@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/runtime/routes/inbound-stages/reaction-intercept.test.ts

@@ -69,17 +69,28 @@ mock.module("../../../contacts/contact-store.js", () => ({
 // Downstream side-effect stubs
 // ---------------------------------------------------------------------------
 
-let recordInboundCalls = 0;
+let recordInboundCalls: Array<{ conversationId?: string }> = [];
+let recordedEvent: { eventId: string; conversationId: string } | null = null;
+let outboundTargetConversationId: string | null = null;
+let storedTarget: { messageId: string; conversationId: string } | null = null;
 mock.module("../../../persistence/delivery-crud.js", () => ({
-  recordInbound: () => {
-    recordInboundCalls++;
+  recordInbound: (
+    _channel: string,
+    _chat: string,
+    _externalMessageId: string,
+    options?: { conversationId?: string },
+  ) => {
+    recordInboundCalls.push({ conversationId: options?.conversationId });
     return {
       eventId: "evt-1",
-      conversationId: "conv-1",
+      conversationId: options?.conversationId ?? "conv-minted",
       accepted: true,
       duplicate: false,
     };
   },
+  findMessageBySourceId: () => storedTarget,
+  findSlackConversationByMessageTs: () => outboundTargetConversationId,
+  findInboundEvent: () => recordedEvent,
   clearPayload: () => {},
   linkMessage: () => {},
 }));
@@ -184,7 +195,6 @@ function buildParams(overrides: {
         ? { trustVerdict: overrides.trustVerdict }
         : {}),
     } as never,
-    slackChannelName: "general",
     approvalConversationGenerator: undefined,
   };
 }
@@ -193,7 +203,7 @@ function expectDropped(result: Record<string, unknown>): void {
   expect(result.reaction).toBe("dropped_unknown_actor");
   // Dropped before any write or routing: no dedup record, no transcript row,
   // no approval-pipeline dispatch.
-  expect(recordInboundCalls).toBe(0);
+  expect(recordInboundCalls.length).toBe(0);
   expect(addMessageCalls).toBe(0);
   expect(guardianReplyCalls.length).toBe(0);
 }
@@ -204,10 +214,13 @@ describe("reaction intercept consumes the stamped verdict directly", () => {
     guardianDeliveryReads = 0;
     setMemberVerdictCalls = 0;
     contactLookups = 0;
-    recordInboundCalls = 0;
+    recordInboundCalls = [];
+    recordedEvent = null;
+    outboundTargetConversationId = null;
     addMessageCalls = 0;
     guardianReplyCalls = [];
     guardianReplyResponse = undefined;
+    storedTarget = { messageId: "msg-target", conversationId: "conv-target" };
   });
 
