@vellumai/assistant 0.6.2 → 0.6.4

package/src/runtime/routes/llm-context-normalization.ts

@@ -112,6 +112,168 @@ export function normalizeLlmContextPayloads(
 function normalizeOpenAiRequestPayload(
   requestPayload: unknown,
   allowPlainText = false,
+): NormalizedPayloadCandidate | null {
+  // Try Responses API shape first, then fall back to chat-completions.
+  return (
+    normalizeOpenAiResponsesRequestPayload(requestPayload, allowPlainText) ??
+    normalizeOpenAiChatCompletionsRequestPayload(requestPayload, allowPlainText)
+  );
+}
+
+/**
+ * Detect and normalize OpenAI Responses API request payloads.
+ *
+ * Responses requests use `input` (array) instead of `messages`, may have a
+ * top-level `instructions` string, and tools have `type: "function"` at the
+ * top level with the function fields inlined (no nested `function` wrapper).
+ */
+function normalizeOpenAiResponsesRequestPayload(
+  requestPayload: unknown,
+  allowPlainText = false,
+): NormalizedPayloadCandidate | null {
+  const request = asRecord(requestPayload);
+  if (!request) {
+    return null;
+  }
+
+  const input = asRecordArray(request.input);
+  if (!input) {
+    return null;
+  }
+
+  // Require at least one Responses-specific signal to avoid matching generic
+  // arrays. `instructions` is the strongest signal; otherwise look for
+  // Responses-shaped input items or tool objects.
+  const hasResponsesSignal =
+    typeof request.instructions === "string" ||
+    hasOpenAiModelPrefix(asString(request.model)) ||
+    input.some(
+      (item) =>
+        asString(item.type) === "function_call" ||
+        asString(item.type) === "function_call_output",
+    ) ||
+    extractOpenAiResponsesRequestToolNames(request.tools).length > 0;
+
+  if (!allowPlainText && !hasResponsesSignal) {
+    return null;
+  }
+
+  const requestSections: LlmContextSection[] = [];
+
+  // System-level instructions
+  const instructions = asString(request.instructions);
+  if (instructions && hasMeaningfulText(instructions)) {
+    requestSections.push({
+      kind: "system",
+      label: "System prompt",
+      role: "system",
+      text: instructions,
+    });
+  }
+
+  // Input items
+  let messageIndex = 0;
+  for (const item of input) {
+    const itemType = asString(item.type);
+
+    if (itemType === "message") {
+      messageIndex++;
+      const role = asString(item.role) ?? "unknown";
+      const messageText = extractOpenAiContentText(item.content);
+      if (messageText !== undefined) {
+        requestSections.push({
+          kind: "message",
+          label: buildMessageLabel(role, messageIndex),
+          role,
+          text: messageText,
+        });
+      }
+      continue;
+    }
+
+    if (itemType === "function_call") {
+      const name = asString(item.name);
+      const args = parseJsonValue(asString(item.arguments));
+      requestSections.push({
+        kind: "function_call",
+        label: `Request tool call${name ? ` (${name})` : ""}`,
+        role: "assistant",
+        toolName: name,
+        data: args,
+        text: previewStructuredValue(args),
+      });
+      continue;
+    }
+
+    if (itemType === "function_call_output") {
+      const output = asString(item.output);
+      requestSections.push({
+        kind: "tool_result",
+        label: `Tool result${asString(item.call_id) ? ` (${asString(item.call_id)})` : ""}`,
+        role: "tool",
+        toolName: asString(item.call_id),
+        text: output,
+      });
+    }
+  }
+
+  // Tool definitions (Responses shape: top-level type/name/parameters)
+  const requestToolNames = extractOpenAiResponsesRequestToolNames(
+    request.tools,
+  );
+  if (requestToolNames.length > 0) {
+    requestSections.push({
+      kind: "tool_definitions",
+      label: "Available tools",
+      data: {
+        tools: asRecordArray(request.tools) ?? request.tools,
+      },
+      language: "json",
+    });
+  }
+
+  const requestSettings = omitRecordKeys(request, [
+    "instructions",
+    "input",
+    "tools",
+  ]);
+  if (hasMeaningfulRequestSettings(requestSettings)) {
+    requestSections.push(
+      structuredJsonSection("settings", "Request settings", requestSettings),
+    );
+  }
+
+  // Count all input items for the message count (includes messages, function
+  // calls, and function call outputs — mirrors how chat-completions counts
+  // all messages regardless of role).
+  return {
+    provider: "openai",
+    summary: {
+      provider: "openai",
+      model: asString(request.model),
+      inputTokens: undefined,
+      outputTokens: undefined,
+      cacheCreationInputTokens: undefined,
+      cacheReadInputTokens: undefined,
+      stopReason: undefined,
+      requestMessageCount: input.length,
+      requestToolCount: requestToolNames.length,
+      responseMessageCount: undefined,
+      responseToolCallCount: undefined,
+      responsePreview: undefined,
+      toolCallNames: undefined,
+    },
+    requestSections: requestSections.length > 0 ? requestSections : undefined,
+  };
+}
+
+/**
+ * Normalize a legacy OpenAI Chat Completions request payload.
+ * Requires `messages` array in the request.
+ */
+function normalizeOpenAiChatCompletionsRequestPayload(
+  requestPayload: unknown,
+  allowPlainText = false,
 ): NormalizedPayloadCandidate | null {
   const request = asRecord(requestPayload);
   if (!request) {
@@ -202,6 +364,130 @@ function normalizeOpenAiRequestPayload(
 
