@remnic/core 10.0.91 → 10.0.92

package/dist/verified-recall.js

@@ -1,9 +1,9 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-7L3TODI7.js";
+} from "./chunk-JV4S6VDH.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-WWK6J6SE.js";
+import "./chunk-FSO3G4JJ.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-IGOW4TJE.js";
@@ -82,7 +82,7 @@ import "./chunk-7RJUVTVF.js";
 import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
-import "./chunk-V4XE263I.js";
+import "./chunk-43AA5FVD.js";
 import "./chunk-YBA52OKG.js";
 import "./chunk-YCNIGRRF.js";
 import "./chunk-VUFL7X3H.js";

package/dist/who-knows-cli.js

@@ -4,9 +4,9 @@ import {
   renderWhoKnows,
   renderWhoKnowsJson,
   renderWhoKnowsText
-} from "./chunk-EV76IZ37.js";
-import "./chunk-JBCCWVU2.js";
-import "./chunk-WWK6J6SE.js";
+} from "./chunk-4J363OAA.js";
+import "./chunk-EXHXJETE.js";
+import "./chunk-FSO3G4JJ.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-IGOW4TJE.js";
@@ -85,7 +85,7 @@ import "./chunk-7RJUVTVF.js";
 import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
-import "./chunk-V4XE263I.js";
+import "./chunk-43AA5FVD.js";
 import "./chunk-YBA52OKG.js";
 import "./chunk-YCNIGRRF.js";
 import "./chunk-VUFL7X3H.js";

package/dist/who-knows.js

@@ -9,8 +9,8 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-JBCCWVU2.js";
-import "./chunk-WWK6J6SE.js";
+} from "./chunk-EXHXJETE.js";
+import "./chunk-FSO3G4JJ.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-IGOW4TJE.js";
@@ -89,7 +89,7 @@ import "./chunk-7RJUVTVF.js";
 import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
-import "./chunk-V4XE263I.js";
+import "./chunk-43AA5FVD.js";
 import "./chunk-YBA52OKG.js";
 import "./chunk-YCNIGRRF.js";
 import "./chunk-VUFL7X3H.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "10.0.91",
+  "version": "10.0.92",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3386,7 +3386,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^10.0.91"
+    "@remnic/coding-graph": "^10.0.92"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-service.ts

@@ -1365,6 +1365,7 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
   }
   private readonly extractionLivenessWarn = new ExtractionLivenessWarnThrottle();
 
+  private readonly secretRefResolver: ResolveSecretRefFn | null;
   constructor(
     private readonly orchestrator: Orchestrator,
     options: {
@@ -1375,6 +1376,7 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
   ) {
     super();
     this.idempotency = new AccessIdempotencyStore(orchestrator.config.memoryDir);
+    this.secretRefResolver = options.resolveSecretRef ?? null;
     // Peer SecretRef tokens resolve at poll time through the host resolver, the
     // same indirection as agentAccessHttp.authToken (review round 1). Absent a
     // resolver, string/${ENV} tokens still work and a SecretRef degrades to a
@@ -3721,6 +3723,7 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
     this.writableNamespaceFor(undefined, undefined, request.authenticatedPrincipal ?? principal);
     return this.orchestrator.runLiveConnectors({
       force: request.force === true,
+      resolveSecretRef: this.secretRefResolver,
     });
   }
 

package/src/cli.ts

@@ -6107,8 +6107,7 @@ export function registerCli(
                   priorState: state,
                   syncFn: (cursor) =>
                     connector.syncIncremental({
-                      cursor,
-                      config: validatedCfg,
+                      cursor, config: validatedCfg, resolveSecretRef: hostSecretRefResolver(registerOptions),
                     }),
                   ingestFn: sharedIngestFn,
                   writeCursorFn: makeWriteCursorFn(name),

package/src/config.test.ts

@@ -1891,6 +1891,23 @@ test("parseConfig connectors.googleDrive accepts valid overrides", () => {
   ]);
 });
 
