@ravefox/space 0.2.1 → 0.4.0

package/node_modules/@commonlyai/seats/src/upstream-refusal.js

@@ -1,418 +0,0 @@
-/**
- * TASK-096 — name a refused model route, instead of reporting the silence it
- * causes.
- *
- * Measured 2026-09-22 against pi 0.84.1 with a route answering 429 (the shape
- * that made a seat look broken for two and a half days): pi runs its own retry
- * ladder, reports the refusal on `message_end`/`auto_retry_end` JSON events, and
- * EXITS 0 with no assistant text. `extractReply` in the pi adapter collected only
- * `type: "error"` events — of which this produces none — so the wrapper logged
- * `no wrapper-post (empty output)` and the cause sat unread in the stream.
- *
- * Two rules govern the text that reaches a seat log:
- *
- *  1. KEEP-LIST, not strip-list (Vera 70876, Wren 70877). A strip-list removes
- *     only the shapes we thought of, and a 401 can echo the key back. So a body
- *     contributes one NAMED field or nothing at all.
- *  2. Exact-match refusal for credentials. If the kept text contains a value
- *     this spawn was handed, the text is dropped — a known value, not a guessed
- *     shape (Wren 70877).
- *
- * Two limits follow from rule 2. They are the accepted cost of refusing guessed
- * shapes, named here so they are not rediscovered as defects later (Vera 71082):
- *
- *  a. The match is exact and against THIS spawn's values only, so a credential
- *     that arrives transformed — base64 inside a proxy error, percent-encoded in
- *     a URL echo — does not match and the text is kept. Matching transformed
- *     shapes instead would reintroduce the class rule 1 exists to avoid.
- *  b. The keep-list can still surface someone ELSE's secret. A third party's key
- *     relayed in an upstream error is not detectable here, because the one
- *     inventory this module has is the set of values it was itself handed.
- *
- * Scope: this reader was wired into the pi adapter only. TASK-103 extended it
- * to codex and claude, which are NOT silent the way pi was: the claude adapter
- * rejects on a non-zero exit and deliberately reports stdout with it, because a
- * `-p` run writes quota conditions there; the codex adapter rejects on
- * `turnFailedMessage` even at exit 0. Their gap was the opposite one — the text
- * they raised was the raw tail, unscrubbed by the rules above, and carried no
- * HTTP status for the run loop to classify on. `scrubAdapterFailure` below is
- * the shared reader they now both go through, so the two rules cannot drift
- * apart between three adapters.
- */
-
-/** The kept detail is truncated, ellipsis included, to this many characters. */
-export const MAX_REFUSAL_DETAIL = 256;
-
-/**
- * The status an adapter prefixes to its error text: `"429: {…}"` -> `429`.
- * Null for anything that is not a 4xx/5xx, so a message that merely starts with
- * a number ("4040 tokens over budget") is not read as a status.
- *
- * The separator pi uses is NOT fixed — measured 2026-09-22, the same pi 0.84.1
- * emits `"429: {"message":…}"` for a JSON body and `"502 <html>…"` for an
- * HTML one. Both forms are matched here; a parser that required the colon would
- * have kept `502 <html>…` as the whole "body" and then dropped it as non-JSON,
- * reporting the status alone with no sign that the body was never read.
- */
-const STATUS_PREFIX = /^\s*(\d{3})(?!\d)\s*:?\s*/;
-
-export const statusFromError = (value) => {
-  const match = STATUS_PREFIX.exec(String(value ?? ''));
-  if (!match) return null;
-  const status = Number(match[1]);
-  return status >= 400 && status <= 599 ? status : null;
-};
-
-/**
- * The body the adapter carried after its status prefix, or the whole text when
- * there is no status to strip. `"429: {"message":"a: b"}"` -> `{"message":"a: b"}`;
- * `"502 <html>"` -> `<html>`.
- */
-export const bodyFromError = (value) => {
-  const text = String(value ?? '');
-  if (statusFromError(text) === null) return text.trim();
-  return text.replace(STATUS_PREFIX, '').trim();
-};
-
-/** The shortest value the refusal-text reader treats as a credential. */
-export const MIN_CREDENTIAL_LENGTH = 8;
-
-/**
- * Replace credential values this spawn was handed with a marker.