 function normalizeOpenAiResponsePayload(
   responsePayload: unknown,
+): NormalizedPayloadCandidate | null {
+  // Try Responses API shape first, then fall back to chat-completions.
+  return (
+    normalizeOpenAiResponsesResponsePayload(responsePayload) ??
+    normalizeOpenAiChatCompletionsResponsePayload(responsePayload)
+  );
+}
+
+/**
+ * Detect and normalize OpenAI Responses API response payloads.
+ *
+ * Responses responses have an `output` array of items instead of `choices`.
+ * Tool calls are top-level items with `type: "function_call"`.
+ * Usage uses `input_tokens`/`output_tokens` (not `prompt_tokens`/`completion_tokens`).
+ * `status` replaces `choices[0].finish_reason`.
+ */
+function normalizeOpenAiResponsesResponsePayload(
+  responsePayload: unknown,
+): NormalizedPayloadCandidate | null {
+  const response = asRecord(responsePayload);
+  if (!response) {
+    return null;
+  }
+
+  const output = asRecordArray(response.output);
+  if (!output) {
+    return null;
+  }
+
+  // Require at least one Responses-specific signal
+  const hasResponsesSignal =
+    typeof response.status === "string" ||
+    hasOpenAiModelPrefix(asString(response.model)) ||
+    output.some(
+      (item) =>
+        asString(item.type) === "message" ||
+        asString(item.type) === "function_call",
+    );
+  if (!hasResponsesSignal) {
+    return null;
+  }
+
+  const responseSections: LlmContextSection[] = [];
+  let responseText: string | undefined;
+  const toolCallSections: LlmContextSection[] = [];
+  let toolCallIndex = 0;
+
+  for (const item of output) {
+    const itemType = asString(item.type);
+
+    if (itemType === "message") {
+      const role = asString(item.role) ?? "assistant";
+      const content = asRecordArray(item.content);
+      const text = content ? extractOpenAiContentText(content) : undefined;
+      if (text !== undefined) {
+        responseText = text;
+        responseSections.push({
+          kind: "message",
+          label: "Assistant response",
+          role,
+          text,
+        });
+      }
+      continue;
+    }
+
+    if (itemType === "function_call") {
+      toolCallIndex++;
+      const name = asString(item.name);
+      const args = parseJsonValue(asString(item.arguments));
+      const section: LlmContextSection = {
+        kind: "function_call",
+        label: `Response tool call ${toolCallIndex}`,
+        role: "assistant",
+        toolName: name,
+        data: args,
+        text: previewStructuredValue(args),
+      };
+      toolCallSections.push(section);
+      responseSections.push(section);
+    }
+  }
+
+  const usage = asRecord(response.usage);
+  const toolCallNames = toolCallSections
+    .map((section) => section.toolName)
+    .filter((name): name is string => typeof name === "string");
+
+  // Map Responses API status to a stop reason string.
+  const status = asString(response.status);
+  const stopReason = status === "completed" ? "stop" : status;
+
+  return {
+    provider: "openai",
+    summary: {
+      provider: "openai",
+      model: asString(response.model),
+      inputTokens: asNumber(usage?.input_tokens),
+      outputTokens: asNumber(usage?.output_tokens),
+      cacheCreationInputTokens: undefined,
+      cacheReadInputTokens: undefined,
+      stopReason,
+      requestMessageCount: undefined,
+      requestToolCount: undefined,
+      responseMessageCount:
+        responseText !== undefined || toolCallSections.length > 0
+          ? 1
+          : undefined,
+      responseToolCallCount:
+        toolCallSections.length > 0 ? toolCallSections.length : undefined,
+      responsePreview: responseText ? truncateText(responseText) : undefined,
+      toolCallNames: toolCallNames.length > 0 ? toolCallNames : undefined,
+    },
+    responseSections:
+      responseSections.length > 0 ? responseSections : undefined,
+  };
+}
+
+/**
+ * Normalize a legacy OpenAI Chat Completions response payload.
+ * Requires `choices` array in the response.
+ */
+function normalizeOpenAiChatCompletionsResponsePayload(
+  responsePayload: unknown,
 ): NormalizedPayloadCandidate | null {
   const response = asRecord(responsePayload);
   if (!response) {
@@ -739,6 +1025,23 @@ function extractOpenAiRequestToolNames(tools: unknown): string[] {
     .filter((name): name is string => typeof name === "string");
 }
 
