@sema-agent/client-core 0.85.2 → 0.86.0

package/dist/wireFailureShape.d.ts

@@ -3,10 +3,13 @@ interface WireFailureShape {
     errorCode?: string;
     retryAfterSec?: number;
     committed?: 'no' | 'unknown' | 'unreadable';
+    bodyField?: string;
+    bodyName?: string;
     message: string;
 }
 export declare function readErrorNumber(o: object, key: string): number | undefined;
 export declare function readErrorString(o: object, key: string): string | undefined;
 export declare function readErrorStringList(o: object, key: string): readonly string[] | undefined;
+export declare function readErrorStrictStringList(o: object, key: string): readonly string[] | undefined;
 export declare function wireFailureShapeOf(e: unknown): WireFailureShape;
 export {};

package/dist/wireFailureShape.js

@@ -52,6 +52,33 @@ export function readErrorStringList(o, key) {
     const v = readErrorSlot(o, key, (x) => Array.isArray(x));
     return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : undefined;
 }
+export function readErrorStrictStringList(o, key) {
+    const strict = (x) => {
+        if (!Array.isArray(x))
+            return false;
+        for (let i = 0; i < x.length; i++)
+            if (typeof x[i] !== 'string')
+                return false;
+        return true;
+    };
+    const v = readErrorSlot(o, key, strict);
+    if (!Array.isArray(v))
+        return undefined;
+    try {
+        const out = [];
+        const len = v.length;
+        for (let i = 0; i < len; i++) {
+            const item = v[i];
+            if (typeof item !== 'string')
+                return undefined;
+            out.push(item);
+        }
+        return out;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function wireFailureShapeOf(e) {
     const o = e ?? {};
     const status = readGuarded(o, 'status');
@@ -85,6 +112,21 @@ export function wireFailureShapeOf(e) {
             }
         }
     }
+    const ownString = (key) => {
+        if (extraObj === undefined)
+            return undefined;
+        try {
+            if (!Object.hasOwn(extraObj, key))
+                return undefined;
+            const v = extraObj[key];
+            return typeof v === 'string' ? v : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const bodyField = ownString('field');
+    const bodyName = ownString('name');
     let message;
     try {
         message = typeof rawMessage === 'string' && rawMessage !== '' ? rawMessage : String(e);
@@ -107,6 +149,8 @@ export function wireFailureShapeOf(e) {
         ...(typeof errorCode === 'string' ? { errorCode } : {}),
         ...(sec !== undefined ? { retryAfterSec: sec } : {}),
         ...(committed !== undefined ? { committed } : {}),
+        ...(bodyField !== undefined ? { bodyField } : {}),
+        ...(bodyName !== undefined ? { bodyName } : {}),
         message,
     };
 }

package/dist/wireRefusalCopy.d.ts

@@ -1,4 +1,5 @@
-import { USAGE_WINDOW_EXHAUSTED } from './engineErrorCodes.js';
+import { FLEET_LEASE_UNAVAILABLE, USAGE_WINDOW_EXHAUSTED } from './engineErrorCodes.js';
+import type { TaskRequestLike } from './request/taskRequest.js';
 export declare const CONFLICT_APPROVAL_SETTLED = "conflict.approval_settled";
 export declare const CONFLICT_RUN_NOT_RUNNING = "conflict.run_not_running";
 export type CancelConflictKind = 'approval_settled' | 'run_not_running' | 'unrecognized';
@@ -14,6 +15,13 @@ export interface UsageWindowExhaustedDetail {
 }
 export declare function usageWindowExhaustedFromError(err: unknown): UsageWindowExhaustedDetail | null;
 export declare function usageWindowExhaustedContent(detail: UsageWindowExhaustedDetail): string;
+export interface FleetLeaseUnavailableDetail {
+    code: typeof FLEET_LEASE_UNAVAILABLE;
+    reason?: string;
+    retryAfterSec?: number;
+}
+export declare function fleetLeaseUnavailableFromError(err: unknown): FleetLeaseUnavailableDetail | null;