   test("guardian verdict routes the reaction into the approval decision pipeline", async () => {
@@ -244,6 +257,77 @@ describe("reaction intercept consumes the stamped verdict directly", () => {
     expect(result.accepted).toBe(true);
     expect(result.reaction).toBeUndefined();
     expect(addMessageCalls).toBe(1);
+    // Recorded into the reacted message's conversation, never a fresh one.
+    expect(recordInboundCalls).toEqual([{ conversationId: "conv-target" }]);
+  });
+
+  test("a reaction on the assistant's own post resolves through slackMeta", async () => {
+    // Outbound posts open no inbound event, so the ts is only on the row.
+    storedTarget = null;
+    outboundTargetConversationId = "conv-assistant-post";
+
+    const result = await handleSlackReactionIntercept(
+      buildParams({
+        rawSenderId: MEMBER_USER_ID,
+        trustVerdict: MEMBER_VERDICT,
+      }),
+    );
+
+    expect(recordInboundCalls).toEqual([
+      { conversationId: "conv-assistant-post" },
+    ]);
+    expect(addMessageCalls).toBe(1);
+    expect(result).toMatchObject({ accepted: true, duplicate: false });
+  });
+
+  test("a reaction on a message that is not stored is dropped without minting", async () => {
+    storedTarget = null;
+
+    const result = await handleSlackReactionIntercept(
+      buildParams({
+        rawSenderId: MEMBER_USER_ID,
+        trustVerdict: MEMBER_VERDICT,
+      }),
+    );
+
+    expect(result.reaction).toBe("dropped_unknown_target");
+    expect(recordInboundCalls.length).toBe(0);
+    expect(addMessageCalls).toBe(0);
+  });
+
+  test("a redelivered reaction never reaches the guardian rail twice", async () => {
+    recordedEvent = { eventId: "evt-1", conversationId: "conv-target" };
+
+    const result = await handleSlackReactionIntercept(
+      buildParams({
+        rawSenderId: GUARDIAN_USER_ID,
+        trustVerdict: GUARDIAN_VERDICT,
+      }),
+    );
+
+    expect(result).toEqual({
+      accepted: true,
+      duplicate: true,
+      eventId: "evt-1",
+    });
+    expect(guardianReplyCalls.length).toBe(0);
+    expect(addMessageCalls).toBe(0);
+    expect(recordInboundCalls.length).toBe(0);
+  });
+
+  test("a guardian card reaction still applies when the card is not a stored message", async () => {
+    storedTarget = null;
+    guardianReplyResponse = { accepted: true, canonicalRouter: "applied" };
+
+    const result = await handleSlackReactionIntercept(
+      buildParams({
+        rawSenderId: GUARDIAN_USER_ID,
+        trustVerdict: GUARDIAN_VERDICT,
+      }),
+    );
+
+    expect(result).toEqual(guardianReplyResponse);
+    expect(recordInboundCalls.length).toBe(0);
   });
 
   test("unknown verdict is dropped before any write", async () => {

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -9,7 +9,9 @@
  *     or an access-request notification (LUM-2489),
  *   - a stranger's reaction creates no conversation, binding, or transcript
  *     row — it is dropped as channel noise,
- *   - a known contact's reaction is recorded as an inline transcript signal,
+ *   - a known contact's reaction is recorded as an inline transcript signal in
+ *     the conversation of the message it was attached to, whether that message
+ *     arrived from the channel or the assistant posted it,
  *   - a guardian's reaction on an approval card is routed through the guardian
  *     decision pipeline (the same path as buttons and text replies).
  *
@@ -28,12 +30,13 @@ import {
 } from "../../../messaging/providers/slack/message-metadata.js";
 import { addMessage } from "../../../persistence/conversation-crud.js";
 import {
-  clearPayload,
+  findInboundEvent,
+  findMessageBySourceId,
+  findSlackConversationByMessageTs,
   linkMessage,
   recordInbound,
 } from "../../../persistence/delivery-crud.js";
 import { markProcessed } from "../../../persistence/delivery-status.js";
-import { upsertBinding } from "../../../persistence/external-conversation-store.js";
 import { getLogger } from "../../../util/logger.js";
 import type { ApprovalConversationGenerator } from "../../http-types.js";
 import {
@@ -105,8 +108,6 @@ export interface ReactionInterceptParams {
   actorUsername: string | undefined;
   replyCallbackUrl: string | undefined;
   sourceMetadata: SourceMetadata | undefined;
-  /** Slack channel display name, for the conversation binding. */
-  slackChannelName: string | null;
   approvalConversationGenerator: ApprovalConversationGenerator | undefined;
 }
 
@@ -130,7 +131,6 @@ export async function handleSlackReactionIntercept(
     actorUsername,
     replyCallbackUrl,
     sourceMetadata,
-    slackChannelName,
     approvalConversationGenerator,
   } = params;
 
