Support custom HTTP headers for cloud sync (ENGRAM_CLOUD_EXTRA_HEADERS)

[4DRIAN0RTIZ]

📋 Pre-flight Checks

• I have searched existing issues and this is not a duplicate
• I understand this issue needs status:approved before a PR can be opened

🔍 Problem Description

Engram cloud sync only supports ENGRAM_CLOUD_TOKEN (Authorization: Bearer).
Deployments behind Cloudflare Access, reverse proxies, or zero-trust networks require additional service headers on every outgoing request.
For example:
CF-Access-Client-Id and CF-Access-Client-Secret. Currently there is no way to inject these without patching the binary, making programmatic sync impossible when the server sits behind an Access policy (results in a 302 redirect to login).

💡 Proposed Solution

Add ENGRAM_CLOUD_EXTRA_HEADERS env var accepting comma-separated Key: Value pairs injected into all outgoing cloud sync HTTP requests:

ENGRAM_CLOUD_EXTRA_HEADERS="CF-Access-Client-Id: abc.access, CF-Access-Client-Secret: secret"

• Parsed once at construction, zero allocation per request
• Authorization override rejected (security guardrail)
• Malformed pairs skipped with a warning; values never logged
• Fully backward-compatible, no change when unset

📦 Affected Area

MCP Server (tools, transport)

🔄 Alternatives Considered

• Wrapping engram in a proxy that injects headers but adds infrastructure complexity
• Using ENGRAM_CLOUD_TOKEN but only covers Authorization, not service headers
• Patching the binary per deployment

📎 Additional Context

Verified working against a self-hosted engram instance behind Cloudflare Tunnel + Access policy. Without the headers, every sync request gets a 302 to the CF Access login page.
With ENGRAM_CLOUD_EXTRA_HEADERS set, sync completes successfully.

[santiagob03]

eso quiere decir que si tengo mi raspberry pi 5 y estoy usando cloudflare tunnel no me permite sincronizarlo de forma automatica? ya que me di cuenta que no se sincroniza solo, debo escribir sync cada vez que hago cambios :s

[4DRIAN0RTIZ]

Si, dependerá también de la forma que tengas configurado el tunnel, en mi caso es un key service, y por eso necesito los headers, también se podría colocar un bypass, pero creo que se rompería la línea de seguridad que se ha venido manejando.

[Alan-TheGentleman]

Reasonable need for Cloudflare Access style setups, but injecting arbitrary headers into every cloud request has security implications (header injection, accidental Authorization override). Before a PR, propose the design: which headers are allowed, how the Authorization guardrail is kept, and the config surface. Design-gated. Align here first.