chore(vendor): re-pin Interchange trees to main head with the director loader

Author: TheGreatAxios

docs/VENDORING.md

@@ -1514,13 +1514,13 @@ describe("buildOpenAISource", () => {
     expect(source.baseURL).toBe("http://localhost:11434/v1");
   });
 
-  test("substitutes a placeholder apiKey when none is provided (keyless)", () => {
+  test("substitutes a placeholder credentialId when none is provided (keyless)", () => {
     const source = buildOpenAISource({
       id: "local",
       baseURL: "http://localhost:8080/v1",
       model: "local-model",
     });
-    expect(source.apiKey).toBe(KEYLESS_API_KEY);
+    expect(source.credentialId).toBe(KEYLESS_API_KEY);
   });
 });
 

src/config.test.ts

@@ -0,0 +1,9 @@
+import type { CredentialMaterialResolver } from "@intx/types";
+
+// Every source builder in `src/config` stores secret material directly in
+// `credentialId` (API keys, OAuth access tokens, the keyless placeholder), so
+// resolving a credential is an identity read. A live credential cell would
+// replace this; until then the resolver echoes the id.
+export const resolveInlineCredentialMaterial: CredentialMaterialResolver = (
+  credentialId,
+) => ({ secret: credentialId });

src/config/credential-material.ts

@@ -107,7 +107,7 @@ export const SOURCE_MAX_TOKENS = 16384;
 
 // Placeholder sent in the Authorization header for keyless local providers
 // (e.g. Ollama). The runtime's InferenceSource type requires a non-empty
-// apiKey string; the value is injected as `Bearer <key>` by the harness but
+// credentialId string; the value is injected as `Bearer <key>` by the harness but
 // keyless servers ignore it entirely.
 export const KEYLESS_API_KEY = "keyless";
 
@@ -259,7 +259,7 @@ export function buildOpenAISource(fields: {
     baseURL: isOllamaProviderId(fields.id)
       ? ollamaOpenAIBaseURL(fields.baseURL)
       : normalizeOpenAICompatibleBaseURL(fields.baseURL),
-    apiKey:
+    credentialId:
       fields.apiKey !== undefined && fields.apiKey.length > 0
         ? fields.apiKey
         : KEYLESS_API_KEY,
@@ -338,7 +338,7 @@ export function buildCodexSource(fields: {
     id: fields.id,
     provider: CODEX_RESPONSES_PROVIDER,
     baseURL: CODEX_BASE_URL,
-    apiKey: fields.apiKey,
+    credentialId: fields.apiKey,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS, providerOptions },
   };
@@ -368,7 +368,7 @@ export function buildXaiSource(fields: {
     id: fields.id,
     provider: GROK_RESPONSES_PROVIDER,
     baseURL: XAI_BASE_URL,
-    apiKey: fields.apiKey,
+    credentialId: fields.apiKey,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS, providerOptions },
   };
@@ -392,7 +392,7 @@ export function buildBifrostSource(fields: {
     id: fields.id,
     provider: BIFROST_PROVIDER,
     baseURL: normalizeOpenAICompatibleBaseURL(fields.baseURL),
-    apiKey:
+    credentialId:
       fields.apiKey !== undefined && fields.apiKey.length > 0
         ? fields.apiKey
         : KEYLESS_API_KEY,
@@ -412,7 +412,7 @@ export function buildAnthropicSource(fields: {
     id: fields.id,
     provider: "anthropic",
     baseURL: fields.baseURL.replace(/\/+$/, ""),
-    apiKey:
+    credentialId:
       fields.apiKey !== undefined && fields.apiKey.length > 0
         ? fields.apiKey
         : KEYLESS_API_KEY,
@@ -440,7 +440,7 @@ export function buildGoSource(fields: {
       id: fields.id,
       provider: OPENCODE_GO_MESSAGES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: apiKey,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -455,7 +455,7 @@ export function buildGoSource(fields: {
       id: fields.id,
       provider: OPENAI_RESPONSES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: apiKey,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -509,7 +509,7 @@ export function buildZenSource(fields: {
       id: fields.id,
       provider: ZEN_MESSAGES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: apiKey,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -524,7 +524,7 @@ export function buildZenSource(fields: {
       id: fields.id,
       provider: OPENAI_RESPONSES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: apiKey,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,

src/config/index.ts

@@ -953,7 +953,7 @@ describe("createPruningCompactor — consolidated handoff (CL-7521)", () => {
       provider: "openai",
       model: "test-model",
       baseURL: "http://localhost:1",
-      apiKey: "k",
+      credentialId: "k",
     };
     let calls = 0;
     const summarize = createModelSummarizer({

