@vellumai/assistant 0.10.2-dev.202606242023.5e459ba → 0.10.2-dev.202606242135.63f618e

package/openapi.yaml

@@ -8408,6 +8408,22 @@ paths:
                                   anyOf:
                                     - type: number
                                     - type: "null"
+                                apiErrorCode:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
+                                apiErrorType:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
+                                apiErrorParam:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
+                                requestId:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
                               additionalProperties: false
                             - type: "null"
                       required:
@@ -15352,6 +15368,22 @@ paths:
                             anyOf:
                               - type: number
                               - type: "null"
+                          apiErrorCode:
+                            anyOf:
+                              - type: string
+                              - type: "null"
+                          apiErrorType:
+                            anyOf:
+                              - type: string
+                              - type: "null"
+                          apiErrorParam:
+                            anyOf:
+                              - type: string
+                              - type: "null"
+                          requestId:
+                            anyOf:
+                              - type: string
+                              - type: "null"
                         additionalProperties: false
                       - type: "null"
                 required:
@@ -17809,6 +17841,22 @@ paths:
                                   anyOf:
                                     - type: number
                                     - type: "null"
+                                apiErrorCode:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
+                                apiErrorType:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
+                                apiErrorParam:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
+                                requestId:
+                                  anyOf:
+                                    - type: string
+                                    - type: "null"
                               additionalProperties: false
                             - type: "null"
                       required:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.2-dev.202606242023.5e459ba",
+  "version": "0.10.2-dev.202606242135.63f618e",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/config-loader-backfill.test.ts

@@ -98,6 +98,64 @@ function writeConfig(obj: unknown): void {
   writeFileSync(CONFIG_PATH, JSON.stringify(obj, null, 2) + "\n");
 }
 
+function latencySeed(): Record<string, unknown> {
+  return {
+    model: "claude-haiku-4-5-20251001",
+    effort: "low",
+    thinking: { enabled: false },
+  };
+}
+
+function fullSeededCallSites(): Record<string, Record<string, unknown>> {
+  return {
+    guardianQuestionCopy: latencySeed(),
+    interactionClassifier: latencySeed(),
+    skillCategoryInference: latencySeed(),
+    inviteInstructionGenerator: latencySeed(),
+    notificationDecision: latencySeed(),
+    preferenceExtraction: latencySeed(),
+    commitMessage: {
+      model: "claude-haiku-4-5-20251001",
+      maxTokens: 120,
+      temperature: 0.2,
+      effort: "low",
+      thinking: { enabled: false },
+    },
+    conversationStarters: latencySeed(),
+    conversationSummarization: {
+      model: "claude-opus-4-7",
+      effort: "low",
+      thinking: { enabled: false },
+    },
+    recall: {
+      profile: "cost-optimized",
+      maxTokens: 4096,
+      effort: "low",
+      thinking: { enabled: false, streamThinking: false },
+      temperature: 0,
+      disableCache: true,
+    },
+    heartbeatAgent: {
+      profile: "cost-optimized",
+      maxTokens: 2048,
+      effort: "low",
+      temperature: 0,
+      thinking: { enabled: false, streamThinking: false },
+      contextWindow: { maxInputTokens: 16000 },
+    },
+    replySuggestion: {
+      model: "claude-haiku-4-5-20251001",
+      effort: "low",
+      thinking: { enabled: false },
+      disableCache: true,
+    },
+    memoryRouter: {
+      profile: "cost-optimized",
+      contextWindow: { maxInputTokens: 1_000_000 },
+    },
+  };
+}
+
 function mergeDefaultConfigAndSeedInferenceProfiles(db?: DrizzleDb): void {
   const defaultConfigMerge = mergeDefaultWorkspaceConfig();
   seedInferenceProfiles({
@@ -372,6 +430,56 @@ describe("loadConfig startup behavior", () => {
     expect(config.memory.v2.bm25_b).toBe(0.4);
   });
 
