@agenthippo-ai/agenthippo 0.1.0 → 0.1.1

package/out/cli/state-sync.js

@@ -2,37 +2,93 @@
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAwsCliAvailable = isAwsCliAvailable;
 exports.resolveS3StateConfig = resolveS3StateConfig;
+exports.resolveRestoreBootMode = resolveRestoreBootMode;
+exports.safeSessionId = safeSessionId;
+exports.sessionRemoteUri = sessionRemoteUri;
+exports.shardBelongsToSession = shardBelongsToSession;
+exports.hasLocalSessionState = hasLocalSessionState;
+exports.listSessionShardFiles = listSessionShardFiles;
+exports.stageSessionPushDir = stageSessionPushDir;
+exports.mergeSessionStagingIntoState = mergeSessionStagingIntoState;
 exports.restoreState = restoreState;
 exports.pushState = pushState;
+exports.pushSessionState = pushSessionState;
+exports.ensureSessionLocal = ensureSessionLocal;
+exports.clearRestoreAttemptCache = clearRestoreAttemptCache;
 exports.makeStatePusher = makeStatePusher;
+exports.providerSessionShardName = providerSessionShardName;
 /**
- * Object-store state sync (serve-v3 Q1, shared SessionStore).
+ * Object-store state sync (serve-v3 Q1 + serve-v4 P1.2).
  *
- * Persists the durable state root (/state) to an S3-compatible object store so
- * sessions survive scale-to-zero / a fresh instance even where there is NO
- * filesystem mount (Cloudflare R2, Databricks → S3/DBFS), and so a sticky-routed
- * fleet replica can reload an affinity-owned session.
+ * Persists the durable state root to an S3-compatible object store so sessions
+ * survive scale-to-zero / a fresh instance (Cloudflare R2, MinIO, GCS, AWS S3)
+ * and so a sticky-routed fleet can restore-on-miss after resharding.
  *
- * Strategy (agreed): boot restore + per-turn async-delta push (debounced, off
- * the response path) + a SIGTERM flush. Uses `aws s3 sync` (delta by default;
- * S3-compatible via --endpoint-url → MinIO / R2 / GCS / S3) so we add no SDK to
- * the binary. Single-writer-per-session safety comes from sticky-by-session_id.
+ * Strategy:
+ *   - Per-session async-delta push (debounced, off the response path) →
+ *     s3://…/sessions/<sessionId>/
+ *   - Restore-on-miss before a turn when the session is not local
+ *   - Optional boot restore of the whole prefix (`AGENTHIPPO_STATE_RESTORE_BOOT=all`)
+ *   - SIGTERM flush of pending session pushes
+ *
+ * Uses `aws s3 sync` (S3-compatible via --endpoint-url). No SDK in the binary.
+ * Last-write-wins per session prefix — no CAS. Mid-reshard may lose one turn of
+ * context; sticky routing makes that rare.
  *
  * Config (no-op unless AGENTHIPPO_STATE_S3_URI is set):
- *   AGENTHIPPO_STATE_S3_URI       s3://bucket/prefix
- *   AGENTHIPPO_STATE_S3_ENDPOINT  http://minio:9000  (for non-AWS S3)
- *   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION   (standard aws creds)
+ *   AGENTHIPPO_STATE_S3_URI          s3://bucket/prefix
+ *   AGENTHIPPO_STATE_S3_ENDPOINT     http://minio:9000  (non-AWS S3)
+ *   AGENTHIPPO_STATE_RESTORE_BOOT    all|none (default all for single-instance compat;
+ *                                    multi-replica templates set none)
+ *   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION
  */
+const crypto_1 = require("crypto");
 const child_process_1 = require("child_process");
+const fsp = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
 const util_1 = require("util");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/** In-process cache: skip repeat S3 pulls for the same session on this replica. */
+const restoreAttempted = new Set();
 /**
  * Verify the `aws` CLI is callable. State sync shells out to it, so when S3 is
  * configured a missing binary means silent data loss — callers should fail fast.
- * Resolves true when available, false otherwise.
  */
 async function isAwsCliAvailable() {
     try {
@@ -54,6 +110,27 @@ function resolveS3StateConfig(env = process.env) {
         endpoint: env.AGENTHIPPO_STATE_S3_ENDPOINT?.trim() || undefined,
     };
 }
+/**
