@zhivex-ai/harness 1.4.0 → 1.4.1

package/dist/index-c39197wq.js

@@ -0,0 +1,552 @@
+import {
+  VERTEX_TRANSIENT_ATTEMPTS,
+  classifyProviderFailure,
+  isEmptyModelTurn,
+  isRetryableProviderFailure,
+  providerDiagnostic,
+  providerDiagnosticSchema,
+  transientBackoffMs
+} from "./index-fm84men1.js";
+
+// src/providers/vertex-auth.ts
+import { GoogleAuth } from "google-auth-library";
+import { createVertex } from "@zhivex-ai/vertex";
+import { wrapLanguageModel } from "@zhivex-ai/core";
+var CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+function vertexRoute(env) {
+  const projectId = (env.GOOGLE_CLOUD_PROJECT ?? "").trim();
+  const location = (env.VERTEX_LOCATION ?? "").trim();
+  if (!/^(?:[a-z][a-z0-9-]{4,61}[a-z0-9]|[0-9]{6,20})$/.test(projectId)) {
+    throw new Error("Vertex requires a valid GOOGLE_CLOUD_PROJECT.");
+  }
+  if (!/^(?:global|us|eu|[a-z]+-[a-z]+[0-9]+)$/.test(location)) {
+    throw new Error("Vertex requires an explicit valid VERTEX_LOCATION.");
+  }
+  return Object.freeze({ projectId, location });
+}
+function vertexConfigured(env) {
+  try {
+    vertexRoute(env);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var VERTEX_ENVIRONMENT = ["GOOGLE_CLOUD_PROJECT", "VERTEX_LOCATION", "GOOGLE_APPLICATION_CREDENTIALS"];
+function vertexEnvironment(env) {
+  return Object.fromEntries(VERTEX_ENVIRONMENT.flatMap((name) => env[name] ? [[name, env[name]]] : []));
+}
+function vertexTokenSource(env, route, createAuth = (options) => new GoogleAuth(options)) {
+  const keyFilename = env.GOOGLE_APPLICATION_CREDENTIALS?.trim();
+  const auth = createAuth({
+    projectId: route.projectId,
+    scopes: [CLOUD_PLATFORM_SCOPE],
+    ...keyFilename ? { keyFilename } : {}
+  });
+  return async () => {
+    try {
+      const token = await auth.getAccessToken();
+      if (!token)
+        throw new Error("Empty ADC token");
+      return token;
+    } catch {
+      throw new VertexAuthenticationError;
+    }
+  };
+}
+
+class VertexAuthenticationError extends Error {
+  status = 401;
+  retryable = false;
+  constructor() {
+    super("Vertex ADC credentials are unavailable or could not be refreshed. Configure Application Default Credentials and retry.");
+    this.name = "VertexAuthenticationError";
+  }
+}
+function createVertexModel(model, env, createAuth, retry) {
+  const route = vertexRoute(env);
+  const adapter = createVertex({
+    ...route,
+    getAccessToken: vertexTokenSource(env, route, createAuth)
+  })(model);
+  const attempts = retry?.attempts ?? VERTEX_TRANSIENT_ATTEMPTS;
+  const delayFor = (input) => retry?.delayMs ?? ((attempt) => input.retryBackoffMs === 0 ? 0 : transientBackoffMs(attempt, input.retryBackoffMs ?? 250));
+  const generate = async (input) => withVertexAttempts(input.abortSignal, vertexAttemptBudget(input, attempts), delayFor(input), async () => {
+    try {
+      return await adapter.generate({ ...input, maxRetries: 0 });
+    } catch (error) {
+      throw safeVertexError(error);
+    }
+  }, (result) => !isEmptyModelTurn(result));
+  const innerStream = adapter.stream?.bind(adapter);
+  const retrying = innerStream ? {
+    ...adapter,
+    generate,
+    async stream(input) {
+      const events = await withVertexAttempts(input.abortSignal, vertexAttemptBudget(input, attempts), delayFor(input), () => collectVertexStream(() => innerStream({ ...input, maxRetries: 0 })), (events2) => !isEmptyVertexStream(events2));
+      return replayVertexStream(events);
+    }
+  } : { ...adapter, generate };
+  return wrapLanguageModel(retrying, [{
+    name: "harness-vertex-sanitized-errors",