- *
- * This is the exact-match half, for text that is kept for its whole shape rather
- * than filtered to one field — an adapter's stderr tail, say, whose diagnostic
- * value is in the lines around the secret. Values shorter than eight characters
- * are ignored: redacting a one-character "credential" would corrupt ordinary
- * prose, and no issued credential is that short.
- *
- * The floor belongs to this reader only. The trace store scrubs every value
- * registered with it, whatever its length, and the valet refuses to grant a
- * credential shorter than this (credential_denied), so no granted value is
- * ever below the floor.
- */
-export const redactKnownCredentials = (text, credentials = []) => {
-  let out = String(text ?? '');
-  for (const value of credentials) {
-    if (typeof value !== 'string' || value.length < MIN_CREDENTIAL_LENGTH) continue;
-    out = out.split(value).join('[redacted]');
-  }
-  return out;
-};
-
-/**
- * The keep-list. Given the raw body an adapter captured, keep at most one named
- * field of it and only when that field is a string:
- *
- *   `error.message` first (the OpenAI-shaped error), then a top-level `message`
- *   (which is the shape LiteLLM's budget refusal actually uses — the motivating
- *   case; a keep-list that kept only `error.message` would name the status and
- *   still hide the budget line that started this row).
- *
- * Everything else — HTML, a non-JSON body, a JSON body with neither field, a
- * body echoing a known credential — contributes nothing. Returns null rather
- * than a partial guess.
- */
-export const keptRefusalDetail = (raw, { credentials = [] } = {}) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(String(raw ?? ''));
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
-
-  const candidate = parsed?.error?.message ?? parsed?.message;
-  if (typeof candidate !== 'string') return null;
-
-  const text = candidate.replace(/\s+/g, ' ').trim();
-  if (!text) return null;
-
-  const redacted = redactKnownCredentials(text, credentials);
-  // `[redacted]` appearing is the signal that the body echoed something this
-  // spawn was handed. The status is still worth keeping; the text is not.
-  if (redacted !== text) return null;
-
-  return text.length > MAX_REFUSAL_DETAIL
-    ? `${text.slice(0, MAX_REFUSAL_DETAIL - 1)}…`
-    : text;
-};
-
-/**
- * Read a pi JSON stream and return the refusal it ended on, or null.
- *
- * `auto_retry_end` is the terminal word — it names the status and the body after
- * the ladder has finished — so it wins over the per-attempt `message_end`
- * events that precede it. A run that refused on its first attempt and never
- * retried still reports through `message_end`.
- *
- * A retry that answered ends the refusal. pi prints `auto_retry_end` with
- * `success: true` once a retried call answers (agent-session.js, pi 0.84.1), so
- * a refusal before it is one pi recovered from. Kept, it would name the cause
- * of a later failure that has none of its own, such as `fetch failed` (F320).
- */
-export const readUpstreamRefusal = (stdout, { credentials = [] } = {}) => {
-  let status = null;
-  let raw = null;
-
-  for (const line of String(stdout ?? '').split('\n')) {
-    if (!line.trim()) continue;
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      continue;
-    }
-
-    // A compaction that continues the turn is pi recovering from an overflow,
-    // so a refusal before it is one pi recovered from too. The turn's own cause
-    // comes after (agent-session.js `compaction_end`, pi 0.84.1).
-    if ((event?.type === 'auto_retry_end' && event.success === true)
-      || (event?.type === 'compaction_end' && event.aborted === false && event.willRetry === true)) {
-      status = null;
-      raw = null;
-      continue;
-    }
-
-    if (event?.type === 'auto_retry_end' && event.success === false) {
-      const candidate = event.finalError ?? event.errorMessage;
-      const attemptStatus = statusFromError(candidate);
-      if (attemptStatus) {
-        status = attemptStatus;
-        raw = bodyFromError(candidate);
-      } else if (typeof candidate === 'string' && candidate.trim()) {
-        // F341: the retries ended on a failure that names no status ("fetch
-        // failed"), so that is the turn's cause, not a 429 an earlier attempt
-        // hit. Holding the old status named the turn refused and it went
-        // unretried. An end with no error text at all says nothing, and keeps it.
