Skip to content

Keep a second credential error from failing the session #926

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheGreatAxios merged 3 commits into from
Sep 12, 2026
Merged

Keep a second credential error from failing the session #926

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
40da15d
Keep a second credential error from failing the session
TheGreatAxios Sep 12, 2026
bc81652
Ledger vendor error sequence patches
TheGreatAxios Sep 12, 2026
a4d20d9
Drop only the colliding error record on a duplicate flush
TheGreatAxios Sep 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 35 additions & 31 deletions docs/VENDORING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,19 +22,19 @@ points straight at `./src/*.ts` files rather than a `dist/` build.

## What's vendored

| Package | Vendor path | License | Synced from upstream commit | Retrieved | Local patches |
| -------------------------------------------------- | ------------------------------------- | ------------- | ------------------------------------------ | ---------- | -------------------------------------------- |
| `@intx/inference` | `vendor/intx-inference/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-inference/PATCHES.md` |
| `@intx/types` | `vendor/intx-types/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/storage-isogit` | `vendor/intx-storage-isogit/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/agent` | `vendor/intx-agent/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/authz` | `vendor/intx-authz/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/log` | `vendor/intx-log/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/tools-posix` | `vendor/intx-tools-posix/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/mailbox` | `vendor/intx-mailbox/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/harness` | `vendor/intx-harness/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/mime` | `vendor/intx-mime/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/workflow-host` (partial — `adapters/` only) | `vendor/intx-workflow-host/adapters/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| Package | Vendor path | License | Synced from upstream commit | Retrieved | Local patches |
| -------------------------------------------------- | ------------------------------------- | ------------- | ------------------------------------------ | ---------- | ------------------------------------------------- |
| `@intx/inference` | `vendor/intx-inference/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-inference/PATCHES.md` |
| `@intx/types` | `vendor/intx-types/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-types/PATCHES.md` |
| `@intx/storage-isogit` | `vendor/intx-storage-isogit/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-storage-isogit/PATCHES.md` |
| `@intx/agent` | `vendor/intx-agent/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | Yes — see `vendor/intx-agent/PATCHES.md` |
| `@intx/authz` | `vendor/intx-authz/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/log` | `vendor/intx-log/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/tools-posix` | `vendor/intx-tools-posix/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/mailbox` | `vendor/intx-mailbox/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/harness` | `vendor/intx-harness/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/mime` | `vendor/intx-mime/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |
| `@intx/workflow-host` (partial — `adapters/` only) | `vendor/intx-workflow-host/adapters/` | LGPL-2.1-only | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | 2026-09-07 | None — verbatim |

