@intx/inference 0.3.0 → 0.4.0

package/dist/assembly.d.ts

@@ -1,3 +1,4 @@
+import type { CredentialMaterialResolver } from "@intx/types";
 import { type BlobReader, type AuditStore, type BeforeToolExtension, type Compactor, type ContextStore, type ContextTransform, type InferenceSource, type ReactorDirector, type ToolDefinition, type ToolResultTransform, type ToolRunner } from "@intx/types/runtime";
 import { type AuditCollector } from "./audit-collector.js";
 import { type AuthzExtensionOptions } from "./authz-extension.js";
@@ -27,6 +28,12 @@ export type ReactorAssemblyConfig = {
     failOverToNextSource?: () => boolean;
     /** Reset `source` to the most-preferred source, in place. */
     resetToPreferredSource?: () => void;
+    /**
+     * Resolves the active source's credential secret by `credentialId` from the
+     * run's credential cell at send time. Threaded verbatim to the reactor;
+     * optional, defaulted fail-closed by the harness when omitted.
+     */
+    readMaterial?: CredentialMaterialResolver;
     toolRunner: ToolRunner;
     contextStore: ContextStore;
     onEvent: (event: ReactorEmittedEvent) => void;
@@ -51,6 +58,7 @@ export type ReactorAssemblyConfig = {
     inferenceRunner?: ReactorConfig["inferenceRunner"];
     gateTimeout?: number;
     shutdownTimeoutMs?: number;
+    doomLoopThreshold?: number | false;
 };
 /**
  * Output of `createReactorAssembly`. The `reactor` is started by the caller as

package/dist/assembly.js

@@ -24,7 +24,7 @@ const DEFAULT_SIZE_CAP_MAX_CHARS = 10_000;
  * different composition.
  */
 export function createReactorAssembly(config) {
-    const { sessionId, director, source, failOverToNextSource, resetToPreferredSource, toolRunner, contextStore, onEvent, authorize, toolDefinitions, auditStore, beforeToolExtensions: callerBeforeToolExtensions, toolResultTransforms: callerToolResultTransforms, contextTransforms, compactors, sizeCapMaxChars, afterCheckpoint: callerAfterCheckpoint, onShutdown: callerOnShutdown, deps, correlationValidator, inferenceRunner, gateTimeout, shutdownTimeoutMs, } = config;
+    const { sessionId, director, source, failOverToNextSource, resetToPreferredSource, readMaterial, toolRunner, contextStore, onEvent, authorize, toolDefinitions, auditStore, beforeToolExtensions: callerBeforeToolExtensions, toolResultTransforms: callerToolResultTransforms, contextTransforms, compactors, sizeCapMaxChars, afterCheckpoint: callerAfterCheckpoint, onShutdown: callerOnShutdown, deps, correlationValidator, inferenceRunner, gateTimeout, shutdownTimeoutMs, doomLoopThreshold, } = config;
     // Audit collector is created up-front so the authz extension can route its
     // decisions through `onDecision`. When no auditStore is supplied, no
     // collector is created and authz runs without decision recording.
@@ -106,6 +106,7 @@ export function createReactorAssembly(config) {
         source,
         ...(failOverToNextSource !== undefined ? { failOverToNextSource } : {}),
         ...(resetToPreferredSource !== undefined ? { resetToPreferredSource } : {}),
+        ...(readMaterial !== undefined ? { readMaterial } : {}),
         toolRunner,
         contextStore,
         onEvent: composedOnEvent,
@@ -126,6 +127,7 @@ export function createReactorAssembly(config) {
         ...(inferenceRunner !== undefined ? { inferenceRunner } : {}),
         ...(gateTimeout !== undefined ? { gateTimeout } : {}),
         ...(shutdownTimeoutMs !== undefined ? { shutdownTimeoutMs } : {}),
+        ...(doomLoopThreshold !== undefined ? { doomLoopThreshold } : {}),
     };
     const reactor = createReactor(reactorConfig);
     const blobReader = createBlobReader(contextStore);

