@remnic/core 10.0.90 → 10.0.92

package/src/access-observe-replay-durability.test.ts

@@ -1600,7 +1600,10 @@ test("#3251 namespaced buffered admission without writeNamespaceOverride or plan
         [makeReplayTurn("no-target-sess", "capture without target")],
         bufferedObserveOptions({ sessionOwnerPrincipal: "alice" }),
       ),
-      /requires an explicit storage target/,
+      (err: Error) =>
+        err.name === "StorageTargetRequiredError" &&
+        /requires an explicit storage target/.test(err.message),
+      "the missing-target refusal must be its own non-retryable class, never ReplayAdmissionRefusedError",
     );
     assert.equal(lcmCalls.length, 0, "zero LCM archival on rejected admission");
     assert.equal(queued.length, 0, "zero extraction queued on rejected admission");

package/src/access-service-observe-idempotency.test.ts

@@ -22,6 +22,7 @@ import { EngramAccessService } from "./access-service.js";
 import { EngramAccessInputError } from "./access-service.js";
 import { initLogger } from "./logger.js";
 import { Orchestrator } from "./orchestrator.js";
+import { ReplayAdmissionRefusedError } from "./orchestration/turn-ingestion.js";
 import type { EngramAccessObserveRequest } from "./access-service.js";
 import type { CodingContext, PluginConfig } from "./types.js";
 
@@ -328,6 +329,49 @@ test("#2206 project-scope-off ignores ambient coding context in observe idempote
   }
 });
 
+test("#1649 a capacity-refused observe does not consume its idempotencyKey", async () => {
+  const memoryDir = mkdtempSync(join(tmpdir(), "remnic-observe-cap-idem-"));
+  try {
+    const probe = makeObserveProbe(memoryDir);
+    const service = new EngramAccessService(probe.orch);
+    const orch: Orchestrator = probe.orch;
+    const realIngest = orch.ingestReplayBatch.bind(orch);
+    type IngestFn = Orchestrator["ingestReplayBatch"];
+    let armed = true;
+    orch.ingestReplayBatch = async (...args: Parameters<IngestFn>): Promise<void> => {
+      if (armed) {
+        armed = false;
+        throw new ReplayAdmissionRefusedError(
+          "durable observe capture refused: extraction buffer at entry capacity for batch containing pi-geek:abc123",
+        );
+      }
+      return realIngest(...args);
+    };
+    const key = "observe-capacity-pi-geek-abc123-#1";
+
+    // First attempt refuses at entry capacity — the key must stay unused.
+    await assert.rejects(
+      service.observe(observeRequest({ idempotencyKey: key })),
+      (err: Error) => err instanceof ReplayAdmissionRefusedError,
+      "the seeded first attempt must refuse with the capacity backpressure error",
+    );
+    assert.equal(probe.extractionCalls.length, 0, "refused attempt must not ingest");
+
+    // Identical retry, same key: a REAL miss once capacity exists, not a replay
+    // of a response that never happened.
+    const retry = await service.observe(observeRequest({ idempotencyKey: key }));
+    assert.equal(retry.idempotencyReplay, undefined, "refusal must not have cached a response");
+    assert.equal(probe.extractionCalls.length, 1, "retry is admitted exactly once");
+
+    // Third identical request replays — the success bound the key, not the refusal.
+    const replay = await service.observe(observeRequest({ idempotencyKey: key }));
+    assert.equal(replay.idempotencyReplay, true, "post-success identical request replays");
+    assert.equal(probe.extractionCalls.length, 1, "replay must not ingest again");
+  } finally {
+    rmSync(memoryDir, { recursive: true, force: true });
+  }
+});
+
 test("#1649 review fix: projectTag observe replays correctly despite scope resolution side effects", async () => {
   // The fingerprint folds in the RESOLVED writeNamespace (not the raw ambient
   // context). resolveMemoryScopePlan seeds the session context from projectTag

package/src/access-service.ts

@@ -1365,6 +1365,7 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
   }
   private readonly extractionLivenessWarn = new ExtractionLivenessWarnThrottle();
 