@@ -165,27 +165,11 @@ export async function handleSlackReactionIntercept(
     typeof sourceMetadata?.messageId === "string"
       ? sourceMetadata.messageId
       : undefined;
-  const threadTs =
-    typeof sourceMetadata?.threadId === "string" &&
-    sourceMetadata.threadId.trim().length > 0
-      ? sourceMetadata.threadId.trim()
-      : undefined;
-
-  // Record for dedup + conversation resolution (known contacts only — strangers
-  // were dropped above).
-  const result = recordInbound(
-    sourceChannel,
-    conversationExternalId,
-    externalMessageId,
-    {
-      sourceMessageId: reactedMessageTs,
-      sourceThreadId: threadTs,
-    },
-  );
-
   // Respect disk-pressure cleanup so reactions don't bypass storage
   // protection. Guardians resolve to `allow-cleanup-mode` (not `block`), so a
-  // guardian's approval-by-reaction still flows.
+  // guardian's approval-by-reaction still flows. Blocked silently and before
+  // any write: a reaction is a passive signal, so the message pipeline's
+  // "storage is low, try again" notice is meaningless for an emoji.
   const diskPressure = classifyDiskPressureTurnPolicy(getDiskPressureStatus(), {
     sourceChannel,
     sourceInterface,
@@ -195,44 +179,39 @@ export async function handleSlackReactionIntercept(
     },
   });
   if (diskPressure.action === "block") {
-    // Block silently: a reaction is a passive signal, so the message
-    // pipeline's "storage is low, try again" notice is meaningless for an
-    // emoji — there is nothing to retry. Mark the event processed and stop
-    // before binding/persistence.
-    if (!result.duplicate) {
-      clearPayload(result.eventId);
-      markProcessed(result.eventId);
-    }
     return {
       accepted: true,
-      duplicate: result.duplicate,
-      eventId: result.eventId,
+      reaction: "dropped_disk_pressure",
       diskPressure: "blocked",
       reason: diskPressure.reason,
     };
   }
 
-  // Maintain the conversation binding, matching the message pipeline.
-  upsertBinding({
-    conversationId: result.conversationId,
+  // A redelivery is answered before anything acts on it. Recording the event
+  // is what dedups a reaction, and that happens after the guardian rail, so
+  // without this probe the same emoji could drive a decision twice.
+  const alreadyRecorded = findInboundEvent(
     sourceChannel,
-    externalChatId: conversationExternalId,
-    externalChatName: slackChannelName,
-    externalThreadId: threadTs ?? null,
-    externalUserId: canonicalSenderId ?? rawSenderId ?? null,
-    displayName: actorDisplayName ?? null,
-    username: actorUsername ?? null,
-  });
+    conversationExternalId,
+    externalMessageId,
+  );
+  if (alreadyRecorded) {
+    return {
+      accepted: true,
+      duplicate: true,
+      eventId: alreadyRecorded.eventId,
+    };
+  }
 
-  // Guardian approval-by-reaction → guardian decision pipeline, exactly like
-  // buttons and text replies. Only `reaction:` (added) expresses intent;
+  // Guardian approval-by-reaction runs before the reacted message is resolved:
+  // an approval card is addressed by its own message id and is not always a
+  // stored message. Only `reaction:` (added) expresses intent;
   // `reaction_removed:` never does. `handleGuardianReplyIntercept` self-gates
-  // on `trustClass === "guardian"`, so a contact's reaction returns no response
-  // and falls through to persistence.
-  const isReactionAdded = callbackData.startsWith("reaction:");
-  if (isReactionAdded && replyCallbackUrl && !result.duplicate) {
+  // on `trustClass === "guardian"`, so a contact's reaction returns no
+  // response and falls through to persistence.
+  if (callbackData.startsWith("reaction:") && replyCallbackUrl) {
     const reactionIntercept = await handleGuardianReplyIntercept({
-      isDuplicate: result.duplicate,
+      isDuplicate: false,
       trimmedContent: "",
       hasCallbackData: true,
       callbackData,
@@ -241,35 +220,56 @@ export async function handleSlackReactionIntercept(
       canonicalSenderId,
       sourceChannel,
       conversationExternalId,
-      conversationId: result.conversationId,
-      eventId: result.eventId,
       replyCallbackUrl,
       trustClass: trustCtx.trustClass,
       guardianPrincipalId: trustCtx.guardianPrincipalId,
       approvalConversationGenerator,
     });
-    // Consumed as a guardian decision (applied, or a surfaced failure delivered
-    // as an ephemeral reply). Short-circuit so we do not also persist a
-    // transcript row.
     if (reactionIntercept.response) {
       return reactionIntercept.response;
     }
   }
 