package/dist/auth.d.ts

@@ -1,4 +1,5 @@
 import type { InferenceSource } from "@intx/types/runtime";
+import type { CredentialMaterialResolver } from "@intx/types";
 /**
  * Sentinel for headers that carry the API key verbatim (no prefix).
  * Used by providers like Anthropic (`x-api-key`) and Google
@@ -21,4 +22,4 @@ export declare const BEARER_CREDENTIAL_SENTINEL = "<inject:bearer-credential>";
  * surprising, and no legitimate adapter constructs sentinel-bearing
  * composite values.
  */
-export declare function injectCredentials(headers: Record<string, string>, source: InferenceSource): Record<string, string>;
+export declare function injectCredentials(headers: Record<string, string>, source: InferenceSource, readMaterial: CredentialMaterialResolver): Record<string, string>;

package/dist/auth.js

@@ -1,8 +1,8 @@
 // Sentinel placeholder strings adapters use in their built request
 // headers to declare which credential the harness should fill at send
 // time. The harness scans every header value and replaces exact-match
-// sentinels with material derived from `InferenceSource.apiKey`. Adapters
-// never see the API key.
+// sentinels with the secret resolved from the source's `credentialId`
+// against the run's credential cell. Adapters never see the API key.
 //
 // Each new provider adds a new header name + sentinel choice in its
 // `buildRequest`; the harness needs no per-provider knowledge. The
@@ -38,14 +38,23 @@ export const BEARER_CREDENTIAL_SENTINEL = "<inject:bearer-credential>";
  * surprising, and no legitimate adapter constructs sentinel-bearing
  * composite values.
  */
-export function injectCredentials(headers, source) {
+export function injectCredentials(headers, source, readMaterial) {
+    // Resolve the source's secret lazily and once: only when a header actually
+    // carries a sentinel, so a request with no credential sentinel never touches
+    // the cell, and the fail-closed read (revoked/absent credential) surfaces only
+    // when the secret is genuinely needed.
+    let cachedSecret;
+    const secret = () => {
+        cachedSecret ??= readMaterial(source.credentialId).secret;
+        return cachedSecret;
+    };
     const result = {};
     for (const [name, value] of Object.entries(headers)) {
         if (value === CREDENTIAL_SENTINEL) {
-            result[name] = source.apiKey;
+            result[name] = secret();
         }
         else if (value === BEARER_CREDENTIAL_SENTINEL) {
-            result[name] = `Bearer ${source.apiKey}`;
+            result[name] = `Bearer ${secret()}`;
         }
         else {
             result[name] = value;

package/dist/harness.d.ts

@@ -1,4 +1,5 @@
 import type { ConversationTurn, InferenceEvent, InferenceOptions, InferenceSource } from "@intx/types/runtime";
+import type { CredentialMaterialResolver } from "@intx/types";
 import type { AdapterRegistry } from "./adapter.js";
 /**
  * Default per-call inactivity timeout (ms). Two minutes is conservative
@@ -86,6 +87,7 @@ export type InferenceHarnessOptions = {
     inferenceOptions?: InferenceOptions;
     signal?: AbortSignal;
     nextSeq: () => number;
+    readMaterial?: CredentialMaterialResolver;
     deps: Dependencies;
 };
 /**

