larkin 0.4.28 → 0.4.29

package/dist/runtime/runtime-host.cjs

@@ -14,6 +14,7 @@ const inbox_projection_js_1 = require("../agent/inbox-projection.cjs");
 const api_1 = require("@opentelemetry/api");
 const provider_error_classifier_js_1 = require("./provider-error-classifier.cjs");
 const runtime_readiness_js_1 = require("./runtime-readiness.cjs");
+const pi_official_auth_js_1 = require("./pi-official-auth.cjs");
 const official_lark_cli_js_1 = require("../app/official-lark-cli.cjs");
 const agent_lark_cli_workspace_js_1 = require("../app/agent-lark-cli-workspace.cjs");
 const pi_compaction_recovery_js_1 = require("./pi-compaction-recovery.cjs");
@@ -102,6 +103,121 @@ function persistPreviousSession(agent, previous) {
         // In-memory ref still holds for this process; restart will miss it only if this write failed.
     }
 }
+function isBuiltinPiAgent(agent) {
+    return agent.adapter.id === "pi"
+        && ((0, runtime_readiness_js_1.isBuiltinPiDistribution)(agent.config.piDistribution) || agent.config.runtime === "builtin-pi");
+}
+function authFailureScopeOf(agent) {
+    return {
+        runtime: agent.config.runtime,
+        model: agent.config.model,
+        piDistribution: agent.config.piDistribution,
+        adapterId: agent.adapter.id,
+    };
+}
+function currentAuthFailure(agent) {
+    if (!agent.authFailureActive)
+        return null;
+    const kind = agent.authFailureKind
+        ?? (agent.authFailureProvider ? "missing-provider" : "generic");
+    if (kind === "missing-provider") {
+        if (!agent.authFailureProvider)
+            return null;
+        return { kind: "missing-provider", runtime: "pi", piDistribution: "builtin", provider: agent.authFailureProvider };
+    }
+    const runtime = agent.adapter.id === "codex" || agent.adapter.id === "claude" || agent.adapter.id === "pi"
+        ? agent.adapter.id : null;
+    if (!runtime)
+        return null;
+    return {
+        kind: "generic",
+        runtime,
+        ...(runtime === "pi" && (agent.config.piDistribution === "builtin" || agent.config.piDistribution === "external")
+            ? { piDistribution: agent.config.piDistribution } : {}),
+        provider: agent.authFailureProvider,
+    };
+}
+function genericAuthProvider(agent, upstream) {
+    return (0, runtime_readiness_js_1.safeProviderId)(upstream?.provider) ?? (0, runtime_readiness_js_1.configuredProviderId)(agent.config.model);
+}
+function persistAuthFailure(agent) {
+    const store = agent.stateStore;
+    if (!store)
+        return;
+    try {
+        const write = () => {
+            const current = store.readJson("agentState", { sessions: {} });
+            if (Array.isArray(current.records) && !("sessions" in current))
+                return;
+            const { authFailureProvider: _legacy, authFailure: _scoped, ...rest } = current;
+            const failure = currentAuthFailure(agent);
+            if (!failure) {
+                if (!("authFailureProvider" in current) && !("authFailure" in current))
+                    return;
+                store.writeJson("agentState", rest);
+                return;
+            }
+            store.writeJson("agentState", {
+                ...rest,
+                authFailure: failure,
+                ...(failure.kind === "missing-provider" && failure.provider
+                    ? { authFailureProvider: failure.provider } : {}),
+            });
+        };
+        if (store.withInboxTransaction)
+            store.withInboxTransaction(write);
+        else
+            write();
+    }
+    catch {
+        // In-memory flags and the delivery ledger still hold for this process.
