mercury-agent 0.8.2 → 0.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/agent/container-error.ts

@@ -1,4 +1,9 @@
-export type ContainerFailureReason = "timeout" | "oom" | "aborted" | "error";
+export type ContainerFailureReason =
+  | "timeout"
+  | "oom"
+  | "aborted"
+  | "error"
+  | "no-credentials";
 
 export class ContainerError extends Error {
   readonly reason: ContainerFailureReason;
@@ -39,6 +44,14 @@ export class ContainerError extends Error {
     );
   }
 
+  static noCredentials(spaceId: string, detail: string): ContainerError {
+    return new ContainerError(
+      "no-credentials",
+      null,
+      `Refusing to start container for space ${spaceId}: ${detail}`,
+    );
+  }
+
   static error(exitCode: number, output: string): ContainerError {
     return new ContainerError(
       "error",

package/src/agent/container-runner.ts

@@ -8,7 +8,7 @@ import { mintCallerToken } from "../core/caller-token.js";
 import { scanOutbox } from "../core/outbox.js";
 import type { ExtImageBuildState } from "../extensions/image-builder.js";
 import { type Logger, logger } from "../logger.js";
-import { getApiKeyFromPiAuthFile } from "../storage/pi-auth.js";
+import { getPiAuthCredential } from "../storage/pi-auth.js";
 import type {
   ContainerResult,
   MessageAttachment,
@@ -677,11 +677,6 @@ export class AgentContainerRunner {
       );
     }
 
-    const authFromPi = await getApiKeyFromPiAuthFile({
-      provider: this.config.modelProvider,
-      authPath: this.config.authPath ?? path.join(globalDir, "auth.json"),
-    });
-
     // Env vars that should never be passed to containers
     const BLOCKED_ENV_VARS = new Set([
       "MERCURY_API_SECRET",
@@ -762,6 +757,7 @@ export class AgentContainerRunner {
         p.key === "ANTHROPIC_OAUTH_TOKEN" &&
         p.value.trimStart().startsWith("{"),
     );
+    let oauthBlobCorrupt = false;
     if (anthOauthIdx !== -1) {
       const raw = passthroughEnvPairs[anthOauthIdx]?.value ?? "";
       passthroughEnvPairs.splice(anthOauthIdx, 1);
@@ -769,6 +765,7 @@ export class AgentContainerRunner {
       try {
         parsedCreds = JSON.parse(raw) as AnthropicOAuthCreds;
       } catch {
+        oauthBlobCorrupt = true;
         logger.warn("Anthropic OAuth blob corrupt; skipping token injection");
       }
       if (parsedCreds) {
@@ -794,18 +791,41 @@ export class AgentContainerRunner {
     }
 
     // Check for pi auth file fallback for Anthropic
-    const hasAnthropicKey = passthroughEnvPairs.some(
-      (p) => p.key === "ANTHROPIC_API_KEY" || p.key === "ANTHROPIC_OAUTH_TOKEN",
-    );
-    if (
-      !hasAnthropicKey &&
-      this.config.modelProvider === "anthropic" &&
-      authFromPi
-    ) {
-      passthroughEnvPairs.push({
-        key: "ANTHROPIC_OAUTH_TOKEN",
-        value: authFromPi,
+    const hasAnthropicKey =
+      passthroughEnvPairs.some(
+        (p) =>
+          (p.key === "ANTHROPIC_API_KEY" ||
+            p.key === "ANTHROPIC_OAUTH_TOKEN") &&
+          p.value,
+      ) ||
+      Boolean(
+        input.extraEnv?.ANTHROPIC_API_KEY ||
+          input.extraEnv?.ANTHROPIC_OAUTH_TOKEN,
+      );
+    if (!hasAnthropicKey && this.config.modelProvider === "anthropic") {
+      const piAuth = await getPiAuthCredential({
+        provider: this.config.modelProvider,
+        authPath: this.config.authPath ?? path.join(globalDir, "auth.json"),
       });
+      if (piAuth.status === "ok") {
+        passthroughEnvPairs.push({
+          key: "ANTHROPIC_OAUTH_TOKEN",
+          value: piAuth.apiKey,
+        });
+      } else {
+        // Fail fast: without a credential, pi inside the container exits 1
+        // ("No API key found for anthropic") after a full container start,
+        // and the user gets a misleading "try again" message.
+        const detail = oauthBlobCorrupt
+          ? "MERCURY_ANTHROPIC_OAUTH_TOKEN holds a corrupt credential blob — re-provision it or set MERCURY_ANTHROPIC_API_KEY"
+          : piAuth.status === "refresh-failed"
+            ? "Anthropic OAuth refresh failed — re-authenticate on the host (mercury auth login) or set MERCURY_ANTHROPIC_API_KEY"
+            : "no Anthropic credential configured — run mercury auth login or set MERCURY_ANTHROPIC_API_KEY / MERCURY_ANTHROPIC_OAUTH_TOKEN";
+        logger.error(`Refusing to start container: ${detail}`, {
+          spaceId: input.spaceId,
+        });
+        throw ContainerError.noCredentials(input.spaceId, detail);
+      }
     }
 
