@vellumai/assistant 0.6.3 → 0.6.4

package/src/runtime/routes/llm-context-normalization.ts

@@ -112,6 +112,168 @@ export function normalizeLlmContextPayloads(
 function normalizeOpenAiRequestPayload(
   requestPayload: unknown,
   allowPlainText = false,
+): NormalizedPayloadCandidate | null {
+  // Try Responses API shape first, then fall back to chat-completions.
+  return (
+    normalizeOpenAiResponsesRequestPayload(requestPayload, allowPlainText) ??
+    normalizeOpenAiChatCompletionsRequestPayload(requestPayload, allowPlainText)
+  );
+}
+
+/**
+ * Detect and normalize OpenAI Responses API request payloads.
+ *
+ * Responses requests use `input` (array) instead of `messages`, may have a
+ * top-level `instructions` string, and tools have `type: "function"` at the
+ * top level with the function fields inlined (no nested `function` wrapper).
+ */
+function normalizeOpenAiResponsesRequestPayload(
+  requestPayload: unknown,
+  allowPlainText = false,
+): NormalizedPayloadCandidate | null {
+  const request = asRecord(requestPayload);
+  if (!request) {
+    return null;
+  }
+
+  const input = asRecordArray(request.input);
+  if (!input) {
+    return null;
+  }
+
+  // Require at least one Responses-specific signal to avoid matching generic
+  // arrays. `instructions` is the strongest signal; otherwise look for
+  // Responses-shaped input items or tool objects.
+  const hasResponsesSignal =
+    typeof request.instructions === "string" ||
+    hasOpenAiModelPrefix(asString(request.model)) ||
+    input.some(
+      (item) =>
+        asString(item.type) === "function_call" ||
+        asString(item.type) === "function_call_output",
+    ) ||
+    extractOpenAiResponsesRequestToolNames(request.tools).length > 0;
+
+  if (!allowPlainText && !hasResponsesSignal) {
+    return null;
+  }
+
+  const requestSections: LlmContextSection[] = [];
+
+  // System-level instructions
+  const instructions = asString(request.instructions);
+  if (instructions && hasMeaningfulText(instructions)) {
+    requestSections.push({
+      kind: "system",
+      label: "System prompt",
+      role: "system",
+      text: instructions,
+    });
+  }
+
+  // Input items
+  let messageIndex = 0;
+  for (const item of input) {
+    const itemType = asString(item.type);
+
+    if (itemType === "message") {
+      messageIndex++;
+      const role = asString(item.role) ?? "unknown";
+      const messageText = extractOpenAiContentText(item.content);
+      if (messageText !== undefined) {
+        requestSections.push({
+          kind: "message",
+          label: buildMessageLabel(role, messageIndex),
+          role,
+          text: messageText,
+        });
+      }
+      continue;
+    }
+
+    if (itemType === "function_call") {
+      const name = asString(item.name);
+      const args = parseJsonValue(asString(item.arguments));
+      requestSections.push({
+        kind: "function_call",
+        label: `Request tool call${name ? ` (${name})` : ""}`,
+        role: "assistant",
+        toolName: name,
+        data: args,
+        text: previewStructuredValue(args),
+      });
+      continue;
+    }
+
+    if (itemType === "function_call_output") {
+      const output = asString(item.output);
+      requestSections.push({
+        kind: "tool_result",
+        label: `Tool result${asString(item.call_id) ? ` (${asString(item.call_id)})` : ""}`,
+        role: "tool",
+        toolName: asString(item.call_id),
+        text: output,
+      });
+    }
+  }
+
+  // Tool definitions (Responses shape: top-level type/name/parameters)
+  const requestToolNames = extractOpenAiResponsesRequestToolNames(
+    request.tools,
+  );
+  if (requestToolNames.length > 0) {
+    requestSections.push({
+      kind: "tool_definitions",
+      label: "Available tools",
+      data: {
+        tools: asRecordArray(request.tools) ?? request.tools,
+      },
+      language: "json",
+    });
+  }
+
+  const requestSettings = omitRecordKeys(request, [
+    "instructions",
+    "input",
+    "tools",
+  ]);
+  if (hasMeaningfulRequestSettings(requestSettings)) {
+    requestSections.push(
+      structuredJsonSection("settings", "Request settings", requestSettings),
+    );
+  }
+
+  // Count all input items for the message count (includes messages, function
+  // calls, and function call outputs — mirrors how chat-completions counts
+  // all messages regardless of role).
+  return {
+    provider: "openai",
+    summary: {
+      provider: "openai",
+      model: asString(request.model),
+      inputTokens: undefined,
+      outputTokens: undefined,
+      cacheCreationInputTokens: undefined,
+      cacheReadInputTokens: undefined,
+      stopReason: undefined,
+      requestMessageCount: input.length,
+      requestToolCount: requestToolNames.length,
+      responseMessageCount: undefined,
+      responseToolCallCount: undefined,
+      responsePreview: undefined,
+      toolCallNames: undefined,
+    },
+    requestSections: requestSections.length > 0 ? requestSections : undefined,
+  };
+}
+
+/**
+ * Normalize a legacy OpenAI Chat Completions request payload.
+ * Requires `messages` array in the request.
+ */
+function normalizeOpenAiChatCompletionsRequestPayload(
+  requestPayload: unknown,
+  allowPlainText = false,
 ): NormalizedPayloadCandidate | null {
   const request = asRecord(requestPayload);
   if (!request) {
@@ -202,6 +364,130 @@ function normalizeOpenAiRequestPayload(
 