## Provenance, ownership, and kill dates

Expand All @@ -48,9 +48,9 @@ package; the date is the deadline even if it is not.
| Vendor path | Upstream repo | Upstream commit | Patched | Why not the published package | Owner | Proposed kill date |
| ------------------------------------- | ----------------------- | ------------------------------------------ | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------ |
| `vendor/intx-inference/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | Yes — `PATCHES.md` | Local fixes not yet upstream | runtime | 2027-03-07 or when patches land upstream and publish |
| `vendor/intx-types/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No | Cross-package coupling with `@intx/inference` | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0` |
| `vendor/intx-storage-isogit/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No | Cross-package coupling with `@intx/inference` | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0` |
| `vendor/intx-agent/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No | Vendored at Interchange head ahead of npm | runtime | 2027-03-07 or when `@intx/agent@>=0.4.0` publishes |
| `vendor/intx-types/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | Yes — `PATCHES.md` | Cross-package coupling with `@intx/inference` | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0` |
| `vendor/intx-storage-isogit/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | Yes — `PATCHES.md` | Cross-package coupling with `@intx/inference` | runtime | 2027-03-07 or when the coupled trio publishes past `0.3.0` |
| `vendor/intx-agent/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | Yes — `PATCHES.md` | Vendored at Interchange head ahead of npm | runtime | 2027-03-07 or when `@intx/agent@>=0.4.0` publishes |
| `vendor/intx-authz/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No | Vendored at Interchange head ahead of npm | runtime | 2027-03-07 or when `@intx/authz@>=0.4.0` publishes |
| `vendor/intx-log/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No | Vendored at Interchange head ahead of npm | runtime | 2027-03-07 or when `@intx/log@>=0.4.0` publishes |
| `vendor/intx-tools-posix/` | `faremeter/interchange` | `0205b07b64d03f0fec2e4be3593c764070a9ba8a` | No | Vendored at Interchange head ahead of npm | runtime | 2027-03-07 or when `@intx/tools-posix@>=0.4.0` publishes |
Expand Down Expand Up @@ -118,9 +118,11 @@ The 2026-09-07 sync also vendored the remaining four consumed packages
(`@intx/agent`, `@intx/authz`, `@intx/log`, `@intx/tools-posix`) at the
same upstream commit, completing the set: every `@intx/*` package this
repo imports now resolves to vendored source. None of the four carried
local patches at vendoring time; their trees are verbatim upstream
copies. `@intx/tools-lsp` remains on published npm (`0.3.0`) — it is a
thin adapter whose transitive `@intx/*` dependencies resolve to the
local patches at vendoring time. `@intx/agent` later gained the error-seq
patches ledgered in `vendor/intx-agent/PATCHES.md`; the other three remain
verbatim upstream copies. `@intx/tools-lsp` remains on published npm
(`0.3.0`) — it is a thin adapter whose transitive `@intx/*` dependencies
resolve to the
vendored workspaces via root `overrides`, so it tracks the vendored set
without being vendored itself. Published transitive dependencies that
stay on npm (`@intx/crypto`, `@intx/inference-discovery`,
Expand Down Expand Up @@ -187,13 +189,14 @@ those packages now resolves to the single root instance. As of this sync,

## Patched vs. verbatim

Of the eleven vendored paths, exactly one carries local patches:
`@intx/inference` — every divergence is a real fix not yet upstream, listed
one-per-patch in `vendor/intx-inference/PATCHES.md`. The other ten paths
(nine whole packages plus the partial `vendor/intx-workflow-host/adapters/`
Of the eleven vendored paths, four carry local patches:
`@intx/inference`, `@intx/types`, `@intx/storage-isogit`, and
`@intx/agent` — every divergence is a real fix not yet upstream, listed
one-per-patch in that package's `PATCHES.md`. The other seven paths
(six whole packages plus the partial `vendor/intx-workflow-host/adapters/`
tree) are verbatim copies of upstream — no modifications. A diff against a
pristine upstream checkout at the same commit and paths will show 100%
upstream-authored lines.
upstream-authored lines for those seven.

## Notable upstream shape changes carried by the 2026-08-22 sync

Expand Down Expand Up @@ -229,12 +232,12 @@ different reason — the vendored mime sources import `@intx/crypto`, which
stays on published npm, and `Bun.build` cannot resolve that bare specifier
from inside the vendor workspace.

