@vellumai/assistant 0.10.3 → 0.10.4-staging.1

package/src/cli/lib/publish-plugin.ts

@@ -46,6 +46,8 @@ export interface GitContext {
   repo: string;
   dirty: boolean;
   pushed: boolean;
+  /** Repo-relative path to the plugin directory, or "" if at repo root. */
+  pluginPath: string;
 }
 
 export interface PublishPayload {
@@ -225,6 +227,12 @@ export async function resolveGitContext(dir: string): Promise<GitContext> {
   }
   const repo = remoteMatch[1];
 
+  // Compute the repo-relative path to the plugin directory.
+  const repoRoot = await runGit(dir, ["rev-parse", "--show-toplevel"]);
+  const pluginPath = resolve(dir)
+    .slice(resolve(repoRoot).length + 1)
+    .replace(/\\/g, "/");
+
   // Check if the commit is pushed
   let pushed = true;
   try {
@@ -235,7 +243,7 @@ export async function resolveGitContext(dir: string): Promise<GitContext> {
     pushed = true;
   }
 
-  return { sha, repo, dirty, pushed };
+  return { sha, repo, dirty, pushed, pluginPath };
 }
 
 // ---------------------------------------------------------------------------
@@ -261,6 +269,7 @@ export function buildPublishPayload(
       source: "github",
       repo: git.repo,
       ref: git.sha,
+      ...(git.pluginPath ? { path: git.pluginPath } : {}),
     },
     category,
   };
@@ -379,7 +388,228 @@ export function formatValidationResult(validation: PublishValidation): string {
   return lines.join("\n");
 }
 