     const envPairs = [

package/src/agent/user-error-messages.ts

@@ -7,7 +7,7 @@ export type UserErrorCategory =
   | "generic";
 
 const AUTH_RE =
-  /\b401\b|\b403\b|invalid\s+api\s+key|incorrect\s+api\s+key|authentication\s+failed|invalid\s+authentication|unauthorized|access\s+denied/i;
+  /\b401\b|\b403\b|invalid\s+api\s+key|incorrect\s+api\s+key|no\s+api\s+key\s+found|authentication\s+failed|invalid\s+authentication|unauthorized|access\s+denied/i;
 
 const KEY_LIMIT_RE = /quota|billing|usage\s+limit|spending\s+limit/i;
 

package/src/core/runtime.ts

@@ -641,6 +641,19 @@ export class MercuryCoreRuntime {
               type: "denied",
               reason: "Container was killed (possibly out of memory).",
             };
+          case "no-credentials": {
+            // Host refused to start the container (no model credential).
+            // Auth-category message: "try again" would be misleading here.
+            logger.error("Container start refused: no model credentials", {
+              detail: error.message,
+            });
+            const reason = friendlyErrorMessage(
+              "auth",
+              this.config.apiKeyMode,
+              this.config.consoleUrl,
+            );
+            return { type: "denied", reason };
+          }
           case "error": {
             logger.error(
               "Container error",

package/src/storage/pi-auth.ts

@@ -33,19 +33,26 @@ function writeAuthFile(authPath: string, auth: AuthFile): void {
   fs.chmodSync(authPath, 0o600);
 }
 
-export async function getApiKeyFromPiAuthFile(options: {
+export type PiAuthCredential =
+  | { status: "ok"; apiKey: string }
+  /** No usable oauth entry (or an env override takes precedence). */
+  | { status: "none" }
+  /** An oauth entry exists but could not be turned into a usable key. */
+  | { status: "refresh-failed"; error?: Error };
+
+export async function getPiAuthCredential(options: {
   provider: string;
   authPath: string;
-}): Promise<string | undefined> {
+}): Promise<PiAuthCredential> {
   if (
     process.env.MERCURY_ANTHROPIC_API_KEY ||
     process.env.MERCURY_ANTHROPIC_OAUTH_TOKEN
   ) {
-    return undefined;
+    return { status: "none" };
   }
 
   if (options.provider !== "anthropic") {
-    return undefined;
+    return { status: "none" };
   }
 
   const authPath = options.authPath;
@@ -53,13 +60,15 @@ export async function getApiKeyFromPiAuthFile(options: {
 
   const entry = auth.anthropic;
   if (!entry || typeof entry !== "object" || entry.type !== "oauth") {
-    return undefined;
+    return { status: "none" };
   }
 
   const access = typeof entry.access === "string" ? entry.access : undefined;
   const refresh = typeof entry.refresh === "string" ? entry.refresh : undefined;
   const expires = typeof entry.expires === "number" ? entry.expires : undefined;
-  if (!access || !refresh || typeof expires !== "number") return undefined;
+  if (!access || !refresh || typeof expires !== "number") {
+    return { status: "none" };
+  }
 
   try {
     const result = await getOAuthApiKey("anthropic" satisfies OAuthProviderId, {
@@ -70,7 +79,7 @@ export async function getApiKeyFromPiAuthFile(options: {
       },
     });
 
-    if (!result) return undefined;
+    if (!result) return { status: "refresh-failed" };
 
     const nextAuth = {
       ...auth,
@@ -84,12 +93,24 @@ export async function getApiKeyFromPiAuthFile(options: {
     logger.debug("Loaded anthropic oauth token from pi auth.json", {
       authPath,
     });
-    return result.apiKey;
+    return { status: "ok", apiKey: result.apiKey };
   } catch (error) {
     logger.warn(
       "Failed to load anthropic oauth token from pi auth.json",
       error instanceof Error ? error : undefined,
     );
-    return undefined;
+    return {
+      status: "refresh-failed",
+      error: error instanceof Error ? error : undefined,
+    };
   }
 }
+
+/** Back-compat wrapper: returns the key on success, undefined otherwise. */
+export async function getApiKeyFromPiAuthFile(options: {
+  provider: string;
+  authPath: string;
+}): Promise<string | undefined> {
+  const result = await getPiAuthCredential(options);
+  return result.status === "ok" ? result.apiKey : undefined;
+}