@remnic/plugin-openclaw 9.57.3 → 9.57.4

package/dist/index.js

@@ -5412,10 +5412,10 @@ function runHealthWorker(request, data) {
   const READINESS_RETRY_MS = 250;
   const view = new Int32Array(data.state);
   let completed = false;
-  function finish(ok, rejectedAuth = false) {
+  function finish(ok, rejectedAuth = false, httpFailure = false) {
     if (completed) return;
     completed = true;
-    Atomics.store(view, 0, ok ? 1 : rejectedAuth ? 3 : 2);
+    Atomics.store(view, 0, ok ? 1 : rejectedAuth ? 3 : httpFailure ? 4 : 2);
     Atomics.notify(view, 0);
   }
   function probe(pathname, fallbackPath) {
@@ -5480,7 +5480,7 @@ function runHealthWorker(request, data) {
           } else if (statusCode === 401 || statusCode === 403) {
             finish(false, true);
           } else {
-            finish(false);
+            finish(false, false, true);
           }
         }
       );
@@ -6256,8 +6256,11 @@ function coerceDaemonPort(value) {
 }
 var DAEMON_CAPTURE_BYTES = 1024;
 function probeDaemonSync(options) {
+  const auth = options.authToken === void 0 ? loadDaemonAuth(options.configPath) : { token: options.authToken, source: "daemon configuration" };
   const { host, port, timeoutMs } = options;
-  if (!host || !Number.isInteger(port) || port <= 0 || port > 65535) return { ok: false };
+  if (!host || !Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { ok: false, failure: "network" };
+  }
   const deadline = Date.now() + timeoutMs;
   let worker;
   try {
@@ -6272,7 +6275,7 @@ function probeDaemonSync(options) {
         port,
         path: options.path,
         fallbackPath: options.fallbackPath,
-        token: options.authToken ?? loadDaemonAuth(options.configPath).token,
+        token: auth.token,
         deadline,
         state,
         ...capture ? { capture, captureField: options.captureField } : {}
@@ -6282,7 +6285,14 @@ function probeDaemonSync(options) {
     Atomics.wait(view, 0, 0, Math.max(0, deadline - Date.now()));
     const status = Atomics.load(view, 0);
     if (status === 0) void worker.terminate();
-    if (status !== 1) return { ok: false, ...status === 3 ? { rejectedAuth: true } : {} };
+    if (status !== 1) {
+      const failure = status === 3 ? "auth" : status === 4 ? "http" : "network";
+      return {
+        ok: false,
+        failure,
+        ...status === 3 ? { rejectedAuth: true, authSource: auth.source } : {}
+      };
+    }
     if (!capture) return { ok: true };
     const length = new DataView(capture).getUint32(0);
     if (length === 0) return { ok: true };
@@ -6318,9 +6328,9 @@ function readDaemonMemoryDirSync(host, port, timeoutMs = DEFAULT_DAEMON_HEALTH_T
   return {
     healthy: probe.ok,
     memoryDir: probe.captured,
-    // Present only when true, so the result shape is unchanged for callers
-    // that compare it structurally.
