@remnic/core 9.69.39 → 9.69.41

package/src/cli/deep-recall-commands.ts

@@ -4,20 +4,20 @@
  * meetings-commands.ts). `engram deep-recall <query>` runs the budgeted
  * REFINE/EXPAND/STOP loop through EngramAccessService — the same single
  * implementation MCP and HTTP call.
+ *
+ * Identity (issue #2915): with namespaces enabled the read path requires an
+ * authenticated principal, and this standalone CLI runs without a transport
+ * to authenticate one. It therefore exposes the SAME identity pattern the
+ * access CLI already uses — `--principal` (the authenticated identity) or
+ * `--session-key` (resolved through the configured principal mapping) — so a
+ * namespace-enabled deployment is usable from the CLI instead of refusing
+ * every invocation as unauthenticated.
  */
 
 import type { Orchestrator } from "../orchestrator.js";
 import type { CliCommand } from "../cli.js";
 import { EngramAccessService } from "../access-service.js";
-
-function parseMaxSteps(raw: unknown): number | undefined {
-  if (raw === undefined || raw === null) return undefined;
-  const value = typeof raw === "string" ? Number(raw) : raw;
-  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
-    throw new Error(`--max-steps must be a non-negative integer; got ${JSON.stringify(raw)}`);
-  }
-  return value;
-}
+import { parseDeepRecallMaxSteps } from "../deep-recall-config.js";
 
 export function registerDeepRecallCommands(cmd: CliCommand, orchestrator: Orchestrator): void {
   cmd
@@ -25,18 +25,28 @@ export function registerDeepRecallCommands(cmd: CliCommand, orchestrator: Orches
     .description("Budgeted multi-hop retrieval over the anchor graph (slow, thorough; issue #2332)")
     .option("--max-steps <n>", "Policy-step ceiling (cannot exceed the configured deepRecall.maxSteps)")
     .option("--namespace <ns>", "Namespace to scope the retrieval to")
+    .option("--session-key <key>", "Session key for principal/namespace resolution (namespaces enabled)")
+    .option("--principal <principal>", "Authenticated principal for namespace authorization (namespaces enabled)")
     .option("--json", "JSON output (full entries + trace)")
     .action(async (...args: unknown[]) => {
       const query = String(args[0] ?? "");
       const options = (args[args.length - 1] ?? {}) as Record<string, unknown>;
       let maxSteps: number | undefined;
       try {
-        maxSteps = parseMaxSteps(options.maxSteps);
+        maxSteps = parseDeepRecallMaxSteps(options.maxSteps);
       } catch (err) {
         console.error(err instanceof Error ? err.message : String(err));
         process.exitCode = 1;
         return;
       }
+      const sessionKey =
+        typeof options.sessionKey === "string" && options.sessionKey.trim().length > 0
+          ? options.sessionKey.trim()
+          : undefined;
+      const principal =
+        typeof options.principal === "string" && options.principal.trim().length > 0
+          ? options.principal.trim()
+          : undefined;
       const service = new EngramAccessService(orchestrator);
       try {
         const result = await service.deepRecall({
@@ -45,6 +55,8 @@ export function registerDeepRecallCommands(cmd: CliCommand, orchestrator: Orches
           ...(typeof options.namespace === "string" && options.namespace.length > 0
             ? { namespace: options.namespace }
             : {}),
+          ...(sessionKey !== undefined ? { sessionKey } : {}),
+          ...(principal !== undefined ? { authenticatedPrincipal: principal } : {}),
         });
         if (options.json === true) {
           console.log(JSON.stringify(result, null, 2));

package/src/cli/timeline-publish-commands.ts

@@ -23,6 +23,15 @@ export function registerTimelineCommands(cmd: CliCommand, orchestrator: Orchestr
     .option("--what <kinds>", "Comma-separated artifacts to publish (default: timeline)")
     .option("--dry-run", "Report per-file outcomes without writing")
     .action((...args: unknown[]) => {
+      // Commander passes declared positional args before the options
+      // object; `publish` declares none, so a stray positional would
+      // displace the options object and silently publish with defaults
+      // (issue #2917). Reject any string arg outright.
+      if (args.some((arg) => typeof arg === "string")) {
+        process.stderr.write("timeline publish takes no positional arguments.\n");
+        process.exitCode = 1;
+        return;
+      }
       const options = (args[0] ?? {}) as Record<string, unknown>;
       const code = runTimelinePublishCli(orchestrator.config, options, {
         stdout: process.stdout,