+/**
+ * Extract tool names from Responses API tool definitions.
+ * Responses tools have `type: "function"` at the top level with `name`
+ * directly on the tool object (no nested `function` wrapper).
+ */
+function extractOpenAiResponsesRequestToolNames(tools: unknown): string[] {
+  return (asRecordArray(tools) ?? [])
+    .map((tool) => {
+      // Responses shape: { type: "function", name: "...", ... }
+      if (asString(tool.type) === "function" && asString(tool.name)) {
+        return asString(tool.name);
+      }
+      return undefined;
+    })
+    .filter((name): name is string => typeof name === "string");
+}
+
 function extractAnthropicToolNames(tools: unknown): string[] {
   return (asRecordArray(tools) ?? [])
     .map((tool) => asString(tool.name))

package/src/runtime/routes/log-export-routes.ts

@@ -49,6 +49,7 @@ const MAX_LOG_PAYLOAD_BYTES = 10 * 1024 * 1024;
 interface ExportRequestBody {
   auditLimit?: number;
   conversationId?: string; // scope to a single conversation
+  full?: boolean; // include all conversation data (messages + LLM logs) — use for test data debugging
   startTime?: number; // epoch ms — lower bound (inclusive)
   endTime?: number; // epoch ms — upper bound (inclusive)
 }
@@ -67,7 +68,7 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
   const staging = mkdtempSync(join(tmpdir(), "vellum-export-"));
 
   try {
-    const { conversationId, startTime, endTime } = body;
+    const { conversationId, full, startTime, endTime } = body;
 
     // --- Audit data ---
     const limit = body.auditLimit ?? 1000;
@@ -98,14 +99,19 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
       "utf-8",
     );
 
-    // --- Conversation-scoped data tables ---
-    if (conversationId) {
+    // --- Conversation data tables ---
+    // Included when scoped to a single conversation OR when all conversations are requested.
+    if (conversationId || full) {
+      const conversationFilter = conversationId
+        ? [eq(messages.conversationId, conversationId)]
+        : [];
+
       const messageRows = db
         .select()
         .from(messages)
         .where(
           and(
-            eq(messages.conversationId, conversationId),
+            ...conversationFilter,
             startTime ? gte(messages.createdAt, startTime) : undefined,
             endTime ? lte(messages.createdAt, endTime) : undefined,
           ),
@@ -118,12 +124,16 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
         "utf-8",
       );
 
+      const llmConversationFilter = conversationId
+        ? [eq(llmRequestLogs.conversationId, conversationId)]
+        : [];
+
       const llmLogRows = db
         .select()
         .from(llmRequestLogs)
         .where(
           and(
-            eq(llmRequestLogs.conversationId, conversationId),
+            ...llmConversationFilter,
             startTime ? gte(llmRequestLogs.createdAt, startTime) : undefined,
             endTime ? lte(llmRequestLogs.createdAt, endTime) : undefined,
           ),
@@ -136,12 +146,16 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
         "utf-8",
       );
 
+      const usageConversationFilter = conversationId
+        ? [eq(llmUsageEvents.conversationId, conversationId)]
+        : [];
+
       const usageRows = db
         .select()
         .from(llmUsageEvents)
         .where(
           and(
-            eq(llmUsageEvents.conversationId, conversationId),
+            ...usageConversationFilter,
             startTime ? gte(llmUsageEvents.createdAt, startTime) : undefined,
             endTime ? lte(llmUsageEvents.createdAt, endTime) : undefined,
           ),
@@ -265,22 +279,21 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
     }
 