-  // Record the reaction as an inline transcript signal. Requires the reacted
-  // message ts to anchor the rendering.
-  if (!reactedMessageTs) {
+  // The reaction belongs to the conversation of the message it was attached
+  // to. Slack sends no `thread_ts` on a reaction, so resolving a conversation
+  // from the reaction's own address keys one on the reacted message instead of
+  // finding the one that message lives in, minting an orphan per reaction.
+  // A message the assistant never stored has nothing to annotate, so the
+  // reaction is dropped rather than given a conversation of its own.
+  // Inbound messages carry their provider id on the event that delivered
+  // them. The assistant's own posts open no inbound event, so a reaction on
+  // one is resolved through the `slackMeta` those rows carry.
+  const targetConversationId = reactedMessageTs
+    ? (findMessageBySourceId(
+        sourceChannel,
+        conversationExternalId,
+        reactedMessageTs,
+      )?.conversationId ??
+      findSlackConversationByMessageTs(
+        conversationExternalId,
+        reactedMessageTs,
+      ))
+    : null;
+  if (!targetConversationId || !reactedMessageTs) {
     log.debug(
-      { conversationId: result.conversationId, eventId: result.eventId },
-      "Skipping reaction persistence: missing sourceMetadata.messageId",
+      { sourceChannel, conversationExternalId, reactedMessageTs },
+      "Dropping reaction: reacted message is not stored",
     );
-    return {
-      accepted: result.accepted,
-      duplicate: result.duplicate,
-      eventId: result.eventId,
-    };
+    return { accepted: true, reaction: "dropped_unknown_target" };
   }
 
+  const result = recordInbound(
+    sourceChannel,
+    conversationExternalId,
+    externalMessageId,
+    // No `sourceMessageId`: that column names the provider id of the event's
+    // own message, and a reaction is not one. Claiming the reacted message's
+    // id here would put two linked rows on that id, leaving a later edit or
+    // delete of it free to resolve to the reaction instead.
+    { conversationId: targetConversationId },
+  );
+
+  // Record the reaction as an inline transcript signal.
   try {
     await persistSlackReactionAsMessage({
       conversationId: result.conversationId,
@@ -277,7 +277,6 @@ export async function handleSlackReactionIntercept(
       eventId: result.eventId,
       callbackData,
       actorDisplayName,
-      threadTs,
       reactedMessageTs,
       duplicate: result.duplicate,
     });
@@ -311,7 +310,6 @@ async function persistSlackReactionAsMessage(params: {
   eventId: string;
   callbackData: string;
   actorDisplayName?: string;
-  threadTs?: string;
   reactedMessageTs: string;
   duplicate: boolean;
 }): Promise<void> {
@@ -336,7 +334,11 @@ async function persistSlackReactionAsMessage(params: {
     channelId: params.conversationExternalId,
     channelTs: params.reactedMessageTs,
     eventKind: "reaction",
-    ...(params.threadTs ? { threadTs: params.threadTs } : {}),
+    // No `threadTs`: Slack sends none on a reaction, so the gateway's thread
+    // id here is the reacted message's own ts. It equals `channelTs`, which
+    // every reader treats as "not in a thread" anyway, and storing it makes
+    // the row false evidence that a thread belongs to this conversation
+    // (`legacySlackConversationHasThreadEvidence`).
     ...(params.actorDisplayName
       ? { displayName: params.actorDisplayName }
       : {}),

