@vellumai/assistant 0.10.4-staging.1 → 0.10.4

package/src/util/process-tree.ts

@@ -0,0 +1,203 @@
+/**
+ * Native OS process-tree enumeration for the `ps` route.
+ *
+ * `listProcesses()` reads the live process table — preferring Linux `/proc`
+ * (no subprocess, always present in our containers) and falling back to the
+ * `ps` command on macOS / wherever `/proc` is unavailable. `buildProcessTree()`
+ * is a pure function that turns a flat `(pid, ppid, command)` list into the
+ * subtree rooted at a given PID, so the daemon can report every descendant
+ * process that is actually parented to it.
+ */
+
+import { execFile } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+export interface ProcInfo {
+  pid: number;
+  ppid: number;
+  /** Best-effort full command line (falls back to the executable name). */
+  command: string;
+}
+
+export interface ProcTreeNode {
+  pid: number;
+  /** Friendly process name derived from the command. */
+  name: string;
+  command: string;
+  children: ProcTreeNode[];
+}
+
+/** Interpreters whose script argument is more descriptive than argv[0]. */
+const RUNTIMES = new Set([
+  "bun",
+  "node",
+  "deno",
+  "python",
+  "python3",
+  "sh",
+  "bash",
+  "env",
+]);
+
+const basename = (p: string): string => p.split("/").pop() || p;
+
+/** Script extensions whose path we summarize as `<parent>-<file>`. */
+const SCRIPT_EXT_RE = /\.(ts|js|mjs|cjs|py)$/;
+
+/**
+ * Summarize a script path as `<parent-dir>-<filename-without-ext>` so the worker
+ * at `…/jobs/worker.ts` reads as `jobs-worker` and the daemon entry
+ * `…/daemon/main.ts` as `daemon-main`. Falls back to the bare extensionless
+ * filename when the script sits at the filesystem root.
+ */
+function scriptName(scriptPath: string): string {
+  const parts = scriptPath.split("/").filter(Boolean);
+  const file = parts[parts.length - 1].replace(SCRIPT_EXT_RE, "");
+  const parent = parts.length >= 2 ? parts[parts.length - 2] : "";
+  return parent ? `${parent}-${file}` : file;
+}
+
+/**
+ * Derive a readable name from a command line. For interpreter invocations
+ * (`bun run /…/jobs/worker.ts`) the script path is far more useful than the
+ * interpreter name, so prefer the first script-looking argument and summarize it
+ * as `<parent-dir>-<filename>` (e.g. `jobs-worker`). Plain binaries
+ * (`/…/vellum-qdrant`) keep their bare executable name.
+ */
+export function deriveName(command: string): string {
+  const tokens = command.trim().split(/\s+/).filter(Boolean);
+  if (tokens.length === 0) return "(unknown)";
+
+  const argv0 = basename(tokens[0]);
+  if (RUNTIMES.has(argv0)) {
+    const script = tokens.slice(1).find((t) => SCRIPT_EXT_RE.test(t));
+    if (script) return scriptName(script);
+  }
+  return argv0;
+}
+
+/**
+ * Parse a `/proc/<pid>/stat` line into its leading fields. `comm` (the
+ * executable name) may itself contain spaces and parentheses, so the fixed
+ * fields are read relative to the final `)` rather than by naive splitting.
+ * Returns null if the line is malformed.
+ */
+function parseProcStat(content: string): { comm: string; ppid: number } | null {
+  const lparen = content.indexOf("(");
+  const rparen = content.lastIndexOf(")");
+  if (lparen === -1 || rparen === -1 || rparen < lparen) return null;
+  const comm = content.slice(lparen + 1, rparen);
