@vellumai/assistant 0.12.7-staging.1 → 0.12.8

package/openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.1.0
 info:
   title: Vellum Assistant API
-  version: 0.12.7
+  version: 0.12.8
   description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
 servers:
   - url: http://127.0.0.1:7821

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.7-staging.1",
+  "version": "0.12.8",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/runtime/migrations/__tests__/origin-mode.test.ts

@@ -7,12 +7,11 @@
  * - Neither → "self-hosted-local".
  * - Regression: a logged-in local assistant holding managed-proxy
  *   credentials (platform URL + assistant_api_key) must NOT be classified
- *   "managed" — every logged-in local has those credentials, and a
- *   "managed" stamp trips the importer's `secrets_redacted must be true
- *   when origin.mode is 'managed'` refine, breaking local→platform
- *   teleport. The helper keys on the IS_PLATFORM deployment env only —
- *   nothing here consults the credential store, so the regression case is
- *   simply "no env flags set".
+ *   "managed": every logged-in local has those credentials, and importers
+ *   drop every credential from a "managed" bundle, which would break
+ *   local→platform teleport. The helper keys on the IS_PLATFORM deployment
+ *   env only: nothing here consults the credential store, so the regression
+ *   case is simply "no env flags set".
  */
 
 import { afterEach, describe, expect, test } from "bun:test";

package/src/runtime/migrations/__tests__/vbundle-import-credentials.test.ts

@@ -79,6 +79,24 @@ describe("extractCredentialsFromBundle", () => {
     });
   });
 
+  test("returns no credentials from a managed-origin bundle", () => {
+    const entries = new Map<string, VBundleTarEntry>();
+    entries.set("credentials/openai-key", makeTarEntry("sk-test-123"));
+    entries.set(
+      "credentials/credential/vellum/assistant_api_key",
+      makeTarEntry("vak-test-456"),
+    );
+    const manifest = {
+      ...makeManifest([
+        "credentials/openai-key",
+        "credentials/credential/vellum/assistant_api_key",
+      ]),
+      origin: { mode: "managed" },
+    } as ManifestType;
+
+    expect(extractCredentialsFromBundle(entries, manifest)).toEqual([]);
+  });
+
   test("returns empty array when no credential entries exist", () => {
     const entries = new Map<string, VBundleTarEntry>();
     entries.set("workspace/config.json", makeTarEntry('{"test": true}'));

package/src/runtime/migrations/__tests__/vbundle-streaming-importer.test.ts

@@ -372,6 +372,49 @@ describe("streamCommitImport — happy path", () => {
     // Credentials must NOT appear on disk.
     expect(existsSync(join(workspaceDir, "credentials"))).toBe(false);
   });
+
+  test("imports a managed bundle that still carries credentials, without forwarding them", async () => {
+    // Hosted runtimes older than 0.10.8 packed credentials into managed
+    // exports and stamped secrets_redacted: false.
+    const { archive } = buildVBundle({
+      files: [
+        {
+          path: "data/db/assistant.db",
+          data: new Uint8Array(),
+        },
+        {
+          path: "workspace/config.json",
+          data: new TextEncoder().encode("{}"),
+        },
+        {
+          path: "credentials/openai-key",
+          data: new TextEncoder().encode("sk-test-1"),
+        },
+        {
+          path: "credentials/credential/vellum/assistant_api_key",
+          data: new TextEncoder().encode("vak-test-2"),
+        },
+      ],
+      ...defaultV1Options(),
+      origin: { mode: "managed" },
+      secretsRedacted: false,
+    });
+
+    const received: Array<{ account: string; value: string }> = [];
+    const result = await streamCommitImport({
+      source: readableFrom(archive),
+      pathResolver: new DefaultPathResolver(workspaceDir),
+      workspaceDir,
+      importCredentials: async (creds) => {
+        received.push(...creds);
+      },
+    });
+
+    expect(result.ok).toBe(true);
+    expect(received).toEqual([]);
+    expect(existsSync(join(workspaceDir, "credentials"))).toBe(false);
+    expect(existsSync(join(workspaceDir, "config.json"))).toBe(true);
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/runtime/migrations/__tests__/vbundle-validator-v1-schema.test.ts

