@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/providers/__tests__/satellite-connection-routing.test.ts

@@ -22,43 +22,20 @@
  *   - No callSite → straight to default (no resolution work).
  */
 
-import { beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
-
-import { setOverridesForTesting } from "../../__tests__/feature-flag-test-helpers.js";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setConfig } from "../../__tests__/helpers/set-config.js";
 // Connection-routing plumbing over legacy-shaped fixtures (llm.default /
 // activeProfile-centric, no defaultProvider): pinned to the flag-off
 // cascade. Flag-on dispatch behavior is covered by
 // inference-no-mode-boot-e2e.test.ts and the override-or-default resolver
 // suite.
-beforeAll(() => {
-  setOverridesForTesting({ "override-or-default-resolution": false });
-});
-
 import type { Provider, ProviderResponse } from "../types.js";
 
 // ---------------------------------------------------------------------------
 // Module mocks (must be declared before the import-under-test).
 // ---------------------------------------------------------------------------
 
-mock.module("../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
-}));
-
-let mockLlmConfig: Record<string, unknown> = {};
-
-mock.module("../../config/loader.js", () => ({
-  getConfig: () => ({
-    llm: mockLlmConfig,
-    services: { inference: {} },
-  }),
-  loadConfig: () => ({
-    llm: mockLlmConfig,
-    services: { inference: {} },
-  }),
-}));
-
 const mockDbSentinel = { __mock: "db" };
 mock.module("../../persistence/db-connection.js", () => ({
   getDb: () => mockDbSentinel,
@@ -150,7 +127,7 @@ import { ConnectionResolutionError } from "../connection-resolution.js";
 // ---------------------------------------------------------------------------
 
 function setLlmConfig(c: Record<string, unknown>): void {
-  mockLlmConfig = c;
+  setConfig("llm", c);
 }
 
 function registerConnection(
@@ -167,7 +144,7 @@ function reset(): void {
   fakeConnections.clear();
   fakeProviders.clear();
   connectionsThatThrowOnResolve.clear();
-  mockLlmConfig = {};
+  setConfig("llm", {});
 }
 
 // ProvidersConfig stub used by the wrapper helper. The connection-resolution
@@ -208,11 +185,11 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     );
 
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
       profiles: {
         "managed-profile": {
           provider: "anthropic",
           provider_connection: "anthropic-managed",
+          model: "claude-opus-4-7",
         },
       },
       callSites: {
@@ -251,10 +228,10 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     const defaultProvider = makeFakeProvider("default-anthropic", "anthropic");
 
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
       profiles: {
         "anthropic-bare": {
           provider: "anthropic",
+          model: "claude-opus-4-7",
           // no provider_connection — but provider matches default's name
         },
       },
@@ -287,10 +264,10 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     const defaultProvider = makeFakeProvider("default-anthropic", "anthropic");
 
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
       profiles: {
         "openai-profile": {
           provider: "openai",
+          model: "gpt-5.4",
           // No provider_connection — alternate-provider routing demands
           // one; this profile is expected to throw
           // `ConnectionResolutionError(missing_connection)`.
@@ -330,11 +307,11 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     const defaultProvider = makeFakeProvider("default-anthropic", "anthropic");
 
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
       profiles: {
         broken: {
           provider: "anthropic",
           provider_connection: "does-not-exist",
+          model: "claude-opus-4-7",
         },
       },
       callSites: {
@@ -386,13 +363,13 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     );
 
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
       profiles: {
         mismatched: {
           provider: "openai",
           // ↑ profile says openai
           provider_connection: "anthropic-managed",
           // ↑ but connection is anthropic — mismatch
+          model: "gpt-5.4",
         },
       },
       callSites: {
@@ -448,11 +425,11 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     connectionsThatThrowOnResolve.add("flaky-managed");
 
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
       profiles: {
         flaky: {
           provider: "anthropic",
           provider_connection: "flaky-managed",
+          model: "claude-opus-4-7",
         },
       },
       callSites: {
@@ -486,9 +463,7 @@ describe("CallSiteRoutingProvider honors provider_connection (satellite gate)",
     // Note: legacy registry has nothing — if the wrapper tries to consult
     // it, the test will throw. Bare-default path proves the short-circuit.
 