+    async wrapGenerate(_context, next) {
+      try {
+        return await next();
+      } catch (error) {
+        throw safeVertexError(error);
+      }
+    },
+    async wrapStream(_context, next) {
+      let stream;
+      try {
+        stream = await next();
+      } catch (error) {
+        throw safeVertexError(error);
+      }
+      return async function* () {
+        try {
+          yield* stream;
+        } catch (error) {
+          throw safeVertexError(error);
+        }
+      }();
+    }
+  }]);
+}
+async function collectVertexStream(next) {
+  let stream;
+  try {
+    stream = await next();
+  } catch (error) {
+    throw safeVertexError(error);
+  }
+  const events = [];
+  try {
+    for await (const event of stream) {
+      if (event.type === "error")
+        throw safeVertexError(event.error);
+      events.push(event);
+    }
+  } catch (error) {
+    throw error instanceof Error && error.message.startsWith("Vertex request failed.") ? error : safeVertexError(error);
+  }
+  return events;
+}
+function isEmptyVertexStream(events) {
+  let text = "";
+  let finishReason;
+  let tools = false;
+  let media = false;
+  for (const event of events) {
+    if (event.type === "text-delta")
+      text += event.textDelta;
+    else if (event.type === "tool-call" || event.type === "tool-approval-request")
+      tools = true;
+    else if (event.type === "image-generation")
+      media = true;
+    else if (event.type === "finish")
+      finishReason = event.finishReason;
+  }
+  return isEmptyModelTurn({
+    text,
+    finishReason,
+    ...tools ? { messages: [{ parts: [{ type: "tool-call" }] }] } : {},
+    ...media ? { images: [{}] } : {}
+  });
+}
+function replayVertexStream(events) {
+  return async function* () {
+    yield* events;
+  }();
+}
+async function withVertexAttempts(abortSignal, attempts, delayMs, run, accept) {
+  let last;
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    if (abortSignal?.aborted)
+      throw new DOMException("Vertex request cancelled.", "AbortError");
+    try {
+      const value = await run();
+      if (accept(value) || attempt === attempts - 1)
+        return value;
+      last = value;
+    } catch (error) {
+      const safe = error instanceof Error && (error.name === "AbortError" || error.message.startsWith("Vertex request failed.")) ? error : safeVertexError(error);
+      if (safe.name === "AbortError" || abortSignal?.aborted || attempt === attempts - 1 || !isRetryableProviderFailure(safe))
+        throw safe;
+    }
+    await sleep(delayMs(attempt));
+  }
+  return last;
+}
+var sleep = (ms) => ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+function vertexAttemptBudget(input, fallback) {
+  const requested = [
+    typeof input.maxProviderRequests === "number" ? input.maxProviderRequests : undefined,
+    typeof input.maxRetries === "number" ? input.maxRetries + 1 : undefined
+  ].filter((value) => value !== undefined);
+  if (requested.length === 0)
+    return Math.max(1, fallback);
+  return Math.max(1, Math.min(...requested));
+}
+function safeVertexError(error) {
+  if (error instanceof VertexAuthenticationError)
+    return error;
+  const record = error && typeof error === "object" ? error : {};
+  if (record.name === "AbortError")
+    return new DOMException("Vertex request cancelled.", "AbortError");
+  const failure = classifyProviderFailure(error);
+  const body = providerBody(record.responseBody) ?? providerBody(record.body);
+  const preserved = providerDiagnosticSchema.safeParse(record.provider);