+  private readonly secretRefResolver: ResolveSecretRefFn | null;
   constructor(
     private readonly orchestrator: Orchestrator,
     options: {
@@ -1375,6 +1376,7 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
   ) {
     super();
     this.idempotency = new AccessIdempotencyStore(orchestrator.config.memoryDir);
+    this.secretRefResolver = options.resolveSecretRef ?? null;
     // Peer SecretRef tokens resolve at poll time through the host resolver, the
     // same indirection as agentAccessHttp.authToken (review round 1). Absent a
     // resolver, string/${ENV} tokens still work and a SecretRef degrades to a
@@ -3721,6 +3723,7 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
     this.writableNamespaceFor(undefined, undefined, request.authenticatedPrincipal ?? principal);
     return this.orchestrator.runLiveConnectors({
       force: request.force === true,
+      resolveSecretRef: this.secretRefResolver,
     });
   }
 

package/src/buffer-admission.ts

@@ -26,6 +26,19 @@ export class ReplayAdmissionRefusedError extends Error {
   }
 }
 
+/**
+ * Durable observe capture rejected because the request resolves to no storage
+ * target (namespaces ON with neither writeNamespaceOverride nor a plan's
+ * writeNamespace). A property of the request — retrying cannot fix it — so it
+ * must never be classified as retryable backpressure.
+ */
+export class StorageTargetRequiredError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StorageTargetRequiredError";
+  }
+}
+
 /**
  * Live-admission bound (#1908 policy, backlog-safe): a NEW session enters
  * only while under the cap or when an EMPTY entry can be reclaimed. Buffered

package/src/cli.ts

@@ -6107,8 +6107,7 @@ export function registerCli(
                   priorState: state,
                   syncFn: (cursor) =>
                     connector.syncIncremental({
-                      cursor,
-                      config: validatedCfg,
+                      cursor, config: validatedCfg, resolveSecretRef: hostSecretRefResolver(registerOptions),
                     }),
                   ingestFn: sharedIngestFn,
                   writeCursorFn: makeWriteCursorFn(name),

package/src/config.test.ts

@@ -1891,6 +1891,23 @@ test("parseConfig connectors.googleDrive accepts valid overrides", () => {
   ]);
 });
 
+test("parseConfig connectors.googleDrive keeps a SecretRef credential verbatim", () => {
+  const secretRef = { source: "keychain", id: "projects/drive-secret" };
+  const result = parseConfig({
+    openaiApiKey: "sk-test",
+    connectors: {
+      googleDrive: {
+        enabled: true,
+        clientId: "synthetic-client",
+        clientSecret: secretRef,
+        refreshToken: "synthetic-token",
+      },
+    },
+  });
+  assert.deepEqual(result.connectors.googleDrive.clientSecret, secretRef);
+  assert.equal(result.connectors.googleDrive.clientId, "synthetic-client");
+});
+
 test("parseConfig rejects malformed connectors top-level", () => {
   assert.throws(
     () => parseConfig({ openaiApiKey: "sk-test", connectors: "nope" }),