+// ---------------------------------------------------------------------------
+// CLI entrypoint
+// ---------------------------------------------------------------------------
+
+export interface PublishCliOptions {
+  print?: boolean;
+  path?: string;
+  force?: boolean;
+  json?: boolean;
+  category?: string;
+}
+
+export interface PublishCliDeps {
+  confirmPrompt: (opts: {
+    question: string;
+    isTTY: boolean;
+    refuseNonInteractiveMessage: string;
+  }) => Promise<string>;
+}
+
 /**
+ * Run the full `plugins publish` flow. This is the single entrypoint that
+ * the CLI command calls. All validation, git resolution, confirmation,
+ * and submission logic lives here rather than in the command file.
+ *
+ * Returns `true` on success, `false` on failure (with an appropriate
+ * message already printed).
+ */
+export async function runPublish(
+  opts: PublishCliOptions,
+  deps: PublishCliDeps,
+): Promise<boolean> {
+  // 1. Find the plugin root
+  const searchDir = opts.path ?? process.cwd();
+  const pluginDir = findPluginRoot(searchDir);
+  if (!pluginDir) {
+    if (opts.json) {
+      process.stdout.write(
+        JSON.stringify({
+          ok: false,
+          error: "no_package_json",
+          message: `No package.json found in ${searchDir} or any parent directory.`,
+        }) + "\n",
+      );
+    } else {
+      console.error(
+        `No package.json found in ${searchDir} or any parent directory.`,
+      );
+    }
+    return false;
+  }
+
+  // 2. Validate the plugin
+  const validation = validatePluginForPublish(pluginDir);
+  if (!validation.valid) {
+    if (opts.json) {
+      process.stdout.write(
+        JSON.stringify({ ok: false, errors: validation.issues }) + "\n",
+      );
+    } else {
+      console.error(formatValidationResult(validation));
+    }
+    return false;
+  }
+
+  if (!opts.json && validation.warnings.length > 0) {
+    console.warn(formatValidationResult(validation));
+  }
+
+  // 3. Handle --print mode early (no git context needed)
+  if (opts.print) {
+    // For --print, resolve git context best-effort to fill source fields
+    let git: GitContext | null = null;
+    try {
+      git = await resolveGitContext(pluginDir);
+    } catch {
+      // Git not available — use placeholder values
+    }
+
+    const category = opts.category ?? "other";
+    const payload = git
+      ? buildPublishPayload(validation, git, category)
+      : {
+          name: validation.packageJson.name!,
+          source: {
+            source: "github" as const,
+            repo: "<unknown>",
+            ref: "<unknown>",
+          },
+          category,
+          ...(validation.packageJson.description
+            ? { description: validation.packageJson.description }
+            : {}),
+          ...(validation.packageJson.license
+            ? { license: validation.packageJson.license }
+            : {}),
+          ...(validation.packageJson.homepage
+            ? { homepage: validation.packageJson.homepage }
+            : {}),
+        };
+
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ ok: true, payload }) + "\n");
+    } else {
+      console.log(formatPayloadForPrint(payload));
+    }
+    return true;
+  }
+
+  // 4. Resolve git context (required for submission)
+  let git: GitContext;
+  try {
+    git = await resolveGitContext(pluginDir);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      process.stdout.write(
+        JSON.stringify({
+          ok: false,
+          error: "git_resolution_failed",
+          message: `Git context resolution failed: ${message}`,
+        }) + "\n",
+      );
+    } else {
+      console.error(`Git context resolution failed: ${message}`);
+    }
+    return false;
+  }
+
+  if (git.dirty) {
+    console.warn(
+      "Warning: working tree is dirty. The pinned commit SHA should match a clean, pushed commit.",
+    );
+  }
+
+  if (!git.pushed) {
+    if (opts.json) {
+      process.stdout.write(
+        JSON.stringify({
+          ok: false,
+          error: "not_pushed",
+          message: `Commit ${git.sha.slice(0, 7)} has not been pushed to the remote. Push your changes first.`,
+        }) + "\n",
+      );
+    } else {
+      console.error(
+        `Commit ${git.sha.slice(0, 7)} has not been pushed to the remote. Push your changes first.`,
+      );
+    }
+    return false;
+  }
+
+  // 5. Determine category and build payload
+  const category = opts.category ?? "other";
+  const payload = buildPublishPayload(validation, git, category);
+
+  // 6. Confirm before submitting (unless --force or --json)
+  if (!opts.force && !opts.json) {
+    console.log("\nPlugin entry to submit:");
+    console.log(formatPayloadForPrint(payload));
+    console.log("");
+    const result = await deps.confirmPrompt({
+      question: "Submit this entry to the Vellum marketplace? [y/N] ",
+      isTTY: Boolean(process.stdin.isTTY),
+      refuseNonInteractiveMessage:
+        "Refusing to publish non-interactively. Pass --force to confirm.",
+    });
+    if (result === "non-interactive" || result === "denied") {
+      if (result === "non-interactive") {
+        console.error(
+          "Refusing to publish non-interactively. Pass --force to confirm.",
+        );
+      }
+      return false;
+    }
+  }
+
+  // 7. Submit to the platform API
+  const platformDeps = await resolvePlatformDeps();
+  if (!platformDeps) {
+    const msg =
+      "Not connected to Vellum platform. Run `assistant platform connect` to connect, or use --print to generate the entry without submitting.";
+    if (opts.json) {
+      process.stdout.write(
+        JSON.stringify({
+          ok: false,
+          error: "not_connected",
+          message: msg,
+        }) + "\n",
+      );
+    } else {
+      console.error(msg);
+    }
+    return false;
+  }
+
+  try {
+    const result = await postPublishRequest(payload, platformDeps);
+
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(result) + "\n");
+    } else {
+      console.log(formatPublishResult(result));
+    }
+
+    return result.ok;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      process.stdout.write(
+        JSON.stringify({
+          ok: false,
+          error: "request_failed",
+          message,
+        }) + "\n",
+      );
+    } else {
+      console.error(`Publish request failed: ${message}`);
+    }
+    return false;
+  }
+}/**
  * Format a publish result for terminal output.
  */
 export function formatPublishResult(result: PublishResult): string {

package/src/config/__tests__/sync-gated-profiles.test.ts

@@ -153,7 +153,6 @@ describe("reconcileFlagGatedProfiles", () => {
     const raw = readConfig();
     raw.llm.profiles["os-beta"]!.label = "My OS Beta";
     raw.llm.profiles["os-beta"]!.status = "disabled";
-    raw.llm.profiles["os-beta"]!.advisorEnabled = true;
     raw.llm.profiles["os-beta"]!.topP = 0.8;
     writeConfig(raw);
     invalidateConfigCache();
@@ -163,7 +162,6 @@ describe("reconcileFlagGatedProfiles", () => {
     const after = readConfig().llm.profiles["os-beta"]!;
     expect(after.label).toBe("My OS Beta");
     expect(after.status).toBe("disabled");
-    expect(after.advisorEnabled).toBe(true);
     expect(after.topP).toBe(0.8);
     expect(after.model).toBe("MiniMaxAI/MiniMax-M3");
     expect(after.provider_connection).toBe("together-managed");
@@ -324,7 +322,7 @@ describe("reconcileFlagGatedProfiles", () => {
 
