Sync public snapshot from freebuff-private

Source: CodebuffAI/freebuff-private@815720e09517a90bbcc1679d8fb0d7eca4f0ba47

Author: github-actions[bot]

bun.lock

@@ -1,6 +1,6 @@
 {
   "name": "freebuff",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "description": "The world's strongest free coding agent",
   "license": "MIT",
   "bin": {

freebuff/cli/release/package.json

@@ -5,7 +5,7 @@ import path from 'node:path'
 import { afterEach, describe, expect, test } from 'bun:test'
 
 import { CodebuffClient } from '../client'
-import { createByokConnectionStore, type ByokConnection } from '../byok'
+import { ByokConnectionStateError, createByokConnectionStore, type ByokConnection } from '../byok'
 import { getWebsiteUrl } from '../constants'
 import type { RunState } from '../run-state'
 
@@ -319,21 +319,58 @@ describe('direct BYOK SDK runs', () => {
     expect(requests.every((url) => url === 'http://127.0.0.1:9876/v1/chat/completions')).toBe(true)
   }, 30_000)
 
-  test('stops before provider dispatch when a saved connection was replaced or removed', async () => {
+  test.each([
+    ['changed', 'BYOK connection changed; select its current revision to continue'],
+    ['removed', 'BYOK connection was removed; select another provider or a Freebuff model to continue'],
+    ['corrupt', 'BYOK connection metadata is corrupt; restore it before continuing'],
+    ['locked', 'BYOK settings are locked. Close other Freebuff processes and retry.'],
+    ['unknown', 'Could not verify the saved BYOK connection. Reselect the provider and retry.'],
+  ])('reports a %s local connection failure without provider dispatch', async (failure, expected) => {
     let requests = 0
     globalThis.fetch = (async () => {
       requests += 1
       return sse({ id: 'unexpected', object: 'chat.completion.chunk', created: 1, model: 'm', choices: [] })
     }) as unknown as typeof fetch
+    let records: ByokConnection[] = []
+    let failCheck = false
+    const store = createByokConnectionStore({
+      metadataStore: {
+        async get() { return records },
+        async set(next) { records = next },
+        async withLock(operation) {
+          if (failCheck && failure === 'locked')
+            throw new ByokConnectionStateError(expected)
+          if (failCheck && failure === 'unknown')
+            throw new Error('provider-key-canary must not leak')
+          return operation()
+        },
+      },
+      secretStore: {
+        async get() { return 'provider-key-canary' },
+        async set() {},
+        async delete() {},
+      },
+    })
+    const saved = await store.create({
+      name: 'Local failure test', provider: 'openrouter', model: 'scripted/model',
+      credentialRef: 'env:PROVIDER_KEY',
+    })
+    const resolved = await store.resolve(saved)
+    if (failure === 'changed') await store.update({ ...saved, patch: { model: 'new/model' } })
+    if (failure === 'removed') await store.remove(saved)
+    if (failure === 'corrupt') records = [{ ...saved, model: '' }]
+    failCheck = true
     const client = new CodebuffClient({
       agentDefinitions: [agent],
-      byok: connection({ assertCurrent: async () => { throw new Error('connection revision no longer current') } }),
+      byok: resolved,
     })
 
-    const result = await client.run({ agent: agent.id, prompt: 'Do not use the replaced connection.' })
+    const result = await client.run({ agent: agent.id, prompt: 'Do not use the unavailable connection.' })
     expect(result.output.type).toBe('error')
     if (result.output.type !== 'error') throw new Error('expected BYOK connection error')
-    expect(result.output.message).toContain('Could not connect to the BYOK provider')
+    expect(result.output.message).toContain(expected)
+    expect(result.output.message).not.toContain('provider-key-canary')
+    expect(result.output.message).not.toContain('network connection')
     expect(requests).toBe(0)
   }, 30_000)
 

sdk/src/__tests__/byok-run.test.ts

@@ -125,6 +125,11 @@ export class ByokCredentialError extends Error {
   override name = 'ByokCredentialError'
 }
 
