@yeaft/webchat-agent 1.0.302 → 1.0.304

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.302"}
+{"version":"1.0.304"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.302",
+  "version": "1.0.304",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/config.js

@@ -77,6 +77,7 @@ const DEFAULTS = {
     maxDelayMs: 30_000,
     jitterRatio: 0.25,
     streamIdleTimeoutMs: 90_000,
+    forbiddenRetryDelaysMs: [30_000, 120_000],
   },
 };
 
@@ -114,6 +115,12 @@ export function normalizeLlmRetry(fileConfig, overrides) {
     if (Number.isFinite(src.streamIdleTimeoutMs) && src.streamIdleTimeoutMs >= 0) {
       out.streamIdleTimeoutMs = Math.min(600_000, Math.floor(src.streamIdleTimeoutMs));
     }
+    if (Array.isArray(src.forbiddenRetryDelaysMs)) {
+      out.forbiddenRetryDelaysMs = src.forbiddenRetryDelaysMs
+        .filter(v => Number.isFinite(v) && v >= 0)
+        .slice(0, 3)
+        .map(v => Math.min(600_000, Math.floor(v)));
+    }
   };
   apply(fileConfig);
   apply(overrides);

package/yeaft/engine.js

@@ -22,7 +22,7 @@ import { promises as fsp } from 'fs';
 import { join, resolve as resolvePath } from 'path';
 import { buildSystemPrompt, buildWorkerPrompt } from './prompts.js';
 import { getRuntimePlatformInfo } from './runtime-platform.js';
-import { LLMContextError, LLMAbortError, LLMRateLimitError, LLMServerError, LLMStreamIdleTimeoutError } from './llm/adapter.js';
+import { LLMContextError, LLMAbortError, LLMAuthError, LLMRateLimitError, LLMServerError, LLMStreamIdleTimeoutError } from './llm/adapter.js';
 import { runMemoryPreflow, buildRelevantScopes, memoryScopeLabel } from './sessions/pre-flow.js';
 import { readProjectDoc, pickProjectDocFile, DEFAULT_PROJECT_DOC_MAX_BYTES } from './sessions/project-doc.js';
 import { partitionMessages } from './compact/partition.js';
@@ -103,6 +103,7 @@ const RETRY_DEFAULTS = Object.freeze({
   baseDelayMs: 1_000,
   maxDelayMs: 30_000,
   jitterRatio: 0.25,
+  forbiddenRetryDelaysMs: [30_000, 120_000],
 });
 
 const RETRY_CONTINUATION_PROMPT =
@@ -159,11 +160,18 @@ function stripLeadingSkillCommandFromPromptParts(promptParts, skillManager) {
 function resolveRetryPolicy(config) {
   const raw = config?.llmRetry || {};
   const num = (v, d) => (Number.isFinite(v) && v >= 0 ? v : d);
+  const forbiddenRetryDelaysMs = Array.isArray(raw.forbiddenRetryDelaysMs)
+    ? raw.forbiddenRetryDelaysMs
+      .filter(v => Number.isFinite(v) && v >= 0)
+      .slice(0, 3)
+      .map(v => Math.min(600_000, Math.floor(v)))
+    : RETRY_DEFAULTS.forbiddenRetryDelaysMs;
   return {
     maxRetries: Math.max(0, Math.floor(num(raw.maxRetries, RETRY_DEFAULTS.maxRetries))),
     baseDelayMs: Math.max(0, Math.floor(num(raw.baseDelayMs, RETRY_DEFAULTS.baseDelayMs))),
     maxDelayMs: Math.max(0, Math.floor(num(raw.maxDelayMs, RETRY_DEFAULTS.maxDelayMs))),
     jitterRatio: Math.min(1, Math.max(0, num(raw.jitterRatio, RETRY_DEFAULTS.jitterRatio))),
+    forbiddenRetryDelaysMs,
   };
 }
 
@@ -2408,6 +2416,7 @@ export class Engine {
     // and does NOT count against this budget.
     const retryPolicy = resolveRetryPolicy(this.#config);
     let consecutiveRetryableErrors = 0;
+    let consecutiveForbiddenErrors = 0;
 
