@maintainabilityai/research-runner 0.1.16 → 0.1.18

package/dist/llm/llm-router.js

@@ -67,17 +67,24 @@ async function callAnthropicTier(opts, tierModels) {
     };
 }
 /**
- * GitHub Models returns 401 / 403 / 404 when the token can't reach the
- * requested model (typically the workflow bot token hitting a "custom"-
- * tier model like gpt-5-chat). These are recoverable via fallback;
- * everything else (timeouts, 5xx, 413 cap, parse errors) should
- * propagate.
+ * GitHub Models returns these statuses when the token can't reach the
+ * requested model or is being throttled. All recoverable via the
+ * github-models→github-models fallback (custom-tier → low-tier).
+ *
+ *   401 / 403 — token lacks `models:read` or hasn't been enrolled in
+ *               the custom tier (workflow bot vs Copilot PAT)
+ *   404      — model id not visible to this token tier
+ *   429      — rate limited on the primary tier; the low-tier model
+ *              has its own bucket so the fallback often succeeds
+ *
+ * Everything else (timeouts, 5xx, 413 token cap, parse errors)
+ * propagates — those are not "wrong model" problems.
  */
 function isModelAccessError(err) {
     if (!(err instanceof Error)) {
         return false;
     }
-    return /GitHub Models returned 40[134]:/.test(err.message);
+    return /GitHub Models returned (?:401|403|404|429):/.test(err.message);
 }
 async function callGitHubModelsTier(opts, tierModels) {
     if (!opts.githubToken) {

package/dist/search/uspto-client.js

@@ -100,11 +100,17 @@ async function usptoSearch(opts) {
         try {
             const xmlRes = await fetchImpl(r._xmlUri, {
                 method: 'GET',
-                // The signed XML URI lives on a CDN/storage host, not api.uspto.gov.
-                // It accepts unauthenticated GETs; sending X-API-Key actually causes
-                // some hosts to 403. Use a vanilla request with a polite User-Agent.
+                // Mirror the NCMS reference exactly: same headers dict on the
+                // search call AND the XML fetch (X-API-Key + Accept: json). My
+                // earlier "drop X-API-Key on stage 2" was wrong — the CDN does
+                // gate on it, and removing it produced http403 across the
+                // board (seen in #49 logs: "0/5 fetched, failures: http403 ×5").
+                // The Accept header looks wrong-shape (json for an XML doc) but
+                // the upstream ignores it and returns XML regardless; matches
+                // the NCMS pattern that works in production.
                 headers: {
-                    accept: 'application/xml,text/xml,*/*',
+                    accept: 'application/json',
+                    'X-API-Key': opts.apiKey,
                     'user-agent': 'maintainabilityai-research-runner/1.0',
                 },
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainabilityai/research-runner",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Research + PRD agent runner — orchestrates the Archeologist and PRD pipelines for the MaintainabilityAI governance mesh",
   "license": "MIT",
   "author": "MaintainabilityAI",