@remnic/plugin-codex 9.45.5 → 9.46.1

package/README.md

@@ -107,9 +107,26 @@ export REMNIC_DAEMON_URL="http://macstudio.tail-XXXX.ts.net:4318"
   namespace to the compaction flush (parity with `@remnic/plugin-pi`'s
   `config.namespace`). Unset → the daemon resolves the default namespace.
 
-The bearer token still comes from the per-plugin token store
-(`remnic connectors install codex-cli` writes `~/.remnic/tokens.json`) or the
-`OPENCLAW_REMNIC_ACCESS_TOKEN` / `OPENCLAW_ENGRAM_ACCESS_TOKEN` env vars.
+The bearer token is resolved in this order:
+
+1. The per-plugin token store — `remnic connectors install codex-cli` writes
+   `~/.remnic/tokens.json`; legacy `~/.engram/tokens.json` is read as a
+   fallback.
+2. `OPENCLAW_REMNIC_ACCESS_TOKEN`, then `REMNIC_AUTH_TOKEN`.
+3. Legacy aliases: `OPENCLAW_ENGRAM_ACCESS_TOKEN`, then `ENGRAM_AUTH_TOKEN`.
+
+Current names outrank legacy ones, so a leftover pre-rename value cannot
+shadow the credential the daemon is actually running with. `REMNIC_AUTH_TOKEN`
+covers the standalone-server setup, which authenticates the daemon with that
+variable and never mints a connector token. Against an auth-gated
+daemon the hook needs one of these: every route, including
+`/engram/v1/health`, returns 401 without a bearer, so an unauthenticated hook
+reports `daemon not running` and silently skips auto-recall and auto-observe.
+
+`REMNIC_HOOK_TOKEN` is not part of this chain — it is an internal channel the
+foreground hook uses to hand its already-resolved token to the detached
+observe worker, so the worker does not re-read the token store. Nothing in
+the foreground path reads it.
 
 ## Hook trust (one-time review)
 

package/hooks/bin/remnic-codex-hook.cjs

@@ -220,6 +220,13 @@ function onPath(bin) {
 }
 
 // ── token resolution (per-plugin token store, then env) ────────────────────
+// Env precedence is primary-before-legacy per AGENTS.md §9: the two current
+// names (OPENCLAW_REMNIC_ACCESS_TOKEN, REMNIC_AUTH_TOKEN) before the two
+// legacy aliases (OPENCLAW_ENGRAM_ACCESS_TOKEN, ENGRAM_AUTH_TOKEN), so a
+// stale leftover from a pre-rename install cannot outrank the credential the
+// daemon is actually running with. REMNIC_AUTH_TOKEN matters because the
+// documented standalone-server setup authenticates the daemon with it alone
+// and never mints a connector token.
 function resolveToken() {
   for (const file of [
     path.join(HOME, ".remnic", "tokens.json"),
@@ -245,7 +252,9 @@ function resolveToken() {
   }
   return (
     process.env.OPENCLAW_REMNIC_ACCESS_TOKEN ||
+    process.env.REMNIC_AUTH_TOKEN ||
     process.env.OPENCLAW_ENGRAM_ACCESS_TOKEN ||
+    process.env.ENGRAM_AUTH_TOKEN ||
     ""
   );
 }
@@ -334,7 +343,17 @@ function httpPost(urlPath, token, bodyObj, timeoutMs) {
   });
 }
 
-function httpHealthy(timeoutMs) {
+// `token` is the caller's already-resolved credential, NOT a second
+// resolveToken() call: the probe must authenticate with the exact bearer the
+// operation it gates will send. Re-resolving could pick up a rotated
+// tokens.json (or an inherited REMNIC_HOOK_TOKEN the foreground handlers
+// ignore) and green-light a probe whose recall then 401s.
+//
+// When the daemon has an auth token configured, every route — including
+// /engram/v1/health — returns 401 to unauthenticated requests, so an
+// unauthenticated probe makes the hook wrongly report "daemon not running"
+// and skip recall/observe. Unauthenticated daemons ignore the header.
+function httpHealthy(timeoutMs, token) {
   if (DAEMON_URL === null) return Promise.resolve(false);
   const transport = DAEMON_URL.protocol === "https:" ? https : http;
   return new Promise((resolve) => {
@@ -345,6 +364,7 @@ function httpHealthy(timeoutMs) {
         port: DAEMON_URL.port || (DAEMON_URL.protocol === "https:" ? 443 : 80),
         path: DAEMON_BASE_PATH + "/engram/v1/health",
         method: "GET",
+        headers: token ? { Authorization: `Bearer ${token}` } : {},
       },
       (res) => {
         res.resume();
@@ -658,7 +678,7 @@ async function handleSessionStart(input, token, log) {
   log(`session=${sessionId} project=${projectName} coding-context=${codingContext ? "yes" : ""}`);
 
