@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/providers/__tests__/connection-model-compat.test.ts

@@ -50,6 +50,8 @@ describe("isConnectionCompatibleWithModel", () => {
     expect(isConnectionCompatibleWithModel(conn, "gpt-5.4-nano")).toBe(false);
     expect(isConnectionCompatibleWithModel(conn, "gpt-5.5-pro")).toBe(false);
     expect(isConnectionCompatibleWithModel(conn, "gpt-5.3-codex")).toBe(false);
+    expect(isConnectionCompatibleWithModel(conn, "gpt-5.4")).toBe(false);
+    expect(isConnectionCompatibleWithModel(conn, "gpt-5.4-mini")).toBe(false);
   });
 
   test("oauth_subscription connection is compatible with a Codex model", () => {
@@ -59,8 +61,6 @@ describe("isConnectionCompatibleWithModel", () => {
     expect(isConnectionCompatibleWithModel(conn, "gpt-5.6-terra")).toBe(true);
     expect(isConnectionCompatibleWithModel(conn, "gpt-5.6-luna")).toBe(true);
     expect(isConnectionCompatibleWithModel(conn, "gpt-5.5")).toBe(true);
-    expect(isConnectionCompatibleWithModel(conn, "gpt-5.4")).toBe(true);
-    expect(isConnectionCompatibleWithModel(conn, "gpt-5.4-mini")).toBe(true);
   });
 
   test("undefined model applies no gating (compatible)", () => {
@@ -165,7 +165,7 @@ describe("auto-resolution skips oauth_subscription connections for non-Codex mod
 
   test("Codex model can select the oauth_subscription connection", async () => {
     registerConnections([OPENAI_CODEX, OPENAI_KEY]);
-    setOpenAiProfile("gpt-5.4");
+    setOpenAiProfile("gpt-5.5");
 
     const result = await getConfiguredProvider("mainAgent", {
       overrideProfile: "openai-any",

package/src/providers/__tests__/retry-callsite.test.ts

@@ -149,6 +149,47 @@ describe("RetryProvider — callSite resolution", () => {
     expect(headers).not.toHaveProperty("session_id");
   });
 
+  test("stamps a stable fallback session on OpenCode calls with no conversation", async () => {
+    setLlmConfig({
+      callSites: {
+        memoryRetrieval: {
+          provider: "opencode",
+          model: "mimo-v2.5-free",
+        },
+      },
+    });
+
+    const seen: SendMessageOptions[] = [];
+    const wrapped = new RetryProvider(
+      makeProvider("opencode", (options) => {
+        seen.push(options!);
+      }),
+    );
+
+    await wrapped.sendMessage(DUMMY_MESSAGES, {
+      config: { callSite: "memoryRetrieval" },
+    });
+    await wrapped.sendMessage(DUMMY_MESSAGES, {
+      config: { callSite: "memoryRetrieval", conversationId: "   " },
+    });
+
+    const sessions = seen.map(
+      (options) =>
+        (options.config?.requestHeaders as Record<string, string>)[
+          "x-opencode-session"
+        ],
+    );
+    expect(sessions[0]).toMatch(/\S/);
+    expect(sessions[1]).toBe(sessions[0]!);
+    for (const options of seen) {
+      const config = options.config as Record<string, unknown>;
+      const headers = config.requestHeaders as Record<string, string>;
+      expect(headers["x-opencode-request"]).toMatch(/\S/);
+      expect(headers).not.toHaveProperty("session_id");
+      expect(config.conversationId).toBeUndefined();
+    }
+  });
+
   test("does not stamp OpenCode headers on openai-compatible", async () => {
     setLlmConfig({
       callSites: {

