
 var SESSION_MAX = 100;
 var RECALL_TIMEOUT_MS = 5e3;
 var CAPTURE_TIMEOUT_MS = 8e3;
-function buildRuntime(config, cwd) {
+function buildRuntime(config, cwd, env = process.env) {
   return {
     config,
-    http: new HttpClient({ baseUrl: config.baseUrl, apiKey: config.apiKey }),
+    http: new HttpClient({
+      baseUrl: config.baseUrl,
+      apiKey: config.apiKey,
+      accessToken: accessTokenFromEnv(env)
+    }),
     sessionState: /* @__PURE__ */ new Map(),
     cwd
   };
@@ -1500,7 +1514,7 @@ async function buildHooks(input) {
     logDebug(
       config,
       "config",
-      "opencode integration disabled: missing agents.opencode.api_key in ~/.ctxdb/ctxdb.json or CTXDB_API_KEY"
+      "opencode integration disabled: missing CTXDB_ACCESS_TOKEN or API key in agents.opencode.api_key / CTXDB_API_KEY"
     );
     return {};
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aliyunrds/ctxdb",
-  "version": "1.0.8-beta.2",
+  "version": "1.0.8-beta.3",
   "type": "module",
   "description": "Unified access layer for RDS ContextDatabase: `ctxdb` CLI (memory + KB ops), one-shot multi-agent installer, per-agent config, hooks/plugins, and SKILL.md.",
   "license": "Apache-2.0",