     const raw = readConfig();
     (raw.llm as Record<string, unknown>).callSites = {
-      advisor: { profile: "os-beta", temperature: 0.3 },
+      inference: { profile: "os-beta", temperature: 0.3 },
     };
     writeConfig(raw);
     invalidateConfigCache();
@@ -333,14 +331,14 @@ describe("reconcileFlagGatedProfiles", () => {
     expect(reconcileFlagGatedProfiles()).toBe(true);
 
     const after = readConfig();
-    const advisor = (
+    const inference = (
       after.llm as unknown as Record<
         string,
         Record<string, Record<string, unknown>>
       >
-    ).callSites.advisor;
-    expect(advisor.profile).toBeUndefined();
-    expect(advisor.temperature).toBe(0.3);
+    ).callSites.inference;
+    expect(inference.profile).toBeUndefined();
+    expect(inference.temperature).toBe(0.3);
 
     expect(LLMSchema.safeParse(after.llm).success).toBe(true);
   });

package/src/config/bundled-skills/subagent/SKILL.md

@@ -40,9 +40,24 @@ Each subagent is spawned with a role that determines its tool access. Choose the
 | `coder` | `bash`, `file_read`, `file_write`, `file_edit`, `web_search`, `recall`, `notify_parent` | Code changes, file editing, running commands, build/test tasks |
 | `planner` | `file_read`, `file_list`, `web_search`, `web_fetch`, `recall`, `notify_parent` | Analysis, planning, synthesizing information, reviewing approaches |
 | `investigator` | `code_search`, `file_read`, `file_list`, `web_search`, `web_fetch`, `recall`, `notify_parent` | Root-cause analysis: debugging, log forensics, tracing behavior across many files. Read-only search/read tools only (no shell): use `code_search` to grep file contents across directories, `file_list` to enumerate paths, `file_read` to read whole files and logs; returns a compact root-cause report |
+| `advisor` | None (tool-less) | Read-only senior-advisor consult. Runs on a stronger model, inherits full parent context, and BLOCKS until it returns guidance |
 
 All specialized roles (`researcher`, `coder`, `planner`) include `notify_parent` for mid-run communication with the parent.
 
+## Consulting the Advisor
+
+The `advisor` role is the one role you spawn on your own judgment, unprompted — you do NOT wait for the user to ask for a subagent. The other roles (`researcher`, `coder`, `planner`, `investigator`, `general`) stay delegation-driven: reach for them to offload work, typically when the user's request calls for it. The advisor is different: proactively consult it whenever the conditions below are met.
+
+Orient yourself first (read the relevant files, understand the task), then consult the advisor:
+
+- **Before you commit to an approach and start building** — to shape a plan when you don't have one, or to pressure-test and sharpen a plan you've already drafted.
+- **When you get stuck or are weighing a change in direction.**
+- **Once before you declare the task done.**
+
+The consult is synchronous and read-only: spawning an `advisor` subagent BLOCKS until it returns guidance. It runs on a stronger model and inherits your full context, so it sees the task, your tool calls, and their results without you re-explaining. Give its guidance serious weight; only override it when primary-source evidence contradicts a specific claim — and say so when you do.
+
+Spawn the advisor **alone** — do NOT batch the consult in the same turn as other tool calls (especially file edits, shell commands, or anything destructive or expensive). Tool calls you issue in the same turn run concurrently with the consult, so they would execute before you see its guidance. Consult the advisor by itself, read its guidance, then act.
+
 ## Parent Communication
 
 Subagents use `notify_parent` to send messages to the parent conversation while still running. Each notification has an urgency level:
@@ -79,7 +94,7 @@ Set `inference_profile` to an `llm.profiles` key when a subagent should run unde
 
 Forks are sub-agents that inherit the parent's full context -- messages, system prompt, and memory -- sharing the KV cache for near-free context inheritance. Use forks when the task benefits from knowing what you've been discussing; use a regular sub-agent when the task is self-contained.
 
-**Key behaviors:** Forks always run as `general` role (the `role` parameter is ignored). `send_result_to_user` defaults to `false`. Read fork output with `last_n: 1` to get only the final synthesis.
+**Key behaviors:** Forks default to `general` role (the `role` parameter is ignored for forks), except the special `advisor` role, which is honored even as a fork. `send_result_to_user` defaults to `false`. Read fork output with `last_n: 1` to get only the final synthesis.
 