package/src/providers/__tests__/retry-outbound-sanitize.test.ts

@@ -0,0 +1,176 @@
+/**
+ * `RetryProvider` strips orphaned UTF-16 surrogates from every outbound
+ * request before the inner adapter sees it. An orphan (half of a surrogate
+ * pair left by a code-unit `.slice()`) serializes to a `\udXXX` escape that
+ * strict provider parsers reject with a 400, so the guard sits at the one
+ * layer every adapter shares instead of inside each client.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { stripOrphanedSurrogates } from "../../util/unicode.js";
+import { RetryProvider } from "../retry.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+  SendMessageOptions,
+} from "../types.js";
+
+const OK_RESPONSE = {
+  content: [{ type: "text", text: "ok" }],
+  model: "test-model",
+  usage: { inputTokens: 1, outputTokens: 1 },
+} as unknown as ProviderResponse;
+
+const LONE_HIGH = "\uD83C";
+const LONE_LOW = "\uDF89";
+const EMOJI = "🎉";
+
+function capturingProvider(): {
+  provider: Provider;
+  received: () => { messages: Message[]; options?: SendMessageOptions };
+} {
+  let captured: { messages: Message[]; options?: SendMessageOptions } | null =
+    null;
+  const provider: Provider = {
+    name: "openai",
+    sendMessage: async (messages, options) => {
+      captured = { messages, options };
+      return OK_RESPONSE;
+    },
+  };
+  return {
+    provider,
+    received: () => {
+      if (!captured) {
+        throw new Error("inner provider was not called");
+      }
+      return captured;
+    },
+  };
+}
+
+describe("RetryProvider outbound surrogate sanitization", () => {
+  test("an orphaned surrogate in a text block, a tool result, the system prompt, and a tool description never reaches the inner adapter", async () => {
+    const { provider, received } = capturingProvider();
+    const messages: Message[] = [
+      {
+        role: "user",
+        content: [{ type: "text", text: `memory preview ${LONE_HIGH} cut` }],
+      },
+      {
+        role: "assistant",
+        content: [{ type: "tool_use", id: "tu1", name: "bash", input: {} }],
+      },
+      {
+        role: "user",
+        content: [
+          {
+            type: "tool_result",
+            tool_use_id: "tu1",
+            content: `shell output ${LONE_LOW} more`,
+          },
+        ],
+      },
+    ];
+
+    await new RetryProvider(provider).sendMessage(messages, {
+      systemPrompt: `system ${LONE_HIGH}`,
+      tools: [
+        {
+          name: "select_pages",
+          description: `pick ${LONE_LOW}`,
+          input_schema: { type: "object", properties: {} },
+        },
+      ],
+    });
+
+    const sent = received();
+    expect(stripOrphanedSurrogates(JSON.stringify(sent.messages))).toBe(
+      JSON.stringify(sent.messages),
+    );
+    const systemPrompt = sent.options?.systemPrompt ?? "";
+    expect(stripOrphanedSurrogates(systemPrompt)).toBe(systemPrompt);
+    expect(stripOrphanedSurrogates(JSON.stringify(sent.options?.tools))).toBe(
+      JSON.stringify(sent.options?.tools),
+    );
+    // The orphan is replaced, not dropped, so surrounding text survives.
+    const text = sent.messages[0]!.content[0] as { text: string };
+    expect(text.text).toBe("memory preview � cut");
+  });
+
+  test("an inline base64 payload is passed through by reference, not scanned", async () => {
+    const { provider, received } = capturingProvider();
+    // Base64 is ASCII by construction; the guard must not walk a payload that
+    // can run to a hundred megabytes. A deliberately corrupt payload proves
+    // the field was skipped rather than scanned and found clean.
+    const source = {
+      type: "base64" as const,
+      media_type: "image/png",
+      data: `AAAA${LONE_HIGH}`,
+    };
+    const messages: Message[] = [
+      {
+        role: "user",
+        content: [
+          { type: "image", source },
+          { type: "text", text: `caption ${LONE_LOW}` },
+        ],
+      },
+    ];
+
+    await new RetryProvider(provider).sendMessage(messages);
+
+    const sent = received();
+    const image = sent.messages[0]!.content[0] as { source: unknown };
+    expect(image.source).toBe(source);
+    const text = sent.messages[0]!.content[1] as { text: string };
+    expect(text.text).toBe("caption �");
+  });
+
+  test("token-count requests are sanitized the same way", async () => {
+    let counted: {
+      messages: Message[];
+      systemPrompt: string;
+      tools: unknown;
+    } | null = null;
+    const provider: Provider = {
+      name: "anthropic",
+      sendMessage: async () => OK_RESPONSE,
+      countInputTokens: async (messages, systemPrompt, tools) => {
+        counted = { messages, systemPrompt, tools };
+        return 7;
+      },
+    };
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: `count ${LONE_HIGH}` }] },
+    ];
+
+    const total = await new RetryProvider(provider).countInputTokens!(
+      messages,
+      `system ${LONE_LOW}`,
+      undefined,
+    );
+
+    expect(total).toBe(7);
+    const seen = counted!;
+    const text = seen.messages[0]!.content[0] as { text: string };
+    expect(text.text).toBe("count �");
+    expect(seen.systemPrompt).toBe("system �");
+  });
+
+  test("a well-formed request passes through by reference, emoji intact", async () => {
+    const { provider, received } = capturingProvider();
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: `hello ${EMOJI}` }] },
+    ];
+
+    await new RetryProvider(provider).sendMessage(messages);
+
+    const sent = received();
+    expect(sent.messages).toBe(messages);
+    const text = sent.messages[0]!.content[0] as { text: string };
+    expect(text.text).toContain(EMOJI);
+  });
+});

