@orchestrator-claude/definitions 3.43.1 → 3.44.1

package/hooks/lib/workflow-artifact-client.ts

@@ -0,0 +1,351 @@
+/**
+ * workflow-artifact-client.ts — the hooks' tagged HTTP client of the workflow-artifacts contract
+ * (RFC-044 F3, S4: PL-ADR-5, M4, M5, R1, R2, R3).
+ *
+ * Unlike apiGet/apiPost in api-client.ts (which answer null for every failure), every call here returns a
+ * discriminated result: each failure is a `kind`/`cause` of its own, and nothing throws to the caller. The
+ * callers (workflow-guard R7 in S4; gate-guardian in S5) fail CLOSED on anything that is not `ok`.
+ *
+ * The contract types come from `@orchestrator-claude/vault-projection/workflow-artifact` (wire.ts): this file
+ * imports them, it does not declare them (M4). The client rules it implements:
+ *   R1  a non-2xx is classified by its problem code (problemCode: `code`, or the house `type`), never by the
+ *       status alone; a non-2xx without a KNOWN code is `unavailable` -- a route that is not deployed answers
+ *       404 without a code, and must not read as "workflow not found".
+ *   R2  verify-observed is decided by its per-item `results` (checked item by item against the request).
+ *   R3  verifyObserved probes the workflow first (M5): verify-observed does not check that it exists.
+ *
+ * api-client.ts is NOT edited (PL-ADR-8: editing it re-bundles every hook): the URL is read from the same env
+ * var with the same default, and the token/project come from its existing exports.
+ */
+import {
+  LEDGER_FRONTMATTER_FIELDS,
+  VERIFY_VERDICT_CODES,
+  WORKFLOW_ARTIFACT_ERROR_CODES,
+  problemCode,
+  projectLedgerFrontmatter,
+  type RegisterWorkflowArtifactRequest,
+  type RegisterWorkflowArtifactResponse,
+  type VerifyItemFailed,
+  type VerifyItemResult,
+  type VerifyObservedItem,
+  type VerifyObservedRequest,
+  type VerifyObservedResponse,
+} from '@orchestrator-claude/vault-projection/workflow-artifact';
+import { getEffectiveProjectId, getToken } from './api-client.js';
+
+export interface ClientDeps {
+  fetch: typeof fetch;
+  getToken: () => Promise<string | null>;
+  getProjectId: () => string;
+  apiUrl: string;
+  timeoutMs: number;
+}
+
+/** Same env var and default as api-client.ts (`API_URL`, not exported there on purpose, PL-ADR-8). */
+export function defaultClientDeps(): ClientDeps {
+  const envUrl = process.env.ORCHESTRATOR_API_URL;
+  return {
+    fetch: (input, init) => fetch(input, init),
+    getToken,
+    getProjectId: getEffectiveProjectId,
+    // An EMPTY value falls back too, exactly like api-client.ts (`||` there).
+    apiUrl: envUrl !== undefined && envUrl !== '' ? envUrl : 'http://localhost:3001',
+    timeoutMs: 5000,
+  };
+}
+
+export type UnavailableCause =
+  | 'no-token'
+  | 'unauthorized'
+  | 'timeout'
+  | 'network'
+  | 'http-5xx'
+  | 'unknown-response'
+  | 'bad-body'
+  | 'exception';
+
+export interface Unavailable {
+  kind: 'unavailable';
+  cause: UnavailableCause;
+  httpStatus?: number;
+  code?: string;
+  detail?: string;
+}
+
+export type ProbeResult =
+  | { kind: 'ok'; workflowId: string; status: string; currentPhase: string | null }
+  | { kind: 'not-found' }
+  | Unavailable;
+
+export interface Rejected {
+  kind: 'rejected';
+  httpStatus: number;
+  code: string;
+  detail?: string;
+}
+
+export type RegisterResult =
+  | { kind: 'ok'; response: RegisterWorkflowArtifactResponse }
+  | Rejected
+  | Unavailable;
+
+/** A registered host file nobody showed (S3c, M6): derived from the wire type, not redeclared. */
+export type UnobservedArtifact = NonNullable<VerifyObservedResponse['unobserved']>[number];
+
+/** `exhaustive` of the wire request (S3c, M6, D-469). */
+export interface VerifyOptions {
+  exhaustive?: NonNullable<VerifyObservedRequest['exhaustive']>;
+}
+
+export type VerifyResult =
+  | {
+      kind: 'ok';
+      results: VerifyItemResult[];
+      failed: VerifyItemFailed[];
+      /** Present exactly when the request carried `exhaustive`. */
+      unobserved?: UnobservedArtifact[];
+    }
+  | { kind: 'probe-failed'; probe: Exclude<ProbeResult, { kind: 'ok' }> }
+  | Rejected
+  | Unavailable;
+
+/** The register input: a whole-file frontmatter is accepted and projected on the ledger fields (M4). */
+export type RegisterInput = Omit<RegisterWorkflowArtifactRequest, 'frontmatter'> & {
+  frontmatter: Readonly<Record<string, unknown>>;
+};
+
+const AUTH_CODES: ReadonlySet<string> = new Set(['unauthorized', 'forbidden']);
+/** Request errors of the two workflow-artifacts routes a caller can act on (INTERNAL_ERROR is a 5xx). */
+const REJECT_CODES: ReadonlySet<string> = new Set([
+  ...WORKFLOW_ARTIFACT_ERROR_CODES.filter((c) => c !== 'INTERNAL_ERROR'),