package/dist/harness.js

@@ -71,6 +71,13 @@ export function createDependencies(adapters) {
         adapters,
     };
 }
+// Fail-closed default resolver, installed when a caller supplies no
+// `readMaterial`. It throws only if a request actually reaches a credential
+// sentinel, so a sentinel-free mock harness runs without a resolver while a
+// real credentialed request surfaces the missing wiring loudly.
+const unconfiguredCredentialResolver = (credentialId) => {
+    throw new Error(`no credential resolver supplied to the inference harness, but a request needs the secret for credential ${credentialId}`);
+};
 /**
  * Run one fetch lifecycle and yield its events. Ends on the first
  * `inference.error` or `inference.done`. The outer `runInference`
@@ -82,7 +89,7 @@ export function createDependencies(adapters) {
  * directly would bypass retry handling.
  */
 async function* runSingleAttempt(opts) {
-    const { turns, source, inferenceOptions, signal, nextSeq, deps } = opts;
+    const { turns, source, inferenceOptions, signal, nextSeq, readMaterial, deps, } = opts;
     // Per-call options override source-bound defaults. The merge happens
     // here, once, so the adapter and timeout-resolution paths below all
     // see the effective option set without having to remember the
@@ -181,7 +188,7 @@ async function* runSingleAttempt(opts) {
     }
     // Resolve the full URL and inject credentials.
     const url = resolveURL(builtRequest.url, source.baseURL);
-    const headers = injectCredentials(builtRequest.headers, source);
+    const headers = injectCredentials(builtRequest.headers, source, readMaterial ?? unconfiguredCredentialResolver);
     // Per-call timeouts. The inactivity timer fires when the harness
     // hasn't yielded an event for `inactivityTimeoutMs`; the total timer
     // is a wall-clock cap from fetch onwards. We own one AbortController,

package/dist/providers/anthropic.js

@@ -449,12 +449,7 @@ const MessageStart = type({
 });
 const MessageStop = type({ type: "'message_stop'" });
 const Ping = type({ type: "'ping'" });
-const AnthropicSSEEvent = ContentBlockDelta.or(ContentBlockStart)
-    .or(ContentBlockStop)
-    .or(MessageDelta)
-    .or(MessageStart)
-    .or(MessageStop)
-    .or(Ping);
+const AnthropicSSEEvent = type.or(ContentBlockDelta, ContentBlockStart, ContentBlockStop, MessageDelta, MessageStart, MessageStop, Ping);
 // Maps Anthropic's wire usage object onto the internal TokenUsage. Anthropic
 // never reports a distinct thinking-token count, so `thinking` is always 0.
 // Shared by the streaming `message_start` path and the non-streaming

package/dist/reactor.d.ts

@@ -1,4 +1,5 @@
 import type { InboundMessage, InferenceEvent, InferenceSource, ReactorDirector, ContextStore, ToolRunner, AbortReason, BeforeToolExtension, ToolResultTransform, ContextTransform, Compactor } from "@intx/types/runtime";
+import type { CredentialMaterialResolver } from "@intx/types";
 import type { Dependencies, InferenceHarnessOptions } from "./harness.js";
 import type { CorrelationValidator } from "./correlation.js";
 export type ReactorEmittedEvent = InferenceEvent | {
@@ -20,6 +21,13 @@ export type ReactorConfig = {
     failOverToNextSource?: () => boolean;
     /** Reset `source` to the most-preferred source, in place. */
     resetToPreferredSource?: () => void;
+    /**
+     * Resolves the active source's credential secret by `credentialId` from the
+     * run's credential cell at send time. Read live per attempt, so a failover to
+     * a source with a different `credentialId` resolves that source's credential.
+     * Optional: the harness installs a fail-closed default when it is omitted.
+     */
+    readMaterial?: CredentialMaterialResolver;
     toolRunner: ToolRunner;
     contextStore: ContextStore;
     correlationValidator?: CorrelationValidator;
@@ -34,6 +42,16 @@ export type ReactorConfig = {
     onShutdown?: () => Promise<void>;
     gateTimeout?: number;
     shutdownTimeoutMs?: number;
+    /**
+     * Number of consecutive identical tool-call turns that trips doom-loop
+     * detection. A turn's identity is its batch of executed tool calls; a
+     * runaway model repeating the same call burns inference cost with no
+     * progress. On the Nth consecutive identical turn the reactor emits a fatal
+     * `reactor.error` and shuts the run down. Must be a positive integer.
+     * Pass `false` to disable doom-loop detection entirely. Defaults to
+     * `DEFAULT_DOOM_LOOP_THRESHOLD`.
+     */
+    doomLoopThreshold?: number | false;
 };
 export type Reactor = {
     /** Begin processing. Emits reactor.start. Must be called exactly once. */