 **When to fork vs regular sub-agent:**
 

package/src/config/bundled-skills/subagent/TOOLS.json

@@ -3,7 +3,7 @@
   "tools": [
     {
       "name": "subagent_spawn",
-      "description": "Spawn an independent subagent to work on a task in parallel. The subagent runs autonomously and its results are reported back when complete.\n\nTwo modes:\n- **Regular sub-agent** (fork: false or omitted): Gets only the objective + context fields. Use for self-contained tasks with clear objectives. Can use scoped roles (researcher, coder, planner).\n- **Fork** (fork: true): Inherits full parent context (messages, system prompt, memory). Shares KV cache for near-free context inheritance. Use when the task benefits from knowing what you've been discussing. Always runs as general role. Results are internal by default (send_result_to_user: false). Read with last_n: 1 to get only the final synthesis.\n\nDecision heuristic: Does the task need to know what we've been talking about? Fork. Is it self-contained? Regular sub-agent.",
+      "description": "Spawn an independent subagent to work on a task in parallel. The subagent runs autonomously and its results are reported back when complete.\n\nTwo modes:\n- **Regular sub-agent** (fork: false or omitted): Gets only the objective + context fields. Use for self-contained tasks with clear objectives. Can use scoped roles (researcher, coder, planner).\n- **Fork** (fork: true): Inherits full parent context (messages, system prompt, memory). Shares KV cache for near-free context inheritance. Use when the task benefits from knowing what you've been discussing. Defaults to general role (the 'advisor' role is the exception — it is honored as a fork). Results are internal by default (send_result_to_user: false). Read with last_n: 1 to get only the final synthesis.\n\nDecision heuristic: Does the task need to know what we've been talking about? Fork. Is it self-contained? Regular sub-agent.\n\nThe 'advisor' role is a synchronous, read-only \"consult a stronger advisor\" mode: it inherits your full context, has no tools, and BLOCKS until it returns focused strategic guidance in a single response.",
       "category": "orchestration",
       "risk": "low",
       "input_schema": {
@@ -23,7 +23,7 @@
           },
           "fork": {
             "type": "boolean",
-            "description": "When true, the subagent inherits the parent's full context (messages, system prompt, memory) instead of receiving only the objective + context fields. Fork mode always runs as 'general' role (the role parameter is ignored) and defaults send_result_to_user to false. Use for tasks that benefit from the full conversational context."
+            "description": "When true, the subagent inherits the parent's full context (messages, system prompt, memory) instead of receiving only the objective + context fields. Fork mode defaults to 'general' role (the role parameter is ignored for forks), except the special 'advisor' role which is honored even as a fork, and defaults send_result_to_user to false. Use for tasks that benefit from the full conversational context."
           },
           "send_result_to_user": {
             "type": "boolean",
@@ -36,9 +36,10 @@
               "researcher",
               "coder",
               "planner",
-              "investigator"
+              "investigator",
+              "advisor"
             ],
-            "description": "Agent specialization that controls tool access. 'researcher': read-only (web, files, memory). 'coder': file and bash access. 'planner': read-only analysis. 'investigator': root-cause analysis — debugging, log forensics, tracing behavior across many files; uses read-only search/read tools (code_search, file_read, file_list) with no shell access and returns a compact root-cause report. 'general': full access (default). Ignored when fork: true (forks always use general)."
+            "description": "Agent specialization that controls tool access. 'researcher': read-only (web, files, memory). 'coder': file and bash access. 'planner': read-only analysis. 'investigator': root-cause analysis — debugging, log forensics, tracing behavior across many files; uses read-only search/read tools (code_search, file_read, file_list) with no shell access and returns a compact root-cause report. 'advisor': synchronous, read-only \"consult a stronger advisor\" — inherits full context, has no tools, and blocks until it returns focused strategic guidance. 'general': full access (default). Non-advisor roles are ignored when fork: true (forks default to general); the advisor role is honored even as a fork."
           },
           "inference_profile": {
             "type": "string",

