@vellumai/assistant 0.12.3-staging.2 → 0.12.4-staging.1

package/Dockerfile

@@ -102,6 +102,7 @@ RUN apt-get update && apt-get install -y \
     && rm -rf /var/lib/apt/lists/*
 
 # Desktop system packages persist through container replacement as image layers.
+COPY assistant/docker/mousepad/90-vellum.gschema.override /usr/share/glib-2.0/schemas/90-vellum.gschema.override
 RUN set -eu; \
     wezterm_version=20240203-110809-5046fc22; \
     case "$(dpkg --print-architecture)" in \
@@ -129,6 +130,7 @@ RUN set -eu; \
         libgl1-mesa-dri \
         libgtk-3-0 \
         libvulkan1 \
+        mousepad \
         openbox \
         plank \
         python3 \
@@ -144,6 +146,11 @@ RUN set -eu; \
         xfonts-base \
         xterm \
         /tmp/wezterm.deb; \
+    /usr/lib/*/glib-2.0/glib-compile-schemas --strict /usr/share/glib-2.0/schemas; \
+    mkdir -p /etc/xdg; \
+    awk -v desktop_id=org.xfce.mousepad.desktop \
+        'BEGIN { print "[Default Applications]" } /^MimeType=/ { sub(/^MimeType=/, ""); count = split($0, types, ";"); for (i = 1; i <= count; i++) { if (types[i] != "") { print types[i] "=" desktop_id ";" } } }' \
+        /usr/share/applications/org.xfce.mousepad.desktop > /etc/xdg/mimeapps.list; \
     wezterm --version; \
     rm -rf /tmp/wezterm.deb /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
 

package/README.md

@@ -70,16 +70,16 @@ bun run src/index.ts                # interactive CLI session
 
 ### CLI commands
 
-| Command                                            | Description                                      |
-| -------------------------------------------------- | ------------------------------------------------ |
-| `vellum wake`                                      | Start assistant + gateway from current checkout  |
-| `vellum sleep`                                     | Stop assistant + gateway processes               |
-| `vellum ps`                                        | List assistants and per-assistant process status |
-| `assistant`                                        | Launch interactive CLI session                   |
+| Command                                                    | Description                                      |
+| ---------------------------------------------------------- | ------------------------------------------------ |
+| `vellum wake`                                              | Start assistant + gateway from current checkout  |
+| `vellum sleep`                                             | Stop assistant + gateway processes               |
+| `vellum ps`                                                | List assistants and per-assistant process status |
+| `assistant`                                                | Launch interactive CLI session                   |
 | `assistant conversations list\|search\|new\|export\|clear` | Manage conversations                             |
-| `assistant config set\|get\|list`                  | Manage configuration                             |
-| `assistant keys set\|list\|delete`                 | Manage API keys in secure storage                |
-| `assistant trust list\|add\|update\|remove`        | Manage trust rules                               |
+| `assistant config set\|get\|list`                          | Manage configuration                             |
+| `assistant keys set\|list\|delete`                         | Manage API keys in secure storage                |
+| `assistant trust list\|add\|update\|remove`                | Manage trust rules                               |
 
 ## Project Structure
 
@@ -183,7 +183,7 @@ Internal forwarding routes (`/v1/internal/twilio/*`) are unaffected — these ac
 The `/channels/inbound` endpoint requires a JWT with the `svc_gateway` principal type and `ingress.write` scope to prove the request originated from the gateway. This ensures channel messages can only arrive via the gateway (which performs webhook-level verification) and not via direct HTTP calls that bypass signature checks.
 
 - **JWT-based enforcement:** The route policy in `route-policy.ts` restricts `/channels/inbound` to the `svc_gateway` principal type with `ingress.write` scope. Actor and local principals are rejected with 403.
-- **Auth bypass:** When `DISABLE_HTTP_AUTH=true` is set (platform-managed deployments), JWT verification is skipped and a synthetic context is used.
+- **Auth bypass:** When `DISABLE_HTTP_AUTH=true` is set (platform-managed deployments), a request that supplies no `Authorization` header gets a synthetic context. A request that supplies one is verified normally, and a token that fails verification is rejected.
 