+  const provider = body !== undefined ? providerDiagnostic(body, failure.httpStatus) : preserved.success ? preserved.data : providerDiagnostic(undefined, failure.httpStatus);
+  return Object.assign(new Error("Vertex request failed. Check the sanitized provider diagnosis."), {
+    ...failure.httpStatus !== undefined ? { status: failure.httpStatus } : {},
+    ...failure.providerStatus ? { providerStatus: failure.providerStatus } : {},
+    provider,
+    retryable: failure.retryable
+  });
+}
+function providerBody(value) {
+  if (typeof value === "string")
+    return value;
+  if (!value || typeof value !== "object")
+    return;
+  try {
+    return JSON.stringify(value).slice(0, 8192);
+  } catch {
+    return;
+  }
+}
+
+// src/providers/azure-openai.ts
+import { createAzureOpenAI } from "@zhivex-ai/azure-openai";
+import { wrapLanguageModel as wrapLanguageModel2 } from "@zhivex-ai/core";
+var AZURE_OPENAI_TRANSPORT_ENVIRONMENT = [
+  "AZURE_OPENAI_ENDPOINT",
+  "AZURE_OPENAI_API_VERSION",
+  "AZURE_OPENAI_DEPLOYMENTS"
+];
+var API_VERSION = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/;
+function azureOpenAIEndpoint(env) {
+  const value = env.AZURE_OPENAI_ENDPOINT?.trim() ?? "";
+  if (!value)
+    throw new Error("Azure OpenAI requires AZURE_OPENAI_ENDPOINT.");
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("AZURE_OPENAI_ENDPOINT must be an https URL.");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.hash || url.search) {
+    throw new Error("AZURE_OPENAI_ENDPOINT must be an https URL without credentials or a query.");
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+function azureOpenAIApiVersion(env) {
+  const value = env.AZURE_OPENAI_API_VERSION?.trim() ?? "";
+  if (!value)
+    return;
+  if (!API_VERSION.test(value))
+    throw new Error("AZURE_OPENAI_API_VERSION is invalid.");
+  return value;
+}
+function azureOpenAIDeployments(env) {
+  const raw = env.AZURE_OPENAI_DEPLOYMENTS?.trim() ?? "";
+  if (!raw)
+    return Object.freeze({});
+  if (raw.length > 8192)
+    throw new Error("AZURE_OPENAI_DEPLOYMENTS is too large.");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("AZURE_OPENAI_DEPLOYMENTS must be a JSON object.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("AZURE_OPENAI_DEPLOYMENTS must be a JSON object.");
+  }
+  const entries = Object.entries(parsed);
+  if (entries.length > 32)
+    throw new Error("AZURE_OPENAI_DEPLOYMENTS lists too many deployments.");
+  const deployments = {};
+  for (const [name, value] of entries) {
+    if (!DEPLOYMENT_NAME.test(name))
+      throw new Error("AZURE_OPENAI_DEPLOYMENTS contains an invalid deployment name.");
+    const model = typeof value === "string" ? value : value && typeof value === "object" && !Array.isArray(value) && typeof value.model === "string" ? value.model : "";
+    const normalized = model.trim();
+    if (!MODEL_ID.test(normalized))
+      throw new Error("AZURE_OPENAI_DEPLOYMENTS contains an invalid base model.");
+    deployments[name] = Object.freeze({ model: normalized });
+  }
+  return Object.freeze(deployments);
+}
+function azureOpenAIConfigured(env) {
+  try {
+    azureOpenAIEndpoint(env);
+    azureOpenAIApiVersion(env);
+    azureOpenAIDeployments(env);
+    return Boolean(env.AZURE_OPENAI_API_KEY?.trim());
+  } catch {
+    return false;
+  }
+}
+function azureOpenAIEnvironment(env, secret) {
+  const picked = {};
+  for (const name of [...AZURE_OPENAI_TRANSPORT_ENVIRONMENT, "AZURE_OPENAI_API_KEY"]) {
+    const value = env[name]?.trim();
+    if (value)
+      picked[name] = value;
+  }
+  if (secret && !picked.AZURE_OPENAI_API_KEY)
+    picked.AZURE_OPENAI_API_KEY = secret;
