@etzelm/openclaw-memory-hindsight 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.2 (2026-11-06)
+
+### Security
+
+- Refuse plain http to a non-loopback `hindsightApiUrl` unless the new `allowInsecureHttp` option
+  is `true` (CWE-319, cleartext transmission). Before, 0.1.1 sent the bearer token and
+  conversation text unencrypted and only warned when a token was set. Config resolution now
+  throws an error naming `allowInsecureHttp`; loopback http and https are unchanged.
+- With the opt-in set, the service start warning says both the bearer token (if any) and
+  conversation text go unencrypted, even when no token is configured.
+- Every request to Hindsight is sent with `redirect: "error"`, so an https endpoint cannot answer
+  307/308 and move the body (conversation text) to plain http.
+- Upgrade note: a config that used a remote `http://` URL must switch to https, a loopback
+  tunnel, or set `allowInsecureHttp: true`.
+
 ## 0.1.1 (2026-11-06)
 
 First version published to npm and ClawHub (0.1.0 was never published). Pre-publish hardening

package/README.md

@@ -116,6 +116,7 @@ tool conflict.
 | `excludeProviders`          | `[]`              | Message providers that never recall or retain (for example `heartbeat`)                               |
 | `skipOperationalSessions`   | `true`            | Skip cron, heartbeat and subagent sessions                                                            |
 | `agentBankMap`              | `{}`              | Agent id to bank id, so several agents share one owner bank                                           |
+| `allowInsecureHttp`         | `false`           | Allow plain http to a non-loopback `hindsightApiUrl` (token and conversation text unencrypted)        |
 
 Fixed values (not configurable): recall max tokens 1024, query cap 800 characters, recall
 timeout 10 s, retain and reflect timeout 30 s, memory get timeout 10 s (each combined with the
@@ -158,6 +159,15 @@ as of the vendor plugin 1.2.0:
 
 The vendor plugin has features this one does not port; see [Limitations](#limitations).
 
+## Security
+
+Every request carries the bearer token (if set) and, for recall and retain, conversation text. The
+plugin refuses a plain `http://` `hindsightApiUrl` to any host other than `localhost`, `127.0.0.0/8`
+or `::1`, and config resolution fails with an error that names `allowInsecureHttp`. Prefer `https://`
+or a loopback tunnel. To accept the risk on a trusted network, set `allowInsecureHttp: true`; the
+plugin then warns at service start that the token and conversation text travel unencrypted.
+Redirects are refused, so an https endpoint cannot forward a request body to plain http.
+
 ## Compatibility
 
 `openclaw.install.minHostVersion` and `openclaw.compat.pluginApi` are `>=2026.10.1`. Evidence

package/dist/client.js

@@ -41,6 +41,7 @@ export class HindsightClient {
         const response = await this.fetchImpl(url, {
             method: init.method,
             headers: this.headers(hasBody),
+            redirect: "error",
             ...(hasBody ? { body: JSON.stringify(init.body) } : {}),
             ...(init.signal ? { signal: init.signal } : {}),
         });
@@ -110,6 +111,7 @@ export class HindsightClient {
             const response = await this.fetchImpl(`${apiUrl}/health`, {
                 method: "GET",
                 headers: this.headers(false),
+                redirect: "error",
                 signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS),
             });
             return response.ok;

package/dist/config.js

@@ -27,6 +27,7 @@ const CONFIG_KEYS = [
     "excludeProviders",
     "skipOperationalSessions",
     "agentBankMap",
+    "allowInsecureHttp",
 ];
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -160,8 +161,13 @@ export const hindsightConfigSchema = {
             : readBool(value, "preferObservations", false);
         const retainMission = readString(value, "retainMission");
         const apiToken = readApiToken(value);
+        const apiUrl = normalizeApiUrl(readString(value, "hindsightApiUrl"));
+        const allowInsecureHttp = readBool(value, "allowInsecureHttp", false);
+        if (isPlainHttpRemote(apiUrl) && !allowInsecureHttp) {
+            throw new Error("hindsightApiUrl is plain http to a non-loopback host, so the bearer token and conversation text would travel unencrypted; use https or a loopback tunnel, or set allowInsecureHttp: true to accept the risk");
+        }
         return {
-            apiUrl: normalizeApiUrl(readString(value, "hindsightApiUrl")),
+            apiUrl,
             ...(apiToken ? { apiToken } : {}),
             memoryMode: readEnum(value, "memoryMode", MEMORY_MODES, "hybrid"),
             autoRecall: readBool(value, "autoRecall", true),
@@ -175,6 +181,7 @@ export const hindsightConfigSchema = {
             excludeProviders: readStringList(value, "excludeProviders") ?? [],
             skipOperationalSessions: readBool(value, "skipOperationalSessions", true),
             agentBankMap: readBankMap(value),
+            allowInsecureHttp,
         };
     },
 };