+ * Boot restore mode. Default `all` preserves single-instance behavior.
+ * Multi-replica templates set `none` and rely on restore-on-miss (P1.2).
+ */
+function resolveRestoreBootMode(env = process.env) {
+    const raw = env.AGENTHIPPO_STATE_RESTORE_BOOT?.trim().toLowerCase();
+    if (raw === 'none') {
+        return 'none';
+    }
+    return 'all';
+}
+/** Sanitize a client session id for use as an S3 path segment / local dir name. */
+function safeSessionId(sessionId) {
+    const trimmed = sessionId.trim();
+    const safe = trimmed.replace(/[<>:"/\\|?*\x00-\x1F]+/g, '_').replace(/\.\./g, '_').slice(0, 160);
+    return safe || 'session';
+}
+/** Remote prefix for one session: s3://bucket/prefix/sessions/<id> */
+function sessionRemoteUri(cfg, sessionId) {
+    return `${cfg.uri}/sessions/${safeSessionId(sessionId)}`;
+}
 function syncArgs(cfg, from, to) {
     const args = ['s3', 'sync', from, to, '--no-progress'];
     if (cfg.endpoint) {
@@ -61,6 +138,126 @@ function syncArgs(cfg, from, to) {
     }
     return args;
 }
+function attemptKey(stateDir, sessionId) {
+    return `${path.resolve(stateDir)}\0${sessionId}`;
+}
+/** Conversation key format: engine:chatSessionId:pack:signature */
+function shardBelongsToSession(shardKey, chatSessionId, value) {
+    if (value?.chatSessionId && value.chatSessionId === chatSessionId) {
+        return true;
+    }
+    const parts = shardKey.split(':');
+    return parts.length >= 2 && parts[1] === chatSessionId;
+}
+/**
+ * True when this replica already has provider-session state for the chat session.
+ * Used to skip restore-on-miss on the hot path.
+ */
+async function hasLocalSessionState(stateDir, sessionId) {
+    const dir = path.join(stateDir, 'provider-sessions');
+    let names;
+    try {
+        names = await fsp.readdir(dir);
+    }
+    catch {
+        return false;
+    }
+    for (const name of names) {
+        if (!name.endsWith('.json')) {
+            continue;
+        }
+        try {
+            const raw = await fsp.readFile(path.join(dir, name), 'utf8');
+            const parsed = JSON.parse(raw);
+            if (typeof parsed.key === 'string' && shardBelongsToSession(parsed.key, sessionId, parsed.value)) {
+                return true;
+            }
+        }
+        catch {
+            // skip unreadable
+        }
+    }
+    return false;
+}
+/** Collect provider-session shard filenames that belong to this chat session. */
+async function listSessionShardFiles(stateDir, sessionId) {
+    const dir = path.join(stateDir, 'provider-sessions');
+    let names;
+    try {
+        names = await fsp.readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        if (!name.endsWith('.json')) {
+            continue;
+        }
+        try {
+            const raw = await fsp.readFile(path.join(dir, name), 'utf8');
+            const parsed = JSON.parse(raw);
+            if (typeof parsed.key === 'string' && shardBelongsToSession(parsed.key, sessionId, parsed.value)) {
+                out.push(name);
+            }
+        }
+        catch {
+            // skip
+        }
+    }
+    return out;
+}
+async function pathExists(p) {
+    try {
+        await fsp.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function copyDirIfExists(src, dest) {
+    if (!(await pathExists(src))) {
+        return;
+    }
+    await fsp.mkdir(dest, { recursive: true });
+    await fsp.cp(src, dest, { recursive: true, force: true });
+}
+/**
+ * Build a local staging tree for session S:
+ *   provider-sessions/<shards for S>
+ *   agents/            (replica snapshot — sticky-by-user keeps this scoped)
+ */
+async function stageSessionPushDir(stateDir, sessionId, stagingDir) {
+    await fsp.rm(stagingDir, { recursive: true, force: true });
+    await fsp.mkdir(stagingDir, { recursive: true });
+    const shards = await listSessionShardFiles(stateDir, sessionId);
+    const psDest = path.join(stagingDir, 'provider-sessions');
+    if (shards.length > 0) {
