@undefineds.co/xpod 0.3.69 → 0.3.71-rc.12

package/config/cloud.json

@@ -184,6 +184,7 @@
       "@id": "urn:undefineds:xpod:PostgresRdfVectorIndex",
       "@type": "PostgresRdfVectorIndex",
       "options_driver": "pg",
+      "options_backend": "component",
       "options_connectionString": {
         "@id": "urn:solid-server:default:variable:sparqlEndpoint",
         "@type": "Variable"
@@ -227,32 +228,6 @@
       },
       "enablePrimary": true
     },
-    {
-      "comment": "VectorStore using PostgreSQL",
-      "@id": "urn:undefineds:xpod:VectorStore",
-      "@type": "PostgresVectorStore",
-      "options_connectionString": {
-        "@id": "urn:solid-server:default:variable:sparqlEndpoint",
-        "@type": "Variable"
-      }
-    },
-    {
-      "comment": "Vector HTTP Handler",
-      "@id": "urn:undefineds:xpod:VectorHttpHandler",
-      "@type": "VectorHttpHandler",
-      "vectorStore": {
-        "@id": "urn:undefineds:xpod:VectorStore"
-      },
-      "credentialsExtractor": {
-        "@id": "urn:solid-server:default:CredentialsExtractor"
-      },
-      "permissionReader": {
-        "@id": "urn:solid-server:default:PermissionReader"
-      },
-      "authorizer": {
-        "@id": "urn:solid-server:default:Authorizer"
-      }
-    },
     {
       "comment": "Terminal Sidecar HTTP Handler - manages PTY sessions for trusted AI agents",
       "@id": "urn:undefineds:xpod:TerminalHttpHandler",
@@ -558,10 +533,10 @@
         "@type": "StatusWaterfallHandler",
         "handlers": [
           {
-            "@id": "urn:undefineds:xpod:SubgraphSparqlHttpHandler"
+            "@id": "urn:undefineds:xpod:InternalPodDataHttpHandler"
           },
           {
-            "@id": "urn:undefineds:xpod:VectorHttpHandler"
+            "@id": "urn:undefineds:xpod:SubgraphSparqlHttpHandler"
           },
           {
             "@id": "urn:undefineds:xpod:TerminalHttpHandler"

package/config/local.json

@@ -299,6 +299,9 @@
       "overrideParameters": {
         "@type": "StatusWaterfallHandler",
         "handlers": [
+          {
+            "@id": "urn:undefineds:xpod:InternalPodDataHttpHandler"
+          },
           {
             "@id": "urn:undefineds:xpod:SubgraphSparqlHttpHandler"
           },

package/config/resolver.json

@@ -34,6 +34,13 @@
             "defaultValue": "false"
           }
         },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:gatewayAdminProxyAuthSecret",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "gatewayAdminProxyAuthSecret"
+          }
+        },
         {
           "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:centerRegistrationEnabled",
           "CombinedShorthandResolver:_resolvers_value": {

package/config/xpod.base.json

@@ -223,6 +223,26 @@
         "value": 0
       }
     },
+    {
+      "comment": "Loopback-only runtime-signed hosted Pod data channel for AI Connection resources.",
+      "@type": "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler",
+      "@id": "urn:undefineds:xpod:InternalPodDataHttpHandler",
+      "@context": {
+        "resourceStore": "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_resourceStore",
+        "patchBodyParser": "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_patchBodyParser",
+        "baseUrl": "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_baseUrl"
+      },
+      "resourceStore": {
+        "@id": "urn:solid-server:default:ResourceStore"
+      },
+      "patchBodyParser": {
+        "@id": "urn:solid-server:default:PatchBodyParser"
+      },
+      "baseUrl": {
+        "@id": "urn:solid-server:default:variable:baseUrl",
+        "@type": "Variable"
+      }
+    },
     {
       "comment": "Tracing handler for request ID and logging. Added to CSS Middleware.",
       "@id": "urn:undefineds:xpod:TracingHandler",

package/dist/agents/ClaudeExecutor.js

@@ -90,7 +90,7 @@ class ClaudeExecutor extends BaseAgentExecutor_1.BaseAgentExecutor {
     requireAiConnection() {
         return (0, safe_env_1.requireAiConnectionRuntimeConfig)({
             baseUrl: this.aiConnection?.baseUrl,
-            apiKey: this.aiConnection?.gatewayKey,
+            apiKey: this.aiConnection?.apiKey,
             model: this.aiConnection?.model,
         }, 'Claude executor');
     }