+  test("default workspace config merge prunes exact seeded call-site defaults", () => {
+    const seededCallSites = fullSeededCallSites();
+    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify(
+        {
+          gateway: {
+            unmappedPolicy: "default",
+            defaultAssistantId: "self",
+          },
+          llm: {
+            activeProfile: "balanced",
+            advisorProfile: "frontier",
+            callSites: {
+              ...seededCallSites,
+              recall: {
+                ...seededCallSites.recall,
+                disableCache: false,
+              },
+              customSite: { profile: "frontier" },
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
+
+    const result = mergeDefaultWorkspaceConfig();
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8")) as Record<
+      string,
+      Record<string, unknown>
+    >;
+    const llm = raw.llm as Record<string, unknown>;
+    const callSites = llm.callSites as Record<string, Record<string, unknown>>;
+
+    expect(result.hadOverlay).toBe(true);
+    expect(raw.gateway).toEqual({
+      unmappedPolicy: "default",
+      defaultAssistantId: "self",
+    });
+    expect(llm.activeProfile).toBe("balanced");
+    expect(llm.advisorProfile).toBe("frontier");
+    expect(Object.keys(callSites).sort()).toEqual(["customSite", "recall"]);
+    expect(callSites.recall?.disableCache).toBe(false);
+    expect(callSites.customSite).toEqual({ profile: "frontier" });
+  });
+
   test("reloads cached config when config.json is updated externally", () => {
     // Models a CLI subprocess writing twilio.accountSid while the assistant
     // process already has an effective config cached in memory.

package/src/__tests__/credential-security-invariants.test.ts

@@ -182,6 +182,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "daemon/handlers/config-slack-channel.ts", // Slack channel config credential management
       "providers/platform-proxy/context.ts", // managed proxy API key lookup for provider initialization
       "platform/client.ts", // platform client credential store fallback for standalone CLI auth
+      "mcp/mcp-header-store.ts", // MCP static auth header persistence (credential store CRUD + legacy migration)
       "mcp/mcp-oauth-provider.ts", // MCP OAuth token/client/discovery persistence
       "runtime/routes/integrations/slack/token.ts", // shared Slack token resolver (bot/user token lookup for CLI use routes)
       "mcp/client.ts", // MCP client cached-token lookup

package/src/__tests__/llm-request-log-error-payload.test.ts

@@ -25,18 +25,15 @@
 import { describe, expect, test } from "bun:test";
 
 import { buildProviderErrorResponsePayload } from "../memory/llm-request-log-store.js";
-import {
-  AssistantError,
-  ErrorCode,
-  ProviderError,
-} from "../util/errors.js";
+import { AssistantError, ErrorCode, ProviderError } from "../util/errors.js";
 
-function persisted(err: Error): { error: Record<string, unknown> } {
+function persisted(err: Error): {
+  error: Record<string, unknown>;
+  rawResponse?: unknown;
+} {
   // Round-trip through JSON to assert on the actual stored shape, not the
   // in-memory object reference.
-  return JSON.parse(
-    JSON.stringify(buildProviderErrorResponsePayload(err)),
-  );
+  return JSON.parse(JSON.stringify(buildProviderErrorResponsePayload(err)));
 }
 
 describe("buildProviderErrorResponsePayload", () => {
@@ -60,6 +57,34 @@ describe("buildProviderErrorResponsePayload", () => {
     });
   });
 
+  test("ProviderError serializes upstream provider error metadata when present", () => {
+    const err = new ProviderError(
+      "OpenAI API error (401): Invalid API key provided",
+      "openai",
+      401,
+      {
+        apiErrorCode: "invalid_api_key",
+        apiErrorType: "invalid_request_error",
+        apiErrorParam: "api_key",
+        requestId: "req_abc123",
+      },
+    );
+    const got = persisted(err);
+    expect(got).toEqual({
+      error: {
+        name: "ProviderError",
+        message: "OpenAI API error (401): Invalid API key provided",
+        code: ErrorCode.PROVIDER_ERROR,
+        provider: "openai",
+        statusCode: 401,
+        apiErrorCode: "invalid_api_key",
+        apiErrorType: "invalid_request_error",
+        apiErrorParam: "api_key",
+        requestId: "req_abc123",
+      },
+    });
+  });
+
   test("ProviderError without optional metadata omits statusCode + retryAfterMs", () => {
     const err = new ProviderError(
       "Gemini API error: surprise internal state",
@@ -127,6 +152,43 @@ describe("buildProviderErrorResponsePayload", () => {
     });
   });
 