+        await fsp.mkdir(psDest, { recursive: true });
+        for (const name of shards) {
+            await fsp.copyFile(path.join(stateDir, 'provider-sessions', name), path.join(psDest, name));
+        }
+    }
+    await copyDirIfExists(path.join(stateDir, 'agents'), path.join(stagingDir, 'agents'));
+    const hasAgents = await pathExists(path.join(stagingDir, 'agents'));
+    return shards.length > 0 || hasAgents;
+}
+/** Merge a restored staging tree back into stateDir. */
+async function mergeSessionStagingIntoState(stagingDir, stateDir) {
+    const psSrc = path.join(stagingDir, 'provider-sessions');
+    if (await pathExists(psSrc)) {
+        const psDest = path.join(stateDir, 'provider-sessions');
+        await fsp.mkdir(psDest, { recursive: true });
+        for (const name of await fsp.readdir(psSrc)) {
+            if (!name.endsWith('.json')) {
+                continue;
+            }
+            await fsp.copyFile(path.join(psSrc, name), path.join(psDest, name));
+        }
+    }
+    await copyDirIfExists(path.join(stagingDir, 'agents'), path.join(stateDir, 'agents'));
+}
 /** Download state from the bucket into stateDir on boot. An empty bucket is a no-op. */
 async function restoreState(cfg, stateDir, log) {
     try {
@@ -68,46 +265,130 @@ async function restoreState(cfg, stateDir, log) {
         log?.(`State restored from ${cfg.uri}`);
     }
     catch (err) {
-        // First boot / empty bucket / transient — don't block startup.
         log?.(`State restore skipped: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/** Upload changed files from stateDir to the bucket (delta). */
+/** Upload changed files from stateDir to the bucket (full-tree delta — legacy / flush fallback). */
 async function pushState(cfg, stateDir, log) {
     try {
         await execFileAsync('aws', syncArgs(cfg, stateDir, cfg.uri));
     }
     catch (err) {
-        // A failed push means sessions aren't durable — surface it unconditionally,
-        // not just under --verbose, so the operator notices state isn't persisting.
         console.error(`[state-sync] push to ${cfg.uri} failed: ${err instanceof Error ? err.message : String(err)}`);
         log?.(`State push failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/** Push one session's scoped tree to s3://…/sessions/<id>/. */
+async function pushSessionState(cfg, stateDir, sessionId, log) {
+    const safe = safeSessionId(sessionId);
+    const staging = path.join(stateDir, '.push-staging', safe);
+    try {
+        const hasContent = await stageSessionPushDir(stateDir, sessionId, staging);
+        if (!hasContent) {
+            log?.(`State push skipped for session ${safe}: nothing local`);
+            return;
+        }
+        const remote = sessionRemoteUri(cfg, sessionId);
+        await execFileAsync('aws', syncArgs(cfg, staging, remote));
+        log?.(`State pushed session ${safe} → ${remote}`);
+    }
+    catch (err) {
+        console.error(`[state-sync] push session ${safe} failed: ${err instanceof Error ? err.message : String(err)}`);
+        log?.(`State push failed for ${safe}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        await fsp.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/**
+ * On a request whose session_id has no local provider-session state, pull
+ * s3://…/sessions/<id>/ before runner.run(). No-ops if already local or already
+ * attempted this process (avoids re-pulling brand-new sessions every turn).
+ */
+async function ensureSessionLocal(cfg, stateDir, sessionId, log) {
+    const key = attemptKey(stateDir, sessionId);
+    if (restoreAttempted.has(key)) {
+        return;
+    }
+    if (await hasLocalSessionState(stateDir, sessionId)) {
+        restoreAttempted.add(key);
+        return;
+    }
+    const safe = safeSessionId(sessionId);
+    const staging = path.join(stateDir, '.restore-staging', safe);
+    try {
+        await fsp.rm(staging, { recursive: true, force: true });
