@vellumai/assistant 0.10.6-staging.1 → 0.10.6

package/src/providers/inference/__tests__/connections-label.test.ts

@@ -97,16 +97,14 @@ describe("connection CRUD label defaults", () => {
 });
 
 describe("seedCanonicalConnections labels", () => {
-  test("first boot seeds default labels on all managed connections", () => {
+  test("first boot seeds the default label on the vellum connection", () => {
     const db = bootDb();
     seedCanonicalConnections(db);
 
     const conns = listConnections(db);
     const byName = Object.fromEntries(conns.map((c) => [c.name, c]));
 
-    expect(byName["anthropic-managed"]?.label).toBe("Anthropic");
-    expect(byName["openai-managed"]?.label).toBe("OpenAI");
-    expect(byName["gemini-managed"]?.label).toBe("Google Gemini");
+    expect(byName["vellum"]?.label).toBe("Vellum");
   });
 
   test("second boot preserves user-customized label", () => {
@@ -114,33 +112,16 @@ describe("seedCanonicalConnections labels", () => {
     seedCanonicalConnections(db);
 
     // User customizes the label.
-    updateConnection(db, "anthropic-managed", {
+    updateConnection(db, "vellum", {
       auth: { type: "platform" },
-      label: "Work Anthropic",
+      label: "Work Vellum",
     });
 
     // Reboot.
     seedCanonicalConnections(db);
 
-    const conn = getConnection(db, "anthropic-managed");
-    expect(conn?.label).toBe("Work Anthropic");
-  });
-
-  test("second boot backfills default label when existing row has null label", () => {
-    const db = bootDb();
-
-    // `bootDb()` runs migration 243 which already inserted the three
-    // canonical rows with `label=null` (the label column was added by 244
-    // and defaults NULL for pre-existing rows). This matches the state
-    // every pre-label install carries forward into the boot that ships
-    // the label seed.
-    const before = getConnection(db, "anthropic-managed");
-    expect(before?.label).toBeNull();
-
-    seedCanonicalConnections(db);
-
-    const after = getConnection(db, "anthropic-managed");
-    expect(after?.label).toBe("Anthropic");
+    const conn = getConnection(db, "vellum");
+    expect(conn?.label).toBe("Work Vellum");
   });
 
   test("backfill fills null label on subsequent boot", () => {
@@ -148,7 +129,7 @@ describe("seedCanonicalConnections labels", () => {
     seedCanonicalConnections(db);
 
     // User clears the label (PATCH label: null).
-    updateConnection(db, "openai-managed", {
+    updateConnection(db, "vellum", {
       auth: { type: "platform" },
       label: null,
     });
@@ -160,7 +141,7 @@ describe("seedCanonicalConnections labels", () => {
     // present for everyone.
     seedCanonicalConnections(db);
 
-    const conn = getConnection(db, "openai-managed");
-    expect(conn?.label).toBe("OpenAI");
+    const conn = getConnection(db, "vellum");
+    expect(conn?.label).toBe("Vellum");
   });
 });

package/src/providers/inference/auth.ts

@@ -117,8 +117,7 @@ export const ProviderConnectionSchema = z
     createdAt: z.number().int(),
     updatedAt: z.number().int(),
     /**
-     * Whether this row is a Vellum-managed connection (`anthropic-managed`,
-     * `openai-managed`, `gemini-managed`). Derived from
+     * Whether this row is the Vellum-managed connection (`vellum`). Derived from
      * `MANAGED_CONNECTION_NAMES` in `connections.ts` at serialize time; the
      * DB column does not exist. Clients use this to render the read-only
      * "Vellum" badge + view-only editor and to disable the delete affordance

package/src/providers/inference/backfill.ts

@@ -21,18 +21,17 @@ import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import type { DrizzleDb } from "../../persistence/db-connection.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { getLogger } from "../../util/logger.js";
+import { MANAGED_ROUTABLE_PROVIDERS } from "../vellum-model-routing.js";
 import {
   createConnection,
   getConnection,
   PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
   seedCanonicalConnections,
+  VELLUM_MANAGED_CONNECTION_NAME,
 } from "./connections.js";
 
 const log = getLogger("provider-connections-backfill");
 
-// Providers that support the managed (platform) auth type.
-const MANAGED_PROVIDERS = new Set(["anthropic", "openai", "gemini"]);
-
 /**
  * Seed canonical provider_connections and backfill any legacy config locations
  * that pre-date the connection field.
@@ -168,8 +167,11 @@ function ensureProviderConnection(
 
   let connectionName: string;
 