     while (true) {
       turnNumber++;
@@ -2949,6 +2958,34 @@ export class Engine {
         // leave ambiguous execution ownership, so only pre-tool failures are
         // eligible for transparent retry or model fallback.
         const canReplayProviderRequest = toolCalls.length === 0;
+        const earlyIsTemporaryForbidden = err instanceof LLMAuthError
+          && err.statusCode === 403
+          && err.temporary === true;
+        if (earlyIsTemporaryForbidden && canReplayProviderRequest
+          && consecutiveForbiddenErrors < retryPolicy.forbiddenRetryDelaysMs.length) {
+          const delayMs = retryPolicy.forbiddenRetryDelaysMs[consecutiveForbiddenErrors];
+          consecutiveForbiddenErrors += 1;
+          endAttemptTrace('llm_retry');
+          yield {
+            type: 'llm_retry',
+            attempt: consecutiveForbiddenErrors,
+            maxRetries: retryPolicy.forbiddenRetryDelaysMs.length,
+            delayMs,
+            reason: 'temporary_forbidden',
+            recoveryMode: 'restart',
+            errorName: err.name,
+            statusCode: 403,
+            message: `LLM provider returned HTTP 403; retry ${consecutiveForbiddenErrors}/${retryPolicy.forbiddenRetryDelaysMs.length}`,
+          };
+          const slept = await sleepWithAbort(delayMs, signal);
+          if (!slept || signal?.aborted) {
+            yield { type: 'aborted', reason: this.#abortReason || 'external', turnNumber, threadId };
+            yield { type: 'turn_end', turnNumber, stopReason: 'aborted', threadId };
+            break;
+          }
+          yield { type: 'turn_end', turnNumber, stopReason: 'llm_retry', threadId };
+          continue;
+        }
         if ((earlyIsRateLimit || earlyIsTransient) && canReplayProviderRequest) {
           if (consecutiveRetryableErrors < retryPolicy.maxRetries) {
             consecutiveRetryableErrors += 1;

package/yeaft/llm/adapter.js

@@ -74,15 +74,70 @@ export class LLMRateLimitError extends Error {
   }
 }
 
-/** Authentication error (401, 403) — need to re-authenticate. */
+/** Authentication / authorization error (401, 403). */
 export class LLMAuthError extends Error {
-  constructor(message, statusCode) {
+  constructor(message, statusCode, details = {}) {
     super(message);
     this.name = 'LLMAuthError';
     this.statusCode = statusCode;
+    this.reasonCode = details.reasonCode || (statusCode === 401 ? 'invalid_credentials' : 'permission_denied');
+    this.temporary = details.temporary === true;
+    this.provider = details.provider || null;
+    this.model = details.model || null;
+    this.credentialRefreshable = details.credentialRefreshable === true;
+  }
+}
+
+const PERMANENT_FORBIDDEN_RE = /(?:access[_ -]?denied|not[_ -]?authorized|unauthori[sz]ed|authorization[_ -]?denied|policy|safety|content[_ -]?filter|entitle(?:ment|d)|subscription[_ -]?(?:required|inactive|expired)|plan[_ -]?(?:required|does[_ -]?not[_ -]?include)|model[^\n]{0,60}(?:access|permission|unavailable|not[_ -]?available|plan)|permission[^\n]{0,40}model|account[^\n]{0,40}(?:disabled|suspended)|organization[^\n]{0,40}(?:disabled|suspended)|insufficient[_ -]?(?:permission|scope))/i;
+const PERMANENT_FORBIDDEN_CODE_RE = /(?:access_denied|permission_denied|unauthorized|not_authorized|insufficient_(?:scope|permission)|model_(?:access_denied|not_available)|subscription_required|not_entitled|policy_violation|content_filter)/i;
+
+function parseProviderErrorBody(responseBody) {
+  if (typeof responseBody !== 'string') return responseBody && typeof responseBody === 'object' ? responseBody : null;
+  try {
+    const parsed = JSON.parse(responseBody);
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
   }
 }
 
+function providerErrorSignals(responseBody) {
+  const parsed = parseProviderErrorBody(responseBody);
+  const error = parsed?.error && typeof parsed.error === 'object' ? parsed.error : parsed;
+  const code = [error?.code, error?.type, error?.reason, parsed?.code, parsed?.type]
+    .filter(value => typeof value === 'string')
+    .join(' ');
+  const message = [error?.message, parsed?.message, typeof responseBody === 'string' ? responseBody : '']
+    .filter(value => typeof value === 'string')
+    .join(' ');
+  return { code, message };
+}
+
+/**
+ * Build a user-safe auth error. The provider response body is used only for
+ * classification and is deliberately excluded from the message; raw response
+ * capture remains available in the bounded debug trace.
+ */
+export function classifyAuthError(statusCode, responseBody = '', details = {}) {
+  const status = Number(statusCode) || 0;
+  if (status === 401) {
+    return new LLMAuthError('LLM provider returned HTTP 401 (invalid credentials)', status, {
+      ...details,
+      reasonCode: 'invalid_credentials',
+      temporary: false,
+    });
+  }
+  const signals = providerErrorSignals(responseBody);
+  const permanent = PERMANENT_FORBIDDEN_CODE_RE.test(signals.code)
+    || PERMANENT_FORBIDDEN_RE.test(signals.message);
+  const reasonCode = permanent ? 'permission_denied' : 'unknown_forbidden';
+  return new LLMAuthError(`LLM provider returned HTTP 403 (${reasonCode})`, status, {
+    ...details,
+    reasonCode,
+    temporary: !permanent,
+  });
+}
+
 /** Context too long error (413 or API-specific) — need compaction. */
 export class LLMContextError extends Error {
   constructor(message) {