@@ -174,6 +174,21 @@ describe("ManifestSchema — v1 acceptance", () => {
     const result = validateVBundle(archive);
     expect(result.is_valid).toBe(true);
   });
+
+  test("accepts when origin.mode === 'managed' and secrets_redacted === false", () => {
+    // Hosted runtimes older than 0.10.8 stamp managed exports this way.
+    // Importers drop the credentials of any managed bundle instead.
+    const manifest = withChecksum({
+      ...v1Skeleton(),
+      origin: { mode: "managed" },
+      secrets_redacted: false,
+    });
+    const archive = gzipTarOf(manifest, [
+      { name: "data/db/assistant.db", data: DB_BYTES },
+    ]);
+    const result = validateVBundle(archive);
+    expect(result.is_valid).toBe(true);
+  });
 });
 
 describe("validateVBundle: streaming manifest limits", () => {
@@ -232,19 +247,6 @@ describe("ManifestSchema — v1 rejection", () => {
     expect(result.is_valid).toBe(false);
   });
 
-  test("rejects managed mode with secrets_redacted=false", () => {
-    const manifest = withChecksum({
-      ...v1Skeleton(),
-      origin: { mode: "managed" },
-      secrets_redacted: false,
-    });
-    const archive = gzipTarOf(manifest, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-  });
-
   test("rejects manifest whose contents lacks data/db/assistant.db", () => {
     const manifest = withChecksum({
       ...v1Skeleton(),

package/src/runtime/migrations/origin-mode.ts

@@ -12,10 +12,10 @@
  * Deliberately NOT keyed on managed-proxy prerequisites: any logged-in
  * local assistant holds a platform URL and `assistant_api_key` (to use the
  * platform LLM proxy), so proxy-prereq presence does not distinguish a
- * managed deployment from a local one. Stamping a local export as
- * "managed" would trip the importer's `secrets_redacted must be true when
- * origin.mode is 'managed'` rule and break local→platform teleport for
- * every logged-in local assistant.
+ * managed deployment from a local one. Importers never apply a managed
+ * bundle's credentials (`importsBundledCredentials`), so stamping a local
+ * export as "managed" would drop every credential on local→platform
+ * teleport for every logged-in local assistant.
  */
 
 import {

package/src/runtime/migrations/vbundle-importer.ts

@@ -36,7 +36,10 @@ import type { RuntimeCompatibility } from "./vbundle-import-policy.js";
 import * as policy from "./vbundle-import-policy.js";
 import { mergeMetadataPreservingVellum } from "./vbundle-metadata-merge.js";
 import type { ManifestType, VBundleTarEntry } from "./vbundle-validator.js";
-import { validateVBundle } from "./vbundle-validator.js";
+import {
+  importsBundledCredentials,
+  validateVBundle,
+} from "./vbundle-validator.js";
 
 const log = getLogger("vbundle-importer");
 
@@ -780,12 +783,16 @@ export function commitImport(options: ImportCommitOptions): ImportCommitResult {
  *
  * Credentials are stored under the `credentials/` prefix in the archive,
  * where the remainder of the path is the account name and the entry data
- * is the credential value.
+ * is the credential value. Returns none for a bundle whose credentials an
+ * import never applies (see `importsBundledCredentials`).
  */
 export function extractCredentialsFromBundle(
   entries: Map<string, VBundleTarEntry>,
   manifest: ManifestType,
 ): Array<{ account: string; value: string }> {
+  if (!importsBundledCredentials(manifest)) {
+    return [];
+  }
   const manifestPaths = new Set(manifest.contents.map((f) => f.path));
   const credentials: Array<{ account: string; value: string }> = [];
   for (const [path, entry] of entries) {