     // --- Export manifest ---
-    const manifest = conversationId
-      ? {
-          type: "conversation-export" as const,
-          conversationId,
-          assistantVersion: APP_VERSION,
-          commitSha: COMMIT_SHA,
-          ...(startTime !== undefined ? { startTime } : {}),
-          ...(endTime !== undefined ? { endTime } : {}),
-          exportedAt: new Date().toISOString(),
-        }
-      : {
-          type: "global-export" as const,
-          assistantVersion: APP_VERSION,
-          commitSha: COMMIT_SHA,
-          exportedAt: new Date().toISOString(),
-        };
+    const manifestType = conversationId
+      ? ("conversation-export" as const)
+      : full
+        ? ("full-export" as const)
+        : ("global-export" as const);
+    const manifest = {
+      type: manifestType,
+      ...(conversationId ? { conversationId } : {}),
+      ...(full ? { full: true } : {}),
+      assistantVersion: APP_VERSION,
+      commitSha: COMMIT_SHA,
+      ...(startTime !== undefined ? { startTime } : {}),
+      ...(endTime !== undefined ? { endTime } : {}),
+      exportedAt: new Date().toISOString(),
+    };
     writeFileSync(
       join(staging, "export-manifest.json"),
       JSON.stringify(manifest, null, 2),
@@ -294,6 +307,7 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
         totalBytes,
         hasConfig: configSnapshot !== undefined,
         conversationId: conversationId ?? null,
+        full: full ?? false,
         workspaceEntries: workspaceResult.entries.length,
         workspaceBytes: workspaceResult.totalBytes,
       },
@@ -441,6 +455,12 @@ export function logExportRouteDefinitions(): RouteDefinition[] {
       .string()
       .optional()
       .describe("Scope to a single conversation"),
+    full: z
+      .boolean()
+      .optional()
+      .describe(
+        "Full export — include messages, LLM request logs, and usage events for all conversations. Use for test data debugging.",
+      ),
     startTime: z.number().optional().describe("Lower bound epoch ms"),
     endTime: z.number().optional().describe("Upper bound epoch ms"),
   });

package/src/runtime/routes/memory-item-routes.test.ts

@@ -868,14 +868,15 @@ describe("Memory Item Routes", () => {
       const res = await handler(ctx);
       expect(res.status).toBe(204);
 
-      // Verify the node is gone
+      // Verify the node is soft-deleted (fidelity='gone')
       const db = getDb();
       const node = db
         .select()
         .from(memoryGraphNodes)
         .where(eq(memoryGraphNodes.id, "i1"))
         .get();
-      expect(node).toBeUndefined();
+      expect(node).toBeDefined();
+      expect(node?.fidelity).toBe("gone");
     });
 
     test("returns 404 for non-existent item", async () => {

package/src/runtime/routes/memory-item-routes.ts

@@ -712,15 +712,9 @@ export async function handleDeleteMemoryItem(
     return httpError("NOT_FOUND", "Memory item not found", 404);
   }
 
-  // Hard-delete the node (cascades to edges and triggers via FK)
+  // Soft-delete the node (deleteNode sets fidelity='gone' and enqueues Qdrant cleanup)
   deleteNode(id);
 
-  // Clean up Qdrant vectors asynchronously
-  enqueueMemoryJob("delete_qdrant_vectors", {
-    targetType: "graph_node",
-    targetId: id,
-  });
-
   return new Response(null, { status: 204 });
 }
 

package/src/runtime/routes/migration-routes.ts

@@ -21,6 +21,11 @@ import { invalidateConfigCache } from "../../config/loader.js";
 import { getDb, resetDb } from "../../memory/db-connection.js";
 import { validateMigrationState } from "../../memory/migrations/validate-migration-state.js";
 import { clearCache as clearTrustCache } from "../../permissions/trust-store.js";
+import {
+  bulkSetSecureKeysAsync,
+  getSecureKeyResultAsync,
+  listSecureKeysAsync,
+} from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import {
   getDbPath,
@@ -34,9 +39,15 @@ import {
   analyzeImport,
   DefaultPathResolver,
 } from "../migrations/vbundle-import-analyzer.js";
-import { commitImport } from "../migrations/vbundle-importer.js";
+import {
+  commitImport,
+  extractCredentialsFromBundle,
+} from "../migrations/vbundle-importer.js";
 import { validateVBundle } from "../migrations/vbundle-validator.js";
 
+/** Credentials with this prefix are platform-identity keys and must not be imported. */
+const PLATFORM_CREDENTIAL_PREFIX = "vellum:";
+
 const log = getLogger("migration-routes");
 
