@mastra/factory 0.24.0-alpha.6 → 0.24.0-alpha.8

package/dist/routes/provider-credentials.js

@@ -1,4 +1,5 @@
 import { factoryUserOrgId } from "../auth.js";
+import { providerDisplayName } from "../provider-display-name.js";
 import { getCredentialProviderId as getAuthProviderId } from "@mastra/code-sdk/providers/model-ids";
 //#region src/routes/provider-credentials.ts
 /**
@@ -6,7 +7,7 @@ import { getCredentialProviderId as getAuthProviderId } from "@mastra/code-sdk/p
 * *catalog* provider id (what the routes and settings UI use). All flows need
 * no inbound connection to the server: Anthropic uses paste-code PKCE, the
 * rest use RFC 8628-style device codes. `subscription` names the plan the
-* sign-in bills, as shown under a reply.
+* sign-in bills, as shown under a reply and in the composer.
 */
 const WEB_OAUTH_PROVIDERS = {
 	anthropic: {
@@ -26,6 +27,9 @@ const WEB_OAUTH_PROVIDERS = {
 		subscription: "SuperGrok/X Premium+"
 	}
 };
+function credentialLabel(provider, credentialType) {
+	return credentialType === "api_key" ? `${providerDisplayName(provider)} API key` : WEB_OAUTH_PROVIDERS[provider]?.subscription;
+}
 /**
 * The tenant credentials domain, when registered and ready. `undefined` means
 * the factory never ran (no handle threaded in) or the domain's init failed
@@ -88,6 +92,6 @@ async function listTenantCredentialsForRequest({ c, auth, credentials }) {
 	return storage.listCredentials(tenantOrgId(tenant), tenant.userId);
 }
 //#endregion
-export { WEB_OAUTH_PROVIDERS, getAuthProviderId, getTenantCredentialsStorage, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId };
+export { WEB_OAUTH_PROVIDERS, credentialLabel, getAuthProviderId, getTenantCredentialsStorage, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId };
 
