@gaunt-sloth/core 2.0.0-beta.1 → 2.0.0-beta.3

package/dist/utils/vertexaiUtils.js

@@ -1,3 +1,4 @@
+import { env } from '#src/utils/systemUtils.js';
 export function isVertexGoogleLlm(llm) {
     if (!llm || typeof llm !== 'object') {
         return false;
@@ -10,14 +11,170 @@ export function isVertexGoogleLlm(llm) {
 //  - OAuth "invalid_grant" with "invalid_rapt" subtype, or any "reauth" wording
 //    (expired ADC credentials / reauth proof token — `gcloud auth ... login` needed)
 const VERTEX_AUTH_ERROR_PATTERN = /\b401\b|unauthori[sz]ed|invalid_grant|invalid_rapt|reauth/i;
+/**
+ * Read the credential in use off the CONSTRUCTED client, mirroring the same precedence its own
+ * request path applies: an API key wins, then service-account credentials, then ADC. Determined from
+ * the client rather than from config, because the same config shape can produce different
+ * credentials depending on the environment — which is the whole reason this hint was wrong before.
+ *
+ * Never throws: this runs while formatting somebody's error, and losing the original message to a
+ * secondary failure would be worse than a less specific hint.
+ */
+function vertexAuthMode(llm) {
+    try {
+        const client = llm?.apiClient;
+        if (!client) {
+            return 'unknown';
+        }
+        if (typeof client.hasApiKey === 'function' && client.hasApiKey()) {
+            return 'apiKey';
+        }
+        if (client.credentials !== undefined) {
+            return 'serviceAccount';
+        }
+        if (client.googleAuth !== undefined) {
+            return 'adc';
+        }
+        return 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * The remedy sentences, one per credential. Each is true for every session that reaches it and names
+ * only things that session can actually change.
+ *
+ * The API-key branch covers two setups that are indistinguishable on the constructed client — an
+ * `apiKey` in the `llm` block, and a `.gsloth.config.mjs` that builds `ChatGoogle` itself and picks
+ * up `GOOGLE_API_KEY` from the environment — so it names both sources rather than asserting one.
+ */
+const VERTEX_AUTH_GUIDANCE = {
+    apiKey: 'This session is authenticating with an API key (Vertex AI express mode), not with ' +
+        'Application Default Credentials, so `gcloud auth` will not change it. ' +
+        'The key is the `apiKey` in your `llm` block — or, if your `.gsloth.config.mjs` constructs ' +
+        '`ChatGoogle` itself and so bypasses the preset, `GOOGLE_API_KEY` from your environment. ' +
+        'A Google AI Studio key is not valid for Vertex AI endpoints: use a Vertex AI express-mode ' +
+        'key, or remove the key to fall back to ADC.',
+    serviceAccount: 'This session is authenticating with a Google Cloud service account — from `credentials` in ' +
+        'your `llm` block, or `GOOGLE_CLOUD_CREDENTIALS` in your environment — not with Application ' +
+        'Default Credentials, so `gcloud auth` will not change it. ' +
+        'Check that the service-account key is still valid and that it may use the Vertex AI API in ' +
+        'this project.',
+    adc: 'This session authenticates through Application Default Credentials: run `gcloud auth login` ' +
+        'and `gcloud auth application-default login`. ' +
+        'No API key is in use — a `type: vertexai` config ignores any `GOOGLE_API_KEY` in your ' +
+        'environment, so unsetting that will not help here.',
+    unknown: 'Vertex AI accepts three credentials and only one is in use per session: Application Default ' +
+        'Credentials (`gcloud auth application-default login`), a service account (`credentials` or ' +
+        '`GOOGLE_CLOUD_CREDENTIALS`), or an express-mode API key (`apiKey` in the `llm` block). ' +
+        'Check the one this session is configured for — a Google AI Studio key is not valid for ' +
+        'Vertex AI endpoints.',
+};
+/**
+ * The longest value still treated as a filesystem path. 260 is Windows' classic `MAX_PATH`, which is
+ * a defensible ceiling for a path and sits an order of magnitude below any credential: the deepest
+ * realistic ADC path — a CI runner's temp directory plus
+ * `application_default_credentials.json` — is around 120 characters, while a service-account key is
+ * ~1700 as JSON and ~2300 base64-encoded. Nothing has to land in the gap for the test to be useful.
+ */
+const MAX_CREDENTIAL_PATH_LENGTH = 260;
+/**
+ * Whether a value is the credential ITSELF rather than a path to one.
+ *
+ * Deliberately tested by SIZE first rather than by shape. The shape test alone (`{`) catches a
+ * pasted JSON key and misses the base64 form that CI secret stores hand out, and widening it one
+ * encoding at a time only ever covers the last spelling somebody thought of — the value is
+ * attacker-irrelevant but user-supplied and its formats are open-ended. Length closes the class
+ * because every credential is enormous next to every path. The shape test is kept alongside it for
+ * the short, hand-trimmed JSON that a size test alone would let through.
+ */
+function isCredentialContent(value) {
+    return value.length > MAX_CREDENTIAL_PATH_LENGTH || value.trimStart().startsWith('{');