 ## Twilio Setup Primitive
 
@@ -244,8 +244,8 @@ The channel guardian service generates verification challenge instructions with
 ### Operator Notes
 
 - **Verification input format:** Channel verification accepts a bare code reply only (6-digit numeric for identity-bound sessions; 64-char hex for unbound inbound/bootstrap compatibility).
-- **Rebind requirement:** Creating a new guardian challenge when a binding already exists requires `rebind: true` in the HTTP request. Without it, the assistant returns `already_bound`. This prevents accidental guardian replacement.
-- **Takeover prevention:** Verification is rejected when an active binding exists for a different external user. Same-user re-verification is allowed.
+- **Rebind requirement:** Creating a new guardian challenge when a binding already exists requires `rebind: true` in the HTTP request. Without it, the assistant returns `already_bound`. On text channels the resulting code can only be redeemed by the account already bound, which is how the same guardian verifies again; to move the guardian to a different account, revoke the binding first and verify again. An outbound phone verification is the exception: its code replaces the bound number.
+- **Takeover prevention:** On text channels, verification is rejected when an active binding exists for a different external user: the code is spent, the reply is the generic "invalid or expired", and the sender is made neither guardian nor contact. Same-user re-verification is allowed, including for a guardian who revoked their binding and is verifying the same account again. Phone differs: an outbound verification with `rebind: true` replaces the bound number once its code is entered, and an inbound call from a different number is not bound.
 
 ### Vellum Guardian Identity (Actor Tokens)
 

package/docker/mousepad/90-vellum.gschema.override

@@ -0,0 +1,4 @@
+[org.xfce.mousepad.preferences.view]
+font-name='FreeSans 12'
+use-default-monospace-font=false
+word-wrap=true

package/openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.1.0
 info:
   title: Vellum Assistant API
-  version: 0.12.3
+  version: 0.12.4
   description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
 servers:
   - url: http://127.0.0.1:7821
@@ -7985,9 +7985,13 @@ paths:
             enum:
               - background
               - scheduled
+              - all
           description:
             Filter by conversation type. Pass "background" to list background and scheduled conversations together (the
-            back-compat umbrella), or "scheduled" to list only scheduled conversations.
+            back-compat umbrella), "scheduled" to list only scheduled conversations, or "all" for the union of the
+            standard listing and that umbrella, so one paginated cursor spans every type. Combine "all" with
+            archiveStatus=all for a whole-history read; rows are recency-ordered (COALESCE(last_message_at, updated_at)
+            descending) like every other list read, and pinned rows are never appended to it.
         - name: archiveStatus
           in: query
           required: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.3-staging.2",
+  "version": "0.12.4-staging.1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/approval-routes-http.test.ts

@@ -241,8 +241,10 @@ function makeConfirmationEmittingSession(opts?: {
 // Tests
 // ---------------------------------------------------------------------------
 
-const TEST_TOKEN = "test-bearer-token-approvals";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 describe("standalone approval endpoints — HTTP layer", () => {
   let server: RuntimeHttpServer;

package/src/__tests__/call-routes-http.test.ts

@@ -82,8 +82,10 @@ await initializeDb();
 // Helpers
 // ---------------------------------------------------------------------------
 
-const TEST_TOKEN = "test-bearer-token-calls";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 let ensuredConvIds = new Set<string>();
 