 //# sourceMappingURL=provider-credentials.js.map

package/dist/routes/provider-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials.js","names":[],"sources":["../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport { factoryUserOrgId } from '../auth.js';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the credential id, which differs from the\n * catalog provider id for OpenAI (`openai-codex`) and Kimi (`kimi-for-coding`).\n * Tenant rows use the same keying so one lookup serves both OAuth tokens and\n * API keys, and match what model resolution reads.\n */\nexport { getCredentialProviderId as getAuthProviderId } from '@mastra/code-sdk/providers/model-ids';\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes. `subscription` names the plan the\n * sign-in bills, as shown under a reply.\n */\nexport const WEB_OAUTH_PROVIDERS: Readonly<Record<string, { flow: LoginSessionKind; subscription: string }>> = {\n  anthropic: { flow: 'paste-code', subscription: 'Claude Pro/Max' },\n  openai: { flow: 'device-code', subscription: 'ChatGPT Plus/Pro' },\n  'github-copilot': { flow: 'device-code', subscription: 'GitHub Copilot' },\n  xai: { flow: 'device-code', subscription: 'SuperGrok/X Premium+' },\n};\n\nexport type CredentialContext =\n  | { mode: 'local' }\n  | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? factoryUserOrgId({ id: tenant.userId }) ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";;;;;;;;;;AAyCA,MAAa,sBAAkG;CAC7G,WAAW;EAAE,MAAM;EAAc,cAAc;CAAiB;CAChE,QAAQ;EAAE,MAAM;EAAe,cAAc;CAAmB;CAChE,kBAAkB;EAAE,MAAM;EAAe,cAAc;CAAiB;CACxE,KAAK;EAAE,MAAM;EAAe,cAAc;CAAuB;AACnE;;;;;;AAWA,eAAsB,4BACpB,aAC8C;CAC9C,IAAI,CAAC,aAAa,OAAO,KAAA;CACzB,IAAI;EACF,MAAM,YAAY,YAAY;CAChC,QAAQ;EACN;CACF;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,YAAY,QAAoD;CAC9E,OAAO,OAAO,SAAS,iBAAiB,EAAE,IAAI,OAAO,OAAO,CAAC,KAAK,QAAQ,OAAO;AACnF;;;;;;AAOA,eAAsB,yBAAyB,EAC7C,GACA,MACA,eAMsD;CACtD,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ;EAIX,IAAI,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EAC9E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SACH,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO;EAAE,MAAM;EAAU;EAAS,OAAO,YAAY,MAAM;EAAG,QAAQ,OAAO;CAAO;AACtF;;;;;;;;AASA,eAAsB,gCAAgC,EACpD,GACA,MACA,eAM0C;CAC1C,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAA;CAC1C,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE"}
+{"version":3,"file":"provider-credentials.js","names":[],"sources":["../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport { factoryUserOrgId } from '../auth.js';\nimport { providerDisplayName } from '../provider-display-name.js';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the credential id, which differs from the\n * catalog provider id for OpenAI (`openai-codex`) and Kimi (`kimi-for-coding`).\n * Tenant rows use the same keying so one lookup serves both OAuth tokens and\n * API keys, and match what model resolution reads.\n */\nexport { getCredentialProviderId as getAuthProviderId } from '@mastra/code-sdk/providers/model-ids';\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes. `subscription` names the plan the\n * sign-in bills, as shown under a reply and in the composer.\n */\nexport const WEB_OAUTH_PROVIDERS: Readonly<Record<string, { flow: LoginSessionKind; subscription: string }>> = {\n  anthropic: { flow: 'paste-code', subscription: 'Claude Pro/Max' },\n  openai: { flow: 'device-code', subscription: 'ChatGPT Plus/Pro' },\n  'github-copilot': { flow: 'device-code', subscription: 'GitHub Copilot' },\n  xai: { flow: 'device-code', subscription: 'SuperGrok/X Premium+' },\n};\n\nexport function credentialLabel(provider: string, credentialType: CredentialRecord['credential']['type']) {\n  return credentialType === 'api_key'\n    ? `${providerDisplayName(provider)} API key`\n    : WEB_OAUTH_PROVIDERS[provider]?.subscription;\n}\n\nexport type CredentialContext =\n  | { mode: 'local' }\n  | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? factoryUserOrgId({ id: tenant.userId }) ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";;;;;;;;;;;AA0CA,MAAa,sBAAkG;CAC7G,WAAW;EAAE,MAAM;EAAc,cAAc;CAAiB;CAChE,QAAQ;EAAE,MAAM;EAAe,cAAc;CAAmB;CAChE,kBAAkB;EAAE,MAAM;EAAe,cAAc;CAAiB;CACxE,KAAK;EAAE,MAAM;EAAe,cAAc;CAAuB;AACnE;AAEA,SAAgB,gBAAgB,UAAkB,gBAAwD;CACxG,OAAO,mBAAmB,YACtB,GAAG,oBAAoB,QAAQ,EAAE,YACjC,oBAAoB,SAAS,EAAE;AACrC;;;;;;AAWA,eAAsB,4BACpB,aAC8C;CAC9C,IAAI,CAAC,aAAa,OAAO,KAAA;CACzB,IAAI;EACF,MAAM,YAAY,YAAY;CAChC,QAAQ;EACN;CACF;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,YAAY,QAAoD;CAC9E,OAAO,OAAO,SAAS,iBAAiB,EAAE,IAAI,OAAO,OAAO,CAAC,KAAK,QAAQ,OAAO;AACnF;;;;;;AAOA,eAAsB,yBAAyB,EAC7C,GACA,MACA,eAMsD;CACtD,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ;EAIX,IAAI,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EAC9E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SACH,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO;EAAE,MAAM;EAAU;EAAS,OAAO,YAAY,MAAM;EAAG,QAAQ,OAAO;CAAO;AACtF;;;;;;;;AASA,eAAsB,gCAAgC,EACpD,GACA,MACA,eAM0C;CAC1C,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAA;CAC1C,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE"}