package/src/config.test.ts

@@ -2724,21 +2724,88 @@ test("parseConfig coerces string-typed sharedContextAllowBindingAuthority from t
     );
   }
 });
+test("parseConfig coerces string-typed sharedContextEnabled from the CLI", () => {
+  // `--config sharedContextEnabled=true` arrives as a string, so a strict
+  // `=== true` silently left the feature off for anyone who enabled it.
+  // Parity with sharedContextAllowBindingAuthority (issue #2918).
+  // The default recall-pipeline shared-context gate must use the same
+  // coerced boolean — string true with no custom pipeline enables the
+  // section; false/malformed stay off.
+  for (const enabled of ["true", "1", "yes", "on", true]) {
+    const parsed = parseConfig({ sharedContextEnabled: enabled });
+    assert.equal(
+      parsed.sharedContextEnabled,
+      true,
+      `${JSON.stringify(enabled)} must enable shared context`,
+    );
+    assert.equal(
+      parsed.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+      true,
+      `${JSON.stringify(enabled)} must enable the default shared-context section`,
+    );
+  }
+  for (const disabled of ["false", "0", "no", "off", false, undefined, "", "garbage"]) {
+    const parsed = parseConfig({ sharedContextEnabled: disabled });
+    assert.equal(
+      parsed.sharedContextEnabled,
+      false,
+      `${JSON.stringify(disabled)} must leave shared context off (malformed input never activates)`,
+    );
+    assert.equal(
+      parsed.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+      false,
+      `${JSON.stringify(disabled)} must leave the default shared-context section off`,
+    );
+  }
+});
+
+test("custom recallPipeline keeps operator shared-context enabled (#2918)", () => {
+  const customOff = parseConfig({
+    sharedContextEnabled: "true",
+    recallPipeline: [{ id: "shared-context", enabled: false, maxChars: 1000 }],
+  });
+  assert.equal(customOff.sharedContextEnabled, true);
+  assert.equal(
+    customOff.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+    false,
+    "custom pipeline must not silently activate shared-context",
+  );
+
+  const customOn = parseConfig({
+    sharedContextEnabled: "false",
+    recallPipeline: [{ id: "shared-context", enabled: true, maxChars: 1000 }],
+  });
+  assert.equal(customOn.sharedContextEnabled, false);
+  assert.equal(
+    customOn.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+    true,
+    "custom pipeline enabled stays as specified",
+  );
+});
 
-test("parseConfig consumes backgroundGeneration and leaves openaiBaseUrl untouched", () => {
+
+test("parseConfig consumes llmBridgeClientConfigPath into backgroundGeneration only", () => {
   withIsolatedConnectorsDir(false, () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-client-"));
     const previousKey = process.env.OPENAI_API_KEY;
     const previousBase = process.env.OPENAI_BASE_URL;
     delete process.env.OPENAI_API_KEY;
     delete process.env.OPENAI_BASE_URL;
     try {
-      const parsed = parseConfig({
-        backgroundGeneration: {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
           endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+          health_endpoint: "http://127.0.0.1:8765/healthz",
+          bind: "127.0.0.1",
+          model_policy: "server-owned",
+          max_body_bytes: 524288,
+          timeout_seconds: 120,
           token: "bridge-token-fixture",
-          timeoutSeconds: 120,
-        },
-      });
+        }),
+      );
+      const parsed = parseConfig({ llmBridgeClientConfigPath: file });
       assert.equal(parsed.openaiBaseUrl, undefined);
       assert.equal(parsed.openaiApiKey, undefined);
       assert.deepEqual(parsed.backgroundGeneration, {
@@ -2748,11 +2815,7 @@ test("parseConfig consumes backgroundGeneration and leaves openaiBaseUrl untouch
       });
 
       const explicitOpenAi = parseConfig({
-        backgroundGeneration: {
-          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
-          token: "bridge-token-fixture",
-          timeoutSeconds: 120,
-        },
+        llmBridgeClientConfigPath: file,
         openaiBaseUrl: "http://127.0.0.1:9999/v1",
         openaiApiKey: "keep-me",
       });
@@ -2762,65 +2825,78 @@ test("parseConfig consumes backgroundGeneration and leaves openaiBaseUrl untouch
         explicitOpenAi.backgroundGeneration?.endpoint,
         "http://127.0.0.1:8765/v1/chat/completions",
       );
+
+      const explicitBg = parseConfig({
+        backgroundGeneration: {
+          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+          token: "explicit-token",
+          timeoutSeconds: 30,
+        },
+      });
+      assert.equal(explicitBg.openaiBaseUrl, undefined);
+      assert.deepEqual(explicitBg.backgroundGeneration, {
+        endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+        token: "explicit-token",
+        timeoutSeconds: 30,
+      });
     } finally {
       if (previousKey === undefined) delete process.env.OPENAI_API_KEY;
       else process.env.OPENAI_API_KEY = previousKey;
       if (previousBase === undefined) delete process.env.OPENAI_BASE_URL;
       else process.env.OPENAI_BASE_URL = previousBase;
+      rmSync(dir, { recursive: true, force: true });
     }
   });
 });
 
