pi-roundtable-sandbox 0.7.13 → 0.7.14

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.7.14
+
+- A model request the broker refuses (an unknown role, a native tool, remote media, a remote schema) is answered with a 400 in the Anthropic API's error shape (`invalid_request_error`) instead of a 502, and logged as `sandbox upstream call failed`. Claude Code 2.1.284 (agent SDK 0.3.284) sends a mid-conversation `role: "system"` message when MCP tools arrive late; the broker refused it with a 502, which Claude Code retried about ten times over several minutes before the turn failed. The refusal of a role now reads `messages.N: Unexpected role "system": the input message role must be "user" or "assistant"`, which Claude Code recognizes: it resends without system messages for the rest of that conversation. The broker still never forwards a system message.
+
 ## 0.7.13
 
 - `precheckScriptRunner` forwards only the tools approved with the script (pi-roundtable 0.7.13's `PrecheckScriptContext.tools`) among those `grant` allows, and takes `toolName(server, tool)`, the name the host's hold rules know a tool by (default the tool's own name).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-sandbox",
-	"version": "0.7.13",
+	"version": "0.7.14",
 	"description": "Sealed guest channels and an allow-listed credential broker for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -52,7 +52,7 @@
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
 		"discord.js": "14.27.0",
-		"pi-roundtable": "0.7.13",
+		"pi-roundtable": "0.7.14",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/pi-broker.ts

@@ -616,13 +616,29 @@ export class PiSandboxBroker {
 					if (value && value.length <= 256) headers.set(name, value);
 				}
 			} else {
-				body = piModelInput(
-					input,
-					this.#options.model,
-					url.pathname.endsWith("/count_tokens"),
-					this.#options.maxOutputTokens ?? 128_000,
-					turn.context.thinking,
-				);
+				try {
+					body = piModelInput(
+						input,
+						this.#options.model,
+						url.pathname.endsWith("/count_tokens"),
+						this.#options.maxOutputTokens ?? 128_000,
+						turn.context.thinking,
+					);
+				} catch (error) {
+					// The request itself is refused: a 400 the client does not retry unchanged, in the
+					// API's error shape so it can resend without what was refused. A 502 would be retried.
+					failed(secret, { status: 400, error });
+					return Response.json(
+						{
+							type: "error",
+							error: {
+								type: "invalid_request_error",
+								message: error instanceof Error ? error.message : String(error),
+							},
+						},
+						{ status: 400 },
+					);
+				}
 				target = `${this.#options.upstream ?? "https://api.anthropic.com"}${url.pathname.slice("/anthropic".length)}${url.search}`;
 				secret = await this.#options.oauthToken();
 				for (const name of HEADERS) {

package/src/pi-model-input.ts

@@ -106,12 +106,14 @@ export function piModelInput(
 		throw new Error("Invalid messages");
 	const body: Record<string, unknown> = {
 		model,
-		messages: input.messages.map((message: unknown) => {
-			if (
-				!isRecord(message) ||
-				!["user", "assistant"].includes(String(message.role))
-			)
-				throw new Error("Invalid role");
+		messages: input.messages.map((message: unknown, index) => {
+			if (!isRecord(message)) throw new Error("Invalid message");
+			// Worded as the Anthropic API words it, so a client that sends a mid-conversation
+			// `role: "system"` message (Claude Code does) recognizes the refusal and resends without it.
+			if (!["user", "assistant"].includes(String(message.role)))
+				throw new Error(
+					`messages.${index}: Unexpected role ${JSON.stringify(String(message.role))}: the input message role must be "user" or "assistant"`,
+				);
 			return { role: message.role, content: blocks(message.content) };
 		}),
 	};