package/dist/agents/ClaudeExecutor.js.map

@@ -1 +1 @@
-{"version":3,"file":"ClaudeExecutor.js","sourceRoot":"","sources":["../../src/agents/ClaudeExecutor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2XH,oDAEC;AAzXD,2DAAwD;AAWxD,kDAI6B;AAE7B;;GAEG;AACH,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAmB,UAAkB,6BAA6B;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe;IAC5B,MAAM,GAAG,GAAG,wDAAa,gCAAgC,GAAC,CAAC;IAC3D,MAAM,CAAC,GAAI,GAAW,EAAE,KAAK,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAa,cAAe,SAAQ,qCAAiB;IAArD;;QACkB,iBAAY,GAAiB,QAAQ,CAAC;IAwUxD,CAAC;IAtUC;;OAEG;IACI,WAAW;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,GAAG,CAAC;YAClC,GAAG,IAAA,wCAA6B,EAAC,UAAU,CAAC;SAC7C,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,OAAO,IAAA,2CAAgC,EAAC;YACtC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO;YACnC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU;YACrC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK;SAChC,EAAE,iBAAiB,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAEhC,gBAAgB;YAChB,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,WAAW,CAAC;gBACpB,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE;oBACP,GAAG;oBACH,QAAQ,EAAE,CAAC;oBACX,cAAc,EAAE,SAAS;oBACzB,KAAK,EAAE,EAAE,EAAE,SAAS;oBACpB,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC,CAAC;YAEH,gBAAgB;YAChB,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,OAA2B,CAAC;oBAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBACjC,YAAY;wBACZ,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;4BACnH,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACxF,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAExE,IACE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAClC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxB,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;gBACD,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAsB,EAAE,iBAAoC;QAC/E,MAAM,OAAO,GAAY;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,0BAA0B;YACjD,GAAG,EAAE,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7C,sBAAsB,EAAE,IAAI,EAAE,SAAS;YACvC,cAAc,EAAE,KAAK,EAAE,eAAe;YACtC,GAAG,iBAAiB;SACrB,CAAC;QAEF,mBAAmB;QACnB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QAED,OAAO;QACP,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QAED,SAAS;QACT,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,cAA2C,CAAC;QAC9E,CAAC;QAED,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,UAAmC,CAAC;QAClE,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;QAC/C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAsB,EAAE,OAAe;QAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,sCAAsC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAElG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,0BAA0B,CAAC;QAE7D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAE5E,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAEpD,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YAEzB,IAAI,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,EAAE,CAAC;gBACjC,YAAY;gBACZ,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;oBACxB,KAAK,WAAW;wBACd,mBAAmB;wBACnB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;4BAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gCAC1B,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;4BACxB,CAAC;wBACH,CAAC;wBACD,WAAW;wBACX,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;4BAC7B,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;4BAC1D,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;wBACjE,CAAC;wBACD,MAAM;oBAER,KAAK,cAAc;wBACjB,OAAO;wBACP,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;4BACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;4BACrC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gCAChC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gCAC5C,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;4BACzB,CAAC;wBACH,CAAC;6BAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;4BACrD,WAAW;4BACX,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gCAC3B,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;4BAC/D,CAAC;wBACH,CAAC;6BAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;4BACrD,WAAW;4BACX,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;gCACpC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;4BAClE,CAAC;wBACH,CAAC;wBACD,MAAM;oBAER,KAAK,QAAQ;wBACX,OAAO;wBACP,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;4BAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,qBAAqB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC9E,CAAC;wBACD,MAAM;oBAER,KAAK,QAAQ;wBACX,OAAO;wBACP,MAAM,MAAM,GAAG,UAA8B,CAAC;wBAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;4BACjC,mBAAmB;4BACnB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gCACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC;gCACzD,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC;4BACpE,CAAC;4BACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gCAC/B,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;4BAC3B,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,KAAK;4BACL,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC1E,CAAC;wBACD,MAAM;gBACV,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE;wBACL,YAAY;wBACZ,gBAAgB;wBAChB,WAAW,EAAE,YAAY,GAAG,gBAAgB;wBAC5C,UAAU;qBACX;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,QAAuB;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YAEjE,sBAAsB;YACtB,MAAM,iBAAiB,GAAG,YAAY;iBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;gBACvD,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhB,aAAa;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;gBACxC,sCAAsC;gBACtC,YAAY,EACV,cAAc,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnD,CAAC,CAAC,MAAM,CAAC,YAAY;aAC1B,CAAC,CAAC;YAEH,oDAAoD;YACpD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,eAAe,EAAE,OAAO,IAAI,iBAAiB,CAAC;YAE7D,kCAAkC;YAClC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACpD,OAAO,CAAC,YAAY,GAAG,GAAG,OAAO,CAAC,YAAY,gCAAgC,iBAAiB,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAE3C,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YAEzB,IAAI,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACpC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;4BAC1B,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;wBACxB,CAAC;oBACH,CAAC;oBACD,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBAC7B,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;wBAC1D,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;oBACjE,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,UAA8B,CAAC;oBAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1E,CAAC;oBACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;wBACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC;wBACzD,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC;oBACpE,CAAC;oBACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC/B,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE;oBACL,YAAY;oBACZ,gBAAgB;oBAChB,WAAW,EAAE,YAAY,GAAG,gBAAgB;oBAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAzUD,wCAyUC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,OAA6B;IAChE,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * Claude Executor\n *\n * 使用 Claude Agent SDK 执行任务。\n *\n * 支持功能：\n * - 完整的 Agent 能力（代码理解、文件编辑、命令执行等）\n * - 工具调用（MCP）\n * - 权限管理\n * - 流式输出\n *\n * 注意：\n * - Claude Agent SDK 需要 Anthropic-compatible env，但值必须来自\n *   invocation-scoped Xpod AI Connection，不允许直接投递 Pod provider secret。\n * - SDK 会自动处理复杂的交互逻辑\n */\n\ntype Options = any;\ntype SDKResultMessage = any;\nimport { BaseAgentExecutor } from './BaseAgentExecutor';\nimport type {\n  ExecutorType,\n  AuthType,\n  AuthInfo,\n  ExecutorConfig,\n  ExecuteMessage,\n  ChatMessage,\n  ExecuteResult,\n  BaseExecutorOptions,\n} from './types';\nimport {\n  projectAnthropicCompatibleEnv,\n  requireAiConnectionRuntimeConfig,\n  sanitizeRuntimeEnv,\n} from '../runtime/safe-env';\n\n/**\n * Claude 鉴权错误\n */\nexport class ClaudeAuthenticationError extends Error {\n  public constructor(message: string = 'Claude 未配置 AI Connection 认证') {\n    super(message);\n    this.name = 'ClaudeAuthenticationError';\n  }\n}\n\n/**\n * Claude Executor\n *\n * 封装 Claude Agent SDK 调用。\n */\nasync function loadClaudeQuery(): Promise<(args: { prompt: string; options: Options }) => AsyncIterable<any>> {\n  const mod = await import('@anthropic-ai/claude-agent-sdk');\n  const q = (mod as any)?.query;\n  if (typeof q !== 'function') {\n    throw new Error('Claude SDK is installed but query API is unavailable');\n  }\n  return q;\n}\n\nexport class ClaudeExecutor extends BaseAgentExecutor {\n  public readonly executorType: ExecutorType = 'claude';\n\n  /**\n   * 获取认证类型\n   */\n  public getAuthType(): AuthType {\n    return 'api-key';\n  }\n\n  /**\n   * 获取环境变量配置\n   */\n  private getEnvConfig(): Record<string, string | undefined> {\n    const connection = this.requireAiConnection();\n    return {\n      ...sanitizeRuntimeEnv(process.env),\n      ...projectAnthropicCompatibleEnv(connection),\n    };\n  }\n\n  private requireAiConnection() {\n    return requireAiConnectionRuntimeConfig({\n      baseUrl: this.aiConnection?.baseUrl,\n      apiKey: this.aiConnection?.gatewayKey,\n      model: this.aiConnection?.model,\n    }, 'Claude executor');\n  }\n\n  /**\n   * 检查认证状态\n   */\n  public async checkAuthentication(): Promise<AuthInfo> {\n    try {\n      const env = this.getEnvConfig();\n\n      // 发送一个简单查询来验证认证\n      const claudeQuery = await loadClaudeQuery();\n      const q = claudeQuery({\n        prompt: 'hi',\n        options: {\n          env,\n          maxTurns: 1,\n          permissionMode: 'dontAsk',\n          tools: [], // 禁用所有工具\n          persistSession: false,\n        },\n      });\n\n      // 收集消息检查是否有认证错误\n      for await (const message of q) {\n        if (message.type === 'result') {\n          const result = message as SDKResultMessage;\n          if (result.subtype !