-    setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
-    });
+    setLlmConfig({});
 
     const wrapped = wrapWithCallSiteRouting(
       defaultProvider,

package/src/providers/__tests__/vellum-mismatch-routing.test.ts

@@ -8,11 +8,6 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-mock.module("../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
-}));
-
 const dbSentinel = { __mock: "db" };
 mock.module("../../persistence/db-connection.js", () => ({
   getDb: () => dbSentinel,

package/src/providers/anthropic/client.ts

@@ -76,7 +76,8 @@ function readAnthropicErrorType(
   error: InstanceType<typeof Anthropic.APIError>,
 ): string | undefined {
   const body = error.error as
-    { type?: string; error?: { type?: string; code?: string } } | undefined;
+    | { type?: string; error?: { type?: string; code?: string } }
+    | undefined;
   return body?.error?.type ?? body?.type;
 }
 
@@ -96,7 +97,8 @@ function readAnthropicMessage(
   error: InstanceType<typeof Anthropic.APIError>,
 ): string | undefined {
   const body = error.error as
-    { message?: string; error?: { message?: string } } | undefined;
+    | { message?: string; error?: { message?: string } }
+    | undefined;
   const inner = body?.error?.message ?? body?.message;
   return typeof inner === "string" && inner.length > 0 ? inner : undefined;
 }
@@ -885,7 +887,8 @@ export class AnthropicProvider implements Provider {
     const { tools, systemPrompt, config, onEvent, signal } = options ?? {};
     const cacheTtl: "5m" | "1h" =
       ((config as Record<string, unknown> | undefined)?.cacheTtl as
-        "5m" | "1h") ?? "1h";
+        | "5m"
+        | "1h") ?? "1h";
     // Opt-out for callers (e.g. the memory router) that send a single
     // user message per call with content that changes every time. The
     // turn-start cache breakpoint below is only useful when the same
@@ -924,6 +927,9 @@ export class AnthropicProvider implements Provider {
         disableTurnStartCache: _disableTurnStartCache,
         mutableLatestUserMessage: _mutableLatestUserMessage,
         disableCache: _disableCache,
+        // OpenAI-transport prompt-cache key; reaches this client on
+        // OpenRouter's anthropic/* delegation path and must not hit the wire.
+        promptCacheKey: _promptCacheKey,
         max_tokens: callerMaxTokens,
         usageAttributionHeaders,
         // Pulled out of `restConfig` so they are forwarded conditionally below:

package/src/providers/call-site-routing.ts

@@ -7,7 +7,7 @@
  * Without this wrapper the conversation-level provider transport is fixed at
  * construction time, so a per-call-site `llm.callSites.<id>.provider`
  * override only affects the request *metadata* the downstream client sees —
- * the actual HTTP transport still belongs to `llm.default.provider`. That
+ * the actual HTTP transport still belongs to the default provider. That
  * means routing decisions like "send `memoryRetrieval` calls to OpenAI even
  * though the main agent runs on Anthropic" silently fail.
  *
@@ -192,7 +192,9 @@ export class CallSiteRoutingProvider implements Provider {
     options?: SendMessageOptions,
   ): Promise<Provider> {
     const callSite = options?.config?.callSite;
-    if (!callSite) return this.defaultProvider;
+    if (!callSite) {
+      return this.defaultProvider;
+    }
 
     const overrideProfile = options?.config?.overrideProfile;
     // Forward `forceOverrideProfile` and the per-conversation mix seed so
@@ -239,7 +241,9 @@ export class CallSiteRoutingProvider implements Provider {
         resolved.provider,
         resolved.model,
       );
-      if (connectionProvider) return connectionProvider;
+      if (connectionProvider) {
+        return connectionProvider;
+      }
       return this.defaultProvider;
     }
 