package/yeaft/llm/anthropic.js

@@ -12,6 +12,7 @@ import {
   classifyFetchError,
   retryAfterFromResponse,
   LLMAuthError,
+  classifyAuthError,
   LLMContextError,
   LLMServerError,
   LLMAbortError,
@@ -218,7 +219,7 @@ export class AnthropicAdapter extends LLMAdapter {
   #classifyError(status, body, response = null) {
     const authHint = `auth=${this.#authHeaderMode}`;
     if (status === 401 || status === 403) {
-      return new LLMAuthError(`Anthropic auth error (${authHint}): ${body}`, status);
+      return classifyAuthError(status, body);
     }
     if (status === 429) {
       const retryAfter = retryAfterFromResponse(response);

package/yeaft/llm/credentials/github-copilot.js

@@ -59,6 +59,16 @@ const JWT_REFRESH_MARGIN_SECONDS = 120;
 const DEVICE_POLL_SAFETY_MARGIN_SECONDS = 3;
 const DEFAULT_DEVICE_TIMEOUT_SECONDS = 300;
 
+/** Safe credential exchange failure. Provider response bodies are never attached. */
+export class CopilotCredentialError extends Error {
+  constructor(message, statusCode = null, reasonCode = 'credential_exchange_failed') {
+    super(message);
+    this.name = 'CopilotCredentialError';
+    this.statusCode = Number.isFinite(statusCode) ? statusCode : null;
+    this.reasonCode = reasonCode;
+  }
+}
+
 const CREDENTIALS_DIR = join(homedir(), '.yeaft', 'credentials');
 const CREDENTIALS_FILE = join(CREDENTIALS_DIR, 'github-copilot.json');
 
@@ -80,6 +90,11 @@ export function _resetCacheForTests() {
   _exchangeInFlight.clear();
 }
 
+/** Drop exchanged API tokens after the provider rejects one with HTTP 401. */
+export function invalidateApiTokenCache() {
+  _jwtCache.clear();
+}
+
 /**
  * Anchor for `gh auth token` output validation. gh prints either a bare
  * token followed by a newline or, on misconfiguration, a help banner /
@@ -270,12 +285,20 @@ export async function exchangeToken(rawToken, { fetchFn = fetch } = {}) {
     });
 
     if (!res.ok) {
-      const body = await res.text().catch(() => '');
-      throw new Error(`Copilot token exchange failed: HTTP ${res.status} ${body.slice(0, 200)}`);
+      throw new CopilotCredentialError(
+        `Copilot token exchange failed with HTTP ${res.status}`,
+        res.status,
+      );
     }
     const data = await res.json();
     const apiToken = data && typeof data.token === 'string' ? data.token : '';
-    if (!apiToken) throw new Error('Copilot token exchange returned empty token');
+    if (!apiToken) {
+      throw new CopilotCredentialError(
+        'Copilot token exchange returned no API token',
+        res.status,
+        'credential_exchange_invalid_response',
+      );
+    }
 
     const expiresAtRaw = data.expires_at;
     const expiresAt =
@@ -307,13 +330,14 @@ export async function exchangeToken(rawToken, { fetchFn = fetch } = {}) {
  * @param {typeof fetch} [opts.fetchFn]
  * @returns {Promise<{token: string, source: string, exchanged: boolean} | null>}
  */
-export async function getApiToken({ hostname, fetchFn = fetch } = {}) {
+export async function getApiToken({ hostname, fetchFn = fetch, requireExchange = false } = {}) {
   const raw = await resolveRawToken({ hostname });
   if (!raw) return null;
   try {
     const { apiToken } = await exchangeToken(raw.token, { fetchFn });
     return { token: apiToken, source: raw.source, exchanged: true };
-  } catch {
+  } catch (err) {
+    if (requireExchange) throw err;
     return { token: raw.token, source: raw.source, exchanged: false };
   }
 }

package/yeaft/llm/credentials/index.js

@@ -20,7 +20,7 @@
 import * as githubCopilot from './github-copilot.js';
 
