@mastra/factory 0.24.0-alpha.7 → 0.24.0-alpha.8

package/dist/rules/dispatcher.js

@@ -37,7 +37,28 @@ const RECONCILE_INTERVAL_MS = 3e4;
 /** The card moved on before this run could act; it settles as superseded, not succeeded. */
 var FactoryDecisionSuperseded = class extends Error {};
 /** A run that ran and ended in error; the session's own listener reports it to followers. */
-var RunEndedInError = class extends Error {};
+var RunEndedInError = class extends FactoryDispatchError {};
+const CREDENTIAL_RESOLUTION_FAILURE = "tenant model credential policy could not be resolved";
+const NO_AUTHENTICATED_USER = "the request has no authenticated user";
+function httpStatus(error) {
+	if (!error || typeof error !== "object") return void 0;
+	if ("statusCode" in error && typeof error.statusCode === "number") return error.statusCode;
+	return "status" in error && typeof error.status === "number" ? error.status : void 0;
+}
+function causeOf(error) {
+	return error && typeof error === "object" && "cause" in error ? error.cause : void 0;
+}
+function runErrorCode(error, message) {
+	const lower = message.toLowerCase();
+	if (lower.includes(CREDENTIAL_RESOLUTION_FAILURE)) return lower.includes(NO_AUTHENTICATED_USER) ? "run_user_unauthenticated" : "run_credentials_unavailable";
+	const status = httpStatus(error) ?? httpStatus(causeOf(error));
+	return status === 401 || status === 403 ? "run_credentials_unavailable" : "run_failed";
+}
+function runErrorFailure(label, error) {
+	const cause = (error instanceof Error ? error.message : String(error ?? "")).trim();
+	if (!cause) return new RunEndedInError("run_failed", `${label} ended in error.`);
+	return new RunEndedInError(runErrorCode(error, cause), `${label} ended in error: ${cause}`);
+}
 function isTerminalFailure(attempts, failureCode) {
 	return attempts >= MAX_ATTEMPTS || !factoryDispatchFailureMetadata(failureCode).canRetry;
 }
@@ -59,10 +80,12 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 	let supersededAtEnd;
 	let parked;
 	let omFailure;
+	let runError;
 	const arm = () => {
 		endReason = void 0;
 		supersededAtEnd = void 0;
 		omFailure = void 0;
+		runError = void 0;
 		agentEnd = new Promise((resolve) => {
 			resolveAgentEnd = resolve;
 		});
@@ -75,6 +98,10 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 			resolveAgentEnd();
 			return;
 		}
+		if (event.type === "error") {
+			runError = event.error;
+			return;
+		}
 		if (event.type === "om_observation_failed" || event.type === "om_buffering_failed") {
 			if (event.error) omFailure = event.error;
 			return;
@@ -119,7 +146,7 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 				observed = await wait();
 			}
 			if (!observed) throw new FactoryDispatchError("run_terminal_event_missing", `${label} terminal event was not observed before timeout.`);
-			if (endReason === "error") throw new RunEndedInError(`${label} ended in error.`);
+			if (endReason === "error") throw runErrorFailure(label, runError);
 			if (endReason === "aborted") {
 				if (omFailure) {
 					if (isPermanentProviderRejection(omFailure)) throw new FactoryDispatchError("run_configuration_invalid", `${label} was aborted by an observational-memory failure that will not succeed on retry: ${omFailure}`);
@@ -164,8 +191,20 @@ function factoryRequestContext(input) {
 function positiveMs(value, fallback) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
+const KEY_SHAPED_TOKEN = /\b(?:sk-[A-Za-z0-9_-]{3,}|gh[pousr]_[A-Za-z0-9]{10,}|github_pat_[A-Za-z0-9_]{10,}|xox[abprs]-[A-Za-z0-9-]{10,})/g;
+function looksLikeSecret(token) {
+	return /[A-Z]/.test(token) && /[a-z]/.test(token) && /\d/.test(token) && /[A-Za-z0-9]{16,}/.test(token);
+}
+function redactSecretRun(token) {
+	if (looksLikeSecret(token) && !token.split("/").some((piece) => /^[A-Za-z][a-z]+$/.test(piece))) return "[redacted]";
+	return token.replace(/[A-Za-z0-9_+=-]{24,}/g, (piece) => looksLikeSecret(piece) || isGroupedKey(piece) ? "[redacted]" : piece);
+}
+function isGroupedKey(token) {
+	const groups = token.split(/[-_]/);
+	return groups.length >= 4 && groups.every((group) => /[A-Z]/.test(group) && /[a-z]/.test(group) && /\d/.test(group));
+}
 function sanitizeDispatchError(error) {
-	return (error instanceof Error ? error.message : String(error)).replace(/\b(?:bearer|token|api[-_ ]?key|authorization)\s*[:=]?\s*[^\s,;]+/gi, "[redacted]").slice(0, MAX_ERROR_LENGTH);
+	return (error instanceof Error ? error.message : String(error)).replace(KEY_SHAPED_TOKEN, "[redacted]").replace(/\b[A-Za-z0-9_+=/-]{24,}/g, redactSecretRun).replace(/\b(?:bearer|token|api[-_ ]?key|authorization)\s*[:=]?\s*(?:bearer\s+)?[^\s,;]+/gi, "[redacted]").slice(0, MAX_ERROR_LENGTH);
 }
 function retryAt(now, attempts) {
 	return new Date(now.getTime() + Math.min(1e3 * 2 ** Math.max(0, attempts - 1), MAX_BACKOFF_MS));