package/src/providers/connection-resolution.ts

@@ -28,7 +28,6 @@
  */
 
 import {
-  isOverrideOrDefaultResolutionEnabled,
   resolveCallSiteConfig,
   selectWinningProfile,
 } from "../config/llm-resolver.js";
@@ -233,7 +232,8 @@ export async function tryResolveProviderForConnectionName(
  * construction-time path (subagent manager, conversation store,
  * approval/guardian generators, rollup producer).
  *
- * Reads `config.llm.default.{provider, provider_connection}`.
+ * Resolves the mainAgent call-site config and reads its
+ * `{provider, provider_connection}`.
  *
  *   - Throws `ConnectionResolutionError` if the default profile has no
  *     `provider_connection` (boot-time backfill should have set one;
@@ -285,16 +285,16 @@ export async function resolveDefaultProvider(
         : null;
       if (incompatMsg) {
         throw new ConnectionResolutionError(
-          "<llm.default>",
+          "<default>",
           "model_incompatible",
           incompatMsg,
           { model: resolved.model },
         );
       }
       throw new ConnectionResolutionError(
-        "<llm.default>",
+        "<default>",
         "missing_connection",
-        `llm.default.provider_connection is unset — every profile must declare a provider_connection. The boot-time backfill in lifecycle.ts populates this field; if you see this error, the backfill did not run or the field was manually cleared.`,
+        `The resolved default config carries no provider_connection and no active connection exists for provider "${resolved.provider}". Connect a provider or point llm.defaultProvider at one with credentials.`,
       );
     }
   }
@@ -460,12 +460,10 @@ export async function mainAgentResolutionError(
   registeredProviders: string[],
 ): Promise<ProviderNotConfiguredError> {
   const resolved = resolveCallSiteConfig("mainAgent", llm);
-  if (isOverrideOrDefaultResolutionEnabled()) {
-    await preflightResolvedConfig(resolved, {
-      profileName:
-        selectWinningProfile("mainAgent", llm, {}).profileName ?? undefined,
-    });
-  }
+  await preflightResolvedConfig(resolved, {
+    profileName:
+      selectWinningProfile("mainAgent", llm, {}).profileName ?? undefined,
+  });
   return new ProviderNotConfiguredError(
     resolved.provider,
     registeredProviders,

package/src/providers/content-block-schema.ts

@@ -0,0 +1,149 @@
+/**
+ * Canonical zod schema for the raw model-loop {@link ContentBlock} union in
+ * `providers/types.ts` — the shape PERSISTED into `messages.content` and
+ * consumed by plugins/hooks.
+ *
+ * This is deliberately distinct from `ConversationContentBlockSchema`
+ * (`api/responses/conversation-message.ts`), which is the cleaned wire/display
+ * projection: that form merges tool results into their calls and drops
+ * internal fields, so it cannot validate raw persisted content.
+ *
+ * Every variant uses `.passthrough()` rather than zod's default key-stripping:
+ * persisted blocks carry internal riders (e.g. `_startedAt` /
+ * `_previewStartedAt` timing stamps on thinking and tool_use blocks) that
+ * must survive a parse→serialize round trip byte-for-byte.
+ *
+ * The export is typed `z.ZodType<ContentBlock>`, so the compiler enforces
+ * that the schema's output stays assignable to the hand-written union —
+ * drifting the schema away from `providers/types.ts` is a type error here.
+ */
+
+import { z } from "zod";
+
+import type { ContentBlock } from "./types.js";
+
+const base64MediaSourceSchema = z
+  .object({
+    type: z.literal("base64"),
+    media_type: z.string(),
+    data: z.string(),
+    filename: z.string().optional(),
+  })
+  .passthrough();
+
+const workspaceRefMediaSourceSchema = z
+  .object({
+    type: z.literal("workspace_ref"),
+    media_type: z.string(),
+    attachmentId: z.string(),
+    sizeBytes: z.number(),
+    filename: z.string().optional(),
+    width: z.number().optional(),
+    height: z.number().optional(),
+  })
+  .passthrough();
+
+export const mediaSourceSchema = z.discriminatedUnion("type", [
+  base64MediaSourceSchema,
+  workspaceRefMediaSourceSchema,
+]);
+
+const textContentSchema = z
+  .object({
+    type: z.literal("text"),
+    text: z.string(),
+  })
+  .passthrough();
+
+const thinkingContentSchema = z
+  .object({
+    type: z.literal("thinking"),
+    thinking: z.string(),
+    signature: z.string(),
+  })
+  .passthrough();
+
+const redactedThinkingContentSchema = z
+  .object({
+    type: z.literal("redacted_thinking"),
+    data: z.string(),
+  })
+  .passthrough();
+
+const imageContentSchema = z
+  .object({
+    type: z.literal("image"),
+    source: mediaSourceSchema,
+  })
+  .passthrough();
+
+const fileContentSchema = z
+  .object({
+    type: z.literal("file"),
+    source: mediaSourceSchema,
+    extracted_text: z.string().optional(),
+    _attachmentId: z.string().optional(),
+  })
+  .passthrough();
+
+const toolUseContentSchema = z
+  .object({
+    type: z.literal("tool_use"),
+    id: z.string(),
+    name: z.string(),
+    input: z.record(z.string(), z.unknown()),
+    providerMetadata: z
+      .object({
+        gemini: z
+          .object({ thoughtSignature: z.string().optional() })
+          .passthrough()
+          .optional(),
+      })
+      .passthrough()
+      .optional(),
+  })
+  .passthrough();
+
+const toolResultContentSchema = z
+  .object({
+    type: z.literal("tool_result"),
+    tool_use_id: z.string(),
+    content: z.string(),
+    is_error: z.boolean().optional(),
+    contentBlocks: z.lazy(() => z.array(contentBlockSchema)).optional(),
+  })
+  .passthrough();
+
+const serverToolUseContentSchema = z
+  .object({
+    type: z.literal("server_tool_use"),
+    id: z.string(),
+    name: z.string(),
+    input: z.record(z.string(), z.unknown()),
+  })
+  .passthrough();
+
+const webSearchToolResultContentSchema = z
+  .object({
+    type: z.literal("web_search_tool_result"),
+    tool_use_id: z.string(),
+    content: z.unknown(),
+  })
+  .passthrough();
+
+export const contentBlockSchema: z.ZodType<ContentBlock> = z.discriminatedUnion(
+  "type",
+  [
+    textContentSchema,
+    thinkingContentSchema,
+    redactedThinkingContentSchema,
+    imageContentSchema,
+    fileContentSchema,
+    toolUseContentSchema,
+    toolResultContentSchema,
+    serverToolUseContentSchema,
+    webSearchToolResultContentSchema,
+  ],
+);
+
+export const contentBlockArraySchema = z.array(contentBlockSchema);