+}
+/**
+ * Where an ADC session's credentials are being read from when an environment variable names a file,
+ * and the spelling of the variable that named it — `undefined` when no such variable is in play.
+ *
+ * THIS IS THE ONE ENVIRONMENT READ IN THIS FILE AND IT IS DELIBERATE, so read it against the
+ * comment on {@link vertexAuthMode} rather than as a contradiction of it. That function decides
+ * WHICH credential is in use and must keep doing so from the constructed client alone. This one
+ * decides nothing: the session has already been classified as ADC from the client, and the
+ * environment is consulted only to compose the DIAGNOSTIC SENTENCE for it. Read-only, through the
+ * `systemUtils` accessor like every other environment read in this package.
+ *
+ * It is not client-derived because there is nothing client-derived to be had. Measured on
+ * google-auth-library 10.9.1: `GoogleAuth.keyFilename` is populated only from constructor options,
+ * so on a Vertex client it is `undefined` both with and without the variable set, and stays
+ * `undefined` after a resolution attempt. The only artifact a successful resolution leaves behind is
+ * `jsonContent` — the parsed key file, which holds the private key and must never be printed.
+ *
+ * Mirrors `googleauth.js` rather than reinventing it: both spellings, upper case first, and an empty
+ * value falls through to the well-known file instead of counting as set.
+ */
+function adcCredentialFileFromEnvironment() {
+    for (const variable of ['GOOGLE_APPLICATION_CREDENTIALS', 'google_application_credentials']) {
+        const path = env[variable];
+        if (!path) {
+            continue;
+        }
+        // First non-empty wins, exactly as the library's `||` does — so a value that is credential
+        // CONTENT rather than a path ends the search rather than falling through to the other spelling.
+        //
+        // Pasting the service-account key into the variable instead of writing it to a file is a common
+        // CI misconfiguration, and such a session must NOT be described below. There is no file for the
+        // message to point at, so naming one would be exactly the kind of claim-that-does-not-hold this
+        // hint exists to avoid; and the value is a private key, while this message also reaches the log
+        // stream and debug dumps. It falls back to the pinned `adc` sentence, which asserts nothing
+        // about where the credentials came from.
+        return isCredentialContent(path) ? undefined : { variable, path };
+    }
+    return undefined;
+}
+/**
+ * The remedy for an ADC session whose credentials come from a file named in the environment.
+ *
+ * The diagnosis is the same as the plain `adc` one and is CORRECT — this really is ADC. What
+ * differs is that the plain remedy is inert here: `google-auth-library` resolves this variable
+ * before it reads the well-known file, so `gcloud auth application-default login` writes a file
+ * this session never opens, reports success, and leaves the failure exactly where it was. Naming
+ * the command anyway is the point — the reader has usually just run it.
+ */
+function adcFromEnvironmentGuidance(variable, path) {
+    return ('This session authenticates through Application Default Credentials, and those credentials ' +
+        'come from `' +
+        variable +
+        '` in your environment, which points at `' +
+        path +
+        '`. That variable is resolved BEFORE the well-known credentials file, so ' +
+        '`gcloud auth application-default login` writes a file this session never reads and the ' +
+        'failure survives it. Repair or replace the credentials in the file above, or unset ' +
+        '`' +
+        variable +
+        '` so the well-known Application Default Credentials file is used instead. ' +
+        'No API key is in use — a `type: vertexai` config ignores any `GOOGLE_API_KEY` in your ' +
+        'environment, so unsetting that will not help here.');
+}
+/**
+ * The sentence for a classified session. Only the ADC branch is refined further, and only into the
+ * one sub-case whose remedy would otherwise be inert; every other mode returns its pinned string
+ * unchanged.
+ */
+function vertexAuthGuidance(mode) {
+    if (mode === 'adc') {
+        const fromEnvironment = adcCredentialFileFromEnvironment();
+        if (fromEnvironment) {
+            return adcFromEnvironmentGuidance(fromEnvironment.variable, fromEnvironment.path);
+        }
+    }
+    return VERTEX_AUTH_GUIDANCE[mode];
+}
 export function enhanceVertexUnauthorizedMessage(originalMessage, llm) {
     if (!isVertexGoogleLlm(llm) || !VERTEX_AUTH_ERROR_PATTERN.test(originalMessage)) {
         return originalMessage;
     }
     return (`${originalMessage}\n\n` +
         'Vertex AI authentication failed. ' +
-        'If you use ADC, run `gcloud auth login` and `gcloud auth application-default login`. ' +
-        'Also make sure `GOOGLE_API_KEY` is unset or not a Google AI Studio key, ' +
-        'since AI Studio keys are not valid for Vertex AI endpoints.\n');
+        `${vertexAuthGuidance(vertexAuthMode(llm))}\n`);
 }
 //# sourceMappingURL=vertexaiUtils.js.map