 function normalizeOpenAiResponsePayload(
   responsePayload: unknown,
+): NormalizedPayloadCandidate | null {
+  // Try Responses API shape first, then fall back to chat-completions.
+  return (
+    normalizeOpenAiResponsesResponsePayload(responsePayload) ??
+    normalizeOpenAiChatCompletionsResponsePayload(responsePayload)
+  );
+}
+
+/**
+ * Detect and normalize OpenAI Responses API response payloads.
+ *
+ * Responses responses have an `output` array of items instead of `choices`.
+ * Tool calls are top-level items with `type: "function_call"`.
+ * Usage uses `input_tokens`/`output_tokens` (not `prompt_tokens`/`completion_tokens`).
+ * `status` replaces `choices[0].finish_reason`.
+ */
+function normalizeOpenAiResponsesResponsePayload(
+  responsePayload: unknown,
+): NormalizedPayloadCandidate | null {
+  const response = asRecord(responsePayload);
+  if (!response) {
+    return null;
+  }
+
+  const output = asRecordArray(response.output);
+  if (!output) {
+    return null;
+  }
+
+  // Require at least one Responses-specific signal
+  const hasResponsesSignal =
+    typeof response.status === "string" ||
+    hasOpenAiModelPrefix(asString(response.model)) ||
+    output.some(
+      (item) =>
+        asString(item.type) === "message" ||
+        asString(item.type) === "function_call",
+    );
+  if (!hasResponsesSignal) {
+    return null;
+  }
+
+  const responseSections: LlmContextSection[] = [];
+  let responseText: string | undefined;
+  const toolCallSections: LlmContextSection[] = [];
+  let toolCallIndex = 0;
+
+  for (const item of output) {
+    const itemType = asString(item.type);
+
+    if (itemType === "message") {
+      const role = asString(item.role) ?? "assistant";
+      const content = asRecordArray(item.content);
+      const text = content ? extractOpenAiContentText(content) : undefined;
+      if (text !== undefined) {
+        responseText = text;
+        responseSections.push({
+          kind: "message",
+          label: "Assistant response",
+          role,
+          text,
+        });
+      }
+      continue;
+    }
+
+    if (itemType === "function_call") {
+      toolCallIndex++;
+      const name = asString(item.name);
+      const args = parseJsonValue(asString(item.arguments));
+      const section: LlmContextSection = {
+        kind: "function_call",
+        label: `Response tool call ${toolCallIndex}`,
+        role: "assistant",
+        toolName: name,
+        data: args,
+        text: previewStructuredValue(args),
+      };
+      toolCallSections.push(section);
+      responseSections.push(section);
+    }
+  }
+
+  const usage = asRecord(response.usage);
+  const toolCallNames = toolCallSections
+    .map((section) => section.toolName)
+    .filter((name): name is string => typeof name === "string");
+
+  // Map Responses API status to a stop reason string.
+  const status = asString(response.status);
+  const stopReason = status === "completed" ? "stop" : status;
+
+  return {
+    provider: "openai",
+    summary: {
+      provider: "openai",
+      model: asString(response.model),
+      inputTokens: asNumber(usage?.input_tokens),
+      outputTokens: asNumber(usage?.output_tokens),
+      cacheCreationInputTokens: undefined,
+      cacheReadInputTokens: undefined,
+      stopReason,
+      requestMessageCount: undefined,
+      requestToolCount: undefined,
+      responseMessageCount:
+        responseText !== undefined || toolCallSections.length > 0
+          ? 1
+          : undefined,
+      responseToolCallCount:
+        toolCallSections.length > 0 ? toolCallSections.length : undefined,
+      responsePreview: responseText ? truncateText(responseText) : undefined,
+      toolCallNames: toolCallNames.length > 0 ? toolCallNames : undefined,
+    },
+    responseSections:
+      responseSections.length > 0 ? responseSections : undefined,
+  };
+}
+
+/**
+ * Normalize a legacy OpenAI Chat Completions response payload.
+ * Requires `choices` array in the response.
+ */
+function normalizeOpenAiChatCompletionsResponsePayload(
+  responsePayload: unknown,
 ): NormalizedPayloadCandidate | null {
   const response = asRecord(responsePayload);
   if (!response) {
@@ -739,6 +1025,23 @@ function extractOpenAiRequestToolNames(tools: unknown): string[] {
     .filter((name): name is string => typeof name === "string");
 }
 