+  test("captured JSON rawBody is attached as a parsed rawResponse sibling", () => {
+    // So the inspector's Raw tab can render the actual upstream provider JSON
+    // (like a successful row) instead of only the extracted error fields.
+    const err = new ProviderError(
+      "Together AI API error (400): Model 'MiniMax-M3' is not supported.",
+      "together",
+      400,
+      {
+        apiErrorCode: "model_not_supported",
+        rawBody: JSON.stringify({
+          detail: "Model 'MiniMax-M3' is not supported.",
+        }),
+      },
+    );
+    const got = persisted(err);
+    expect(got.error.apiErrorCode).toBe("model_not_supported");
+    expect(got.rawResponse).toEqual({
+      detail: "Model 'MiniMax-M3' is not supported.",
+    });
+  });
+
+  test("non-JSON rawBody (HTML/text error page) is kept verbatim as a string", () => {
+    const err = new ProviderError("Bad gateway", "openai", 400, {
+      rawBody: "<html><body>upstream timeout</body></html>",
+    });
+    const got = persisted(err);
+    expect(got.rawResponse).toBe("<html><body>upstream timeout</body></html>");
+  });
+
+  test("no captured rawBody omits the rawResponse sibling entirely", () => {
+    const err = new ProviderError("rate limited", "anthropic", 429, {
+      retryAfterMs: 1500,
+    });
+    const got = persisted(err);
+    expect("rawResponse" in got).toBe(false);
+  });
+
   test("ProviderError with statusCode 0 is still recorded (not coerced to undefined)", () => {
     // Defensive: `if (err.statusCode !== undefined)` correctly admits 0.
     // A raw `if (err.statusCode)` would drop it, so the test guards against

package/src/__tests__/openai-provider.test.ts

@@ -58,6 +58,16 @@ let lastConstructorOptions: Record<string, unknown> | null = null;
 let shouldThrow: Error | null = null;
 const DEFAULT_SDK_TIMEOUT_MS = 1_860_000;
 
+// Each provider installs a `fetch` wrapper to capture raw error bodies, so the
+// constructor options carry a `fetch` function; assert the meaningful options
+// via objectContaining and confirm `fetch` is wired.
+function expectOpenAIConstructorOptions(
+  expected: Record<string, unknown>,
+): void {
+  expect(lastConstructorOptions).toEqual(expect.objectContaining(expected));
+  expect(typeof lastConstructorOptions?.fetch).toBe("function");
+}
+
 function userMsg(text: string): Message {
   return { role: "user", content: [{ type: "text", text }] };
 }
@@ -309,7 +319,7 @@ describe("OpenAIProvider", () => {
     });
 
     expect(compatible.name).toBe("ollama");
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "sk-local",
       baseURL: "http://127.0.0.1:11434/v1",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -322,7 +332,7 @@ describe("OpenAIProvider", () => {
       delete process.env.OLLAMA_BASE_URL;
       const ollama = new OllamaProvider("llama3.2");
       expect(ollama.name).toBe("ollama");
-      expect(lastConstructorOptions).toEqual({
+      expectOpenAIConstructorOptions({
         apiKey: "ollama",
         baseURL: "http://127.0.0.1:11434/v1",
         timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -342,7 +352,7 @@ describe("OpenAIProvider", () => {
       process.env.OLLAMA_BASE_URL = "   ";
       const ollama = new OllamaProvider("llama3.2");
       expect(ollama.name).toBe("ollama");
-      expect(lastConstructorOptions).toEqual({
+      expectOpenAIConstructorOptions({
         apiKey: "ollama",
         baseURL: "http://127.0.0.1:11434/v1",
         timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1260,7 +1270,7 @@ describe("custom baseURL initialization", () => {
     });
 
     expect(managed.name).toBe("openai");
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "ast-key-123",
       baseURL: "https://platform.example.com/v1/runtime-proxy/openai",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1270,7 +1280,7 @@ describe("custom baseURL initialization", () => {
   test("OpenAIProvider without baseURL calls provider directly", () => {
     new OpenAIProvider("sk-user-key", "gpt-4o");
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "sk-user-key",
       baseURL: undefined,
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1282,7 +1292,7 @@ describe("custom baseURL initialization", () => {
       streamTimeoutMs: 300_000,
     });
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "sk-user-key",
       baseURL: undefined,
       timeout: 360_000,
@@ -1299,7 +1309,7 @@ describe("custom baseURL initialization", () => {
     );
 
