Re-apply ledgered Interchange patches onto main HEAD

Every PATCHES.md entry re-carried against 1ad0104 with an as-is / adapt
triage recorded in the ledgers; none was subsumed upstream. Assembly
resolves direct-wins-over-deps for the new contextTransforms field,
harness/reactor adaptations follow the rewritten usage emission and
tryCorrelate regions, and VENDORING.md records the new pin, the loader
provenance row, and the tool-packaging decision.

Author: TheGreatAxios

docs/VENDORING.md

@@ -23,6 +23,7 @@ import {
   SOURCE_MAX_TOKENS,
 } from "./config/index.js";
 import { DIRECTOR_IDS } from "./agent/directors/types.js";
+import { peekSourceCredentialSecret } from "./config/source-credentials.js";
 import type { Config, UnconfiguredConfig } from "./config/index.js";
 import {
   mergeProviderIntoSettings,
@@ -1505,13 +1506,16 @@ describe("buildOpenAISource", () => {
     expect(source.baseURL).toBe("http://localhost:11434/v1");
   });
 
-  test("substitutes a placeholder apiKey when none is provided (keyless)", () => {
+  test("registers the keyless placeholder in the credential cell when none is provided", () => {
     const source = buildOpenAISource({
       id: "local",
       baseURL: "http://localhost:8080/v1",
       model: "local-model",
     });
-    expect(source.apiKey).toBe(KEYLESS_API_KEY);
+    expect(source.credentialId).toBe("local");
+    expect(peekSourceCredentialSecret(source.credentialId)).toBe(
+      KEYLESS_API_KEY,
+    );
   });
 });
 

src/config.test.ts

@@ -29,6 +29,7 @@ import {
 import type { CodexProfile } from "../auth/codex/store.js";
 import type { XaiProfile } from "../auth/xai/store.js";
 import { listCodexProfiles, listXaiProfiles } from "./oauth-stores.js";
+import { registerSourceCredential } from "./source-credentials.js";
 import {
   codexProfilesToCatalogEntries,
   codexProvidersAsSettings,
@@ -105,12 +106,22 @@ import { resolveProfile } from "./profiles.js";
 // revert the ceiling.
 export const SOURCE_MAX_TOKENS = 16384;
 
-// Placeholder sent in the Authorization header for keyless local providers
-// (e.g. Ollama). The runtime's InferenceSource type requires a non-empty
-// apiKey string; the value is injected as `Bearer <key>` by the harness but
-// keyless servers ignore it entirely.
+// Placeholder resolved from the credential cell for keyless local providers
+// (e.g. Ollama). Sources that need no secret register this sentinel; the
+// harness still sends it as `Bearer <key>` but keyless servers ignore it.
 export const KEYLESS_API_KEY = "keyless";
 
+// Registers the secret behind a source id in the credential cell (see
+// ./source-credentials.ts), falling back to the keyless sentinel when no key
+// was configured. Every buildXSource below calls this so the vendored
+// credentialId auth model resolves the secret at send time.
+function registerSourceSecret(id: string, apiKey: string | undefined): void {
+  registerSourceCredential(
+    id,
+    apiKey !== undefined && apiKey.length > 0 ? apiKey : KEYLESS_API_KEY,
+  );
+}
+
 function applyPersistedOAuthDefaults(
   settings: Settings | null,
   projected: Record<string, ProviderSettings>,
@@ -253,16 +264,14 @@ export function buildOpenAISource(fields: {
     fields.reasoningEffort !== undefined
       ? { providerOptions: { reasoning_effort: fields.reasoningEffort } }
       : {};
+  registerSourceSecret(fields.id, fields.apiKey);
   return {
     id: fields.id,
     provider: "openai-compatible",
     baseURL: isOllamaProviderId(fields.id)
       ? ollamaOpenAIBaseURL(fields.baseURL)
       : normalizeOpenAICompatibleBaseURL(fields.baseURL),
-    apiKey:
-      fields.apiKey !== undefined && fields.apiKey.length > 0
-        ? fields.apiKey
-        : KEYLESS_API_KEY,
+    credentialId: fields.id,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS, ...overrides },
     ...(fields.quirks !== undefined ? { quirks: fields.quirks } : {}),
@@ -318,7 +327,8 @@ export type ProviderCatalogEntry = Omit<
 // "codex-responses" adapter (the Codex backend speaks the Responses API, not
 // Chat Completions) and carries the account id + a session id through
 // providerOptions, where the adapter lifts them into request headers. The
-// access token is the apiKey; the harness injects it as the bearer credential.
+// access token is registered in the credential cell under the source id; the
+// harness resolves it as the bearer credential at send time.
 export function buildCodexSource(fields: {
   id: string;
   apiKey: string;
@@ -334,19 +344,21 @@ export function buildCodexSource(fields: {
     providerOptions[CODEX_ACCOUNT_ID_OPTION] = fields.accountId;
   if (fields.reasoningEffort !== undefined)
     providerOptions["reasoning_effort"] = fields.reasoningEffort;
+  registerSourceSecret(fields.id, fields.apiKey);
   return {
     id: fields.id,
     provider: CODEX_RESPONSES_PROVIDER,
     baseURL: CODEX_BASE_URL,
-    apiKey: fields.apiKey,
+    credentialId: fields.id,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS, providerOptions },
   };
 }
 