+export declare function fleetLeaseUnavailableContent(detail: FleetLeaseUnavailableDetail): string;
 export type DenyAttributionRefusalKind = 'not_in_proof' | 'decision_conflict' | 'attribution_rejected';
 export interface DenyAttributionRefusalDetail {
     kind: DenyAttributionRefusalKind;
@@ -33,3 +41,33 @@ export interface SessionDeleteConflictDetail {
 }
 export declare function sessionDeleteConflictFromError(err: unknown): SessionDeleteConflictDetail | null;
 export declare function sessionDeleteConflictContent(detail: Pick<SessionDeleteConflictDetail, 'kind' | 'remaining' | 'activeTaskId'>): string;
+export type SettingsPermissionBucket = 'allow' | 'deny' | 'ask';
+export type SettingsPermissionBucketRefusalReason = 'over_cap' | 'bad_entry';
+export interface SettingsPermissionBucketRefusalDetail {
+    readonly bucket: SettingsPermissionBucket;
+    readonly reason: SettingsPermissionBucketRefusalReason;
+    readonly count?: number;
+    readonly cap?: number;
+    readonly index?: number;
+    readonly folded?: true;
+}
+export declare function settingsPermissionBucketRefusalFromError(err: unknown): SettingsPermissionBucketRefusalDetail | null;
+export declare function settingsPermissionBucketRefusalContent(detail: SettingsPermissionBucketRefusalDetail): string;
+export interface ToolDeclarationRefusalDetail {
+    readonly code: string;
+}
+export declare function toolDeclarationRefusalFromError(err: unknown): ToolDeclarationRefusalDetail | null;
+export declare function toolDeclarationRefusalContent(_detail: Pick<ToolDeclarationRefusalDetail, 'code'>): string;
+export interface BodyShapeRefusalDetail {
+    readonly unknownKeys?: readonly string[];
+    readonly unsupportedKeys?: readonly string[];
+}
+export declare function bodyShapeRefusalFromError(err: unknown): BodyShapeRefusalDetail | null;
+export declare function bodyShapeRefusalTouchesSettings(detail: BodyShapeRefusalDetail | null | undefined, sentBody?: TaskRequestLike): boolean | undefined;
+export interface HostPostureRefusalDetail {
+    readonly code: string;
+    readonly askedWholeEnvironment?: true;
+    readonly askedOpenWriteFace?: true;
+}
+export declare function hostPostureRefusalFromError(err: unknown, sentRequest?: TaskRequestLike): HostPostureRefusalDetail | null;
+export declare function hostPostureRefusalContent(detail: Pick<HostPostureRefusalDetail, 'askedWholeEnvironment' | 'askedOpenWriteFace'>): string;

package/dist/wireRefusalCopy.js

@@ -1,6 +1,8 @@
-import { readErrorNumber, readErrorString, readErrorStringList } from './wireFailureShape.js';
-import { ACTIVE_RUN_BUSY_ERROR_CODE, USAGE_WINDOW_EXHAUSTED } from './engineErrorCodes.js';
+import { readErrorNumber, readErrorStrictStringList, readErrorString, readErrorStringList } from './wireFailureShape.js';
+import { ACTIVE_RUN_BUSY_ERROR_CODE, FLEET_LEASE_UNAVAILABLE, RESUME_POLICY_FOLD_CODE, USAGE_WINDOW_EXHAUSTED } from './engineErrorCodes.js';
 import { capForDisplay } from './fleetTaskDesc.js';
+import { effectiveWireErrorCode } from './wireErrorTriage.js';
+import { CORE_TOOL_DECLARATION_CODES } from './generated/engineFactTables.js';
 export const CONFLICT_APPROVAL_SETTLED = 'conflict.approval_settled';
 export const CONFLICT_RUN_NOT_RUNNING = 'conflict.run_not_running';
 function readStringField(o, key) {
@@ -84,6 +86,64 @@ export function usageWindowExhaustedContent(detail) {
         ? `${head} · Send it again in about ${humanWait(detail.retryAfterSec)}`
         : `${head} · The engine did not say how long the window needs — send it again a little later`;
 }
+const positiveFinite = (v) => typeof v === 'number' && Number.isFinite(v) && v > 0;
+export function fleetLeaseUnavailableFromError(err) {
+    if (err === null || typeof err !== 'object')
+        return null;
+    let code;
+    try {