+  'FST_ERR_VALIDATION',
+]);
+const VERDICTS: ReadonlySet<string> = new Set(VERIFY_VERDICT_CODES);
+
+type Sent = { ok: false; failure: Unavailable } | { ok: true; resp: Response };
+
+const isObject = (v: unknown): v is Record<string, unknown> =>
+  typeof v === 'object' && v !== null && !Array.isArray(v);
+
+function causeOfThrow(e: unknown): UnavailableCause {
+  const name = (e as { name?: unknown } | null)?.name;
+  return name === 'TimeoutError' || name === 'AbortError' ? 'timeout' : 'network';
+}
+
+async function readJson(
+  resp: Response
+): Promise<{ parsed: true; body: unknown } | { parsed: false }> {
+  try {
+    return { parsed: true, body: (await resp.json()) as unknown };
+  } catch {
+    return { parsed: false };
+  }
+}
+
+/** One HTTP exchange; transport failures become `unavailable`, an HTTP answer of any status is returned. */
+async function send(deps: ClientDeps, path: string, body?: unknown): Promise<Sent> {
+  const token = await deps.getToken();
+  if (token === null || token === '') {
+    return { ok: false, failure: { kind: 'unavailable', cause: 'no-token' } };
+  }
+  const headers: Record<string, string> = {
+    Authorization: `Bearer ${token}`,
+    'X-Project-ID': deps.getProjectId(),
+  };
+  if (body !== undefined) headers['Content-Type'] = 'application/json';
+  try {
+    const resp = await deps.fetch(`${deps.apiUrl}${path}`, {
+      method: body === undefined ? 'GET' : 'POST',
+      headers,
+      ...(body !== undefined && { body: JSON.stringify(body) }),
+      signal: AbortSignal.timeout(deps.timeoutMs),
+    });
+    return { ok: true, resp };
+  } catch (e) {
+    return { ok: false, failure: { kind: 'unavailable', cause: causeOfThrow(e) } };
+  }
+}
+
+/**
+ * R1: classifies a non-2xx. `known` are the codes the caller acts on as a typed rejection; auth codes are
+ * `unavailable(unauthorized)`; a 5xx is `http-5xx`; everything else (no code, or a code nobody published)
+ * is `unavailable(unknown-response)`.
+ */
+async function classifyFailure(
+  resp: Response,
+  known: ReadonlySet<string>
+): Promise<Rejected | Unavailable | { kind: 'code'; code: string }> {
+  const read = await readJson(resp);
+  const code = read.parsed ? problemCode(read.body) : null;
+  const detail =
+    read.parsed && isObject(read.body) && typeof read.body.detail === 'string'
+      ? read.body.detail
+      : undefined;
+  const base = {
+    httpStatus: resp.status,
+    ...(code !== null && { code }),
+    ...(detail !== undefined && { detail }),
+  };
+  if (resp.status >= 500) return { kind: 'unavailable', cause: 'http-5xx', ...base };
+  if (code !== null && AUTH_CODES.has(code)) {
+    return { kind: 'unavailable', cause: 'unauthorized', ...base };
+  }
+  if (code !== null && known.has(code)) {
+    return {
+      kind: 'rejected',
+      httpStatus: resp.status,
+      code,
+      ...(detail !== undefined && { detail }),
+    };
+  }
+  return { kind: 'unavailable', cause: 'unknown-response', ...base };
+}
+
+const badBody = (httpStatus: number): Unavailable => ({
+  kind: 'unavailable',
+  cause: 'bad-body',
+  httpStatus,
+});
+
+async function guard<T>(run: () => Promise<T | Unavailable>): Promise<T | Unavailable> {
+  try {
+    return await run();
+  } catch (e) {
+    return {
+      kind: 'unavailable',
+      cause: 'exception',
+      detail: e instanceof Error ? e.message : String(e),
+    };
+  }
+}
+
+/** GET /api/v1/workflows/:id/status, by the id given (the id of the PATH for R7; never "the active one"). */
+export function probeWorkflow(
+  workflowId: string,
+  deps: ClientDeps = defaultClientDeps()
+): Promise<ProbeResult> {
+  return guard<ProbeResult>(async () => {
+    const sent = await send(deps, `/api/v1/workflows/${encodeURIComponent(workflowId)}/status`);
+    if (!sent.ok) return sent.failure;
+    const { resp } = sent;
+    if (!resp.ok) {
+      const failure = await classifyFailure(resp, new Set(['not-found']));
+      return failure.kind === 'rejected' ? { kind: 'not-found' } : (failure as Unavailable);
+    }
+    const read = await readJson(resp);
+    if (!read.parsed || !isObject(read.body)) return badBody(resp.status);
+    const { workflowId: id, status, currentPhase } = read.body;
+    const phaseOk = currentPhase === null || typeof currentPhase === 'string';
+    if (id !== workflowId || typeof status !== 'string' || !phaseOk) return badBody(resp.status);
+    return { kind: 'ok', workflowId: id, status, currentPhase };
+  });
+}
+
+function isRegisterResponse(v: unknown): v is RegisterWorkflowArtifactResponse {
+  return (
+    isObject(v) &&
+    (v.status === 'recorded' || v.status === 'unchanged') &&