package/src/providers/anthropic/client.ts

@@ -9,7 +9,6 @@ import {
   INSUFFICIENT_CREDITS_PATTERNS,
 } from "../../util/provider-error-patterns.js";
 import { extractRetryAfterMs } from "../../util/retry.js";
-import { stripOrphanedSurrogatesDeep } from "../../util/unicode.js";
 import {
   clampProviderString,
   isDecodableTextMimeType,
@@ -201,43 +200,6 @@ export function deriveAnthropicReason(
   return "unknown";
 }
 
-/** Rate-limit the orphaned-surrogate warning so a single bad stream can't flood logs. */
-const ORPHAN_WARNING_THROTTLE_MS = 60_000;
-let lastOrphanWarningMs = 0;
-
-function logOrphanedSurrogateWarning(
-  fixedStringCount: number,
-  messages: Anthropic.MessageParam[],
-): void {
-  const now = Date.now();
-  if (now - lastOrphanWarningMs < ORPHAN_WARNING_THROTTLE_MS) {
-    return;
-  }
-  lastOrphanWarningMs = now;
-  const blockTypes = new Set<string>();
-  for (const msg of messages) {
-    if (!Array.isArray(msg.content)) {
-      continue;
-    }
-    for (const block of msg.content) {
-      if (typeof block !== "object" || block == null) {
-        continue;
-      }
-      const type = (block as { type?: string }).type;
-      if (type) {
-        blockTypes.add(type);
-      }
-    }
-  }
-  log.warn(
-    {
-      fixedStringCount,
-      blockTypes: Array.from(blockTypes),
-    },
-    "stripped orphaned UTF-16 surrogates from outbound Anthropic request — upstream truncation is not surrogate-aware",
-  );
-}
-
 /**
  * Validate an Anthropic API key by making a lightweight GET /v1/models call.
  * Returns `{ valid: true }` on success or `{ valid: false, reason: string }` on failure.
@@ -1299,15 +1261,6 @@ export class AnthropicProvider implements Provider {
       // previous turn exists to anchor). At most two message-level
       // breakpoints are placed, so the total can't drift past 4.
 
-      // Strip orphaned UTF-16 surrogates so the Anthropic JSON parser never
-      // sees invalid strings produced by upstream surrogate-splitting `.slice()` calls.
-      const sanitized = stripOrphanedSurrogatesDeep(params);
-      if (sanitized.changed) {
-        logOrphanedSurrogateWarning(sanitized.fixedStringCount, sentMessages);
-        params = sanitized.value;
-        sentMessages = params.messages;
-      }
-
       // Callers can stamp `cache_control` on message blocks before the
       // provider sees them. Two repairs apply:
       // - `disableCache`: strip the marker entirely — this call opted out of

package/src/providers/gemini/client.ts

@@ -15,6 +15,7 @@ import {
   keepFileAsWorkspaceRef,
 } from "../content-block-size.js";
 import { fileBlockToProviderText } from "../file-block-text.js";
+import { unsignedThoughtSignatureFallback } from "../gemini-thought-signature.js";
 import { base64Source, resolveMediaReferences } from "../media-resolve.js";
 import { PROVIDER_CATALOG } from "../model-catalog.js";
 import { recordProviderRequestDiagnostics } from "../request-diagnostics.js";
@@ -45,13 +46,6 @@ import {
 const GEMINI_CONTEXT_OVERFLOW_TOKEN_PATTERNS =
   /token.?count.*exceeds|exceeds.*maximum.*tokens|prompt.?is.?too.?long|too.?many.?(?:input.?)?tokens|input.?too.?long|context.?length.?exceeded/i;
 