+test("parseConfig connectors.googleDrive keeps a SecretRef credential verbatim", () => {
+  const secretRef = { source: "keychain", id: "projects/drive-secret" };
+  const result = parseConfig({
+    openaiApiKey: "sk-test",
+    connectors: {
+      googleDrive: {
+        enabled: true,
+        clientId: "synthetic-client",
+        clientSecret: secretRef,
+        refreshToken: "synthetic-token",
+      },
+    },
+  });
+  assert.deepEqual(result.connectors.googleDrive.clientSecret, secretRef);
+  assert.equal(result.connectors.googleDrive.clientId, "synthetic-client");
+});
+
 test("parseConfig rejects malformed connectors top-level", () => {
   assert.throws(
     () => parseConfig({ openaiApiKey: "sk-test", connectors: "nope" }),

package/src/config.ts

@@ -19,6 +19,7 @@ import type {
   RecallSectionConfig,
   ReasoningEffort,
   SemanticChunkingConfigShape,
+  SecretRef,
   SessionObserverBandConfig,
   SlotBehaviorConfig,
   SlotMismatchMode,
@@ -3719,16 +3720,33 @@ export function parseConfig(
           ? (rawConnectors.googleDrive as Record<string, unknown>)
           : {};
       const driveEnabled = coerceBool(rawDrive.enabled) === true;
+      const driveClientIdRaw = rawDrive.clientId;
+      // SAFETY: a string value is a string; an object with a string source is a SecretRef, kept verbatim.
       const driveClientId =
-        typeof rawDrive.clientId === "string" ? rawDrive.clientId : "";
+        Object.prototype.toString.call(driveClientIdRaw) === "[object String]"
+          ? (driveClientIdRaw as string)
+          : Object.prototype.toString.call(driveClientIdRaw) === "[object Object]" &&
+            Object.prototype.toString.call((driveClientIdRaw as { source?: object }).source) === "[object String]"
+            ? (driveClientIdRaw as SecretRef)
+            : "";
+      const driveClientSecretRaw = rawDrive[CLIENT_SECRET_FIELD];
+      // SAFETY: a string value is a string; an object with a string source is a SecretRef, kept verbatim.
       const driveClientSecret =
-        typeof rawDrive[CLIENT_SECRET_FIELD] === "string"
-          ? rawDrive[CLIENT_SECRET_FIELD]
-          : "";
+        Object.prototype.toString.call(driveClientSecretRaw) === "[object String]"
+          ? (driveClientSecretRaw as string)
+          : Object.prototype.toString.call(driveClientSecretRaw) === "[object Object]" &&
+            Object.prototype.toString.call((driveClientSecretRaw as { source?: object }).source) === "[object String]"
+            ? (driveClientSecretRaw as SecretRef)
+            : "";
+      const driveRefreshTokenRaw = rawDrive[REFRESH_TOKEN_FIELD];
+      // SAFETY: a string value is a string; an object with a string source is a SecretRef, kept verbatim.
       const driveRefreshToken =
-        typeof rawDrive[REFRESH_TOKEN_FIELD] === "string"
-          ? rawDrive[REFRESH_TOKEN_FIELD]
-          : "";
+        Object.prototype.toString.call(driveRefreshTokenRaw) === "[object String]"
+          ? (driveRefreshTokenRaw as string)
+          : Object.prototype.toString.call(driveRefreshTokenRaw) === "[object Object]" &&
+            Object.prototype.toString.call((driveRefreshTokenRaw as { source?: object }).source) === "[object String]"
+            ? (driveRefreshTokenRaw as SecretRef)
+            : "";
       const drivePollCoerced = coerceNumber(rawDrive.pollIntervalMs);
       let drivePollIntervalMs = 300_000;
       if (drivePollCoerced !== undefined) {

package/src/connectors/live/framework.ts

@@ -1,3 +1,5 @@
+import type { ResolveSecretRefFn } from "../../resolve-auth-token.js";
+
 /**
  * @remnic/core — Live Connectors Framework (issue #683 PR 1/N)
  *
@@ -139,6 +141,12 @@ export interface SyncIncrementalArgs {
   readonly config: ConnectorConfig;
   /** Optional abort signal. Connectors SHOULD honor it for cooperative cancellation. */
   readonly abortSignal?: AbortSignal;
+  /**
+   * Host resolver for credential fields that hold a SecretRef. A connector
+   * resolves those at poll time. Absent a resolver, a plain string still works
+   * and a SecretRef fails that connector only.
+   */
+  readonly resolveSecretRef?: ResolveSecretRefFn | null;
 }
 
 /**

package/src/connectors/live/google-drive.test.ts

@@ -88,6 +88,41 @@ test("validateGoogleDriveConfig accepts a minimal valid config", () => {
   assert.deepEqual([...cfg.folderIds], []);
 });
 
+test("a SecretRef credential resolves at poll time and never reaches the persisted config", async () => {
+  const client = makeMockClient({});
+  let seenSecret = "";
+  const factory: GoogleDriveClientFactory = async (config) => {
+    seenSecret = config.clientSecret;
+    return client;
+  };
+  const connector = createGoogleDriveConnector({ clientFactory: factory });
+  const ref = { source: "keychain", id: "projects/drive-secret" };
+  const config: ConnectorConfig = { ...SYNTHETIC_CREDS, clientSecret: ref };
+  await connector.syncIncremental({
+    cursor: null,
+    config,
+    resolveSecretRef: async () => "resolved-drive-secret",
+  });
+  assert.equal(seenSecret, "resolved-drive-secret");
+  const persisted = JSON.stringify(connector.persistConfig?.(config) ?? {});
+  assert.equal(persisted.includes("resolved-drive-secret"), false);
+  assert.equal(persisted.includes("projects/drive-secret"), false);
+});
+
+test("a SecretRef with no resolver fails the connector and hides the reference", async () => {
+  const connector = createGoogleDriveConnector({ clientFactory: makeFactory(makeMockClient({})) });
+  const config: ConnectorConfig = { ...SYNTHETIC_CREDS, clientSecret: { source: "keychain", id: "projects/drive-secret" } };
+  let message = "";
+  try {
+    await connector.syncIncremental({ cursor: null, config });
+  } catch (err) {
+    message = err instanceof Error ? err.message : "";
+  }
+  assert.match(message, /clientSecret is a secret reference but no resolver is configured/);
+  assert.equal(message.includes("projects/drive-secret"), false);
+  assert.equal(message.includes("keychain"), false);
+});
+
 test("validateGoogleDriveConfig rejects non-object input", () => {
   assert.throws(() => validateGoogleDriveConfig(null), /must be an object/);
   assert.throws(() => validateGoogleDriveConfig([]), /must be an object/);

package/src/connectors/live/google-drive.ts

@@ -65,6 +65,8 @@ import type {
 } from "./framework.js";
 import { isTransientHttpError } from "./transient-errors.js";
 import { throwIfAborted } from "../../abort-error.js";
+import type { ResolveSecretRefFn } from "../../resolve-auth-token.js";
+import type { SecretRef } from "../../types.js";
 
 /**
  * Stable connector id. Lives in the registry under this exact string.
@@ -122,15 +124,40 @@ const FOLDER_ID_PATTERN = /^[A-Za-z0-9_-]{8,256}$/;
  * Validated, frozen view of `connectors.googleDrive.*`.
  */
 export interface GoogleDriveConnectorConfig {
+  readonly clientId: DriveCredential;
+  readonly clientSecret: DriveCredential;
+  readonly refreshToken: DriveCredential;
+  /** Poll interval surfaced to the scheduler. */
+  readonly pollIntervalMs: number;
+  /** Folder ids to scope import to. Empty = "all accessible". */
+  readonly folderIds: readonly string[];
+}
+
+/** A credential field as configured: a plain string, or a SecretRef resolved at poll time. */
+type DriveCredential = string | SecretRef;
+
+interface DriveCredentialFields {
+  clientId: DriveCredential;
+  clientSecret: DriveCredential;
+  refreshToken: DriveCredential;
+}
+
+/** Resolved credentials passed to the Drive client. Always plain strings. */
+interface GoogleDriveResolvedConfig {
   readonly clientId: string;
   readonly clientSecret: string;
   readonly refreshToken: string;
-  /** Poll interval surfaced to the scheduler. */
   readonly pollIntervalMs: number;
-  /** Folder ids to scope import to. Empty = "all accessible". */
   readonly folderIds: readonly string[];
 }
 
+/** Disk form of a Drive config. A SecretRef clientId is omitted, never written. */
+interface PersistedGoogleDriveConfig {
+  pollIntervalMs: number;
+  folderIds: readonly string[];
+  clientId?: string;
+}
+
 /**
  * Optional injection point for tests. The real connector dynamically imports
  * `googleapis`; tests pass a stub here to avoid the optional-peer-dep
@@ -139,7 +166,7 @@ export interface GoogleDriveConnectorConfig {
  * The shape only covers the tiny slice of the SDK we actually use.
  */
 export interface GoogleDriveClientFactory {
-  (config: GoogleDriveConnectorConfig): Promise<GoogleDriveClient>;
+  (config: GoogleDriveResolvedConfig): Promise<GoogleDriveClient>;
 }
 
 /**
@@ -243,9 +270,30 @@ export function validateGoogleDriveConfig(raw: unknown): GoogleDriveConnectorCon
     );
   }
   const r = raw as Record<string, unknown>;
-  const clientId = requireNonEmptyString(r.clientId, "clientId");
-  const clientSecret = requireNonEmptyString(r[CLIENT_SECRET_FIELD], CLIENT_SECRET_FIELD);
-  const refreshToken = requireNonEmptyString(r[REFRESH_TOKEN_FIELD], REFRESH_TOKEN_FIELD);
+  const credentialKeys = ["clientId", CLIENT_SECRET_FIELD, REFRESH_TOKEN_FIELD] as const;
+  const credentials: DriveCredentialFields = {
+    clientId: "",
+    clientSecret: "",
+    refreshToken: "",
+  };
+  for (const key of credentialKeys) {
+    const value = r[key];
+    if (Object.prototype.toString.call(value) === "[object Object]") {
+      // SAFETY: the toString check proves value is a non-null object.
+      const source = (value as { source?: object }).source;
+      if (Object.prototype.toString.call(source) === "[object String]") {
+        // SAFETY: a string `source` on this object is the SecretRef discriminator.
+        credentials[key] = value as SecretRef;
+      } else {
+        credentials[key] = requireNonEmptyString(value, key);
+      }
+    } else {
+      credentials[key] = requireNonEmptyString(value, key);
+    }
+  }
+  const clientId = credentials.clientId;
+  const clientSecret = credentials.clientSecret;
+  const refreshToken = credentials.refreshToken;
 
   let pollIntervalMs: number;
   if (r.pollIntervalMs === undefined) {
@@ -321,6 +369,51 @@ function requireNonEmptyString(value: unknown, key: string): string {
   return trimmed;
 }
 
+
+async function resolveCredential(
+  value: DriveCredential,
+  key: string,
+  resolver: ResolveSecretRefFn | null | undefined,
+): Promise<string> {
+  if (Object.prototype.toString.call(value) !== "[object Object]") {
+    // SAFETY: a DriveCredential that is not an object is the plain string form.
+    return value as string;
+  }
+  // SAFETY: the toString check proves value is a non-null object, so it is a SecretRef.
+  const ref = value as SecretRef;
+  if (resolver == null) {
+    throw new Error(`googleDrive: ${key} is a secret reference but no resolver is configured`);
+  }
+  let resolved: unknown;
+  try {
+    resolved = await resolver(ref);
+  } catch {
+    throw new Error(`googleDrive: ${key} secret reference could not be resolved`);
+  }
+  if (Object.prototype.toString.call(resolved) !== "[object String]") {
+    throw new Error(`googleDrive: ${key} secret reference resolved to a non-string value`);
+  }
+  // SAFETY: the toString check above proves `resolved` is a string.
+  const text = (resolved as string).trim();
+  if (text.length === 0) {
+    throw new Error(`googleDrive: ${key} secret reference resolved to an empty value`);
+  }
+  return text;
+}
+
+async function resolveGoogleDriveConfig(
+  stored: GoogleDriveConnectorConfig,
+  resolver: ResolveSecretRefFn | null | undefined,
+): Promise<GoogleDriveResolvedConfig> {
+  return {
+    clientId: await resolveCredential(stored.clientId, "clientId", resolver),
+    [CLIENT_SECRET_FIELD]: await resolveCredential(stored[CLIENT_SECRET_FIELD], CLIENT_SECRET_FIELD, resolver),
+    [REFRESH_TOKEN_FIELD]: await resolveCredential(stored[REFRESH_TOKEN_FIELD], REFRESH_TOKEN_FIELD, resolver),
+    pollIntervalMs: stored.pollIntervalMs,
+    folderIds: stored.folderIds,
+  };
+}
+
 /**
  * Decide whether a Drive `change` corresponds to an importable text file
  * scoped to (optionally) the configured folder set.
@@ -405,16 +498,21 @@ export function createGoogleDriveConnector(
 
     persistConfig(validated: ConnectorConfig): ConnectorConfig {
       const config = validateGoogleDriveConfig(validated);
-      return Object.freeze({
-        clientId: config.clientId,
+      const persisted: PersistedGoogleDriveConfig = {
         pollIntervalMs: config.pollIntervalMs,
         folderIds: config.folderIds,
-      });
+      };
+      if (Object.prototype.toString.call(config.clientId) === "[object String]") {
+        // SAFETY: the toString check proves clientId is a string, not a SecretRef.
+        persisted.clientId = config.clientId as string;
+      }
+      return Object.freeze(persisted);
+
     },
 
     async syncIncremental(args: SyncIncrementalArgs): Promise<SyncIncrementalResult> {
       // Re-validate on every pass: a JS caller could mutate it between passes.
-      const config = validateGoogleDriveConfig(args.config);
+      const config = await resolveGoogleDriveConfig(validateGoogleDriveConfig(args.config), args.resolveSecretRef);
       throwIfAborted(args.abortSignal, "googleDrive: sync aborted");
 
       const client = await clientFactory(config);

package/src/live-connectors-runner.ts

@@ -31,6 +31,7 @@ import {
 } from "./connectors/live/index.js";
 import { abortError } from "./abort-error.js";
 import type { LiveConnectorsConfig } from "./types.js";
+import type { ResolveSecretRefFn } from "./resolve-auth-token.js";
 
 export type LiveConnectorSkipReason =
   | "disabled"
@@ -138,6 +139,7 @@ export async function runLiveConnectorsOnce(options: {
   now?: LiveConnectorsNow;
   abortSignal?: AbortSignal;
   definitions?: LiveConnectorDefinition[];
+  resolveSecretRef?: ResolveSecretRefFn | null;
 }): Promise<LiveConnectorsRunSummary> {
   const ranAt = resolveNow(options.now);
   const force = options.force === true;
@@ -228,6 +230,7 @@ export async function runLiveConnectorsOnce(options: {
               cursor,
               config: validatedConfig,
               abortSignal: pollAbortSignal,
+              resolveSecretRef: options.resolveSecretRef,
             }),
           ingestFn: async (docs) => {
             throwIfAborted(pollAbortSignal);

package/src/live-connectors-secretref.test.ts

@@ -0,0 +1,126 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+
+import { parseConfig } from "./config.js";
+import {
+  builtInLiveConnectorDefinitions,
+  runLiveConnectorsOnce,
+} from "./live-connectors-runner.js";
+import {
+  GOOGLE_DRIVE_CONNECTOR_ID,
+  NOTION_CONNECTOR_ID,
+  createGoogleDriveConnector,
+  type GoogleDriveClient,
+} from "./connectors/live/index.js";
+import type { LiveConnector } from "./connectors/live/framework.js";
+
+const RESOLVED_SECRET = "resolved-drive-secret";
+const SECRET_REF = { source: "keychain", id: "projects/drive-secret" };
+
+function driveConfig() {
+  return {
+    openaiApiKey: "sk-test",
+    connectors: {
+      googleDrive: {
+        enabled: true,
+        clientId: "synthetic-client",
+        clientSecret: SECRET_REF,
+        refreshToken: "synthetic-token",
+      },
+      notion: { enabled: true, token: "secret_synthetic_notion_token" },
+    },
+  };
+}
+
+function notionStub(): LiveConnector {
+  return {
+    id: NOTION_CONNECTOR_ID,
+    displayName: "Notion",
+    validateConfig: () => ({}),
+    async syncIncremental() {
+      return { newDocs: [], nextCursor: { kind: "notion", value: "cursor-1", updatedAt: "2026-11-11T00:00:00.000Z" } };
+    },
+  };
+}
+
+test("a Drive SecretRef resolves through parseConfig and the runner, and stays out of the state file", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-drive-secretref-"));
+  try {
+    const parsed = parseConfig(driveConfig());
+    const definitions = builtInLiveConnectorDefinitions(parsed.connectors);
+    let seenSecret = "";
+    const client: GoogleDriveClient = {
+      async getStartPageToken() {
+        return { startPageToken: "seed-token" };
+      },
+      async listChanges() {
+        return { changes: [], newStartPageToken: "next-token" };
+      },
+      async exportFile() {
+        return "";
+      },
+      async getFileMedia() {
+        return "";
+      },
+    };
+    for (const definition of definitions) {
+      if (definition.id === GOOGLE_DRIVE_CONNECTOR_ID) {
+        definition.createConnector = () =>
+          createGoogleDriveConnector({
+            clientFactory: async (config) => {
+              seenSecret = config.clientSecret;
+              return client;
+            },
+          });
+      }
+      if (definition.id === NOTION_CONNECTOR_ID) {
+        definition.createConnector = notionStub;
+      }
+    }
+    const summary = await runLiveConnectorsOnce({
+      memoryDir,
+      connectors: parsed.connectors,
+      definitions,
+      force: true,
+      resolveSecretRef: async () => RESOLVED_SECRET,
+      ingestDocuments: async () => {},
+    });
+    assert.equal(seenSecret, RESOLVED_SECRET);
+    const drive = summary.results.find((item) => item.id === GOOGLE_DRIVE_CONNECTOR_ID);
+    assert.equal(drive?.ran, true);
+    const statePath = path.join(memoryDir, "state", "connectors", `${GOOGLE_DRIVE_CONNECTOR_ID}.json`);
+    const stateText = await readFile(statePath, "utf-8");
+    assert.equal(stateText.includes(RESOLVED_SECRET), false);
+    assert.equal(stateText.includes(SECRET_REF.id), false);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("a Drive SecretRef with no resolver fails that connector and the others still run", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-drive-secretref-"));
+  try {
+    const parsed = parseConfig(driveConfig());
+    const definitions = builtInLiveConnectorDefinitions(parsed.connectors);
+    for (const definition of definitions) {
+      if (definition.id === NOTION_CONNECTOR_ID) definition.createConnector = notionStub;
+    }
+    const summary = await runLiveConnectorsOnce({
+      memoryDir,
+      connectors: parsed.connectors,
+      definitions,
+      force: true,
+      ingestDocuments: async () => {},
+    });
+    const drive = summary.results.find((item) => item.id === GOOGLE_DRIVE_CONNECTOR_ID);
+    const notion = summary.results.find((item) => item.id === NOTION_CONNECTOR_ID);
+    assert.match(drive?.error ?? "", /clientSecret is a secret reference but no resolver is configured/);
+    assert.equal((drive?.error ?? "").includes(SECRET_REF.id), false);
+    assert.equal(notion?.ran, true);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/orchestrator.ts

@@ -236,6 +236,7 @@ import {
   runLiveConnectorsOnce,
   type LiveConnectorsRunSummary,
 } from "./live-connectors-runner.js";
+import type { ResolveSecretRefFn } from "./resolve-auth-token.js";
 import {
   runPatternReinforcement,
   type PatternReinforcementResult,
@@ -2116,20 +2117,19 @@ export class Orchestrator {
   async runLiveConnectors(options: {
     force?: boolean;
     abortSignal?: AbortSignal;
+    resolveSecretRef?: ResolveSecretRefFn | null;
   } = {}): Promise<LiveConnectorsRunSummary> {
     return runLiveConnectorsOnce({
       memoryDir: this.config.memoryDir,
       connectors: this.config.connectors,
       force: options.force === true,
       abortSignal: options.abortSignal,
+      resolveSecretRef: options.resolveSecretRef,
       ingestDocuments: async (docs) => {
         const fetchedAt = new Date().toISOString();
         const turns = docs.map((doc) => ({
-          role: "assistant" as const,
-          content: doc.title
-            ? `# ${doc.title}\n\n${doc.content}`
-            : doc.content,
-          timestamp: fetchedAt,
+          role: "assistant" as const, timestamp: fetchedAt,
+          content: doc.title ? `# ${doc.title}\n\n${doc.content}` : doc.content,
         }));
         await this.ingestBulkImportBatch(turns);
       },

package/src/types.ts

@@ -273,8 +273,9 @@ export interface NativeKnowledgeOpenClawWorkspaceConfig {
  * OpenClaw resolves these at runtime via its built-in secret resolver
  * (e.g. exec providers like `kc_*` for macOS Keychain). Plugins receive
  * the raw object in `pluginConfig` and must call the gateway's resolver
- * before using the value. Standalone Remnic does NOT resolve SecretRefs;
- * operators must use plain strings or `${ENV_VAR}` expansion instead.
+ * before using the value. A live connector credential field resolves a
+ * SecretRef at poll time through the host resolver. Other surfaces still
+ * need a plain string or `${ENV_VAR}` expansion.
  */
 export interface SecretRef {
   source: string;
@@ -2539,21 +2540,20 @@ export interface LiveConnectorsConfig {
  * shape (frozen, post-validation). This interface is the pre-validation
  * shape that `parseConfig` round-trips through.
  *
- * `clientId` / `clientSecret` / `refreshToken` are stored as strings here so
- * the schema can ship in `openclaw.plugin.json` and operators can populate
- * them from a secret store (e.g. an env-substituted plist or systemd
- * EnvironmentFile). They MUST NEVER be committed to source. The repo-wide
- * privacy policy in CLAUDE.md applies.
+ * `clientId` / `clientSecret` / `refreshToken` are a plain string or a
+ * SecretRef. A SecretRef is kept verbatim here and resolved at poll time
+ * through the host resolver. They MUST NEVER be committed to source. The
+ * repo-wide privacy policy in CLAUDE.md applies.
  */
 export interface GoogleDriveLiveConnectorConfig {
   /** Master gate. Default false — operators must opt in explicitly. */
   enabled: boolean;
   /** OAuth2 client id. Populate from a secret store; never commit. */
-  clientId: string;
+  clientId: string | SecretRef;
   /** OAuth2 client secret. Populate from a secret store; never commit. */
-  clientSecret: string;
+  clientSecret: string | SecretRef;
   /** OAuth2 refresh token. Populate from a secret store; never commit. */
-  refreshToken: string;
+  refreshToken: string | SecretRef;
   /** Poll interval in ms. Default 300000 (5 min); min 1000; max 86400000 (24h). */
   pollIntervalMs: number;
   /** Optional folder-id scope. Empty array = all accessible files. */