 /**
@@ -146,6 +157,27 @@ export async function handleMigrationExport(req: Request): Promise<Response> {
   let cleanup: (() => Promise<void>) | undefined;
 
   try {
+    // Read all stored credentials to include in the export bundle
+    const credentialList = await listSecureKeysAsync();
+    const credentials: Array<{ account: string; value: string }> = [];
+    if (credentialList.unreachable) {
+      log.warn(
+        "Credential store is unreachable — export will not include credentials",
+      );
+    } else {
+      for (const account of credentialList.accounts) {
+        const result = await getSecureKeyResultAsync(account);
+        if (result.unreachable) {
+          log.warn(
+            { account },
+            "Credential store unreachable when reading credential — skipping",
+          );
+        } else if (result.value != null) {
+          credentials.push({ account, value: result.value });
+        }
+      }
+    }
+
     const result = await streamExportVBundle({
       // hooksDir is intentionally omitted — hooks now live under workspace/hooks/
       // and are included in the workspace walk. Passing hooksDir separately would
@@ -153,6 +185,7 @@ export async function handleMigrationExport(req: Request): Promise<Response> {
       workspaceDir: getWorkspaceDir(),
       source: "runtime-export",
       description,
+      credentials,
       checkpoint: () => {
         const dbPath = getDbPath();
         try {
@@ -196,6 +229,7 @@ export async function handleMigrationExport(req: Request): Promise<Response> {
         "Content-Length": String(size),
         "X-Vbundle-Schema-Version": manifest.schema_version,
         "X-Vbundle-Manifest-Sha256": manifest.manifest_sha256,
+        "X-Vbundle-Credentials-Included": String(credentials.length),
       },
     });
   } catch (err) {
@@ -444,6 +478,89 @@ export async function handleMigrationImport(req: Request): Promise<Response> {
       );
     }
 
+    // Import credentials from the bundle into CES (non-blocking — failures
+    // are logged as warnings but do not fail the overall import).
+    let credentialsImported:
+      | {
+          total: number;
+          succeeded: number;
+          failed: number;
+          failedAccounts: string[];
+          skippedPlatform: number;
+        }
+      | undefined;
+
+    if (validation.entries) {
+      const bundleCredentials = extractCredentialsFromBundle(
+        validation.entries,
+        validation.manifest!,
+      );
+
+      // Filter out platform-identity credentials (vellum:*) — these are
+      // environment-specific and must not overwrite the target's own identity.
+      const userCredentials = bundleCredentials.filter(
+        (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
+      );
+      const skippedPlatform = bundleCredentials.length - userCredentials.length;
+      if (skippedPlatform > 0) {
+        log.info(
+          `Skipped ${skippedPlatform} platform credential(s) from import`,
+        );
+      }
+
+      if (userCredentials.length > 0) {
+        try {
+          const credResults = await bulkSetSecureKeysAsync(userCredentials);
+          const failedResults = credResults.filter((r) => !r.ok);
+          if (failedResults.length > 0) {
+            log.warn(
+              { failed: failedResults.map((f) => f.account) },
+              "Some credentials failed to import",
+            );
+          }
+          log.info(
+            { total: userCredentials.length, failed: failedResults.length },
+            "Credential import complete",
+          );
+          const succeeded = userCredentials.length - failedResults.length;
+          credentialsImported = {
+            total: userCredentials.length,
+            succeeded,
+            failed: failedResults.length,
+            failedAccounts: failedResults.map((f) => f.account),
+            skippedPlatform,
+          };
+          if (failedResults.length > 0) {
+            result.report.warnings.push(
+              `Imported ${succeeded} credential(s), ${failedResults.length} failed`,
+            );
+          }
+        } catch (err) {
+          log.warn({ err }, "Credential import failed entirely");
+          result.report.warnings.push(
+            `Credential import failed: ${err instanceof Error ? err.message : String(err)}`,
+          );
+          credentialsImported = {
+            total: userCredentials.length,
+            succeeded: 0,
+            failed: userCredentials.length,
+            failedAccounts: userCredentials.map((c) => c.account),
+            skippedPlatform,
+          };
+        }
+      } else if (skippedPlatform > 0) {
+        // All credentials in the bundle were platform credentials — report
+        // the skip count even though nothing was sent to CES.
+        credentialsImported = {
+          total: userCredentials.length,
+          succeeded: 0,
+          failed: 0,
+          failedAccounts: [],
+          skippedPlatform,
+        };
+      }
+    }
+
     // Invalidate in-process caches so imported settings.json and trust.json take effect
     invalidateConfigCache();
     clearTrustCache();
@@ -463,7 +580,10 @@ export async function handleMigrationImport(req: Request): Promise<Response> {
       // Don't fail the import if validation itself errors
     }
 
-    return Response.json(result.report);
+    return Response.json({
+      ...result.report,
+      ...(credentialsImported ? { credentialsImported } : {}),
+    });
   } catch (err) {
     log.error({ err }, "Unexpected error during import commit");
     return httpError(