-const GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE =
-  "context_engineering_is_the_way_to_go";
-
-function isGemini3Model(model: string): boolean {
-  return model.startsWith("gemini-3") || model.startsWith("models/gemini-3");
-}
-
 const THINKING_LEVEL_BY_NAME: Record<ThinkingLevelName, ThinkingLevel> = {
   minimal: ThinkingLevel.MINIMAL,
   low: ThinkingLevel.LOW,
@@ -435,7 +429,8 @@ export class GeminiProvider implements Provider {
     const maxTokens = configObj?.max_tokens as number | undefined;
     const modelOverride = configObj?.model as string | undefined;
     const usageAttributionHeaders = configObj?.usageAttributionHeaders as
-      Record<string, string> | undefined;
+      | Record<string, string>
+      | undefined;
     const activeModel = modelOverride ?? this.model;
     const thinkingConfig = geminiModelSupportsThinking(activeModel)
       ? buildThinkingConfig(
@@ -902,28 +897,19 @@ export class GeminiProvider implements Provider {
     parts: genai.Part[],
     model: string,
   ): void {
-    if (!isGemini3Model(model)) {
-      return;
-    }
-
     const functionCallParts = parts.filter((part) => part.functionCall);
-    if (functionCallParts.length === 0) {
-      return;
-    }
-
-    const hasRealThoughtSignature = functionCallParts.some((part) =>
-      Boolean(part.thoughtSignature),
+    const fallback = unsignedThoughtSignatureFallback(
+      functionCallParts.map((part) => part.thoughtSignature),
+      { model },
     );
-    if (hasRealThoughtSignature) {
+    if (!fallback) {
       return;
     }
-
-    const firstFunctionCallPart = functionCallParts[0];
+    const firstFunctionCallPart = functionCallParts[fallback.index];
     if (!firstFunctionCallPart) {
       return;
     }
-    firstFunctionCallPart.thoughtSignature =
-      GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE;
+    firstFunctionCallPart.thoughtSignature = fallback.signature;
   }
 
   private supportsGeminiInlineFile(mimeType: string): boolean {

package/src/providers/gemini-thought-signature.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
+  isGemini3Model,
+  unsignedThoughtSignatureFallback,
+} from "./gemini-thought-signature.js";
+
+describe("isGemini3Model", () => {
+  test("matches native Gemini 3 ids", () => {
+    expect(isGemini3Model("gemini-3.7-flash")).toBe(true);
+    expect(isGemini3Model("models/gemini-3.1-pro-preview")).toBe(true);
+  });
+
+  test("matches OpenAI-compatible catalog prefixes", () => {
+    expect(isGemini3Model("google/gemini-3.7-flash")).toBe(true);
+  });
+
+  test("does not match Gemini 2.5 or unrelated ids", () => {
+    expect(isGemini3Model("gemini-2.5-flash")).toBe(false);
+    expect(isGemini3Model("gpt-5.2")).toBe(false);
+  });
+});
+
+describe("unsignedThoughtSignatureFallback", () => {
+  test("stamps the dummy on the first unsigned Gemini 3 call", () => {
+    expect(
+      unsignedThoughtSignatureFallback([undefined, undefined], {
+        model: "gemini-3.7-flash",
+      }),
+    ).toEqual({
+      index: 0,
+      signature: GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
+    });
+  });
+
+  test("does not stamp when any call already has a signature", () => {
+    expect(
+      unsignedThoughtSignatureFallback(["signed-thought-1", undefined], {
+        model: "gemini-3.7-flash",
+      }),
+    ).toBeUndefined();
+  });
+
+  test("does not stamp for non-Gemini-3 models when a model id is provided", () => {
+    expect(
+      unsignedThoughtSignatureFallback([undefined], { model: "gpt-5.2" }),
+    ).toBeUndefined();
+  });
+
+  test("stamps unsigned calls when no model gate is supplied", () => {
+    expect(unsignedThoughtSignatureFallback([undefined])).toEqual({
+      index: 0,
+      signature: GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
+    });
+  });
+
+  test("does not stamp an empty function-call list", () => {
+    expect(
+      unsignedThoughtSignatureFallback([], { model: "gemini-3.7-flash" }),
+    ).toBeUndefined();
+  });
+});