+  // After ")" come: " <state> <ppid> …" — split the remainder on spaces.
+  const rest = content.slice(rparen + 2).split(" ");
+  const ppid = Number(rest[1]);
+  if (!Number.isInteger(ppid)) return null;
+  return { comm, ppid };
+}
+
+/** Read the live process table from Linux `/proc`. Throws if `/proc` is absent. */
+function listProcessesFromProc(): ProcInfo[] {
+  const entries = readdirSync("/proc");
+  const procs: ProcInfo[] = [];
+  for (const entry of entries) {
+    const pid = Number(entry);
+    if (!Number.isInteger(pid) || pid <= 0) continue;
+
+    let ppid: number;
+    let comm: string;
+    try {
+      const parsed = parseProcStat(readFileSync(`/proc/${pid}/stat`, "utf8"));
+      if (!parsed) continue;
+      ({ ppid, comm } = parsed);
+    } catch {
+      // Process exited between readdir and read — skip.
+      continue;
+    }
+
+    // `/proc/<pid>/cmdline` is NUL-delimited and empty for kernel threads.
+    let command = comm;
+    try {
+      const raw = readFileSync(`/proc/${pid}/cmdline`, "utf8");
+      const joined = raw.split("\0").filter(Boolean).join(" ");
+      if (joined) command = joined;
+    } catch {
+      // Fall back to comm.
+    }
+
+    procs.push({ pid, ppid, command });
+  }
+  return procs;
+}
+
+/** Read the live process table via the `ps` command (macOS / no `/proc`). */
+async function listProcessesFromPs(): Promise<ProcInfo[]> {
+  const { stdout } = await execFileAsync(
+    "ps",
+    ["-A", "-o", "pid=,ppid=,command="],
+    { maxBuffer: 8 * 1024 * 1024 },
+  );
+
+  const procs: ProcInfo[] = [];
+  for (const line of stdout.split("\n")) {
+    const m = line.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);
+    if (!m) continue;
+    procs.push({
+      pid: Number(m[1]),
+      ppid: Number(m[2]),
+      command: m[3].trim(),
+    });
+  }
+  return procs;
+}
+
+/**
+ * Enumerate the live process table as `(pid, ppid, command)` rows. Prefers
+ * Linux `/proc`; falls back to `ps` when `/proc` is unavailable (e.g. macOS).
+ */
+export async function listProcesses(): Promise<ProcInfo[]> {
+  try {
+    return listProcessesFromProc();
+  } catch {
+    return listProcessesFromPs();
+  }
+}
+
+/**
+ * Build the process subtree rooted at `rootPid` from a flat process list.
+ * Children are ordered by PID. Self-references and already-visited PIDs are
+ * skipped so a malformed table cannot produce an infinite tree.
+ */
+export function buildProcessTree(
+  procs: ProcInfo[],
+  rootPid: number,
+): ProcTreeNode {
+  const byPid = new Map<number, ProcInfo>();
+  const childrenOf = new Map<number, number[]>();
+  for (const p of procs) {
+    byPid.set(p.pid, p);
+    const siblings = childrenOf.get(p.ppid);
+    if (siblings) siblings.push(p.pid);
+    else childrenOf.set(p.ppid, [p.pid]);
+  }
+
+  const visited = new Set<number>();
+  const build = (pid: number): ProcTreeNode => {
+    visited.add(pid);
+    const info = byPid.get(pid);
+    const command = info?.command ?? "";
+    const children = (childrenOf.get(pid) ?? [])
+      .filter((child) => child !== pid && !visited.has(child))
+      .sort((a, b) => a - b)
+      .map(build);
+    return {
+      pid,
+      name: info ? deriveName(command) : "assistant",
+      command,
+      children,
+    };
+  };
+
+  return build(rootPid);
+}