package/src/runtime/routes/index.ts

@@ -127,6 +127,7 @@ import { ROUTES as PUBLISH_ROUTES } from "./publish-routes.js";
 import { ROUTES as QUESTION_ROUTES } from "./question-routes.js";
 import { ROUTES as RECORDING_ROUTES } from "./recording-routes.js";
 import { ROUTES as RENAME_CONVERSATION_ROUTES } from "./rename-conversation-routes.js";
+import { ROUTES as RESOURCE_PRESSURE_ROUTES } from "./resource-pressure-routes.js";
 import { ROUTES as RETROSPECTIVE_ROUTES } from "./retrospective-routes.js";
 import { ROUTES as ROUTE_HOST_WORKER_ROUTES } from "./route-host-worker-routes.js";
 import { ROUTES as SANITY_ROUTES } from "./sanity-routes.js";
@@ -210,6 +211,7 @@ export const ROUTES: RouteDefinition[] = [
   ...DEFAULT_PROVIDER_ROUTES,
   ...DIAGNOSTICS_ROUTES,
   ...DISK_PRESSURE_ROUTES,
+  ...RESOURCE_PRESSURE_ROUTES,
   ...DOMAIN_ROUTES,
   ...DOCUMENT_COMMENT_ROUTES,
   ...DOCUMENT_ROUTES,

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -27,7 +27,7 @@ import {
   ConnectionProviderSchema,
   deriveAuthForProvider,
   ProviderConnectionSchema,
-  PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
+  PROVIDERS_ALLOWING_CUSTOM_BASE_URL,
   VALID_CONNECTION_PROVIDERS,
 } from "../../providers/inference/auth.js";
 import {
@@ -72,14 +72,16 @@ const providerConnectionResponseSchema = ProviderConnectionSchema;
  * Parse and validate `base_url` and `models` from the request body.
  *
  * `base_url` is only accepted for providers in
- * `PROVIDERS_REQUIRING_BASE_URL_AND_MODELS` (currently `openai-compatible`).
+ * `PROVIDERS_ALLOWING_CUSTOM_BASE_URL` (openai-compatible and ollama).
  * For all other providers, supplying `base_url` returns a 400. This prevents
  * API-key exfiltration: an attacker cannot create an `anthropic` connection
  * with a `base_url` pointing to their own server, which would redirect all
  * LLM calls (and the API key) to the attacker.
  *
- * Even for `openai-compatible`, the `base_url` must not point to private
- * networks or cloud metadata endpoints (SSRF protection).
+ * Even for allowed providers, a platform-hosted daemon rejects `base_url`
+ * values that point to private networks or cloud metadata endpoints
+ * (SSRF protection). Self-hosted daemons allow those addresses because
+ * localhost and LAN hosts are the expected target.
  */
 async function parseCustomProviderFields(
   body: Record<string, unknown>,
@@ -96,14 +98,14 @@ async function parseCustomProviderFields(
   if ("base_url" in body) {
     const raw = body.base_url;
 
-    // Gate: base_url is only valid for openai-compatible providers.
+    // Gate: base_url is only valid for providers that persist a custom endpoint.
     if (
       raw !== null &&
       raw !== undefined &&
-      !PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)
+      !PROVIDERS_ALLOWING_CUSTOM_BASE_URL.has(provider)
     ) {
       throw new BadRequestError(
-        `base_url is only valid for openai-compatible providers. Remove base_url or use the openai-compatible provider type.`,
+        `base_url is only valid for openai-compatible and ollama providers. Remove base_url or use a provider that accepts a custom endpoint.`,
       );
     }
 