package/src/__tests__/conversation-resurface-done.test.ts

@@ -0,0 +1,289 @@
+/**
+ * A Done conversation comes back to the list when a message the user reads
+ * lands in it.
+ *
+ * Two seams enforce the rule: `insertMessageCore`, where every durable append
+ * lands, and the turn's finalize effect, where a streamed reply becomes
+ * readable. These tests drive the insert seam the way each ingest path does,
+ * with `addMessage` and that path's row shape, and drive the finalize seam
+ * through `resurfaceArchivedConversation` itself, which is all the finalize
+ * effect adds to the reserved row.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { eq } from "drizzle-orm";
+
+mock.module("../persistence/embeddings/qdrant-client.js", () => ({
+  getQdrantClient: () => ({
+    searchWithFilter: async () => [],
+    hybridSearch: async () => [],
+    upsertPoints: async () => {},
+    deletePoints: async () => {},
+  }),
+  initQdrantClient: () => {},
+  resolveQdrantUrl: () => "http://127.0.0.1:6333",
+}));
+
+let sidebarDoneEnabled = true;
+mock.module("../config/sidebar-done-gate.js", () => ({
+  SIDEBAR_DONE_FLAG_KEY: "sidebar-done",
+  isSidebarDoneEnabled: () => sidebarDoneEnabled,
+}));
+
+const listInvalidations: Array<{ reason: string; conversationIds: unknown }> =
+  [];
+const actualSyncEvents =
+  await import("../runtime/sync/resource-sync-events.js");
+mock.module("../runtime/sync/resource-sync-events.js", () => ({
+  ...actualSyncEvents,
+  publishConversationListAndMetadataChanged: (
+    reason: string,
+    conversationIds: unknown,
+  ) => {
+    listInvalidations.push({ reason, conversationIds });
+  },
+}));
+
+import {
+  addMessage,
+  archiveConversation,
+  getConversation,
+  reserveMessage,
+  resurfaceArchivedConversation,
+} from "../persistence/conversation-crud.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { conversations, messages } from "../persistence/schema/index.js";
+import {
+  MEMORY_RETROSPECTIVE_INSTRUCTION_KIND,
+  SKILL_CARD_MESSAGE_KIND,
+} from "../plugins/defaults/memory/memory-retrospective-constants.js";
+import { setConfig } from "./helpers/set-config.js";
+
+setConfig("memory", { extraction: { useLLM: false } });
+
+await initializeDb();
+
+const DONE_CONVERSATION_ID = "conv-done";
+const RETRO_FORK_ID = "conv-done-retro-fork";
+
+function insertConversation(id: string): void {
+  const now = Date.now();
+  getDb()
+    .insert(conversations)
+    .values({
+      id,
+      title: null,
+      createdAt: now,
+      updatedAt: now,
+      totalInputTokens: 0,
+      totalOutputTokens: 0,
+      totalEstimatedCost: 0,
+      contextSummary: null,
+      contextCompactedMessageCount: 0,
+      contextCompactedAt: null,
+    })
+    .run();
+}
+
+function resetTables(): void {
+  const db = getDb();
+  db.run("DELETE FROM messages");
+  db.run("DELETE FROM conversations");
+  insertConversation(DONE_CONVERSATION_ID);
+  insertConversation(RETRO_FORK_ID);
+  archiveConversation(DONE_CONVERSATION_ID);
+  listInvalidations.length = 0;
+}
+
+function archivedAtOf(id: string): number | null | undefined {
+  return getConversation(id)?.archivedAt;
+}
+
+function blocks(text: string): string {
+  return JSON.stringify([{ type: "text", text }]);
+}
+
+describe("Done conversations and new activity", () => {
+  beforeEach(() => {
+    sidebarDoneEnabled = true;
+    resetTables();
+  });
+
+  test("assistant output from a scheduled run brings the conversation back", async () => {
+    // The wake persists its `<background_event>` trigger first. That row is
+    // dropped from the transcript, so it must not resurface anything on its
+    // own: the run has produced nothing the user can read yet.
+    await addMessage(
+      DONE_CONVERSATION_ID,
+      "user",
+      blocks(
+        '<background_event source="schedule">Daily digest</background_event>',
+      ),
+      {
+        metadata: {
+          kind: "background-event",
+          backgroundEventSource: "schedule",
+          automated: true,
+        },
+        skipIndexing: true,
+      },
+    );
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+
+    // The run's own output is what the user reads.
+    await addMessage(
+      DONE_CONVERSATION_ID,
+      "assistant",
+      blocks("Here is today's digest."),
+      { metadata: { automated: true }, skipIndexing: true },
+    );
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).toBeNull();
+    expect(listInvalidations).toEqual([
+      { reason: "reordered", conversationIds: DONE_CONVERSATION_ID },
+    ]);
+  });