+/** A local connection-state failure with a safe, SDK-authored message. */
+export class ByokConnectionStateError extends Error {
+  override name = 'ByokConnectionStateError'
+}
+
 /** The environment variable a connection reads its key from, if any. */
 export function byokCredentialVariable(
   connection: Pick<ByokConnection, 'credentialRef'>,
@@ -196,11 +201,11 @@ export function byokCompletionUrl(
 function parseConnections(value: unknown): ByokConnection[] {
   const parsed = z.array(connectionSchema).safeParse(value)
   if (!parsed.success)
-    throw new Error(
+    throw new ByokConnectionStateError(
       'BYOK connection metadata is corrupt; restore it before continuing',
     )
   if (new Set(parsed.data.map((item) => item.id)).size !== parsed.data.length) {
-    throw new Error('BYOK connection metadata contains duplicate connections')
+    throw new ByokConnectionStateError('BYOK connection metadata contains duplicate connections')
   }
   for (const item of parsed.data) {
     byokModelLimits(item)
@@ -209,7 +214,7 @@ function parseConnections(value: unknown): ByokConnection[] {
       !envReference.test(item.credentialRef) &&
       !item.credentialRef.startsWith(`connection:${item.id}:`)
     ) {
-      throw new Error(
+      throw new ByokConnectionStateError(
         'BYOK credential reference belongs to a different connection',
       )
     }
@@ -660,11 +665,11 @@ export function createByokConnectionStore(params: {
     const connections = await read()
     const connection = connections.find((item) => item.id === id)
     if (!connection)
-      throw new Error(
+      throw new ByokConnectionStateError(
         'BYOK connection was removed; select another provider or a Freebuff model to continue',
       )
     if (connection.revision !== revision)
-      throw new Error(
+      throw new ByokConnectionStateError(
         'BYOK connection changed; select its current revision to continue',
       )
     return { connection, connections }
@@ -979,7 +984,7 @@ export function createBunByokMetadataStore(
         return parseConnections(JSON.parse(await fs.readFile(file, 'utf8')))
       } catch (error) {
         if ((error as NodeJS.ErrnoException).code === 'ENOENT') return []
-        throw new Error(
+        throw new ByokConnectionStateError(
           'Cannot read BYOK connection metadata; restore the configuration before continuing',
         )
       }
@@ -1024,7 +1029,7 @@ export function createBunByokMetadataStore(
             if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error
             await recoverByokLock(lock)
             if (Date.now() - started >= 5000)
-              throw new Error(
+              throw new ByokConnectionStateError(
                 'BYOK settings are locked. Close other Freebuff processes and retry. If the problem persists, close all Freebuff processes before removing connections.lock from the BYOK configuration directory.',
               )
             await new Promise((resolve) => setTimeout(resolve, 25))

sdk/src/byok.ts

@@ -21,7 +21,7 @@ import { APICallError } from 'ai'
 import { byokReasoningRetryBody, byokRequestTransform } from './byok-request'
 import { getWebsiteUrl } from '../constants'
 import { getByokOpenrouterApiKeyFromEnv } from '../env'
-import { byokCompletionUrl, byokCredentialVariable } from '../byok'
+import { ByokConnectionStateError, byokCompletionUrl, byokCredentialVariable } from '../byok'
 import type { ResolvedByokConnection } from '../byok'
 
 import type { LanguageModel } from 'ai'
@@ -401,8 +401,14 @@ export function getModelForRequest({
         // Revocation is a durable policy decision, never a transport retry.
         try {
           await byok.assertCurrent?.()
-        } catch {
-          throw new Error(BYOK_CONNECTION_FAILURE_MESSAGE)
+        } catch (error) {
+          // Only our typed state errors carry display-safe messages. Custom
+          // resolvers and filesystem errors may contain credentials or paths.
+          throw new Error(
+            error instanceof ByokConnectionStateError
+              ? error.message
+              : 'Could not verify the saved BYOK connection. Reselect the provider and retry. If the problem persists, fully quit and restart Freebuff.',
+          )
         }
         try {
           const send = (init: RequestInit | undefined) =>