+    }
+}
+function loadPersistedAuthFailure(store) {
+    if (!store)
+        return null;
+    try {
+        return (0, runtime_readiness_js_1.parsePersistedAuthFailure)(store.readJson("agentState", {}));
+    }
+    catch {
+        return null;
+    }
+}
+function applyAuthFailure(agent, failure) {
+    agent.authFailureActive = true;
+    agent.authFailureKind = failure.kind;
+    agent.authFailureProvider = failure.provider ?? null;
+    agent.readiness = (0, runtime_readiness_js_1.readinessForPersistedAuthFailure)(failure);
+}
+function clearAuthFailure(agent, persist = true) {
+    agent.authFailureActive = false;
+    agent.authFailureKind = null;
+    agent.authFailureProvider = null;
+    if (persist)
+        persistAuthFailure(agent);
+}
+function restoreAuthFailure(agent) {
+    const persisted = loadPersistedAuthFailure(agent.stateStore);
+    if (!persisted)
+        return;
+    // 只恢复仍绑定当前 candidate 的当前作用域 auth；不从历史 delivery 回灌。
+    if (!(0, runtime_readiness_js_1.authFailureAppliesTo)(authFailureScopeOf(agent), persisted)) {
+        clearAuthFailure(agent);
+        return;
+    }
+    applyAuthFailure(agent, persisted);
+}
+function clearLedgerAuthProviders(agent) {
+    let changed = false;
+    for (const record of agent.records.values()) {
+        if (!record.authProvider)
+            continue;
+        delete record.authProvider;
+        changed = true;
+    }
+    if (changed)
+        persist(agent);
+}
 const REPLAY_FAILURE_CODES = new Set([
     "canonical_inbox_row_missing", "canonical_inbox_malformed", "duplicate_message_id",
     "inbox_state_conflict", "delivery_target_conflict", "structured_target_invalid",
@@ -490,6 +606,34 @@ function createRuntimeHost(options) {
                 messageId: record.messageId, status: "consumed" });
         }
     };
+    const ownedConfigDir = () => {
+        const value = process.env.LARKIN_CONFIG_DIR?.trim();
+        return value || null;
+    };
+    const projectAuthFailure = (agent, readiness, failure) => {
+        agent.authFailureActive = true;
+        agent.authFailureKind = failure.kind;
+        agent.authFailureProvider = failure.provider;
+        agent.readiness = {
+            ...readiness,
+            ...(agent.readiness?.executable ? { executable: agent.readiness.executable } : {}),
+            ...(agent.readiness?.version ? { version: agent.readiness.version } : {}),
+        };
+        persistAuthFailure(agent);
+        emit({ type: "agent-status", agentId: agent.config.agentId, status: "error",
+            error: `${agent.readiness.reason} ${agent.readiness.nextAction}`, readiness: agent.readiness });
+    };
+    const namedAuthProviderPresent = (agent) => {
+        if (agent.authFailureKind !== "missing-provider" || !agent.authFailureProvider)
+            return true;
+        const failure = currentAuthFailure(agent);
+        if (!failure || !(0, runtime_readiness_js_1.authFailureAppliesTo)(authFailureScopeOf(agent), failure))
+            return false;
+        const configDir = ownedConfigDir();
+        if (!configDir)
+            return false;
+        return (0, pi_official_auth_js_1.officialPiHasStoredProvider)(configDir, agent.config.agentId, agent.authFailureProvider);
+    };
     const resultFor = (agent, record, result) => {
         if (result.status === "accepted") {
             if (record.errorCategory !== "context_window") {
@@ -503,6 +647,28 @@ function createRuntimeHost(options) {
                     deliveryId: record.deliveryId, messageId: record.messageId, status: "accepted" });
             return { status: "accepted", deliveryId: record.deliveryId };
         }
+        const missing = result.status === "rejected" && isBuiltinPiAgent(agent)
+            ? (0, runtime_readiness_js_1.classifyPiMissingCredentialRejection)(result.reason)
+            : null;
+        if (missing) {
+            const readiness = (0, runtime_readiness_js_1.missingProviderCredentialReadiness)(agent.adapter.id, missing.provider);
+            const reason = readiness.reason ?? `Provider ${missing.provider} is missing from this Agent's official credential store.`;
+            if (record.status !== "error") {
+                record.reason = reason;
+                record.retryable = false;
+                record.errorCategory = "auth";
+                record.authProvider = missing.provider;
+                const finalRecord = setRecord(agent, record, "error");
+                if (finalRecord.status !== "consumed")
+                    emit({ type: "delivery", agentId: agent.config.agentId,
+                        deliveryId: record.deliveryId, messageId: record.messageId, status: "error", reason });
+                projectAuthFailure(agent, readiness, { kind: "missing-provider", provider: missing.provider });
+            }
+            return { status: "error", deliveryId: record.deliveryId, reason: record.reason ?? reason, retryable: false };
+        }
+        if (record.status === "error") {