package/src/config.ts

@@ -19,6 +19,7 @@ import type {
   RecallSectionConfig,
   ReasoningEffort,
   SemanticChunkingConfigShape,
+  SecretRef,
   SessionObserverBandConfig,
   SlotBehaviorConfig,
   SlotMismatchMode,
@@ -3719,16 +3720,33 @@ export function parseConfig(
           ? (rawConnectors.googleDrive as Record<string, unknown>)
           : {};
       const driveEnabled = coerceBool(rawDrive.enabled) === true;
+      const driveClientIdRaw = rawDrive.clientId;
+      // SAFETY: a string value is a string; an object with a string source is a SecretRef, kept verbatim.
       const driveClientId =
-        typeof rawDrive.clientId === "string" ? rawDrive.clientId : "";
+        Object.prototype.toString.call(driveClientIdRaw) === "[object String]"
+          ? (driveClientIdRaw as string)
+          : Object.prototype.toString.call(driveClientIdRaw) === "[object Object]" &&
+            Object.prototype.toString.call((driveClientIdRaw as { source?: object }).source) === "[object String]"
+            ? (driveClientIdRaw as SecretRef)
+            : "";
+      const driveClientSecretRaw = rawDrive[CLIENT_SECRET_FIELD];
+      // SAFETY: a string value is a string; an object with a string source is a SecretRef, kept verbatim.
       const driveClientSecret =
-        typeof rawDrive[CLIENT_SECRET_FIELD] === "string"
-          ? rawDrive[CLIENT_SECRET_FIELD]
-          : "";
+        Object.prototype.toString.call(driveClientSecretRaw) === "[object String]"
+          ? (driveClientSecretRaw as string)
+          : Object.prototype.toString.call(driveClientSecretRaw) === "[object Object]" &&
+            Object.prototype.toString.call((driveClientSecretRaw as { source?: object }).source) === "[object String]"
+            ? (driveClientSecretRaw as SecretRef)
+            : "";
+      const driveRefreshTokenRaw = rawDrive[REFRESH_TOKEN_FIELD];
+      // SAFETY: a string value is a string; an object with a string source is a SecretRef, kept verbatim.
       const driveRefreshToken =
-        typeof rawDrive[REFRESH_TOKEN_FIELD] === "string"
-          ? rawDrive[REFRESH_TOKEN_FIELD]
-          : "";
+        Object.prototype.toString.call(driveRefreshTokenRaw) === "[object String]"
+          ? (driveRefreshTokenRaw as string)
+          : Object.prototype.toString.call(driveRefreshTokenRaw) === "[object Object]" &&
+            Object.prototype.toString.call((driveRefreshTokenRaw as { source?: object }).source) === "[object String]"
+            ? (driveRefreshTokenRaw as SecretRef)
+            : "";
       const drivePollCoerced = coerceNumber(rawDrive.pollIntervalMs);
       let drivePollIntervalMs = 300_000;
       if (drivePollCoerced !== undefined) {

package/src/connectors/live/framework.ts

@@ -1,3 +1,5 @@
+import type { ResolveSecretRefFn } from "../../resolve-auth-token.js";
+
 /**
  * @remnic/core — Live Connectors Framework (issue #683 PR 1/N)
  *
@@ -139,6 +141,12 @@ export interface SyncIncrementalArgs {
   readonly config: ConnectorConfig;
   /** Optional abort signal. Connectors SHOULD honor it for cooperative cancellation. */
   readonly abortSignal?: AbortSignal;
+  /**
+   * Host resolver for credential fields that hold a SecretRef. A connector
+   * resolves those at poll time. Absent a resolver, a plain string still works
+   * and a SecretRef fails that connector only.
+   */
+  readonly resolveSecretRef?: ResolveSecretRefFn | null;
 }
 
 /**

package/src/connectors/live/google-drive.test.ts

@@ -88,6 +88,41 @@ test("validateGoogleDriveConfig accepts a minimal valid config", () => {
   assert.deepEqual([...cfg.folderIds], []);
 });
 
+test("a SecretRef credential resolves at poll time and never reaches the persisted config", async () => {
+  const client = makeMockClient({});
+  let seenSecret = "";
+  const factory: GoogleDriveClientFactory = async (config) => {
+    seenSecret = config.clientSecret;
+    return client;
+  };
+  const connector = createGoogleDriveConnector({ clientFactory: factory });
+  const ref = { source: "keychain", id: "projects/drive-secret" };
+  const config: ConnectorConfig = { ...SYNTHETIC_CREDS, clientSecret: ref };
+  await connector.syncIncremental({
+    cursor: null,
+    config,
+    resolveSecretRef: async () => "resolved-drive-secret",
+  });
+  assert.equal(seenSecret, "resolved-drive-secret");
+  const persisted = JSON.stringify(connector.persistConfig?.(config) ?? {});
+  assert.equal(persisted.includes("resolved-drive-secret"), false);
+  assert.equal(persisted.includes("projects/drive-secret"), false);
+});
+
+test("a SecretRef with no resolver fails the connector and hides the reference", async () => {
+  const connector = createGoogleDriveConnector({ clientFactory: makeFactory(makeMockClient({})) });
+  const config: ConnectorConfig = { ...SYNTHETIC_CREDS, clientSecret: { source: "keychain", id: "projects/drive-secret" } };
+  let message = "";
+  try {
+    await connector.syncIncremental({ cursor: null, config });
+  } catch (err) {
+    message = err instanceof Error ? err.message : "";
+  }
+  assert.match(message, /clientSecret is a secret reference but no resolver is configured/);
+  assert.equal(message.includes("projects/drive-secret"), false);
+  assert.equal(message.includes("keychain"), false);
+});
+
 test("validateGoogleDriveConfig rejects non-object input", () => {
   assert.throws(() => validateGoogleDriveConfig(null), /must be an object/);
   assert.throws(() => validateGoogleDriveConfig([]), /must be an object/);