+
+  test("the empty row an LLM call reserves leaves the conversation Done", async () => {
+    const reserved = await reserveMessage(
+      DONE_CONVERSATION_ID,
+      "assistant",
+      undefined,
+      "inflight/ref.jsonl",
+    );
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+
+    // The finalize seam is what resurfaces it, once the row holds content.
+    expect(
+      resurfaceArchivedConversation(DONE_CONVERSATION_ID, reserved.createdAt),
+    ).toBe(true);
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).toBeNull();
+    expect(listInvalidations).toHaveLength(1);
+  });
+
+  test("a Done mark made after the activity wins over the resurface", () => {
+    const activityAt = Date.now() - 60_000;
+
+    expect(
+      resurfaceArchivedConversation(DONE_CONVERSATION_ID, activityAt),
+    ).toBe(false);
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+  });
+
+  test("an inbound channel message from a person brings the conversation back", async () => {
+    await addMessage(DONE_CONVERSATION_ID, "user", "any updates?", {
+      metadata: {
+        userMessageChannel: "slack",
+        provenanceSourceChannel: "slack",
+      },
+      skipIndexing: true,
+    });
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).toBeNull();
+    expect(listInvalidations).toHaveLength(1);
+  });
+
+  test("rows that never render leave the conversation Done", async () => {
+    await addMessage(DONE_CONVERSATION_ID, "user", "internal signal", {
+      metadata: { hidden: true },
+      skipIndexing: true,
+    });
+    await addMessage(DONE_CONVERSATION_ID, "user", "subagent finished", {
+      metadata: { subagentNotification: { subagentId: "sub-1" } },
+      skipIndexing: true,
+    });
+    await addMessage(DONE_CONVERSATION_ID, "user", "acp session update", {
+      metadata: { acpNotification: { sessionId: "acp-1" } },
+      skipIndexing: true,
+    });
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+  });
+
+  test("a memory retrospective leaves the conversation it reviews Done", async () => {
+    // A retrospective runs in a fork: its instruction and its whole pass are
+    // appended to the fork, never to the conversation under review.
+    await addMessage(RETRO_FORK_ID, "user", "Review the transcript.", {
+      metadata: { kind: MEMORY_RETROSPECTIVE_INSTRUCTION_KIND, hidden: true },
+      skipIndexing: true,
+    });
+    await addMessage(RETRO_FORK_ID, "assistant", blocks("Saved one fact."), {
+      metadata: { automated: true },
+      skipIndexing: true,
+    });
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+  });
+
+  test("a row its producer marked as bookkeeping leaves the conversation Done", async () => {
+    // The retrospective skill card, written the way
+    // `memory-retrospective-skill-card.ts` writes it. Persistence cannot
+    // import the memory plugin (`persistence-layering-guard`), so the producer
+    // declares the row instead of the seam recognising its kind.
+    await addMessage(
+      DONE_CONVERSATION_ID,
+      "assistant",
+      JSON.stringify([
+        {
+          type: "ui_surface",
+          surfaceId: "surface-1",
+          surfaceType: "skill_card",
+          title: "I just learned how to do expense filing",
+          display: "inline",
+          data: { skills: [] },
+        },
+        {
+          type: "text",
+          text: "I just learned how to do expense filing",
+          _surfaceFallback: true,
+        },
+      ]),
+      {
+        metadata: { kind: SKILL_CARD_MESSAGE_KIND, automated: true },
+        skipIndexing: true,
+        clientMessageId: "surface-1",
+        skipResurface: true,
+      },
+    );
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+  });
+
+  test("the flag off keeps every append from clearing archived_at", async () => {
+    sidebarDoneEnabled = false;
+
+    await addMessage(DONE_CONVERSATION_ID, "user", "any updates?", {
+      metadata: {
+        userMessageChannel: "slack",
+        provenanceSourceChannel: "slack",
+      },
+      skipIndexing: true,
+    });
+    await addMessage(
+      DONE_CONVERSATION_ID,
+      "assistant",
+      blocks("Here is today's digest."),
+      { metadata: { automated: true }, skipIndexing: true },
+    );
+
+    expect(archivedAtOf(DONE_CONVERSATION_ID)).not.toBeNull();
+    expect(listInvalidations).toHaveLength(0);
+    expect(
+      getDb()
+        .select()
+        .from(messages)
+        .where(eq(messages.conversationId, DONE_CONVERSATION_ID))
+        .all(),
+    ).toHaveLength(2);
+  });
+});