+        code = err.errorCode;
+    }
+    catch {
+        return null;
+    }
+    if (code !== FLEET_LEASE_UNAVAILABLE)
+        return null;
+    const reason = readErrorString(err, 'reason');
+    const rawSec = readErrorNumber(err, 'retryAfterSec');
+    let sec = positiveFinite(rawSec) ? Math.ceil(rawSec) : undefined;
+    if (sec === undefined) {
+        let rawMs;
+        try {
+            rawMs = err.retryAfterMs;
+        }
+        catch {
+            rawMs = undefined;
+        }
+        sec = positiveFinite(rawMs) ? Math.ceil(rawMs / 1000) : undefined;
+    }
+    return {
+        code: FLEET_LEASE_UNAVAILABLE,
+        ...(reason !== undefined && reason !== '' ? { reason } : {}),
+        ...(sec !== undefined ? { retryAfterSec: sec } : {}),
+    };
+}
+export function fleetLeaseUnavailableContent(detail) {
+    let reason;
+    let sec;
+    try {
+        reason = typeof detail === 'object' && detail !== null ? detail.reason : undefined;
+    }
+    catch {
+        reason = undefined;
+    }
+    try {
+        sec = typeof detail === 'object' && detail !== null ? detail.retryAfterSec : undefined;
+    }
+    catch {
+        sec = undefined;
+    }
+    const head = "This deployment could not confirm your usage budget with its quota service, and it refuses billed work while it cannot check, so the engine did not accept this request · Nothing is wrong with the request itself";
+    const cause = reason === 'auth-rejected'
+        ? " · The quota service rejected this engine's credentials — if this keeps happening, whoever operates the engine needs to fix them"
+        : reason === 'unreachable'
+            ? ' · The engine could not reach the quota service'
+            : '';
+    const wait = positiveFinite(sec)
+        ? ` · Send it again in about ${humanWait(Math.ceil(sec))}`
+        : ' · The engine did not say how long to wait — send it again a little later';
+    return `${head}${cause}${wait}`;
+}
 const SETTLED_BY_NOT_IN_PROOF = 'settled_by_not_in_proof';
 const REQUEST_FIELD_CONFLICT = 'request.field_conflict';
 const RESUME_OUTCOME_INVALID = 'resume_outcome_invalid';
@@ -211,3 +271,291 @@ export function sessionDeleteConflictContent(detail) {
         return sessionDeleteConflictUnrecognizedContent();
     }
 }
+const FIELD_INVALID = 'request.field_invalid';
+const BUCKET_OF_FIELD = Object.freeze({
+    'settings.permissions.allow': 'allow',
+    'settings.permissions.deny': 'deny',
+    'settings.permissions.ask': 'ask',
+});
+const nonNegInt = (v) => (typeof v === 'number' && Number.isSafeInteger(v) && v >= 0 ? v : undefined);
+const posInt = (v) => (typeof v === 'number' && Number.isSafeInteger(v) && v >= 1 ? v : undefined);
+export function settingsPermissionBucketRefusalFromError(err) {
+    try {
+        if (typeof err !== 'object' || err === null)
+            return null;
+        if (effectiveWireErrorCode(err) !== FIELD_INVALID)
+            return null;
+        let outer;
+        try {
+            outer = err.errorCode;
+        }
+        catch {
+            return null;
+        }
+        const field = readErrorString(err, 'field');
+        const bucket = field !== undefined && Object.hasOwn(BUCKET_OF_FIELD, field) ? BUCKET_OF_FIELD[field] : undefined;
+        if (bucket === undefined)
+            return null;
+        const reason = readErrorString(err, 'reason');
+        if (reason !== 'over_cap' && reason !== 'bad_entry')
+            return null;
+        const folded = outer === RESUME_POLICY_FOLD_CODE;
+        if (reason === 'over_cap') {
+            const count = nonNegInt(readErrorNumber(err, 'count'));
+            const cap = posInt(readErrorNumber(err, 'cap'));
+            return Object.freeze({
+                bucket,
+                reason,
+                ...(count !== undefined ? { count } : {}),
+                ...(cap !== undefined ? { cap } : {}),
