@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/providers/content-blocks.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared predicates over the raw model-loop {@link ContentBlock} union.
+ *
+ * The agent loop and the receive-side credential guard judge "did this turn
+ * produce anything" the same way, so the predicates live here rather than in
+ * each consumer. Plugins keep their own copies: a plugin may not import from
+ * outside its own directory.
+ */
+
+import type { ContentBlock } from "./types.js";
+
+/** Whether `content` carries at least one non-empty `text` block. */
+export function hasVisibleText(content: ReadonlyArray<ContentBlock>): boolean {
+  return content.some(
+    (block) => block.type === "text" && block.text.trim().length > 0,
+  );
+}
+
+/** Whether `content` carries at least one tool call. */
+export function hasToolUse(content: ReadonlyArray<ContentBlock>): boolean {
+  return content.some((block) => block.type === "tool_use");
+}

package/src/providers/gemini/client.ts

@@ -694,8 +694,11 @@ export class GeminiProvider implements Provider {
     model: string,
   ): Promise<genai.Content[]> {
     // Swap any persisted attachment references back to inline base64 before
-    // building parts, so the transforms below can read `source.data`.
-    messages = await resolveMediaReferences(messages);
+    // building parts, so the transforms below can read `source.data`. Gemini
+    // decodes HEIF itself, so an untranscoded HEIC photo stays an image here
+    // rather than being replaced by an omission note:
+    // https://ai.google.dev/gemini-api/docs/image-understanding
+    messages = await resolveMediaReferences(messages, { acceptsHeif: true });
     const result: genai.Content[] = [];
 
     // Build a map from tool_use id → function name so tool_result blocks

package/src/providers/inference/__tests__/adapter-factory-litellm.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, test } from "bun:test";
 
-import { OpenAIChatCompletionsProvider } from "../../openai/chat-completions-provider.js";
+import {
+  EMPTY_ASSISTANT_TURN_PLACEHOLDER,
+  OpenAIChatCompletionsProvider,
+} from "../../openai/chat-completions-provider.js";
 import {
   buildProviderAdapter,
   createAdapterFromConnection,
@@ -19,6 +22,49 @@ describe("litellm adapter factory", () => {
     expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
   });
 
+  test("backfills placeholder content after an aborted empty assistant turn", async () => {
+    const adapter = buildProviderAdapter("litellm", {
+      apiKey: "sk-litellm-test",
+      model: "deepseek/deepseek-v4",
+      streamTimeoutMs: 60_000,
+      baseURL: "http://localhost:4000/v1",
+      useNativeWebSearch: false,
+    });
+    expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    const provider = adapter as OpenAIChatCompletionsProvider;
+    const requests: unknown[] = [];
+    (provider as unknown as { client: unknown }).client = {
+      chat: {
+        completions: {
+          create: async (params: unknown) => {
+            requests.push(params);
+            return {
+              async *[Symbol.asyncIterator]() {
+                yield {
+                  choices: [
+                    { delta: { content: "ok" }, finish_reason: "stop" },
+                  ],
+                  usage: { prompt_tokens: 2, completion_tokens: 1 },
+                };
+              },
+            };
+          },
+        },
+      },
+    };
+
+    await provider.sendMessage([
+      { role: "user", content: [{ type: "text", text: "question" }] },
+      { role: "assistant", content: [] },
+    ]);
+
+    const params = requests[0] as {
+      messages: Array<{ role: string; content: string | null }>;
+    };
+    const assistantMsg = params.messages.find((m) => m.role === "assistant")!;
+    expect(assistantMsg.content).toBe(EMPTY_ASSISTANT_TURN_PLACEHOLDER);
+  });
+
   test("buildProviderAdapter works without baseURL (uses proxy default)", () => {
     const adapter = buildProviderAdapter("litellm", {
       apiKey: "sk-litellm-test",