package/src/config/call-site-defaults.ts

@@ -69,12 +69,6 @@ export const CALL_SITE_DEFAULTS: Record<LLMCallSite, CallSiteDefaultConfig> = {
   meetConsentMonitor: { profile: "cost-optimized" },
   meetChatOpportunity: { profile: "cost-optimized" },
   inference: { profile: "cost-optimized" },
-  // The advisor consults the strongest managed profile (`frontier`, Opus),
-  // which seeding writes into `llm.advisorProfile` on boot and floats above this
-  // layer. This static fallback — used only when no `advisorProfile` resolves —
-  // stays on the always-reserved `quality-optimized` so it can never resolve to
-  // a user-owned profile that happens to be named `frontier`.
-  advisor: { profile: "quality-optimized" },
   // Vision captioning for the image-fallback plugin. No pinned profile — the
   // plugin resolves a vision-capable profile itself via `doesSupportVision` and
   // passes it as an `overrideProfile`, so the call-site default is a fallback

package/src/config/llm-resolver.ts

@@ -497,9 +497,6 @@ function profileConfigFragment(profile: ProfileEntry): Mergeable {
     // lower-precedence (e.g. active) profile into one that merely inherited it.
     // `RetryProvider` resolves it from the applied profile, not the merge.
     logitBias: _logitBias,
-    // Per-profile advisor toggle is profile identity, not inheritable model
-    // config — strip it so it can't leak into the merged `LLMConfigBase`.
-    advisorEnabled: _advisorEnabled,
     // `temperature`/`top_p` are provider-coupled: only the winning profile
     // contributes them (tracked via `samplingRef`, applied post-merge), so a
     // shadowed profile's sampling can never reach a different provider through

package/src/config/schemas/call-site-catalog.ts

@@ -300,13 +300,6 @@ const CATALOG_RECORD: CatalogRecord = {
     description: "General-purpose LLM inference call site for skill use.",
     domain: "skills",
   },
-  advisor: {
-    id: "advisor",
-    displayName: "Advisor",
-    description:
-      "Stronger reviewer model consulted mid-task to shape or pressure-test the plan.",
-    domain: "skills",
-  },
   vision: {
     id: "vision",
     displayName: "Vision",

package/src/config/schemas/heartbeat.ts

@@ -5,10 +5,7 @@ export const HeartbeatConfigSchema = z
   .object({
     enabled: z
       .boolean({ error: "heartbeat.enabled must be a boolean" })
-      // Heartbeats are opt-in for new workspaces. Workspaces created while
-      // the default was true keep their behavior via workspace migration
-      // 102-preserve-heartbeat-enabled-for-existing-workspaces.
-      .default(false)
+      .default(true)
       .describe("Whether periodic heartbeat checks are enabled"),
     intervalMs: z
       .number({ error: "heartbeat.intervalMs must be a number" })
@@ -64,7 +61,7 @@ export const HeartbeatConfigSchema = z
       .int("heartbeat.maxDailyRuns must be an integer")
       .positive("heartbeat.maxDailyRuns must be a positive integer")
       .nullable()
-      .default(2)
+      .default(10)
       .describe(
         "Maximum heartbeats that can run per calendar day. Resets at midnight local time. Set to null for unlimited.",
       ),

package/src/config/schemas/llm.ts

@@ -79,7 +79,6 @@ export const LLMCallSiteEnum = z.enum([
   "meetConsentMonitor",
   "meetChatOpportunity",
   "inference",
-  "advisor",
   "vision",
   "trustRuleSuggestion",
   "homeGreeting",
@@ -442,13 +441,6 @@ export const ProfileEntry = LLMConfigFragment.extend({
    * #30362 even though the schema didn't accept it until now.
    */
   status: ProfileStatusSchema.nullable().optional(),
-  /**
-   * Whether the advisor is active while this profile is the chat profile.
-   * Absent/null means enabled (default on); only an explicit `false` disables
-   * it. `.nullable()` matches `status`/`label` so the PUT route's "send null
-   * to clear" sentinel resets it back to the default-on state.
-   */
-  advisorEnabled: z.boolean().nullable().optional(),
   /**
    * When present, this profile is a "mix": it carries no model config and
    * instead references a weighted list of standard profiles. The resolver
@@ -492,10 +484,9 @@ export const LLMSchema = z
     // schema level, so `LLMSchema.parse({})` yields an empty map.
     callSites: z.partialRecord(LLMCallSiteEnum, LLMCallSiteConfig).default({}),
     activeProfile: z.string().min(1).optional(),
-    // The profile the advisor consults (chosen under Models & Services). It is
-    // excluded from the chat-profile pickers so it can't be selected as the
-    // assistant's chat model. Absent falls back to the `advisor` call-site
-    // default (`quality-optimized`).
+    // The profile the advisor role consults when spawned as a subagent (chosen
+    // under Models & Services). It is excluded from the chat-profile pickers so
+    // it can't be selected as the assistant's chat model.
     advisorProfile: z.string().min(1).optional(),
     // TTL bounds for inference profile sessions. `defaultTtlSeconds` is read by
     // the CLI to apply when `--ttl` is omitted; the daemon handler itself only