== 'success') {\n            // 检查是否是认证错误\n            if (result.errors?.some((e: string) => e.includes('authentication') || e.includes('api_key') || e.includes('401'))) {\n              throw new ClaudeAuthenticationError(`Claude API Key 无效: ${result.errors.join(', ')}`);\n            }\n          }\n        }\n      }\n\n      return {\n        authenticated: true,\n        authType: 'api-key',\n        providerId: this.providerId,\n        executorType: this.executorType,\n      };\n    } catch (error) {\n      if (error instanceof ClaudeAuthenticationError) {\n        throw error;\n      }\n\n      const errorMsg = error instanceof Error ? error.message : String(error);\n\n      if (\n        errorMsg.includes('authentication') ||\n        errorMsg.includes('api_key') ||\n        errorMsg.includes('AI Connection') ||\n        errorMsg.includes('invalid') ||\n        errorMsg.includes('401') ||\n        errorMsg.includes('unauthorized')\n      ) {\n        throw new ClaudeAuthenticationError(`Claude AI Connection 无效: ${errorMsg}`);\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * 构建 SDK Options\n   */\n  private buildOptions(config: ExecutorConfig, additionalOptions?: Partial<Options>): Options {\n    const options: Options = {\n      env: this.getEnvConfig(),\n      model: config.model ?? 'claude-sonnet-4-20250514',\n      cwd: config.workingDirectory ?? process.cwd(),\n      includePartialMessages: true, // 启用流式输出\n      persistSession: false, // 不持久化 session\n      ...additionalOptions,\n    };\n\n    // 设置 system prompt\n    if (config.systemPrompt) {\n      options.systemPrompt = config.systemPrompt;\n    }\n\n    // 设置工具\n    if (config.tools && config.tools.length > 0) {\n      options.tools = config.tools;\n    }\n\n    // 设置允许的工具\n    if (config.allowedTools && config.allowedTools.length > 0) {\n      options.allowedTools = config.allowedTools;\n    }\n\n    // 设置权限模式\n    if (config.permissionMode) {\n      options.permissionMode = config.permissionMode as Options['permissionMode'];\n    }\n\n    // 设置 MCP 服务器\n    if (config.mcpServers) {\n      options.mcpServers = config.mcpServers as Options['mcpServers'];\n    }\n\n    // 设置 max tokens (通过 maxThinkingTokens)\n    if (config.maxTokens) {\n      options.maxThinkingTokens = config.maxTokens;\n    }\n\n    return options;\n  }\n\n  /**\n   * 执行任务（流式）\n   */\n  public async *execute(config: ExecutorConfig, message: string): AsyncGenerator<ExecuteMessage> {\n    this.logger.info(`[${config.name}] Executing with Claude Agent SDK: ${message.slice(0, 100)}...`);\n\n    const startTime = Date.now();\n    const modelName = config.model ?? 'claude-sonnet-4-20250514';\n\n    try {\n      yield { type: 'system', executorType: this.executorType, model: modelName };\n\n      const options = this.buildOptions(config);\n      const claudeQuery = await loadClaudeQuery();\n      const q = claudeQuery({ prompt: message, options });\n\n      let fullText = '';\n      let promptTokens = 0;\n      let completionTokens = 0;\n\n      for await (const sdkMessage of q) {\n        // 处理不同类型的消息\n        switch (sdkMessage.type) {\n          case 'assistant':\n            // 完整的 assistant 消息\n            for (const block of sdkMessage.message.content) {\n              if (block.type === 'text') {\n                fullText = block.text;\n              }\n            }\n            // 更新 usage\n            if (sdkMessage.message.usage) {\n              promptTokens = sdkMessage.message.usage.input_tokens ?? 0;\n              completionTokens = sdkMessage.message.usage.output_tokens ?? 0;\n            }\n            break;\n\n          case 'stream_event':\n            // 流式事件\n            if (sdkMessage.event.type === 'content_block_delta') {\n              const delta = sdkMessage.event.delta;\n              if (delta.type === 'text_delta') {\n                yield { type: 'text', content: delta.text };\n                fullText += delta.text;\n              }\n            } else if (sdkMessage.event.type === 'message_delta') {\n              // 更新 usage\n              if (sdkMessage.event.usage) {\n                completionTokens = sdkMessage.event.usage.output_tokens ?? 0;\n              }\n            } else if (sdkMessage.event.type === 'message_start') {\n              // 初始 usage\n              if (sdkMessage.event.message?.usage) {\n                promptTokens = sdkMessage.event.message.usage.input_tokens ?? 0;\n              }\n            }\n            break;\n\n          case 'system':\n            // 系统消息\n            if ('subtype' in sdkMessage) {\n              this.logger.debug(`[${config.name}] System message: ${sdkMessage.subtype}`);\n            }\n            break;\n\n          case 'result':\n            // 最终结果\n            const result = sdkMessage as SDKResultMessage;\n            if (result.subtype === 'success') {\n              // 使用 result 中的信息更新\n              if (result.usage) {\n                promptTokens = result.usage.input_tokens ?? promptTokens;\n                completionTokens = result.usage.output_tokens ?? completionTokens;\n              }\n              if (result.result && !fullText) {\n                fullText = result.result;\n              }\n            } else {\n              // 错误\n              throw new Error(result.errors?.join(', ') ?? `执行失败: ${result.subtype}`);\n            }\n            break;\n        }\n      }\n\n      const durationMs = Date.now() - startTime;\n\n      yield {\n        type: 'done',\n        result: {\n          success: true,\n          result: fullText,\n          usage: {\n            promptTokens,\n            completionTokens,\n            totalTokens: promptTokens + completionTokens,\n            durationMs,\n          },\n        },\n      };\n    } catch (error) {\n      yield* this.yieldError(error, startTime);\n    }\n  }\n\n  /**\n   * 多轮对话\n   *\n   * 注意：Claude Agent SDK 主要设计用于单次查询模式，\n   * 多轮对话需要通过 session API（V2，目前不稳定）或\n   * 在 prompt 中包含历史消息。\n   */\n  public async chat(config: ExecutorConfig, messages: ChatMessage[]): Promise<ExecuteResult> {\n    const startTime = Date.now();\n\n    try {\n      // 分离 system 消息和对话消息\n      const systemMessages = messages.filter((m) => m.role === 'system');\n      const chatMessages = messages.filter((m) => m.role !== 'system');\n\n      // 构建完整的 prompt，包含历史消息\n      const formattedMessages = chatMessages\n        .map((m) => {\n          const role = m.role === 'user' ? 'Human' : 'Assistant';\n          return `${role}: ${m.content}`;\n        })\n        .join('\\n\\n');\n\n      // 构建 options\n      const options = this.buildOptions(config, {\n        // 如果有 system 消息，使用第一个作为 system prompt\n        systemPrompt:\n          systemMessages.length > 0\n            ? systemMessages.map((m) => m.content).join('\\n\\n')\n            : config.systemPrompt,\n      });\n\n      // 使用最后一条用户消息作为 prompt（如果有历史则在 system prompt 中添加上下文）\n      const lastUserMessage = chatMessages.filter((m) => m.role === 'user').pop();\n      const prompt = lastUserMessage?.content ?? formattedMessages;\n\n      // 如果有多条消息，在 system prompt 中添加对话历史\n      if (chatMessages.length > 1 && options.systemPrompt) {\n        options.systemPrompt = `${options.systemPrompt}\\n\\n## Conversation History\\n${formattedMessages}`;\n      }\n\n      const claudeQuery = await loadClaudeQuery();\n      const q = claudeQuery({ prompt, options });\n\n      let fullText = '';\n      let promptTokens = 0;\n      let completionTokens = 0;\n\n      for await (const sdkMessage of q) {\n        if (sdkMessage.type === 'assistant') {\n          for (const block of sdkMessage.message.content) {\n            if (block.type === 'text') {\n              fullText = block.text;\n            }\n          }\n          if (sdkMessage.message.usage) {\n            promptTokens = sdkMessage.message.usage.input_tokens ?? 0;\n            completionTokens = sdkMessage.message.usage.output_tokens ?? 0;\n          }\n        } else if (sdkMessage.type === 'result') {\n          const result = sdkMessage as SDKResultMessage;\n          if (result.subtype !== 'success') {\n            throw new Error(result.errors?.join(', ') ?? `执行失败: ${result.subtype}`);\n          }\n          if (result.usage) {\n            promptTokens = result.usage.input_tokens ?? promptTokens;\n            completionTokens = result.usage.output_tokens ?? completionTokens;\n          }\n          if (result.result && !fullText) {\n            fullText = result.result;\n          }\n        }\n      }\n\n      return {\n        success: true,\n        result: fullText,\n        usage: {\n          promptTokens,\n          completionTokens,\n          totalTokens: promptTokens + completionTokens,\n          durationMs: Date.now() - startTime,\n        },\n      };\n    } catch (error) {\n      return this.wrapError(error, startTime);\n    }\n  }\n}\n\n/**\n * 创建 Claude executor 实例\n */\nexport function createClaudeExecutor(options?: BaseExecutorOptions): ClaudeExecutor {\n  return new ClaudeExecutor(options);\n}\n"]}
