@inflexa-ai/harness 0.46.0 → 0.46.2

package/dist/app/chat-turn-workflow.js

@@ -29,7 +29,7 @@ import { askPartOf } from "../tools/approval/gateway.js";
 import { stepUuid } from "../tools/workspace/edit-file.js";
 import { openThread, readTurnContext, runOpenTurn, userTextOf, } from "./chat-turn.js";
 import { CHAT_STREAM_KEY, createTurnStreamWriter, readChatTurn } from "../loop/chat-stream.js";
-import { credentialGuard, turnCredentials, withRootTurn } from "../loop/turn-credentials.js";
+import { credentialGuard, liveAuth, turnCredentials, withRootTurn } from "../loop/turn-credentials.js";
 import { assembleMessages, loadHistoryView, sanitizedUserMessage } from "./message-assembly.js";
 /** The name of the turn workflow. */
 export const CHAT_TURN_WORKFLOW = "chat-turn";
@@ -270,11 +270,10 @@ async function runTurnWorkflow(deps, input, signal) {
     const session = {
         identity: { user: input.userId },
         scope: { kind: "analysis", analysisId: input.analysisId, threadId: input.threadId },
-        // The credential comes at each read, thus a call after a resume uses the credential that the resume put. A
-        // turn with no credential makes no model call, thus no adapter reads the empty value.
-        get auth() {
-            return turnCredentials.of(input.turnId) ?? {};
-        },
+        // The credential comes at each read, also through a copy of the session, thus a call after a resume uses the
+        // credential that the resume put. A turn with no credential makes no model call, thus no adapter reads the
+        // empty value.
+        auth: liveAuth(() => turnCredentials.of(input.turnId)),
     };
     const ran = await runOpenTurn(deps, { analysisId: input.analysisId, threadId: input.threadId, userInput: input.userText }, { kind: "ok", threadType: input.threadType, history: view, userMessage: opening.userMessage, contextRecords: opening.contextRecords }, agent.value, { session, author: input.author, startedAtMs: input.startedAtMs, promptCache: input.promptCache }, transport);
     const { outcome } = ran;

package/dist/lib/hooks.d.ts

@@ -24,6 +24,11 @@ export type GateFailure = {
     readonly reason: string;
     /** True when the host asks the harness to suspend the work in place of a failure. */
     readonly suspend: boolean;
+    /**
+     * True when the host refuses the credential of the caller: it is expired, revoked, or absent. A person repairs
+     * it, thus a work that can pause waits for a resume. The suspend flag wins over it.
+     */
+    readonly credential?: boolean;
 };
 /**
  * The settlement a gate's `ResultAsync` resolves to, read structurally. An embedder whose neverthrow is
@@ -54,6 +59,10 @@ export type GateRefusal = {
     readonly kind: "suspended";
     readonly gate: GateName;
     readonly reason: string;
+} | {
+    readonly kind: "credential";
+    readonly gate: GateName;
+    readonly reason: string;
 };
 /**
  * The host can build its `Result` with its own copy of neverthrow. The helper

package/dist/lib/hooks.js

@@ -30,6 +30,11 @@ async function settlementOf(result) {
     }
     return await result;
 }
+function refusalKindOf(failure) {
+    if (failure.suspend)
+        return "suspended";
+    return failure.credential === true ? "credential" : "failed";
+}
 /**
  * The host can build its `Result` with its own copy of neverthrow. The helper
  * gives the outcome again as a `Result` of the copy of the harness. Thus the
@@ -41,7 +46,7 @@ export function passGate(gate, result) {
         const settled = await settlementOf(result);
         if (settlementOk(settled))
             return ok(settled.value);
-        return err({ kind: settled.error.suspend ? "suspended" : "failed", gate, reason: settled.error.reason });
+        return err({ kind: refusalKindOf(settled.error), gate, reason: settled.error.reason });
     })());
 }
 export async function deliverNotice(log, notice, result) {

package/dist/loop/sub-agent.js

@@ -23,7 +23,7 @@ import { DATA_PROFILE_RUN_LITERAL } from "../contracts/data-profile.js";
 import { createSubAgentActivityTracker } from "../contracts/subagent-activity.js";
 import { CHAT_STREAM_KEY, createTurnStreamWriter, SUB_AGENT_STREAM_PART } from "./chat-stream.js";
 import { addChatUsage } from "./metrics.js";
-import { credentialGuard, currentRootTurn, turnCredentials, withRootTurn } from "./turn-credentials.js";
+import { credentialGuard, currentRootTurn, liveAuth, turnCredentials, withRootTurn } from "./turn-credentials.js";
 /** The work of a child, from its input. A data profile runs under one constant frame and starts no child, thus it gives none. */
 function workOf(input) {
     const { analysisId, threadId } = input.scope;
@@ -59,11 +59,10 @@ export function registerSubAgent(name, body, pauses) {
             scope: input.scope,
             provenance: input.provenance,
             runFrame: input.runFrame,
-            // The credential comes at each read, thus a call after a resume of the turn uses the credential that the
-            // resume put. A child with no credential makes no model call, thus no adapter reads the empty value.
-            get auth() {
-                return authOf() ?? {};
-            },
+            // The credential comes at each read, also through a copy of the session, thus a call after a resume of the
+            // turn uses the credential that the resume put. A child with no credential makes no model call, thus no
+            // adapter reads the empty value.
+            auth: liveAuth(authOf),
         };
         // The input holds the provenance of the caller. The body of the sub-agent extends it.
         const caller = { agentId: input.provenance.agentId, callPath: [...input.provenance.callPath] };