-        status = null;
-        raw = null;
-      }
-      continue;
-    }
-
-    const message = event?.message;
-    if (
-      event?.type === 'message_end'
-      && message?.role === 'assistant'
-      && message.stopReason === 'error'
-      && status === null
-    ) {
-      const attemptStatus = statusFromError(message.errorMessage);
-      if (attemptStatus) {
-        status = attemptStatus;
-        raw = bodyFromError(message.errorMessage);
-      }
-    }
-  }
-
-  if (status === null) return null;
-  return { status, detail: keptRefusalDetail(raw, { credentials }) };
-};
-
-/**
- * Is this text STRUCTURED upstream data — a JSON object or an array? The gate for
- * the whole-tail fallback below, deliberately NOT `kept === null`, which is true
- * for five different reasons (Vera 71350).
- *
- * An array counts, and that is a correction (Vera 71360, measured): `[{...}]` is
- * structured data with fields this code does not know, which is exactly what rule
- * 1 exists for, and treating it as prose shipped the whole body under exact-match
- * alone. A JSON *string* is the opposite case and does NOT count — `"Too many
- * requests"` is a whole-shape text with no fields to reduce, so it keeps its
- * wording like any other prose.
- */
-const isStructuredBody = (raw) => {
-  try {
-    const parsed = JSON.parse(String(raw ?? ''));
-    return parsed !== null && typeof parsed === 'object';
-  } catch {
-    return false;
-  }
-};
-
-/**
- * A 3-digit number is read as a status only when the tail NAMES it as one:
- * `status 429`, `HTTP 429`, `code: "429"` — or when it opens the tail or a ` | `
- * segment followed by a colon, which is the shape claude's `stderr | stdout`
- * join produces for a body that leads with its status.
- *
- * A bare `\b(\d{3})\b` scan is not enough, and the false positives are not
- * hypothetical: `500 tokens`, `"max_tokens": 500` and `retry in 500 seconds`
- * all read as 500, and `classifySpawnFailure` tests the status FIELD before the
- * message — so a count misread as a status stands the fleet down on a refusal
- * that never happened, which is worse than no status at all (Vera 71352).
- */
-const STATUS_NAMED = /\b(?:status(?:_?code)?|code|http)\b\W{0,4}(\d{3})(?!\d)/gi;
-// `HTTP/1.1 429 Too Many Requests` is the most canonical refusal shape there is,
-// and the `\W{0,4}` gap above handles `HTTP 429` but cannot reach a VERSIONED
-// line: the `1` in `/1.1` is a
-// WORD character, so `HTTP` and `429` are not within four non-word characters of
-// each other. It read as `status: null` — an unclassified runtime failure on the
-// single most recognisable shape, which is the misclassification this row exists
-// to remove (Vera 71359). Its own pattern, not a looser gap: widening the gap
-// would start reading `/v1/models 500` as a status.
-const STATUS_LINE = /\bHTTP\/\d(?:\.\d)?\s+(\d{3})(?!\d)/gi;
-const STATUS_COLON = /(?:^|\|\s*)(\d{3})(?!\d)\s*:/g;
-
-/** The first 4xx/5xx one of those shapes names, or null. */
-const scanStatuses = (text, pattern) => {
-  for (const match of String(text ?? '').matchAll(pattern)) {
-    const value = Number(match[1]);
-    if (value >= 400 && value <= 599) return value;
-  }
-  return null;
-};
-
-/**
- * Find the status AND the body boundary, because they are the same question.
- *
- * Anchoring the status to a ` | ` segment start is not enough on its own: the
- * body has to be taken from just past that status too, or a mid-tail read
- * isolates the status and then hands the WHOLE joined tail to the body rules,
- * which no longer look like a JSON body and so fall through to "keep it all".
- * That is the difference between dropping a credential-echoing body and shipping
- * the part of it that exact-match cannot see.
- *
- * `STATUS_COLON` is the only shape that moves the boundary, because it is the
- * same shape as the anchored prefix (`429: {body}`), just found at a segment
- * boundary — claude's `stderr | stdout` join. A status that appears inside a
- * body (`{"error":{"code":"429"}}`) or as prose (`HTTP 503`) names the status
- * (`HTTP/1.1 429`) but marks no boundary, so the whole text stays the body.
- */
-const readStatusAndBody = (text) => {
-  const raw = String(text ?? '');
-  const prefixed = statusFromError(raw);
-  if (prefixed !== null) return { status: prefixed, body: bodyFromError(raw) };
-  // Only the colon shape moves the boundary — see the note above. A status LINE
-  // names the status but its reason phrase is prose, so the body stays the whole
-  // text and the exact-match rule protects it.