package/src/providers/inference/__tests__/adapter-factory-ollama.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from "bun:test";
+
+import { OllamaProvider } from "../../ollama/client.js";
+import {
+  buildProviderAdapter,
+  createAdapterFromConnection,
+} from "../adapter-factory.js";
+import type { ProviderConnection, ResolvedAuth } from "../auth.js";
+
+interface RetryOptions {
+  credentialSource?: string;
+  connectionName?: string;
+}
+
+function retryOptions(adapter: unknown): RetryOptions {
+  let node = adapter;
+  for (let depth = 0; node && depth < 8; depth++) {
+    const { options, inner } = node as {
+      options?: RetryOptions;
+      inner?: unknown;
+    };
+    if (options) {
+      return options;
+    }
+    node = inner;
+  }
+  throw new Error("no RetryProvider found in the adapter wrapper chain");
+}
+
+function innermostAdapter(adapter: unknown): unknown {
+  let node = adapter;
+  for (let depth = 0; node && depth < 8; depth++) {
+    const inner = (node as { inner?: unknown }).inner;
+    if (!inner) {
+      return node;
+    }
+    node = inner;
+  }
+  throw new Error("wrapper chain too deep");
+}
+
+describe("adapter factory ollama", () => {
+  test("buildProviderAdapter returns an OllamaProvider", () => {
+    const adapter = buildProviderAdapter("ollama", {
+      apiKey: "",
+      model: "llama3.2",
+      streamTimeoutMs: 60_000,
+      baseURL: "http://192.168.1.50:11434/v1",
+      useNativeWebSearch: false,
+    });
+    expect(adapter).toBeInstanceOf(OllamaProvider);
+  });
+
+  test("createAdapterFromConnection accepts keyless ollama with a stored baseUrl", () => {
+    const connection: ProviderConnection = {
+      name: "ollama",
+      provider: "ollama",
+      auth: { type: "none" },
+      label: null,
+      baseUrl: "http://192.168.1.50:11434/v1",
+      models: null,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      isManaged: false,
+    };
+
+    const resolvedAuth: ResolvedAuth = {
+      kind: "none",
+      baseUrl: "http://192.168.1.50:11434/v1",
+    };
+
+    const adapter = createAdapterFromConnection(connection, resolvedAuth, {
+      model: "llama3.2",
+    });
+
+    expect(adapter).not.toBeNull();
+    expect(innermostAdapter(adapter)).toBeInstanceOf(OllamaProvider);
+    expect(retryOptions(adapter)).toMatchObject({
+      credentialSource: "no-auth",
+      connectionName: "ollama",
+    });
+  });
+});

package/src/providers/inference/__tests__/adapter-factory-openai-compatible.test.ts

@@ -1,12 +1,37 @@
 import { describe, expect, test } from "bun:test";
 
-import { OpenAIChatCompletionsProvider } from "../../openai/chat-completions-provider.js";
+import {
+  EMPTY_ASSISTANT_TURN_PLACEHOLDER,
+  OpenAIChatCompletionsProvider,
+} from "../../openai/chat-completions-provider.js";
 import {
   buildProviderAdapter,
   createAdapterFromConnection,
 } from "../adapter-factory.js";
 import type { ProviderConnection, ResolvedAuth } from "../auth.js";
 