package/dist/routes/surface.js

@@ -9,10 +9,10 @@ import { invalidateTenantCredentialSnapshots } from "./tenant-credentials.js";
 import { effectiveModelScope } from "../storage/domains/projects/base.js";
 import { SessionOwnershipMismatchError, SourceControlConnectionNotFoundError } from "../storage/domains/source-control/base.js";
 import { FactorySourceSessionResolutionError, createSourceControlSessionLookup, ensureFactorySourceSession, resolveFactorySourceControl } from "../session/factory-session.js";
+import { ConfigRoutes } from "./config.js";
 import { buildSourceControlSessionRoutes } from "./source-control-sessions.js";
 import { resolveWorkItemRepository } from "../session/work-item-repository.js";
 import { FactoryStartCoordinator } from "../rules/start-coordinator.js";
-import { ConfigRoutes } from "./config.js";
 import { invalidateCustomProvidersSnapshots } from "./custom-provider-source.js";
 import { FactoryTransitionService } from "../rules/transition-service.js";
 import { buildAutomationRunRoutes } from "./automation-runs.js";

package/dist/routes/work-items.js

@@ -4,13 +4,13 @@ import { FACTORY_PULL_REQUEST_RECONCILIATION_KEY, FACTORY_RULE_MATERIALIZATION_K
 import { EXTERNAL_SOURCE_MISSING_KEY } from "../integrations/issue-reconciler.js";
 import { effectiveModelScope } from "../storage/domains/projects/base.js";
 import { decisionRetryable, overtakenDecisionIds } from "../rules/decision-applicability.js";
-import { FactoryStartTransitionError, WorkItemRepositoryError } from "../rules/start-coordinator.js";
 import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { Route } from "./route.js";
+import { FactoryStartTransitionError, WorkItemRepositoryError } from "../rules/start-coordinator.js";
 import { createFactoryWorkItem } from "../work-items/create-work-item.js";
 import { factoryDecisionType } from "./attention-providers.js";
 import { buildAttentionRoutes } from "./attention.js";
 import { resolveFactoryProposal, retryFactoryDecision } from "../work-items/decision-actions.js";
-import { Route } from "./route.js";
 import { auditRequestOrigin } from "../storage/domains/audit/domain.js";
 import { thresholdsOrDefault } from "../storage/domains/queue-health/base.js";
 import { computeFactoryMetrics, parseMetricsRange } from "../storage/domains/work-items/metrics.js";

package/dist/rules/dispatch-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-errors.d.ts","sourceRoot":"","sources":["../../src/rules/dispatch-errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,uCAAuC,CAAC;AAE/C,UAAU,8BAA8B;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AA2BD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAKzB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAErF;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,gCAAgC,GAAG,IAAI,GAC5C,8BAA8B,CAEhC"}
+{"version":3,"file":"dispatch-errors.d.ts","sourceRoot":"","sources":["../../src/rules/dispatch-errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,uCAAuC,CAAC;AAE/C,UAAU,8BAA8B;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AA+BD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAKzB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAErF;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,gCAAgC,GAAG,IAAI,GAC5C,8BAA8B,CAEhC"}

package/dist/rules/dispatch-errors.js

@@ -72,6 +72,18 @@ const FAILURE_METADATA = {
 		canRetry: false,
 		label: "Run configuration rejected by provider"
 	},
+	run_credentials_unavailable: {
+		canRetry: true,
+		label: "Model credentials unavailable for the run"
+	},
+	run_user_unauthenticated: {
+		canRetry: false,
+		label: "Run started without an authenticated user"
+	},
+	run_failed: {
+		canRetry: true,
+		label: "Agent run ended in error"
+	},
 	unknown: {
 		canRetry: true,
 		label: "Factory automation failed"