package/dist/reactor.js

@@ -14,6 +14,7 @@
 // (INFERENCE.md § Agent Reactor)
 import { getLogger } from "@intx/log";
 import { ApprovalDecision, signalKindToGateType } from "@intx/types";
+import { canonicalJsonStringify } from "@intx/types/wire-definition-hash";
 import { type } from "arktype";
 import { runInference } from "./harness.js";
 import { createCapabilities } from "./director.js";
@@ -33,21 +34,54 @@ const SUSPENDED = Symbol("suspended");
 function assertNever(x) {
     throw new Error(`Unhandled resume case: ${JSON.stringify(x)}`);
 }
-function buildHarnessOpts(turns, source, options, signal, nextSeq, deps) {
-    if (options !== undefined) {
-        return {
-            turns,
-            source,
-            inferenceOptions: options,
-            signal,
-            nextSeq,
-            deps,
-        };
-    }
-    return { turns, source, signal, nextSeq, deps };
+function buildHarnessOpts(turns, source, options, signal, nextSeq, readMaterial, deps) {
+    // exactOptionalPropertyTypes is on: only set the optional keys when defined.
+    return {
+        turns,
+        source,
+        ...(options !== undefined ? { inferenceOptions: options } : {}),
+        signal,
+        nextSeq,
+        ...(readMaterial !== undefined ? { readMaterial } : {}),
+        deps,
+    };
 }
 const DEFAULT_GATE_TIMEOUT_MS = 3_600_000;
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 30_000;
+const DEFAULT_DOOM_LOOP_THRESHOLD = 3;
+/**
+ * Resolve the caller-facing `doomLoopThreshold` into the reactor's internal
+ * form: a positive integer when detection is active, or `null` when it is
+ * disabled. `undefined` (omitted) takes the default; `false` disables; a
+ * number is validated here — the construction edge is the one place that owns
+ * the default and rejects a malformed value loudly, so a stray `0`, negative,
+ * or non-integer throws rather than silently disarming the guard. Downstream
+ * code compares against the returned `number | null` and never sees the raw
+ * `false`, whose numeric coercion would otherwise trip the loop immediately.
+ */
+function resolveDoomLoopThreshold(raw) {
+    if (raw === false)
+        return null;
+    if (raw === undefined)
+        return DEFAULT_DOOM_LOOP_THRESHOLD;
+    if (!Number.isInteger(raw) || raw < 1) {
+        throw new Error(`doomLoopThreshold must be a positive integer or false, got ${String(raw)}`);
+    }
+    return raw;
+}
+/**
+ * Order-independent identity of a batch of executed tool calls. Each call
+ * canonicalizes to its name and arguments (the call `id` is excluded, since it
+ * differs on every request); sorting makes a parallel batch match regardless
+ * of the order the model emitted its calls. Two turns share a signature when
+ * they run the same multiset of `(name, arguments)` pairs.
+ */
+function toolBatchSignature(calls) {
+    return calls
+        .map((call) => canonicalJsonStringify({ name: call.name, arguments: call.arguments }))
+        .sort()
+        .join("\n");
+}
 /**
  * Creates a reactor instance bound to the given configuration.
  * Call `start()` to begin the event loop.
@@ -61,6 +95,10 @@ export function createReactor(config) {
     failOverToNextSource = () => false, resetToPreferredSource = () => {
         /* single-source: nothing to reset */
     }, } = config;
+    // Resolved once at the construction edge: a positive integer while detection
+    // is active, or `null` when the caller disabled it with `false`. Every
+    // downstream comparison reads this binding, never the raw config value.
+    const doomLoopThreshold = resolveDoomLoopThreshold(config.doomLoopThreshold);
     // Monotonic sequence counter, scoped to this session.
     let seq = 0;
     function nextSeq() {
@@ -156,9 +194,22 @@ export function createReactor(config) {
     // produces unambiguous start/end pairs downstream.
     let currentMessageRunId = null;
     let currentMessageId = null;
+    // Doom-loop detection state, scoped to the current message run. Each executed
+    // tool-call turn is reduced to a batch signature; consecutive identical
+    // signatures accumulate here, and the run is broken when the count reaches
+    // `doomLoopThreshold`. This is run-scoped, not cycle-scoped: it resets only in
+    // `openMessageRun`, never in `resetCycleAccumulators`. It is also deliberately