-  if (globalMode === "managed" && MANAGED_PROVIDERS.has(provider)) {
-    connectionName = `${provider}-managed`;
+  if (globalMode === "managed" && MANAGED_ROUTABLE_PROVIDERS.has(provider)) {
+    // All managed-routable providers share the single provider-agnostic
+    // `vellum` connection; the upstream is recovered per-request from the
+    // profile's `provider` field.
+    connectionName = VELLUM_MANAGED_CONNECTION_NAME;
   } else {
     // "your-own" path (or provider not managed-supported): ensure a
     // personal connection exists. Ollama is keyless, so it gets

package/src/providers/inference/connections.ts

@@ -3,7 +3,9 @@ import { z } from "zod";
 
 import type { DrizzleDb } from "../../persistence/db-connection.js";
 import { providerConnections } from "../../persistence/schema/inference.js";
+import { getLogger } from "../../util/logger.js";
 import { clearConnectionProviderCache } from "../registry.js";
+import { VELLUM_MANAGED_PROVIDER } from "../vellum-model-routing.js";
 import {
   type Auth,
   AuthSchema,
@@ -15,6 +17,8 @@ import {
   VALID_CONNECTION_PROVIDERS,
 } from "./auth.js";
 
+const log = getLogger("providers/inference/connections");
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -316,6 +320,30 @@ export function deleteConnection(
 // Seed canonical connections (upsert, used at boot time)
 // ---------------------------------------------------------------------------
 
+/**
+ * Name of the single Vellum-managed connection. Provider-agnostic: it stores
+ * the `vellum` sentinel instead of a real upstream, and the upstream is chosen
+ * per-request from the resolving profile's provider (see
+ * `resolveProviderFromConnection` / `isVellumManagedConnection`). This replaces
+ * the former per-provider `*-managed` connections.
+ */
+export const VELLUM_MANAGED_CONNECTION_NAME = "vellum";
+
+/**
+ * The former per-provider `*-managed` connection names, now collapsed into the
+ * single `vellum` connection. They are no longer seeded, but existing installs
+ * (and fresh installs seeded by migration 243) may still carry these rows until
+ * a follow-up migration deletes them. They are filtered out of the connection
+ * list so the UI never shows the pre-consolidation duplicates.
+ */
+export const LEGACY_MANAGED_CONNECTION_NAMES: ReadonlySet<string> = new Set([
+  "anthropic-managed",
+  "openai-managed",
+  "gemini-managed",
+  "fireworks-managed",
+  "together-managed",
+]);
+
 const CANONICAL_CONNECTIONS: Array<{
   name: string;
   provider: string;
@@ -323,40 +351,16 @@ const CANONICAL_CONNECTIONS: Array<{
   label: string;
 }> = [
   {
-    name: "anthropic-managed",
-    provider: "anthropic",
+    name: VELLUM_MANAGED_CONNECTION_NAME,
+    provider: VELLUM_MANAGED_PROVIDER,
     auth: { type: "platform" },
-    label: "Anthropic",
-  },
-  {
-    name: "openai-managed",
-    provider: "openai",
-    auth: { type: "platform" },
-    label: "OpenAI",
-  },
-  {
-    name: "gemini-managed",
-    provider: "gemini",
-    auth: { type: "platform" },
-    label: "Google Gemini",
-  },
-  {
-    name: "fireworks-managed",
-    provider: "fireworks",
-    auth: { type: "platform" },
-    label: "Fireworks",
-  },
-  {
-    name: "together-managed",
-    provider: "together",
-    auth: { type: "platform" },
-    label: "Together AI",
+    label: "Vellum",
   },
 ];
 
 /**
- * Names of the canonical Vellum-managed connections. These are seeded on every
- * daemon boot via `seedCanonicalConnections` and represent the platform-managed
+ * Names of the canonical Vellum-managed connections. Seeded on every daemon
+ * boot via `seedCanonicalConnections` and representing the platform-managed
  * inference route. They are write-protected at the route layer:
  *   - DELETE is blocked outright (would resurrect on next boot anyway, but
  *     blocking prevents a confusing delete → re-appear loop).
@@ -374,7 +378,7 @@ export const MANAGED_CONNECTION_NAMES: ReadonlySet<string> = new Set(
 );
 