+                ...(folded ? { folded: true } : {}),
+            });
+        }
+        const index = nonNegInt(readErrorNumber(err, 'index'));
+        return Object.freeze({ bucket, reason, ...(index !== undefined ? { index } : {}), ...(folded ? { folded: true } : {}) });
+    }
+    catch {
+        return null;
+    }
+}
+const BUCKET_REFUSAL_UNKNOWN = "The engine refused the permission rules in this request's settings as too many or malformed · Nothing was trimmed or dropped — fix the rule lists, then send the request again";
+export function settingsPermissionBucketRefusalContent(detail) {
+    try {
+        if (typeof detail !== 'object' || detail === null)
+            return BUCKET_REFUSAL_UNKNOWN;
+        const bucket = detail.bucket;
+        const reason = detail.reason;
+        if (bucket !== 'allow' && bucket !== 'deny' && bucket !== 'ask')
+            return BUCKET_REFUSAL_UNKNOWN;
+        if (reason !== 'over_cap' && reason !== 'bad_entry')
+            return BUCKET_REFUSAL_UNKNOWN;
+        const folded = detail.folded === true;
+        const subject = folded ? 'The engine refused to continue this parked work: in the request stored for it,' : 'The engine refused this request:';
+        const list = `the ${bucket} rule list in the permission settings (permissions.${bucket})`;
+        let what;
+        let fix;
+        if (reason === 'over_cap') {
+            const count = nonNegInt(detail.count);
+            const cap = posInt(detail.cap);
+            what =
+                count !== undefined && cap !== undefined
+                    ? count > cap
+                        ? `${list} has ${count} entries, ${count - cap} more than the ${cap} the engine accepts`
+                        : `${list} has ${count} entries, and the engine accepts at most ${cap}`
+                    : `${list} has more entries than the engine accepts`;
+            fix = 'merge rules into broader patterns or remove some';
+        }
+        else {
+            const index = nonNegInt(detail.index);
+            what = index !== undefined ? `entry ${index + 1} of ${list} is empty or not text` : `${list} is not a list of rules`;
+            fix = index !== undefined ? 'fix or remove that entry, so every entry is a non-empty rule' : 'make it a list of non-empty rules';
+        }
+        const next = folded
+            ? `It cannot continue as stored, and the engine refuses the list rather than silently losing rules — ${fix}, then submit the work again as a new request`
+            : `Nothing was trimmed or dropped, because the engine refuses the list rather than silently losing rules — ${fix}, then send the request again`;
+        return `${subject} ${what} · ${next}`;
+    }
+    catch {
+        return BUCKET_REFUSAL_UNKNOWN;
+    }
+}
+export function toolDeclarationRefusalFromError(err) {
+    try {
+        if (typeof err !== 'object' || err === null)
+            return null;
+        let code;
+        try {
+            code = err.errorCode;
+        }
+        catch {
+            return null;
+        }
+        if (typeof code !== 'string' || !CORE_TOOL_DECLARATION_CODES.includes(code))
+            return null;
+        return Object.freeze({ code });
+    }
+    catch {
+        return null;
+    }
+}
+const TOOL_DECLARATION_REFUSAL = "The engine refused to start this run because of a tool this request declares; the engine's own message says which tool and what is wrong with it · " +
+    'This is a problem with the request itself, not a temporary outage — sending the same request again is refused the same way; fix or remove that tool declaration, then send it';
+export function toolDeclarationRefusalContent(_detail) {
+    return TOOL_DECLARATION_REFUSAL;
+}
+const BODY_SHAPE = 'request.body_shape';
+const SETTINGS_KEY_PREFIX = 'settings.';