package/src/__tests__/gemini-provider.test.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { MALFORMED_TOOL_CALL_MESSAGE } from "../providers/malformed-tool-call.js";
 import type {
   ContentBlock,
   Message,
@@ -209,6 +210,36 @@ describe("GeminiProvider", () => {
     expect(result.stopReason).toBe("STOP");
   });
 
+  test("throws a status-less malformed tool-call error on MALFORMED_FUNCTION_CALL", async () => {
+    fakeChunks = [
+      textChunk(",featuredImage:{_type:image},patch:true}]})"),
+      finishChunk("MALFORMED_FUNCTION_CALL", 10, 5),
+    ];
+
+    const error = await provider
+      .sendMessage([{ role: "user", content: [{ type: "text", text: "Hi" }] }])
+      .then(
+        () => undefined,
+        (e: unknown) => e,
+      );
+
+    expect(error).toBeInstanceOf(ProviderError);
+    const providerError = error as ProviderError;
+    expect(providerError.statusCode).toBeUndefined();
+    expect(providerError.message).toContain(MALFORMED_TOOL_CALL_MESSAGE);
+    expect(providerError.message).toContain("MALFORMED_FUNCTION_CALL");
+  });
+
+  test("throws a malformed tool-call error on UNEXPECTED_TOOL_CALL", async () => {
+    fakeChunks = [finishChunk("UNEXPECTED_TOOL_CALL", 10, 0)];
+
+    await expect(
+      provider.sendMessage([
+        { role: "user", content: [{ type: "text", text: "Hi" }] },
+      ]),
+    ).rejects.toThrow(MALFORMED_TOOL_CALL_MESSAGE);
+  });
+
   // -----------------------------------------------------------------------
   // Streaming events
   // -----------------------------------------------------------------------

package/src/__tests__/provider-error-scenarios.test.ts

@@ -118,6 +118,7 @@ mock.module("../util/retry.js", () => {
   };
 });
 
+import { malformedToolCallError } from "../providers/malformed-tool-call.js";
 import { RetryProvider } from "../providers/retry.js";
 import { createStreamTimeout } from "../providers/stream-timeout.js";
 import {
@@ -941,6 +942,51 @@ describe("RetryProvider — streaming corruption retries", () => {
     }
   });
 
+  test("malformed tool-call finishes retry once with a corrective note", async () => {
+    const providerError = malformedToolCallError(
+      "openrouter",
+      "MALFORMED_FUNCTION_CALL",
+    );
+    // Providers wrap stream-loop throws in their generic catch.
+    const wrapped = new ProviderError(
+      `OpenRouter request failed: ${providerError.message}`,
+      "openrouter",
+      undefined,
+      { cause: providerError },
+    );
+    const inner = makeCapturingFlaky(1, wrapped);
+    const provider = new RetryProvider(inner);
+
+    await provider.sendMessage(MESSAGES);
+
+    expect(inner.calls).toBe(2);
+    expect(inner.seen[0]).toBe(MESSAGES);
+    const retried = inner.seen[1]!;
+    const lastMessage = retried[retried.length - 1]!;
+    expect(lastMessage.role).toBe("user");
+    expect(lastMessage.content).toHaveLength(2);
+    const hint = lastMessage.content[1] as { type: string; text: string };
+    expect(hint.type).toBe("text");
+    expect(hint.text).toContain("did not parse");
+    expect(MESSAGES[MESSAGES.length - 1]!.content).toHaveLength(1);
+  });
+
+  test("a malformed tool-call message with an HTTP status is not retried", async () => {
+    const inner = makeFailing(
+      new ProviderError(
+        malformedToolCallError("gemini", "MALFORMED_FUNCTION_CALL").message,
+        "gemini",
+        400,
+      ),
+    );
+    const provider = new RetryProvider(inner);
+
+    await expect(provider.sendMessage(MESSAGES)).rejects.toThrow(
+      "malformed tool call",
+    );
+    expect(inner.calls).toBe(1);
+  });
+
   test("other stream-corruption retries resend the messages untouched", async () => {
     const inner = makeCapturingFlaky(
       1,

package/src/__tests__/provider-platform-proxy-integration.test.ts

@@ -191,6 +191,7 @@ const MANAGED_FALLBACK_PROVIDERS: string[] = [
   "openai",
   "fireworks",
   "together",
+  "typesafe",
 ];
 
 function enableManagedProxy() {
@@ -314,28 +315,57 @@ describe("managed proxy integration — credential precedence", () => {
       },
     );
 