package/dist/index.js

@@ -79,11 +79,17 @@ export default definePluginEntry({
                 return startupConfig;
             }
         };
-        const service = createHindsightService({ config: currentConfig, logger: api.logger });
+        const service = createHindsightService({
+            config: currentConfig,
+            logger: api.logger,
+        });
         const flushDeduper = createFlushDeduper();
         const runStartBySession = new Map();
         const capability = {
-            providerRuntime: createHindsightProviderRuntime({ providerId: PLUGIN_ID, service }),
+            providerRuntime: createHindsightProviderRuntime({
+                providerId: PLUGIN_ID,
+                service,
+            }),
             providerFlushPlanResolver: createProviderFlushPlanResolver(currentConfig),
             recallToolNames: RECALL_TOOL_NAMES,
         };
@@ -119,7 +125,10 @@ export default definePluginEntry({
                 !config.autoRecall ||
                 config.memoryMode === "tools" ||
                 isIncognitoSessionKey(sessionKey) ||
-                !sessionUsesMemory(config, { sessionKey, messageProvider: ctx.messageProvider })) {
+                !sessionUsesMemory(config, {
+                    sessionKey,
+                    messageProvider: ctx.messageProvider,
+                })) {
                 return undefined;
             }
             const route = routeAudience(ctx.agentId, ctx.memoryAudience, config.agentBankMap);
@@ -149,7 +158,9 @@ export default definePluginEntry({
                 }
                 api.logger.info?.(`memory-hindsight: injecting ${results.length} memories`);
                 // Before the user message, outside the system prompt, so the cached prefix stays stable.
-                return { prependContext: buildRecallContext(results, config.recallPromptPreamble) };
+                return {
+                    prependContext: buildRecallContext(results, config.recallPromptPreamble),
+                };
             }
             catch (error) {
                 api.logger.warn?.(`memory-hindsight: auto-recall skipped: ${formatErrorMessage(error)}`);
@@ -170,7 +181,10 @@ export default definePluginEntry({
                 !Array.isArray(event.messages) ||
                 event.messages.length === 0 ||
                 isIncognitoSessionKey(sessionKey) ||
-                !sessionUsesMemory(config, { sessionKey, messageProvider: ctx.messageProvider })) {
+                !sessionUsesMemory(config, {
+                    sessionKey,
+                    messageProvider: ctx.messageProvider,
+                })) {
                 return;
             }
             const route = routeAudience(ctx.agentId, ctx.memoryAudience, config.agentBankMap);
@@ -238,8 +252,9 @@ export default definePluginEntry({
                 if (hasUnresolvedToken(raw)) {
                     api.logger.warn("memory-hindsight: hindsightApiToken not resolved; requests go unauthenticated");
                 }
-                else if (config.apiToken && isPlainHttpRemote(config.apiUrl)) {
-                    api.logger.warn("memory-hindsight: hindsightApiUrl is plain http to a non-loopback host; the bearer token is sent unencrypted");
+                // Config parsing already refuses plain remote http without the opt-in; warn only when opted in.
+                if (config.allowInsecureHttp && isPlainHttpRemote(config.apiUrl)) {
+                    api.logger.warn("memory-hindsight: allowInsecureHttp is set and hindsightApiUrl is plain http to a non-loopback host; the bearer token (if any) and conversation text are sent unencrypted");
                 }
                 api.logger.info(`memory-hindsight: initialized (mode: ${currentConfig().memoryMode})`);
             },

package/openclaw.plugin.json

@@ -45,6 +45,11 @@
       "help": "Agent id to owner bank id, so several agents share one private bank (for example wb-dev and wb-dev2 to wb)",
       "advanced": true
     },
+    "allowInsecureHttp": {
+      "label": "Allow Insecure HTTP",
+      "help": "Permit plain http to a non-loopback host. Token and conversation text are sent unencrypted; prefer https or a loopback tunnel",
+      "advanced": true
+    },
     "retainMission": {
       "label": "Retain Mission",
       "help": "Applied to each bank before its first write: what Hindsight should extract",
@@ -66,6 +71,11 @@
         "type": "string",
         "enum": ["hybrid", "context", "tools"]
       },
+      "allowInsecureHttp": {
+        "type": "boolean",
+        "default": false,
+        "description": "Allow plain http to a non-loopback hindsightApiUrl; the bearer token and conversation text then travel unencrypted"
+      },
       "autoRecall": {
         "type": "boolean"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@etzelm/openclaw-memory-hindsight",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Native Hindsight memory engine for OpenClaw: memory slot provider runtime, auto-recall, auto-retain, pre-compaction flush and hindsight_* agent tools.",
   "keywords": [
     "hindsight",