package/src/providers/gemini-thought-signature.ts

@@ -0,0 +1,44 @@
+/**
+ * Gemini 3.x requires a thought signature on the first function-call part of
+ * each step. When history has no captured signature (unsigned tool_use from an
+ * earlier provider, or a client-injected call), Google documents these dummy
+ * values to skip validation.
+ */
+export const GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE =
+  "context_engineering_is_the_way_to_go";
+
+/**
+ * True for Gemini 3.x model ids, including the native `models/` prefix and
+ * OpenAI-compatible catalog prefixes such as `google/gemini-3.7-flash`.
+ */
+export function isGemini3Model(model: string): boolean {
+  if (model.startsWith("gemini-3") || model.startsWith("models/gemini-3")) {
+    return true;
+  }
+  return /\/gemini-3/.test(model);
+}
+
+/**
+ * Decide whether unsigned function-call history should receive Google's
+ * documented dummy thought signature. Returns the first call's index when
+ * every call is unsigned. Pass `model` to restrict this to Gemini 3.x;
+ * omit it for retry backfills that already observed a thought-signature 4xx.
+ */
+export function unsignedThoughtSignatureFallback(
+  signatures: ReadonlyArray<string | undefined | null>,
+  options?: { model?: string },
+): { index: 0; signature: string } | undefined {
+  if (options?.model !== undefined && !isGemini3Model(options.model)) {
+    return undefined;
+  }
+  if (signatures.length === 0) {
+    return undefined;
+  }
+  if (signatures.some((signature) => Boolean(signature))) {
+    return undefined;
+  }
+  return {
+    index: 0,
+    signature: GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
+  };
+}

package/src/providers/inference/__tests__/endpoint-probe.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
+import {
+  OPENCODE_GO_BASE_URL,
+  OPENCODE_REQUEST_HEADER,
+  OPENCODE_SESSION_HEADER,
+} from "../../opencode/client.js";
 import { testInferenceConnection } from "../endpoint-probe.js";
 
 // Keyless auth so the probe never touches the vault; the fetch stub records
@@ -11,11 +16,18 @@ const CONNECTION = {
   models: [{ id: "meta/llama-3.1-8b-instruct" }],
 };
 
-function stubFetch(status: number, calls: { url: string; body: unknown }[]) {
+type ProbeCall = {
+  url: string;
+  body: unknown;
+  headers: Record<string, string>;
+};
+
+function stubFetch(status: number, calls: ProbeCall[]) {
   return (async (url: RequestInfo | URL, init?: RequestInit) => {
     calls.push({
       url: String(url),
       body: JSON.parse(String(init?.body)),
+      headers: { ...(init?.headers as Record<string, string>) },
     });
     return new Response(status < 400 ? "{}" : "404 page not found", { status });
   }) as typeof fetch;
@@ -23,7 +35,7 @@ function stubFetch(status: number, calls: { url: string; body: unknown }[]) {
 
 describe("testInferenceConnection", () => {
   test("reports ok:false with a base-path hint on 404", async () => {
-    const calls: { url: string; body: unknown }[] = [];
+    const calls: ProbeCall[] = [];
     const result = await testInferenceConnection(
       CONNECTION,
       stubFetch(404, calls),
@@ -43,7 +55,7 @@ describe("testInferenceConnection", () => {
   });
 
   test("reports ok:true on 200 from a correct base URL", async () => {
-    const calls: { url: string; body: unknown }[] = [];
+    const calls: ProbeCall[] = [];
     const result = await testInferenceConnection(
       { ...CONNECTION, baseUrl: "https://integrate.api.nvidia.com/v1" },
       stubFetch(200, calls),
@@ -75,6 +87,33 @@ describe("testInferenceConnection", () => {
     expect(result?.hint).toContain("connection refused");
   });
 
+  test("sends OpenCode session and request headers to an OpenCode endpoint", async () => {
+    const calls: ProbeCall[] = [];
+    const result = await testInferenceConnection(
+      {
+        ...CONNECTION,
+        provider: "opencode",
+        baseUrl: OPENCODE_GO_BASE_URL,
+        models: [{ id: "kimi-k3" }],
+      },
+      stubFetch(200, calls),
+    );
+
+    expect(result).toMatchObject({ ok: true, status: 200 });
+    const headers = calls[0].headers;
+    expect(headers[OPENCODE_SESSION_HEADER]).toMatch(/\S/);
+    expect(headers[OPENCODE_REQUEST_HEADER]).toMatch(/\S/);
+    expect(headers).not.toHaveProperty("session_id");
+    expect(calls[0].body).not.toHaveProperty(OPENCODE_SESSION_HEADER);
+  });
+
+  test("does not send OpenCode headers to other providers", async () => {
+    const calls: ProbeCall[] = [];
+    await testInferenceConnection(CONNECTION, stubFetch(200, calls));
+    expect(calls[0].headers).not.toHaveProperty(OPENCODE_SESSION_HEADER);
+    expect(calls[0].headers).not.toHaveProperty(OPENCODE_REQUEST_HEADER);
+  });
+
   test("skips when there is no base URL or no model to probe with", async () => {
     const neverFetch = (async () => {
       throw new Error("should not be called");