   // Health check — start daemon if not running.
-  if (!(await httpHealthy(2000))) {
+  if (!(await httpHealthy(2000, token))) {
     log("daemon not responding, attempting start...");
     // Try `remnic` first, fall through to legacy `engram` when only the older
     // CLI is on PATH. spawn() emits ENOENT *asynchronously* via 'error', so we
@@ -683,7 +703,7 @@ async function handleSessionStart(input, token, log) {
       }
     }
     await new Promise((r) => setTimeout(r, 2000));
-    if (!(await httpHealthy(2000))) {
+    if (!(await httpHealthy(2000, token))) {
       log("daemon still not responding after start attempt");
       emit({
         continue: true,

package/hooks/bin/remnic-codex-hook.test.cjs

@@ -48,12 +48,12 @@ function mkHome() {
 // stays free to answer the runner's requests while it runs.
 function runHook(event, input, { port, home, env = {} } = {}) {
   return new Promise((resolve) => {
-    // When a test asks for "no token" (env.token === null) we must clear BOTH
-    // token env vars — the runner's resolveToken() falls through from
-    // OPENCLAW_REMNIC_ACCESS_TOKEN to OPENCLAW_ENGRAM_ACCESS_TOKEN, and the
-    // parent process (a real dev shell) often has the latter set, which
-    // previously leaked through `...process.env` and made the no-token
-    // assertions fail outside CI (#1571 test-harness hygiene).
+    // Every env name resolveToken() consults is pinned below — including the
+    // canonical REMNIC_AUTH_TOKEN / ENGRAM_AUTH_TOKEN pair — so a value from
+    // the parent process (a real dev shell, or CI authenticating a local
+    // daemon) cannot leak through `...process.env` and make the no-token
+    // assertions fail outside CI (#1571 test-harness hygiene). Tests that want
+    // a specific name set it via env.extra, which spreads last.
     const noToken = env.token === null;
     const child = spawn(process.execPath, [RUNNER, event], {
       env: {
@@ -65,7 +65,12 @@ function runHook(event, input, { port, home, env = {} } = {}) {
         REMNIC_PORT: String(port),
         REMNIC_CODEX_MATERIALIZE: "0",
         OPENCLAW_REMNIC_ACCESS_TOKEN: noToken ? "" : env.token || "test-token",
-        OPENCLAW_ENGRAM_ACCESS_TOKEN: noToken ? "" : "",
+        OPENCLAW_ENGRAM_ACCESS_TOKEN: "",
+        REMNIC_AUTH_TOKEN: "",
+        ENGRAM_AUTH_TOKEN: "",
+        // Internal worker-propagation channel, not a user credential. Pinned
+        // so an inherited value cannot reach the detached observe worker.
+        REMNIC_HOOK_TOKEN: "",
         // Clear daemon URL env so a developer shell with REMNIC_DAEMON_URL set
         // can't route tests away from the mock server. Tests that WANT a daemon
         // URL override it via env.extra (which spreads last).
@@ -1092,3 +1097,179 @@ test("pre-compact: REMNIC_PRECOMPACT_LOCK_RETRIES=0 still takes a FREE lock (doe
     fs.rmSync(home, { recursive: true, force: true });
   }
 });
+
+// ── daemon auth: health probe + canonical env credentials ──────────────────
+// An auth-gated daemon 401s EVERY route, including /engram/v1/health. An
+// unauthenticated probe therefore makes the hook report "daemon not running"
+// and skip recall/observe entirely. The credential itself has to be findable:
+// the documented standalone-server setup authenticates the daemon with
+// REMNIC_AUTH_TOKEN and never mints a connector token, so resolveToken() must
+// accept the canonical names as well as the connector-scoped OPENCLAW_* pair.
+
+function authServer() {
+  const seen = { health: "unset", recall: "unset" };
+  return startServer((req, res) => {
+    if (req.url === "/engram/v1/health") {
+      seen.health = req.headers.authorization || null;
+      return res.writeHead(200).end("ok");
+    }
+    if (req.url === "/engram/v1/recall") {
+      seen.recall = req.headers.authorization || null;
+      return res
+        .writeHead(200, { "Content-Type": "application/json" })
+        .end(JSON.stringify({ context: "ctx", count: 1, mode: "auto" }));
+    }
+    res.writeHead(404).end();
+  }).then((started) => ({ ...started, seen }));
+}
+
+test("session-start: health probe carries the bearer token (auth-gated daemons)", async () => {
+  const home = mkHome();
+  const { server, port, seen } = await authServer();
+  try {
+    await runHook("session-start", { session_id: "sAuth", cwd: home }, { port, home });
+    assert.equal(seen.health, "Bearer test-token");
+  } finally {
+    server.close();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+for (const name of ["REMNIC_AUTH_TOKEN", "ENGRAM_AUTH_TOKEN"]) {
+  test(`token resolution: ${name} authenticates health and recall (no token store)`, async () => {
+    const home = mkHome();
+    const { server, port, seen } = await authServer();
+    try {
+      const res = await runHook(
+        "session-start",