+            return { status: "error", deliveryId: record.deliveryId, reason: record.reason ?? result.reason, retryable: false };
+        }
         if (record.errorCategory !== "context_window")
             delete record.errorCategory;
         const retryable = result.status === "deferred" || result.retryable;
@@ -1347,7 +1513,7 @@ function createRuntimeHost(options) {
                     agent.compactionMachines.delete(inputId);
             }
             const recoveredAuthentication = agent.authFailureActive && agent.turnInProgress
-                && agent.turnHadAuthenticatedOutput && !agent.turnHadFailure;
+                && agent.turnHadAuthenticatedOutput && !agent.turnHadFailure && namedAuthProviderPresent(agent);
             agent.turnInProgress = false;
             agent.busy = false;
             emit({ type: "activity", agentId: agent.config.agentId, activity: "idle", activityKind: "idle", detailKind: "turn_ended" });
@@ -1369,7 +1535,8 @@ function createRuntimeHost(options) {
             reconcileSubagentLedger(agent);
             telemetry?.runtimeEvent(agent.config.agentId, event);
             if (recoveredAuthentication) {
-                agent.authFailureActive = false;
+                clearAuthFailure(agent);
+                clearLedgerAuthProviders(agent);
                 const prior = agent.readiness;
                 agent.readiness = {
                     runtime: agent.adapter.id,
@@ -1462,21 +1629,24 @@ function createRuntimeHost(options) {
                 record.errorCategory = classifiedCategory;
             else
                 delete record.errorCategory;
+            const missing = event.errorCategory === "auth" && !event.retryable && isBuiltinPiAgent(agent)
+                ? (0, runtime_readiness_js_1.classifyPiMissingCredentialRejection)(event.upstream?.message)
+                    ?? (0, runtime_readiness_js_1.classifyPiMissingCredentialRejection)(event.message)
+                : null;
+            if (missing)
+                record.authProvider = missing.provider;
             const finalRecord = setRecord(agent, record, event.retryable ? "pending" : "error");
             if (finalRecord.status !== "consumed")
                 emit({ type: "delivery", agentId: agent.config.agentId,
                     deliveryId: record.deliveryId, messageId: record.messageId,
                     status: event.retryable ? "deferred" : "error", reason: event.message });
             if (event.errorCategory === "auth" && !event.retryable) {
-                const readiness = (0, runtime_readiness_js_1.providerAuthenticationFailureReadiness)(agent.adapter.id, event.upstream?.provider);
-                agent.authFailureActive = true;
-                agent.readiness = {
-                    ...readiness,
-                    ...(agent.readiness?.executable ? { executable: agent.readiness.executable } : {}),
-                    ...(agent.readiness?.version ? { version: agent.readiness.version } : {}),
-                };
-                emit({ type: "agent-status", agentId: agent.config.agentId, status: "error",
-                    error: `${agent.readiness.reason} ${agent.readiness.nextAction}`, readiness: agent.readiness });
+                const readiness = missing
+                    ? (0, runtime_readiness_js_1.missingProviderCredentialReadiness)(agent.adapter.id, missing.provider)
+                    : (0, runtime_readiness_js_1.providerAuthenticationFailureReadiness)(agent.adapter.id, event.upstream?.provider);
+                projectAuthFailure(agent, readiness, missing
+                    ? { kind: "missing-provider", provider: missing.provider }
+                    : { kind: "generic", provider: genericAuthProvider(agent, event.upstream) });
             }
             if (event.retryable && !agent.busy && !agent.turnInProgress)
                 void retryPending(agent);
@@ -1748,14 +1918,27 @@ function createRuntimeHost(options) {
                         clearTimeout(previous.backgroundCompletionRetryTimer);
                     if (previous.subagentReconcileTimer)
                         clearInterval(previous.subagentReconcileTimer);
+                    const previousFailure = currentAuthFailure(previous);
+                    const scoped = Boolean(previousFailure
+                        && (0, runtime_readiness_js_1.authFailureAppliesTo)({
+                            runtime: config.runtime,
+                            model: config.model,
+                            piDistribution: config.piDistribution,
+                            adapterId: adapter.id,
+                        }, previousFailure));
                     const candidate = {
                         ...previous, config, adapter, session, launchId: node_crypto_1.default.randomUUID(), busy: false, submitting: false,
                         starting: null, retryAfterSubmit: false, generation: 0, poller: null, retryTimer: null,
                         recreateAttempts: 0, stabilityTimer: null, recreateReason: null, stopped: false,
                         backgroundCompletionRetryTimer: null, subagentReconcileTimer: null,