package/src/config/schemas/memory-lifecycle.ts

@@ -84,7 +84,7 @@ export const MemoryWorkerConfigSchema = z
       .boolean({ error: "memory.worker.enabled must be a boolean" })
       .default(false)
       .describe(
-        "Whether the memory jobs worker runs as a separate OS process spawned at assistant startup (the `assistant memory worker` implementation) instead of on the assistant's main event loop. Only affects startup; shutdown stops whichever worker is actually running.",
+        "Whether the memory jobs worker runs as a separate OS process instead of the assistant's synchronous in-process runner. The assistant's worker supervisor re-reads this flag on every poll: while it is set, the in-process runner stands down (the out-of-process worker, spawned at startup when set, owns the queue); while it is unset, the in-process runner drains the queue. `assistant memory worker start`/`stop` flip the flag (and spawn/stop the worker process) to switch modes at runtime without a restart.",
       ),
   })
   .describe("Memory jobs worker process configuration");

package/src/config/seed-inference-profiles.ts

@@ -84,9 +84,6 @@ const MANAGED_PROFILE_TEMPLATES: Record<string, ManagedProfileTemplate> = {
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
-    // This is the advisor's own (strongest) profile: when it's also the chat
-    // profile there's nothing stronger to consult, so the advisor defaults off.
-    advisorEnabled: false,
   },
   // Served by DeepSeek V4 Flash on Fireworks via managed platform inference: a
   // fast, low-cost open model. `model` is pinned explicitly rather than
@@ -224,11 +221,9 @@ export type SeedInferenceProfilesOptions = {
  *    `cost-optimized`): reconciled from the code templates on every boot —
  *    on-platform and off-platform alike — so Vellum can push model/config
  *    updates to customers in a release without a workspace migration. The
- *    templates own all profile content; `label`, `status`, `advisorEnabled`,
- *    and `topP` are user overrides that survive reseeds. Of those, only
- *    `label`, `status`, and `topP` are editable through the managed PUT route
- *    allowlist; `advisorEnabled` is edited via the generic config path but is
- *    still preserved here so it survives reboots.
+ *    templates own all profile content; `label`, `status`, and `topP` are user
+ *    overrides that survive reseeds and are editable through the managed PUT
+ *    route allowlist.
  *    Platform overlays (`preserveProfileNames`) take precedence for the boot
  *    they are supplied.
  *
@@ -283,14 +278,11 @@ export function seedInferenceProfiles(
   //    as usual.
   //
   //    A whitelist of user-editable fields survives the reconcile: `label`
-  //    (display rename), `status` (active/disabled toggle), `advisorEnabled`
-  //    (per-profile advisor toggle), and `topP` (sampling override) — the only
-  //    fields a user may override. The managed PUT route
-  //    `/v1/config/llm/profiles/:name` lets users patch `label`, `status`, and
-  //    `topP` on managed profiles without duplicating (its editable allowlist,
-  //    `MANAGED_PROFILE_EDITABLE_KEYS`, deliberately excludes `advisorEnabled`,
-  //    which is set through the generic config path). We honor every one of
-  //    these overrides across reseeds or they'd silently revert on every boot.
+  //    (display rename), `status` (active/disabled toggle), and `topP`
+  //    (sampling override) — the only fields a user may override. The managed
+  //    PUT route `/v1/config/llm/profiles/:name` lets users patch these on
+  //    managed profiles without duplicating. We honor every one of these
+  //    overrides across reseeds or they'd silently revert on every boot.
   //    Carry by key-presence rather than truthiness so an explicit `null` (user
   //    cleared the field) survives too.
   //
@@ -362,12 +354,6 @@ export function seedInferenceProfiles(
             : previous.label;
       }
       if ("status" in previous) next.status = previous.status;
-      // The per-profile advisor toggle is a user override — preserve it across
-      // reseeds so a user's choice survives reboots (the template value only
-      // seeds the initial default, e.g. off for quality-optimized).
-      if ("advisorEnabled" in previous) {
-        next.advisorEnabled = previous.advisorEnabled;
-      }
       // `topP` is user-editable on managed profiles (see the managed-profile
       // editable allowlist on the PUT route) — preserve a user override across
       // reseeds, including an explicit `null` clear, or it would silently revert
@@ -440,19 +426,32 @@ export function seedInferenceProfiles(
     }
   }
 