-  for (const match of raw.matchAll(STATUS_COLON)) {
-    const value = Number(match[1]);
-    if (value >= 400 && value <= 599) {
-      return { status: value, body: raw.slice(match.index + match[0].length).replace(/^\s*:?\s*/, '') };
-    }
-  }
-  const named = scanStatuses(raw, STATUS_NAMED);
-  return { status: named ?? scanStatuses(raw, STATUS_LINE), body: raw };
-};
-
-/**
- * The shared reader for an adapter's own failure tail (TASK-103).
- *
- * The two rules above are about a body an adapter captured, and they apply here
- * too — but the tail is a different shape from pi's refusal, and the difference
- * decides how each rule lands:
- *
- *  - The tail is often NOT structured. Claude's `-p` mode writes its terminal
- *    condition as prose (`Claude usage limit reached. Your limit will reset at
- *    11:40pm.`), and that line is the whole diagnostic value of reporting
- *    stdout at all — 361 consecutive failures on 2026-08-03 carried no reason
- *    because of it. So the keep-list applies only when the tail parses as a
- *    body; when it does not, the text is KEPT as a whole shape and the
- *    exact-match rule is what protects it (`redactKnownCredentials`, which
- *    substitutes rather than drops, precisely because a whole-shape text has no
- *    second field to fall back to).
- *
- *  - A body that IS structured (a JSON object or array) is reduced to one named
- *    field, and a body whose field echoed a value this spawn was handed is
- *    DROPPED WHOLE — the same trade rule 2 makes everywhere. The fallback to the
- *    whole tail is gated on the SHAPE (is it structured at all), never on
- *    "the keep-list returned null": that null has
- *    four other causes, and one of them is the credential echo this line exists
- *    to drop. Gating on `kept === null` would emit the whole body for that case,
- *    which is precisely what rule 2 forbids — and exact-match cannot see a
- *    transformed shape (limit (a) in the header), so a key that arrived
- *    base64'd or percent-encoded would ship (Vera 71350/71351).
- *
- * Returns `{ status, detail }`: `status` is the 4xx/5xx the tail named, or null.
- * The caller decides where the status goes; `classifySpawnFailure` reads it off
- * `error.status` or out of the message text, so both a leading `429: …` prefix
- * and an attached field classify the same way. `detail` is `''` when nothing of
- * the body may be shown — the status is then the whole diagnostic.
- */
-export const scrubAdapterFailure = (text, { credentials = [], limit = MAX_REFUSAL_DETAIL } = {}) => {
-  const raw = String(text ?? '').trim();
-  const { status, body } = readStatusAndBody(raw);
-  const kept = keptRefusalDetail(body, { credentials });
-  const detail = kept ?? (isStructuredBody(body) ? '' : redactKnownCredentials(body, credentials));
-  return { status, detail: detail.slice(0, limit) };
-};
-
-/**
- * The Error an adapter raises, built from its own failure tail.
- *
- * `status` is attached as a field, not only written into the text: the run
- * loop's classifier tests `error.status === 429` before it looks at the
- * message, and a refusal that is only readable by regex is one wording away
- * from the misclassification that cost an hour on 2026-08-18 (see
- * spawn-retry.js). The message still names the status so a human log says the
- * same thing as the classifier's decision.
- */
-/**
- * The provider's own error code (`error.code`, then a top-level `code`), read
- * from the body a tail carries: the structured body after a status, else the
- * one JSON object embedded in prose (`unexpected status 404 Not Found: {…}`).
- * It is a keep-list of one more named field, and narrower than the message:
- * only a short identifier is kept, and one that echoes a credential this spawn
- * was handed is dropped. Null when there is none (F178: the keep-list reduced
- * `{"code":"model_not_found"}` to its message, so the code was lost).