package/src/util/sqlite-retry.ts

@@ -0,0 +1,90 @@
+/**
+ * Retry helper for transient SQLite write contention.
+ *
+ * SQLite serializes writers at the database level: only one connection holds
+ * the write lock at a time. `PRAGMA busy_timeout` makes a contending writer
+ * *wait* for the lock, but it cannot rescue a statement that still loses the
+ * race (the wait elapses) or a transaction that begins as a reader and then
+ * fails to upgrade to a writer — both surface as `SQLITE_BUSY`. Transient disk
+ * errors surface as `SQLITE_IOERR`. The only correct recovery for either is to
+ * re-run the whole operation, so write paths that several processes contend on
+ * (the conversation loop, the scheduler, the memory worker) wrap their writes
+ * in {@link withSqliteRetry}.
+ *
+ * It retries on `SQLITE_BUSY*` / `SQLITE_IOERR*` with jittered backoff; the
+ * jitter decorrelates retries across the now-separate worker processes so they
+ * don't collide in lockstep. The wrapped function may be sync (a `bun:sqlite`
+ * statement) or async — it is always awaited, so the single async signature is
+ * the one boundary to port if the storage layer ever moves to an async driver.
+ *
+ * The wrapped function must be safe to re-run: either a single statement, or a
+ * sequence guarded so re-execution is idempotent (e.g. an optimistic-lock
+ * `WHERE` clause, or a full `db.transaction(...)` that rolls back atomically on
+ * failure). Do not wrap a partial sequence whose earlier statements already
+ * committed — a retry would double-apply them.
+ */
+
+import { getLogger } from "./logger.js";
+import { computeRetryDelay } from "./retry.js";
+
+const log = getLogger("sqlite-retry");
+
+const DEFAULT_MAX_RETRIES = 3;
+/** Base for the jittered backoff; busy_timeout absorbs the bulk of the wait. */
+const DEFAULT_BASE_DELAY_MS = 50;
+
+export interface SqliteRetryOptions {
+  /** Short identifier for the wrapped operation, used in retry logs. */
+  op: string;
+  /** Maximum retry attempts after the initial try (default 3). */
+  maxRetries?: number;
+  /** Base delay in ms for the jittered backoff (default 50). */
+  baseDelayMs?: number;
+  /** Extra structured fields to include in retry warnings (e.g. an id). */
+  context?: Record<string, unknown>;
+}
+
+function sqliteErrorCode(err: unknown): string {
+  return (err as { code?: string } | null)?.code ?? "";
+}
+
+/**
+ * Whether an error is a transient SQLite contention/IO error worth retrying.
+ * Matches the `SQLITE_BUSY` and `SQLITE_IOERR` families (including their
+ * extended-result-code suffixes like `SQLITE_BUSY_SNAPSHOT`).
+ */
+export function isRetryableSqliteError(err: unknown): boolean {
+  const code = sqliteErrorCode(err);
+  return code.startsWith("SQLITE_BUSY") || code.startsWith("SQLITE_IOERR");
+}
+
+/**
+ * Run a SQLite write (sync or async) with retry on transient contention.
+ */
+export async function withSqliteRetry<T>(
+  fn: () => T | Promise<T>,
+  options: SqliteRetryOptions,
+): Promise<T> {
+  const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
+  const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (attempt < maxRetries && isRetryableSqliteError(err)) {
+        log.warn(
+          {
+            ...options.context,
+            op: options.op,
+            attempt,
+            code: sqliteErrorCode(err),
+          },
+          "withSqliteRetry: transient SQLite error, retrying",
+        );
+        await Bun.sleep(computeRetryDelay(attempt, baseDelayMs));
+        continue;
+      }
+      throw err;
+    }
+  }
+}

package/src/watcher/__tests__/telemetry.test.ts

@@ -15,14 +15,14 @@ let recordImpl: (name: string) => void = (name) => {
   recordedEvents.push(name);
 };
 
-mock.module("../../memory/checkpoints.js", () => ({
+mock.module("../../persistence/checkpoints.js", () => ({
   getMemoryCheckpoint: (key: string) => checkpoints.get(key) ?? null,
   setMemoryCheckpoint: (key: string, value: string) => {
     checkpoints.set(key, value);
   },
 }));
 