+{"version":3,"file":"ClaudeExecutor.js","sourceRoot":"","sources":["../../src/agents/ClaudeExecutor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2XH,oDAEC;AAzXD,2DAAwD;AAWxD,kDAI6B;AAE7B;;GAEG;AACH,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAmB,UAAkB,6BAA6B;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe;IAC5B,MAAM,GAAG,GAAG,wDAAa,gCAAgC,GAAC,CAAC;IAC3D,MAAM,CAAC,GAAI,GAAW,EAAE,KAAK,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAa,cAAe,SAAQ,qCAAiB;IAArD;;QACkB,iBAAY,GAAiB,QAAQ,CAAC;IAwUxD,CAAC;IAtUC;;OAEG;IACI,WAAW;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,GAAG,CAAC;YAClC,GAAG,IAAA,wCAA6B,EAAC,UAAU,CAAC;SAC7C,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,OAAO,IAAA,2CAAgC,EAAC;YACtC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO;YACnC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM;YACjC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK;SAChC,EAAE,iBAAiB,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAEhC,gBAAgB;YAChB,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,WAAW,CAAC;gBACpB,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE;oBACP,GAAG;oBACH,QAAQ,EAAE,CAAC;oBACX,cAAc,EAAE,SAAS;oBACzB,KAAK,EAAE,EAAE,EAAE,SAAS;oBACpB,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC,CAAC;YAEH,gBAAgB;YAChB,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,OAA2B,CAAC;oBAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBACjC,YAAY;wBACZ,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;4BACnH,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACxF,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAExE,IACE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAClC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxB,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;gBACD,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAsB,EAAE,iBAAoC;QAC/E,MAAM,OAAO,GAAY;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,0BAA0B;YACjD,GAAG,EAAE,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7C,sBAAsB,EAAE,IAAI,EAAE,SAAS;YACvC,cAAc,EAAE,KAAK,EAAE,eAAe;YACtC,GAAG,iBAAiB;SACrB,CAAC;QAEF,mBAAmB;QACnB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QAED,OAAO;QACP,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QAED,SAAS;QACT,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,cAA2C,CAAC;QAC9E,CAAC;QAED,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,UAAmC,CAAC;QAClE,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;QAC/C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAsB,EAAE,OAAe;QAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,sCAAsC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAElG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,0BAA0B,CAAC;QAE7D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAE5E,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAEpD,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YAEzB,IAAI,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,EAAE,CAAC;gBACjC,YAAY;gBACZ,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;oBACxB,KAAK,WAAW;wBACd,mBAAmB;wBACnB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;4BAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gCAC1B,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;4BACxB,CAAC;wBACH,CAAC;wBACD,WAAW;wBACX,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;4BAC7B,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;4BAC1D,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;wBACjE,CAAC;wBACD,MAAM;oBAER,KAAK,cAAc;wBACjB,OAAO;wBACP,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;4BACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;4BACrC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gCAChC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gCAC5C,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;4BACzB,CAAC;wBACH,CAAC;6BAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;4BACrD,WAAW;4BACX,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gCAC3B,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;4BAC/D,CAAC;wBACH,CAAC;6BAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;4BACrD,WAAW;4BACX,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;gCACpC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;4BAClE,CAAC;wBACH,CAAC;wBACD,MAAM;oBAER,KAAK,QAAQ;wBACX,OAAO;wBACP,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;4BAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,qBAAqB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC9E,CAAC;wBACD,MAAM;oBAER,KAAK,QAAQ;wBACX,OAAO;wBACP,MAAM,MAAM,GAAG,UAA8B,CAAC;wBAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;4BACjC,mBAAmB;4BACnB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gCACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC;gCACzD,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC;4BACpE,CAAC;4BACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gCAC/B,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;4BAC3B,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,KAAK;4BACL,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC1E,CAAC;wBACD,MAAM;gBACV,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE;wBACL,YAAY;wBACZ,gBAAgB;wBAChB,WAAW,EAAE,YAAY,GAAG,gBAAgB;wBAC5C,UAAU;qBACX;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,QAAuB;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YAEjE,sBAAsB;YACtB,MAAM,iBAAiB,GAAG,YAAY;iBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;gBACvD,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhB,aAAa;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;gBACxC,sCAAsC;gBACtC,YAAY,EACV,cAAc,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnD,CAAC,CAAC,MAAM,CAAC,YAAY;aAC1B,CAAC,CAAC;YAEH,oDAAoD;YACpD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,eAAe,EAAE,OAAO,IAAI,iBAAiB,CAAC;YAE7D,kCAAkC;YAClC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACpD,OAAO,CAAC,YAAY,GAAG,GAAG,OAAO,CAAC,YAAY,gCAAgC,iBAAiB,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAE3C,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YAEzB,IAAI,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACpC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;4BAC1B,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;wBACxB,CAAC;oBACH,CAAC;oBACD,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBAC7B,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;wBAC1D,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;oBACjE,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,UAA8B,CAAC;oBAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1E,CAAC;oBACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;wBACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC;wBACzD,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC;oBACpE,CAAC;oBACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC/B,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE;oBACL,YAAY;oBACZ,gBAAgB;oBAChB,WAAW,EAAE,YAAY,GAAG,gBAAgB;oBAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAzUD,wCAyUC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,OAA6B;IAChE,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * Claude Executor\n *\n * 使用 Claude Agent SDK 执行任务。\n *\n * 支持功能：\n * - 完整的 Agent 能力（代码理解、文件编辑、命令执行等）\n * - 工具调用（MCP）\n * - 权限管理\n * - 流式输出\n *\n * 注意：\n * - Claude Agent SDK 需要 Anthropic-compatible env，但值必须来自\n *   invocation-scoped Xpod AI Connection，不允许直接投递 Pod provider secret。\n * - SDK 会自动处理复杂的交互逻辑\n */\n\ntype Options = any;\ntype SDKResultMessage = any;\nimport { BaseAgentExecutor } from './BaseAgentExecutor';\nimport type {\n  ExecutorType,\n  AuthType,\n  AuthInfo,\n  ExecutorConfig,\n  ExecuteMessage,\n  ChatMessage,\n  ExecuteResult,\n  BaseExecutorOptions,\n} from './types';\nimport {\n  projectAnthropicCompatibleEnv,\n  requireAiConnectionRuntimeConfig,\n  sanitizeRuntimeEnv,\n} from '../runtime/safe-env';\n\n/**\n * Claude 鉴权错误\n */\nexport class ClaudeAuthenticationError extends Error {\n  public constructor(message: string = 'Claude 未配置 AI Connection 认证') {\n    super(message);\n    this.name = 'ClaudeAuthenticationError';\n  }\n}\n\n/**\n * Claude Executor\n *\n * 封装 Claude Agent SDK 调用。\n */\nasync function loadClaudeQuery(): Promise<(args: { prompt: string; options: Options }) => AsyncIterable<any>> {\n  const mod = await import('@anthropic-ai/claude-agent-sdk');\n  const q = (mod as any)?.query;\n  if (typeof q !== 'function') {\n    throw new Error('Claude SDK is installed but query API is unavailable');\n  }\n  return q;\n}\n\nexport class ClaudeExecutor extends BaseAgentExecutor {\n  public readonly executorType: ExecutorType = 'claude';\n\n  /**\n   * 获取认证类型\n   */\n  public getAuthType(): AuthType {\n    return 'api-key';\n  }\n\n  /**\n   * 获取环境变量配置\n   */\n  private getEnvConfig(): Record<string, string | undefined> {\n    const connection = this.requireAiConnection();\n    return {\n      ...sanitizeRuntimeEnv(process.env),\n      ...projectAnthropicCompatibleEnv(connection),\n    };\n  }\n\n  private requireAiConnection() {\n    return requireAiConnectionRuntimeConfig({\n      baseUrl: this.aiConnection?.baseUrl,\n      apiKey: this.aiConnection?.apiKey,\n      model: this.aiConnection?.model,\n    }, 'Claude executor');\n  }\n\n  /**\n   * 检查认证状态\n   */\n  public async checkAuthentication(): Promise<AuthInfo> {\n    try {\n      const env = this.getEnvConfig();\n\n      // 发送一个简单查询来验证认证\n      const claudeQuery = await loadClaudeQuery();\n      const q = claudeQuery({\n        prompt: 'hi',\n        options: {\n          env,\n          maxTurns: 1,\n          permissionMode: 'dontAsk',\n          tools: [], // 禁用所有工具\n          persistSession: false,\n        },\n      });\n\n      // 收集消息检查是否有认证错误\n      for await (const message of q) {\n        if (message.type === 'result') {\n          const result = message as SDKResultMessage;\n          if (result.subtype !