+        await fsp.mkdir(staging, { recursive: true });
+        const remote = sessionRemoteUri(cfg, sessionId);
+        await execFileAsync('aws', syncArgs(cfg, remote, staging));
+        await mergeSessionStagingIntoState(staging, stateDir);
+        log?.(`State restored session ${safe} from ${remote}`);
+    }
+    catch (err) {
+        // Empty prefix / first turn / transient — continue; runner creates fresh state.
+        log?.(`State restore-on-miss skipped for ${safe}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        restoreAttempted.add(key);
+        await fsp.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/** Test helper — clear the restore-attempted cache. */
+function clearRestoreAttemptCache() {
+    restoreAttempted.clear();
+}
 /**
- * Debounced, non-overlapping pusher. `schedule()` after each turn (cheap, off the
- * response path); coalesces bursts; `flush()` awaits a final push (SIGTERM).
+ * Debounced, non-overlapping per-session pusher.
+ * `schedule(sessionId)` after each turn; `flush()` awaits pending pushes (SIGTERM).
  */
 function makeStatePusher(cfg, stateDir, log, waitMs = 1000) {
     let timer = null;
     let running = false;
-    let pending = false;
     let inflightPromise = null;
+    const pendingSessions = new Set();
+    let pendingFull = false;
     const runNow = () => {
         running = true;
-        pending = false;
-        inflightPromise = pushState(cfg, stateDir, log).then(() => {
+        const sessions = [...pendingSessions];
+        const doFull = pendingFull;
+        pendingSessions.clear();
+        pendingFull = false;
+        inflightPromise = (async () => {
+            if (doFull) {
+                await pushState(cfg, stateDir, log);
+            }
+            for (const id of sessions) {
+                await pushSessionState(cfg, stateDir, id, log);
+            }
+        })()
+            .catch((err) => {
+            console.error(`[state-sync] push batch failed: ${err instanceof Error ? err.message : String(err)}`);
+        })
+            .finally(() => {
             running = false;
             inflightPromise = null;
-            if (pending) {
-                schedule();
+            if (pendingSessions.size > 0 || pendingFull) {
+                // Re-arm debounce without treating this as a legacy full-push schedule().
+                if (!timer) {
+                    timer = setTimeout(() => {
+                        timer = null;
+                        void runNow();
+                    }, waitMs);
+                    timer.unref?.();
+                }
             }
         });
         return inflightPromise;
     };
-    const schedule = () => {
+    const schedule = (sessionId) => {
+        if (sessionId?.trim()) {
+            pendingSessions.add(sessionId.trim());
+        }
+        else {
+            // Legacy no-arg call → full-tree push (boot-compat / callers that omit id).
+            pendingFull = true;
+        }
         if (running) {
-            pending = true;
             return;
         }
         if (timer) {
@@ -124,12 +405,19 @@ function makeStatePusher(cfg, stateDir, log, waitMs = 1000) {
             clearTimeout(timer);
             timer = null;
         }
-        // Wait for any in-flight push to complete before the final push,
-        // so SIGTERM never runs two concurrent aws s3 sync processes.
         if (inflightPromise) {
             await inflightPromise;
         }
-        await pushState(cfg, stateDir, log);
+        if (pendingSessions.size > 0 || pendingFull) {
+            await runNow();
+            if (inflightPromise) {
+                await inflightPromise;
+            }
+        }
     };
     return { schedule, flush };
 }
+/** Stable hash helper exposed for tests (matches DirectorySessionStore naming). */
+function providerSessionShardName(conversationKey) {
+    return `${(0, crypto_1.createHash)('sha256').update(conversationKey).digest('hex').slice(0, 40)}.json`;
+}