 /**
- * Upsert the three canonical connections on every boot. Existing rows are
+ * Upsert the canonical connections on every boot. Existing rows are
  * updated to the latest provider/auth values so Vellum can push connection
  * changes to customers in new releases.
  *
@@ -388,6 +392,26 @@ export const MANAGED_CONNECTION_NAMES: ReadonlySet<string> = new Set(
 export function seedCanonicalConnections(db: DrizzleDb): void {
   const now = Date.now();
   for (const { name, provider, auth, label } of CANONICAL_CONNECTIONS) {
+    // Never clobber a pre-existing user connection that happens to share this
+    // canonical name. `vellum` was not a reserved name before consolidation, so
+    // an install may already have a BYOK connection keyed `vellum` (with a real
+    // provider + api_key auth). Upserting it here would silently rewrite it to
+    // the platform-auth sentinel and make it managed/write-protected, breaking
+    // any profile that references the user's connection. Only seed/refresh when
+    // the row is absent or already our sentinel (same provider).
+    const existing = db
+      .select({ provider: providerConnections.provider })
+      .from(providerConnections)
+      .where(eq(providerConnections.name, name))
+      .get();
+    if (existing && existing.provider !== provider) {
+      log.warn(
+        { name, existingProvider: existing.provider },
+        `Skipping canonical seed for "${name}": a user-owned connection already claims this name.`,
+      );
+      continue;
+    }
+
     db.insert(providerConnections)
       .values({
         name,

package/src/runtime/channel-reply-delivery.ts

@@ -12,6 +12,10 @@ import { getLogger } from "../util/logger.js";
 import type { ChannelDeliveryResult } from "./gateway-client.js";
 import { deliverChannelReply } from "./gateway-client.js";
 import type { RuntimeAttachmentMetadata } from "./http-types.js";
+import {
+  containsNoResponseMarker,
+  stripNoResponseMarkers,
+} from "./no-response.js";
 
 const log = getLogger("channel-reply-delivery");
 
@@ -50,40 +54,69 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-const NO_RESPONSE_RE = /^\s*<no_response\s*\/?>\s*$/;
-
-/** Returns true when any segment is a `<no_response/>` sentinel. */
+/** Returns true when any segment carries a `<no_response/>` sentinel. */
 function hasNoResponseMarker(textSegments: string[]): boolean {
-  return textSegments.some((s) => NO_RESPONSE_RE.test(s));
+  return textSegments.some(containsNoResponseMarker);
 }
 
 function toDeliverableTextSegments(
   textSegments: string[],
   fallbackText?: string,
 ): string[] {
+  // Hide the sentinel itself, never the content around it: strip every
+  // occurrence from mixed segments so a reply the model wrapped around a
+  // stray <no_response/> still reaches the user, and the raw sentinel never
+  // leaks into the channel as visible text.
   const nonEmptySegments = textSegments
-    .map(stripVellumLinks)
-    .filter(
-      (segment) => segment.trim().length > 0 && !NO_RESPONSE_RE.test(segment),
-    );
+    .map((segment) => {
+      const stripped = stripVellumLinks(segment);
+      return containsNoResponseMarker(stripped)
+        ? stripNoResponseMarkers(stripped)
+        : stripped;
+    })
+    .filter((segment) => segment.trim().length > 0);
   if (nonEmptySegments.length > 0) return nonEmptySegments;
   // If the only text was <no_response/>, treat as intentional silence —
   // do not fall back to fallbackText.
   if (hasNoResponseMarker(textSegments)) return [];
-  if (typeof fallbackText === "string" && fallbackText.trim().length > 0) {
-    return [fallbackText];
+  if (typeof fallbackText === "string") {
+    const fallback = stripNoResponseMarkers(fallbackText);
+    if (fallback.length > 0) return [fallback];
   }
   return [];
 }
 
+/**
+ * A reply worth delivering on its own merits: real text after sentinel
+ * stripping, or attachments. A bare `<no_response/>` row does NOT count —
+ * even when it carries attachments, since `deliverRenderedReplyViaCallback`
+ * suppresses attachment delivery for marker rows; counting such a row as
+ * real would stop the turn scan on a row that delivers nothing.
+ */
+function hasRealDeliverableReply(
+  rendered: RenderedHistoryContent,
+  attachments: RuntimeAttachmentMetadata[],
+): boolean {
+  if (
+    toDeliverableTextSegments(rendered.textSegments, rendered.text).length > 0
+  ) {
+    return true;
+  }
+  return attachments.length > 0 && !hasNoResponseMarker(rendered.textSegments);
+}
+
+/**
+ * A reply whose delivery is a terminal outcome: real content, or a bare
+ * `<no_response/>` sentinel whose "delivery" is deliberate silence. The
+ * unbounded fallback scan stops at either so a silence marker can never be
+ * skipped in favor of re-delivering an older turn's reply.
+ */
 function hasDeliverableReply(
   rendered: RenderedHistoryContent,
   attachments: RuntimeAttachmentMetadata[],
 ): boolean {
   return (
-    toDeliverableTextSegments(rendered.textSegments, rendered.text).length >
-      0 ||
-    attachments.length > 0 ||
+    hasRealDeliverableReply(rendered, attachments) ||
     hasNoResponseMarker(rendered.textSegments)
   );
 }
@@ -284,16 +317,27 @@ export function findAssistantReplyMessageIdForTurn(
     }
   }
 
