@remnic/core 9.50.1 → 9.50.2

package/dist/{chunk-LOW66JRO.js → chunk-PYKKWQZ2.js}

@@ -28,7 +28,7 @@ import {
   defineOperation,
   parseNamespacePreflightWriteOp,
   resolveAuthorizedNamespaceWritablePreflight
-} from "./chunk-UWIDGVQM.js";
+} from "./chunk-5C2HNJMO.js";
 import {
   validateBriefingFormat
 } from "./chunk-VJXY5ZCT.js";
@@ -494,4 +494,4 @@ defineOperation({ name: "graph_events", description: "SSE graph events.", schema
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
-//# sourceMappingURL=chunk-LOW66JRO.js.map
+//# sourceMappingURL=chunk-PYKKWQZ2.js.map

package/dist/{chunk-T6RATUV2.js → chunk-QW3WFHKU.js}

@@ -2,7 +2,7 @@ import {
   OPERATION_NAMES,
   getOperation,
   operationRequiresAuthorizedNamespace
-} from "./chunk-UWIDGVQM.js";
+} from "./chunk-5C2HNJMO.js";
 import {
   assertOperationAuthorizationAllowed
 } from "./chunk-MZWSOLMT.js";
@@ -49,4 +49,4 @@ export {
   probeOperationAuthorization,
   authorizationProbeNamespaces
 };
-//# sourceMappingURL=chunk-T6RATUV2.js.map
+//# sourceMappingURL=chunk-QW3WFHKU.js.map

