Skip to content

fix: bedrock outputAssessments type correction - #4028

Merged
akshaydeo merged 1 commit into
mainfrom
06-03-fix_type_correction_bedrock_outputassessments
Jun 3, 2026
Merged

fix: bedrock outputAssessments type correction#4028
akshaydeo merged 1 commit into
mainfrom
06-03-fix_type_correction_bedrock_outputassessments

Conversation

@TejasGhatte

@TejasGhatte TejasGhatte commented Jun 3, 2026

Copy link
Copy Markdown
Collaborator

Summary

Fixes a crash introduced in Bifrost 1.4.6 where Bedrock Converse calls with trace: enabled would always return an InternalServerError. The root cause was a type mismatch: BedrockGuardrailTrace.OutputAssessments was typed as []BedrockGuardrailAssessment (a slice), but Bedrock returns outputAssessments as map[guardrailId][]Assessment (a map keyed by guardrail ID). This caused JSON unmarshalling to crash on every guardrailed Converse call that reached the model and produced output.

Changes

  • Corrected BedrockGuardrailTrace.OutputAssessments from []BedrockGuardrailAssessment to map[string][]BedrockGuardrailAssessment to match the actual Bedrock API shape
  • Corrected BedrockGuardrailTrace.InputAssessment from map[string]interface{} to map[string]BedrockGuardrailAssessment for type safety
  • Unified the struct to a single shape covering both Converse and ConverseStream paths, removing the previously incorrect split between "streaming" and "non-streaming" field sets
  • Expanded BedrockGuardrailAssessment with the full set of fields returned by Bedrock, including AppliedGuardrailDetails, AutomatedReasoningPolicy, ContextualGroundingPolicy, and InvocationMetrics
  • Added supporting types: BedrockGuardrailAppliedDetails, BedrockGuardrailAutomatedReasoningPolicy, BedrockGuardrailContextualGroundingPolicy, BedrockGuardrailContextualGroundingFilter, BedrockGuardrailInvocationMetrics, BedrockGuardrailCoverage, BedrockGuardrailCoverageCount, and BedrockGuardrailUsage
  • Added a regression test (test_56) to the Bedrock integration suite asserting outputAssessments is a map, not a list
  • Added regression tests (test_31, test_32) to the LangChain integration suite covering both non-streaming and streaming paths
  • Added a Postman/Newman e2e collection test case for the guardrailConfig + trace path that validates outputAssessments shape

Note: A benign prompt is intentionally used in all regression tests. A blocked prompt never reaches the model, so outputAssessments would be absent in the trace — masking the type-mismatch bug entirely.

Type of change

  • Bug fix
  • Feature
  • Refactor
  • Documentation
  • Chore/CI

Affected areas

  • Core (Go)
  • Transports (HTTP)
  • Providers/Integrations
  • Plugins
  • UI (React)
  • Docs

How to test

# Core
go test ./core/providers/bedrock/...

# Integration tests (requires AWS credentials and a configured guardrail)
export BEDROCK_GUARDRAIL_IDENTIFIER=<your-guardrail-id>
export BEDROCK_GUARDRAIL_VERSION=DRAFT  # or a pinned version

cd tests/integrations/python
pytest tests/test_bedrock.py::TestBedrockConverse::test_56_outputAssessments_is_map -v
pytest tests/test_langchain.py::TestLangChainBedrock::test_31_bedrock_guardrail_outputAssessments_is_map -v
pytest tests/test_langchain.py::TestLangChainBedrock::test_32_bedrock_guardrail_streaming_outputAssessments_is_map -v

Set the following environment variables to enable guardrail tests:

Variable Description
BEDROCK_GUARDRAIL_IDENTIFIER The guardrail ID to use for trace regression tests
BEDROCK_GUARDRAIL_VERSION Guardrail version (defaults to DRAFT)

Breaking changes

  • Yes
  • No

Security considerations

No new auth, secrets, or PII handling introduced. The fix only corrects the Go type used to deserialise guardrail trace data returned by AWS Bedrock.

Checklist

  • I read docs/contributing/README.md and followed the guidelines
  • I added/updated tests where appropriate
  • I updated documentation where needed
  • I verified builds succeed (Go and UI)
  • I verified the CI pipeline passes locally if applicable

@coderabbitai

coderabbitai Bot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 890832a9-d668-4350-82d4-5e3f6a4c9d61

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 06-03-fix_type_correction_bedrock_outputassessments

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Collaborator Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@TejasGhatte
TejasGhatte marked this pull request as ready for review June 3, 2026 15:28
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


tejas ghatte seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

akshaydeo commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Merge activity

  • Jun 3, 3:31 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • Jun 3, 3:31 PM UTC: @akshaydeo merged this pull request with Graphite.