- */
-const PROVIDER_CODE_RE = /^[A-Za-z][\w.-]{0,63}$/;
-export const providerCodeFrom = (text, { credentials = [] } = {}) => {
-  const raw = String(text ?? '');
-  const { body } = readStatusAndBody(raw.trim());
-  const candidates = [body];
-  const start = raw.indexOf('{');
-  const end = raw.lastIndexOf('}');
-  if (start >= 0 && end > start) candidates.push(raw.slice(start, end + 1));
-  for (const candidate of candidates) {
-    let parsed;
-    try {
-      parsed = JSON.parse(candidate);
-    } catch {
-      continue;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
-    const code = parsed.error?.code ?? parsed.code;
-    if (typeof code !== 'string' || !PROVIDER_CODE_RE.test(code)) return null;
-    return redactKnownCredentials(code, credentials) === code ? code : null;
-  }
-  return null;
-};
-
-export const adapterFailure = (label, text, { credentials = [], exitCode = null, limit } = {}) => {
-  const { status, detail } = scrubAdapterFailure(text, { credentials, limit });
-  const code = exitCode === null ? '' : ` exited with code ${exitCode}`;
-  const named = status === null ? '' : ` (upstream ${status})`;
-  const error = new Error(`${label}${code}${named}${detail ? `: ${detail}` : ''}`);
-  if (status !== null) error.status = status;
-  const providerCode = providerCodeFrom(text, { credentials });
-  if (providerCode !== null) error.providerCode = providerCode;
-  return error;
-};
-
-/**
- * The seat-log clause. The status is always present; the detail only when the
- * keep-list kept one. `grep 'upstream refused'` finds every refusal, which is
- * the property the old `no wrapper-post (empty output)` line did not have.
- */
-export const describeUpstreamRefusal = (refusal) => {
-  if (!refusal || typeof refusal.status !== 'number') return null;
-  return refusal.detail
-    ? `upstream refused ${refusal.status}: ${refusal.detail}`
-    : `upstream refused ${refusal.status}`;
-};
-
-/**
- * The credential values this spawn was handed, for the exact-match check in
- * `redactKnownCredentials`. `envNames` are the adapter's own provider keys; the
- * caller supplies them because only the adapter knows which key its route uses.
- */
-export const spawnCredentials = (ctx = {}, envNames = []) => {
-  const env = ctx.env || process.env || {};
-  return [
-    ctx.runtimeToken,
-    ...envNames.map((name) => env[name]),
-  ].filter((value) => typeof value === 'string' && value.length >= MIN_CREDENTIAL_LENGTH);
-};

package/node_modules/@commonlyai/seats/src/valet/env.js

@@ -1,201 +0,0 @@
-/**
- * Build the env and HOME one run executes in. The run starts from nothing the
- * user's login can be found through: a short allowlist of locale/terminal
- * variables, a fresh HOME whose XDG dirs sit inside it, and only the
- * credentials its grant names.
- *
- * What this is NOT: a filesystem sandbox. A process that already knows an
- * absolute path (/Users/<you>/.claude) can still open it, and macOS keychain
- * items are reached through the user's security session, not through HOME.
- * This removes the paths a CLI discovers its login by; an OS sandbox
- * (Seatbelt, bwrap) is what stops a process that goes looking.
- */
-import { randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
-import { mkdtemp, mkdir, chmod, readFile, rm } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
-import { delimiter, join, resolve, sep } from 'node:path';
-import { traceOf } from '../trace/events.js';
-import { runFailure } from '../failures.js';
-import { MIN_CREDENTIAL_LENGTH } from '../upstream-refusal.js';
-import { validateGrant } from './grant.js';
-import { startProviderProxy } from '../wire/provider-proxy.js';
-
-// Same spirit as the goose adapter's SAFE_ENV: locale, terminal and TLS trust
-// only. USER/LOGNAME are left out on purpose; they name the account whose
-// login this boundary exists to hide.
-export const BASE_ENV_ALLOWLIST = /^(?:PATH|LANG|LC_[A-Z0-9_]+|TERM|TZ|SSL_CERT_FILE|SSL_CERT_DIR|NO_COLOR|CI)$/;
-
-const isInside = (path, dir) => {
-  const a = resolve(path);
-  const b = resolve(dir);
-  return a === b || a.startsWith(b.endsWith(sep) ? b : b + sep);
-};
-
-/**
- * PATH entries under the real home both name it and often hold shims that
- * read the user's login (~/.local/bin/claude). Adapters run their CLI by
- * absolute path, so the run loses nothing it needs.