package/src/connectors/live/google-drive.ts

@@ -65,6 +65,8 @@ import type {
 } from "./framework.js";
 import { isTransientHttpError } from "./transient-errors.js";
 import { throwIfAborted } from "../../abort-error.js";
+import type { ResolveSecretRefFn } from "../../resolve-auth-token.js";
+import type { SecretRef } from "../../types.js";
 
 /**
  * Stable connector id. Lives in the registry under this exact string.
@@ -122,15 +124,40 @@ const FOLDER_ID_PATTERN = /^[A-Za-z0-9_-]{8,256}$/;
  * Validated, frozen view of `connectors.googleDrive.*`.
  */
 export interface GoogleDriveConnectorConfig {
+  readonly clientId: DriveCredential;
+  readonly clientSecret: DriveCredential;
+  readonly refreshToken: DriveCredential;
+  /** Poll interval surfaced to the scheduler. */
+  readonly pollIntervalMs: number;
+  /** Folder ids to scope import to. Empty = "all accessible". */
+  readonly folderIds: readonly string[];
+}
+
+/** A credential field as configured: a plain string, or a SecretRef resolved at poll time. */
+type DriveCredential = string | SecretRef;
+
+interface DriveCredentialFields {
+  clientId: DriveCredential;
+  clientSecret: DriveCredential;
+  refreshToken: DriveCredential;
+}
+
+/** Resolved credentials passed to the Drive client. Always plain strings. */
+interface GoogleDriveResolvedConfig {
   readonly clientId: string;
   readonly clientSecret: string;
   readonly refreshToken: string;
-  /** Poll interval surfaced to the scheduler. */
   readonly pollIntervalMs: number;
-  /** Folder ids to scope import to. Empty = "all accessible". */
   readonly folderIds: readonly string[];
 }
 
+/** Disk form of a Drive config. A SecretRef clientId is omitted, never written. */
+interface PersistedGoogleDriveConfig {
+  pollIntervalMs: number;
+  folderIds: readonly string[];
+  clientId?: string;
+}
+
 /**
  * Optional injection point for tests. The real connector dynamically imports
  * `googleapis`; tests pass a stub here to avoid the optional-peer-dep
@@ -139,7 +166,7 @@ export interface GoogleDriveConnectorConfig {
  * The shape only covers the tiny slice of the SDK we actually use.
  */
 export interface GoogleDriveClientFactory {
-  (config: GoogleDriveConnectorConfig): Promise<GoogleDriveClient>;
+  (config: GoogleDriveResolvedConfig): Promise<GoogleDriveClient>;
 }
 
 /**
@@ -243,9 +270,30 @@ export function validateGoogleDriveConfig(raw: unknown): GoogleDriveConnectorCon
     );
   }
   const r = raw as Record<string, unknown>;
-  const clientId = requireNonEmptyString(r.clientId, "clientId");
-  const clientSecret = requireNonEmptyString(r[CLIENT_SECRET_FIELD], CLIENT_SECRET_FIELD);
-  const refreshToken = requireNonEmptyString(r[REFRESH_TOKEN_FIELD], REFRESH_TOKEN_FIELD);
+  const credentialKeys = ["clientId", CLIENT_SECRET_FIELD, REFRESH_TOKEN_FIELD] as const;
+  const credentials: DriveCredentialFields = {
+    clientId: "",
+    clientSecret: "",
+    refreshToken: "",
+  };
+  for (const key of credentialKeys) {
+    const value = r[key];
+    if (Object.prototype.toString.call(value) === "[object Object]") {
+      // SAFETY: the toString check proves value is a non-null object.
+      const source = (value as { source?: object }).source;
+      if (Object.prototype.toString.call(source) === "[object String]") {
+        // SAFETY: a string `source` on this object is the SecretRef discriminator.
+        credentials[key] = value as SecretRef;
+      } else {
+        credentials[key] = requireNonEmptyString(value, key);
+      }
+    } else {
+      credentials[key] = requireNonEmptyString(value, key);
+    }
+  }
+  const clientId = credentials.clientId;
+  const clientSecret = credentials.clientSecret;
+  const refreshToken = credentials.refreshToken;
 