package/src/providers/inference/auth.ts

@@ -15,9 +15,8 @@ import { VELLUM_MANAGED_PROVIDER } from "../vellum-model-routing.js";
  *   - platform: route via Vellum managed proxy; no client-side credential.
  *   - none: no auth (e.g. Ollama running locally).
  *   - oauth_subscription: OAuth-based subscription auth (e.g. ChatGPT Codex).
- *
- * Schema-accepted variants (runtime rejects with a clear "not yet shipped" error):
- *   - service_account: service-account credentials (Vertex AI, Bedrock).
+ *   - service_account: Google service-account JSON key (Vertex AI); signs a
+ *     JWT and exchanges it for a bearer token at the embedded token_uri.
  */
 export const AuthSchema = z
   .discriminatedUnion("type", [

package/src/providers/inference/connection-availability.ts

@@ -178,14 +178,33 @@ export async function computeConnectionAvailability(
   }
 
   switch (connection.auth.type) {
-    // Schema-accepted but not dispatchable: `resolveAuth` returns
-    // not_implemented for service_account, so a stored credential still
-    // cannot serve inference.
-    case "service_account":
-      return {
-        status: "unsupported_auth",
-        message: `Connection "${resolvedConnectionName}" uses service-account auth, which inference does not support yet. Pick a connection with a different auth type.`,
-      };
+    case "service_account": {
+      const result = await getSecureKeyResultAsync(connection.auth.credential);
+      if (result.unreachable) {
+        return {
+          status: "unknown",
+          message: `The credential store is unreachable, so the credential for connection "${resolvedConnectionName}" could not be verified. Try again shortly.`,
+        };
+      }
+      if (result.value == null) {
+        return {
+          status: "missing_credential",
+          message: `Connection "${resolvedConnectionName}" has no service-account credential stored. Add one ${SETTINGS_HINT}.`,
+        };
+      }
+      // Validate the JSON payload before reporting ok: a stored value that is
+      // not a well-formed service-account object will be rejected by dispatch,
+      // so surface the problem here rather than letting a turn fail silently.
+      const { parseServiceAccountKey } =
+        await import("./service-account-token.js");
+      if (!parseServiceAccountKey(result.value)) {
+        return {
+          status: "missing_credential",
+          message: `Connection "${resolvedConnectionName}" has an invalid service-account credential (expected JSON with client_email, private_key, and token_uri). Update it ${SETTINGS_HINT}.`,
+        };
+      }
+      return { status: "ok" };
+    }
     case "api_key":
     case "oauth_subscription": {
       const result = await getSecureKeyResultAsync(connection.auth.credential);

package/src/providers/inference/endpoint-probe.ts

@@ -10,6 +10,7 @@
 import { z } from "zod";
 
 import { getLogger } from "../../util/logger.js";
+import { resolveOpenCodeRequestHeaders } from "../opencode/client.js";
 import type { Auth, ConnectionModel } from "./auth.js";
 import { resolveAuth } from "./resolve-auth.js";
 
@@ -72,12 +73,20 @@ export async function testInferenceConnection(
   }
   const authHeaders =
     resolved.resolved.kind === "header" ? resolved.resolved.headers : {};
+  // OpenCode Go rejects requests without a session header, which would
+  // report a false HTTP 400 hint for a correctly configured connection.
+  const providerHeaders =
+    connection.provider === "opencode" ? resolveOpenCodeRequestHeaders() : {};
 
   const url = `${connection.baseUrl.replace(/\/+$/, "")}/chat/completions`;
   try {
     const res = await fetchImpl(url, {
       method: "POST",
-      headers: { ...authHeaders, "Content-Type": "application/json" },
+      headers: {
+        ...authHeaders,
+        ...providerHeaders,
+        "Content-Type": "application/json",
+      },
       body: JSON.stringify({
         model,
         messages: [{ role: "user", content: "ping" }],