== 'success') {\n            // 检查是否是认证错误\n            if (result.errors?.some((e: string) => e.includes('authentication') || e.includes('api_key') || e.includes('401'))) {\n              throw new ClaudeAuthenticationError(`Claude API Key 无效: ${result.errors.join(', ')}`);\n            }\n          }\n        }\n      }\n\n      return {\n        authenticated: true,\n        authType: 'api-key',\n        providerId: this.providerId,\n        executorType: this.executorType,\n      };\n    } catch (error) {\n      if (error instanceof ClaudeAuthenticationError) {\n        throw error;\n      }\n\n      const errorMsg = error instanceof Error ? error.message : String(error);\n\n      if (\n        errorMsg.includes('authentication') ||\n        errorMsg.includes('api_key') ||\n        errorMsg.includes('AI Connection') ||\n        errorMsg.includes('invalid') ||\n        errorMsg.includes('401') ||\n        errorMsg.includes('unauthorized')\n      ) {\n        throw new ClaudeAuthenticationError(`Claude AI Connection 无效: ${errorMsg}`);\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * 构建 SDK Options\n   */\n  private buildOptions(config: ExecutorConfig, additionalOptions?: Partial<Options>): Options {\n    const options: Options = {\n      env: this.getEnvConfig(),\n      model: config.model ?? 'claude-sonnet-4-20250514',\n      cwd: config.workingDirectory ?? process.cwd(),\n      includePartialMessages: true, // 启用流式输出\n      persistSession: false, // 不持久化 session\n      ...additionalOptions,\n    };\n\n    // 设置 system prompt\n    if (config.systemPrompt) {\n      options.systemPrompt = config.systemPrompt;\n    }\n\n    // 设置工具\n    if (config.tools && config.tools.length > 0) {\n      options.tools = config.tools;\n    }\n\n    // 设置允许的工具\n    if (config.allowedTools && config.allowedTools.length > 0) {\n      options.allowedTools = config.allowedTools;\n    }\n\n    // 设置权限模式\n    if (config.permissionMode) {\n      options.permissionMode = config.permissionMode as Options['permissionMode'];\n    }\n\n    // 设置 MCP 服务器\n    if (config.mcpServers) {\n      options.mcpServers = config.mcpServers as Options['mcpServers'];\n    }\n\n    // 设置 max tokens (通过 maxThinkingTokens)\n    if (config.maxTokens) {\n      options.maxThinkingTokens = config.maxTokens;\n    }\n\n    return options;\n  }\n\n  /**\n   * 执行任务（流式）\n   */\n  public async *execute(config: ExecutorConfig, message: string): AsyncGenerator<ExecuteMessage> {\n    this.logger.info(`[${config.name}] Executing with Claude Agent SDK: ${message.slice(0, 100)}...`);\n\n    const startTime = Date.now();\n    const modelName = config.model ?? 'claude-sonnet-4-20250514';\n\n    try {\n      yield { type: 'system', executorType: this.executorType, model: modelName };\n\n      const options = this.buildOptions(config);\n      const claudeQuery = await loadClaudeQuery();\n      const q = claudeQuery({ prompt: message, options });\n\n      let fullText = '';\n      let promptTokens = 0;\n      let completionTokens = 0;\n\n      for await (const sdkMessage of q) {\n        // 处理不同类型的消息\n        switch (sdkMessage.type) {\n          case 'assistant':\n            // 完整的 assistant 消息\n            for (const block of sdkMessage.message.content) {\n              if (block.type === 'text') {\n                fullText = block.text;\n              }\n            }\n            // 更新 usage\n            if (sdkMessage.message.usage) {\n              promptTokens = sdkMessage.message.usage.input_tokens ?? 0;\n              completionTokens = sdkMessage.message.usage.output_tokens ?? 0;\n            }\n            break;\n\n          case 'stream_event':\n            // 流式事件\n            if (sdkMessage.event.type === 'content_block_delta') {\n              const delta = sdkMessage.event.delta;\n              if (delta.type === 'text_delta') {\n                yield { type: 'text', content: delta.text };\n                fullText += delta.text;\n              }\n            } else if (sdkMessage.event.type === 'message_delta') {\n              // 更新 usage\n              if (sdkMessage.event.usage) {\n                completionTokens = sdkMessage.event.usage.output_tokens ?? 0;\n              }\n            } else if (sdkMessage.event.type === 'message_start') {\n              // 初始 usage\n              if (sdkMessage.event.message?.usage) {\n                promptTokens = sdkMessage.event.message.usage.input_tokens ?? 0;\n              }\n            }\n            break;\n\n          case 'system':\n            // 系统消息\n            if ('subtype' in sdkMessage) {\n              this.logger.debug(`[${config.name}] System message: ${sdkMessage.subtype}`);\n            }\n            break;\n\n          case 'result':\n            // 最终结果\n            const result = sdkMessage as SDKResultMessage;\n            if (result.subtype === 'success') {\n              // 使用 result 中的信息更新\n              if (result.usage) {\n                promptTokens = result.usage.input_tokens ?? promptTokens;\n                completionTokens = result.usage.output_tokens ?? completionTokens;\n              }\n              if (result.result && !fullText) {\n                fullText = result.result;\n              }\n            } else {\n              // 错误\n              throw new Error(result.errors?.join(', ') ?? `执行失败: ${result.subtype}`);\n            }\n            break;\n        }\n      }\n\n      const durationMs = Date.now() - startTime;\n\n      yield {\n        type: 'done',\n        result: {\n          success: true,\n          result: fullText,\n          usage: {\n            promptTokens,\n            completionTokens,\n            totalTokens: promptTokens + completionTokens,\n            durationMs,\n          },\n        },\n      };\n    } catch (error) {\n      yield* this.yieldError(error, startTime);\n    }\n  }\n\n  /**\n   * 多轮对话\n   *\n   * 注意：Claude Agent SDK 主要设计用于单次查询模式，\n   * 多轮对话需要通过 session API（V2，目前不稳定）或\n   * 在 prompt 中包含历史消息。\n   */\n  public async chat(config: ExecutorConfig, messages: ChatMessage[]): Promise<ExecuteResult> {\n    const startTime = Date.now();\n\n    try {\n      // 分离 system 消息和对话消息\n      const systemMessages = messages.filter((m) => m.role === 'system');\n      const chatMessages = messages.filter((m) => m.role !== 'system');\n\n      // 构建完整的 prompt，包含历史消息\n      const formattedMessages = chatMessages\n        .map((m) => {\n          const role = m.role === 'user' ? 'Human' : 'Assistant';\n          return `${role}: ${m.content}`;\n        })\n        .join('\\n\\n');\n\n      // 构建 options\n      const options = this.buildOptions(config, {\n        // 如果有 system 消息，使用第一个作为 system prompt\n        systemPrompt:\n          systemMessages.length > 0\n            ? systemMessages.map((m) => m.content).join('\\n\\n')\n            : config.systemPrompt,\n      });\n\n      // 使用最后一条用户消息作为 prompt（如果有历史则在 system prompt 中添加上下文）\n      const lastUserMessage = chatMessages.filter((m) => m.role === 'user').pop();\n      const prompt = lastUserMessage?.content ?? formattedMessages;\n\n      // 如果有多条消息，在 system prompt 中添加对话历史\n      if (chatMessages.length > 1 && options.systemPrompt) {\n        options.systemPrompt = `${options.systemPrompt}\\n\\n## Conversation History\\n${formattedMessages}`;\n      }\n\n      const claudeQuery = await loadClaudeQuery();\n      const q = claudeQuery({ prompt, options });\n\n      let fullText = '';\n      let promptTokens = 0;\n      let completionTokens = 0;\n\n      for await (const sdkMessage of q) {\n        if (sdkMessage.type === 'assistant') {\n          for (const block of sdkMessage.message.content) {\n            if (block.type === 'text') {\n              fullText = block.text;\n            }\n          }\n          if (sdkMessage.message.usage) {\n            promptTokens = sdkMessage.message.usage.input_tokens ?? 0;\n            completionTokens = sdkMessage.message.usage.output_tokens ?? 0;\n          }\n        } else if (sdkMessage.type === 'result') {\n          const result = sdkMessage as SDKResultMessage;\n          if (result.subtype !== 'success') {\n            throw new Error(result.errors?.join(', ') ?? `执行失败: ${result.subtype}`);\n          }\n          if (result.usage) {\n            promptTokens = result.usage.input_tokens ?? promptTokens;\n            completionTokens = result.usage.output_tokens ?? completionTokens;\n          }\n          if (result.result && !fullText) {\n            fullText = result.result;\n          }\n        }\n      }\n\n      return {\n        success: true,\n        result: fullText,\n        usage: {\n          promptTokens,\n          completionTokens,\n          totalTokens: promptTokens + completionTokens,\n          durationMs: Date.now() - startTime,\n        },\n      };\n    } catch (error) {\n      return this.wrapError(error, startTime);\n    }\n  }\n}\n\n/**\n * 创建 Claude executor 实例\n */\nexport function createClaudeExecutor(options?: BaseExecutorOptions): ClaudeExecutor {\n  return new ClaudeExecutor(options);\n}\n"]}