   let pollIntervalMs: number;
   if (r.pollIntervalMs === undefined) {
@@ -321,6 +369,51 @@ function requireNonEmptyString(value: unknown, key: string): string {
   return trimmed;
 }
 
+
+async function resolveCredential(
+  value: DriveCredential,
+  key: string,
+  resolver: ResolveSecretRefFn | null | undefined,
+): Promise<string> {
+  if (Object.prototype.toString.call(value) !== "[object Object]") {
+    // SAFETY: a DriveCredential that is not an object is the plain string form.
+    return value as string;
+  }
+  // SAFETY: the toString check proves value is a non-null object, so it is a SecretRef.
+  const ref = value as SecretRef;
+  if (resolver == null) {
+    throw new Error(`googleDrive: ${key} is a secret reference but no resolver is configured`);
+  }
+  let resolved: unknown;
+  try {
+    resolved = await resolver(ref);
+  } catch {
+    throw new Error(`googleDrive: ${key} secret reference could not be resolved`);
+  }
+  if (Object.prototype.toString.call(resolved) !== "[object String]") {
+    throw new Error(`googleDrive: ${key} secret reference resolved to a non-string value`);
+  }
+  // SAFETY: the toString check above proves `resolved` is a string.
+  const text = (resolved as string).trim();
+  if (text.length === 0) {
+    throw new Error(`googleDrive: ${key} secret reference resolved to an empty value`);
+  }
+  return text;
+}
+
+async function resolveGoogleDriveConfig(
+  stored: GoogleDriveConnectorConfig,
+  resolver: ResolveSecretRefFn | null | undefined,
+): Promise<GoogleDriveResolvedConfig> {
+  return {
+    clientId: await resolveCredential(stored.clientId, "clientId", resolver),
+    [CLIENT_SECRET_FIELD]: await resolveCredential(stored[CLIENT_SECRET_FIELD], CLIENT_SECRET_FIELD, resolver),
+    [REFRESH_TOKEN_FIELD]: await resolveCredential(stored[REFRESH_TOKEN_FIELD], REFRESH_TOKEN_FIELD, resolver),
+    pollIntervalMs: stored.pollIntervalMs,
+    folderIds: stored.folderIds,
+  };
+}
+
 /**
  * Decide whether a Drive `change` corresponds to an importable text file
  * scoped to (optionally) the configured folder set.
@@ -405,16 +498,21 @@ export function createGoogleDriveConnector(
 
     persistConfig(validated: ConnectorConfig): ConnectorConfig {
       const config = validateGoogleDriveConfig(validated);
-      return Object.freeze({
-        clientId: config.clientId,
+      const persisted: PersistedGoogleDriveConfig = {
         pollIntervalMs: config.pollIntervalMs,
         folderIds: config.folderIds,
-      });
+      };
+      if (Object.prototype.toString.call(config.clientId) === "[object String]") {
+        // SAFETY: the toString check proves clientId is a string, not a SecretRef.
+        persisted.clientId = config.clientId as string;
+      }
+      return Object.freeze(persisted);
+
     },
 
     async syncIncremental(args: SyncIncrementalArgs): Promise<SyncIncrementalResult> {
       // Re-validate on every pass: a JS caller could mutate it between passes.
-      const config = validateGoogleDriveConfig(args.config);
+      const config = await resolveGoogleDriveConfig(validateGoogleDriveConfig(args.config), args.resolveSecretRef);
       throwIfAborted(args.abortSignal, "googleDrive: sync aborted");
 