package/dist/rules/dispatch-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-errors.js","names":[],"sources":["../../src/rules/dispatch-errors.ts"],"sourcesContent":["import type {\n  FactoryDispatchFailureCode,\n  StoredFactoryDispatchFailureCode,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactoryDispatchFailureMetadata {\n  canRetry: boolean;\n  label: string;\n}\n\nconst FAILURE_METADATA = {\n  session_unavailable: { canRetry: true, label: 'Factory session unavailable' },\n  source_control_missing: { canRetry: true, label: 'Source-control connection unavailable' },\n  source_repository_missing: { canRetry: true, label: 'Source repository unavailable' },\n  source_repository_ambiguous: { canRetry: true, label: 'Choose a repository for this work item' },\n  unsupported_provider_item: { canRetry: false, label: 'Unsupported provider work item' },\n  notification_delivery_failed: { canRetry: true, label: 'Factory message delivery failed' },\n  run_terminal_event_missing: { canRetry: false, label: 'Agent run terminal event was not observed' },\n  skill_delivery_ambiguous: { canRetry: false, label: 'Factory skill delivery could not be confirmed' },\n  run_overdue: { canRetry: false, label: 'Agent run is overdue' },\n  repository_git_missing: { canRetry: false, label: 'Git is unavailable in the workspace' },\n  repository_egress_blocked: { canRetry: false, label: 'Repository network access is blocked' },\n  repository_clone_failed: { canRetry: true, label: 'Repository clone failed' },\n  repository_pull_failed: { canRetry: true, label: 'Repository update failed' },\n  repository_push_failed: { canRetry: true, label: 'Repository push failed' },\n  repository_commit_failed: { canRetry: true, label: 'Repository commit failed' },\n  repository_cli_missing: { canRetry: false, label: 'GitHub CLI is unavailable in the workspace' },\n  repository_pr_failed: { canRetry: true, label: 'Pull request creation failed' },\n  run_configuration_invalid: { canRetry: false, label: 'Run configuration rejected by provider' },\n  unknown: { canRetry: true, label: 'Factory automation failed' },\n  // Retired: no path writes these any more, stored rows still read through here.\n  plan_awaiting_approval: { canRetry: false, label: 'Plan waiting for review' },\n  run_awaiting_input: { canRetry: false, label: 'Agent is waiting for an answer' },\n} satisfies Record<StoredFactoryDispatchFailureCode, FactoryDispatchFailureMetadata>;\n\nexport class FactoryDispatchError extends Error {\n  constructor(\n    readonly code: FactoryDispatchFailureCode,\n    message: string,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'FactoryDispatchError';\n  }\n}\n\nexport function factoryDispatchFailureCode(error: unknown): FactoryDispatchFailureCode {\n  return error instanceof FactoryDispatchError ? error.code : 'unknown';\n}\n\nexport function factoryDispatchFailureMetadata(\n  code: StoredFactoryDispatchFailureCode | null,\n): FactoryDispatchFailureMetadata {\n  return code === null ? FAILURE_METADATA.unknown : FAILURE_METADATA[code];\n}\n"],"mappings":";AAUA,MAAM,mBAAmB;CACvB,qBAAqB;EAAE,UAAU;EAAM,OAAO;CAA8B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAwC;CACzF,2BAA2B;EAAE,UAAU;EAAM,OAAO;CAAgC;CACpF,6BAA6B;EAAE,UAAU;EAAM,OAAO;CAAyC;CAC/F,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAiC;CACtF,8BAA8B;EAAE,UAAU;EAAM,OAAO;CAAkC;CACzF,4BAA4B;EAAE,UAAU;EAAO,OAAO;CAA4C;CAClG,0BAA0B;EAAE,UAAU;EAAO,OAAO;CAAgD;CACpG,aAAa;EAAE,UAAU;EAAO,OAAO;CAAuB;CAC9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAAsC;CACxF,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAuC;CAC5F,yBAAyB;EAAE,UAAU;EAAM,OAAO;CAA0B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAyB;CAC1E,0BAA0B;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC9E,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA6C;CAC/F,sBAAsB;EAAE,UAAU;EAAM,OAAO;CAA+B;CAC9E,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAyC;CAC9F,SAAS;EAAE,UAAU;EAAM,OAAO;CAA4B;CAE9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA0B;CAC5E,oBAAoB;EAAE,UAAU;EAAO,OAAO;CAAiC;AACjF;AAEA,IAAa,uBAAb,cAA0C,MAAM;CAEnC;CADX,YACE,MACA,SACA,SACA;EACA,MAAM,SAAS,OAAO;EAJb,KAAA,OAAA;EAKT,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,2BAA2B,OAA4C;CACrF,OAAO,iBAAiB,uBAAuB,MAAM,OAAO;AAC9D;AAEA,SAAgB,+BACd,MACgC;CAChC,OAAO,SAAS,OAAO,iBAAiB,UAAU,iBAAiB;AACrE"}