package/src/runtime/routes/monitoring-routes.ts

@@ -56,6 +56,7 @@ const sampleEventsSchema = z.object({
 const sampleMemoryStatSchema = z.object({
   anonBytes: z.number().nullable(),
   fileBytes: z.number().nullable(),
+  inactiveFileBytes: z.number().nullable(),
   kernelBytes: z.number().nullable(),
   slabReclaimableBytes: z.number().nullable(),
   slabUnreclaimableBytes: z.number().nullable(),
@@ -195,9 +196,16 @@ function readLatestSample(): ResourceSample | null {
     }
     // Samples persisted by an older monitor may predate some fields; fill
     // them with null so the response always matches the documented shape.
+    // The nested memoryStat needs the same backfill for fields added after
+    // a sample was written.
     return {
       ...sample,
-      memoryStat: sample.memoryStat ?? null,
+      memoryStat: sample.memoryStat
+        ? {
+            ...sample.memoryStat,
+            inactiveFileBytes: sample.memoryStat.inactiveFileBytes ?? null,
+          }
+        : null,
       reclaim: sample.reclaim ?? null,
       cpu: sample.cpu ?? null,
       deltas: sample.deltas ?? null,

package/src/runtime/routes/plugins-routes.ts

@@ -1643,7 +1643,7 @@ function mapTogglePluginError(err: unknown): RouteError {
 
 /**
  * Converge plugin-declared schedules against the sentinel this route just
- * wrote, so a toggled plugin's rows disarm or re-arm now rather than at the
+ * wrote, so a disabled plugin's rows disarm now rather than at the
  * reconciler's next backstop sweep.
  *
  * Fire-and-forget: the toggle itself already succeeded on disk, so a reconcile
@@ -1671,15 +1671,27 @@ function reconcilePluginSchedulesInBackground(): void {
  * names WHICH resource is stale, not the new value. The origin client id is
  * threaded through for self-echo suppression.
  */
-function handleEnablePlugin({ pathParams = {}, headers }: RouteHandlerArgs) {
+async function handleEnablePlugin({
+  pathParams = {},
+  headers,
+}: RouteHandlerArgs) {
   try {
     enablePlugin(pathParams.name ?? "");
-    publishPluginsChanged(getOriginClientId(headers));
-    reconcilePluginSchedulesInBackground();
-    return { ok: true };
   } catch (err) {
     throw mapTogglePluginError(err);
   }
+  // A plugin the boot scan skipped for its sentinel has no hooks, tools or
+  // MCP servers in the caches, so clearing the sentinel is not enough to
+  // bring it up. Run the same imperative source reconcile the install and
+  // upgrade routes use, which activates the plugin and then converges its
+  // schedules and MCP servers. Awaited, like the install route, so a client
+  // that lists tools right after enabling sees the plugin up; the reconcile
+  // contains its own failures, so a broken plugin cannot turn a successful
+  // enable into a route error. The invalidation publishes after it for the
+  // same reason: refetching clients should see the post-activation state.
+  await reconcilePluginSourcesNow();
+  publishPluginsChanged(getOriginClientId(headers));
+  return { ok: true };
 }
 
 function handleDisablePlugin({ pathParams = {}, headers }: RouteHandlerArgs) {

package/src/runtime/routes/resource-pressure-routes.ts

@@ -0,0 +1,22 @@
+import { ResourcePressureStatusResponseSchema } from "../../api/responses/resource-pressure-status.js";
+import { getResourcePressureStatus } from "../../daemon/resource-pressure-guard.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import type { RouteDefinition } from "./types.js";
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "getResourcePressureStatus",
+    endpoint: "resource-pressure/status",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Get resource pressure status",
+    description:
+      "Return the current resource pressure status snapshot. Off-platform the guard does not run, so a disabled status is returned.",
+    tags: ["resource-pressure"],
+    responseBody: ResourcePressureStatusResponseSchema,
+    handler: () => ({ status: getResourcePressureStatus() }),
+  },
+];

package/src/runtime/routes/secret-routes.ts

@@ -58,7 +58,16 @@ import {
 } from "../../tools/credentials/metadata-store.js";
 import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
-import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
+import {
+  assertCredentialNotInUse,
+  invalidateConnectionsAfterCredentialDelete,
+} from "./credential-in-use.js";
+import {
+  BadRequestError,
+  InternalError,
+  NotFoundError,
+  RouteError,
+} from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("runtime-http");
@@ -550,7 +559,11 @@ async function handleDeleteSecret({ body }: RouteHandlerArgs) {
     throw new BadRequestError("Request body is required");
   }
 