package/dist/loop/turn-credentials.d.ts

@@ -17,6 +17,11 @@ export declare const turnCredentials: {
     /** The function of the host for a turn that this process did not open. */
     setHostCredential(credentialFor: ((turnId: string) => AuthContext | undefined) | undefined): void;
 };
+/**
+ * The `auth` of a session whose credential can come later: each read goes to `current`, and no credential reads as an
+ * empty object. A copy of the session keeps this object, thus each copy sees the credential that a resume puts.
+ */
+export declare function liveAuth(current: () => AuthContext | undefined): AuthContext;
 /** Run the body of a turn, or of one of its sub-agents, with the id of its root turn in its context. */
 export declare function withRootTurn<T>(turnId: string, body: () => Promise<T>): Promise<T>;
 /** The id of the root chat turn of the body that runs, or `undefined` outside a chat turn. */

package/dist/loop/turn-credentials.js

@@ -29,6 +29,23 @@ export const turnCredentials = {
         hostCredential = credentialFor;
     },
 };
+/**
+ * The `auth` of a session whose credential can come later: each read goes to `current`, and no credential reads as an
+ * empty object. A copy of the session keeps this object, thus each copy sees the credential that a resume puts.
+ */
+export function liveAuth(current) {
+    const credential = () => current() ?? {};
+    return new Proxy({}, {
+        get: (_shell, key) => Reflect.get(credential(), key),
+        has: (_shell, key) => Reflect.has(credential(), key),
+        ownKeys: () => Reflect.ownKeys(credential()),
+        getOwnPropertyDescriptor: (_shell, key) => {
+            const descriptor = Reflect.getOwnPropertyDescriptor(credential(), key);
+            // A proxy can report a key that its shell does not hold only as configurable.
+            return descriptor === undefined ? undefined : { ...descriptor, configurable: true };
+        },
+    });
+}
 /** Run the body of a turn, or of one of its sub-agents, with the id of its root turn in its context. */
 export function withRootTurn(turnId, body) {
     return rootTurn.run(turnId, body);

package/dist/providers/request-headers.js

@@ -16,7 +16,16 @@ export function requestHeadersFor(hook, session) {
 }
 export function headersRefusalError(refusal, workload) {
     const message = `The request headers hook refused the model call for ${workload}: ${refusal.reason}`;
-    return refusal.kind === "suspended"
-        ? { type: "suspend", retryable: false, reason: refusal.reason, message }
-        : { type: "provider", retryable: false, message };
+    switch (refusal.kind) {
+        case "suspended":
+            return { type: "suspend", retryable: false, reason: refusal.reason, message };
+        case "credential":
+            return { type: "auth", retryable: false, message };
+        case "failed":
+            return { type: "provider", retryable: false, message };
+        default: {
+            const exhaustive = refusal;
+            return exhaustive;
+        }
+    }
 }

package/dist/testing.d.ts

@@ -7,6 +7,7 @@
  * embedder imports it from `@inflexa-ai/harness/testing`.
  */
 import type { LanguageModelV4CallOptions, SharedV4ProviderMetadata } from "@ai-sdk/provider";
+import type { ResolveRequestHeaders } from "./providers/request-headers.js";
 export { inProcessChatTurns } from "./app/in-process-turn.js";
 import type { ChatProvider, ChatUsage, ProviderCapabilities } from "./providers/types.js";
 export type ScriptedPart = {
@@ -57,4 +58,5 @@ export declare function callTools(...calls: readonly ScriptedPart[]): ScriptedRe
 export declare function scriptedModel(script: readonly ScriptStep[], options?: {
     readonly capabilities?: Partial<ProviderCapabilities>;
     readonly maxRetries?: number;
+    readonly resolveRequestHeaders?: ResolveRequestHeaders;
 }): ScriptedModel;

package/dist/testing.js

@@ -91,6 +91,11 @@ export function scriptedModel(script, options = {}) {
             return { stream: convertArrayToReadableStream(streamOf(entry, index)) };
         },
     });
-    const provider = createAiSdkProvider({ model, capabilities: options.capabilities, maxRetries: options.maxRetries ?? 0 });
+    const provider = createAiSdkProvider({
+        model,
+        capabilities: options.capabilities,
+        maxRetries: options.maxRetries ?? 0,
+        resolveRequestHeaders: options.resolveRequestHeaders,
+    });
     return { provider, calls };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@inflexa-ai/harness",
-    "version": "0.46.0",
+    "version": "0.46.2",
     "description": "Host-agnostic bioinformatics agent harness — an agent loop on the AI SDK, DBOS-durable workflows, sandboxed compute.",
     "license": "Apache-2.0",
     "type": "module",