+export function bodyShapeRefusalFromError(err) {
+    try {
+        if (typeof err !== 'object' || err === null)
+            return null;
+        if (effectiveWireErrorCode(err) !== BODY_SHAPE)
+            return null;
+        const unknownKeys = readErrorStrictStringList(err, 'unknownKeys');
+        const unsupportedKeys = readErrorStrictStringList(err, 'unsupportedKeys');
+        return Object.freeze({
+            ...(unknownKeys !== undefined ? { unknownKeys: Object.freeze(unknownKeys) } : {}),
+            ...(unsupportedKeys !== undefined ? { unsupportedKeys: Object.freeze(unsupportedKeys) } : {}),
+        });
+    }
+    catch {
+        return null;
+    }
+}
+const SETTINGS_PERMISSIONS_PREFIX = 'permissions.';
+const ECHO_MAX_CHARS = 64;
+function echoedKeyName(key) {
+    const clean = key.replace(/[\u0000-\u001f\u007f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, '');
+    return clean.length > ECHO_MAX_CHARS ? `${clean.slice(0, ECHO_MAX_CHARS)}…` : clean;
+}
+function hasCustomJson(v) {
+    return typeof v === 'object' && v !== null && typeof v.toJSON === 'function';
+}
+function sentValue(bag, key) {
+    try {
+        if (!Object.prototype.propertyIsEnumerable.call(bag, key))
+            return { state: 'absent' };
+        const value = bag[key];
+        if (value === undefined || typeof value === 'function' || typeof value === 'symbol')
+            return { state: 'absent' };
+        if (typeof value === 'bigint' || hasCustomJson(value))
+            return { state: 'unknown' };
+        return { state: 'sent', value };
+    }
+    catch {
+        return { state: 'unknown' };
+    }
+}
+function isKeyBag(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function echoMatch(bag, prefix, echo) {
+    let names;
+    try {
+        names = Object.keys(bag);
+    }
+    catch {
+        return 'unknown';
+    }
+    let state = 'absent';
+    for (const name of names) {
+        if (prefix + echoedKeyName(name) !== echo)
+            continue;
+        const s = sentValue(bag, name).state;
+        if (s === 'sent')
+            return 'sent';
+        if (s === 'unknown')
+            state = 'unknown';
+    }
+    return state;
+}
+function settingsLayerMatch(body, echo) {
+    const s = sentValue(body, 'settings');
+    if (s.state !== 'sent')
+        return s.state;
+    if (!isKeyBag(s.value))
+        return 'absent';
+    let state = echoMatch(s.value, SETTINGS_KEY_PREFIX, echo);
+    if (state === 'sent' || !echo.startsWith(SETTINGS_KEY_PREFIX + SETTINGS_PERMISSIONS_PREFIX))
+        return state;
+    const p = sentValue(s.value, 'permissions');
+    if (p.state === 'unknown')
+        return 'unknown';
+    if (p.state === 'sent' && isKeyBag(p.value)) {
+        const inner = echoMatch(p.value, SETTINGS_KEY_PREFIX + SETTINGS_PERMISSIONS_PREFIX, echo);
+        if (inner !== 'absent')
+            state = inner;
+    }
+    return state;
+}
+export function bodyShapeRefusalTouchesSettings(detail, sentBody) {
+    try {
+        if (typeof detail !== 'object' || detail === null)
+            return undefined;
+        let bothRead = true;
+        const prefixed = [];
+        for (const list of [detail.unknownKeys, detail.unsupportedKeys]) {
+            if (!Array.isArray(list)) {
+                bothRead = false;
+                continue;
+            }
+            for (const k of list) {
+                if (typeof k !== 'string')
+                    continue;
+                if (!k.startsWith(SETTINGS_KEY_PREFIX))
+                    return false;
+                prefixed.push(k);
+            }
+        }
+        if (prefixed.length === 0)
+            return bothRead ? false : undefined;
+        const body = sentBody;
+        if (!isKeyBag(body) || hasCustomJson(body))
+            return undefined;
+        const top = prefixed.map((k) => echoMatch(body, '', k));