@akshaydeo
akshaydeo merged commit 2a7bcf6 into main Jun 3, 2026
13 of 14 checks passed
@akshaydeo
akshaydeo deleted the 06-03-fix_type_correction_bedrock_outputassessments branch June 3, 2026 15:31
@mintlify

mintlify Bot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
Bifrost 🟡 Building Jun 3, 2026, 3:28 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

@akshaydeo akshaydeo mentioned this pull request Jun 4, 2026
18 tasks
akshaydeo added a commit that referenced this pull request Jun 4, 2026
## Summary

Releases core v1.5.16, framework v1.3.16, transports v1.5.8, and bumps all plugins to pick up the new core and framework versions. This release adds `file://` scheme support for pricing URLs, paginated virtual key fetching, and fixes several correctness issues across Bedrock, OpenAI→Anthropic conversion, MCP stdio, and streaming responses.

## Changes

- **File scheme pricing URLs** — Pricing source URLs now accept `file://`, enabling local filesystem pricing data for air-gapped and self-hosted deployments (#4045)
- **Paginated virtual key fetch** — Virtual key retrieval is now paginated to avoid loading all keys into memory at once for large deployments (#3957)
- **Preserve model pool entries on pricing reload** — Non-pricing model pool entries are no longer dropped when pricing data is reloaded (#3999)
- **Bedrock `outputAssessments` type** — Corrected the type of `outputAssessments` in Bedrock response structs (#4028)
- **`Model` field in `TextCompletionChunkResponse`** — Added the missing `Model` field to text completion chunk responses (#3970)
- **Orphaned tool results in OpenAI→Anthropic conversion** — Orphaned tool results no longer cause rejections from the Anthropic API (#3919)
- **MCP inline stdio env assignments** — MCP stdio server configs now correctly parse inline environment variable assignments (#3861)

## Type of change

- [x] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [ ] UI (React)
- [ ] Docs

## How to test

```sh
go version
go test ./...
```

- To test `file://` pricing URLs, configure a pricing URL using the `file:///path/to/pricing.json` scheme and verify pricing data loads correctly from the local file.
- To test paginated virtual key fetch, create a large number of virtual keys and confirm they are all returned correctly without memory issues.
- To test orphaned tool results, send a request through the OpenAI→Anthropic conversion flow containing a tool result with no matching tool call and verify it is accepted rather than rejected.
- To test MCP inline stdio env, configure an MCP stdio server with inline env var assignments (e.g. `KEY=value`) and verify the server starts correctly.

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

Closes #4045, #3957, #3999, #4028, #3970, #3919, #3861

## Security considerations

No new security implications. This release does not touch auth, secrets handling, or sandboxing.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
@akshaydeo akshaydeo mentioned this pull request Jun 5, 2026
18 tasks
akshaydeo added a commit that referenced this pull request Jun 6, 2026
## Summary

This PR bumps the Go toolchain version from `1.26.3` to `1.26.4` across all modules and CI workflows, and cuts a new release (`core` v1.5.17, `framework` v1.3.17, `transports` v1.5.9, `plugins/compat` v0.1.16, `plugins/governance` v1.5.17, and associated plugin versions) incorporating a large batch of features and fixes accumulated since the previous release.

## Changes

- **Go 1.26.4** — Updated `go-version` in all GitHub Actions workflows (`e2e-tests`, `helm-release`, `pr-tests`, `release-cli`, `release-pipeline`, `snyk`) and all `go.mod` files (core, framework, transports, cli, all plugins, examples, and test modules).
- **Core (v1.5.17)** — OpenAI compaction support, multi-customer logs and usage tracking, multiple team/business unit support, `request_headers` wildcard pattern capture for OTel and Maxim plugins, xAI `x_search` tool, fetch URL validation with SSRF hardening, `file://` pricing URL scheme, virtual key provider fan-out filtering, and a broad set of fixes including Anthropic prompt cache key, empty thinking block stripping, OpenAI stream usage event cleanup, Gemini numeric schema constraints, stale connection retries, Azure Claude diagnostic strip, and passthrough budget handling.
- **Framework (v1.3.17)** — Scope-aware budgets and limits wired from model configs, provider-level governance, multiple customer budget support with `calendar_aligned` windows, paginated virtual key fetch, `config.json` source-of-truth flow, FTS index cap reduction, sync worker drift fix, cascade deletes for model configs, and high-scale virtual key flow improvements.
- **Transports (v1.5.9)** — Full changelog covering all of the above plus UI improvements (log navigation, customer detail sheet, `BudgetDisplay` component, inline loading shell, materialized view alias), SCIM provisioning fields, Helm/config schema additions (`roles`, `per_user_oauth`), client IP resolution from forwarded headers, and dependency upgrades (`recharts` to 3.8.1, `golang.org/x` CVE remediation).
- **Plugins** — `governance` v1.5.17 adds team budget/rate-limit exporters, ghost node reconciliation fix, and VK double usage counting fix; `logging` v1.5.17 adds wildcard header capture and file attachment rendering; `otel` v1.2.17 adds `disable_content_logging` and multiple collectors support; `maxim` v1.6.17 adds `request_headers` wildcard capture; `compat` v0.1.16 fixes `max_tokens` preservation during param filtering.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Verify Go version
go version  # should report go1.26.4