- */
-// A HOME reached through a symlink (macOS /var -> /private/var) shows up in
-// PATH under its resolved path too, e.g. npm's cwd-derived node_modules/.bin.
-const spellings = (dir) => { try { return [dir, realpathSync(dir)]; } catch { return [dir]; } };
-
-const scrubPath = (value, realHomes) => value.split(delimiter)
-  .filter((entry) => entry && !realHomes.some((home) => isInside(entry, home)))
-  .join(delimiter);
-
-const pickBaseEnv = (baseEnv, realHomes) => {
-  const env = {};
-  for (const [name, value] of Object.entries(baseEnv)) {
-    if (typeof value === 'string' && BASE_ENV_ALLOWLIST.test(name)) env[name] = value;
-  }
-  if (env.PATH !== undefined) env.PATH = scrubPath(env.PATH, realHomes);
-  return env;
-};
-
-const makeHome = async (root) => {
-  const home = await mkdtemp(join(root || tmpdir(), 'seat-home-'));
-  // Conventional layout, so a CLI that ignores XDG_* and defaults to
-  // ~/.config still lands inside the throwaway HOME.
-  const dirs = {
-    XDG_CONFIG_HOME: join(home, '.config'),
-    XDG_DATA_HOME: join(home, '.local', 'share'),
-    XDG_STATE_HOME: join(home, '.local', 'state'),
-    XDG_CACHE_HOME: join(home, '.cache'),
-    TMPDIR: join(home, 'tmp'),
-  };
-  await chmod(home, 0o700);
-  for (const dir of Object.values(dirs)) await mkdir(dir, { recursive: true, mode: 0o700 });
-  // mkdir's mode is masked by umask; set it explicitly on every level made.
-  for (const dir of [join(home, '.local'), ...Object.values(dirs)]) await chmod(dir, 0o700);
-  return { home, dirs };
-};
-
-/** A value that cannot ride an env var is the same as no value. */
-const usable = (value) => typeof value === 'string' && value.length > 0 && !value.includes('\0');
-
-const resolveOne = async (spec, { baseEnv, resolveSecret }) => {
-  if (spec.from === 'env') return baseEnv[spec.ref || spec.name];
-  if (spec.from === 'file') return (await readFile(spec.ref, 'utf8')).replace(/\r?\n$/, '');
-  if (typeof resolveSecret !== 'function') return undefined;
-  return resolveSecret(spec.name, spec);
-};
-
-/**
- * The grant.issued entry for grantMeta. Its scope is the room grant this run
- * acts under (exact tool names, a connection id), as the host knows it; the
- * run grant's own credential names and patterns show up in credential.* and
- * in each permission.decided rule. `taskId` + `podId` bind the grant to that
- * board task, ending when it is done unless `endsOn` says otherwise.
- */
-const grantIssued = (meta) => {
-  const {
-    grantId = randomUUID(), parentGrantId, scope = {}, target, issuedBy, expiresAt, taskId, podId, endsOn = 'task.done',
-  } = meta;
-  return {
-    grantId,
-    ...(parentGrantId === undefined ? {} : { parentGrantId }),
-    scope: { tools: [], audience: [], ...scope },
-    ...(target ? { target } : {}),
-    ...(issuedBy ? { issuedBy } : {}),
-    ...(expiresAt ? { expiresAt: expiresAt instanceof Date ? expiresAt.toISOString() : expiresAt } : {}),
-    ...(taskId ? { binding: { taskId, podId, endsOn } } : {}),
-  };
-};
-
-/**
- * prepareRunEnv({ grant, baseEnv, resolveSecret, root?, require?, trace?, ctx?, grantMeta?, upstreams? })
- *   → { env, home, cleanup, granted: [names], injected: { NAME: { baseURL, wire } }, grantId? }
- *
- * `require` lists credential names the adapter cannot run without; one the
- * grant does not name fails the run as credential_denied before any spawn.
- * A named credential that cannot be resolved, or that resolves to fewer than
- * MIN_CREDENTIAL_LENGTH characters, fails it the same way: a run that
- * silently lacks its key fails later and less legibly, and a value that short
- * would slip past the refusal-text reader's redaction.