 // Build the InferenceSource for an xAI/Grok OAuth profile. Routes to the
 // "grok-responses" adapter (the grok-cli proxy speaks the Responses API, not
-// Chat Completions). The access token is the apiKey; the caller's user id is
+// Chat Completions). The access token is registered in the credential cell
+// under the source id; the caller's user id is
 // decoded from it and lifted into the x-grok-user-id header by the adapter.
 // The session id becomes the request's prompt_cache_key so every call in the
 // thread routes to the same cache shard (store:false has no other signal).
@@ -364,11 +376,12 @@ export function buildXaiSource(fields: {
   if (userId !== undefined) providerOptions[GROK_USER_ID_OPTION] = userId;
   if (fields.reasoningEffort !== undefined)
     providerOptions["reasoning_effort"] = fields.reasoningEffort;
+  registerSourceSecret(fields.id, fields.apiKey);
   return {
     id: fields.id,
     provider: GROK_RESPONSES_PROVIDER,
     baseURL: XAI_BASE_URL,
-    apiKey: fields.apiKey,
+    credentialId: fields.id,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS, providerOptions },
   };
@@ -388,14 +401,12 @@ export function buildBifrostSource(fields: {
     fields.reasoningEffort !== undefined
       ? { providerOptions: { reasoning_effort: fields.reasoningEffort } }
       : {};
+  registerSourceSecret(fields.id, fields.apiKey);
   return {
     id: fields.id,
     provider: BIFROST_PROVIDER,
     baseURL: normalizeOpenAICompatibleBaseURL(fields.baseURL),
-    apiKey:
-      fields.apiKey !== undefined && fields.apiKey.length > 0
-        ? fields.apiKey
-        : KEYLESS_API_KEY,
+    credentialId: fields.id,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS, ...overrides },
   };
@@ -408,14 +419,12 @@ export function buildAnthropicSource(fields: {
   apiKey?: string;
   model: string;
 }): InferenceSource {
+  registerSourceSecret(fields.id, fields.apiKey);
   return {
     id: fields.id,
     provider: "anthropic",
     baseURL: fields.baseURL.replace(/\/+$/, ""),
-    apiKey:
-      fields.apiKey !== undefined && fields.apiKey.length > 0
-        ? fields.apiKey
-        : KEYLESS_API_KEY,
+    credentialId: fields.id,
     model: fields.model,
     defaults: { maxTokens: SOURCE_MAX_TOKENS },
   };
@@ -431,16 +440,13 @@ export function buildGoSource(fields: {
   reasoningEffort?: ReasoningEffort;
 }): InferenceSource {
   const endpoint = resolveGoEndpoint(fields.model);
-  const apiKey =
-    fields.apiKey !== undefined && fields.apiKey.length > 0
-      ? fields.apiKey
-      : KEYLESS_API_KEY;
+  registerSourceSecret(fields.id, fields.apiKey);
   if (endpoint.adapter === "anthropic") {
     return {
       id: fields.id,
       provider: OPENCODE_GO_MESSAGES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: fields.id,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -455,7 +461,7 @@ export function buildGoSource(fields: {
       id: fields.id,
       provider: OPENAI_RESPONSES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: fields.id,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -471,7 +477,7 @@ export function buildGoSource(fields: {
     id: fields.id,
     baseURL:
       endpoint.baseURL.length > 0 ? endpoint.baseURL : OPENCODE_GO_BASE_URL,
-    apiKey,
+    ...(fields.apiKey !== undefined ? { apiKey: fields.apiKey } : {}),
     model: fields.model,
     ...(fields.reasoningEffort !== undefined
       ? { reasoningEffort: fields.reasoningEffort }
@@ -500,16 +506,13 @@ export function buildZenSource(fields: {
   reasoningEffort?: ReasoningEffort;
 }): InferenceSource {
   const endpoint = resolveZenEndpoint(fields.model);
-  const apiKey =
-    fields.apiKey !== undefined && fields.apiKey.length > 0
-      ? fields.apiKey
-      : KEYLESS_API_KEY;
+  registerSourceSecret(fields.id, fields.apiKey);
   if (endpoint.adapter === "anthropic") {
     return {
       id: fields.id,
       provider: ZEN_MESSAGES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: fields.id,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -524,7 +527,7 @@ export function buildZenSource(fields: {
       id: fields.id,
       provider: OPENAI_RESPONSES_PROVIDER,
       baseURL: endpoint.baseURL,
-      apiKey,
+      credentialId: fields.id,
       model: fields.model,
       defaults: {
         maxTokens: SOURCE_MAX_TOKENS,
@@ -540,7 +543,7 @@ export function buildZenSource(fields: {
     id: fields.id,
     baseURL:
       endpoint.baseURL.length > 0 ? endpoint.baseURL : ZEN_DEFAULT_BASE_URL,
-    apiKey,
+    ...(fields.apiKey !== undefined ? { apiKey: fields.apiKey } : {}),
     model: fields.model,
     ...(fields.reasoningEffort !== undefined
       ? { reasoningEffort: fields.reasoningEffort }