-mock.module("../../memory/lifecycle-events-store.js", () => ({
+mock.module("../../persistence/lifecycle-events-store.js", () => ({
   recordLifecycleEvent: (name: string) => {
     recordImpl(name);
     return null;

package/src/watcher/telemetry.ts

@@ -22,8 +22,8 @@
 import {
   getMemoryCheckpoint,
   setMemoryCheckpoint,
-} from "../memory/checkpoints.js";
-import { recordLifecycleEvent } from "../memory/lifecycle-events-store.js";
+} from "../persistence/checkpoints.js";
+import { recordLifecycleEvent } from "../persistence/lifecycle-events-store.js";
 import { getLogger } from "../util/logger.js";
 import { listWatchers } from "./watcher-store.js";
 

package/src/watcher/watcher-store.ts

@@ -1,9 +1,9 @@
 import { and, asc, desc, eq, gte, lte } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
-import { getDb } from "../memory/db-connection.js";
-import { rawChanges } from "../memory/raw-query.js";
-import { watcherEvents, watchers } from "../memory/schema.js";
+import { getDb } from "../persistence/db-connection.js";
+import { rawChanges } from "../persistence/raw-query.js";
+import { watcherEvents, watchers } from "../persistence/schema/index.js";
 import { truncate } from "../util/truncate.js";
 import { DEFAULT_POLL_INTERVAL_MS } from "./constants.js";
 

package/src/work-items/work-item-store.ts

@@ -1,7 +1,7 @@
 import { asc, desc, eq } from "drizzle-orm";
 
-import { getDb } from "../memory/db-connection.js";
-import { workItems } from "../memory/schema.js";
+import { getDb } from "../persistence/db-connection.js";
+import { workItems } from "../persistence/schema/index.js";
 import { getTask } from "../tasks/task-store.js";
 
 // ── Types ────────────────────────────────────────────────────────────

package/src/workflows/engine-integration.test.ts

@@ -172,8 +172,8 @@ mock.module("../providers/provider-send-message.js", () => ({
 
 import { WorkflowsConfigSchema } from "../config/schemas/workflows.js";
 import type { TrustContext } from "../daemon/trust-context.js";
-import { getSqlite } from "../memory/db-connection.js";
-import { initializeDb } from "../memory/db-init.js";
+import { getSqlite } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
 import { registerTool } from "../tools/registry.js";
 import type { ToolContext, ToolExecutionResult } from "../tools/types.js";
 import { resolveCapabilities } from "./capabilities.js";

package/src/workflows/engine.test.ts

@@ -13,8 +13,8 @@ mock.module("../util/logger.js", () => ({
 
 import type { WorkflowsConfig } from "../config/schemas/workflows.js";
 import type { TrustContext } from "../daemon/trust-context.js";
-import { getSqlite } from "../memory/db-connection.js";
-import { initializeDb } from "../memory/db-init.js";
+import { getSqlite } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
 import type { ResolvedCapabilities } from "./capabilities.js";
 import {
   executeWorkflow,

package/src/workflows/fanout-load.test.ts

@@ -34,8 +34,8 @@ import { z } from "zod";
 
 import { getConfig } from "../config/loader.js";
 import type { TrustContext } from "../daemon/trust-context.js";
-import { initializeDb } from "../memory/db-init.js";
-import { listUsageEvents } from "../memory/llm-usage-store.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { listUsageEvents } from "../persistence/llm-usage-store.js";
 import { resolveCapabilities } from "./capabilities.js";
 import { executeWorkflow } from "./engine.js";
 import * as journalStore from "./journal-store.js";

package/src/workflows/journal-store.test.ts

@@ -8,9 +8,9 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-import { getDb, getSqlite } from "../memory/db-connection.js";
-import { initializeDb } from "../memory/db-init.js";
-import { migrateWorkflowRuns } from "../memory/migrations/284-workflow-runs.js";
+import { getDb, getSqlite } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { migrateWorkflowRuns } from "../persistence/migrations/284-workflow-runs.js";
 import {
   appendJournalEntry,
   createRun,

