fix(ai): log roast-me stream failures and pass system prompts via system - #35

Summary

Two fixes from the Dash0 log review:

1. roast-me stream failures are now logged. streamObject keeps errors inside the stream, so a failed model call or a schema mismatch returned 200 and logged nothing.
2. System prompts go through the system parameter instead of messages. This removes the AI SDK prompt-injection warning that made up 1,256 of about 1,280 WARN logs in the last 14 days.

 streamObject / generateObject / generateText({
-  messages: [{ role: "system", content: prompt }, ...rest],
+  system: prompt,
+  messages: rest,
+  onError: ({ error }) => console.error("[roast-me/analyze] stream failed", error),  // roast-me only
 })

roast-me has the repo's only streamText/streamObject call. OpenAISdkAIClient (behavioral-checker) is unchanged. It uses the raw OpenAI SDK, which has no system option and doesn't emit this warning.

Evidence

The same three requests ran against a local dev server with no AI keys, so every model call fails with an auth error.

• Before:

  AI SDK Warning: System messages in the prompt or messages fields can be a security risk ...
   POST /roast-me/api/analyze 200        ← failure not logged
  AI SDK Warning: System messages in the prompt or messages fields can be a security risk ...
   POST /api/analyze-take-home 500
  AI SDK Warning: System messages in the prompt or messages fields can be a security risk ...
   POST /api/grade 500
  

  After:

  [roast-me/analyze] stream failed [Error [GatewayAuthenticationError]: Unauthenticated request to AI Gateway.
   POST /roast-me/api/analyze 200
  Error [AI_LoadAPIKeyError]: OpenAI API key is missing ...
   POST /api/analyze-take-home 500
  Error [GatewayAuthenticationError]: Unauthenticated request to AI Gateway ...
   POST /api/grade 500
  

bun tsc passes.

Merge Danger

Door: two-way

Revert the commit to undo it.

Blast Radius: alerts

The Dash0 rule exists error in production @ vercel (open-silver) fires on any ERROR log, so real roast-me failures now reach Slack. That is the goal. The prompts are identical, only where they are passed changed, so grading output should stay the same. The happy path was not run with real keys.

🤖 Generated with Claude Code