src/config/index.ts

@@ -0,0 +1,48 @@
+// First-party credential cell backing the vendored inference auth model.
+//
+// Since the 1ad0104 re-vendor, `InferenceSource` carries no inline secret:
+// it names a `credentialId` and every send resolves the secret through a
+// `CredentialMaterialResolver` ("credential cell" in upstream terms — read
+// `CredentialMaterialResolver`'s doc comment in the vendored
+// `@intx/types`). This module is that cell for first-party API-key and
+// OAuth access-token sources: each `buildXSource` in `./index.ts` registers
+// the secret it was built with under the source id, and the inference entry
+// points (`assemble-runtime`, subagent run, summarizer fallback) hand
+// `readSourceCredentialMaterial` to the vendored trees as their resolver.
+//
+// Keyed by source id because ids are unique per live source within a
+// process. The map lives at module scope so sources built in one layer
+// (config) resolve in another (agent env, reactor options) without threading
+// secrets through every intermediate shape.
+import type { CredentialMaterialResolver } from "@intx/types";
+
+const cell = new Map<string, string>();
+
+export function registerSourceCredential(
+  credentialId: string,
+  secret: string,
+): void {
+  cell.set(credentialId, secret);
+}
+
+/** The resolver handed to vendored inference calls. Fails closed. */
+export const readSourceCredentialMaterial: CredentialMaterialResolver = (
+  credentialId: string,
+) => {
+  const secret = cell.get(credentialId);
+  if (secret === undefined)
+    throw new Error(`Unknown inference credential "${credentialId}".`);
+  return { secret };
+};
+
+/** Non-throwing read for "did the token change?" comparisons. */
+export function peekSourceCredentialSecret(
+  credentialId: string,
+): string | undefined {
+  return cell.get(credentialId);
+}
+
+/** Test seam: empties the cell between cases. */
+export function clearSourceCredentials(): void {
+  cell.clear();
+}

src/config/source-credentials.ts

@@ -953,7 +953,7 @@ describe("createPruningCompactor — consolidated handoff (CL-7521)", () => {
       provider: "openai",
       model: "test-model",
       baseURL: "http://localhost:1",
-      apiKey: "k",
+      credentialId: "test",
     };
     let calls = 0;
     const summarize = createModelSummarizer({