+/**
+ * Extract tool names from Responses API tool definitions.
+ * Responses tools have `type: "function"` at the top level with `name`
+ * directly on the tool object (no nested `function` wrapper).
+ */
+function extractOpenAiResponsesRequestToolNames(tools: unknown): string[] {
+  return (asRecordArray(tools) ?? [])
+    .map((tool) => {
+      // Responses shape: { type: "function", name: "...", ... }
+      if (asString(tool.type) === "function" && asString(tool.name)) {
+        return asString(tool.name);
+      }
+      return undefined;
+    })
+    .filter((name): name is string => typeof name === "string");
+}
+
 function extractAnthropicToolNames(tools: unknown): string[] {
   return (asRecordArray(tools) ?? [])
     .map((tool) => asString(tool.name))

package/src/runtime/routes/memory-item-routes.test.ts

@@ -868,14 +868,15 @@ describe("Memory Item Routes", () => {
       const res = await handler(ctx);
       expect(res.status).toBe(204);
 
-      // Verify the node is gone
+      // Verify the node is soft-deleted (fidelity='gone')
       const db = getDb();
       const node = db
         .select()
         .from(memoryGraphNodes)
         .where(eq(memoryGraphNodes.id, "i1"))
         .get();
-      expect(node).toBeUndefined();
+      expect(node).toBeDefined();
+      expect(node?.fidelity).toBe("gone");
     });
 
     test("returns 404 for non-existent item", async () => {

package/src/runtime/routes/migration-routes.ts

@@ -45,6 +45,9 @@ import {
 } from "../migrations/vbundle-importer.js";
 import { validateVBundle } from "../migrations/vbundle-validator.js";
 
+/** Credentials with this prefix are platform-identity keys and must not be imported. */
+const PLATFORM_CREDENTIAL_PREFIX = "vellum:";
+
 const log = getLogger("migration-routes");
 
 /**
@@ -483,6 +486,7 @@ export async function handleMigrationImport(req: Request): Promise<Response> {
           succeeded: number;
           failed: number;
           failedAccounts: string[];
+          skippedPlatform: number;
         }
       | undefined;
 