+function stubChatCreate(provider: OpenAIChatCompletionsProvider): unknown[] {
+  const requests: unknown[] = [];
+  (provider as unknown as { client: unknown }).client = {
+    chat: {
+      completions: {
+        create: async (params: unknown) => {
+          requests.push(params);
+          return {
+            async *[Symbol.asyncIterator]() {
+              yield {
+                choices: [{ delta: { content: "ok" }, finish_reason: "stop" }],
+                usage: { prompt_tokens: 2, completion_tokens: 1 },
+              };
+            },
+          };
+        },
+      },
+    },
+  };
+  return requests;
+}
+
 interface RetryOptions {
   credentialSource?: string;
   connectionName?: string;
@@ -43,6 +68,78 @@ describe("adapter factory", () => {
       useNativeWebSearch: false,
     });
     expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    expect(
+      (adapter as unknown as { omitToolChoiceWhenReasoning: boolean })
+        .omitToolChoiceWhenReasoning,
+    ).toBe(true);
+  });
+
+  test("openai-compatible round-trips thinking as reasoning_content", () => {
+    const adapter = buildProviderAdapter("openai-compatible", {
+      apiKey: "test-key",
+      model: "deepseek-reasoner",
+      streamTimeoutMs: 60_000,
+      baseURL: "https://example.com/v1",
+      useNativeWebSearch: false,
+    });
+    expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    expect(
+      (adapter as unknown as { assistantReasoningField?: string })
+        .assistantReasoningField,
+    ).toBe("reasoning_content");
+  });
+
+  test("litellm round-trips thinking as reasoning_content", () => {
+    const adapter = buildProviderAdapter("litellm", {
+      apiKey: "test-key",
+      model: "deepseek-reasoner",
+      streamTimeoutMs: 60_000,
+      baseURL: "https://example.com/v1",
+      useNativeWebSearch: false,
+    });
+    expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    expect(
+      (adapter as unknown as { assistantReasoningField?: string })
+        .assistantReasoningField,
+    ).toBe("reasoning_content");
+  });
+
+  test("backfills placeholder content after an aborted empty assistant turn", async () => {
+    const adapter = buildProviderAdapter("openai-compatible", {
+      apiKey: "test-key",
+      model: "deepseek-v4",
+      streamTimeoutMs: 60_000,
+      baseURL: "http://localhost:8080/v1",
+      useNativeWebSearch: false,
+    });
+    expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    const provider = adapter as OpenAIChatCompletionsProvider;
+    const requests = stubChatCreate(provider);
+
+    await provider.sendMessage([
+      { role: "user", content: [{ type: "text", text: "question" }] },
+      {
+        role: "assistant",
+        content: [
+          {
+            type: "thinking",
+            thinking: "aborted mid-thought",
+            signature: "",
+          },
+        ],
+      },
+    ]);
+
+    const params = requests[0] as {
+      messages: Array<{
+        role: string;
+        content: string | null;
+        tool_calls?: unknown;
+      }>;
+    };
+    const assistantMsg = params.messages.find((m) => m.role === "assistant")!;
+    expect(assistantMsg.content).toBe(EMPTY_ASSISTANT_TURN_PLACEHOLDER);
+    expect(assistantMsg.tool_calls).toBeUndefined();
   });
 
   test("createAdapterFromConnection wires baseURL from ResolvedAuth", () => {

package/src/providers/inference/__tests__/base-url-route-validation.test.ts

@@ -184,6 +184,22 @@ describe("base_url provider-type gate (create)", () => {
     );
   });
 
+  test("accepts base_url on ollama provider", async () => {
+    mockResolvedAddresses = ["93.184.216.34"];
+    const result = await handleCreate({
+      body: {
+        name: "valid-ollama-remote",
+        provider: "ollama",
+        auth: { type: "none" },
+        base_url: "https://ollama.example.com/v1",
+      },
+    });
+    expect(result).toBeDefined();
+    expect((result as { baseUrl: string }).baseUrl).toBe(
+      "https://ollama.example.com/v1",
+    );
+  });
+
   test("allows null base_url on non-openai-compatible provider", async () => {
     // Setting base_url to null is always allowed (it's a no-op clear).
     const result = await handleCreate({
@@ -433,4 +449,26 @@ describe("base_url provider-type gate (update)", () => {
       }),
     ).rejects.toThrow(/base_url is only valid for openai-compatible/);
   });
+
+  test("accepts adding base_url to an existing ollama connection", async () => {
+    mockResolvedAddresses = ["93.184.216.34"];
+    await handleCreate({
+      body: {
+        name: "update-test-ollama",
+        provider: "ollama",
+        auth: { type: "none" },
+      },
+    });
+
+    const result = await handleUpdate({
+      pathParams: { name: "update-test-ollama" },
+      body: {
+        auth: { type: "none" },
+        base_url: "https://ollama.example.com/v1",
+      },
+    });
+    expect((result as { baseUrl: string }).baseUrl).toBe(
+      "https://ollama.example.com/v1",
+    );
+  });
 });

package/src/providers/inference/__tests__/base-url-security.test.ts

@@ -174,6 +174,16 @@ describe("resolveAuth defense-in-depth", () => {
     }
   });
 