src/context-compactor.test.ts

@@ -14,6 +14,10 @@ import {
   isCodexProviderName,
 } from "../config/codex-providers.js";
 import { xaiProfileFromProviderName } from "../config/xai-providers.js";
+import {
+  peekSourceCredentialSecret,
+  registerSourceCredential,
+} from "../config/source-credentials.js";
 import { formatDirectorSystemPrompt } from "../agent/directors/identity.js";
 import { DIRECTOR_REGISTRY } from "../agent/directors/registry.js";
 import type { DirectorId, DirectorPackage } from "../agent/directors/types.js";
@@ -772,7 +776,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
       const { access } = await refreshSelectedProviderCredential(() =>
         getValidCodexToken(initialCodexProfile),
       );
-      liveSource = { ...liveSource, apiKey: access };
+      registerSourceCredential(liveSource.credentialId, access);
       liveSubAgentProvider.current = {
         ...liveSubAgentProvider.current,
         apiKey: access,
@@ -782,7 +786,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
       const { access } = await refreshSelectedProviderCredential(() =>
         getValidXaiToken(initialXaiProfile),
       );
-      liveSource = { ...liveSource, apiKey: access };
+      registerSourceCredential(liveSource.credentialId, access);
       liveSubAgentProvider.current = {
         ...liveSubAgentProvider.current,
         apiKey: access,
@@ -798,12 +802,13 @@ export async function runExec(config: Config): Promise<ExecResult> {
       // A 401 here usually means the shared OAuth file rotated under another
       // process; re-read it so the retry runs on the fresh token.
       refreshAuth: async () => {
+        const before = peekSourceCredentialSecret(liveSource.credentialId);
         const fresh = await ensureFreshInferenceSource(
           liveSource,
           config.providers,
         );
-        if (fresh.apiKey === liveSource.apiKey) return;
         liveSource = fresh;
+        if (peekSourceCredentialSecret(fresh.credentialId) === before) return;
         if (currentAgent !== null)
           setAgentSourceUnlessClosed(currentAgent, fresh);
       },
@@ -859,10 +864,10 @@ export async function runExec(config: Config): Promise<ExecResult> {
       inferenceDeps,
       getSources: () => {
         const sources = liveSources.length > 0 ? liveSources : [liveSource];
-        // Prefer liveSource credentials on the active id when OAuth was refreshed.
-        return sources.map((s) =>
-          s.id === liveSource.id ? { ...s, apiKey: liveSource.apiKey } : s,
-        );
+        // OAuth refreshes land in the shared credential cell (keyed by source
+        // id), so every source already resolves the live secret — no per-send
+        // credential copy is needed.
+        return sources;
       },
       getDefaultSource: () =>
         liveDefaultSource.length > 0 ? liveDefaultSource : liveSource.id,
@@ -1005,15 +1010,15 @@ export async function runExec(config: Config): Promise<ExecResult> {
       // Final OAuth refresh immediately before send (token may have aged during MCP).
       if (initialCodexProfile !== undefined) {
         const { access } = await getValidCodexToken(initialCodexProfile);
-        if (access !== liveSource.apiKey) {
-          liveSource = { ...liveSource, apiKey: access };
+        if (access !== peekSourceCredentialSecret(liveSource.credentialId)) {
+          registerSourceCredential(liveSource.credentialId, access);
           setAgentSourceUnlessClosed(activeAgent, liveSource);
         }
       }
       if (initialXaiProfile !== undefined) {
         const { access } = await getValidXaiToken(initialXaiProfile);
-        if (access !== liveSource.apiKey) {
-          liveSource = { ...liveSource, apiKey: access };
+        if (access !== peekSourceCredentialSecret(liveSource.credentialId)) {
+          registerSourceCredential(liveSource.credentialId, access);
           setAgentSourceUnlessClosed(activeAgent, liveSource);
         }
       }

src/exec/runner.ts

@@ -219,7 +219,7 @@ function stubChatAgentWiring(
         id: "s",
         provider: "test",
         baseURL: "http://localhost",
-        apiKey: "k",
+        credentialId: "s",
         model: "m",
       },
     ],