+    Number.isInteger(v.revision) &&
+    typeof v.rowId === 'string'
+  );
+}
+
+/** POST /api/v1/workflow-artifacts. The frontmatter is projected on LEDGER_FRONTMATTER_FIELDS first. */
+export function registerArtifact(
+  input: RegisterInput,
+  deps: ClientDeps = defaultClientDeps()
+): Promise<RegisterResult> {
+  return guard<RegisterResult>(async () => {
+    const request: RegisterWorkflowArtifactRequest = {
+      ...input,
+      frontmatter: projectLedgerFrontmatter(input.frontmatter),
+    };
+    const sent = await send(deps, '/api/v1/workflow-artifacts', request);
+    if (!sent.ok) return sent.failure;
+    const { resp } = sent;
+    if (!resp.ok) return (await classifyFailure(resp, REJECT_CODES)) as Rejected | Unavailable;
+    const read = await readJson(resp);
+    if (!read.parsed || !isRegisterResponse(read.body)) return badBody(resp.status);
+    const { status, revision, rowId } = read.body;
+    return { kind: 'ok', response: { status, revision, rowId } };
+  });
+}
+
+/** R2: one result per item, in the request's order, each a well-formed verdict; anything else is bad-body. */
+function checkResults(
+  body: unknown,
+  items: readonly VerifyObservedItem[]
+): VerifyItemResult[] | null {
+  if (!isObject(body) || !Array.isArray(body.results)) return null;
+  const results = body.results as unknown[];
+  if (results.length !== items.length) return null;
+  const checked: VerifyItemResult[] = [];
+  for (const [i, r] of results.entries()) {
+    const item = items[i] as VerifyObservedItem;
+    if (!isObject(r)) return null;
+    if (r.phase !== item.phase || r.artifactType !== item.artifactType) return null;
+    if (r.ok === true && Number.isInteger(r.revision)) {
+      checked.push(r as unknown as VerifyItemResult);
+    } else if (r.ok === false && typeof r.code === 'string' && VERDICTS.has(r.code)) {
+      checked.push(r as unknown as VerifyItemResult);
+    } else {
+      return null;
+    }
+  }
+  return checked;
+}
+
+/**
+ * `unobserved` of an exhaustive answer: an array of {phase, artifactType, revision}. Anything else (absent: an
+ * API that ignored `exhaustive`; a malformed entry) is null, which the caller turns into bad-body (fail closed).
+ */
+function checkUnobserved(body: unknown): UnobservedArtifact[] | null {
+  if (!isObject(body) || !Array.isArray(body.unobserved)) return null;
+  const checked: UnobservedArtifact[] = [];
+  for (const u of body.unobserved as unknown[]) {
+    if (!isObject(u)) return null;
+    const { phase, artifactType, revision } = u;
+    if (typeof phase !== 'string' || typeof artifactType !== 'string') return null;
+    if (typeof revision !== 'number' || !Number.isInteger(revision)) return null;
+    checked.push({ phase, artifactType, revision });
+  }
+  return checked;
+}
+
+/**
+ * POST /api/v1/workflow-artifacts/verify-observed, AFTER probeWorkflow (M5, R3): an unknown or unreachable
+ * workflow stops at the probe, so it can never read as ARTIFACT_NOT_REGISTERED. Decided per item (R2).
+ * With `options.exhaustive` (S3c, M6, D-469) the request says "this is everything the host has outside
+ * excludePhases", and the answer must carry `unobserved` (the registered host files nobody showed).
+ */
+export function verifyObserved(
+  workflowId: string,
+  items: readonly VerifyObservedItem[],
+  deps: ClientDeps = defaultClientDeps(),
+  options: VerifyOptions = {}
+): Promise<VerifyResult> {
+  return guard<VerifyResult>(async () => {
+    const probe = await probeWorkflow(workflowId, deps);
+    if (probe.kind !== 'ok') return { kind: 'probe-failed', probe };
+    const request: VerifyObservedRequest = {
+      workflowId,
+      items: [...items],
+      ...(options.exhaustive !== undefined && { exhaustive: options.exhaustive }),
+    };
+    const sent = await send(deps, '/api/v1/workflow-artifacts/verify-observed', request);
+    if (!sent.ok) return sent.failure;
+    const { resp } = sent;
+    if (!resp.ok) return (await classifyFailure(resp, REJECT_CODES)) as Rejected | Unavailable;
+    const read = await readJson(resp);
+    const results = read.parsed ? checkResults(read.body, items) : null;
+    if (results === null) return badBody(resp.status);
+    const failed = results.filter((r): r is VerifyItemFailed => !r.ok);
+    if (options.exhaustive === undefined) return { kind: 'ok', results, failed };
+    const unobserved = checkUnobserved(read.parsed ? read.body : undefined);
+    if (unobserved === null) return badBody(resp.status);
+    return { kind: 'ok', results, failed, unobserved };
+  });
+}
+
+/** Re-exported so a caller can tell which frontmatter keys travel (the rest stays in the file). */
+export { LEDGER_FRONTMATTER_FIELDS };