+  test("preserves baseUrl for ollama none-auth", async () => {
+    const result = await resolveAuth({ type: "none" }, "ollama", {
+      baseUrl: "http://192.168.1.50:11434/v1",
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok && result.resolved.kind === "none") {
+      expect(result.resolved.baseUrl).toBe("http://192.168.1.50:11434/v1");
+    }
+  });
+
   test("handles null baseUrl gracefully for any provider", async () => {
     const result = await resolveAuth(
       { type: "api_key", credential: "cred-test" },

package/src/providers/inference/__tests__/connections-ollama.test.ts

@@ -0,0 +1,90 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { migrateCreateProviderConnections } from "../../../persistence/migrations/243-provider-connections.js";
+import { migrateProviderConnectionStatusLabel } from "../../../persistence/migrations/244-provider-connection-status-label.js";
+import { migrateProviderConnectionBaseUrlAndModels } from "../../../persistence/migrations/250-provider-connection-base-url-and-models.js";
+import * as schema from "../../../persistence/schema/index.js";
+import {
+  createConnection,
+  getConnection,
+  updateConnection,
+} from "../connections.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  return drizzle(sqlite, { schema });
+}
+
+function bootDb() {
+  const db = createTestDb();
+  migrateCreateProviderConnections(db);
+  migrateProviderConnectionStatusLabel(db);
+  migrateProviderConnectionBaseUrlAndModels(db);
+  return db;
+}
+
+describe("ollama connection CRUD", () => {
+  test("create without baseUrl leaves it null and does not require models", () => {
+    const db = bootDb();
+    const result = createConnection(db, {
+      name: "ollama-local",
+      provider: "ollama",
+      auth: { type: "none" },
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.connection.baseUrl).toBeNull();
+      expect(result.connection.models).toBeNull();
+    }
+  });
+
+  test("create persists an optional baseUrl", () => {
+    const db = bootDb();
+    const result = createConnection(db, {
+      name: "ollama-remote",
+      provider: "ollama",
+      auth: { type: "none" },
+      baseUrl: "http://192.168.1.50:11434/v1",
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.connection.baseUrl).toBe("http://192.168.1.50:11434/v1");
+      expect(result.connection.models).toBeNull();
+    }
+
+    const fetched = getConnection(db, "ollama-remote");
+    expect(fetched).not.toBeNull();
+    expect(fetched!.baseUrl).toBe("http://192.168.1.50:11434/v1");
+  });
+
+  test("update can change and then clear baseUrl", () => {
+    const db = bootDb();
+    createConnection(db, {
+      name: "ollama-local",
+      provider: "ollama",
+      auth: { type: "none" },
+    });
+
+    const updated = updateConnection(db, "ollama-local", {
+      auth: { type: "none" },
+      baseUrl: "http://127.0.0.1:11434/v1",
+    });
+    expect(updated.ok).toBe(true);
+    if (updated.ok) {
+      expect(updated.connection.baseUrl).toBe("http://127.0.0.1:11434/v1");
+    }
+
+    const cleared = updateConnection(db, "ollama-local", {
+      auth: { type: "none" },
+      baseUrl: null,
+    });
+    expect(cleared.ok).toBe(true);
+    if (cleared.ok) {
+      expect(cleared.connection.baseUrl).toBeNull();
+    }
+  });
+});