+        { session_id: "sEnv", cwd: home },
+        { port, home, env: { token: null, extra: { [name]: "operator-secret" } } },
+      );
+      assert.equal(seen.health, "Bearer operator-secret");
+      assert.equal(seen.recall, "Bearer operator-secret");
+      assert.doesNotMatch(
+        res.json.hookSpecificOutput.additionalContext,
+        /daemon not running/,
+        "an authenticated daemon must not be reported as down",
+      );
+    } finally {
+      server.close();
+      fs.rmSync(home, { recursive: true, force: true });
+    }
+  });
+}
+
+test("token resolution: OPENCLAW_REMNIC_ACCESS_TOKEN outranks REMNIC_AUTH_TOKEN", async () => {
+  const home = mkHome();
+  const { server, port, seen } = await authServer();
+  try {
+    await runHook(
+      "session-start",
+      { session_id: "sPrec", cwd: home },
+      { port, home, env: { token: "connector-tok", extra: { REMNIC_AUTH_TOKEN: "operator-secret" } } },
+    );
+    // Both are current names; the connector-scoped one stays first, so an
+    // install that already worked keeps its existing credential.
+    assert.equal(seen.health, "Bearer connector-tok");
+  } finally {
+    server.close();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("token resolution: REMNIC_AUTH_TOKEN outranks the legacy OPENCLAW_ENGRAM_ACCESS_TOKEN", async () => {
+  const home = mkHome();
+  const { server, port, seen } = await authServer();
+  try {
+    await runHook(
+      "session-start",
+      { session_id: "sLegacyPrec", cwd: home },
+      {
+        port,
+        home,
+        env: {
+          token: null,
+          extra: {
+            OPENCLAW_ENGRAM_ACCESS_TOKEN: "stale-legacy-tok",
+            REMNIC_AUTH_TOKEN: "operator-secret",
+          },
+        },
+      },
+    );
+    // Primary-before-legacy (AGENTS.md §9). A migrated deployment often still
+    // exports the pre-rename alias; if that stale value outranked the token
+    // the daemon actually runs with, the probe would 401 and land back on
+    // "daemon not running".
+    assert.equal(seen.health, "Bearer operator-secret");
+  } finally {
+    server.close();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("token resolution: tokens.json still outranks REMNIC_AUTH_TOKEN", async () => {
+  const home = mkHome();
+  fs.mkdirSync(path.join(home, ".remnic"), { recursive: true });
+  fs.writeFileSync(
+    path.join(home, ".remnic", "tokens.json"),
+    JSON.stringify({ tokens: [{ connector: "codex-cli", token: "codex-tok" }] }),
+  );
+  const { server, port, seen } = await authServer();
+  try {
+    await runHook(
+      "session-start",
+      { session_id: "sStore", cwd: home },
+      { port, home, env: { token: null, extra: { REMNIC_AUTH_TOKEN: "operator-secret" } } },
+    );
+    assert.equal(seen.health, "Bearer codex-tok");
+  } finally {
+    server.close();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("token resolution: REMNIC_AUTH_TOKEN outranks ENGRAM_AUTH_TOKEN when both are set", async () => {
+  const home = mkHome();
+  const { server, port, seen } = await authServer();
+  try {
+    await runHook(
+      "session-start",
+      { session_id: "sBothCanonical", cwd: home },
+      {
+        port,
+        home,
+        env: {
+          token: null,
+          extra: { REMNIC_AUTH_TOKEN: "current-tok", ENGRAM_AUTH_TOKEN: "legacy-tok" },
+        },
+      },
+    );
+    assert.equal(seen.health, "Bearer current-tok");
+    assert.equal(seen.recall, "Bearer current-tok");
+  } finally {
+    server.close();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("health probe uses the same bearer as the operation it gates", async () => {
+  const home = mkHome();
+  const { server, port, seen } = await authServer();
+  try {
+    // REMNIC_HOOK_TOKEN is the detached observe worker's internal propagation
+    // channel; the foreground handlers never read it. If the probe consulted
+    // it, an inherited value would authenticate health with one bearer while
+    // recall sent another — a false "healthy" followed by a 401, or the
+    // reverse. Probe and operation must carry one snapshot.
+    await runHook(
+      "session-start",
+      { session_id: "sSnapshot", cwd: home },
+      { port, home, env: { extra: { REMNIC_HOOK_TOKEN: "inherited-worker-tok" } } },
+    );
+    assert.equal(seen.health, "Bearer test-token");
+    assert.equal(seen.recall, seen.health);
+  } finally {
+    server.close();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/plugin-codex",
-  "version": "9.45.5",
+  "version": "9.46.1",
   "description": "Remnic memory plugin for Codex CLI — hooks, skills, MCP integration",
   "type": "module",
   "license": "MIT",
@@ -30,6 +30,6 @@
     ".mcp.json"
   ],
   "dependencies": {
-    "@remnic/core": "^9.45.5"
+    "@remnic/core": "^9.46.1"
   }
 }