package/dist/{chunk-PNRA7FAD.js → chunk-RZRUV6N2.js}

@@ -11,6 +11,7 @@ import {
   getRegistryPath
 } from "./chunk-K6MV3TRQ.js";
 import {
+  coerceBool,
   coerceInstallExtension
 } from "./chunk-PQVCH2AE.js";
 import {
@@ -38,6 +39,70 @@ import os from "os";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 
+// src/runtime/http-transport.ts
+import { isIP } from "net";
+function normalizedIp(host) {
+  const value = host.trim().replace(/^\[/, "").replace(/\]\.?$/, "").replace(/\.$/, "");
+  if (isIP(value) === 4) return value;
+  if (isIP(value) !== 6) return "";
+  return new URL(`http://[${value}]/`).hostname.slice(1, -1);
+}
+function isLoopbackHost(host) {
+  const normalized = host.trim().replace(/^\[/, "").replace(/\]\.?$/, "").replace(/\.$/, "").toLowerCase();
+  if (normalized === "localhost" || normalized.endsWith(".localhost")) return true;
+  const ip = normalizedIp(normalized);
+  if (ip === "::1") return true;
+  if (isIP(ip) === 4) return ip.startsWith("127.");
+  if (!ip.startsWith("::ffff:")) return false;
+  const [high, low] = ip.slice("::ffff:".length).split(":");
+  return Number.parseInt(high, 16) >>> 8 === 127 || high === "0" && Number.parseInt(low, 16) >>> 8 === 127;
+}
+function httpProtocolForHost(host, allowInsecureHttp = false) {
+  return isLoopbackHost(host) || allowInsecureHttp ? "http" : "https";
+}
+
+// src/runtime/daemon-health.ts
+var HEALTH_EXIT_OK = 0;
+var HEALTH_EXIT_UNAUTHORIZED = 2;
+function checkDaemonHealth(host, port, authToken, allowInsecureHttp = false) {
+  try {
+    const safePort = Math.trunc(Number(port));
+    if (!Number.isFinite(safePort) || safePort < 1 || safePort > 65535) return false;
+    const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    const script = [
+      "const env = process['env'];",
+      "const protocol = env.REMNIC_HEALTH_PROTOCOL;",
+      "if (protocol !== 'http' && protocol !== 'https') process.exit(1);",
+      "const transport = require(protocol);",
+      "const headers = {};",
+      "if (env.REMNIC_HEALTH_TOKEN) headers['authorization'] = 'Bearer ' + env.REMNIC_HEALTH_TOKEN;",
+      "const req = transport.get({",
+      "  host: env.REMNIC_HEALTH_HOST,",
+      "  port: parseInt(env.REMNIC_HEALTH_PORT, 10),",
+      "  path: '/engram/v1/health', headers, timeout: 3000,",
+      "}, (res) => { process.exit(res.statusCode === 200 ? 0 : res.statusCode === 401 ? 2 : 1); });",
+      "req.on('error', () => process.exit(1));",
+      "req.on('timeout', () => { req.destroy(); process.exit(1); });"
+    ].join("\n");
+    const env = mergeEnv({
+      REMNIC_HEALTH_HOST: bareHost,
+      REMNIC_HEALTH_PORT: String(safePort),
+      REMNIC_HEALTH_PROTOCOL: httpProtocolForHost(host, allowInsecureHttp)
+    });
+    if (authToken) env.REMNIC_HEALTH_TOKEN = authToken;
+    const launchOptions = { timeout: 4e3, env };
+    const result = launchProcessSync(process.execPath, ["-e", script], launchOptions);
+    if (result.status === HEALTH_EXIT_OK) return true;
+    if (result.status !== HEALTH_EXIT_UNAUTHORIZED) return false;
+    console.error("[remnic/connectors] health probe got 401 \u2014 retrying after token cache TTL...");
+    launchProcessSync(process.execPath, ["-e", "setTimeout(() => {}, 6000)"], { timeout: 7e3, env: {} });
+    const retry = launchProcessSync(process.execPath, ["-e", script], launchOptions);
+    return retry.status === HEALTH_EXIT_OK;
+  } catch {
+    return false;
+  }
+}
+
 // src/connectors/hermes-shim.ts
 import fs from "fs";
 import path from "path";
@@ -1208,9 +1273,11 @@ function installConnector(options) {
   let hermesSavedProfile;
   let hermesSavedHost;
   let hermesSavedPort;
+  let hermesSavedAllowInsecureHttp;
   let hermesResolvedProfile;
   let hermesResolvedHost;
   let hermesResolvedPort;
+  let hermesResolvedAllowInsecureHttp = false;
   if (options.connectorId === "hermes") {
     if (fs3.existsSync(configPath)) {
       try {
@@ -1234,11 +1301,15 @@ function installConnector(options) {
           } catch {
           }
         }
+        if (prev?.allow_insecure_http != null) {
+          hermesSavedAllowInsecureHttp = coerceBool(prev.allow_insecure_http, "allow_insecure_http");
+        }
       } catch {
       }
     }
     hermesResolvedProfile = hermesSavedProfile ?? "default";
     hermesResolvedHost = hermesSavedHost ?? "127.0.0.1";
+    hermesResolvedAllowInsecureHttp = hermesSavedAllowInsecureHttp ?? false;
     if (options.config?.port !== void 0) {
       try {
         hermesResolvedPort = sanitizeHermesPort(Number(String(options.config.port)));
@@ -1275,6 +1346,17 @@ function installConnector(options) {
         };
       }
     }
+    if (options.config?.allow_insecure_http !== void 0) {
+      const allowInsecureHttp = coerceBool(options.config.allow_insecure_http, "allow_insecure_http");
+      if (allowInsecureHttp === void 0) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: "Invalid Hermes config: allow_insecure_http must be true or false"
+        };
+      }
+      hermesResolvedAllowInsecureHttp = allowInsecureHttp;
+    }
   }
   const nonHermesPriorTokenStore = options.connectorId !== "hermes" && manifest.requiresToken ? loadTokenStore() : null;
   let tokenEntry = null;
@@ -1317,7 +1399,8 @@ function installConnector(options) {
     ...hermesResolvedProfile !== void 0 ? {
       profile: hermesResolvedProfile,
       host: hermesResolvedHost,
-      port: hermesResolvedPort
+      port: hermesResolvedPort,
+      allow_insecure_http: hermesResolvedAllowInsecureHttp
     } : {}
   };
   if (options.connectorId === "hermes") {
@@ -1356,7 +1439,8 @@ function installConnector(options) {
         profile: hermesProfile,
         host: hermesHost,
         port: hermesPort,
-        token: tokenEntry.token
+        token: tokenEntry.token,
+        allowInsecureHttp: hermesResolvedAllowInsecureHttp
       });
     } catch (err) {
       return {
@@ -1469,7 +1553,8 @@ function installConnector(options) {