-    ...probe.rejectedAuth === true ? { rejectedAuth: true } : {}
+    ...probe.failure === void 0 ? {} : { failure: probe.failure },
+    ...probe.rejectedAuth === true ? { rejectedAuth: true } : {},
+    ...probe.authSource === void 0 ? {} : { authSource: probe.authSource }
   };
 }
 function shouldProbeDaemonHealth(host) {
@@ -6509,7 +6519,8 @@ function detectDaemonBridgeMode(options) {
       }
     }
     if (!health.healthy) {
-      options.onSkip?.(`no healthy daemon at ${daemonHost}:${daemonPort}`);
+      const reason = health.failure === "auth" ? `daemon authentication failed at ${daemonHost}:${daemonPort} using ${health.authSource ?? "the configured credential"}` : health.failure === "http" ? `daemon health at ${daemonHost}:${daemonPort} returned an HTTP error; no healthy daemon` : `daemon network probe failed at ${daemonHost}:${daemonPort}; no healthy daemon`;
+      options.onSkip?.(reason);
       continue;
     }
     if (health.memoryDir === void 0) {
@@ -6609,7 +6620,9 @@ function selectedDaemonConfigPath() {
 function isOpenClawTokenEntry(value) {
   return value !== null && typeof value === "object" && "connector" in value && value.connector === "openclaw" && "token" in value && typeof value.token === "string";
 }
-function loadDaemonAuth(configPath) {
+var daemonAuthKey = (source, token) => `${source}\0${token}`;
+function loadDaemonAuth(configPath, excludedSources) {
+  const excluded = (source, token) => excludedSources?.has(source) === true || excludedSources?.has(daemonAuthKey(source, token)) === true;
   const environmentTokens = [
     ["OPENCLAW_REMNIC_ACCESS_TOKEN", readEnv("OPENCLAW_REMNIC_ACCESS_TOKEN")],
     ["REMNIC_AUTH_TOKEN", readEnv("REMNIC_AUTH_TOKEN")],
@@ -6617,7 +6630,7 @@ function loadDaemonAuth(configPath) {
     ["ENGRAM_AUTH_TOKEN", readEnv("ENGRAM_AUTH_TOKEN")]
   ];
   for (const [source, token] of environmentTokens) {
-    if (token) return { token, source };
+    if (token && !excluded(source, token)) return { token, source };
   }
   const tokenStores = [
     { path: path6.join(resolveHomeDir2(), ".remnic", "tokens.json"), source: "remnic token store" },
@@ -6629,10 +6642,10 @@ function loadDaemonAuth(configPath) {
       const store = JSON.parse(fs3.readFileSync(tokenStore.path, "utf8"));
       const tokens = Array.isArray(store.tokens) ? store.tokens : [];
       const openClawToken = tokens.find(isOpenClawTokenEntry)?.token;
-      if (typeof openClawToken === "string" && openClawToken.length > 0) {
+      if (typeof openClawToken === "string" && openClawToken.length > 0 && !excluded(tokenStore.source, openClawToken)) {
         return { token: openClawToken, source: tokenStore.source };
       }
-      if (typeof store === "object" && store !== null && "openclaw" in store && typeof store.openclaw === "string" && store.openclaw.length > 0 && (store.openclaw.startsWith("remnic_") || store.openclaw.startsWith("engram_"))) {
+      if (typeof store === "object" && store !== null && "openclaw" in store && typeof store.openclaw === "string" && store.openclaw.length > 0 && (store.openclaw.startsWith("remnic_") || store.openclaw.startsWith("engram_")) && !excluded(tokenStore.source, store.openclaw)) {
         return { token: store.openclaw, source: tokenStore.source };
       }
     } catch {
@@ -6645,7 +6658,7 @@ function loadDaemonAuth(configPath) {
       const raw = JSON.parse(fs3.readFileSync(candidate, "utf8"));
       const server = raw?.server;
       const token = server?.authToken;
-      if (typeof token === "string" && token.length > 0) {
+      if (typeof token === "string" && token.length > 0 && !excluded("daemon configuration", token)) {
         return { token, source: "daemon configuration" };
       }
     } catch {
@@ -6655,15 +6668,24 @@ function loadDaemonAuth(configPath) {
   }
   return { token: "", source: "no configured token" };
 }