package/out/headless/index.js

@@ -283,8 +283,11 @@ function createHeadlessRunner(config) {
         }
         return customEngine;
     };
-    // Shared session event writer for Layer 2 analytics
-    const sessionEventWriter = new sessionEvents_1.SessionEventWriter();
+    // Shared session event writer for Layer 2 analytics. Rooted under storagePath (not the
+    // os.homedir() default) so tool-call/warrant events land on the same durable volume as
+    // session state — a container's home directory is ephemeral, storagePath honors
+    // AGENTHIPPO_HOME / --state-dir and is what actually survives a restart or scale event.
+    const sessionEventWriter = new sessionEvents_1.SessionEventWriter(path.join(config.storagePath, 'analytics', 'sessions'));
     return {
         async run(options) {
             const result = {

package/out/mcp.js

@@ -271,8 +271,15 @@ function resolveMcpEnvVar(varName, envSources = {}) {
     const aliases = getDataTokenEnvAliases();
     const isDataTokenVar = varName === 'dataToken' || aliases.includes(varName);
     if (tokenFile && isDataTokenVar) {
-        // Token lives in the per-turn file (AGENTHIPPO_DATA_TOKEN_FILE); don't bake into spawn env.
-        return '';
+        // Token lives in the per-turn file (AGENTHIPPO_DATA_TOKEN_FILE); never bake the OBO token
+        // into spawn env. The explicit ${credential:dataToken} placeholder resolves to empty
+        // (AgentHippo-aware servers read the file). A plain ${env:ALIAS} reference falls through to
+        // any operator-provided ambient value so a stock server that reads the var directly still
+        // works, instead of being clobbered to an empty string.
+        if (varName === 'dataToken') {
+            return '';
+        }
+        return process.env[varName] ?? envSources[varName] ?? '';
     }
     if (varName === 'dataToken') {
         return cred?.dataToken?.trim() ?? '';
@@ -465,7 +472,9 @@ function generateCodexMcpConfig(servers, options) {
             // Use separate [mcp_servers.name.env] section — codex binary requires this form
             lines.push('', `[mcp_servers.${s.name}.env]`);
             for (const [k, v] of Object.entries(s.env)) {
-                lines.push(`${k} = ${JSON.stringify(v)}`);
+                // Quote the key: env-var names may contain '.', spaces, etc. that are not valid
+                // TOML bare keys (a bare `my.token` would parse as a nested table).
+                lines.push(`${JSON.stringify(k)} = ${JSON.stringify(v)}`);
             }
         }
         return lines.join('\n');

package/out/remote/handleRemoteChat.js

@@ -96,13 +96,19 @@ async function handleRemoteServeChat(deps, args) {
     try {
         syncService.incrementActiveAgentTurns();
         await observableEmitter.emitTurnStart();
-        await (0, serveClient_js_1.streamRemoteServeChat)({
+        const result = await (0, serveClient_js_1.streamRemoteServeChat)({
             baseUrl: remoteUrl,
             message,
             sessionId: remoteSessionId,
             signal: abortController.signal,
             auth,
         }, observableEmitter);
+        if (!result.ok) {
+            // streamRemoteServeChat already surfaced the failure to the emitter (error + done);
+            // record the turn as failed and propagate to the caller without re-emitting.
+            await observableEmitter.emitTurnEnd(false);
+            return { error: result.error ?? 'Remote serve failed' };
+        }
         await observableEmitter.emitTurnEnd(true);
         return { streaming: true };
     }