           const refresh = upsertHermesConfigAt(priorConfigPath, {
             host: hermesHost,
             port: hermesPort,
-            token: tokenEntry.token
+            token: tokenEntry.token,
+            allowInsecureHttp: hermesResolvedAllowInsecureHttp
           });
           if (refresh.updated) {
             hermesPriorConfigMutations.push({ mutatedPath: priorConfigPath, priorContent: beforeRefresh });
@@ -1680,7 +1765,12 @@ function installConnector(options) {
       }
     }
     if (committed && tokenEntry) {
-      const daemonOk = checkDaemonHealth(hermesHost, hermesPort, tokenEntry.token);
+      const daemonOk = checkDaemonHealth(
+        hermesHost,
+        hermesPort,
+        tokenEntry.token,
+        hermesResolvedAllowInsecureHttp
+      );
       if (daemonOk) {
         notes.push("Daemon health check: OK");
       } else {
@@ -2331,6 +2421,7 @@ function upsertHermesConfigAt(cfgPath, opts) {
   const profileDir = path3.dirname(cfgPath);
   const safeHost = sanitizeHermesHost(opts.host);
   const safePort = sanitizeHermesPort(opts.port);
+  const allowInsecureHttp = opts.allowInsecureHttp ?? false;
   if (!/^[A-Za-z0-9_]+$/.test(opts.token)) {
     throw new Error("Invalid Hermes token: contains non-alphanumeric characters");
   }
@@ -2346,7 +2437,8 @@ function upsertHermesConfigAt(cfgPath, opts) {
     "remnic:",
     `  host: "${safeHost}"`,
     `  port: ${safePort}`,
-    `  token: "${opts.token}"`
+    `  token: "${opts.token}"`,
+    `  allow_insecure_http: ${allowInsecureHttp}`
   ].join("\n");
   if (!fs3.existsSync(cfgPath)) {
     writeSecretFileSync(cfgPath, block + "\n");
@@ -2367,7 +2459,7 @@ function upsertHermesConfigAt(cfgPath, opts) {
   const newLines = [];
   let inRemnicBlock = false;
   let blockWritten = false;
-  const written = { host: false, port: false, token: false };
+  const written = { host: false, port: false, token: false, allowInsecureHttp: false };
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     if (/^remnic:/.test(line)) {
@@ -2380,6 +2472,7 @@ function upsertHermesConfigAt(cfgPath, opts) {
         if (!written.host) newLines.push(`  host: "${safeHost}"`);
         if (!written.port) newLines.push(`  port: ${safePort}`);
         if (!written.token) newLines.push(`  token: "${opts.token}"`);
+        if (!written.allowInsecureHttp) newLines.push(`  allow_insecure_http: ${allowInsecureHttp}`);
         blockWritten = true;
         inRemnicBlock = false;
         newLines.push(line);
@@ -2394,6 +2487,9 @@ function upsertHermesConfigAt(cfgPath, opts) {
       } else if (/^\s+token:/.test(line)) {
         newLines.push(`  token: "${opts.token}"`);
         written.token = true;
+      } else if (/^\s+allow_insecure_http:/.test(line)) {
+        newLines.push(`  allow_insecure_http: ${allowInsecureHttp}`);
+        written.allowInsecureHttp = true;
       } else {
         newLines.push(line);
       }
@@ -2405,6 +2501,7 @@ function upsertHermesConfigAt(cfgPath, opts) {
     if (!written.host) newLines.push(`  host: "${safeHost}"`);
     if (!written.port) newLines.push(`  port: ${safePort}`);
     if (!written.token) newLines.push(`  token: "${opts.token}"`);
+    if (!written.allowInsecureHttp) newLines.push(`  allow_insecure_http: ${allowInsecureHttp}`);
   }
   writeSecretFileSync(cfgPath, newLines.join("\n") + "\n");
   return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
@@ -2535,61 +2632,6 @@ function removeHermesConfigFile(cfgPath) {
   writeSecretFileSync(cfgPath, newLines.length > 0 ? newLines.join("\n") + "\n" : "");
   return { updated: true, skipped: false, configPath: cfgPath };
 }
-var HEALTH_EXIT_OK = 0;
-var HEALTH_EXIT_UNAUTHORIZED = 2;
-function checkDaemonHealth(host, port, authToken) {
-  try {
-    const safePort = Math.trunc(Number(port));
-    if (!Number.isFinite(safePort) || safePort < 1 || safePort > 65535) {
-      return false;
-    }
-    const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-    const script = [
-      "const http = require('http');",
-      "const env = process['env'];",
-      "const headers = {};",
-      "if (env.REMNIC_HEALTH_TOKEN) {",
-      "  headers['authorization'] = 'Bearer ' + env.REMNIC_HEALTH_TOKEN;",
-      "}",
-      "const req = http.get({",
-      "  host: env.REMNIC_HEALTH_HOST,",
-      "  port: parseInt(env.REMNIC_HEALTH_PORT, 10),",
-      "  path: '/engram/v1/health',",
-      "  headers,",
-      "  timeout: 3000,",
-      "}, (res) => { process.exit(res.statusCode === 200 ? 0 : res.statusCode === 401 ? 2 : 1); });",
-      "req.on('error', () => process.exit(1));",
-      "req.on('timeout', () => { req.destroy(); process.exit(1); });"
-    ].join("\n");
-    const env = mergeEnv({
-      REMNIC_HEALTH_HOST: bareHost,
-      REMNIC_HEALTH_PORT: String(safePort)
-    });
-    if (authToken) {
-      env.REMNIC_HEALTH_TOKEN = authToken;
-    }
-    const processPath = process.execPath;
-    const launchOptions = { timeout: 4e3, env };
-    const result = launchProcessSync(processPath, ["-e", script], launchOptions);
-    if (result.status === HEALTH_EXIT_OK) {
-      return true;
-    }
-    if (result.status === HEALTH_EXIT_UNAUTHORIZED) {
-      console.error(
-        "[remnic/connectors] health probe got 401 \u2014 retrying after token cache TTL..."
-      );
-      launchProcessSync(processPath, ["-e", "setTimeout(() => {}, 6000)"], {
-        timeout: 7e3,
-        env: {}
-      });
-      const retry = launchProcessSync(processPath, ["-e", script], launchOptions);
-      return retry.status === HEALTH_EXIT_OK;
-    }
-    return false;
-  } catch {
-    return false;
-  }
-}
 async function doctorConnector(connectorId) {
   const installed = listConnectors().installed;
   const instance = installed.find((c) => c.connectorId === connectorId);
@@ -3032,4 +3074,4 @@ export {
   resolveWeCloneProxyConfigPath,
   buildWeCloneProxyConfig
 };
-//# sourceMappingURL=chunk-PNRA7FAD.js.map
+//# sourceMappingURL=chunk-RZRUV6N2.js.map