fix: fail fast on incomplete embeddings response

Addresses PR review (Codex P2). The OpenAI embeddings parser sized the
result by len(data) and indexed by the API's index field, so a response
with fewer items than inputs — or a duplicate index — could silently
misalign embeddings with their inputs or leave an empty [] vector,
corrupting downstream pgvector writes/queries. Size the output by
len(req.Inputs) and reject out-of-range, duplicate, or missing indexes.
Adds a regression test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WnKgCRfMvFcZAkoVbr8k79

Author: claude

packages/engine/internal/connector/embed_test.go

@@ -120,6 +120,30 @@ func TestEmbeddingConnector_ModelAllowlist(t *testing.T) {
 	}
 }
 
+func TestEmbeddingConnector_IncompleteResponseFailsFast(t *testing.T) {
+	// Server returns only one embedding for two inputs — must error rather
+	// than silently returning a misaligned/short vectors list.
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"model": "text-embedding-3-small",
+			"data":  []map[string]any{{"index": 0, "embedding": []float64{0.1, 0.2}}},
+			"usage": map[string]any{"prompt_tokens": 3, "total_tokens": 3},
+		})
+	}))
+	defer server.Close()
+
+	c := &EmbeddingConnector{Client: server.Client()}
+	_, err := c.Execute(context.Background(), map[string]any{
+		"model":    "text-embedding-3-small",
+		"input":    []any{"a", "b"},
+		"base_url": server.URL,
+	})
+	if err == nil {
+		t.Error("expected error when the provider returns fewer embeddings than inputs")
+	}
+}
+
 func TestEmbeddingConnector_BedrockUnsupported(t *testing.T) {
 	c := &EmbeddingConnector{}
 	_, err := c.Execute(context.Background(), map[string]any{

packages/engine/internal/connector/provider_openai.go

@@ -225,18 +225,26 @@ func (p *OpenAIProvider) Embeddings(ctx context.Context, req *EmbeddingRequest)
 	if err := json.Unmarshal(body, &apiResp); err != nil {
 		return nil, fmt.Errorf("openai: parsing embeddings response: %w", err)
 	}
-	if len(apiResp.Data) == 0 {
-		return nil, fmt.Errorf("openai: no embeddings returned")
-	}
-
 	// Reassemble in request order — the API tags each item with its index.
-	out := make([][]float64, len(apiResp.Data))
+	// Size by the request so a short or duplicate-indexed response fails fast
+	// rather than silently misaligning embeddings with their inputs.
+	out := make([][]float64, len(req.Inputs))
+	seen := make([]bool, len(req.Inputs))
 	for _, d := range apiResp.Data {
-		if d.Index < 0 || d.Index >= len(out) {
-			return nil, fmt.Errorf("openai: embedding index %d out of range", d.Index)
+		if d.Index < 0 || d.Index >= len(req.Inputs) {
+			return nil, fmt.Errorf("openai: embedding index %d out of range for %d inputs", d.Index, len(req.Inputs))
+		}
+		if seen[d.Index] {
+			return nil, fmt.Errorf("openai: duplicate embedding index %d", d.Index)
 		}
+		seen[d.Index] = true
 		out[d.Index] = d.Embedding
 	}
+	for i, ok := range seen {
+		if !ok {
+			return nil, fmt.Errorf("openai: missing embedding for input %d (got %d of %d)", i, len(apiResp.Data), len(req.Inputs))
+		}
+	}
 
 	return &EmbeddingResponse{
 		Embeddings: out,