 /**
- * @typedef {{ getApiKey: () => Promise<string>, name: string }} CredentialProvider
+ * @typedef {{ getApiKey: () => Promise<string>, refreshApiKey?: () => Promise<string>, name: string }} CredentialProvider
  */
 
 /**
@@ -42,6 +42,18 @@ export function getCredentialProvider(name) {
         }
         return r.token;
       },
+      async refreshApiKey() {
+        githubCopilot.invalidateApiTokenCache();
+        const r = await githubCopilot.getApiToken({ requireExchange: true });
+        if (!r?.token) {
+          throw new githubCopilot.CopilotCredentialError(
+            'GitHub Copilot credential refresh found no usable credential',
+            null,
+            'credential_unavailable',
+          );
+        }
+        return r.token;
+      },
     };
   }
   return null;

package/yeaft/llm/openai-responses.js

@@ -29,6 +29,7 @@ import {
   LLMAdapter,
   LLMRateLimitError,
   LLMAuthError,
+  classifyAuthError,
   LLMContextError,
   LLMServerError,
   LLMAbortError,
@@ -207,7 +208,7 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
 
   #classifyError(status, body, response = null) {
     if (status === 401 || status === 403) {
-      return new LLMAuthError(`Auth error: ${body}`, status);
+      return classifyAuthError(status, body);
     }
     if (status === 429) {
       const retryAfter = retryAfterFromResponse(response);

package/yeaft/llm/router.js

@@ -21,7 +21,7 @@
  * Phase 7 removed the legacy "openai" (Chat Completions) protocol entirely.
  */
 
-import { LLMAdapter } from './adapter.js';
+import { LLMAdapter, LLMAuthError } from './adapter.js';
 import { getModelEffortOptions, getThinkingCapability, normalizeEffort, normalizeEffortOptions, parseModelRef } from '../models.js';
 import {
   GITHUB_COPILOT_BASE_URL,
@@ -563,18 +563,62 @@ export class AdapterRouter extends LLMAdapter {
    * @param {import('./adapter.js').StreamParams} params
    * @returns {AsyncGenerator<import('./adapter.js').StreamEvent>}
    */
+  async #refreshRejectedCredential(provider, model) {
+    if (!provider?.credentialProvider) return false;
+    try {
+      if (provider.credentialProvider === 'github-copilot' && provider.githubToken) {
+        const githubCopilot = await import('./credentials/github-copilot.js');
+        githubCopilot.invalidateApiTokenCache();
+        await githubCopilot.exchangeToken(provider.githubToken);
+      } else {
+        const { getCredentialProvider } = await import('./credentials/index.js');
+        const credentialProvider = getCredentialProvider(provider.credentialProvider);
+        if (!credentialProvider?.refreshApiKey) return false;
+        await credentialProvider.refreshApiKey();
+      }
+    } catch (err) {
+      throw new LLMAuthError('LLM credential refresh failed', err?.statusCode ?? 401, {
+        reasonCode: err?.reasonCode || 'credential_refresh_failed',
+        provider: provider.name || null,
+        model,
+        credentialRefreshable: true,
+      });
+    }
+    this.#adapterCache.clear();
+    return true;
+  }
+
+  #annotateAuthError(err, provider, model) {
+    if (err?.name !== 'LLMAuthError') return;
+    err.provider = provider?.name || null;
+    err.model = model;
+    err.credentialRefreshable = Boolean(provider?.credentialProvider);
+  }
+
   async *stream(params) {
-    const resolved = await this.#resolveAdapter(params.model);
-    const effortContext = {
-      protocol: resolved.protocol,
-      supportsEffort: resolved.entry?.supportsEffort,
-      effortOptions: resolved.entry?.effortOptions,
-      thinkingProtocol: resolved.entry?.thinkingProtocol,
-      maxBudgetTokens: resolved.entry?.maxBudgetTokens,
-    };
-    const filtered = filterEffortForModel({ ...params, model: resolved.modelId }, resolved);
-    const sanitized = sanitizeMessagesForWire(filtered);
-    yield* resolved.adapter.stream({ ...sanitized, model: resolved.modelId, effortContext });
+    let refreshedCredential = false;
+    while (true) {
+      const resolved = await this.#resolveAdapter(params.model);
+      const provider = this.getProviderForModel(params.model);
+      const effortContext = {
+        protocol: resolved.protocol,
+        supportsEffort: resolved.entry?.supportsEffort,
+        effortOptions: resolved.entry?.effortOptions,
+        thinkingProtocol: resolved.entry?.thinkingProtocol,
+        maxBudgetTokens: resolved.entry?.maxBudgetTokens,
+      };
+      const filtered = filterEffortForModel({ ...params, model: resolved.modelId }, resolved);
+      const sanitized = sanitizeMessagesForWire(filtered);
+      try {
+        yield* resolved.adapter.stream({ ...sanitized, model: resolved.modelId, effortContext });
+        return;
+      } catch (err) {
+        this.#annotateAuthError(err, provider, params.model);
+        if (err?.statusCode !== 401 || refreshedCredential
+          || !(await this.#refreshRejectedCredential(provider, params.model))) throw err;
+        refreshedCredential = true;
+      }
+    }
   }
 