# Run core tests
cd core && go test ./...

# Run framework tests
cd framework && go test ./...

# Run transports tests
cd transports && go test ./...

# Run plugin tests
cd plugins/governance && go test ./...
cd plugins/logging && go test ./...
cd plugins/otel && go test ./...

# UI
cd ui
pnpm i
pnpm build
pnpm test
```

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

#4053, #4066, #4041, #4012, #3976, #3947, #3991, #4045, #3957, #3938, #3937, #3939, #3981, #3998, #3997, #4092, #4091, #4079, #4080, #4086, #3929, #3994, #4028, #3970, #3919, #3861, #3664, #3999, #4088, #4070, #4051, #4043, #4057, #4023, #3941, #3955, #4024, #3956, #3967, #3925, #3992, #3900

## Security considerations

- Fetch URL validation hardened against SSRF by tightening IP checks for private networks and link-local addresses (#4092, #3947, #3991).
- Transitive `golang.org/x` dependencies (crypto, net, sys, text) bumped to address Docker Scout CVEs (#3900).

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

* **New Features**
  * OpenAI compaction, multi-customer/team logstore support, request-header wildcard capture, enhanced governance (provider-level & scope-aware limits), disable-content-logging option, support for multiple OpenTelemetry collectors, SSRF hardening and URL validation.

* **Chores**
  * Bumped Go toolchain across modules and updated component/plugin version releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@akshaydeo akshaydeo mentioned this pull request Jun 7, 2026
akshaydeo added a commit that referenced this pull request Jun 7, 2026
## ✨ Features

- **OpenAI Compaction** — Added OpenAI conversation compaction support
across core, framework, logging, and the API surface (#4053)
- **Multi-Customer & Org Hierarchy** — Logs and usage tracking now
support multiple customers, teams, and business units, including
business unit CRUD, team assignment, and governance endpoints in the
OpenAPI spec (#4066, #4041, #4082)
- **Provider-Level Governance** — Budgets & limits are now scope-aware
and can be applied at the virtual-key top level and per provider, wired
from the model configs table, with UI filters for scope and providers
(#3938, #3937, #3939, #3981, #3962)
- **Customer Budgets** — Customers support multiple budgets and
`calendar_aligned` budget windows (#3998, #3997)
- **Virtual Key Attribution & Controls** — Added a `created_by` user
attribution column and a `blacklisted_models` column for virtual key
provider configs (#3672, #3653)
- **Request Header Capture** — OTel and Maxim observability plugins
capture `request_headers` by pattern, with wildcard support (e.g.
`x-custom-*`); logging gained the same wildcard header capture (#4012,
#3958)
- **OTel Content Controls & Collectors** — New `disable_content_logging`
option drops message/tool content from exported spans, plus support for
multiple OTel collectors (#4064, #3894)
- **xAI x_search** — Added xAI `x_search` tool support (#3976)
- **URL Validation** — Added fetch URL validation with private-network
configuration and link-local blocking (#3947, #3991)
- **File Scheme Pricing URLs** — Pricing source URLs now accept the
`file://` scheme for air-gapped and self-hosted deployments (#4045)
- **Paginated Virtual Keys** — Virtual key fetching is paginated to
handle deployments with very large numbers of keys (#3957)
- **Client IP Resolution** — Resolve client IP from
`X-Forwarded-For`/`X-Real-IP` headers
- **SCIM Provisioning** — Added `attributeType`/`attributeValue` SCIM
provisioning fields
- **Helm/Config Schema** — Added `roles` RBAC governance config and
`per_user_oauth` MCP auth to the Helm chart and config schema (#4004,
#4009)
- **Log Navigation UI** — Added a "View logs" menu item to customer,
team, and virtual key tables, clickable links in log detail views, a
customer detail sheet, and a reusable `BudgetDisplay` component (#4073,
#4054, #4026, #4055)