package/src/providers/inference/__tests__/base-url-route-validation.test.ts

@@ -41,23 +41,19 @@ mock.module("../../../config/assistant-feature-flags.js", () => ({
 }));
 
 // Mock platform detection: tests default to platform mode (SSRF enforced).
-// Individual tests can override via `mockIsPlatform = false`.
+// Individual tests can override via `mockIsPlatform = false`. Spread the real
+// module so the (now real) config loader's transitive `util/platform` import of
+// `getWorkspaceDirOverride` still resolves — only `getIsPlatform` is overridden.
 let mockIsPlatform = true;
 
+const realEnvRegistry = {
+  ...(await import("../../../config/env-registry.js")),
+};
 mock.module("../../../config/env-registry.js", () => ({
+  ...realEnvRegistry,
   getIsPlatform: () => mockIsPlatform,
 }));
 
-mock.module("../../../config/loader.js", () => ({
-  getConfig: () => ({ llm: {} }),
-  getConfigReadOnly: () => ({ llm: {} }),
-  // Unused by these tests, but the route module's import chain
-  // (config/default-provider.js) needs the named exports to resolve.
-  loadRawConfig: () => ({}),
-  saveRawConfig: () => {},
-  invalidateConfigCache: () => {},
-}));
-
 // Mock DNS resolution: all hostnames resolve to a public IP by default.
 // Tests that need private-IP resolution override this per-test.
 let mockResolvedAddresses: string[] = ["93.184.216.34"];

package/src/providers/inference/__tests__/codex-token-refresh.test.ts

@@ -1,23 +1,9 @@
-import {
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  mock,
-  test,
-} from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
 // Mocks
 // ---------------------------------------------------------------------------
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 const mockGetSecureKey = mock<(key: string) => Promise<string | undefined>>(
   async () => undefined,
 );

package/src/providers/inference/auth.ts

@@ -44,6 +44,29 @@ export const AuthSchema = z
 
 export type Auth = z.infer<typeof AuthSchema>;
 