   /**
@@ -584,17 +628,28 @@ export class AdapterRouter extends LLMAdapter {
    * @returns {Promise<{ text: string, usage: { inputTokens: number, outputTokens: number } }>}
    */
   async call(params) {
-    const resolved = await this.#resolveAdapter(params.model);
-    const effortContext = {
-      protocol: resolved.protocol,
-      supportsEffort: resolved.entry?.supportsEffort,
-      effortOptions: resolved.entry?.effortOptions,
-      thinkingProtocol: resolved.entry?.thinkingProtocol,
-      maxBudgetTokens: resolved.entry?.maxBudgetTokens,
-    };
-    const filtered = filterEffortForModel({ ...params, model: resolved.modelId }, resolved);
-    const sanitized = sanitizeMessagesForWire(filtered);
-    return resolved.adapter.call({ ...sanitized, model: resolved.modelId, effortContext });
+    let refreshedCredential = false;
+    while (true) {
+      const resolved = await this.#resolveAdapter(params.model);
+      const provider = this.getProviderForModel(params.model);
+      const effortContext = {
+        protocol: resolved.protocol,
+        supportsEffort: resolved.entry?.supportsEffort,
+        effortOptions: resolved.entry?.effortOptions,
+        thinkingProtocol: resolved.entry?.thinkingProtocol,
+        maxBudgetTokens: resolved.entry?.maxBudgetTokens,
+      };
+      const filtered = filterEffortForModel({ ...params, model: resolved.modelId }, resolved);
+      const sanitized = sanitizeMessagesForWire(filtered);
+      try {
+        return await resolved.adapter.call({ ...sanitized, model: resolved.modelId, effortContext });
+      } catch (err) {
+        this.#annotateAuthError(err, provider, params.model);
+        if (err?.statusCode !== 401 || refreshedCredential
+          || !(await this.#refreshRejectedCredential(provider, params.model))) throw err;
+        refreshedCredential = true;
+      }
+    }
   }
 
   /**

package/yeaft/web-bridge.js

@@ -3778,7 +3778,8 @@ function handleEngineEvent(event, hctx) {
   const terminalTurnEnd = event.type === 'turn_end' && event.terminal === true;
   const managesQueryTimer = terminalTurnEnd
     || event.type === 'async_task_wait_start'
-    || event.type === 'async_task_wait_end';
+    || event.type === 'async_task_wait_end'
+    || event.type === 'llm_retry';
   if (!managesQueryTimer) hctx.resetQueryTimer();
   const envelope = {
     sessionId: hctx.sessionId,
@@ -4074,6 +4075,9 @@ function handleEngineEvent(event, hctx) {
       break;
 
     case 'llm_retry':
+      // Engine is intentionally sleeping before the next provider request.
+      // Silence watchdogs protect active calls, not declared retry waits.
+      if (typeof hctx.pauseQueryTimer === 'function') hctx.pauseQueryTimer();
       maybeTransitionVpStatus(hctx, 'retrying');
       // Engine paused before re-issuing the same turn because the LLM
       // returned a retryable error (rate limit / 5xx / transient network /
@@ -4284,6 +4288,11 @@ function handleEngineEvent(event, hctx) {
         type: 'error',
         message: visibleErrMsg,
         errorName: event.error?.name || null,
+        statusCode: event.error?.statusCode ?? null,
+        reasonCode: event.error?.reasonCode || null,
+        provider: event.error?.provider || null,
+        model: event.error?.model || null,
+        credentialRefreshable: event.error?.credentialRefreshable === true,
         retryable: !!event.retryable,
         ...(event.reason ? { reason: event.reason } : {}),
         ...(event.retryExhausted !== undefined ? { retryExhausted: !!event.retryExhausted } : {}),