+  let sentinelRowId: string | undefined;
   for (let i = turnEndIndex - 1; i > userIndex; i--) {
     const msg = msgs[i];
     if (msg.role === "assistant") {
       const { rendered, replyAttachments } = readPersistedAssistantReply(msg);
-      if (hasDeliverableReply(rendered, replyAttachments)) {
+      if (hasRealDeliverableReply(rendered, replyAttachments)) {
         return msg.id;
       }
+      if (
+        sentinelRowId === undefined &&
+        hasNoResponseMarker(rendered.textSegments)
+      ) {
+        sentinelRowId = msg.id;
+      }
     }
   }
-  return undefined;
+  // Silence means the turn produced no real reply text anywhere — not "the
+  // last row was a sentinel". Only when no row in the turn carries real
+  // content does the bare <no_response/> row become the reply; delivering it
+  // suppresses all output as deliberate silence.
+  return sentinelRowId;
 }
 
 async function deliverPersistedAssistantMessageViaCallback(
@@ -302,8 +346,10 @@ async function deliverPersistedAssistantMessageViaCallback(
   callbackUrl: string,
   assistantId: string | undefined,
   options: DeliverReplyOptions | undefined,
+  preRead?: ReturnType<typeof readPersistedAssistantReply>,
 ): Promise<boolean> {
-  const { rendered, replyAttachments } = readPersistedAssistantReply(msg);
+  const { rendered, replyAttachments } =
+    preRead ?? readPersistedAssistantReply(msg);
   if (!hasDeliverableReply(rendered, replyAttachments)) {
     return false;
   }
@@ -355,14 +401,27 @@ export async function deliverReplyViaCallback(
         `Target assistant reply message not found: ${options.messageId}`,
       );
     }
-    await deliverPersistedAssistantMessageViaCallback(
-      msg,
-      externalChatId,
-      callbackUrl,
-      assistantId,
-      options,
-    );
-    return;
+    // The targeted row is usually the turn's final assistant row, but a bare
+    // <no_response/> or tool-only final row is not necessarily the turn's
+    // reply — the model may have written the real reply in an earlier row of
+    // the same turn. When the turn boundary is known, defer to the turn scan
+    // below; it returns this same sentinel row (deliberate silence) only when
+    // no row in the turn carries real content.
+    const preRead = readPersistedAssistantReply(msg);
+    if (
+      hasRealDeliverableReply(preRead.rendered, preRead.replyAttachments) ||
+      !options.sinceMessageId
+    ) {
+      await deliverPersistedAssistantMessageViaCallback(
+        msg,
+        externalChatId,
+        callbackUrl,
+        assistantId,
+        options,
+        preRead,
+      );
+      return;
+    }
   }
 
   if (options?.sinceMessageId) {

package/src/runtime/channel-retry-sweep.ts

@@ -436,6 +436,10 @@ export async function sweepFailedEvents(
         assistantId,
         {
           messageId: replyMessageId,
+          // The stored reply id may point at a bare <no_response/> row from
+          // the turn's final message; the turn boundary lets delivery fall
+          // through to the real reply written earlier in the same turn.
+          ...(event.messageId ? { sinceMessageId: event.messageId } : {}),
           startFromSegment: event.deliveredSegmentCount,
           ...(priorStreamMessageTs ? { messageTs: priorStreamMessageTs } : {}),
           onSegmentDelivered: (count) =>

package/src/runtime/{slack-no-response.ts → no-response.ts}

@@ -1,10 +1,12 @@
 /**
  * The assistant emits a `<no_response/>` sentinel to signal that a turn should
- * produce no user-visible reply. Slack surfaces that begin work on the first
- * deliverable text (the thinking-status indicator and native reply streaming)
- * must not act on a partially-arrived sentinel: a slow stream can surface just
- * `<` or `<no_resp` before the rest lands, and starting on that leaks a stray
- * message that later resolves to empty.
+ * produce no user-visible reply. Channel delivery must hide the sentinel
+ * itself without hiding real content it happens to coexist with. Slack
+ * surfaces that begin work on the first deliverable text (the thinking-status
+ * indicator and native reply streaming) additionally must not act on a
+ * partially-arrived sentinel: a slow stream can surface just `<` or `<no_resp`
+ * before the rest lands, and starting on that leaks a stray message that
+ * later resolves to empty.
  */
 