src/context-compactor.test.ts

@@ -772,7 +772,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
       const { access } = await refreshSelectedProviderCredential(() =>
         getValidCodexToken(initialCodexProfile),
       );
-      liveSource = { ...liveSource, apiKey: access };
+      liveSource = { ...liveSource, credentialId: access };
       liveSubAgentProvider.current = {
         ...liveSubAgentProvider.current,
         apiKey: access,
@@ -782,7 +782,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
       const { access } = await refreshSelectedProviderCredential(() =>
         getValidXaiToken(initialXaiProfile),
       );
-      liveSource = { ...liveSource, apiKey: access };
+      liveSource = { ...liveSource, credentialId: access };
       liveSubAgentProvider.current = {
         ...liveSubAgentProvider.current,
         apiKey: access,
@@ -802,7 +802,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
           liveSource,
           config.providers,
         );
-        if (fresh.apiKey === liveSource.apiKey) return;
+        if (fresh.credentialId === liveSource.credentialId) return;
         liveSource = fresh;
         if (currentAgent !== null)
           setAgentSourceUnlessClosed(currentAgent, fresh);
@@ -861,7 +861,9 @@ export async function runExec(config: Config): Promise<ExecResult> {
         const sources = liveSources.length > 0 ? liveSources : [liveSource];
         // Prefer liveSource credentials on the active id when OAuth was refreshed.
         return sources.map((s) =>
-          s.id === liveSource.id ? { ...s, apiKey: liveSource.apiKey } : s,
+          s.id === liveSource.id
+            ? { ...s, credentialId: liveSource.credentialId }
+            : s,
         );
       },
       getDefaultSource: () =>
@@ -1005,15 +1007,15 @@ export async function runExec(config: Config): Promise<ExecResult> {
       // Final OAuth refresh immediately before send (token may have aged during MCP).
       if (initialCodexProfile !== undefined) {
         const { access } = await getValidCodexToken(initialCodexProfile);
-        if (access !== liveSource.apiKey) {
-          liveSource = { ...liveSource, apiKey: access };
+        if (access !== liveSource.credentialId) {
+          liveSource = { ...liveSource, credentialId: access };
           setAgentSourceUnlessClosed(activeAgent, liveSource);
         }
       }
       if (initialXaiProfile !== undefined) {
         const { access } = await getValidXaiToken(initialXaiProfile);
-        if (access !== liveSource.apiKey) {
-          liveSource = { ...liveSource, apiKey: access };
+        if (access !== liveSource.credentialId) {
+          liveSource = { ...liveSource, credentialId: access };
           setAgentSourceUnlessClosed(activeAgent, liveSource);
         }
       }

src/exec/runner.ts

@@ -219,7 +219,7 @@ function stubChatAgentWiring(
         id: "s",
         provider: "test",
         baseURL: "http://localhost",
-        apiKey: "k",
+        credentialId: "k",
         model: "m",
       },
     ],

src/session/assemble-runtime.test.ts

@@ -40,6 +40,7 @@ import {
   type LocalSettings,
 } from "../config/settings.js";
 import type { SessionMode } from "../config/session-mode.js";
+import { resolveInlineCredentialMaterial } from "../config/credential-material.js";
 import {
   advertisedTools,
   advertisedToolNamesForSessionMode,
@@ -578,6 +579,7 @@ export function assembleChatAgent(wiring: ChatAgentWiring): AssembledChatAgent {
     const agent = await createAgentWithLiveToolDispatch(agentDef, {
       sources: wiring.getSources(),
       defaultSource: wiring.getDefaultSource(),
+      readCurrentMaterial: resolveInlineCredentialMaterial,
       storage: storageForAgent,
       workdir,
       // contextTransforms ride deps: the published @intx/agent forwards deps

src/session/assemble-runtime.ts

@@ -19,6 +19,7 @@ import {
   type RetryPolicy,
 } from "@intx/types/runtime";
 import { LOG_NAMESPACE_ROOT } from "../branding.js";
+import { resolveInlineCredentialMaterial } from "../config/credential-material.js";
 import { NOOP_TELEMETRY, type Telemetry } from "../telemetry/index.js";
 import {
   buildArchiveSummaryExcerpt,
@@ -200,6 +201,7 @@ function defaultComplete(deps: Dependencies, timeoutMs: number): CompletionFn {
       signal,
       nextSeq: () => seq++,
       deps,
+      readMaterial: resolveInlineCredentialMaterial,
       inferenceOptions: {
         totalTimeoutMs: timeoutMs,
         retryPolicy: NO_HARNESS_RETRY,

src/session/summarizer.ts

@@ -4,11 +4,11 @@ import * as xaiSession from "../auth/xai/session.js";
 
 import type { InferenceSource } from "@intx/types/runtime";
 
-const baseSource = (id: string, apiKey = "stale"): InferenceSource => ({
+const baseSource = (id: string, credentialId = "stale"): InferenceSource => ({
   id,
   provider: "openai",
   baseURL: "https://api.openai.com/v1",
-  apiKey,
+  credentialId,
   model: "gpt-4o",
 });
 
@@ -18,15 +18,15 @@ describe("refresh-inference-source", () => {
     spyOn(xaiSession, "getValidXaiToken").mockRestore();
   });
 
-  test("ensureFreshInferenceSource replaces stale Codex apiKey after refresh", async () => {
+  test("ensureFreshInferenceSource replaces stale Codex credentialId after refresh", async () => {
     spyOn(codexSession, "getValidCodexToken").mockResolvedValue({
       access: "fresh-codex-token",
     });
     const { ensureFreshInferenceSource } =
       await import("./refresh-inference-source.js");
     const source = baseSource("codex/default", "stale");
     const out = await ensureFreshInferenceSource(source, []);
-    expect(out.apiKey).toBe("fresh-codex-token");
+    expect(out.credentialId).toBe("fresh-codex-token");
   });
 
   test("refreshInferenceSourceBundle refreshes each leg", async () => {
@@ -53,6 +53,6 @@ describe("refresh-inference-source", () => {
         apiKey: "key-abc",
       },
     ]);
-    expect(out.apiKey).toBe("key-abc");
+    expect(out.credentialId).toBe("key-abc");
   });
 });