-    test("managed bootstrap registers anthropic, openai, gemini, fireworks, and together", async () => {
+    test("managed bootstrap registers every managed-routable catalog provider", async () => {
       enableManagedProxy();
       mockProviderKeys = {};
       await initializeProviders(makeProvidersConfig("anthropic", "test-model"));
-      expect(listProviders()).toEqual(
-        expect.arrayContaining([
-          "anthropic",
-          "openai",
-          "gemini",
-          "fireworks",
-          "together",
-        ]),
+      expect([...listProviders()].sort()).toEqual(
+        [...MANAGED_FALLBACK_PROVIDERS].sort(),
       );
-      expect(listProviders()).toHaveLength(5);
-      expect(getProviderRoutingSource("anthropic")).toBe("managed-proxy");
-      expect(getProviderRoutingSource("openai")).toBe("managed-proxy");
-      expect(getProviderRoutingSource("gemini")).toBe("managed-proxy");
-      expect(getProviderRoutingSource("fireworks")).toBe("managed-proxy");
-      expect(getProviderRoutingSource("together")).toBe("managed-proxy");
+      for (const provider of MANAGED_FALLBACK_PROVIDERS) {
+        expect(getProviderRoutingSource(provider)).toBe("managed-proxy");
+      }
       expect(getProviderRoutingSource("openrouter")).toBeUndefined();
     });
 
+    test("managed typesafe sends System One through the typesafe proxy path with the assistant key", async () => {
+      enableManagedProxy();
+      mockProviderKeys = {};
+      await initializeProviders(makeProvidersConfig("anthropic", "test-model"));
+
+      const provider = getProvider("typesafe");
+      const originalFetch = globalThis.fetch;
+      let capturedUrl = "";
+      let capturedHeaders: Record<string, string> = {};
+      globalThis.fetch = (async (
+        input: string | URL | Request,
+        init?: RequestInit,
+      ) => {
+        capturedUrl = String(input);
+        capturedHeaders = (init?.headers ?? {}) as Record<string, string>;
+        return new Response(
+          JSON.stringify({
+            model: "jev-latest",
+            answers: {},
+            usage: { input_tokens: 1, output_tokens: 0 },
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }) as typeof fetch;
+      try {
+        await provider.sendMessage([userMsg("hello")], {
+          config: { model: "jev-latest" },
+        });
+      } finally {
+        globalThis.fetch = originalFetch;
+      }
+
+      expect(capturedUrl).toBe(
+        `${PLATFORM_BASE}/v1/runtime-proxy/typesafe/v1/systemone`,
+      );
+      expect(capturedHeaders.Authorization).toBe(`Bearer ${MANAGED_API_KEY}`);
+    });
+
     test("managed anthropic uses anthropic proxy path", async () => {
       enableManagedProxy();
       mockProviderKeys = {};

package/src/__tests__/retry-fallback-escalation.test.ts

@@ -12,7 +12,9 @@ mock.module("../util/retry.js", () => ({
 import {
   recordFallbackServed,
   resetFallbackBreaker,
+  shouldSkipPrimary,
 } from "../providers/fallback-breaker.js";
+import { malformedToolCallError } from "../providers/malformed-tool-call.js";
 import type {
   Message,
   Provider,
@@ -666,6 +668,26 @@ describe("RetryProvider fallback-route escalation", () => {
     expect(backup.calls()).toBe(1);
   });
 
+  test("malformed tool call exhausts retries → backup serves, breaker stays closed", async () => {
+    const primary = failingProvider("openai", () =>
+      malformedToolCallError("openai", "MALFORMED_FUNCTION_CALL"),
+    );
+    const backup = backupProvider();
+    const route = makeRoute(backup.provider);
+    const wrapped = new RetryProvider(primary.provider, {
+      resolveFallbackRoute: route.resolveFallbackRoute,
+    });
+
+    const result = await wrapped.sendMessage(MESSAGES, {
+      config: { callSite: "mainAgent" },
+    });
+
+    expect(primary.calls()).toBe(1 + DEFAULT_MAX_RETRIES);
+    expect(backup.calls()).toBe(1);
+    expect(result.model).toBe("backup-model");
+    expect(shouldSkipPrimary({ upstream: "openai" })).toBe(false);
+  });
+
   test("resolveFallbackRoute unset → behavior unchanged (original error rethrown)", async () => {
     const finalError = new ProviderError("Service Unavailable", "openai", 503);
     const primary = failingProvider("openai", () => finalError);

package/src/__tests__/runtime-attachment-metadata.test.ts

@@ -55,8 +55,10 @@ afterAll(() => {
   resetDbForTesting();
 });
 
-const TEST_TOKEN = "test-bearer-token-attach";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 describe("Runtime attachment metadata", () => {
   let server: RuntimeHttpServer;