+  return picked;
+}
+function createAzureOpenAIModel(model, env) {
+  const endpoint = azureOpenAIEndpoint(env);
+  const apiVersion = azureOpenAIApiVersion(env);
+  const deployments = azureOpenAIDeployments(env);
+  const apiKey = env.AZURE_OPENAI_API_KEY?.trim();
+  if (!apiKey)
+    throw new Error("Missing credentials for azure-openai. Set AZURE_OPENAI_API_KEY in the environment.");
+  const settings = {
+    apiKey,
+    endpoint,
+    ...apiVersion ? { apiVersion } : {},
+    ...Object.keys(deployments).length ? { deployments } : {}
+  };
+  const azure = apiVersion ? createAzureOpenAI(settings) : withoutProcessEnv(["AZURE_OPENAI_API_VERSION"], () => createAzureOpenAI(settings));
+  const deployed = sanitizeAzureModel(azure(model), apiKey);
+  const baseModel = deployments[model]?.model;
+  if (!baseModel || baseModel === model)
+    return deployed;
+  return withBaseModelCapabilities(deployed, azure(baseModel));
+}
+function withoutProcessEnv(names, run) {
+  const saved = new Map;
+  for (const name of names) {
+    saved.set(name, process.env[name]);
+    delete process.env[name];
+  }
+  try {
+    return run();
+  } finally {
+    for (const [name, value] of saved) {
+      if (value === undefined)
+        delete process.env[name];
+      else
+        process.env[name] = value;
+    }
+  }
+}
+function withBaseModelCapabilities(deployed, reference) {
+  return new Proxy(deployed, {
+    get(target, property, receiver) {
+      if (property === "capabilities")
+        return reference.capabilities;
+      const value = Reflect.get(target, property, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function sanitizeAzureModel(model, secret) {
+  const clean = (error) => {
+    if (error instanceof Error && error.name === "AbortError") {
+      return new DOMException("Azure OpenAI request cancelled.", "AbortError");
+    }
+    const record = error && typeof error === "object" ? error : {};
+    const safe = new Error("Azure OpenAI request failed. Check the endpoint, deployment, and credentials.");
+    if (secret && safe.message.includes(secret))
+      safe.message = safe.message.split(secret).join("[REDACTED]");
+    if (typeof record.status === "number")
+      Object.assign(safe, { status: record.status });
+    if (typeof record.retryable === "boolean")
+      Object.assign(safe, { retryable: record.retryable });
+    return safe;
+  };
+  return wrapLanguageModel2(model, [{
+    name: "harness-azure-openai-sanitized-errors",
+    async wrapGenerate(_context, next) {
+      try {
+        return await next();
+      } catch (error) {
+        throw clean(error);
+      }
+    },
+    async wrapStream(_context, next) {
+      let stream;
+      try {
+        stream = await next();
+      } catch (error) {
+        throw clean(error);
+      }
+      return async function* () {
+        try {
+          for await (const event of stream) {
+            if (event.type === "error")
+              throw clean(event.error);
+            yield event;
+          }
+        } catch (error) {
+          throw clean(error);
+        }
+      }();
+    }
+  }]);
+}
+
+// src/providers/bedrock.ts
+import { createBedrock } from "@zhivex-ai/bedrock";
+import { wrapLanguageModel as wrapLanguageModel3 } from "@zhivex-ai/core";
+var BEDROCK_TRANSPORT_ENVIRONMENT = [
+  "AWS_REGION",
+  "AWS_DEFAULT_REGION",
+  "AWS_PROFILE",
+  "BEDROCK_RUNTIME",
+  "BEDROCK_OPENAI_BASE_URL"
+];
+var BEDROCK_CREDENTIAL_ENVIRONMENT = [
+  "BEDROCK_API_KEY",
+  "AWS_BEARER_TOKEN_BEDROCK"
+];
+var REGION = /^[a-z]{2}(?:-[a-z0-9]+){1,3}$/;
+function bedrockRuntime(env) {