-async function checkDaemonHealth(host, port, timeoutMs = DEFAULT_DAEMON_HEALTH_TIMEOUT_MS) {
-  if (!host || !Number.isInteger(port) || port <= 0 || port > 65535) return false;
+function classifyDaemonHealthStatus(status, tokenSource) {
+  if (status === 200) return { ok: true };
+  if (status === 401 || status === 403) {
+    return { ok: false, failure: "auth", status, tokenSource };
+  }
+  if (status === void 0) return { ok: false, failure: "network" };
+  return { ok: false, failure: "http", status };
+}
+async function checkDaemonHealthDetailed(host, port, timeoutMs = DEFAULT_DAEMON_HEALTH_TIMEOUT_MS) {
+  if (!host || !Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { ok: false, failure: "network" };
+  }
   const deadline = Date.now() + timeoutMs;
   try {
     const { request } = await import("http");
-    const token = loadDaemonAuth().token;
-    const headers = {};
-    if (token) headers["Authorization"] = `Bearer ${token}`;
-    const probe = (requestPath) => new Promise((resolve) => {
+    let auth = loadDaemonAuth();
+    const fallbackAuth = auth.token === "" ? void 0 : loadDaemonAuth(void 0, /* @__PURE__ */ new Set([auth.source]));
+    const probe = (requestPath, token) => new Promise((resolve) => {
       const remainingMs = deadline - Date.now();
       if (remainingMs <= 0) {
         resolve(void 0);
@@ -6675,6 +6697,8 @@ async function checkDaemonHealth(host, port, timeoutMs = DEFAULT_DAEMON_HEALTH_T
         settled = true;
         resolve(statusCode);
       };
+      const headers = {};
+      if (token) headers.Authorization = `Bearer ${token}`;
       const req = request(
         { hostname: host, port, path: requestPath, method: "GET", timeout: remainingMs, headers },
         (res) => {
@@ -6689,14 +6713,28 @@ async function checkDaemonHealth(host, port, timeoutMs = DEFAULT_DAEMON_HEALTH_T
       });
       req.end();
     });
-    const livenessStatus = await probe(LIVENESS_PATH);
-    if (livenessStatus === 200) return true;
-    if (livenessStatus !== 404) return false;
-    return await probe(LEGACY_HEALTH_PATH) === 200;
+    const probeWithFallback = async (requestPath) => {
+      let status = await probe(requestPath, auth.token);
+      if ((status === 401 || status === 403) && fallbackAuth?.token && fallbackAuth.token !== auth.token) {
+        auth = fallbackAuth;
+        status = await probe(requestPath, auth.token);
+      }
+      return status;
+    };
+    const livenessStatus = await probeWithFallback(LIVENESS_PATH);
+    if (livenessStatus === 200) return { ok: true };
+    if (livenessStatus !== 404) return classifyDaemonHealthStatus(livenessStatus, auth.source);
+    return classifyDaemonHealthStatus(
+      await probeWithFallback(LEGACY_HEALTH_PATH),
+      auth.source
+    );
   } catch {
-    return false;
+    return { ok: false, failure: "network" };
   }
 }
+async function checkDaemonHealth(host, port, timeoutMs = DEFAULT_DAEMON_HEALTH_TIMEOUT_MS) {
+  return (await checkDaemonHealthDetailed(host, port, timeoutMs)).ok;
+}
 
 // src/delegate-authorization.ts
 var DEFAULT_DELEGATE_AUTHORIZATION_OPERATIONS = [
@@ -6824,32 +6862,37 @@ async function lifecycleSessionNamespacesFrom(sessionKey, event, ctx, fallback,
 
 // src/delegate-daemon-target.ts
 function daemonTargetFor(bridge) {
+  const invalidatedCredentials = /* @__PURE__ */ new Set();
+  const invalidated = (token) => invalidatedCredentials.has(`daemon configuration\0${token}`);
   return {
     host: bridge.daemonHost,
     port: bridge.daemonPort,
+    invalidateAuthToken: (auth) => {
+      invalidatedCredentials.add(`${auth.source}\0${auth.token}`);
+    },
     resolveAuthToken: () => {
-      if (bridge.daemonAuthTokenOverride !== void 0) {
+      if (bridge.daemonAuthTokenOverride !== void 0 && !invalidated(bridge.daemonAuthTokenOverride)) {
         const unit = bridge.daemonAuthUnit === void 0 ? void 0 : readUnitAuthToken(bridge.daemonAuthUnit);