package/dist/utils/vertexaiUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"vertexaiUtils.js","sourceRoot":"","sources":["../../src/utils/vertexaiUtils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAA6B,CAAC;IAC5C,OAAO,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,gEAAgE;AAChE,gFAAgF;AAChF,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,4DAA4D,CAAC;AAE/F,MAAM,UAAU,gCAAgC,CAAC,eAAuB,EAAE,GAAY;IACpF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChF,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CACL,GAAG,eAAe,MAAM;QACxB,mCAAmC;QACnC,uFAAuF;QACvF,0EAA0E;QAC1E,+DAA+D,CAChE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vertexaiUtils.js","sourceRoot":"","sources":["../../src/utils/vertexaiUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAEhD,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAA6B,CAAC;IAC5C,OAAO,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,gEAAgE;AAChE,gFAAgF;AAChF,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,4DAA4D,CAAC;AAY/F;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GACV,GAGD,EAAE,SAAS,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAmC;IAC3D,MAAM,EACJ,oFAAoF;QACpF,wEAAwE;QACxE,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,6CAA6C;IAC/C,cAAc,EACZ,6FAA6F;QAC7F,6FAA6F;QAC7F,4DAA4D;QAC5D,6FAA6F;QAC7F,eAAe;IACjB,GAAG,EACD,8FAA8F;QAC9F,+CAA+C;QAC/C,wFAAwF;QACxF,oDAAoD;IACtD,OAAO,EACL,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,sBAAsB;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,MAAM,GAAG,0BAA0B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,gCAAgC;IACvC,KAAK,MAAM,QAAQ,IAAI,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,2FAA2F;QAC3F,gGAAgG;QAChG,EAAE;QACF,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,4FAA4F;QAC5F,yCAAyC;QACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CAAC,QAAgB,EAAE,IAAY;IAChE,OAAO,CACL,4FAA4F;QAC5F,aAAa;QACb,QAAQ;QACR,0CAA0C;QAC1C,IAAI;QACJ,0EAA0E;QAC1E,yFAAyF;QACzF,qFAAqF;QACrF,GAAG;QACH,QAAQ;QACR,4EAA4E;QAC5E,wFAAwF;QACxF,oDAAoD,CACrD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAoB;IAC9C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,eAAe,GAAG,gCAAgC,EAAE,CAAC;QAC3D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,0BAA0B,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,eAAuB,EAAE,GAAY;IACpF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChF,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CACL,GAAG,eAAe,MAAM;QACxB,mCAAmC;QACnC,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAC/C,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gaunt-sloth/core",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.3",
   "description": "Core utilities and types for Gaunt Sloth",
   "license": "MIT",
   "author": "Andrew Kondratev",
@@ -30,11 +30,11 @@
     "#src/*.js": "./dist/*.js"
   },
   "dependencies": {
-    "@langchain/core": "^1.2.5",
-    "@langchain/langgraph": "^1.4.9",
+    "@langchain/core": "^1.2.9",
+    "@langchain/langgraph": "^1.4.13",
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
-    "langchain": "^1.5.5",
+    "langchain": "^1.5.10",
     "string-width": "^8.2.2",
     "zod": "^4.4.3"
   },
@@ -89,6 +89,7 @@
   "scripts": {
     "build": "tsc",
     "schema:generate": "node scripts/generate-config-schema.mjs",
-    "surface:generate": "node scripts/generate-type-surface.mjs"
+    "surface:generate": "node scripts/generate-type-surface.mjs",
+    "value-surface:generate": "node scripts/generate-value-surface.mjs"
   }
 }

package/schema/gsloth-config.schema.json

@@ -427,6 +427,9 @@
             "rater": {
               "type": "string"
             },
+            "alignmentChecker": {
+              "type": "string"
+            },
             "allow": {
               "type": "array",
               "items": {
@@ -776,6 +779,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {
@@ -939,6 +945,11 @@
                 },
                 "errorOnReviewFail": {
                   "type": "boolean"
+                },
+                "timeoutMs": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 9007199254740991
                 }
               }
             },
@@ -1097,6 +1108,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {
@@ -1257,6 +1271,11 @@
                 },
                 "errorOnReviewFail": {
                   "type": "boolean"
+                },
+                "timeoutMs": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 9007199254740991
                 }
               }
             },
@@ -1409,6 +1428,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {
@@ -1701,6 +1723,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {
@@ -1993,6 +2018,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {
@@ -2285,6 +2313,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {
@@ -2577,6 +2608,9 @@
                     "rater": {
                       "type": "string"
                     },
+                    "alignmentChecker": {
+                      "type": "string"
+                    },
                     "allow": {
                       "type": "array",
                       "items": {