+{"version":3,"file":"dispatch-errors.js","names":[],"sources":["../../src/rules/dispatch-errors.ts"],"sourcesContent":["import type {\n  FactoryDispatchFailureCode,\n  StoredFactoryDispatchFailureCode,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactoryDispatchFailureMetadata {\n  canRetry: boolean;\n  label: string;\n}\n\nconst FAILURE_METADATA = {\n  session_unavailable: { canRetry: true, label: 'Factory session unavailable' },\n  source_control_missing: { canRetry: true, label: 'Source-control connection unavailable' },\n  source_repository_missing: { canRetry: true, label: 'Source repository unavailable' },\n  source_repository_ambiguous: { canRetry: true, label: 'Choose a repository for this work item' },\n  unsupported_provider_item: { canRetry: false, label: 'Unsupported provider work item' },\n  notification_delivery_failed: { canRetry: true, label: 'Factory message delivery failed' },\n  run_terminal_event_missing: { canRetry: false, label: 'Agent run terminal event was not observed' },\n  skill_delivery_ambiguous: { canRetry: false, label: 'Factory skill delivery could not be confirmed' },\n  run_overdue: { canRetry: false, label: 'Agent run is overdue' },\n  repository_git_missing: { canRetry: false, label: 'Git is unavailable in the workspace' },\n  repository_egress_blocked: { canRetry: false, label: 'Repository network access is blocked' },\n  repository_clone_failed: { canRetry: true, label: 'Repository clone failed' },\n  repository_pull_failed: { canRetry: true, label: 'Repository update failed' },\n  repository_push_failed: { canRetry: true, label: 'Repository push failed' },\n  repository_commit_failed: { canRetry: true, label: 'Repository commit failed' },\n  repository_cli_missing: { canRetry: false, label: 'GitHub CLI is unavailable in the workspace' },\n  repository_pr_failed: { canRetry: true, label: 'Pull request creation failed' },\n  run_configuration_invalid: { canRetry: false, label: 'Run configuration rejected by provider' },\n  run_credentials_unavailable: { canRetry: true, label: 'Model credentials unavailable for the run' },\n  // The run's request carries no user, so every retry fails the same way; a person has to start it.\n  run_user_unauthenticated: { canRetry: false, label: 'Run started without an authenticated user' },\n  run_failed: { canRetry: true, label: 'Agent run ended in error' },\n  unknown: { canRetry: true, label: 'Factory automation failed' },\n  // Retired: no path writes these any more, stored rows still read through here.\n  plan_awaiting_approval: { canRetry: false, label: 'Plan waiting for review' },\n  run_awaiting_input: { canRetry: false, label: 'Agent is waiting for an answer' },\n} satisfies Record<StoredFactoryDispatchFailureCode, FactoryDispatchFailureMetadata>;\n\nexport class FactoryDispatchError extends Error {\n  constructor(\n    readonly code: FactoryDispatchFailureCode,\n    message: string,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'FactoryDispatchError';\n  }\n}\n\nexport function factoryDispatchFailureCode(error: unknown): FactoryDispatchFailureCode {\n  return error instanceof FactoryDispatchError ? error.code : 'unknown';\n}\n\nexport function factoryDispatchFailureMetadata(\n  code: StoredFactoryDispatchFailureCode | null,\n): FactoryDispatchFailureMetadata {\n  return code === null ? FAILURE_METADATA.unknown : FAILURE_METADATA[code];\n}\n"],"mappings":";AAUA,MAAM,mBAAmB;CACvB,qBAAqB;EAAE,UAAU;EAAM,OAAO;CAA8B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAwC;CACzF,2BAA2B;EAAE,UAAU;EAAM,OAAO;CAAgC;CACpF,6BAA6B;EAAE,UAAU;EAAM,OAAO;CAAyC;CAC/F,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAiC;CACtF,8BAA8B;EAAE,UAAU;EAAM,OAAO;CAAkC;CACzF,4BAA4B;EAAE,UAAU;EAAO,OAAO;CAA4C;CAClG,0BAA0B;EAAE,UAAU;EAAO,OAAO;CAAgD;CACpG,aAAa;EAAE,UAAU;EAAO,OAAO;CAAuB;CAC9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAAsC;CACxF,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAuC;CAC5F,yBAAyB;EAAE,UAAU;EAAM,OAAO;CAA0B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAyB;CAC1E,0BAA0B;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC9E,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA6C;CAC/F,sBAAsB;EAAE,UAAU;EAAM,OAAO;CAA+B;CAC9E,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAyC;CAC9F,6BAA6B;EAAE,UAAU;EAAM,OAAO;CAA4C;CAElG,0BAA0B;EAAE,UAAU;EAAO,OAAO;CAA4C;CAChG,YAAY;EAAE,UAAU;EAAM,OAAO;CAA2B;CAChE,SAAS;EAAE,UAAU;EAAM,OAAO;CAA4B;CAE9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA0B;CAC5E,oBAAoB;EAAE,UAAU;EAAO,OAAO;CAAiC;AACjF;AAEA,IAAa,uBAAb,cAA0C,MAAM;CAEnC;CADX,YACE,MACA,SACA,SACA;EACA,MAAM,SAAS,OAAO;EAJb,KAAA,OAAA;EAKT,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,2BAA2B,OAA4C;CACrF,OAAO,iBAAiB,uBAAuB,MAAM,OAAO;AAC9D;AAEA,SAAgB,+BACd,MACgC;CAChC,OAAO,SAAS,OAAO,iBAAiB,UAAU,iBAAiB;AACrE"}