 /** Matches a message whose entire content is the sentinel. */
@@ -13,6 +15,24 @@ const NO_RESPONSE_ONLY_RE = /^\s*<no_response\s*\/?>\s*$/i;
 /** Matches every sentinel occurrence for stripping it out of mixed content. */
 export const NO_RESPONSE_INLINE_RE = /<no_response\s*\/?>/gi;
 
+/**
+ * Detection variant without the `g` flag: a `g`-flagged regex is stateful
+ * under `.test()` (it resumes from `lastIndex`), so reusing
+ * {@link NO_RESPONSE_INLINE_RE} for detection would alternate between
+ * matches and misses across calls.
+ */
+const NO_RESPONSE_MARKER_RE = new RegExp(NO_RESPONSE_INLINE_RE.source, "i");
+
+/** Whether `text` contains the sentinel anywhere. */
+export function containsNoResponseMarker(text: string): boolean {
+  return NO_RESPONSE_MARKER_RE.test(text);
+}
+
+/** Removes every sentinel occurrence, trimming the leftover whitespace. */
+export function stripNoResponseMarkers(text: string): string {
+  return text.replace(NO_RESPONSE_INLINE_RE, "").trim();
+}
+
 const NO_RESPONSE_SENTINEL_FORMS = [
   "<no_response/>",
   "<no_response />",
@@ -43,5 +63,5 @@ export function hasDeliverableAssistantText(text: string): boolean {
   if (trimmed.length === 0) return false;
   if (NO_RESPONSE_ONLY_RE.test(trimmed)) return false;
   if (isPotentialNoResponsePrefix(trimmed)) return false;
-  return trimmed.replace(NO_RESPONSE_INLINE_RE, "").trim().length > 0;
+  return stripNoResponseMarkers(trimmed).length > 0;
 }

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -65,6 +65,7 @@ import {
   llmRequestLogs,
   memoryV2ActivationLogs,
   messages,
+  providerConnections,
 } from "../../../persistence/schema/index.js";
 import {
   backfillMemoryV2ActivationMessageId,
@@ -825,6 +826,16 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
   });
 
   test("auto-derives provider_connection when omitted from body (Any active)", async () => {
+    // Start from a clean connection slate — provider_connections persists
+    // across tests in this file, so a leaked openai-personal would otherwise
+    // win the derivation.
+    getDb().delete(providerConnections).run();
+    // The single Vellum-managed connection serves managed-routable providers.
+    createConnection(getDb(), {
+      name: "vellum",
+      provider: "vellum",
+      auth: { type: "platform" },
+    });
     // Seed an existing binding so the test starts from a non-empty state.
     (
       rawConfigFixture.llm as {
@@ -851,9 +862,38 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
       }
     ).profiles.custom;
 
-    // The canonical "openai-managed" connection exists in the test DB;
-    // the route auto-derives it when the UI omits provider_connection.
-    expect(savedProfile.provider_connection).toBe("openai-managed");
+    // No personal openai connection exists, so the route auto-derives the
+    // single Vellum-managed connection for this managed-routable provider.
+    expect(savedProfile.provider_connection).toBe("vellum");
+  });
+
+  test("Any active derivation skips orphaned legacy *-managed rows", async () => {
+    getDb().delete(providerConnections).run();
+    // Upgraded workspaces may still carry a legacy openai-managed row (hidden
+    // from the list route, deleted by a follow-up migration). It must not be
+    // auto-picked — the derivation should bind to `vellum` instead.
+    createConnection(getDb(), {
+      name: "openai-managed",
+      provider: "openai",
+      auth: { type: "platform" },
+    });
+    createConnection(getDb(), {
+      name: "vellum",
+      provider: "vellum",
+      auth: { type: "platform" },
+    });
+
+    await replaceProfileRoute.handler({
+      pathParams: { name: "custom" },
+      body: { provider: "openai", model: "gpt-5.5" },
+    });
+
+    const savedProfile = (
+      savedRawConfig?.llm as {
+        profiles: Record<string, Record<string, unknown>>;
+      }
+    ).profiles.custom;
+    expect(savedProfile.provider_connection).toBe("vellum");
   });
 
   test("auto-derives provider_connection for BYOK provider (Any active)", async () => {