                         disabledReason: null, configurationRecovery: null,
-                        readiness: previous.authFailureActive ? previous.readiness : readiness,
+                        authFailureActive: scoped && previous.authFailureActive,
+                        authFailureKind: scoped ? previous.authFailureKind : null,
+                        authFailureProvider: scoped ? previous.authFailureProvider : null,
+                        readiness: scoped && previous.authFailureActive ? previous.readiness : readiness,
                     };
+                    if (previous.authFailureActive && !candidate.authFailureActive)
+                        clearAuthFailure(candidate);
                     managed.set(config.agentId, candidate);
                     session.subscribe((event) => observe(candidate, session, event));
                     if (session.sessionId) {
@@ -1850,7 +2033,8 @@ function createRuntimeHost(options) {
                 agent.config.sessionId = null;
                 agent.session = fresh;
                 persistPreviousSession(agent, previousRef);
-                agent.readiness = readiness;
+                if (!agent.authFailureActive)
+                    agent.readiness = readiness;
                 agent.disabledReason = null;
             };
             try {
@@ -1871,7 +2055,13 @@ function createRuntimeHost(options) {
                     ...(fresh.effectiveReasoningEffort ? { reasoningEffort: fresh.effectiveReasoningEffort } : {}),
                     ...(agent.previousSession ? { previousSession: agent.previousSession } : {}) });
             }
-            emit({ type: "agent-status", agentId, status: "active", readiness });
+            emit({
+                type: "agent-status",
+                agentId,
+                status: agent.authFailureActive ? "error" : "active",
+                ...(agent.authFailureActive ? { error: `${agent.readiness?.reason} ${agent.readiness?.nextAction}` } : {}),
+                readiness: agent.authFailureActive ? agent.readiness ?? readiness : readiness,
+            });
             agent.piSessionOwner = probeEnv[pi_subagent_ledger_js_1.PI_SUBAGENT_SESSION_OWNER_ENV];
             await oldSession.close("fresh session reset committed")
                 .catch((error) => log("previous runtime close after fresh reset failed", String(error)));
@@ -2009,7 +2199,8 @@ function createRuntimeHost(options) {
                     agent.config.sessionId = null;
                     agent.session = fresh;
                     persistPreviousSession(agent, previousRef);
-                    agent.readiness = readiness;
+                    if (!agent.authFailureActive)
+                        agent.readiness = readiness;
                     agent.disabledReason = null;
                     for (const record of agent.records.values()) {
                         if (!messageIds.includes(record.messageId))
@@ -2027,7 +2218,13 @@ function createRuntimeHost(options) {
                         ...(fresh.effectiveReasoningEffort ? { reasoningEffort: fresh.effectiveReasoningEffort } : {}),
                         ...(agent.previousSession ? { previousSession: agent.previousSession } : {}) });
                 }
-                emit({ type: "agent-status", agentId, status: "active", readiness });
+                emit({
+                    type: "agent-status",
+                    agentId,
+                    status: agent.authFailureActive ? "error" : "active",
+                    ...(agent.authFailureActive ? { error: `${agent.readiness?.reason} ${agent.readiness?.nextAction}` } : {}),
+                    readiness: agent.authFailureActive ? agent.readiness ?? readiness : readiness,
+                });
                 durableRollback = null;
                 agent.piSessionOwner = probeEnv[pi_subagent_ledger_js_1.PI_SUBAGENT_SESSION_OWNER_ENV];
                 await oldSession.close("context-window recovery committed")
@@ -2117,11 +2314,13 @@ function createRuntimeHost(options) {
                     piProactiveCompactionFailedGeneration: null,
                     previousSession: loadPersistedPreviousSession(config, stateStore), readiness: null,
                     turnInProgress: false, turnHadFailure: false, turnHadAuthenticatedOutput: false, authFailureActive: false,
+                    authFailureKind: null, authFailureProvider: null,
                     promotedInboxUpdateIds: new Set(),
                     backgroundCompletionQueue: [], backgroundCompletionKeys: new Set(),
                     backgroundCompletionInFlight: null, backgroundCompletionWakeInputId: null,
                     backgroundCompletionRejectStreak: 0, backgroundCompletionRetryTimer: null,
                     subagentLedger: loadSubagentLedger(config), subagentReconcileTimer: null };
+                restoreAuthFailure(agent);
                 const startupConsumed = [];
                 const startupQuarantined = [];
                 for (const record of agent.records.values()) {