-test("parseConfig ignores llmBridgeClientConfigPath", () => {
-  withIsolatedConnectorsDir(false, () => {
-    const parsed = parseConfig({
-      llmBridgeClientConfigPath: "/no/such/remnic-llm-bridge-client.json",
-    });
-    assert.equal(parsed.backgroundGeneration, undefined);
-  });
-});
-
-test("parseConfig rejects backgroundGeneration without a token", () => {
+test("parseConfig rejects an unreadable llmBridgeClientConfigPath", () => {
   withIsolatedConnectorsDir(false, () => {
     assert.throws(
-      () =>
-        parseConfig({
-          backgroundGeneration: {
-            endpoint: "http://127.0.0.1:8765/v1/chat/completions",
-          },
-        }),
-      /must include a token/,
+      () => parseConfig({ llmBridgeClientConfigPath: "/no/such/remnic-llm-bridge-client.json" }),
+      /llmBridgeClientConfigPath could not be read/,
     );
   });
 });
 
-test("parseConfig ignores Hermes timeout_seconds on backgroundGeneration", () => {
+test("parseConfig rejects a bridge client file without a token", () => {
   withIsolatedConnectorsDir(false, () => {
-    const parsed = parseConfig({
-      backgroundGeneration: {
-        endpoint: "http://127.0.0.1:8765/v1/chat/completions",
-        token: "bridge-token-fixture",
-        timeout_seconds: 45,
-      },
-    });
-    assert.equal(parsed.backgroundGeneration?.timeoutSeconds, 120);
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-client-"));
+    try {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
+          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+        }),
+      );
+      assert.throws(
+        () => parseConfig({ llmBridgeClientConfigPath: file }),
+        /must include a token/,
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
   });
 });
 
-test("parseConfig keeps env openaiBaseUrl isolated from backgroundGeneration", () => {
+test("parseConfig keeps env openaiBaseUrl isolated from the Hermes bridge", () => {
   withIsolatedConnectorsDir(false, () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-env-"));
     const previousKey = process.env.OPENAI_API_KEY;
     const previousBase = process.env.OPENAI_BASE_URL;
     process.env.OPENAI_API_KEY = "env-openai-key";
     process.env.OPENAI_BASE_URL = "http://127.0.0.1:9999/v1";
     try {
-      const parsed = parseConfig({
-        backgroundGeneration: {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
           endpoint: "http://127.0.0.1:8765/v1/chat/completions",
           token: "bridge-token-fixture",
-          timeoutSeconds: 45,
-        },
-      });
+          timeout_seconds: 45,
+        }),
+      );
+      const parsed = parseConfig({ llmBridgeClientConfigPath: file });
       assert.equal(parsed.openaiBaseUrl, "http://127.0.0.1:9999/v1");
       assert.equal(parsed.openaiApiKey, "env-openai-key");
       assert.deepEqual(parsed.backgroundGeneration, {
@@ -2833,6 +2909,57 @@ test("parseConfig keeps env openaiBaseUrl isolated from backgroundGeneration", (
       else process.env.OPENAI_API_KEY = previousKey;
       if (previousBase === undefined) delete process.env.OPENAI_BASE_URL;
       else process.env.OPENAI_BASE_URL = previousBase;
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+test("parseConfig rejects nonnumeric bridge timeout values", () => {
+  withIsolatedConnectorsDir(false, () => {
+    assert.throws(
+      () =>
+        parseConfig({
+          backgroundGeneration: {
+            endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+            token: "t",
+            timeoutSeconds: true,
+          },
+        }),
+      /timeoutSeconds must be a finite number/,
+    );
+    assert.throws(
+      () =>
+        parseConfig({
+          backgroundGeneration: {
+            endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+            token: "t",
+            timeout_seconds: "45",
+          },
+        }),
+      /timeoutSeconds must be a finite number/,
+    );
+  });
+});
+
+test("parseConfig rejects a bridge client file with a nonnumeric timeout", () => {
+  withIsolatedConnectorsDir(false, () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-badtimeout-"));
+    try {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
+          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+          token: "bridge-token-fixture",
+          timeout_seconds: "45",
+        }),
+      );
+      assert.throws(
+        () => parseConfig({ llmBridgeClientConfigPath: file }),
+        /timeoutSeconds must be a finite number/,
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
     }
   });
 });

package/src/config.ts

@@ -25,6 +25,7 @@ import type {
   TriggerMode,
   TrustWeights,
 } from "./types.js";
+import { parseBackgroundGeneration } from "./background-generation-config.js";
 import { parseLocalLlmConfig } from "./local-llm-config.js";
 import { parseConvergeConfig } from "./converge-config.js";
 import { parseExternalWikiRecallGuard } from "./external-wiki-guard.js";
@@ -519,6 +520,7 @@ function normalizeOpenaiBaseUrl(value: string | undefined, source: "config" | "e
   return url;
 }
 