       const client = await clientFactory(config);

package/src/live-connectors-runner.ts

@@ -31,6 +31,7 @@ import {
 } from "./connectors/live/index.js";
 import { abortError } from "./abort-error.js";
 import type { LiveConnectorsConfig } from "./types.js";
+import type { ResolveSecretRefFn } from "./resolve-auth-token.js";
 
 export type LiveConnectorSkipReason =
   | "disabled"
@@ -138,6 +139,7 @@ export async function runLiveConnectorsOnce(options: {
   now?: LiveConnectorsNow;
   abortSignal?: AbortSignal;
   definitions?: LiveConnectorDefinition[];
+  resolveSecretRef?: ResolveSecretRefFn | null;
 }): Promise<LiveConnectorsRunSummary> {
   const ranAt = resolveNow(options.now);
   const force = options.force === true;
@@ -228,6 +230,7 @@ export async function runLiveConnectorsOnce(options: {
               cursor,
               config: validatedConfig,
               abortSignal: pollAbortSignal,
+              resolveSecretRef: options.resolveSecretRef,
             }),
           ingestFn: async (docs) => {
             throwIfAborted(pollAbortSignal);

package/src/live-connectors-secretref.test.ts

@@ -0,0 +1,126 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+
+import { parseConfig } from "./config.js";
+import {
+  builtInLiveConnectorDefinitions,
+  runLiveConnectorsOnce,
+} from "./live-connectors-runner.js";
+import {
+  GOOGLE_DRIVE_CONNECTOR_ID,
+  NOTION_CONNECTOR_ID,
+  createGoogleDriveConnector,
+  type GoogleDriveClient,
+} from "./connectors/live/index.js";
+import type { LiveConnector } from "./connectors/live/framework.js";
+
+const RESOLVED_SECRET = "resolved-drive-secret";
+const SECRET_REF = { source: "keychain", id: "projects/drive-secret" };
+
+function driveConfig() {
+  return {
+    openaiApiKey: "sk-test",
+    connectors: {
+      googleDrive: {
+        enabled: true,
+        clientId: "synthetic-client",
+        clientSecret: SECRET_REF,
+        refreshToken: "synthetic-token",
+      },
+      notion: { enabled: true, token: "secret_synthetic_notion_token" },
+    },
+  };
+}
+
+function notionStub(): LiveConnector {
+  return {
+    id: NOTION_CONNECTOR_ID,
+    displayName: "Notion",
+    validateConfig: () => ({}),
+    async syncIncremental() {
+      return { newDocs: [], nextCursor: { kind: "notion", value: "cursor-1", updatedAt: "2026-11-11T00:00:00.000Z" } };
+    },
+  };
+}
+
+test("a Drive SecretRef resolves through parseConfig and the runner, and stays out of the state file", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-drive-secretref-"));
+  try {
+    const parsed = parseConfig(driveConfig());
+    const definitions = builtInLiveConnectorDefinitions(parsed.connectors);
+    let seenSecret = "";
+    const client: GoogleDriveClient = {
+      async getStartPageToken() {
+        return { startPageToken: "seed-token" };
+      },
+      async listChanges() {
+        return { changes: [], newStartPageToken: "next-token" };
+      },
+      async exportFile() {
+        return "";
+      },
+      async getFileMedia() {
+        return "";
+      },
+    };
+    for (const definition of definitions) {
+      if (definition.id === GOOGLE_DRIVE_CONNECTOR_ID) {
+        definition.createConnector = () =>
+          createGoogleDriveConnector({
+            clientFactory: async (config) => {
+              seenSecret = config.clientSecret;
+              return client;
+            },
+          });
+      }
+      if (definition.id === NOTION_CONNECTOR_ID) {
+        definition.createConnector = notionStub;
+      }
+    }
+    const summary = await runLiveConnectorsOnce({
+      memoryDir,
+      connectors: parsed.connectors,
+      definitions,
+      force: true,
+      resolveSecretRef: async () => RESOLVED_SECRET,
+      ingestDocuments: async () => {},
+    });
+    assert.equal(seenSecret, RESOLVED_SECRET);
+    const drive = summary.results.find((item) => item.id === GOOGLE_DRIVE_CONNECTOR_ID);
+    assert.equal(drive?.ran, true);
+    const statePath = path.join(memoryDir, "state", "connectors", `${GOOGLE_DRIVE_CONNECTOR_ID}.json`);
+    const stateText = await readFile(statePath, "utf-8");
+    assert.equal(stateText.includes(RESOLVED_SECRET), false);
+    assert.equal(stateText.includes(SECRET_REF.id), false);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("a Drive SecretRef with no resolver fails that connector and the others still run", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-drive-secretref-"));
+  try {
+    const parsed = parseConfig(driveConfig());
+    const definitions = builtInLiveConnectorDefinitions(parsed.connectors);
+    for (const definition of definitions) {
+      if (definition.id === NOTION_CONNECTOR_ID) definition.createConnector = notionStub;
+    }
+    const summary = await runLiveConnectorsOnce({
+      memoryDir,
+      connectors: parsed.connectors,
+      definitions,
+      force: true,
+      ingestDocuments: async () => {},
+    });
+    const drive = summary.results.find((item) => item.id === GOOGLE_DRIVE_CONNECTOR_ID);
+    const notion = summary.results.find((item) => item.id === NOTION_CONNECTOR_ID);
+    assert.match(drive?.error ?? "", /clientSecret is a secret reference but no resolver is configured/);
+    assert.equal((drive?.error ?? "").includes(SECRET_REF.id), false);
+    assert.equal(notion?.ran, true);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/orchestration/turn-ingestion.ts