-  const { type, name } = body as { type?: string; name?: string };
+  const { type, name, force } = body as {
+    type?: string;
+    name?: string;
+    force?: boolean;
+  };
 
   if (!type || typeof type !== "string") {
     throw new BadRequestError("type is required");
@@ -583,6 +596,13 @@ async function handleDeleteSecret({ body }: RouteHandlerArgs) {
           throw new NotFoundError(`API key not found: ${name}`);
         }
       }
+      // Provider connections reference the namespaced account, so the in-use
+      // check keys off `credKey`: the bare pre-migration account is never a
+      // connection's `resolve_auth` target.
+      const affectedConnections = assertCredentialNotInUse(
+        credKey,
+        force === true,
+      );
       // Delete from both locations. During a migration overlap both may exist;
       // ignore "not-found" since one location may already be empty.
       const credDeleteResult = await deleteSecureKeyAsync(credKey);
@@ -598,6 +618,7 @@ async function handleDeleteSecret({ body }: RouteHandlerArgs) {
         );
       }
       await refreshProvidersAfterSecretChange();
+      invalidateConnectionsAfterCredentialDelete(affectedConnections);
       log.info({ provider: name }, "API key deleted via HTTP");
       return { success: true, type, name };
     }
@@ -617,6 +638,7 @@ async function handleDeleteSecret({ body }: RouteHandlerArgs) {
       if (existing === undefined) {
         throw new NotFoundError(`Credential not found: ${name}`);
       }
+      const affectedConnections = assertCredentialNotInUse(key, force === true);
       const deleteResult = await deleteSecureKeyAsync(key);
       if (deleteResult === "error") {
         throw new InternalError(
@@ -639,6 +661,7 @@ async function handleDeleteSecret({ body }: RouteHandlerArgs) {
       if (isManagedProxyCredential(service, field)) {
         await refreshProvidersAfterSecretChange();
       }
+      invalidateConnectionsAfterCredentialDelete(affectedConnections);
       log.info({ service, field }, "Credential deleted via HTTP");
       return { success: true, type, name };
     }
@@ -647,11 +670,10 @@ async function handleDeleteSecret({ body }: RouteHandlerArgs) {
       `Unknown secret type: ${type}. Valid types: api_key, credential`,
     );
   } catch (err) {
-    if (
-      err instanceof BadRequestError ||
-      err instanceof InternalError ||
-      err instanceof NotFoundError
-    ) {
+    // Every RouteError is already a deliberate client-facing outcome (including
+    // CREDENTIAL_IN_USE); re-wrapping one as a 500 would hide its code, status,
+    // and details from the caller.
+    if (err instanceof RouteError) {
       throw err;
     }
     const message = err instanceof Error ? err.message : String(err);
@@ -793,11 +815,20 @@ export const ROUTES: RouteDefinition[] = [
       allowedPrincipalTypes: ACTOR_PRINCIPALS,
     },
     summary: "Delete a secret",
-    description: "Remove a secret from the credential vault by name.",
+    description:
+      "Remove a secret from the credential vault by name. Refused with " +
+      "CREDENTIAL_IN_USE while an LLM provider connection resolves its auth " +
+      "through the credential, unless `force` is set.",
     tags: ["secrets"],
     requestBody: z.object({
       type: z.string().describe("Secret type: 'api_key' or 'credential'"),
       name: z.string().describe("Name of the secret to delete"),
+      force: z
+        .boolean()
+        .optional()
+        .describe(
+          "Delete even when provider connections depend on the credential",
+        ),
     }),
     responseBody: z.object({
       success: z.boolean(),