+
 function normalizeMemoryRelativeDir(raw: unknown, fallback: string): string {
   if (typeof raw !== "string") return fallback;
   const trimmed = raw.trim();
@@ -1482,6 +1484,7 @@ export function parseConfig(
   } else if (apiKey !== undefined) {
     baseUrl = normalizeOpenaiBaseUrl(readEnvVar("OPENAI_BASE_URL"), "env");
   }
+  const backgroundGeneration = parseBackgroundGeneration(cfg, resolveEnvVars);
 
   const sharedCrossSignalSemanticEnabled =
     cfg.sharedCrossSignalSemanticEnabled === true || cfg.crossSignalsSemanticEnabled === true;
@@ -1491,7 +1494,15 @@ export function parseConfig(
       : typeof cfg.crossSignalsSemanticTimeoutMs === "number"
         ? Math.max(1, Math.floor(cfg.crossSignalsSemanticTimeoutMs))
         : 4000;
-  const recallPipelineConfig = buildRecallPipelineConfig(cfg);
+  // Coerce once. The default recall-pipeline shared-context gate reads
+  // `cfg.sharedContextEnabled === true`, so it must see this boolean —
+  // not the raw CLI/config string. Custom `recallPipeline` is unchanged.
+  const sharedContextEnabled =
+    coerceBool(cfg.sharedContextEnabled, "sharedContextEnabled") ?? false;
+  const recallPipelineConfig = buildRecallPipelineConfig({
+    ...cfg,
+    sharedContextEnabled,
+  });
   const maintenanceNamespaceFanoutEnabled = resolveBooleanConfig(
     readFlatOrNestedConfig(
       cfg,
@@ -1560,6 +1571,7 @@ export function parseConfig(
   return {
     openaiApiKey: apiKey,
     openaiBaseUrl: baseUrl,
+    backgroundGeneration,
     model,
     reasoningEffort,
     triggerMode,
@@ -2784,6 +2796,11 @@ export function parseConfig(
       cfg.inlineSourceAttributionFormat.trim().length > 0
         ? cfg.inlineSourceAttributionFormat
         : "[Source: agent={agent}, session={sessionId}, ts={ts}]",
+    inlineSourceAttributionFormatHistory: Array.isArray(cfg.inlineSourceAttributionFormatHistory)
+      ? (cfg.inlineSourceAttributionFormatHistory as unknown[])
+          .filter((value): value is string => typeof value === "string" && value.trim().length > 0)
+          .map((value) => value.trim())
+      : [],
     consolidationRequireNonZeroExtraction: cfg.consolidationRequireNonZeroExtraction !== false,
     // Issue #678 PR 2/4: dreams.phases.rem.minIntervalMs WINS when set.
     consolidationMinIntervalMs: dreamsRem.minIntervalMs,
@@ -3003,10 +3020,9 @@ export function parseConfig(
         ? cfg.routingRulesStateFile.trim()
         : "state/routing-rules.json",
 
-    // v4.0 shared-context (default off)
-    sharedContextEnabled: cfg.sharedContextEnabled === true,
-    // CLI values arrive as strings (`--config sharedContextAllowBindingAuthority=true`),
-    // so a strict `=== true` silently keeps the feature off. Default stays false.
+    // Reuse the hoisted coerce above (default pipeline already saw it).
+    sharedContextEnabled,
+    // Same coercion contract for the binding-authority sibling (#2918 parity).
     sharedContextAllowBindingAuthority:
       coerceBool(cfg.sharedContextAllowBindingAuthority, "sharedContextAllowBindingAuthority") ?? false,
     sharedContextDir:
@@ -4217,6 +4233,7 @@ function buildDefaultRecallPipeline(cfg: Record<string, unknown>): RecallSection
   return [
     {
       id: "shared-context",
+      // Already coerced in parseConfig; do not coerce again.
       enabled: cfg.sharedContextEnabled === true,
       maxChars:
         typeof cfg.sharedContextMaxInjectChars === "number"