+  const value = env.BEDROCK_RUNTIME?.trim() ?? "";
+  if (!value || value === "converse")
+    return "converse";
+  if (value === "openai")
+    return "openai";
+  throw new Error("BEDROCK_RUNTIME must be converse or openai.");
+}
+function bedrockRegion(env) {
+  const region = env.AWS_REGION?.trim() || env.AWS_DEFAULT_REGION?.trim() || "";
+  if (!REGION.test(region)) {
+    throw new Error("Bedrock requires a valid AWS_REGION or AWS_DEFAULT_REGION.");
+  }
+  return region;
+}
+function bedrockOpenAIBaseURL(env) {
+  const baseURL = env.BEDROCK_OPENAI_BASE_URL?.trim() ?? "";
+  if (!baseURL)
+    throw new Error("Bedrock OpenAI-compatible runtime requires BEDROCK_OPENAI_BASE_URL.");
+  let url;
+  try {
+    url = new URL(baseURL);
+  } catch {
+    throw new Error("BEDROCK_OPENAI_BASE_URL must be an https URL.");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.hash) {
+    throw new Error("BEDROCK_OPENAI_BASE_URL must be an https URL without credentials.");
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+function openAIRoute(env) {
+  const apiKey = env.BEDROCK_API_KEY?.trim() || env.AWS_BEARER_TOKEN_BEDROCK?.trim() || "";
+  if (!apiKey) {
+    throw new Error("Bedrock OpenAI-compatible runtime requires BEDROCK_API_KEY or AWS_BEARER_TOKEN_BEDROCK.");
+  }
+  return { apiKey, baseURL: bedrockOpenAIBaseURL(env) };
+}
+function bedrockConfigured(env) {
+  try {
+    if (bedrockRuntime(env) === "openai") {
+      openAIRoute(env);
+      return true;
+    }
+    bedrockRegion(env);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var BEDROCK_STATIC_CREDENTIALS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"];
+function bedrockEnvironment(env, secret) {
+  const names = [...BEDROCK_TRANSPORT_ENVIRONMENT, ...BEDROCK_CREDENTIAL_ENVIRONMENT, ...BEDROCK_STATIC_CREDENTIALS];
+  const picked = {};
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value)
+      picked[name] = value;
+  }
+  let runtime = "converse";
+  try {
+    runtime = bedrockRuntime(picked);
+  } catch {
+    runtime = "converse";
+  }
+  if (secret && runtime === "openai" && !picked.BEDROCK_API_KEY && !picked.AWS_BEARER_TOKEN_BEDROCK) {
+    picked.BEDROCK_API_KEY = secret;
+  }
+  return picked;
+}
+function createBedrockModel(model, env) {
+  const runtime = bedrockRuntime(env);
+  if (runtime === "openai") {
+    const route = openAIRoute(env);
+    return sanitizeBedrockModel(createBedrock({
+      runtime: "openai",
+      apiKey: route.apiKey,
+      baseURL: route.baseURL
+    })(model), [route.apiKey]);
+  }
+  const region = bedrockRegion(env);
+  const bearer = env.AWS_BEARER_TOKEN_BEDROCK?.trim();
+  const accessKeyId = env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = env.AWS_SECRET_ACCESS_KEY?.trim();
+  const sessionToken = env.AWS_SESSION_TOKEN?.trim();
+  const staticCredentials = !bearer && accessKeyId && secretAccessKey ? { accessKeyId, secretAccessKey, ...sessionToken ? { sessionToken } : {} } : undefined;
+  return sanitizeBedrockModel(createBedrock({
+    region,
+    ...bearer ? { apiKey: bearer } : {},
+    ...staticCredentials ? { credentials: staticCredentials } : {}
+  })(model), [bearer, secretAccessKey, sessionToken].filter((value) => Boolean(value)));
+}
+function sanitizeBedrockModel(model, secrets) {
+  const clean = (error) => {
+    if (error instanceof Error && error.name === "AbortError") {
+      return new DOMException("Bedrock request cancelled.", "AbortError");
+    }
+    const record = error && typeof error === "object" ? error : {};
+    const safe = new Error("Bedrock request failed. Check region, model access, and credentials.");