package/hooks/mailbox-listener.mjs

@@ -74,8 +74,6 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);

package/hooks/playwright-output-guard.mjs

@@ -64,8 +64,6 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);

package/hooks/post-implement.mjs

@@ -61,8 +61,15 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var DEFAULT_AUTH_EMAIL = "system@orchestrator.local";
+var MISSING_CREDENTIAL_MESSAGE = "no credential configured (ORCHESTRATOR_ADMIN_PASSWORD / ORCHESTRATOR_AUTH_PASSWORD unset or empty) - login not attempted";
+var missingCredentialLogged = false;
+function resolveAuthCredentials() {
+  const password = (process.env.ORCHESTRATOR_ADMIN_PASSWORD ?? "").trim() || (process.env.ORCHESTRATOR_AUTH_PASSWORD ?? "").trim();
+  if (!password) return null;
+  const email = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || DEFAULT_AUTH_EMAIL;
+  return { email, password };
+}
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
@@ -121,6 +128,14 @@ function getCachedToken() {
   return null;
 }
 async function login() {
+  const credentials = resolveAuthCredentials();
+  if (credentials === null) {
+    if (!missingCredentialLogged) {
+      missingCredentialLogged = true;
+      log("API-CLIENT", MISSING_CREDENTIAL_MESSAGE);
+    }
+    return null;
+  }
   try {
     const resp = await fetch(`${API_URL}/api/v1/auth/login`, {
       method: "POST",
@@ -128,7 +143,7 @@ async function login() {
         "Content-Type": "application/json",
         "X-Project-ID": PROJECT_ID
       },
-      body: JSON.stringify({ email: AUTH_EMAIL, password: AUTH_PASSWORD }),
+      body: JSON.stringify({ email: credentials.email, password: credentials.password }),
       signal: AbortSignal.timeout(5e3)
     });
     if (!resp.ok) return null;

