@sema-agent/core/dist/core/runner/credential-origin-seat.js

Stateless, task-oriented AI agent core

import { runWithCredentialOriginRefusals } from "../../brain/status-sink.js";
import { deliverEngineNotice } from "../engine-notice.js";
export function createCredentialOriginRefusalScope({ onNotice, sessionId, runId }) {
    const announced = new Set();
    return (fn) => runWithCredentialOriginRefusals(({ modelId, boundOrigin, requestOrigin }) => {
        const key = `${modelId}\u0000${boundOrigin}\u0000${requestOrigin}`;
        if (announced.has(key))
            return;
        announced.add(key);
        deliverEngineNotice(onNotice, {
            code: "route.credential_origin_mismatch",
            message: `A request for model "${modelId}" was not sent: the model's own credential belongs to ${boundOrigin}, the host it was ` +
                `first sent to, and this request was going to ${requestOrigin}. A credential does not follow its model to another host — ` +
                `the deployment has to give the model a credential for ${requestOrigin} (or point it back at ${boundOrigin}). ` +
                `Said once per run for this model and these two hosts.`,
            detail: { modelId, boundOrigin, requestOrigin, sessionId, runId },
        });
    }, fn);
}