pi-roundtable-sandbox 0.7.13 → 0.7.15

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.7.15
+
+- The model broker forwards a mid-conversation `role: "system"` message, which Claude Code 2.1.284 sends with each turn's environment, instead of refusing it. Like every other part of the request it is rebuilt, not passed on: its content may be only text (a string, or `text` blocks with `cache_control`), it keeps `clear_at`, and its per-message `output_config.effort` is capped at the host-judged level as the top-level effort is. The guest already writes the top-level system prompt and every user turn, so this text gives it no more reach. A tool change inside one (`tool_addition`, `tool_removal`, `tool_definition`) is still refused, with a 400 worded as the API words it, so Claude Code resends its tools whole.
+
+## 0.7.14
+
+- A model request the broker refuses (an unknown role, a native tool, remote media, a remote schema) is answered with a 400 in the Anthropic API's error shape (`invalid_request_error`) instead of a 502, and logged as `sandbox upstream call failed`. Claude Code 2.1.284 (agent SDK 0.3.284) sends a mid-conversation `role: "system"` message when MCP tools arrive late; the broker refused it with a 502, which Claude Code retried about ten times over several minutes before the turn failed. The refusal of a role now reads `messages.N: Unexpected role "system": the input message role must be "user" or "assistant"`, which Claude Code recognizes: it resends without system messages for the rest of that conversation. The broker still never forwards a system message.
+
 ## 0.7.13
 
 - `precheckScriptRunner` forwards only the tools approved with the script (pi-roundtable 0.7.13's `PrecheckScriptContext.tools`) among those `grant` allows, and takes `toolName(server, tool)`, the name the host's hold rules know a tool by (default the tool's own name).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-sandbox",
-	"version": "0.7.13",
+	"version": "0.7.15",
 	"description": "Sealed guest channels and an allow-listed credential broker for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -52,7 +52,7 @@
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
 		"discord.js": "14.27.0",
-		"pi-roundtable": "0.7.13",
+		"pi-roundtable": "0.7.15",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/pi-broker.ts

@@ -616,13 +616,29 @@ export class PiSandboxBroker {
 					if (value && value.length <= 256) headers.set(name, value);
 				}
 			} else {
-				body = piModelInput(
-					input,
-					this.#options.model,
-					url.pathname.endsWith("/count_tokens"),
-					this.#options.maxOutputTokens ?? 128_000,
-					turn.context.thinking,
-				);
+				try {
+					body = piModelInput(
+						input,
+						this.#options.model,
+						url.pathname.endsWith("/count_tokens"),
+						this.#options.maxOutputTokens ?? 128_000,
+						turn.context.thinking,
+					);
+				} catch (error) {
+					// The request itself is refused: a 400 the client does not retry unchanged, in the
+					// API's error shape so it can resend without what was refused. A 502 would be retried.
+					failed(secret, { status: 400, error });
+					return Response.json(
+						{
+							type: "error",
+							error: {
+								type: "invalid_request_error",
+								message: error instanceof Error ? error.message : String(error),
+							},
+						},
+						{ status: 400 },
+					);
+				}
 				target = `${this.#options.upstream ?? "https://api.anthropic.com"}${url.pathname.slice("/anthropic".length)}${url.search}`;
 				secret = await this.#options.oauthToken();
 				for (const name of HEADERS) {

package/src/pi-model-input.ts

@@ -84,6 +84,28 @@ function blocks(raw: unknown, nested = false): unknown[] | string {
 		throw new Error("Native tools or remote media refused");
 	});
 }
+/**
+ * A mid-conversation system message's content: text only. The guest already writes the top-level
+ * system prompt and every user turn, so its text here carries no more authority. Its tool changes
+ * are refused in the API's wording, so Claude Code resends the tools whole instead.
+ */
+function systemContent(raw: unknown, index: number): unknown[] | string {
+	if (typeof raw === "string") return raw;
+	if (!Array.isArray(raw) || raw.length > 256)
+		throw new Error("Invalid content");
+	return raw.map((value: unknown, block) => {
+		if (
+			isRecord(value) &&
+			value.type === "text" &&
+			typeof value.text === "string"
+		)
+			return { type: "text", text: value.text, ...cache(value) };
+		const type = isRecord(value) ? String(value.type) : typeof value;
+		throw new Error(
+			`messages.${index}.content.${block}: Input tag '${type}' found using 'type' does not match any of the expected tags: 'text'`,
+		);
+	});
+}
 const EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const;
 /** Highest effort and extended-thinking budget the host-judged level allows. */
 const CEILINGS: Record<PiThinkingLevel, { effort: number; budget: number }> = {
@@ -104,14 +126,38 @@ export function piModelInput(
 ): Record<string, unknown> {
 	if (!Array.isArray(input.messages) || input.messages.length > 2000)
 		throw new Error("Invalid messages");
+	const ceiling = CEILINGS[thinking];
+	/** An effort the guest asks for, at most the host-judged level allows; -1 when none. */
+	const cappedEffort = (config: unknown): number => {
+		const asked = isRecord(config)
+			? EFFORTS.indexOf(config.effort as (typeof EFFORTS)[number])
+			: -1;
+		return asked >= 0 ? Math.min(asked, ceiling.effort) : -1;
+	};
 	const body: Record<string, unknown> = {
 		model,
-		messages: input.messages.map((message: unknown) => {
-			if (
-				!isRecord(message) ||
-				!["user", "assistant"].includes(String(message.role))
-			)
-				throw new Error("Invalid role");
+		messages: input.messages.map((message: unknown, index) => {
+			if (!isRecord(message)) throw new Error("Invalid message");
+			// Claude Code sends each turn's environment as a mid-conversation system message.
+			if (message.role === "system") {
+				const effort = cappedEffort(message.output_config);
+				return {
+					role: "system",
+					content: systemContent(message.content, index),
+					...(message.clear_at === "next_user_message" ||
+					message.clear_at === "never"
+						? { clear_at: message.clear_at }
+						: {}),
+					...(effort >= 0
+						? { output_config: { effort: EFFORTS[effort] } }
+						: {}),
+				};
+			}
+			// Worded as the Anthropic API words it, so a client recognizes the refusal.
+			if (!["user", "assistant"].includes(String(message.role)))
+				throw new Error(
+					`messages.${index}: Unexpected role ${JSON.stringify(String(message.role))}: the input message role must be "user", "assistant" or "system"`,
+				);
 			return { role: message.role, content: blocks(message.content) };
 		}),
 	};
@@ -153,7 +199,6 @@ export function piModelInput(
 				: {}),
 		};
 	}
-	const ceiling = CEILINGS[thinking];
 	if (isRecord(input.thinking)) {
 		if (
 			input.thinking.type === "adaptive" ||
@@ -175,13 +220,11 @@ export function piModelInput(
 			};
 		else throw new Error("Invalid thinking");
 	}
-	const asked = isRecord(input.output_config)
-		? EFFORTS.indexOf(input.output_config.effort as (typeof EFFORTS)[number])
-		: -1;
+	const asked = cappedEffort(input.output_config);
 	// Adaptive thinking without an explicit effort runs at the model's default, so the host caps it too.
 	const effort =
 		asked >= 0
-			? Math.min(asked, ceiling.effort)
+			? asked
 			: isRecord(body.thinking) &&
 					body.thinking.type === "adaptive" &&
 					ceiling.effort < 2