+        if (top.includes('sent'))
+            return false;
+        for (let i = 0; i < prefixed.length; i++) {
+            if (top[i] === 'absent' && settingsLayerMatch(body, prefixed[i]) === 'sent')
+                return true;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const HOST_POSTURE_REFUSED = 'request.host_posture_refused';
+const BYPASS_PERMISSIONS = 'bypassPermissions';
+function readProp(o, key) {
+    if (typeof o !== 'object' || o === null)
+        return undefined;
+    try {
+        return o[key];
+    }
+    catch {
+        return undefined;
+    }
+}
+export function hostPostureRefusalFromError(err, sentRequest) {
+    try {
+        if (readProp(err, 'errorCode') !== HOST_POSTURE_REFUSED)
+            return null;
+        const askedWholeEnvironment = readProp(sentRequest, 'inheritEnv') === 'all';
+        const askedOpenWriteFace = readProp(sentRequest, 'permissionMode') === BYPASS_PERMISSIONS ||
+            readProp(readProp(readProp(sentRequest, 'settings'), 'permissions'), 'defaultMode') === BYPASS_PERMISSIONS;
+        return Object.freeze({
+            code: HOST_POSTURE_REFUSED,
+            ...(askedWholeEnvironment ? { askedWholeEnvironment: true } : {}),
+            ...(askedOpenWriteFace ? { askedOpenWriteFace: true } : {}),
+        });
+    }
+    catch {
+        return null;
+    }
+}
+const HOST_POSTURE_NOT_LOCAL = 'This is not a problem with your local settings and not something this client can grant — whoever runs this engine decides it';
+const HOST_POSTURE_WHOLE_ENV = "The engine refused this request before anything ran: this deployment serves more than one user, so a request may not hand the shell this machine's whole environment · " +
+    `${HOST_POSTURE_NOT_LOCAL}; send it again without the whole-environment setting (or with the default), and the shell gets the default environment, with credential-like variables removed`;
+const HOST_POSTURE_WRITE_FACE = 'The engine refused this request before anything ran: this deployment does not let a request lift the write boundary with bypassPermissions · ' +
+    `${HOST_POSTURE_NOT_LOCAL}; send it again with another permission mode`;
+const HOST_POSTURE_BOTH = "The engine refused this request before anything ran: the request asked both for the shell to inherit this machine's whole environment and for bypassPermissions, and this deployment refused at least one of them; the refusal does not say which · " +
+    `${HOST_POSTURE_NOT_LOCAL}; send it again without one or both (the whole-environment setting is honored only on a single-user deployment)`;
+const HOST_POSTURE_UNATTRIBUTED = "The engine refused this request before anything ran: this deployment does not accept a setting in it that only a single-user deployment may use; the engine's own message names it · " +
+    `${HOST_POSTURE_NOT_LOCAL}; send it again without that setting`;
+export function hostPostureRefusalContent(detail) {
+    try {
+        const env = readProp(detail, 'askedWholeEnvironment') === true;
+        const write = readProp(detail, 'askedOpenWriteFace') === true;
+        if (env && write)
+            return HOST_POSTURE_BOTH;
+        if (env)
+            return HOST_POSTURE_WHOLE_ENV;
+        if (write)
+            return HOST_POSTURE_WRITE_FACE;
+        return HOST_POSTURE_UNATTRIBUTED;
+    }
+    catch {
+        return HOST_POSTURE_UNATTRIBUTED;
+    }
+}

package/dist/workflowClient.d.ts

@@ -33,6 +33,10 @@ export type WorkflowResolution = {
     state: WorkflowRunState;
     code: 501 | 404;
     lastError: string | null;
+} | {
+    kind: 'unauthorized';
+    state: WorkflowRunState | null;
+    lastError: string | null;
 };
 export interface LiveWorkflowConfig {
     baseUrl: string;

package/dist/workflowClient.js

@@ -4,6 +4,7 @@ import { engineSessionParamSpread } from './engineSessionParam.js';