- **Faster First Paint** — Added an inline loading shell to `#root`
before React mounts (#4063)
- **Materialized View Alias** — Added an `alias` column to the
materialized view with filter support (#4078)

## 🐞 Fixed

- **Fetch URL IP Checks** — Hardened fetch URL IP checks against SSRF
(#4092)
- **Mantle Model Matching** — Broadened Mantle model matching to all
`gpt` variants (#4091)
- **Empty Thinking Blocks** — Strip thinking blocks when the signature
is empty (#4079)
- **OpenAI Stream Usage** — Removed usage from the `responses.created`
event in the OpenAI stream (#4080)
- **Prompt Cache Key** — Set the prompt cache key from the Anthropic
integration (#4086)
- **Upstream Failure Status** — Map upstream connection failures to 502
instead of 400 (#3929) (thanks
[@chris-colinsky](https://github.com/chris-colinsky)!)
- **Gemini Schema Constraints** — Accept numeric schema integer
constraints for Gemini (#3994) (thanks
[@yanhao98](https://github.com/yanhao98)!)
- **Files Provider Param** — Accept the `?provider=` query param on `GET
/v1/files` (#3971) (thanks [@alexef](https://github.com/alexef)!)
- **Optional Batch Model** — Made the `model` field optional on `POST
/v1/batches` (#3973) (thanks [@alexef](https://github.com/alexef)!)
- **Helm Azure Config** — Added missing `azure_key_config` fields to the
Helm schema (#3996) (thanks
[@axelray-dev](https://github.com/axelray-dev)!)
- **Text Completion Chunk Model** — Added the missing `Model` field to
`TextCompletionChunkResponse` (#3970) (thanks
[@kuishou68](https://github.com/kuishou68)!)
- **MCP Inline stdio Env** — MCP stdio server configs accept inline
environment variable assignments (#3861) (thanks
[@Shushmitaaaa](https://github.com/Shushmitaaaa)!)
- **Orphaned Tool Results** — Orphaned tool results in the OpenAI to
Anthropic conversion flow are no longer rejected by the Anthropic API
(#3919)
- **Node Usage Reconciliation** — Added a monotonic `inc_number` log
cursor so node usage reconciliation does not skip late async log writes
(#3664)
- **Bedrock Output Assessments** — Corrected the type of
`outputAssessments` in Bedrock responses (#4028)
- **Model Pool Pricing Reloads** — Preserve non-pricing model pool
entries across pricing reloads (#3999)
- **Ghost Node Reconciliation** — Replicate the VK hierarchy flow for
ghost node reconciliation (#4088)
- **VK Double Usage Counting** — Fixed double usage counting when
creating a virtual key (#4070)
- **Model Config Lifecycle** — Cascade deletes for model configs and
removal of stale in-memory model configs (#4051, #4043)
- **FTS Index Cap** — Reduced the FTS index `left()` cap from 800k to
250k chars to stay within the tsvector limit (#4057)
- **Sync Worker Drift** — Reduced the sync worker ticker period to 5m to
prevent threshold drift (#4023)
- **Passthrough** — Fixed passthrough budgets, gated passthrough models
per VK, model extraction for Azure passthrough, and restricted
fallbacks/provider selection to the VK boundary (#3941, #3988, #3983,
#3924)
- **Provider Response Headers** — Strip provider response headers and
add a content-type filter (#3955, #4024)
- **Stream Handling** — Drain non-SSE stream readers and retry stale
connections (#3956, #3967)
- **Azure Claude** — Strip Azure diagnostic property for Claude models
(#3925)
- **Compat max_tokens** — Preserve chat `max_tokens` during param
filtering (#3992)
- **Raw Request Flag** — Removed the raw request flag from providers
that don't support it (#4058)
- **UI Fixes** — Standardized page container layout, virtual key model
configs UI, and dashboard chart tooltips (#4046, #4052, #4044)

## 🔧 Maintenance

- **Dependency Upgrades** — Bumped transitive `golang.org/x`
dependencies (crypto, net, sys, text) for Docker Scout CVE remediation
and `recharts` to 3.8.1; cascaded version bumps across all modules
(#3900, #4003)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants