@remnic/core 9.4.2 → 9.5.0

package/src/index.ts

@@ -992,6 +992,20 @@ export {
   type TokenStore,
 } from "./tokens.js";
 
+export {
+  TOKEN_CAPABILITIES_VERSION,
+  capabilityAllowsNamespace,
+  capabilityAllowsOp,
+  isCapabilityRestricted,
+  isValidNamespaceValue,
+  normalizeCapabilities,
+  tokenCapabilityStore,
+  validateCapabilitiesForMint,
+  type TokenCapabilities,
+} from "./access-token-capabilities.js";
+
+export { OPERATION_NAMES, type OperationName } from "./access-boundary.js";
+
 // ---------------------------------------------------------------------------
 // Codex materializer (#378)
 // ---------------------------------------------------------------------------

package/src/mcp-read-only-tools.ts

@@ -0,0 +1,61 @@
+/**
+ * Conservative allowlist of canonical MCP tool suffixes that are
+ * unambiguously read-only. Tools in this set are tagged with
+ * `annotations: { readOnlyHint: true }` so ChatGPT (and other MCP
+ * clients that honor the hint) can skip per-call confirmation.
+ *
+ * The list is suffix-based so it covers both the `remnic.*` and
+ * `engram.*` naming forms. Anything not on it stays unannotated:
+ * uncertainty is resolved as "might mutate".
+ *
+ * Excluded by construction: anything that writes, runs a pipeline,
+ * flushes, applies, records, imports, or destructively deletes.
+ */
+export const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {
+  recall: true,
+  recall_explain: true,
+  recall_tier_explain: true,
+  recall_xray: true,
+  briefing: true,
+  wearables_status: true,
+  transcript_day: true,
+  transcript_search: true,
+  transcript_memories: true,
+  action_confidence: true,
+  capsule_list: true,
+  procedural_stats: true,
+  memory_get: true,
+  memory_timeline: true,
+  entity_get: true,
+  review_queue_list: true,
+  lcm_search: true,
+  continuity_incident_list: true,
+  identity_anchor_get: true,
+  memory_identity: true,
+  memory_search: true,
+  memory_profile: true,
+  memory_entities_list: true,
+  memory_questions: true,
+  memory_last_recall: true,
+  memory_intent_debug: true,
+  memory_qmd_debug: true,
+  memory_graph_explain: true,
+  graph_snapshot: true,
+  review_list: true,
+  profiling_report: true,
+  peer_list: true,
+  peer_get: true,
+  peer_profile_get: true,
+  console_state: true,
+  dreams_status: true,
+  codegraph_list_projects: true,
+  codegraph_index_status: true,
+  codegraph_search_graph: true,
+  codegraph_trace_path: true,
+  codegraph_detect_changes: true,
+  codegraph_query_graph: true,
+  codegraph_get_schema: true,
+  codegraph_get_snippet: true,
+  codegraph_get_architecture: true,
+  codegraph_search_code: true,
+};

package/src/tokens.ts

@@ -9,11 +9,27 @@ import fs from "node:fs";
 import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { resolveHomeDir } from "./runtime/env.js";
+import {
+  TOKEN_CAPABILITIES_VERSION,
+  normalizeCapabilities,
+  type TokenCapabilities,
+} from "./access-token-capabilities.js";
 
 export interface TokenEntry {
   token: string;
   connector: string;
   createdAt: string;
+  /**
+   * Versioned capabilities record (issue #1837). PRESENT ⇒ the token was
+   * minted by the capability-aware path; its ops/namespaces axes are
+   * enforced (absent axis ⇒ unrestricted on that axis; empty array ⇒ deny
+   * all; non-empty ⇒ allow-list). ABSENT ⇒ a pre-feature legacy entry ⇒
+   * unrestricted (full access), purely for backward compatibility — this is
+   * the ONLY path by which full access is granted by omission. Every new
+   * token carries an explicit record (even `{ version: 1 }` for a deliberate
+   * unrestricted mint), so a new token can never silently gain full access.
+   */
+  capabilities?: TokenCapabilities;
 }
 
 export interface TokenStore {
@@ -75,6 +91,9 @@ function validateTokenEntry(raw: unknown, index: number): TokenEntry {
   if (typeof entry.connector !== "string" || entry.connector.length === 0) {
     throw new Error(`invalid token entry at index ${index}: connector must be a non-empty string`);
   }
+  const capabilities = entry.capabilities !== undefined
+    ? normalizeCapabilities(entry.capabilities)
+    : undefined;
   return {
     token: entry.token,
     connector: entry.connector,
@@ -82,6 +101,7 @@ function validateTokenEntry(raw: unknown, index: number): TokenEntry {
       typeof entry.createdAt === "string" && entry.createdAt.length > 0
         ? entry.createdAt
         : new Date(0).toISOString(),
+    ...(capabilities ? { capabilities } : {}),
   };
 }
 
@@ -201,13 +221,18 @@ export function saveTokenStore(store: TokenStore, tokensPath?: string): void {
  * dependent write (e.g. Hermes config.yaml) succeeds — see
  * commitTokenEntry() to persist the candidate.
  */
-export function buildTokenEntry(connector: string): TokenEntry {
+export function buildTokenEntry(connector: string, capabilities?: TokenCapabilities): TokenEntry {
   const prefix = TOKEN_PREFIXES[connector] ?? "remnic_xx_";
   const token = prefix + randomBytes(24).toString("hex");
+  // Every newly-built entry carries an EXPLICIT capabilities record (issue
+  // #1837). When none is requested, record a deliberate unrestricted
+  // `{ version: 1 }` — never an omitted field — so "full access via omission"
+  // is reachable only by pre-feature legacy entries lacking the marker.
   return {
     token,
     connector,
     createdAt: new Date().toISOString(),
+    capabilities: capabilities ?? { version: TOKEN_CAPABILITIES_VERSION },
   };
 }
 
@@ -230,13 +255,17 @@ export function commitTokenEntry(entry: TokenEntry, tokensPath?: string): void {
   saveTokenStore(store, tokensPath);
 }
 
-export function generateToken(connector: string, tokensPath?: string): TokenEntry {
+export function generateToken(
+  connector: string,
+  tokensPath?: string,
+  capabilities?: TokenCapabilities,
+): TokenEntry {
   const store = loadTokenStore(tokensPath);
 
   // Remove existing token for this connector
   store.tokens = store.tokens.filter((t) => t.connector !== connector);
 
-  const entry = buildTokenEntry(connector);
+  const entry = buildTokenEntry(connector, capabilities);
   store.tokens.push(entry);
   saveTokenStore(store, tokensPath);
   return entry;