package/out/remote/serveClient.js

@@ -77,7 +77,7 @@ async function streamRemoteServeChat(options, emitter) {
         const message = err instanceof Error ? err.message : 'Remote serve connection failed';
         await emitter.error(message);
         await emitter.done();
-        return;
+        return { ok: false, error: message };
     }
     if (!response.ok) {
         clearTimers();
@@ -93,29 +93,39 @@ async function streamRemoteServeChat(options, emitter) {
         }
         await emitter.error(errorMessage);
         await emitter.done();
-        return;
+        return { ok: false, error: errorMessage };
     }
     if (!response.body) {
         clearTimers();
-        await emitter.error('Remote serve returned empty body');
+        const message = 'Remote serve returned empty body';
+        await emitter.error(message);
         await emitter.done();
-        return;
+        return { ok: false, error: message };
     }
     try {
-        await consumeServeSse(response.body, emitter, resetIdle);
+        const streamError = await consumeServeSse(response.body, emitter, resetIdle);
+        return streamError ? { ok: false, error: streamError } : { ok: true };
     }
     finally {
         clearTimers();
     }
 }
+/**
+ * Consume the SSE stream. Returns the message of an `error` event if one was seen
+ * (the turn failed even though the stream ended cleanly), otherwise undefined.
+ */
 async function consumeServeSse(body, emitter, resetIdle) {
     const reader = body.getReader();
     const decoder = new TextDecoder();
     let buffer = '';
     let doneEmitted = false;
+    let streamError;
     const markDone = () => {
         doneEmitted = true;
     };
+    const markError = (message) => {
+        streamError = message;
+    };
     try {
         while (true) {
             const { value, done } = await reader.read();
@@ -125,24 +135,25 @@ async function consumeServeSse(body, emitter, resetIdle) {
             // Any data on the wire means the turn is progressing — push the idle window out.
             resetIdle();
             buffer += decoder.decode(value, { stream: true });
-            buffer = await drainServeSseBuffer(buffer, emitter, markDone);
+            buffer = await drainServeSseBuffer(buffer, emitter, markDone, markError);
             if (doneEmitted) {
-                return;
+                return streamError;
             }
         }
         buffer += decoder.decode();
         if (buffer.trim()) {
-            await drainServeSseBuffer(`${buffer}\n`, emitter, markDone);
+            await drainServeSseBuffer(`${buffer}\n`, emitter, markDone, markError);
         }
         if (!doneEmitted) {
             await emitter.done();
         }
+        return streamError;
     }
     finally {
         reader.releaseLock();
     }
 }
-async function drainServeSseBuffer(buffer, emitter, markDone) {
+async function drainServeSseBuffer(buffer, emitter, markDone, markError) {
     const lines = buffer.split('\n');
     const remainder = lines.pop() ?? '';
     for (const line of lines) {
@@ -160,7 +171,7 @@ async function drainServeSseBuffer(buffer, emitter, markDone) {
         catch {
             continue;
         }
-        const finished = await dispatchServeEvent(event, emitter);
+        const finished = await dispatchServeEvent(event, emitter, markError);
         if (finished) {
             markDone();
             return '';
@@ -168,7 +179,7 @@ async function drainServeSseBuffer(buffer, emitter, markDone) {
     }
     return remainder;
 }
-async function dispatchServeEvent(event, emitter) {
+async function dispatchServeEvent(event, emitter, markError) {
     const type = typeof event.type === 'string' ? event.type : '';
     switch (type) {
         case 'thinking':
@@ -204,9 +215,12 @@ async function dispatchServeEvent(event, emitter) {
             }
             return false;
         }
-        case 'error':
-            await emitter.error(typeof event.message === 'string' ? event.message : 'Remote serve error');
+        case 'error': {
+            const message = typeof event.message === 'string' ? event.message : 'Remote serve error';
+            markError(message);
+            await emitter.error(message);
             return false;
+        }
         case 'done':
             await emitter.done();
             return true;

package/out/shared/providers.js

@@ -79,6 +79,7 @@ exports.PROVIDERS = {
         description: 'local adapter for agents to work with Spotlight and all models from OpenAI, Anthropic, Ollama etc.',
         showInAddApiKeyUI: true,
         isGateway: true, // Can route to any backend
+        deferMissingApiKey: true, // base-url configured; key may be empty in dev
     },
     ollama: {
         id: 'ollama',
@@ -102,6 +103,8 @@ exports.PROVIDERS = {
         showInAddApiKeyUI: false,
         isGateway: true,
         staticHeaders: { 'x-agenthippo-source': 'chat-ui' },
+        credentialRefreshCommand: 'agentide.auth.refreshToken', // refresh stale sign-in JWT on 401
+        deferMissingApiKey: true, // key is the sign-in JWT; route branch prompts sign-in
     },
 };
 // -----------------------------------------------------------------------------