@@ -59,8 +59,8 @@ import {
 
 // The class lives in ../buffer-admission.js next to BufferAdmissionRefusedError;
 // re-exported here so existing importers keep their import path.
-import { ReplayAdmissionRefusedError } from "../buffer-admission.js";
-export { ReplayAdmissionRefusedError };
+import { ReplayAdmissionRefusedError, StorageTargetRequiredError } from "../buffer-admission.js";
+export { ReplayAdmissionRefusedError, StorageTargetRequiredError };
 
 export interface TurnIngestionDeps {
   readonly buffer: SmartBuffer;
@@ -428,7 +428,7 @@ export class TurnIngestionCoordinator {
         ? options.scopeProfileWritePlan?.writeNamespace
         : this.deps.config.defaultNamespace);
     if (!resolvedWriteTarget) {
-      throw new ReplayAdmissionRefusedError(
+      throw new StorageTargetRequiredError(
         "accepted capture requires an explicit storage target (writeNamespaceOverride or scopeProfileWritePlan.writeNamespace)",
       );
     }

package/src/orchestrator.ts

@@ -236,6 +236,7 @@ import {
   runLiveConnectorsOnce,
   type LiveConnectorsRunSummary,
 } from "./live-connectors-runner.js";
+import type { ResolveSecretRefFn } from "./resolve-auth-token.js";
 import {
   runPatternReinforcement,
   type PatternReinforcementResult,
@@ -2116,20 +2117,19 @@ export class Orchestrator {
   async runLiveConnectors(options: {
     force?: boolean;
     abortSignal?: AbortSignal;
+    resolveSecretRef?: ResolveSecretRefFn | null;
   } = {}): Promise<LiveConnectorsRunSummary> {
     return runLiveConnectorsOnce({
       memoryDir: this.config.memoryDir,
       connectors: this.config.connectors,
       force: options.force === true,
       abortSignal: options.abortSignal,
+      resolveSecretRef: options.resolveSecretRef,
       ingestDocuments: async (docs) => {
         const fetchedAt = new Date().toISOString();
         const turns = docs.map((doc) => ({
-          role: "assistant" as const,
-          content: doc.title
-            ? `# ${doc.title}\n\n${doc.content}`
-            : doc.content,
-          timestamp: fetchedAt,
+          role: "assistant" as const, timestamp: fetchedAt,
+          content: doc.title ? `# ${doc.title}\n\n${doc.content}` : doc.content,
         }));
         await this.ingestBulkImportBatch(turns);
       },