package/src/runtime/migrations/vbundle-streaming-importer.ts

@@ -70,6 +70,7 @@ import {
 } from "./vbundle-streaming-validator.js";
 import { parseVBundleStream } from "./vbundle-tar-stream.js";
 import {
+  importsBundledCredentials,
   MANIFEST_MAX_ENTRIES,
   type ManifestType,
 } from "./vbundle-validator.js";
@@ -648,14 +649,16 @@ export async function streamCommitImport(
       if (archivePath.startsWith("credentials/")) {
         // Credentials are hash-verified against the manifest but collected
         // in memory rather than written to disk. DefaultPathResolver
-        // deliberately returns null for these paths.
+        // deliberately returns null for these paths. A bundle whose
+        // credentials an import never applies is still verified, so a
+        // corrupt entry fails the import either way.
         const buffered = await collectHashVerified(entry.body, {
           sha256: expectedEntry.sha256,
           size: expectedEntry.size,
           archivePath,
         });
         const account = archivePath.slice("credentials/".length);
-        if (account) {
+        if (account && manifest && importsBundledCredentials(manifest)) {
           bufferedCredentials.push({
             account,
             value: new TextDecoder().decode(buffered),

package/src/runtime/migrations/vbundle-validator.ts

@@ -69,10 +69,6 @@ export const ManifestSchema = z
     secrets_redacted: z.boolean(),
     export_options: ExportOptions,
   })
-  .refine((m) => m.origin.mode !== "managed" || m.secrets_redacted === true, {
-    message: "secrets_redacted must be true when origin.mode is 'managed'",
-    path: ["secrets_redacted"],
-  })
   .refine(
     (m) =>
       m.contents.some(
@@ -90,6 +86,19 @@ export const ManifestSchema = z
 export type ManifestFileEntryType = z.infer<typeof ManifestFileEntry>;
 export type ManifestType = z.infer<typeof ManifestSchema>;
 
+/**
+ * Whether an import applies the bundle's `credentials/` entries.
+ *
+ * A managed-origin bundle's credentials never reach the target. They are
+ * platform-issued or bound to the managed deployment, and the target
+ * re-provisions its own platform identity. Managed exports from hosted
+ * runtimes older than 0.10.8 carry credentials (`secrets_redacted: false`);
+ * dropping them here keeps those bundles restorable.
+ */
+export function importsBundledCredentials(manifest: ManifestType): boolean {
+  return manifest.origin.mode !== "managed";
+}
+
 // ---------------------------------------------------------------------------
 // Legacy manifest schema (pre-v1, six-field shape)
 // ---------------------------------------------------------------------------

package/src/runtime/routes/migration-routes.ts

@@ -272,9 +272,9 @@ async function resolveAssistantId(): Promise<string> {
  *
  * Managed-mode exports never reach this with credentials: both export
  * handlers skip credential collection entirely when `origin.mode` is
- * "managed" (the validator's cross-field refine rejects a managed bundle
- * with `secrets_redacted: false`, and teleport clients re-provision
- * platform identity after a platform→local import).
+ * "managed" (importers never apply a managed bundle's credentials, and
+ * teleport clients re-provision platform identity after a platform→local
+ * import).
  */
 export function computeSecretsRedacted(
   credentialCount: number,
@@ -380,11 +380,10 @@ export async function handleMigrationExport(
   try {
     const manifestInputs = await buildExportManifestInputs();
 
-    // Managed deployments never ship credentials in bundles — the manifest
-    // schema forbids it (`secrets_redacted` must be true when `origin.mode`
-    // is "managed"), and teleport clients re-provision platform identity
-    // after a platform→local import. Redact instead of emitting a bundle
-    // the importer is guaranteed to reject.
+    // Managed deployments never ship credentials in bundles: importers
+    // never apply a managed bundle's credentials (`importsBundledCredentials`),
+    // and teleport clients re-provision platform identity after a
+    // platform→local import.
     let credentials: Array<{ account: string; value: string }> = [];
     let secretsRedacted = true;
     if (manifestInputs.origin.mode !== "managed") {
@@ -639,11 +638,9 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
   }
 
   // ── 3. Collect credentials up front. Fail closed → 500. Managed
-  // deployments never ship credentials in bundles — the manifest schema
-  // forbids it (`secrets_redacted` must be true when `origin.mode` is
-  // "managed"), and teleport clients re-provision platform identity after
-  // a platform→local import — so redact instead of emitting a bundle the
-  // importer is guaranteed to reject.
+  // deployments never ship credentials in bundles: importers never apply a
+  // managed bundle's credentials (`importsBundledCredentials`), and teleport
+  // clients re-provision platform identity after a platform→local import.
   //
   // A debug bundle goes to Vellum staff, so it never carries credentials
   // either, whatever the deployment mode.