@@ -491,9 +495,22 @@ export async function handleMigrationImport(req: Request): Promise<Response> {
         validation.entries,
         validation.manifest!,
       );
-      if (bundleCredentials.length > 0) {
+
+      // Filter out platform-identity credentials (vellum:*) — these are
+      // environment-specific and must not overwrite the target's own identity.
+      const userCredentials = bundleCredentials.filter(
+        (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
+      );
+      const skippedPlatform = bundleCredentials.length - userCredentials.length;
+      if (skippedPlatform > 0) {
+        log.info(
+          `Skipped ${skippedPlatform} platform credential(s) from import`,
+        );
+      }
+
+      if (userCredentials.length > 0) {
         try {
-          const credResults = await bulkSetSecureKeysAsync(bundleCredentials);
+          const credResults = await bulkSetSecureKeysAsync(userCredentials);
           const failedResults = credResults.filter((r) => !r.ok);
           if (failedResults.length > 0) {
             log.warn(
@@ -502,15 +519,16 @@ export async function handleMigrationImport(req: Request): Promise<Response> {
             );
           }
           log.info(
-            { total: bundleCredentials.length, failed: failedResults.length },
+            { total: userCredentials.length, failed: failedResults.length },
             "Credential import complete",
           );
-          const succeeded = bundleCredentials.length - failedResults.length;
+          const succeeded = userCredentials.length - failedResults.length;
           credentialsImported = {
-            total: bundleCredentials.length,
+            total: userCredentials.length,
             succeeded,
             failed: failedResults.length,
             failedAccounts: failedResults.map((f) => f.account),
+            skippedPlatform,
           };
           if (failedResults.length > 0) {
             result.report.warnings.push(
@@ -522,7 +540,24 @@ export async function handleMigrationImport(req: Request): Promise<Response> {
           result.report.warnings.push(
             `Credential import failed: ${err instanceof Error ? err.message : String(err)}`,
           );
+          credentialsImported = {
+            total: userCredentials.length,
+            succeeded: 0,
+            failed: userCredentials.length,
+            failedAccounts: userCredentials.map((c) => c.account),
+            skippedPlatform,
+          };
         }
+      } else if (skippedPlatform > 0) {
+        // All credentials in the bundle were platform credentials — report
+        // the skip count even though nothing was sent to CES.
+        credentialsImported = {
+          total: userCredentials.length,
+          succeeded: 0,
+          failed: 0,
+          failedAccounts: [],
+          skippedPlatform,
+        };
       }
     }
 

package/src/runtime/routes/settings-routes.ts

@@ -8,7 +8,7 @@
  */
 
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 
 import { z } from "zod";
 
@@ -36,6 +36,8 @@ import {
   generateAllowlistOptions,
   generateScopeOptions,
 } from "../../permissions/checker.js";
+import { resolveGuardianPersonaPath } from "../../prompts/persona-resolver.js";
+import type { ToolDefinition } from "../../providers/types.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { parseToolManifestFile } from "../../skills/tool-manifest.js";
 import {
@@ -314,16 +316,31 @@ async function handleOAuthConnectStart(body: {
 // Workspace files (list/read)
 // ---------------------------------------------------------------------------
 
-const WORKSPACE_FILES = ["IDENTITY.md", "SOUL.md", "USER.md", "skills/"];
+/**
+ * Build the list of workspace files exposed via the workspace-files endpoint.
+ *
+ * Returns the static identity/soul files and skills directory plus the
+ * guardian's resolved per-user persona file at `users/<slug>.md` when a
+ * guardian exists. Callers should invoke this per-request instead of
+ * caching, since the guardian can change over the lifetime of the daemon.
+ */
+function getWorkspaceFiles(): string[] {
+  const files = ["IDENTITY.md", "SOUL.md", "skills/"];
+  const guardianPath = resolveGuardianPersonaPath();
+  if (guardianPath) {
+    files.push(`users/${basename(guardianPath)}`);
+  }
+  return files;
+}
 
 function handleWorkspaceFilesList(): Response {
   const base = getWorkspaceDir();
-  const files = WORKSPACE_FILES.map((name) => ({
+  const files = getWorkspaceFiles().map((name) => ({
     path: name,
     name,
     exists: pathExists(join(base, name)),
   }));
-  return Response.json({ files });
+  return Response.json({ type: "workspace_files_list_response", files });
 }
 
 function handleWorkspaceFileRead(requestedPath: string): Response {
@@ -389,7 +406,7 @@ function handleToolNamesList(): Response {
   const schemas: Record<string, SchemaShape> = {};
 
   // Collect raw definitions from the registry so we can transform them.
-  const rawDefs: import("../../providers/types.js").ToolDefinition[] = [];
+  const rawDefs: ToolDefinition[] = [];
   for (const tool of tools) {
     try {
       rawDefs.push(tool.getDefinition());

package/src/runtime/routes/skills-routes.ts

@@ -24,7 +24,7 @@ import {
   inspectSkill,
   installSkill,
   listSkills,
-  listSkillsWithCatalog,
+  listSkillsFiltered,
   searchSkills,
   uninstallSkill,
   updateSkill,
@@ -40,6 +40,13 @@ export interface SkillRouteDeps {
   getSkillContext: () => SkillOperationContext;
 }
 