 import { makeEngineWireClient } from './engineWireSdk.js';
 import { engineWireDebugEnabled } from './engineWireTarget.js';
 import { hostLog } from './host.js';
+import { isReadCredentialRefusal } from './readCredentialRefusal.js';
 function coerceRunStatus(s) {
     switch (s) {
         case 'completed':
@@ -306,6 +307,7 @@ export function readWorkflowResumeAdmissionIncomplete(run) {
 const NO_RUN_BACKOFF_MS = 3000;
 const DEGRADED_BACKOFF_MS = 3000;
 const UNEXPECTED_ERROR_BACKOFF_MS = 3000;
+const UNAUTHORIZED_BACKOFF_MS = 60_000;
 const STREAM_DROP_BACKOFF_MS = 1000;
 const REFRESH_THROTTLE_MS = 400;
 const MAX_WORKFLOW_ACTIVITY_CALLS = 40;
@@ -744,6 +746,7 @@ export function createLiveWorkflowSource(config) {
     let lastGetAt = 0;
     let first = true;
     let phase = 'loop';
+    let unauthorized = false;
     let activityDisabled = false;
     const listeners = new Set();
     function notify() {
@@ -772,6 +775,7 @@ export function createLiveWorkflowSource(config) {
         if (phase === 'empty')
             phase = 'loop';
         connected = false;
+        unauthorized = isReadCredentialRefusal(err);
         if (err instanceof APIError) {
             code = err.status;
             degraded = err.status === 501 || err.status === 404;
@@ -812,6 +816,7 @@ export function createLiveWorkflowSource(config) {
             runId = run.id;
             connected = true;
             degraded = false;
+            unauthorized = false;
             code = null;
             lastError = null;
             if (engineWireDebugEnabled()) {
@@ -837,12 +842,13 @@ export function createLiveWorkflowSource(config) {
                     code = null;
                     phase = 'empty';
                     connected = false;
+                    unauthorized = false;
                     await abortableSleep(NO_RUN_BACKOFF_MS, abort.signal);
                     continue;
                 }
                 await refresh(id, abort.signal);
-                if (degraded) {
-                    await abortableSleep(DEGRADED_BACKOFF_MS, abort.signal);
+                if (degraded || unauthorized) {
+                    await abortableSleep(unauthorized ? UNAUTHORIZED_BACKOFF_MS : DEGRADED_BACKOFF_MS, abort.signal);
                     continue;
                 }
                 if (!activityDisabled) {
@@ -881,7 +887,7 @@ export function createLiveWorkflowSource(config) {
                                 connected = true;
                             if (Date.now() - lastGetAt >= REFRESH_THROTTLE_MS)
                                 await refresh(id, abort.signal);
-                            if (degraded)
+                            if (degraded || unauthorized)
                                 break;
                             if (beat === 'closed')
                                 break;
@@ -904,7 +910,7 @@ export function createLiveWorkflowSource(config) {
                 if (disposed || abort.signal.aborted)
                     return;
                 noteDegrade(err);
-                await abortableSleep(UNEXPECTED_ERROR_BACKOFF_MS, abort.signal);
+                await abortableSleep(unauthorized ? UNAUTHORIZED_BACKOFF_MS : UNEXPECTED_ERROR_BACKOFF_MS, abort.signal);
             }
         }
     }
@@ -944,6 +950,8 @@ export function createLiveWorkflowSource(config) {
         resolution() {
             if (phase === 'unavailable')
                 return { kind: 'unavailable', lastError };
+            if (unauthorized)
+                return { kind: 'unauthorized', state: current, lastError };
             const hardCode = degraded && (code === 501 || code === 404) ? code : null;
             if (current !== null)
                 return hardCode !== null ? { kind: 'stale', state: current, code: hardCode, lastError } : { kind: 'live', state: current };