package/dist/rules/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/rules/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAyC,MAAM,+BAA+B,CAAC;AAU5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAaxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAErF,OAAO,KAAK,EACV,6BAA6B,EAI7B,WAAW,EACX,gBAAgB,EAEjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAA4C,MAAM,YAAY,CAAC;AA+PlG,KAAK,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,CAAC,CAAC;AA2BjH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,6BAA6B,CAAC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,eAAe,CAAC,CAAC;IAClF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;OAIG;IACH,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnH,6BAA6B,CAAC,EAAE,CAAC,KAAK,EAAE;QACtC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;YAAE,IAAI,EAAE,sBAAsB,CAAA;SAAE,CAAC,CAAC;KAC5E,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC;CAC9C;AA+HD,qBAAa,yBAAyB;;gBAkCxB,OAAO,EAAE,gCAAgC;IA8BrD,KAAK,IAAI,IAAI;IAOP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,OAAO,CAAC,GAAG,OAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAyqC/C;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;CAY7B,CAAC"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/rules/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAyC,MAAM,+BAA+B,CAAC;AAU5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAaxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAErF,OAAO,KAAK,EACV,6BAA6B,EAI7B,WAAW,EACX,gBAAgB,EAEjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAA4C,MAAM,YAAY,CAAC;AAqSlG,KAAK,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,CAAC,CAAC;AA2BjH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,6BAA6B,CAAC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,eAAe,CAAC,CAAC;IAClF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;OAIG;IACH,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnH,6BAA6B,CAAC,EAAE,CAAC,KAAK,EAAE;QACtC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;YAAE,IAAI,EAAE,sBAAsB,CAAA;SAAE,CAAC,CAAC;KAC5E,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC;CAC9C;AA+JD,qBAAa,yBAAyB;;gBAkCxB,OAAO,EAAE,gCAAgC;IA8BrD,KAAK,IAAI,IAAI;IAOP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,OAAO,CAAC,GAAG,OAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAyqC/C;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;;CAY7B,CAAC"}