     expect(managed.name).toBe("fireworks");
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "ast-key-123",
       baseURL: "https://platform.example.com/v1/runtime-proxy/fireworks",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1312,7 +1322,7 @@ describe("custom baseURL initialization", () => {
       "accounts/fireworks/models/llama-v3p1-70b-instruct",
     );
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "fw-user-key",
       baseURL: "https://api.fireworks.ai/inference/v1",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1325,7 +1335,7 @@ describe("custom baseURL initialization", () => {
     });
 
     expect(managed.name).toBe("openrouter");
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "ast-key-123",
       baseURL: "https://platform.example.com/v1/runtime-proxy/openrouter",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1335,7 +1345,7 @@ describe("custom baseURL initialization", () => {
   test("OpenRouterProvider without custom baseURL uses default OpenRouter URL", () => {
     new OpenRouterProvider("or-user-key", "openai/gpt-4o");
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "or-user-key",
       baseURL: "https://openrouter.ai/api/v1",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1348,7 +1358,7 @@ describe("custom baseURL initialization", () => {
     });
 
     expect(managed.name).toBe("minimax");
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "ast-key-123",
       baseURL: "https://platform.example.com/v1/runtime-proxy/minimax",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -1358,7 +1368,7 @@ describe("custom baseURL initialization", () => {
   test("MinimaxProvider without custom baseURL uses default MiniMax URL", () => {
     new MinimaxProvider("mm-user-key", "MiniMax-M2.7");
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "mm-user-key",
       baseURL: "https://api.minimax.io/v1",
       timeout: DEFAULT_SDK_TIMEOUT_MS,

package/src/__tests__/openai-responses-provider.test.ts

@@ -24,6 +24,16 @@ let lastConstructorOptions: Record<string, unknown> | null = null;
 let shouldThrow: Error | null = null;
 const DEFAULT_SDK_TIMEOUT_MS = 1_860_000;
 
+// Each provider installs a `fetch` wrapper to capture raw error bodies, so the
+// constructor options carry a `fetch` function; assert the meaningful options
+// via objectContaining and confirm `fetch` is wired.
+function expectOpenAIConstructorOptions(
+  expected: Record<string, unknown>,
+): void {
+  expect(lastConstructorOptions).toEqual(expect.objectContaining(expected));
+  expect(typeof lastConstructorOptions?.fetch).toBe("function");
+}
+
 // Simulate OpenAI.APIError
 class FakeAPIError extends Error {
   status: number;
@@ -218,7 +228,7 @@ describe("OpenAIResponsesProvider", () => {
       providerLabel: "Managed OpenAI",
     });
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "sk-custom",
       baseURL: "https://proxy.example.com/v1",
       timeout: DEFAULT_SDK_TIMEOUT_MS,
@@ -230,7 +240,7 @@ describe("OpenAIResponsesProvider", () => {
       streamTimeoutMs: 300_000,
     });
 
-    expect(lastConstructorOptions).toEqual({
+    expectOpenAIConstructorOptions({
       apiKey: "sk-custom",
       baseURL: undefined,
       timeout: 360_000,

package/src/__tests__/provider-error-scenarios.test.ts

@@ -837,9 +837,10 @@ describe("RetryProvider — streaming response handling", () => {
 
   test("does NOT retry OpenAI/Gemini-shaped 'Request was aborted' (no inner-timeout rewrite at those catch-sites)", async () => {
     // The OpenAI chat-completions, OpenAI responses, and Gemini catch-sites
-    // format their errors as `"<Provider> API error (undefined): Request
-    // was aborted."` (note the `(undefined)` parenthetical that the
-    // Anthropic catch-site intentionally omits) and — unlike the Anthropic
+    // format their errors as `"<Provider> API error (<status>): Request
+    // was aborted."` (the OpenAI catch-sites render a missing status as
+    // `(unknown status)`; the Anthropic catch-site intentionally omits the
+    // parenthetical) and — unlike the Anthropic
     // catch-site — they do NOT rewrite their inner-streamTimeoutMs
     // deadline failures. A provider-agnostic transport-abort predicate
     // would burn three retries on what is by construction a deterministic
@@ -848,7 +849,7 @@ describe("RetryProvider — streaming response handling", () => {
     // wasted retry budget for non-Anthropic providers until their
     // catch-sites grow the same `innerTimeoutFired` distinction.
     const openaiAbortError = new ProviderError(
-      "OpenAI API error (undefined): Request was aborted.",
+      "OpenAI API error (unknown status): Request was aborted.",
       "openai",
       undefined,
     );