-  // Advisor profile: default to the strongest managed profile when unset, so
-  // the advisor consults `frontier` (Anthropic Opus) out of the box, falling
-  // back to `quality-optimized` if `frontier` is unavailable. The `frontier`
-  // arm requires managed ownership: the seed loop above leaves a user-owned
-  // profile named `frontier` in place, and pointing the advisor at that would
-  // consult an arbitrary user model. Guarded on existence so it never names a
-  // missing profile (superRefine rejects that); off-platform/BYOK installs can
-  // repoint it at one of their own profiles.
-  if (readString(llm.advisorProfile) === undefined) {
-    if (readObject(profiles["frontier"])?.source === "managed") {
-      llm.advisorProfile = "frontier";
-    } else if (readObject(profiles["quality-optimized"]) !== null) {
-      llm.advisorProfile = "quality-optimized";
+  // Advisor profile: BYOK hatches default to the strongest personal profile
+  // backed by the entered provider key. Managed-profile hatches and registered
+  // platform installs default to the strongest active managed profile.
+  const requestedAdvisorProfile = readString(llm.advisorProfile);
+  const requestedAdvisorEntry =
+    requestedAdvisorProfile !== undefined
+      ? readObject(profiles[requestedAdvisorProfile])
+      : null;
+  const requestedAdvisorIsDisabledManaged =
+    requestedAdvisorEntry?.source === "managed" &&
+    requestedAdvisorEntry.status === "disabled";
+  const preferPersonalAdvisor =
+    userConnectionName !== undefined &&
+    hatchSelectedManagedConnection === undefined;
+  if (
+    requestedAdvisorProfile === undefined ||
+    requestedAdvisorIsDisabledManaged
+  ) {
+    const defaultAdvisorProfile = selectDefaultAdvisorProfile(
+      profiles,
+      preferPersonalAdvisor,
+    );
+    if (defaultAdvisorProfile) {
+      llm.advisorProfile = defaultAdvisorProfile;
+    } else if (requestedAdvisorIsDisabledManaged) {
+      delete llm.advisorProfile;
     }
   }
 
@@ -592,6 +591,48 @@ function readString(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
+function selectDefaultAdvisorProfile(
+  profiles: Record<string, Record<string, unknown>>,
+  preferPersonalProfile: boolean,
+): string | undefined {
+  const personal = firstActiveProfile(profiles, [
+    "custom-quality-optimized",
+    "custom-balanced",
+    "custom-cost-optimized",
+  ]);
+  const managed = firstActiveManagedProfile(profiles, [
+    "frontier",
+    "quality-optimized",
+    "balanced",
+    "cost-optimized",
+  ]);
+  return preferPersonalProfile ? (personal ?? managed) : (managed ?? personal);
+}
+
+function firstActiveProfile(
+  profiles: Record<string, Record<string, unknown>>,
+  names: string[],
+): string | undefined {
+  for (const name of names) {
+    const profile = readObject(profiles[name]);
+    if (profile && profile.status !== "disabled") return name;
+  }
+  return undefined;
+}
+
+function firstActiveManagedProfile(
+  profiles: Record<string, Record<string, unknown>>,
+  names: string[],
+): string | undefined {
+  for (const name of names) {
+    const profile = readObject(profiles[name]);
+    if (profile?.source === "managed" && profile.status !== "disabled") {
+      return name;
+    }
+  }
+  return undefined;
+}
+
 function getHatchSelectedManagedConnection(
   llm: Record<string, unknown>,
   profiles: Record<string, Record<string, unknown>>,

package/src/config/sync-gated-profiles.ts

@@ -117,9 +117,6 @@ function enableProfile(
     // Preserve user-owned overrides across reconciles.
     if ("label" in previous) next.label = previous.label;
     if ("status" in previous) next.status = previous.status;
-    if ("advisorEnabled" in previous) {
-      next.advisorEnabled = previous.advisorEnabled;
-    }
     if ("topP" in previous) next.topP = previous.topP;
   }