package/dist/agents/types.d.ts

@@ -60,15 +60,15 @@ export interface AiCredential {
 /**
  * Invocation-scoped AI Connection configuration.
  *
- * Gateway key is an Xpod-issued runtime key for the current invocation. It is
- * not the user's raw Pod provider secret.
+ * API key is the Solid client-credentials wrapper (`sk-*`) projected into the
+ * current invocation. It is not the user's raw Pod provider secret.
  */
 export interface AIConnectionInvocationConfig {
     /** Xpod AI Connection endpoint, usually the local /v1 gateway URL */
     baseUrl: string;
-    /** Xpod-issued gateway key for this invocation */
-    gatewayKey: string;
-    /** ISO timestamp after which the invocation token must be refreshed */
+    /** OpenAI-compatible API key for this invocation */
+    apiKey: string;
+    /** ISO timestamp after which the delegated credential must be refreshed */
     expiresAt?: string;
     /** Optional model routed through the gateway */
     model?: string;

package/dist/agents/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agents/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG","sourcesContent":["/**\n * Agent Executor 类型定义\n *\n * 统一的 AI Agent 执行框架接口。\n * 供应商配置从 Pod 读取，不在代码中硬编码。\n */\n\n/**\n * 通用 MCP Server 配置类型\n *\n * 这是一个宽松的类型定义，各个 Executor 会在内部转换为对应 SDK 的具体类型。\n * 支持的配置类型：\n * - stdio: { command: string, args?: string[], env?: Record<string, string> }\n * - sse: { type: 'sse', url: string, headers?: Record<string, string> }\n * - http: { type: 'http', url: string, headers?: Record<string, string> }\n * - sdk: { type: 'sdk', name: string, instance?: McpServer }\n */\nexport type McpServerConfig = {\n  type?: 'stdio' | 'sse' | 'http' | 'sdk';\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  name?: string;\n  [key: string]: unknown;\n};\n\n/**\n * 执行器类型（SDK 类型）\n *\n * 只支持有完整 Agent SDK 的供应商：\n * - codebuddy: @tencent-ai/agent-sdk\n * - claude: @anthropic-ai/claude-agent-sdk\n *\n * 不支持的原因：\n * - OpenAI: 没有完整的 Agent SDK，Codex CLI 通过 ACP runner 接入，不走这里\n * - Gemini: 没有完整的 Agent SDK，CLI core 使用 MCP 不使用 ACP\n */\nexport type ExecutorType = 'codebuddy' | 'claude';\n\n/**\n * 认证类型\n */\nexport type AuthType = 'api-key' | 'oidc';\n\n/**\n * AI 凭证（从 Pod 读取）\n */\nexport interface AiCredential {\n  /** 提供商 ID（对应 Pod 中的 provider URI fragment） */\n  providerId: string;\n  /** API Key */\n  apiKey: string;\n  /** 自定义 API 端点 */\n  baseUrl?: string;\n  /** 代理 URL */\n  proxyUrl?: string;\n  /** 项目 ID (Gemini Vertex AI) */\n  projectId?: string;\n  /** 组织 ID (OpenAI) */\n  organizationId?: string;\n}\n\n/**\n * Invocation-scoped AI Connection configuration.\n *\n * Gateway key is an Xpod-issued runtime key for the current invocation. It is\n * not the user's raw Pod provider secret.\n */\nexport interface AIConnectionInvocationConfig {\n  /** Xpod AI Connection endpoint, usually the local /v1 gateway URL */\n  baseUrl: string;\n  /** Xpod-issued gateway key for this invocation */\n  gatewayKey: string;\n  /** ISO timestamp after which the invocation token must be refreshed */\n  expiresAt?: string;\n  /** Optional model routed through the gateway */\n  model?: string;\n}\n\n/**\n * 供应商配置（Pod Provider + Agent runtime 的组合视图）\n */\nexport interface ProviderConfig {\n  /** 供应商 ID */\n  id: string;\n  /** 显示名称 */\n  displayName: string;\n  /** 运行时类型（来自 Agent .meta runtimeKind，不存储在 Provider 实体） */\n  executorType: ExecutorType;\n  /** API 端点 */\n  baseUrl?: string;\n  /** 默认模型 ID */\n  defaultModel?: string;\n  /** 是否启用 */\n  enabled: boolean;\n}\n\n/**\n * 认证信息\n */\nexport interface AuthInfo {\n  /** 是否已认证 */\n  authenticated: boolean;\n  /** 认证类型 */\n  authType: AuthType;\n  /** 供应商 ID */\n  providerId: string;\n  /** 执行器类型 */\n  executorType: ExecutorType;\n  /** 过期时间 */\n  expiresAt?: Date;\n  /** 账户信息 */\n  account?: {\n    email?: string;\n    name?: string;\n  };\n}\n\n/**\n * 执行器配置（基础）\n */\nexport interface ExecutorConfig {\n  /** Agent 名称 */\n  name: string;\n  /** Agent 描述 */\n  description?: string;\n  /** System prompt */\n  systemPrompt: string;\n  /** 模型名称 */\n  model?: string;\n  /** 最大输出 tokens */\n  maxTokens?: number;\n  /** 温度参数 (0-2) */\n  temperature?: number;\n  /** Top-P 参数 */\n  topP?: number;\n  /** 工作目录 */\n  workingDirectory?: string;\n  /** 可用工具列表 */\n  tools?: string[];\n  /** 允许的工具列表（自动允许，不需要权限确认） */\n  allowedTools?: string[];\n  /** 禁用的工具列表 */\n  disallowedTools?: string[];\n  /** MCP 服务器配置 */\n  mcpServers?: Record<string, McpServerConfig>;\n  /** 最大轮数 */\n  maxTurns?: number;\n  /** 权限模式 */\n  permissionMode?: 'default' | 'acceptEdits' | 'bypassPermissions' | 'plan' | 'dontAsk';\n}\n\n/**\n * CodeBuddy 扩展配置\n */\nexport interface CodeBuddyConfig extends ExecutorConfig {\n  /** 工作目录（限制文件操作范围） */\n  cwd?: string;\n  /** 允许的工具列表 */\n  allowedTools?: string[];\n  /** 禁用的工具列表 */\n  disallowedTools?: string[];\n  /** MCP 服务器配置 */\n  mcpServers?: Record<string, McpServerConfig>;\n  /** 最大轮数 */\n  maxTurns?: number;\n  /** 权限模式 */\n  permissionMode?: 'default' | 'acceptEdits' | 'bypassPermissions';\n}\n\n/**\n * CodeBuddy 执行选项\n */\nexport interface CodeBuddyOptions {\n  /** Pod base URL */\n  podBaseUrl?: string;\n  /** OAuth access token（用于 MCP 访问 Pod） */\n  accessToken?: string;\n  /** 超时时间（毫秒） */\n  timeout?: number;\n  /** 额外上下文 */\n  context?: Record<string, unknown>;\n}\n\n/**\n * 执行结果（基础）\n */\nexport interface ExecuteResult {\n  /** 是否成功 */\n  success: boolean;\n  /** 结果文本 */\n  result?: string;\n  /** 错误信息 */\n  error?: string;\n  /** 结构化输出（CodeBuddy 专用） */\n  structuredOutput?: unknown;\n  /** 使用统计 */\n  usage?: {\n    promptTokens: number;\n    completionTokens: number;\n    totalTokens: number;\n    durationMs: number;\n  };\n}\n\n/**\n * 执行消息类型\n */\nexport type ExecuteMessage =\n  | { type: 'system'; executorType: ExecutorType; model: string; tools?: string[] }\n  | { type: 'text'; content: string }\n  | { type: 'tool_call'; toolName: string; toolInput: unknown }\n  | { type: 'tool_result'; toolName: string; result: string }\n  | { type: 'error'; error: string }\n  | { type: 'done'; result: ExecuteResult };\n\n/**\n * 聊天消息\n */\nexport interface ChatMessage {\n  role: 'user' | 'assistant' | 'system';\n  content: string;\n}\n\n/**\n * Agent 执行器接口\n *\n * 所有 AI 执行器都必须实现此接口。\n */\nexport interface IAgentExecutor {\n  /** 执行器类型 */\n  readonly executorType: ExecutorType;\n\n  /** 供应商 ID */\n  readonly providerId: string;\n\n  /**\n   * 获取认证类型\n   */\n  getAuthType(): AuthType;\n\n  /**\n   * 检查认证状态\n   */\n  checkAuthentication(): Promise<AuthInfo>;\n\n  /**\n   * 执行任务（流式）\n   *\n   * @param config 执行器配置\n   * @param message 用户消息\n   * @returns 异步迭代器，yield 执行过程中的消息\n   */\n  execute(config: ExecutorConfig, message: string): AsyncGenerator<ExecuteMessage>;\n\n  /**\n   * 执行任务并等待完成\n   *\n   * @param config 执行器配置\n   * @param message 用户消息\n   * @returns 执行结果\n   */\n  executeAndWait(config: ExecutorConfig, message: string): Promise<ExecuteResult>;\n\n  /**\n   * 多轮对话\n   *\n   * @param config 执行器配置\n   * @param messages 对话历史\n   * @returns 执行结果\n   */\n  chat(config: ExecutorConfig, messages: ChatMessage[]): Promise<ExecuteResult>;\n}\n\n/**\n * 执行器基类选项\n */\nexport interface BaseExecutorOptions {\n  /** 供应商 ID */\n  providerId: string;\n  /** 凭证 */\n  credential: AiCredential;\n  /** Invocation-scoped AI Connection runtime config */\n  aiConnection?: AIConnectionInvocationConfig;\n  /** 供应商配置（可选，用于覆盖默认值） */\n  providerConfig?: Partial<ProviderConfig>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agents/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG","sourcesContent":["/**\n * Agent Executor 类型定义\n *\n * 统一的 AI Agent 执行框架接口。