+const partnerAuditSchema = z.object({
+  risk: z.enum(["safe", "low", "medium", "high", "critical", "unknown"]),
+  alerts: z.number().optional(),
+  score: z.number().optional(),
+  analyzedAt: z.string(),
+});
+
 const slimSkillBase = {
   id: z.string(),
   name: z.string(),
@@ -60,6 +67,7 @@ const slimSkillSchema = z.discriminatedUnion("origin", [
     installs: z.number(),
     reports: z.number(),
     publishedAt: z.string().optional(),
+    version: z.string(),
   }),
   z.object({
     ...slimSkillBase,
@@ -67,6 +75,7 @@ const slimSkillSchema = z.discriminatedUnion("origin", [
     slug: z.string(),
     sourceRepo: z.string(),
     installs: z.number(),
+    audit: z.record(z.string(), partnerAuditSchema).optional(),
   }),
   z.object({ ...slimSkillBase, origin: z.literal("custom") }),
 ]);
@@ -82,6 +91,7 @@ const skillDetailSchema = z.discriminatedUnion("origin", [
     installs: z.number(),
     reports: z.number(),
     publishedAt: z.string().optional(),
+    version: z.string(),
     owner: z
       .object({
         handle: z.string(),
@@ -115,6 +125,7 @@ const skillDetailSchema = z.discriminatedUnion("origin", [
     slug: z.string(),
     sourceRepo: z.string(),
     installs: z.number(),
+    audit: z.record(z.string(), partnerAuditSchema).optional(),
   }),
   z.object({ ...slimSkillBase, origin: z.literal("custom") }),
 ]);
@@ -129,7 +140,7 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
       policyKey: "skills",
       summary: "List all skills",
       description:
-        "Return all installed skills. Pass ?include=catalog to also include available catalog skills.",
+        "Return all installed skills. Pass ?include=catalog to also include available catalog skills. Supports optional filter params: origin, kind, q, category.",
       tags: ["skills"],
       queryParams: [
         {
@@ -138,16 +149,73 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
           description:
             "Optional inclusion flag. Use 'catalog' to merge available Vellum catalog skills into the response.",
         },
+        {
+          name: "origin",
+          schema: { type: "string" },
+          description:
+            "Filter by skill origin (e.g. 'vellum', 'clawhub', 'skillssh', 'custom').",
+        },
+        {
+          name: "kind",
+          schema: { type: "string" },
+          description:
+            "Filter by kind: 'installed' (includes bundled), 'available', or pass through as skill.kind.",
+        },
+        {
+          name: "q",
+          schema: { type: "string" },
+          description:
+            "Text search across skill name, description, id, and origin label.",
+        },
+        {
+          name: "category",
+          schema: { type: "string" },
+          description:
+            "Filter by inferred category (e.g. 'communication', 'productivity').",
+        },
       ],
       responseBody: z.object({
         skills: z.array(slimSkillSchema).describe("Skill objects"),
+        categoryCounts: z
+          .record(z.string(), z.number())
+          .optional()
+          .describe(
+            "Count of skills per category (before category filter is applied)",
+          ),
+        totalCount: z
+          .number()
+          .optional()
+          .describe("Total number of skills matching non-category filters"),
       }),
       handler: async ({ url }) => {
         const include = url.searchParams.get("include");
-        const skills =
-          include === "catalog"
-            ? await listSkillsWithCatalog(ctx())
-            : listSkills(ctx());
+        const origin = url.searchParams.get("origin");
+        const kind = url.searchParams.get("kind");
+        const q = url.searchParams.get("q");
+        const category = url.searchParams.get("category");
+
+        const hasFilter = !!(origin || kind || q || category);
+
+        if (hasFilter || include === "catalog") {
+          const result = await listSkillsFiltered(
+            {
+              ...(origin ? { origin } : {}),
+              ...(kind ? { kind } : {}),
+              ...(q ? { q } : {}),
+              ...(category ? { category } : {}),
+              includeCatalog: include === "catalog",
+            },
+            ctx(),
+          );
+          return Response.json({
+            skills: result.skills,
+            categoryCounts: result.categoryCounts,
+            totalCount: result.totalCount,
+          });
+        }
+
+        // No filter params and include !== catalog: preserve existing behavior
+        const skills = listSkills(ctx());
         return Response.json({ skills });
       },
     },
@@ -312,6 +380,7 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
       }),
       responseBody: z.object({
         ok: z.boolean(),
+        skillId: z.string().optional(),
       }),
       handler: async ({ req, authContext }) => {
         const body = (await req.json()) as {
@@ -337,7 +406,7 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
         if (!result.success) {
           return httpError("INTERNAL_ERROR", result.error, 500);
         }
-        return Response.json({ ok: true });
+        return Response.json({ ok: true, skillId: result.skillId });
       },
     },