`@intx/inference` carries local patches — real fixes not yet present
upstream, not workarounds for something upstream has since fixed. Every
patched location carries a one-line comment naming its site-specific entry
in `vendor/intx-inference/PATCHES.md` (e.g. `#reactor-ts-correlating-ids-leak`),
so `grep -rn "Locally patched" vendor/intx-inference/src` finds every
divergence. **Markers are navigation; the SHA-diff is proof.** Run
Patched packages carry local fixes not yet present upstream, not
workarounds for something upstream has since fixed. Every patched
location carries a one-line comment naming its site-specific entry in
that package's `PATCHES.md` (e.g. `#reactor-ts-correlating-ids-leak`),
so `grep -rn "Locally patched" vendor/*/src` finds every divergence.
**Markers are navigation; the SHA-diff is proof.** Run
`bin/vendor-patch-diff` against a pristine upstream checkout at the
recorded SHA to print exactly the lines that are ours. A correspondence
test (`tests/unit/vendor-patch-ledger.test.ts`) fails if a marker anchor
Expand All @@ -253,7 +256,8 @@ does not resolve to a ledger heading, or if a ledger heading has no marker.
`adapters/substrate-mailbox-store.ts` and
`adapters/substrate-mailbox-store.test.ts`). Run
`bun install`, `bun run typecheck`, `bun run build`, `bun run test`.
3. For a **patched** package (`@intx/inference`): before overwriting
3. For a **patched** package (`@intx/inference`, `@intx/types`,
`@intx/storage-isogit`, `@intx/agent`): before overwriting
anything, run `bin/vendor-patch-diff` (optionally
`--upstream /path/to/interchange`) to re-derive the exact local
divergences against the recorded SHA — do not trust `PATCHES.md`'s
Expand Down
1 change: 1 addition & 0 deletions src/session/assemble-runtime.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,7 @@ function stubAuditStore(): AuditStore {
commitAudit: async () => undefined,
commitErrors: async () => undefined,
loadAudit: async () => [],
loadErrors: async () => [],
};
}

Expand Down
1 change: 1 addition & 0 deletions src/session/optimized-context-store.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -800,6 +800,7 @@ describe("createSessionStores", () => {
expect(typeof audit.commitAudit).toBe("function");
expect(typeof audit.commitErrors).toBe("function");
expect(typeof audit.loadAudit).toBe("function");
expect(typeof audit.loadErrors).toBe("function");
});
});

Expand Down
1 change: 1 addition & 0 deletions src/session/optimized-context-store.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -848,6 +848,7 @@ export async function createSessionStores(
commitErrors: (records, signal) =>
withResolvedDirLock(dir, () => base.commitErrors(records, signal)),
loadAudit: (sessionId, signal) => base.loadAudit(sessionId, signal),
loadErrors: (sessionId, signal) => base.loadErrors(sessionId, signal),
};

return { storage: store, audit: store };
Expand Down
42 changes: 42 additions & 0 deletions vendor/intx-agent/PATCHES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# Patch ledger — vendor/intx-agent

**The SHA-diff is authoritative; markers are navigation.**

Recorded upstream commit lives in `docs/VENDORING.md`. A pristine checkout
at that SHA, diffed against `vendor/intx-agent/src`, is the only proof of
which lines are ours — run `bin/vendor-patch-diff` to produce it. The
`Locally patched — see …#<anchor>` comments and the entries below are
signposts that point into that diff; they do not define its extent.

## agent-ts-resume-error-seq

`agent.ts` — `createAgent` resumes `errorSeq` from `auditStore.loadErrors`
so a rebuilt agent does not reuse seq 0 and collide with files the
previous assembly already committed. If `loadErrors` throws, assembly
still succeeds and seq starts at 0; a later colliding flush is dropped
by `agent-ts-duplicate-error-flush` rather than failing the session.

**Disposition:** Promotion candidate. **Removal path:** Upstream PR to
`createAgent` that resumes the durable error sequence; then drop this
entry and its marker.

## agent-ts-duplicate-error-flush

`agent.ts` — `flushErrors` treats `Duplicate error record:` from
`commitErrors` as already-durable instead of failing `afterCheckpoint`.
Only the record named by the colliding `<sessionId>/<seq>-<category>`
key is dropped; the rest of the batch is retried in the same flush, so
a stale-seq assembly flushing `[seq0/dup, seq1/fresh]` still persists
the fresh record. An unparseable key falls back to dropping the batch.
Identical-bytes exact retries still commit normally upstream.

**Disposition:** Promotion candidate. **Removal path:** Upstream PR with
the same duplicate-flush handling; then drop this entry and its marker.

## testing-audit-noop-ts-load-errors

`testing/audit-noop.ts` — No-op `AuditStore` implements `loadErrors` as
an empty array so it satisfies the patched `AuditStore` contract.

**Disposition:** Companion of `runtime-ts-audit-store-load-errors`.
**Removal path:** Ships out with the types patch.
Loading
Loading