\n * 供应商配置从 Pod 读取，不在代码中硬编码。\n */\n\n/**\n * 通用 MCP Server 配置类型\n *\n * 这是一个宽松的类型定义，各个 Executor 会在内部转换为对应 SDK 的具体类型。\n * 支持的配置类型：\n * - stdio: { command: string, args?: string[], env?: Record<string, string> }\n * - sse: { type: 'sse', url: string, headers?: Record<string, string> }\n * - http: { type: 'http', url: string, headers?: Record<string, string> }\n * - sdk: { type: 'sdk', name: string, instance?: McpServer }\n */\nexport type McpServerConfig = {\n  type?: 'stdio' | 'sse' | 'http' | 'sdk';\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  name?: string;\n  [key: string]: unknown;\n};\n\n/**\n * 执行器类型（SDK 类型）\n *\n * 只支持有完整 Agent SDK 的供应商：\n * - codebuddy: @tencent-ai/agent-sdk\n * - claude: @anthropic-ai/claude-agent-sdk\n *\n * 不支持的原因：\n * - OpenAI: 没有完整的 Agent SDK，Codex CLI 通过 ACP runner 接入，不走这里\n * - Gemini: 没有完整的 Agent SDK，CLI core 使用 MCP 不使用 ACP\n */\nexport type ExecutorType = 'codebuddy' | 'claude';\n\n/**\n * 认证类型\n */\nexport type AuthType = 'api-key' | 'oidc';\n\n/**\n * AI 凭证（从 Pod 读取）\n */\nexport interface AiCredential {\n  /** 提供商 ID（对应 Pod 中的 provider URI fragment） */\n  providerId: string;\n  /** API Key */\n  apiKey: string;\n  /** 自定义 API 端点 */\n  baseUrl?: string;\n  /** 代理 URL */\n  proxyUrl?: string;\n  /** 项目 ID (Gemini Vertex AI) */\n  projectId?: string;\n  /** 组织 ID (OpenAI) */\n  organizationId?: string;\n}\n\n/**\n * Invocation-scoped AI Connection configuration.\n *\n * API key is the Solid client-credentials wrapper (`sk-*`) projected into the\n * current invocation. It is not the user's raw Pod provider secret.\n */\nexport interface AIConnectionInvocationConfig {\n  /** Xpod AI Connection endpoint, usually the local /v1 gateway URL */\n  baseUrl: string;\n  /** OpenAI-compatible API key for this invocation */\n  apiKey: string;\n  /** ISO timestamp after which the delegated credential must be refreshed */\n  expiresAt?: string;\n  /** Optional model routed through the gateway */\n  model?: string;\n}\n\n/**\n * 供应商配置（Pod Provider + Agent runtime 的组合视图）\n */\nexport interface ProviderConfig {\n  /** 供应商 ID */\n  id: string;\n  /** 显示名称 */\n  displayName: string;\n  /** 运行时类型（来自 Agent .meta runtimeKind，不存储在 Provider 实体） */\n  executorType: ExecutorType;\n  /** API 端点 */\n  baseUrl?: string;\n  /** 默认模型 ID */\n  defaultModel?: string;\n  /** 是否启用 */\n  enabled: boolean;\n}\n\n/**\n * 认证信息\n */\nexport interface AuthInfo {\n  /** 是否已认证 */\n  authenticated: boolean;\n  /** 认证类型 */\n  authType: AuthType;\n  /** 供应商 ID */\n  providerId: string;\n  /** 执行器类型 */\n  executorType: ExecutorType;\n  /** 过期时间 */\n  expiresAt?: Date;\n  /** 账户信息 */\n  account?: {\n    email?: string;\n    name?: string;\n  };\n}\n\n/**\n * 执行器配置（基础）\n */\nexport interface ExecutorConfig {\n  /** Agent 名称 */\n  name: string;\n  /** Agent 描述 */\n  description?: string;\n  /** System prompt */\n  systemPrompt: string;\n  /** 模型名称 */\n  model?: string;\n  /** 最大输出 tokens */\n  maxTokens?: number;\n  /** 温度参数 (0-2) */\n  temperature?: number;\n  /** Top-P 参数 */\n  topP?: number;\n  /** 工作目录 */\n  workingDirectory?: string;\n  /** 可用工具列表 */\n  tools?: string[];\n  /** 允许的工具列表（自动允许，不需要权限确认） */\n  allowedTools?: string[];\n  /** 禁用的工具列表 */\n  disallowedTools?: string[];\n  /** MCP 服务器配置 */\n  mcpServers?: Record<string, McpServerConfig>;\n  /** 最大轮数 */\n  maxTurns?: number;\n  /** 权限模式 */\n  permissionMode?: 'default' | 'acceptEdits' | 'bypassPermissions' | 'plan' | 'dontAsk';\n}\n\n/**\n * CodeBuddy 扩展配置\n */\nexport interface CodeBuddyConfig extends ExecutorConfig {\n  /** 工作目录（限制文件操作范围） */\n  cwd?: string;\n  /** 允许的工具列表 */\n  allowedTools?: string[];\n  /** 禁用的工具列表 */\n  disallowedTools?: string[];\n  /** MCP 服务器配置 */\n  mcpServers?: Record<string, McpServerConfig>;\n  /** 最大轮数 */\n  maxTurns?: number;\n  /** 权限模式 */\n  permissionMode?: 'default' | 'acceptEdits' | 'bypassPermissions';\n}\n\n/**\n * CodeBuddy 执行选项\n */\nexport interface CodeBuddyOptions {\n  /** Pod base URL */\n  podBaseUrl?: string;\n  /** OAuth access token（用于 MCP 访问 Pod） */\n  accessToken?: string;\n  /** 超时时间（毫秒） */\n  timeout?: number;\n  /** 额外上下文 */\n  context?: Record<string, unknown>;\n}\n\n/**\n * 执行结果（基础）\n */\nexport interface ExecuteResult {\n  /** 是否成功 */\n  success: boolean;\n  /** 结果文本 */\n  result?: string;\n  /** 错误信息 */\n  error?: string;\n  /** 结构化输出（CodeBuddy 专用） */\n  structuredOutput?: unknown;\n  /** 使用统计 */\n  usage?: {\n    promptTokens: number;\n    completionTokens: number;\n    totalTokens: number;\n    durationMs: number;\n  };\n}\n\n/**\n * 执行消息类型\n */\nexport type ExecuteMessage =\n  | { type: 'system'; executorType: ExecutorType; model: string; tools?: string[] }\n  | { type: 'text'; content: string }\n  | { type: 'tool_call'; toolName: string; toolInput: unknown }\n  | { type: 'tool_result'; toolName: string; result: string }\n  | { type: 'error'; error: string }\n  | { type: 'done'; result: ExecuteResult };\n\n/**\n * 聊天消息\n */\nexport interface ChatMessage {\n  role: 'user' | 'assistant' | 'system';\n  content: string;\n}\n\n/**\n * Agent 执行器接口\n *\n * 所有 AI 执行器都必须实现此接口。\n */\nexport interface IAgentExecutor {\n  /** 执行器类型 */\n  readonly executorType: ExecutorType;\n\n  /** 供应商 ID */\n  readonly providerId: string;\n\n  /**\n   * 获取认证类型\n   */\n  getAuthType(): AuthType;\n\n  /**\n   * 检查认证状态\n   */\n  checkAuthentication(): Promise<AuthInfo>;\n\n  /**\n   * 执行任务（流式）\n   *\n   * @param config 执行器配置\n   * @param message 用户消息\n   * @returns 异步迭代器，yield 执行过程中的消息\n   */\n  execute(config: ExecutorConfig, message: string): AsyncGenerator<ExecuteMessage>;\n\n  /**\n   * 执行任务并等待完成\n   *\n   * @param config 执行器配置\n   * @param message 用户消息\n   * @returns 执行结果\n   */\n  executeAndWait(config: ExecutorConfig, message: string): Promise<ExecuteResult>;\n\n  /**\n   * 多轮对话\n   *\n   * @param config 执行器配置\n   * @param messages 对话历史\n   * @returns 执行结果\n   */\n  chat(config: ExecutorConfig, messages: ChatMessage[]): Promise<ExecuteResult>;\n}\n\n/**\n * 执行器基类选项\n */\nexport interface BaseExecutorOptions {\n  /** 供应商 ID */\n  providerId: string;\n  /** 凭证 */\n  credential: AiCredential;\n  /** Invocation-scoped AI Connection runtime config */\n  aiConnection?: AIConnectionInvocationConfig;\n  /** 供应商配置（可选，用于覆盖默认值） */\n  providerConfig?: Partial<ProviderConfig>;\n}\n"]}

