agent-harness 0.36.7 → 0.36.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 787476d24b2577b593c52b21805ddbbc3e7f8fec95eec0fda829d5c382ebf616
-  data.tar.gz: c3645ffa8fdaaf4ce2d6df5dd58417f3f37b1a557351e3abcb074714a547296f
+  metadata.gz: 7b5a9c9ca2e2b03184fad17fea28af20996a3710d23ed5e34feed302be6f54b8
+  data.tar.gz: 888c84fe0cc58a5d9f20a0f396bb75e429fc84287fcb5e4e337340841d2d70a0
 SHA512:
-  metadata.gz: 76d24a618b0cfea4fc91a0e81ca4999adbbc86c3db8ba7fd18baff97956c147853af1daf314a5bb98e104d2f6f502c0a06d5aceb1fb13139b9b083f813a43b09
-  data.tar.gz: 97d8c0362dcb3badbed261fca466ed16d8206e3141c229a3eca9bc00240d93420d8170e73575c8b21c1676dfd22047d85f099163677a229412db52e5094ee0f3
+  metadata.gz: 93eadc79037f9d847ad418023ed8ed9d4920e32445d63e39f4a81b951a65f9587386bf1d2012b632c644f73b7173e4471578160161063570f93c6f8781d671d3
+  data.tar.gz: 6f7e1a3084562f773e415b9bbc23157f3151308e4995a5bb7812ef8080cd871d21da581371f550c6abeff4485c13ad75fd1d873bbb26d76715b2805edd16a1a2

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.36.7"
+  ".": "0.36.8"
 }

data/CHANGELOG.md

@@ -5,6 +5,13 @@
 * add runner model compatibility contract (`AgentHarness.model_compatibility`) with structured `ModelCompatibility::Result` outcomes. Codex exposes static facts for CLI-gated models (e.g. `gpt-5.5` requires Codex CLI `>= 0.116.0`), a baseline supported-model list, supported auth modes, and a `DEFAULT_COMPATIBLE_MODEL_ID` fallback so downstream orchestrators can validate tier/model assignments before scheduling agent runs ([#259](https://github.com/viamin/agent-harness/issues/259)).
 * **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
+## [0.36.8](https://github.com/viamin/agent-harness/compare/agent-harness/v0.36.7...agent-harness/v0.36.8) (2026-08-25)
+
+
+### Bug Fixes
+
+* Claude CLI Not logged in responses should raise AuthenticationError ([#372](https://github.com/viamin/agent-harness/issues/372)) ([8782aef](https://github.com/viamin/agent-harness/commit/8782aef42b0ec6f8e550dc98e79d316bb58b6044))
+
 ## [0.36.7](https://github.com/viamin/agent-harness/compare/agent-harness/v0.36.6...agent-harness/v0.36.7) (2026-08-25)
 
 

data/lib/agent_harness/providers/anthropic.rb

@@ -216,6 +216,25 @@ module AgentHarness
 
         private
 
+        # Message fragments the Claude CLI emits when the local session is
+        # missing or expired. Detected in the envelope's +result+ field even
+        # when +subtype+ is "success", since Claude reports the failure
+        # inside the payload rather than through the transport layer.
+        #
+        # Scoped to explicit expired / login-required phrases. A bare
+        # "authentication" match would also fire on transient service
+        # outages like "authentication service was unavailable", which
+        # belong on the retry / provider-fallback path, not the re-auth
+        # path.
+        AUTH_FAILURE_FRAGMENTS = [
+          "oauth token",
+          "not logged in",
+          "please run /login",
+          "login required",
+          "credentials expired",
+          "session expired"
+        ].freeze
+
         def classify_error_message(message)
           msg_lower = message.downcase
 
@@ -223,13 +242,20 @@ module AgentHarness
             "Rate limit exceeded"
           elsif msg_lower.include?("deprecat") || msg_lower.include?("end-of-life")
             "Model deprecated"
-          elsif msg_lower.include?("oauth token") || msg_lower.include?("authentication")
+          elsif authentication_failure_message?(msg_lower)
             "Authentication error"
           else
             message
           end
         end
 
+        def authentication_failure_message?(message)
+          return false if message.nil? || message.empty?
+
+          msg_lower = message.downcase
+          AUTH_FAILURE_FRAGMENTS.any? { |fragment| msg_lower.include?(fragment) }
+        end
+
         def extract_tokens(parsed)
           usage = parsed["usage"]
           return nil unless usage
@@ -654,22 +680,38 @@ module AgentHarness
       def parse_response(result, duration:)
         output = result.stdout
         error = nil
+        auth_source = nil
         tokens = nil
         metadata = {}
 
+        parsed = parse_json_output(output)
+
+        # Claude CLI can return `subtype: "success"` with `is_error: true`
+        # (e.g. "Not logged in · Please run /login"); trust `is_error` and the
+        # process exit code rather than the envelope subtype.
+        envelope_error = parsed && parsed["is_error"]
+        envelope_message = parsed && parsed["result"]
+
         if result.failed?
           combined = [result.stdout, result.stderr].compact.join("\n")
           error = classify_error_message(combined)
+          # With an envelope present, restrict auth detection to stderr so
+          # assistant `result` text mentioning "authentication" can't trip
+          # a false positive. Without an envelope, the combined output is
+          # our only window into CLI-reported auth failures.
+          auth_source ||= parsed ? result.stderr : combined
         end
 
-        # Parse JSON output to extract result text, token usage, and metadata
-        parsed = parse_json_output(output)
-        if parsed
-          # Handle is_error envelopes as provider errors
-          if parsed["is_error"]
-            error ||= classify_error_message(parsed["result"] || "Unknown Claude CLI error")
-          end
+        if envelope_error
+          error ||= classify_error_message(envelope_message || "Unknown Claude CLI error")
+          # Prefer the envelope's own message for auth detection to avoid
+          # false positives from assistant text that mentions "authentication".
+          auth_source = envelope_message
+        end
 
+        raise_if_authentication_failure(auth_source)
+
+        if parsed
           output = parsed["result"] || output
           tokens = extract_tokens(parsed)
           metadata = extract_envelope_metadata(parsed)
@@ -786,6 +828,24 @@ module AgentHarness
         self.class.send(:classify_error_message, message)
       end
 
+      def authentication_failure_message?(message)
+        self.class.send(:authentication_failure_message?, message)
+      end
+
+      # Raise AuthenticationError so callers (e.g. Conductor) can route to
+      # re-auth handling instead of retrying through generic provider-error
+      # paths. Fires when the source message (envelope's +result+ field, or
+      # the raw combined process output when there is no envelope) matches
+      # a Claude "not logged in" / session-expired signal.
+      def raise_if_authentication_failure(source_message)
+        return unless authentication_failure_message?(source_message)
+
+        message = source_message.to_s.strip
+        message = "Claude CLI reported an authentication failure" if message.empty?
+
+        raise AuthenticationError.new(message, provider: self.class.provider_name)
+      end
+
       def parse_claude_mcp_output(output)
         servers = []
         return servers unless output

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.36.7"
+  VERSION = "0.36.8"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.36.7
+  version: 0.36.8
 platform: ruby
 authors:
 - Bart Agapinan