- *
- * A credential the grant marks `inject: true` never reaches the env. The host
- * names its provider in `upstreams[NAME]` ({ baseURL, wire }, wire defaulting
- * to openai-chat); the run gets a loopback provider proxy holding the value in
- * memory, env[NAME] becomes that proxy's token, and `injected[NAME].baseURL`
- * is where the host points the CLI. cleanup() closes the proxies. One with no
- * upstream fails as credential_denied (no_upstream) before it is resolved.
- * The proxy listens on 127.0.0.1, so a run without the host's network
- * (bwrap --unshare-net) cannot reach it yet.
- *
- * Events go to `trace`, else ctx.trace: grant.issued (only with grantMeta,
- * first), then credential.granted {names, injected?} or credential.denied
- * {name, reason}. `injected` lists the names held by a proxy; the rest of
- * `names` are held by the run.
- * Values never enter an event or a message, and a hook that offers
- * redact(values) is handed the resolved values and each proxy token, so the
- * record can scrub them out of agent text too.
- */
-export const prepareRunEnv = async ({
-  grant, baseEnv = {}, resolveSecret, root, require: required = [], trace, ctx, grantMeta, upstreams = {},
-} = {}) => {
-  const valid = validateGrant(grant);
-  const hook = trace && typeof trace.emit === 'function' ? trace : traceOf(ctx);
-  const issued = grantMeta ? grantIssued(grantMeta) : null;
-  if (issued) hook.emit('grant.issued', issued);
-  const realHomes = [...new Set([baseEnv.HOME, homedir()].filter(Boolean).flatMap(spellings))];
-  const DENIED = {
-    not_granted: 'is not in the run grant',
-    unresolved: 'could not be resolved',
-    too_short: `resolved to a value shorter than ${MIN_CREDENTIAL_LENGTH} characters`,
-    no_upstream: 'is marked inject, but the host named no upstream for it',
-  };
-  const deny = (name, reason, values) => {
-    hook.emit('credential.denied', { name, reason });
-    return runFailure('credential_denied', `${name} ${DENIED[reason]}`, { credentials: values });
-  };
-
-  const granted = new Set(valid.credentials.map((c) => c.name));
-  const missing = required.find((name) => !granted.has(name));
-  if (missing) throw deny(missing, 'not_granted', []);
-
-  const { home, dirs } = await makeHome(root);
-  const proxies = [];
-  const cleanup = async () => {
-    await Promise.all(proxies.splice(0).map((proxy) => proxy.close()));
-    await rm(home, { recursive: true, force: true });
-  };
-  const env = { ...pickBaseEnv(baseEnv, realHomes), HOME: home, ...dirs };
-  const values = [];
-  const injected = {};
-  try {
-    for (const spec of valid.credentials) {
-      const upstream = spec.inject ? upstreams[spec.name] : undefined;
-      if (spec.inject && !upstream) throw deny(spec.name, 'no_upstream', values);
-      let value;
-      // A resolver's error text may quote the secret it failed on; drop it.
-      try { value = await resolveOne(spec, { baseEnv, resolveSecret }); } catch { value = undefined; }
-      if (!usable(value)) throw deny(spec.name, 'unresolved', values);
-      // A value this short cannot be told apart from ordinary text, so the
-      // refusal-text reader would not redact it. Refuse it here, before spawn.
-      if (value.length < MIN_CREDENTIAL_LENGTH) throw deny(spec.name, 'too_short', values);
-      values.push(value);
-      if (upstream) {
-        const wire = upstream.wire ?? 'openai-chat';
-        const proxy = await startProviderProxy({
-          provider: { baseURL: upstream.baseURL }, keyMaterial: value, wire, adapterLabel: 'Valet',
-        });
-        proxies.push(proxy);
-        env[spec.name] = proxy.token;
-        injected[spec.name] = { baseURL: proxy.baseURL, wire };
-      } else {
-        env[spec.name] = value;
-      }
-    }
-  } catch (error) {
-    await cleanup();
-    throw error;
-  }
-  // A proxy token authorizes provider calls until cleanup, so the record scrubs it too.
-  if (typeof hook.redact === 'function') hook.redact([...values, ...proxies.map((proxy) => proxy.token)]);
-  const names = valid.credentials.map((c) => c.name);
-  const proxied = Object.keys(injected);
-  hook.emit('credential.granted', proxied.length ? { names, injected: proxied } : { names });
-  return { env, home, cleanup, granted: names, injected, ...(issued ? { grantId: issued.grantId } : {}) };
-};