package/src/providers/inference/__tests__/missing-credential-guard.test.ts

@@ -0,0 +1,117 @@
+/**
+ * A connection whose credential was force-deleted must fail its next send with
+ * an actionable configuration error. Upstreams that answer an unusable key with
+ * `200` and empty content otherwise reach the user as a blank assistant turn.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { classifyConversationError } from "../../../daemon/conversation-error.js";
+import { credentialKey } from "../../../security/credential-key.js";
+import {
+  deleteSecureKeyAsync,
+  setSecureKeyAsync,
+} from "../../../security/secure-keys.js";
+import { ConnectionResolutionError } from "../../routing-identity.js";
+import type {
+  ContentBlock,
+  Message,
+  Provider,
+  ProviderResponse,
+} from "../../types.js";
+import { MissingCredentialGuardProvider } from "../missing-credential-guard.js";
+
+const CONNECTION_NAME = "agentrouter-primary";
+const ACCOUNT = credentialKey("agentrouter", "api_key");
+
+function respondingProvider(content: ContentBlock[]): Provider {
+  return {
+    name: "openai-compatible",
+    sendMessage: (_messages: Message[]): Promise<ProviderResponse> =>
+      Promise.resolve({
+        content,
+        model: "gpt-4o-mini",
+        usage: { inputTokens: 12, outputTokens: 0 },
+        stopReason: "end_turn",
+      }),
+  };
+}
+
+function guard(inner: Provider): Provider {
+  return new MissingCredentialGuardProvider(inner, {
+    name: CONNECTION_NAME,
+    credentialAccount: ACCOUNT,
+  });
+}
+
+describe("missing credential guard", () => {
+  test("turns an empty upstream turn into an actionable error once the credential is gone", async () => {
+    // GIVEN a connection whose credential has been force-deleted
+    await deleteSecureKeyAsync(ACCOUNT);
+
+    // AND an upstream that answers the unusable key with 200 and no content
+    const provider = guard(respondingProvider([]));
+
+    // WHEN the assistant sends through that connection
+    const sending = provider.sendMessage([
+      {
+        role: "user",
+        content: [{ type: "text", text: "посмотри последние ошибки" }],
+      },
+    ]);
+
+    // THEN the send fails as a missing-credential error naming the connection
+    const error = await sending.then(
+      () => null,
+      (err: unknown) => err,
+    );
+    expect(error).toBeInstanceOf(ConnectionResolutionError);
+    const resolution = error as ConnectionResolutionError;
+    expect(resolution.reason).toBe("missing_credential");
+    expect(resolution.connectionName).toBe(CONNECTION_NAME);
+
+    // AND the conversation layer renders it as a client-visible error telling
+    // the user where to restore the credential, instead of an empty message
+    const classified = classifyConversationError(error, {
+      phase: "agent_loop",
+    });
+    expect(classified.userMessage).toContain(CONNECTION_NAME);
+    expect(classified.userMessage).toMatch(/credential|API key/i);
+    expect(classified.userMessage).toContain("Settings");
+  });
+
+  test("passes an empty turn through while the credential is still stored", async () => {
+    // GIVEN a connection whose credential is present
+    await setSecureKeyAsync(ACCOUNT, "sk-test-value");
+
+    // AND an upstream that legitimately returns no content
+    const provider = guard(respondingProvider([]));
+
+    // WHEN the assistant sends through that connection
+    const response = await provider.sendMessage([
+      { role: "user", content: [{ type: "text", text: "hello" }] },
+    ]);
+
+    // THEN the empty response is left alone: it is not a credential problem
+    expect(response.content).toEqual([]);
+    await deleteSecureKeyAsync(ACCOUNT);
+  });
+
+  test("passes a normal answer through when the credential is gone", async () => {
+    // GIVEN a connection with no stored credential
+    await deleteSecureKeyAsync(ACCOUNT);
+
+    // AND an upstream that still answered with text (e.g. a keyless local model)
+    const provider = guard(
+      respondingProvider([{ type: "text", text: "все хорошо" }]),
+    );
+
+    // WHEN the assistant sends through that connection
+    const response = await provider.sendMessage([
+      { role: "user", content: [{ type: "text", text: "hello" }] },
+    ]);
+
+    // THEN the answer reaches the user untouched
+    expect(response.content).toEqual([{ type: "text", text: "все хорошо" }]);
+  });
+});

package/src/providers/inference/adapter-factory.ts

@@ -18,6 +18,7 @@
  *   3. Register the client in `ADAPTER_FACTORIES` below.
  */
 