package/dist/rules/dispatcher.js

@@ -37,7 +37,28 @@ const RECONCILE_INTERVAL_MS = 3e4;
 /** The card moved on before this run could act; it settles as superseded, not succeeded. */
 var FactoryDecisionSuperseded = class extends Error {};
 /** A run that ran and ended in error; the session's own listener reports it to followers. */
-var RunEndedInError = class extends Error {};
+var RunEndedInError = class extends FactoryDispatchError {};
+const CREDENTIAL_RESOLUTION_FAILURE = "tenant model credential policy could not be resolved";
+const NO_AUTHENTICATED_USER = "the request has no authenticated user";
+function httpStatus(error) {
+	if (!error || typeof error !== "object") return void 0;
+	if ("statusCode" in error && typeof error.statusCode === "number") return error.statusCode;
+	return "status" in error && typeof error.status === "number" ? error.status : void 0;
+}
+function causeOf(error) {
+	return error && typeof error === "object" && "cause" in error ? error.cause : void 0;
+}
+function runErrorCode(error, message) {
+	const lower = message.toLowerCase();
+	if (lower.includes(CREDENTIAL_RESOLUTION_FAILURE)) return lower.includes(NO_AUTHENTICATED_USER) ? "run_user_unauthenticated" : "run_credentials_unavailable";
+	const status = httpStatus(error) ?? httpStatus(causeOf(error));
+	return status === 401 || status === 403 ? "run_credentials_unavailable" : "run_failed";
+}
+function runErrorFailure(label, error) {
+	const cause = (error instanceof Error ? error.message : String(error ?? "")).trim();
+	if (!cause) return new RunEndedInError("run_failed", `${label} ended in error.`);
+	return new RunEndedInError(runErrorCode(error, cause), `${label} ended in error: ${cause}`);
+}
 function isTerminalFailure(attempts, failureCode) {
 	return attempts >= MAX_ATTEMPTS || !factoryDispatchFailureMetadata(failureCode).canRetry;
 }
@@ -59,10 +80,12 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 	let supersededAtEnd;
 	let parked;
 	let omFailure;
+	let runError;
 	const arm = () => {
 		endReason = void 0;
 		supersededAtEnd = void 0;
 		omFailure = void 0;
+		runError = void 0;
 		agentEnd = new Promise((resolve) => {
 			resolveAgentEnd = resolve;
 		});
@@ -75,6 +98,10 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 			resolveAgentEnd();
 			return;
 		}
+		if (event.type === "error") {
+			runError = event.error;
+			return;
+		}
 		if (event.type === "om_observation_failed" || event.type === "om_buffering_failed") {
 			if (event.error) omFailure = event.error;
 			return;
@@ -119,7 +146,7 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 				observed = await wait();
 			}
 			if (!observed) throw new FactoryDispatchError("run_terminal_event_missing", `${label} terminal event was not observed before timeout.`);
-			if (endReason === "error") throw new RunEndedInError(`${label} ended in error.`);
+			if (endReason === "error") throw runErrorFailure(label, runError);
 			if (endReason === "aborted") {
 				if (omFailure) {
 					if (isPermanentProviderRejection(omFailure)) throw new FactoryDispatchError("run_configuration_invalid", `${label} was aborted by an observational-memory failure that will not succeed on retry: ${omFailure}`);
@@ -164,8 +191,20 @@ function factoryRequestContext(input) {
 function positiveMs(value, fallback) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
+const KEY_SHAPED_TOKEN = /\b(?:sk-[A-Za-z0-9_-]{3,}|gh[pousr]_[A-Za-z0-9]{10,}|github_pat_[A-Za-z0-9_]{10,}|xox[abprs]-[A-Za-z0-9-]{10,})/g;
+function looksLikeSecret(token) {
+	return /[A-Z]/.test(token) && /[a-z]/.test(token) && /\d/.test(token) && /[A-Za-z0-9]{16,}/.test(token);
+}
+function redactSecretRun(token) {
+	if (looksLikeSecret(token) && !token.split("/").some((piece) => /^[A-Za-z][a-z]+$/.test(piece))) return "[redacted]";
+	return token.replace(/[A-Za-z0-9_+=-]{24,}/g, (piece) => looksLikeSecret(piece) || isGroupedKey(piece) ? "[redacted]" : piece);
+}
+function isGroupedKey(token) {
+	const groups = token.split(/[-_]/);
+	return groups.length >= 4 && groups.every((group) => /[A-Z]/.test(group) && /[a-z]/.test(group) && /\d/.test(group));
+}
 function sanitizeDispatchError(error) {
-	return (error instanceof Error ? error.message : String(error)).replace(/\b(?:bearer|token|api[-_ ]?key|authorization)\s*[:=]?\s*[^\s,;]+/gi, "[redacted]").slice(0, MAX_ERROR_LENGTH);
+	return (error instanceof Error ? error.message : String(error)).replace(KEY_SHAPED_TOKEN, "[redacted]").replace(/\b[A-Za-z0-9_+=/-]{24,}/g, redactSecretRun).replace(/\b(?:bearer|token|api[-_ ]?key|authorization)\s*[:=]?\s*(?:bearer\s+)?[^\s,;]+/gi, "[redacted]").slice(0, MAX_ERROR_LENGTH);
 }
 function retryAt(now, attempts) {
 	return new Date(now.getTime() + Math.min(1e3 * 2 ** Math.max(0, attempts - 1), MAX_BACKOFF_MS));