+    if (typeof record.status === "number")
+      Object.assign(safe, { status: record.status });
+    if (typeof record.retryable === "boolean")
+      Object.assign(safe, { retryable: record.retryable });
+    for (const secret of secrets) {
+      if (secret && safe.message.includes(secret))
+        safe.message = safe.message.split(secret).join("[REDACTED]");
+    }
+    return safe;
+  };
+  return wrapLanguageModel3(model, [{
+    name: "harness-bedrock-sanitized-errors",
+    async wrapGenerate(_context, next) {
+      try {
+        return await next();
+      } catch (error) {
+        throw clean(error);
+      }
+    },
+    async wrapStream(_context, next) {
+      let stream;
+      try {
+        stream = await next();
+      } catch (error) {
+        throw clean(error);
+      }
+      return async function* () {
+        try {
+          for await (const event of stream) {
+            if (event.type === "error")
+              throw clean(event.error);
+            yield event;
+          }
+        } catch (error) {
+          throw clean(error);
+        }
+      }();
+    }
+  }]);
+}
+
+export { vertexRoute, vertexConfigured, VERTEX_ENVIRONMENT, vertexEnvironment, vertexTokenSource, createVertexModel, azureOpenAIEndpoint, azureOpenAIApiVersion, azureOpenAIDeployments, azureOpenAIConfigured, azureOpenAIEnvironment, createAzureOpenAIModel, bedrockRuntime, bedrockRegion, bedrockOpenAIBaseURL, bedrockConfigured, bedrockEnvironment, createBedrockModel };

package/dist/{index-5jhgatga.js → index-crta5wzv.js}

@@ -1,19 +1,19 @@
 import {
   createHarnessClientAdapter
-} from "./index-937cb7y8.js";
+} from "./index-02pqtbbg.js";
 import {
   harnessPolicyDecisionEventSchema
-} from "./index-pp474137.js";
+} from "./index-wm9xeq1n.js";
 import {
   openCliSessionStore
-} from "./index-s2k2edts.js";
+} from "./index-zxg4ve4j.js";
 import {
   SqliteDatabase
-} from "./index-m34q25jj.js";
+} from "./index-xdbkcccf.js";
 import {
   harnessClientRequestSchema,
   streamEventDocument
-} from "./index-nmjdwd4p.js";
+} from "./index-4gt045j0.js";
 import {
   __require
 } from "./index-1bx83sw4.js";
@@ -378,7 +378,7 @@ var startHarnessLocalService = async (harness, options) => {
       }
       const parsed = harnessClientRequestSchema.safeParse(value);
       const method = parsed.success ? parsed.data.command.method : undefined;
-      const mutation = method !== undefined && !["project.get", "policy.get", "session.list", "session.get", "run.get", "checkpoint.list", "checkpoint.inspect", "restore.get"].includes(method);
+      const mutation = method !== undefined && !["task.get", "task.review", "project.get", "policy.get", "session.list", "session.get", "run.get", "checkpoint.list", "checkpoint.inspect", "restore.get"].includes(method);
       if (paused && mutation && method !== "run.cancel")
         return send(res, 503, fault("SERVICE_PAUSED"));
       if (mutation)
@@ -424,6 +424,7 @@ var startHarnessLocalService = async (harness, options) => {
       ...options.retentionMs === undefined ? {} : { retentionMs: options.retentionMs }
     });
     adapter = await createHarnessClientAdapter(harness, {
+      taskProjectionSensitiveValues: [token, ...options.sensitiveValues ?? [], ...Object.entries(process.env).filter(([k, v]) => /(?:API_KEY|TOKEN|SECRET|PASSWORD)$/.test(k) && v && v.length >= 8).map(([, v]) => v)],
       ...options.approvalNow ? { now: options.approvalNow } : {},
       onPolicyDecision: (sessionId, runId, event) => activity.policyDecision(sessionId, runId, event),
       onPrompt: async (sessionId, runId, prompt) => {