package/dist/api/ai-gateway/AiGatewayService.d.ts

@@ -1,13 +1,12 @@
 import type { AuthContext } from '../auth/AuthContext';
-import type { CredentialVault } from './credentials/CredentialVault';
-import type { EncryptedCredentialSecret } from './credentials/KeyWrapper';
 import type { ProviderRuntimeCredential } from './providers/ProviderRuntimeAdapter';
 import type { ProviderCapabilities, ProviderRegistry } from './providers/ProviderRegistry';
 import type { ProviderRuntimeRegistry } from './providers/ProviderRuntimeRegistry';
 import type { GatewayCredentialCandidate, ModelRouter, ModelRouteResult } from './routing/ModelRouter';
 import type { GatewayEvent, GatewayProtocol, GatewayProtocolFrontend, GatewayRequest } from './types';
 export interface StoredGatewayCredential extends GatewayCredentialCandidate {
-    encryptedSecret: EncryptedCredentialSecret;
+    storageMode: 'plaintext-v1';
+    secretPayload: string;
     version?: number;
     runtimeCredential?: ProviderRuntimeCredential;
 }
@@ -19,13 +18,6 @@ export interface GatewayCredentialStore {
     }): Promise<StoredGatewayCredential[]>;
     recordSuccess?(input: GatewayCredentialHealthRecord): Promise<void>;
     recordFailure?(input: GatewayCredentialHealthRecord): Promise<void>;
-    rewrapCredential?(input: {
-        webId: string;
-        deployment: string;
-        credentialId: string;
-        expectedVersion?: number;
-        encryptedSecret: EncryptedCredentialSecret;
-    }): Promise<boolean>;
 }
 export interface GatewayCredentialHealthRecord {
     webId: string;
@@ -41,7 +33,6 @@ export interface AiGatewayServiceOptions {
     registry: ProviderRegistry;
     router: ModelRouter;
     credentials: GatewayCredentialStore;
-    vault: CredentialVault;
     runtimes: ProviderRuntimeRegistry;
     frontends?: GatewayProtocolFrontend[];
     now?: () => Date;
@@ -69,10 +60,10 @@ export interface GatewayModelListItem {
 }
 export interface GatewayAcceptanceProvenance {
     webId: string;
-    gatewayKeyId: string;
-    gatewayKeyFingerprint: string;
+    authType: 'solid-oidc' | 'client-credentials';
+    clientIdHash?: string;
     credentialIriHash: string;
-    secretCellRefHash: string;
+    credentialPayloadRefHash: string;
     providerId: string;
     providerRouteSource: 'pod-credential';
     xpodBaseUrl: string;
@@ -83,7 +74,6 @@ export declare class AiGatewayService {
     private readonly registry;
     private readonly router;
     private readonly credentials;
-    private readonly vault;
     private readonly runtimes;
     private readonly frontends;
     private readonly now;
@@ -102,5 +92,4 @@ export declare class AiGatewayService {
     private openApiKey;
     private recordRouteFailure;
     private requirePrincipal;
-    private requireScope;
 }

package/dist/api/ai-gateway/AiGatewayService.js

@@ -4,6 +4,7 @@ exports.AiGatewayService = void 0;
 const node_crypto_1 = require("node:crypto");
 const errors_1 = require("./errors");
 const AuthContext_1 = require("../auth/AuthContext");
+const PlaintextCredentialPayload_1 = require("./credentials/PlaintextCredentialPayload");
 const protocol_1 = require("./protocol");
 const ProviderRegistry_1 = require("./providers/ProviderRegistry");
 class AiGatewayService {
@@ -13,7 +14,6 @@ class AiGatewayService {
         this.registry = options.registry;
         this.router = options.router;
         this.credentials = options.credentials;
-        this.vault = options.vault;
         this.runtimes = options.runtimes;
         this.now = options.now ?? (() => new Date());
         for (const frontend of options.frontends ?? [
@@ -36,7 +36,6 @@ class AiGatewayService {
         return frontend;
     }
     async execute(input) {
-        this.requireScope(input.auth, 'inference:write');
         const principal = this.requirePrincipal(input.auth);
         const frontend = this.frontend(input.protocol);
         const request = frontend.parseRequest(input.body);
@@ -51,6 +50,7 @@ class AiGatewayService {
         });
         request.model = route.model;
         const events = this.executeWithCredentialFailover({
+            auth: input.auth,
             principal,
             request,
             route,
@@ -73,7 +73,6 @@ class AiGatewayService {
         return aggregateEvents(execution.protocol, execution.request.model, events, this.now());
     }
     async listModels(auth) {
-        this.requireScope(auth, 'models:read');
         const principal = this.requirePrincipal(auth);
         const credentials = await this.credentials.listCredentials({
             webId: principal.webId,
@@ -140,14 +139,7 @@ class AiGatewayService {
         return models;
     }
     async acceptanceProvenance(input) {
-        this.requireScope(input.auth, 'acceptance:read');
         const principal = this.requirePrincipal(input.auth);
-        if (input.auth.type !== 'solid' || input.auth.viaGatewayApiKey !== true || !input.auth.gatewayKeyFingerprint) {
-            throw new errors_1.GatewayProtocolError('Acceptance provenance requires a Gateway API key principal', {
-                code: 'invalid_request',
-                status: 403,
-            });
-        }
         let route;
         try {
             route = await this.router.route({
@@ -177,10 +169,14 @@ class AiGatewayService {
         const credential = route.credential;
         return {
             webId: principal.webId,
-            gatewayKeyId: input.auth.type === 'solid' ? input.auth.gatewayKeyId ?? 'unknown' : 'unknown',
-            gatewayKeyFingerprint: input.auth.gatewayKeyFingerprint,
+            authType: input.auth.type === 'solid' && input.auth.viaApiKey === true
+                ? 'client-credentials'
+                : 'solid-oidc',
+            ...(input.auth.type === 'solid' && input.auth.clientId
+                ? { clientIdHash: hashProvenanceValue(input.auth.clientId) }
+                : {}),
             credentialIriHash: hashProvenanceValue(credential.credentialIri),
-            secretCellRefHash: hashProvenanceValue(credential.encryptedSecret.credentialIri),
+            credentialPayloadRefHash: hashProvenanceValue(credential.credentialIri),
             providerId: route.provider.id,
             providerRouteSource: 'pod-credential',
             xpodBaseUrl: input.xpodBaseUrl,
@@ -216,7 +212,7 @@ class AiGatewayService {
             catch (error) {
                 await this.recordRouteFailure(input.principal.webId, route, error);
                 if (!firstClientEventEmitted && this.router.canFailOver(route)) {
-                    const nextRoute = await this.findFailoverRoute(input.principal.webId, input.request, route, attempted);
+                    const nextRoute = await this.findFailoverRoute(input.auth, input.principal.webId, input.request, route, attempted);
                     if (nextRoute) {
                         route = nextRoute;
                         continue;
@@ -226,11 +222,12 @@ class AiGatewayService {
             }
         }
     }
-    async findFailoverRoute(webId, request, failedRoute, attempted) {
+    async findFailoverRoute(auth, webId, request, failedRoute, attempted) {
         try {
             return await this.router.route({
                 webId,
                 deployment: this.deployment,
+                auth,
                 model: `${failedRoute.provider.id}/${failedRoute.model}`,
                 conversationId: conversationIdFor(request),
             }, attempted);
@@ -243,17 +240,7 @@ class AiGatewayService {
         }
     }
     async openApiKey(principal, route, credential) {
-        const secret = await this.vault.open(principal, credential.credentialIri, route.provider.id, credential.encryptedSecret);
-        if (this.vault.needsRewrap?.(credential.encryptedSecret) && this.credentials.rewrapCredential) {
-            const rewrapped = await this.vault.rewrap(principal, credential.encryptedSecret);
-            await this.credentials.rewrapCredential({
-                webId: principal.webId,
-                deployment: this.deployment,
-                credentialId: credential.id,
-                expectedVersion: credential.version,
-                encryptedSecret: rewrapped,
-            });
-        }
+        const secret = (0, PlaintextCredentialPayload_1.decodePlaintextCredential)(credential);
         const apiKey = secret.apiKey ?? secret.accessToken ?? secret.token;
         if (typeof apiKey !== 'string' || !apiKey) {
             throw new errors_1.GatewayProtocolError('Credential secret does not contain a usable provider token', {
@@ -295,15 +282,6 @@ class AiGatewayService {
         }
         return { webId };
     }
-    requireScope(auth, scope) {
-        if (!(0, AuthContext_1.hasGatewayScope)(auth, scope)) {
-            throw new errors_1.GatewayProtocolError(`Missing required scope: ${scope}`, {
-                code: 'invalid_request',
-                status: 403,
-                details: { scope },
-            });
-        }
-    }
 }
 exports.AiGatewayService = AiGatewayService;
 function hashProvenanceValue(value) {