+/**
+ * Derive the auth configuration a provider implies when a client omits an
+ * explicit `auth` object: keyless catalog providers (`setupMode: "keyless"`,
+ * e.g. ollama) need none, the Vellum-managed sentinel routes via the
+ * platform proxy, and every other provider authenticates by API key. Returns
+ * null when an API key is required but no credential was supplied, so route
+ * handlers can reject with a 400. `oauth_subscription` is never derived —
+ * the ChatGPT PKCE routes own that connection.
+ */
+export function deriveAuthForProvider(
+  provider: string,
+  credential?: string,
+): Auth | null {
+  if (provider === VELLUM_MANAGED_PROVIDER) {
+    return { type: "platform" };
+  }
+  const entry = PROVIDER_CATALOG.find((p) => p.id === provider);
+  if (entry?.setupMode === "keyless") {
+    return { type: "none" };
+  }
+  return credential ? { type: "api_key", credential } : null;
+}
+
 // ---------------------------------------------------------------------------
 // ResolvedAuth — what the dispatcher hands to each adapter
 // ---------------------------------------------------------------------------

package/src/providers/inference/backfill.ts

@@ -3,7 +3,7 @@
  * `provider` + `source` model to the new `provider_connection` model.
  *
  * Walks three locations in `llm.*` on every boot:
- *   - `llm.default`           — the base profile every dispatch falls back on
+ *   - `llm.default`           — the legacy raw base blob still present in older configs
  *   - `llm.profiles.*`        — named alternate profiles (fast/balanced/...)
  *   - `llm.callSites.*`       — per-call-site overrides with bare `provider`
  *
@@ -63,7 +63,9 @@ export function runProviderConnectionsBackfill(db: DrizzleDb): void {
 function backfillConfigProfiles(db: DrizzleDb): void {
   const raw = loadRawConfig();
   const llm = raw.llm as Record<string, unknown> | undefined;
-  if (!llm) return;
+  if (!llm) {
+    return;
+  }
 
   const isPlatform =
     process.env.IS_PLATFORM === "true" || process.env.IS_PLATFORM === "1";
@@ -87,13 +89,17 @@ function backfillConfigProfiles(db: DrizzleDb): void {
   if (profiles && typeof profiles === "object") {
     for (const [profileName, profileVal] of Object.entries(profiles)) {
       const profile = profileVal as Record<string, unknown>;
-      if (!profile || typeof profile !== "object") continue;
+      if (!profile || typeof profile !== "object") {
+        continue;
+      }
       if (ensureProviderConnection(profile, profileName, db, globalMode)) {
         profiles[profileName] = profile;
         changed = true;
       }
     }
-    if (changed) llm.profiles = profiles;
+    if (changed) {
+      llm.profiles = profiles;
+    }
   }
 
   // 3. Per-call-site overrides. Only legacy entries with a bare `provider`
@@ -103,11 +109,15 @@ function backfillConfigProfiles(db: DrizzleDb): void {
   if (callSites && typeof callSites === "object") {
     for (const [callSiteName, callSiteVal] of Object.entries(callSites)) {
       const callSite = callSiteVal as Record<string, unknown>;
-      if (!callSite || typeof callSite !== "object") continue;
+      if (!callSite || typeof callSite !== "object") {
+        continue;
+      }
       // Only touch overrides that explicitly set `provider` — the typical
       // case is `{profile: "fast"}`, which has no provider and inherits
       // through `resolveCallSiteConfig` deep-merge.
-      if (callSite.provider == null) continue;
+      if (callSite.provider == null) {
+        continue;
+      }
       if (
         ensureProviderConnection(
           callSite,
@@ -120,7 +130,9 @@ function backfillConfigProfiles(db: DrizzleDb): void {
         changed = true;
       }
     }
-    if (changed) llm.callSites = callSites;
+    if (changed) {
+      llm.callSites = callSites;
+    }
   }
 
   if (changed) {
@@ -152,10 +164,14 @@ function ensureProviderConnection(
   // at runtime. Self-heal those alongside null/undefined.
   const existing = entry.provider_connection;
   const hasValid = typeof existing === "string" && existing.trim() !== "";
-  if (hasValid) return false;
+  if (hasValid) {
+    return false;
+  }
 
   const provider = entry.provider as string | undefined;
-  if (!provider) return false;
+  if (!provider) {
+    return false;
+  }
 
   if (PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)) {
     log.warn(