+    // ephemeral (closure state, not persisted) -- a mid-run restart resets it to
+    // zero and the loop simply re-accumulates and trips a few turns later.
+    let lastToolBatchSignature = null;
+    let toolBatchRepeatCount = 0;
+    let lastToolBatchNames = [];
     function openMessageRun(messageId) {
         currentMessageRunId = crypto.randomUUID();
         currentMessageId = messageId;
+        lastToolBatchSignature = null;
+        toolBatchRepeatCount = 0;
+        lastToolBatchNames = [];
         emit({
             type: "message.run.started",
             seq: nextSeq(),
@@ -448,7 +499,7 @@ export function createReactor(config) {
             // prior cycle must not leave the agent permanently demoted.
             resetToPreferredSource();
             for (;;) {
-                const harnessOpts = buildHarnessOpts(prompt, config.source, options, signal, nextSeq, deps);
+                const harnessOpts = buildHarnessOpts(prompt, config.source, options, signal, nextSeq, config.readMaterial, deps);
                 let lastDone;
                 let lastError;
                 for await (const event of inferenceRunner(harnessOpts)) {
@@ -627,6 +678,25 @@ export function createReactor(config) {
         // Suspended calls are parked, not answered: they contribute no tool
         // result to history and no tool.done continuation event.
         const results = outcomes.filter((o) => o !== SUSPENDED);
+        // Doom-loop accounting keys off the calls that actually ran, aligned to
+        // their outcome by index (both the parallel and serial paths above keep
+        // `outcomes` in `calls` order). A parked call contributes nothing, so a
+        // suspend-then-redispatch cycle counts its one real execution once. The
+        // loop reads `toolBatchRepeatCount` after this returns and breaks the run
+        // when it reaches the threshold. A `null` threshold means detection is
+        // disabled, so the accounting is skipped entirely.
+        const ranCalls = calls.filter((_call, i) => outcomes[i] !== SUSPENDED);
+        if (doomLoopThreshold !== null && ranCalls.length > 0) {
+            const signature = toolBatchSignature(ranCalls);
+            if (signature === lastToolBatchSignature) {
+                toolBatchRepeatCount += 1;
+            }
+            else {
+                lastToolBatchSignature = signature;
+                toolBatchRepeatCount = 1;
+            }
+            lastToolBatchNames = ranCalls.map((call) => call.name);
+        }
         cycleToolCallsExecuted += results.length;
         if (addToHistory && stateManager !== null && results.length > 0) {
             stateManager.appendTurn(createToolResultTurn(results));
@@ -1065,6 +1135,17 @@ export function createReactor(config) {
                 const parallel = toolsAction.parallel !== false;
                 const addToHistory = toolsAction.addToHistory !== false;
                 await executeTools(toolsAction.calls, parallel, addToHistory);
+                if (doomLoopThreshold !== null &&
+                    toolBatchRepeatCount >= doomLoopThreshold) {
+                    const tools = lastToolBatchNames.join(", ");
+                    const message = `Doom loop detected: an identical tool batch (${tools}) executed ` +
+                        `${String(doomLoopThreshold)} times consecutively`;
+                    emitError(message, true);
+                    closeMessageRun("failed", { message, kind: "doom_loop" });
+                    done = true;
+                    await initiateShutdown();
+                    break;
+                }
                 continue;
             }
             // No infer/tools/reply/suspend/wait/compact action — if a checkpoint

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@intx/inference",
   "description": "Provider-agnostic inference runtime with Anthropic, OpenAI, and Google GenAI adapters",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "LGPL-2.1-only",
   "type": "module",
   "exports": {
@@ -17,12 +17,12 @@
     }
   },
   "dependencies": {
-    "@intx/log": "0.3.0",
-    "@intx/types": "0.3.0",
+    "@intx/log": "0.4.0",
+    "@intx/types": "0.4.0",
     "arktype": "^2.1.29"
   },
   "devDependencies": {
-    "@intx/mime": "0.3.0"
+    "@intx/mime": "0.4.0"
   },
   "files": [
     "dist",