package/hooks/pre-agent-dispatch.mjs

@@ -64,8 +64,15 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var DEFAULT_AUTH_EMAIL = "system@orchestrator.local";
+var MISSING_CREDENTIAL_MESSAGE = "no credential configured (ORCHESTRATOR_ADMIN_PASSWORD / ORCHESTRATOR_AUTH_PASSWORD unset or empty) - login not attempted";
+var missingCredentialLogged = false;
+function resolveAuthCredentials() {
+  const password = (process.env.ORCHESTRATOR_ADMIN_PASSWORD ?? "").trim() || (process.env.ORCHESTRATOR_AUTH_PASSWORD ?? "").trim();
+  if (!password) return null;
+  const email = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || DEFAULT_AUTH_EMAIL;
+  return { email, password };
+}
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
@@ -128,6 +135,14 @@ function getCachedToken() {
   return null;
 }
 async function login() {
+  const credentials = resolveAuthCredentials();
+  if (credentials === null) {
+    if (!missingCredentialLogged) {
+      missingCredentialLogged = true;
+      log("API-CLIENT", MISSING_CREDENTIAL_MESSAGE);
+    }
+    return null;
+  }
   try {
     const resp = await fetch(`${API_URL}/api/v1/auth/login`, {
       method: "POST",
@@ -135,7 +150,7 @@ async function login() {
         "Content-Type": "application/json",
         "X-Project-ID": PROJECT_ID
       },
-      body: JSON.stringify({ email: AUTH_EMAIL, password: AUTH_PASSWORD }),
+      body: JSON.stringify({ email: credentials.email, password: credentials.password }),
       signal: AbortSignal.timeout(5e3)
     });
     if (!resp.ok) return null;

package/hooks/security-gate-honest.mjs

@@ -61,8 +61,6 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);

package/hooks/session-start.mjs

@@ -7387,8 +7387,15 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var DEFAULT_AUTH_EMAIL = "system@orchestrator.local";
+var MISSING_CREDENTIAL_MESSAGE = "no credential configured (ORCHESTRATOR_ADMIN_PASSWORD / ORCHESTRATOR_AUTH_PASSWORD unset or empty) - login not attempted";
+var missingCredentialLogged = false;
+function resolveAuthCredentials() {
+  const password = (process.env.ORCHESTRATOR_ADMIN_PASSWORD ?? "").trim() || (process.env.ORCHESTRATOR_AUTH_PASSWORD ?? "").trim();
+  if (!password) return null;
+  const email = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || DEFAULT_AUTH_EMAIL;
+  return { email, password };
+}
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
@@ -7453,6 +7460,14 @@ function getCachedToken() {
   return null;
 }
 async function login() {
+  const credentials = resolveAuthCredentials();
+  if (credentials === null) {
+    if (!missingCredentialLogged) {
+      missingCredentialLogged = true;
+      log("API-CLIENT", MISSING_CREDENTIAL_MESSAGE);
+    }
+    return null;
+  }
   try {
     const resp = await fetch(`${API_URL}/api/v1/auth/login`, {
       method: "POST",
@@ -7460,7 +7475,7 @@ async function login() {
         "Content-Type": "application/json",
         "X-Project-ID": PROJECT_ID
       },
-      body: JSON.stringify({ email: AUTH_EMAIL, password: AUTH_PASSWORD }),
+      body: JSON.stringify({ email: credentials.email, password: credentials.password }),
       signal: AbortSignal.timeout(5e3)
     });
     if (!resp.ok) return null;

package/hooks/subagent-start.mjs

@@ -7385,8 +7385,15 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var DEFAULT_AUTH_EMAIL = "system@orchestrator.local";
+var MISSING_CREDENTIAL_MESSAGE = "no credential configured (ORCHESTRATOR_ADMIN_PASSWORD / ORCHESTRATOR_AUTH_PASSWORD unset or empty) - login not attempted";
+var missingCredentialLogged = false;
+function resolveAuthCredentials() {
+  const password = (process.env.ORCHESTRATOR_ADMIN_PASSWORD ?? "").trim() || (process.env.ORCHESTRATOR_AUTH_PASSWORD ?? "").trim();
+  if (!password) return null;
+  const email = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || DEFAULT_AUTH_EMAIL;
+  return { email, password };
+}
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
@@ -7452,6 +7459,14 @@ function getCachedToken() {
   return null;
 }
 async function login() {
+  const credentials = resolveAuthCredentials();
+  if (credentials === null) {
+    if (!missingCredentialLogged) {
+      missingCredentialLogged = true;
+      log("API-CLIENT", MISSING_CREDENTIAL_MESSAGE);
+    }
+    return null;
+  }
   try {
     const resp = await fetch(`${API_URL}/api/v1/auth/login`, {
       method: "POST",
@@ -7459,7 +7474,7 @@ async function login() {
         "Content-Type": "application/json",
         "X-Project-ID": PROJECT_ID
       },
-      body: JSON.stringify({ email: AUTH_EMAIL, password: AUTH_PASSWORD }),
+      body: JSON.stringify({ email: credentials.email, password: credentials.password }),
       signal: AbortSignal.timeout(5e3)
     });
     if (!resp.ok) return null;