-        if (unit?.readable === true && unit.token !== void 0) {
+        if (unit?.readable === true && unit.token !== void 0 && !invalidated(unit.token)) {
           return { token: unit.token, source: "daemon configuration" };
         }
-        if (unit === void 0 || unit.readable === false) {
+        if ((unit === void 0 || unit.readable === false) && !invalidated(bridge.daemonAuthTokenOverride)) {
           return { token: bridge.daemonAuthTokenOverride, source: "daemon configuration" };
         }
         if (bridge.daemonConfigPath !== void 0) {
           const configToken = readDaemonConfigAuthToken(bridge.daemonConfigPath);
-          if (configToken !== void 0) {
+          if (configToken !== void 0 && !invalidated(configToken)) {
             return { token: configToken, source: "daemon configuration" };
           }
         }
       }
       if (bridge.daemonAuthPrefersConfig && bridge.daemonConfigPath !== void 0) {
         const configToken = readDaemonConfigAuthToken(bridge.daemonConfigPath);
-        if (configToken !== void 0) {
+        if (configToken !== void 0 && !invalidated(configToken)) {
           return { token: configToken, source: "daemon configuration" };
         }
       }
-      return loadDaemonAuth(bridge.daemonConfigPath);
+      return loadDaemonAuth(bridge.daemonConfigPath, invalidatedCredentials);
     }
   };
 }
@@ -6892,15 +6935,33 @@ async function noteRefusal(res, serviceId, pathname, source) {
   }
   return { status: res.status, body: null };
 }
-async function postJsonWithStatus(target, serviceId, pathname, body, timeoutMs) {
-  const headers = { "Content-Type": "application/json" };
+async function fetchWithAuthRetry(target, pathname, timeoutMs, init = {}) {
+  const deadline = Date.now() + timeoutMs;
+  const request = async (auth2) => {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) throw new Error("daemon request deadline exceeded");
+    const headers = new Headers(init.headers);
+    if (auth2.token) headers.set("Authorization", `Bearer ${auth2.token}`);
+    return fetch(daemonUrl(target, pathname), {
+      ...init,
+      headers,
+      signal: AbortSignal.timeout(remainingMs)
+    });
+  };
   const auth = target.resolveAuthToken();
-  if (auth.token) headers.Authorization = `Bearer ${auth.token}`;
-  const res = await fetch(daemonUrl(target, pathname), {
+  const response = await request(auth);
+  if (response.status !== 401) return { response, auth };
+  await response.body?.cancel();
+  target.invalidateAuthToken?.(auth);
+  const refreshedAuth = target.resolveAuthToken();
+  if (refreshedAuth.token === auth.token) return { response, auth };
+  return { response: await request(refreshedAuth), auth: refreshedAuth };
+}
+async function postJsonWithStatus(target, serviceId, pathname, body, timeoutMs) {
+  const { response: res, auth } = await fetchWithAuthRetry(target, pathname, timeoutMs, {
     method: "POST",
-    headers,
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(timeoutMs)
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
   });
   if (!res.ok) return noteRefusal(res, serviceId, pathname, auth.source);
   return { status: res.status, body: await readJsonObject(res) };
@@ -6914,13 +6975,7 @@ async function postJson(target, serviceId, pathname, body, timeoutMs) {
   return response.body;
 }
 async function getJson(target, serviceId, pathname, timeoutMs) {
-  const headers = {};
-  const auth = target.resolveAuthToken();
-  if (auth.token) headers.Authorization = `Bearer ${auth.token}`;
-  const res = await fetch(daemonUrl(target, pathname), {
-    headers,
-    signal: AbortSignal.timeout(timeoutMs)
-  });
+  const { response: res, auth } = await fetchWithAuthRetry(target, pathname, timeoutMs);
   if (!res.ok) return noteRefusal(res, serviceId, pathname, auth.source);
   return { status: res.status, body: await readJsonObject(res) };
 }