[ZaynJarvis]

Summary

• package the official OpenViking Studio build as a MiniMax Code Mini App
• proxy only the fixed OpenViking REST and Streamable HTTP MCP routes from the Host-managed Node runtime, keeping credentials out of the browser
• expose OpenViking MCP tools and six Agent Skills
• capture session turns on Stop, then commit on PreCompact and SessionEnd through the upstream OpenViking hook runtimes
• add a user-confirmed message.append handoff from Studio to the current MiniMax Code chat draft

Security and data flow

• connection settings come from the documented OPENVIKING_*, ~/.openviking/ovcli.conf, and ~/.openviking/ov.conf chain
• browser cookies and Host authorization headers are not forwarded
• no arbitrary upstream proxy route is exposed
• upstream OpenViking source revision and AGPL-3.0 attribution are included

Verification

• npm run check (69 tests passed; package validator reports this plugin OK)
• OpenViking upstream hook tests: 51 passed across Claude capture and Codex capture/pre-compact/session-end
• local Studio assets smoke-tested at /workspace
• proxied /health returned 200 from a configured OpenViking service
• proxied MCP initialize returned 200 with protocol 2025-06-18
• package size: 21 MiB, 693 files, no file over 16 MiB

[MyPrototypeWhat]

Thanks for packaging OpenViking Studio. The Mini App side is well isolated: credentials stay in the Node process and the handoff only fires on a click. Most of the issues below are in the bundled hook runtime. Paths are relative to plugins/zayn/openviking-context-workspace/ at 37e1224.

Must fix

1. Session capture is on by default with no consent step, and with a remote OpenViking URL configured the conversation leaves the machine.
After install, each Stop reads the whole transcript and POSTs the new user and assistant turns to OpenViking; PreCompact and SessionEnd then commit the session:

• claude path: hooks/dispatch.mjs:34 forces OPENVIKING_MEMORY_ENABLED=1, overriding the upstream "disabled unless configured" fallback (hooks/claude/config.mjs:72-80)
• codex path: ignores that variable (hooks/codex/ov-memory-doctor.mjs:327) and captures because OPENVIKING_AUTO_CAPTURE defaults to on
• defaults: enabled and autoCapture both default to true (hooks/claude/shared/config-schema.mjs:45,133-136; same in hooks/codex/shared/config-schema.mjs)
• transcript read: the whole file at transcript_path (hooks/dispatch.mjs:62, hooks/claude/auto-capture.mjs:229, hooks/codex/auto-capture.mjs:141)
• upload: /api/v1/sessions/{id}/messages (hooks/claude/shared/batch-send.mjs:53,94); assistant turns included by default (config-schema.mjs:148); tool output sent raw, up to 1,000,000 characters (hooks/claude/shared/capture-utils.mjs:25, config-schema.mjs:145)
• target: defaults to 127.0.0.1:1933 (hooks/claude/shared/credentials.mjs:321-322); any configured remote URL sends the data off the machine

I reproduced this with an empty $HOME and no OpenViking config. One Stop event wrote the transcript text in plaintext to ~/.openviking/pending/*.json for later replay.

Please make capture actually switchable: hooks/dispatch.mjs:34 should stop forcing OPENVIKING_MEMORY_ENABLED=1. Then make it off by default, or ask on first use, on both paths. Also state plainly in the README and the Studio UI what gets sent (full turns, including tool output), that it leaves the machine when a remote URL is set, and how to turn it off.

2. Writes outside the plugin's data directory.
The hook runtime writes under ~/.openviking/ (or OPENVIKING_HOME) and the OS temp dir instead of context.dataDir:

• hooks/claude/shared/pending-queue.mjs:34: ~/.openviking/pending/ (queued message content)
• hooks/claude/lib/state.mjs:18-20: ~/.openviking/state/ (last-capture.json, ws-identity-*.json)
• hooks/claude/shared/agent-hook-runtime.mjs:105: ~/.openviking/hook-state
• hooks/codex/session-state.mjs:30: ~/.openviking/codex-plugin-state
• hooks/claude/shared/credentials.mjs:373, plugin-config.mjs:266: ~/.openviking/logs/
• hooks/claude/auto-capture.mjs:53: $TMPDIR/openviking-cc-capture-state/

All of this state and logging needs to live under the plugin's data directory. Reading ~/.openviking/ovcli.conf / ov.conf as connection config is fine.

3. README "Data & access" is inaccurate.
README.md:45-47 says hook state is kept in the OS temp directory. Most of it goes to ~/.openviking/* (see item 2). The README also doesn't mention that transcript content gets queued on disk, or what is uploaded. Please update this section once items 1 and 2 are settled.

Optional

• Dead code (35 of 97 hook files). Starting from the three registered entries, these are never imported: hooks/claude/{auto-recall,ov-memory-doctor,ov-status,session-start,setup,skill-experience,statusline,subagent-*,uri-guard}.mjs, hooks/codex/{auto-recall,codex-launch,host-compressor,ov-memory-doctor,recall-compressor-profile,session-start-commit,setup}.mjs, hooks/codex/usage/*, and */shared/{doctor-core,mcp-proxy-core,setup-wizard,uri-guard}.mjs. Some of them read files outside OpenViking's own config: ~/.codex/* (hooks/codex/recall-compressor-profile.mjs:12, hooks/codex/ov-memory-doctor.mjs:52) and shell rc files (hooks/claude/shared/doctor-core.mjs:382-398). Removing them shrinks the package and removes code that reviewers would otherwise have to vet.
• Duplicates. All 24 files in hooks/codex/shared/ are byte-identical to hooks/claude/shared/ (same blobs). They work after packaging, but one shared copy would be simpler.
• Proxy scope. miniapp/node/server.mjs:98-105 forwards every /api/* and /bot/* path for any method, not a fixed list of routes, which doesn't match "fixed routes" in the README (README.md:7) and PR text. Either allowlist the routes Studio actually uses or change the wording.
• Root-key fallback. The browser-facing proxy resolves credentials with rootKeyFallback: true (server.mjs:44,108), so it can authenticate with server.root_api_key from ov.conf (hooks/claude/shared/credentials.mjs:269). Consider not falling back to the root key here.
• Dev preview binds 0.0.0.0. dev-server.mjs:15 (documented at README.md:33) exposes the credentialed proxy to the local network. 127.0.0.1 would be a safer default.
• Built assets. miniapp/client/assets/ is 19 MiB of minified build output (547 JS chunks, the largest 1.3 MB) marked -diff linguist-generated. Please note in the README how to rebuild it from the pinned upstream revision.
• Third-party notices. THIRD_PARTY_NOTICES.md covers OpenViking only. The Studio bundle also includes npm dependencies with their own licenses (for example the mermaid and syntax-highlighting chunks). Consider listing them or shipping the generated license file.
• Plugin tests. The PR mentions 51 upstream hook tests, but none are in the plugin folder. Adding a small in-plugin test for dispatch.mjs and the proxy route filter would help.