package/hooks/subagent-stop.mjs

@@ -7381,8 +7381,15 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var DEFAULT_AUTH_EMAIL = "system@orchestrator.local";
+var MISSING_CREDENTIAL_MESSAGE = "no credential configured (ORCHESTRATOR_ADMIN_PASSWORD / ORCHESTRATOR_AUTH_PASSWORD unset or empty) - login not attempted";
+var missingCredentialLogged = false;
+function resolveAuthCredentials() {
+  const password = (process.env.ORCHESTRATOR_ADMIN_PASSWORD ?? "").trim() || (process.env.ORCHESTRATOR_AUTH_PASSWORD ?? "").trim();
+  if (!password) return null;
+  const email = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || DEFAULT_AUTH_EMAIL;
+  return { email, password };
+}
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
@@ -7448,6 +7455,14 @@ function getCachedToken() {
   return null;
 }
 async function login() {
+  const credentials = resolveAuthCredentials();
+  if (credentials === null) {
+    if (!missingCredentialLogged) {
+      missingCredentialLogged = true;
+      log("API-CLIENT", MISSING_CREDENTIAL_MESSAGE);
+    }
+    return null;
+  }
   try {
     const resp = await fetch(`${API_URL}/api/v1/auth/login`, {
       method: "POST",
@@ -7455,7 +7470,7 @@ async function login() {
         "Content-Type": "application/json",
         "X-Project-ID": PROJECT_ID
       },
-      body: JSON.stringify({ email: AUTH_EMAIL, password: AUTH_PASSWORD }),
+      body: JSON.stringify({ email: credentials.email, password: credentials.password }),
       signal: AbortSignal.timeout(5e3)
     });
     if (!resp.ok) return null;

package/hooks/user-prompt.mjs

@@ -61,8 +61,15 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var DEFAULT_AUTH_EMAIL = "system@orchestrator.local";
+var MISSING_CREDENTIAL_MESSAGE = "no credential configured (ORCHESTRATOR_ADMIN_PASSWORD / ORCHESTRATOR_AUTH_PASSWORD unset or empty) - login not attempted";
+var missingCredentialLogged = false;
+function resolveAuthCredentials() {
+  const password = (process.env.ORCHESTRATOR_ADMIN_PASSWORD ?? "").trim() || (process.env.ORCHESTRATOR_AUTH_PASSWORD ?? "").trim();
+  if (!password) return null;
+  const email = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || DEFAULT_AUTH_EMAIL;
+  return { email, password };
+}
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);
@@ -121,6 +128,14 @@ function getCachedToken() {
   return null;
 }
 async function login() {
+  const credentials = resolveAuthCredentials();
+  if (credentials === null) {
+    if (!missingCredentialLogged) {
+      missingCredentialLogged = true;
+      log("API-CLIENT", MISSING_CREDENTIAL_MESSAGE);
+    }
+    return null;
+  }
   try {
     const resp = await fetch(`${API_URL}/api/v1/auth/login`, {
       method: "POST",
@@ -128,7 +143,7 @@ async function login() {
         "Content-Type": "application/json",
         "X-Project-ID": PROJECT_ID
       },
-      body: JSON.stringify({ email: AUTH_EMAIL, password: AUTH_PASSWORD }),
+      body: JSON.stringify({ email: credentials.email, password: credentials.password }),
       signal: AbortSignal.timeout(5e3)
     });
     if (!resp.ok) return null;

package/hooks/verification-before-completion.mjs

@@ -61,8 +61,6 @@ if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT
   );
 }
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
-var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
-var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
 function resolveHookProjectRoot(cwd) {
   return resolveProjectRoot(cwd);