@vellumai/assistant 0.11.5 → 0.11.6-staging.1

package/src/runtime/routes/secret-routes.ts

@@ -21,27 +21,28 @@ import {
   setPlatformOrganizationId,
   setPlatformUserId,
 } from "../../config/env.js";
-import { getConfig, invalidateConfigCache } from "../../config/loader.js";
+import { getConfig } from "../../config/loader.js";
 import { maybeDefaultSpeechToManaged } from "../../config/managed-speech-defaults.js";
 import { getCesClient } from "../../credential-execution/ces-runtime.js";
 import type { CesClient } from "../../credential-execution/client.js";
-import { evictConversationsForReload } from "../../daemon/conversation-store.js";
 import {
   isNonSecretPlatformField,
   scrubStoredCredentialFromTranscripts,
 } from "../../daemon/credential-transcript-scrub.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
-import { clearEmbeddingBackendCache } from "../../persistence/embeddings/embedding-backend.js";
 import { maybeReseedCapabilitiesAfterManagedCredential } from "../../plugins/defaults/memory/substrate/boot-maintenance.js";
 import { validateAnthropicApiKey } from "../../providers/anthropic/client.js";
 import { validateAtlasCloudApiKey } from "../../providers/atlascloud/client.js";
 import { validateBasetenApiKey } from "../../providers/baseten/client.js";
 import { validateGeminiApiKey } from "../../providers/gemini/client.js";
+import {
+  refreshProvidersAfterSecretChange,
+  refreshProvidersForRotatedCredential,
+} from "../../providers/inference/credential-rotation.js";
 import { validateMinimaxApiKey } from "../../providers/minimax/client.js";
 import { validateOpenAIApiKey } from "../../providers/openai/client.js";
 import { validatePoolsideApiKey } from "../../providers/poolside/client.js";
 import { API_KEY_PROVIDERS } from "../../providers/provider-secret-catalog.js";
-import { initializeProviders } from "../../providers/registry.js";
 import { credentialKey } from "../../security/credential-key.js";
 import {
   deleteSecureKeyAsync,
@@ -171,29 +172,6 @@ export async function notifyCesOfAssistantApiKeyUpdate(
   void queueApiKeyPropagation(cesClient, value, generation);
 }
 
-// ---------------------------------------------------------------------------
-// Provider refresh after secret changes
-// ---------------------------------------------------------------------------
-
-async function refreshProvidersAfterSecretChange(): Promise<void> {
-  clearEmbeddingBackendCache();
-  invalidateConfigCache();
-  await initializeProviders(getConfig());
-
-  // Provider instances are captured when conversations are created, so a key
-  // change must evict or mark them stale before the next turn. Best-effort:
-  // the credential write has already succeeded, so a disposal failure must not
-  // surface as a 500 that makes clients think the secret change failed.
-  try {
-    evictConversationsForReload();
-  } catch (err) {
-    log.warn(
-      { error: err instanceof Error ? err.message : String(err) },
-      "Error evicting conversations after credential change (non-fatal)",
-    );
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -430,6 +408,8 @@ async function handleAddSecret({ body }: RouteHandlerArgs) {
         if (service === "vellum" && field === "assistant_api_key") {
           await notifyCesOfAssistantApiKeyUpdate(value, getCesClient());
         }
+      } else if (!isTrimmedIdentity) {
+        await refreshProvidersForRotatedCredential(service, field);
       }
       if (
         service === "vellum" &&

package/src/runtime/routes/settings-routes.ts

@@ -6,6 +6,7 @@
 import { readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 
+import { normalizePublicBaseUrl } from "@vellumai/service-contracts/ingress";
 import { z } from "zod";
 
 import { setImage } from "../../avatar/avatar-store.js";
@@ -24,6 +25,7 @@ import {
 } from "../../daemon/conversation-tool-setup.js";
 import {
   computeGatewayTarget,
+  dropTunnelRecordsForNewUrl,
   getIngressConfigResult,
 } from "../../daemon/handlers/config-ingress.js";
 import { normalizeActivationKey } from "../../daemon/handlers/config-voice.js";
@@ -837,12 +839,12 @@ function handleGetPlatformConfig() {
 function handleUpdatePlatformConfig({ body = {} }: RouteHandlerArgs) {
   try {
     const { baseUrl: rawBaseUrl } = body as { baseUrl?: string };
-    const value = (rawBaseUrl ?? "").trim().replace(/\/+$/, "");
+    const value = normalizePublicBaseUrl(rawBaseUrl);
     const raw = loadRawConfig();
     const platform = (raw?.platform ?? {}) as Record<string, unknown>;
-    platform.baseUrl = value || undefined;
+    platform.baseUrl = value;
     saveRawConfig({ ...raw, platform });
-    return { baseUrl: value, success: true };
+    return { baseUrl: value ?? "", success: true };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err }, "Failed to update platform config");
@@ -860,10 +862,11 @@ function handleUpdateIngressConfig({ body = {} }: RouteHandlerArgs) {
       publicBaseUrl?: string;
       enabled?: boolean;
     };
-    const value = (rawUrl ?? "").trim().replace(/\/+$/, "");
+    const value = normalizePublicBaseUrl(rawUrl);
     const raw = loadRawConfig();
     const ingress = (raw?.ingress ?? {}) as Record<string, unknown>;
-    ingress.publicBaseUrl = value || undefined;
+    dropTunnelRecordsForNewUrl(ingress, value);
+    ingress.publicBaseUrl = value;
     if (enabled !== undefined) {
       ingress.enabled = enabled;
     }
@@ -878,7 +881,7 @@ function handleUpdateIngressConfig({ body = {} }: RouteHandlerArgs) {
 
     return {
       enabled: isEnabled,
-      publicBaseUrl: value,
+      publicBaseUrl: value ?? "",
       localGatewayTarget: computeGatewayTarget(),
       success: true,
     };