Fix: Use centralized credentials to prevent API key hijacking

[bigph00t]

Summary

• Uses centralized credentials from ~/.claude-mem/.env to prevent API key hijacking
• Adds EnvManager for secure credential handling
• Prevents SDK from bypassing Claude Code CLI billing

Issue

Fixes thedotmack#733

Test plan

• Verify credentials are loaded from ~/.claude-mem/.env
• Verify project-level .env files cannot override API keys
• Test that SDK uses centralized credentials correctly

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

• Implements centralized credential management through EnvManager to prevent API key hijacking from project-level .env files
• Adds authentication method configuration (CLAUDE_MEM_CLAUDE_AUTH_METHOD) defaulting to 'cli' to maintain Claude Code CLI billing integrity
• Updates SDK agents (GeminiAgent, OpenRouterAgent, SDKAgent) to use isolated credentials from ~/.claude-mem/.env instead of process.env

Important Files Changed

Filename	Overview
plugin/scripts/worker-service.cjs	Critical error: Worker service file is completely empty, breaking core functionality
src/shared/EnvManager.ts	New centralized credential manager; provides isolated environment building and secure .env parsing
src/services/worker/SDKAgent.ts	Updated to use isolated environment for Agent SDK; prevents credential pollution from project files

Confidence score: 0/5

• This PR introduces a critical production-breaking bug where the worker service is completely empty
• Score reduced from 4/5 to 0/5 due to plugin/scripts/worker-service.cjs having zero content, which will cause immediate service failure
• The worker service is essential infrastructure running on port 37777 that handles AI processing, memory capture, and context injection

Sequence Diagram

sequenceDiagram
    participant User
    participant SDK as "SDKAgent"
    participant EnvManager as "EnvManager"
    participant Settings as "SettingsDefaultsManager"
    participant ClaudeCode as "Claude Code CLI"

    User ->> SDK: "Start memory session"
    SDK ->> Settings: "loadFromFile(~/.claude-mem/settings.json)"
    Settings -->> SDK: "Configuration settings"
    SDK ->> EnvManager: "buildIsolatedEnv()"
    EnvManager ->> EnvManager: "loadClaudeMemEnv(~/.claude-mem/.env)"
    EnvManager -->> SDK: "Isolated environment variables"
    SDK ->> ClaudeCode: "Start with isolated env"
    ClaudeCode -->> SDK: "Memory session responses"
    SDK -->> User: "Memory context generated"

Loading

[greptile-apps]

Additional Comments (2)

1. plugin/scripts/worker-service.cjs, line 1 (link)

   logic: Worker service file is completely empty - this will break Claude-Mem's core functionality since the worker service handles AI processing and runs the localhost:37777 API. Was this file accidentally emptied during the credential changes, or is this intentional?

2. src/services/worker/OpenRouterAgent.ts, line 92 (link)

   style: Error message should reference the new credential source - mentions OPENROUTER_API_KEY environment variable but that's no longer checked

_{7 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}