+import { normalizeCredentialRef } from "../../security/credential-key.js";
 import { AnthropicProvider } from "../anthropic/client.js";
 import { AtlasCloudProvider } from "../atlascloud/client.js";
 import { BasetenProvider } from "../baseten/client.js";
@@ -39,6 +40,7 @@ import { VercelAIGatewayProvider } from "../vercel-ai-gateway/client.js";
 import type { ResolvedAuth } from "./auth.js";
 import type { ProviderConnection } from "./auth.js";
 import { effectiveConnectionAuth } from "./auth.js";
+import { MissingCredentialGuardProvider } from "./missing-credential-guard.js";
 import { resolveAuth } from "./resolve-auth.js";
 
 /** Unified construction opts. Adapters ignore fields they don't consume. */
@@ -96,12 +98,13 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       // Gemini routes managed proxies through `managedBaseUrl`, not `baseURL`.
       ...(baseURL ? { managedBaseUrl: baseURL } : {}),
     }),
-  ollama: ({ apiKey, model, streamTimeoutMs }) =>
+  ollama: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
     new OllamaProvider(model, {
       // Empty string means keyless — Ollama's client treats undefined as
       // "no key provided" and defaults its internal placeholder.
       apiKey: apiKey || undefined,
       streamTimeoutMs,
+      ...(baseURL ? { baseURL } : {}),
     }),
   fireworks: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
     new FireworksProvider(apiKey, model, {
@@ -130,6 +133,13 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       providerName: "litellm",
       providerLabel: "LiteLLM",
       streamTimeoutMs,
+      // Replay thinking as `reasoning_content` so DeepSeek-compatible
+      // thinking-mode upstreams accept follow-up requests that include tools.
+      assistantReasoningField: "reasoning_content",
+      // Generic OpenAI-compat proxies may front a strict backend (vLLM,
+      // DeepSeek, Portkey). Backfill empty assistant turns so the request
+      // satisfies `content or tool_calls must be set`.
+      backfillEmptyAssistantContent: true,
       ...(baseURL ? { baseURL } : {}),
     }),
   // Keyless openai-compatible endpoints (e.g. LM Studio) ignore the key; the
@@ -139,6 +149,17 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       providerName: "openai-compatible",
       providerLabel: "OpenAI-compatible",
       streamTimeoutMs,
+      // Replay thinking as `reasoning_content` so DeepSeek-compatible
+      // thinking-mode endpoints accept follow-up requests that include tools.
+      assistantReasoningField: "reasoning_content",
+      // Custom endpoints (Portkey, vLLM, LM Studio, DeepSeek-compat) often
+      // reject `{ role: "assistant", content: null }` after a Stop mid-stream
+      // or a reasoning-only turn. Same guard as OpenRouter and Vercel AI
+      // Gateway.
+      backfillEmptyAssistantContent: true,
+      // Custom OpenAI-compatible endpoints may front strict reasoning
+      // models (DeepSeek thinking) that 400 on any explicit tool_choice.
+      omitToolChoiceWhenReasoning: true,
       ...(baseURL ? { baseURL } : {}),
     }),
   minimax: ({ apiKey, model, streamTimeoutMs }) =>
@@ -270,7 +291,7 @@ export function createAdapterFromConnection(
   // identity, the only route that flows through our proxy.
   const isManagedProxy = isVellumManagedConnection(connection);
   const effectiveAuth = effectiveConnectionAuth(connection);
-  return new UsageTrackingProvider(
+  const tracked = new UsageTrackingProvider(
     new RetryProvider(adapter, {
       forwardUsageAttributionHeaders: isManagedProxy,
       credentialSource: isManagedProxy
@@ -288,6 +309,16 @@ export function createAdapterFromConnection(
         : {}),
     }),
   );
+
+  // A credential-backed connection can lose its key between construction and
+  // dispatch. Some upstreams answer that with 200 + empty content rather than
+  // a 401, which would otherwise land as a blank assistant turn.
+  return "credential" in effectiveAuth
+    ? new MissingCredentialGuardProvider(tracked, {
+        name: connection.name,
+        credentialAccount: normalizeCredentialRef(effectiveAuth.credential),
+      })
+    : tracked;
 }
 
 function buildConnectionAdapter(