package/src/workflows/journal-store.ts

@@ -14,7 +14,7 @@
  * (the engine, a later PR) own gating.
  */
 
-import { rawAll, rawGet, rawRun } from "../memory/raw-query.js";
+import { rawAll, rawGet, rawRun } from "../persistence/raw-query.js";
 
 export type WorkflowRunStatus =
   | "running"

package/src/workflows/leaf-runner.test.ts

@@ -80,9 +80,12 @@ class MockConversationGraphMemory {
     disposeCalls += 1;
   }
 }
-mock.module("../memory/graph/conversation-graph-memory.js", () => ({
-  ConversationGraphMemory: MockConversationGraphMemory,
-}));
+mock.module(
+  "../plugins/defaults/memory/graph/conversation-graph-memory.js",
+  () => ({
+    ConversationGraphMemory: MockConversationGraphMemory,
+  }),
+);
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
   broadcastMessage: () => {},
@@ -143,9 +146,9 @@ mock.module("../providers/provider-send-message.js", () => ({
 // Module under test (after mocks).
 // ---------------------------------------------------------------------------
 
-import { getDb } from "../memory/db-connection.js";
-import { initializeDb } from "../memory/db-init.js";
-import { conversations } from "../memory/schema.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { conversations } from "../persistence/schema/index.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../tools/types.js";
 import { getWorkspaceDir } from "../util/platform.js";
 import { runLeaf, WorkflowUnknownProfileError } from "./leaf-runner.js";

package/src/workflows/leaf-runner.ts

@@ -48,7 +48,7 @@ import {
   isPersonalMemoryAllowed,
   type TrustContext,
 } from "../daemon/trust-context.js";
-import { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
+import { ConversationGraphMemory } from "../plugins/defaults/memory/graph/conversation-graph-memory.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import {
   extractToolUse,

package/src/workspace/heartbeat-service.ts

@@ -374,6 +374,35 @@ export class WorkspaceHeartbeatService {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Singleton
+// ---------------------------------------------------------------------------
+
+let instance: WorkspaceHeartbeatService | null = null;
+
+/** Construct and start the workspace heartbeat service singleton. */
+export function startWorkspaceHeartbeatService(): void {
+  instance = new WorkspaceHeartbeatService();
+  instance.start();
+}
+
+/**
+ * Stop the workspace heartbeat service singleton if one is running. The instance
+ * is retained so a final commitAllPendingWorkspaceChanges() during shutdown can
+ * still flush after the periodic loop has stopped.
+ */
+export async function stopWorkspaceHeartbeatService(): Promise<void> {
+  await instance?.stop();
+}
+
+/**
+ * Commit any uncommitted workspace changes via the singleton; no-op when the
+ * service was never started.
+ */
+export async function commitAllPendingWorkspaceChanges(): Promise<void> {
+  await instance?.commitAllPending();
+}
+
 /**
  * @internal Test-only: clear the dirty tracking state
  */

package/src/workspace/migrations/011-backfill-installation-id.ts

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import {
   deleteMemoryCheckpoint,
   getMemoryCheckpoint,
-} from "../../memory/checkpoints.js";
+} from "../../persistence/checkpoints.js";
 import { getExternalAssistantId } from "../../runtime/auth/external-assistant-id.js";
 import type { WorkspaceMigration } from "./types.js";
 

package/src/workspace/migrations/028-recover-conversations-from-disk-view.ts

@@ -16,8 +16,11 @@ import { join } from "node:path";
 
 import { eq } from "drizzle-orm";
 
-import { getDb } from "../../memory/db-connection.js";
-import { conversations, messages } from "../../memory/schema/conversations.js";
+import { getDb } from "../../persistence/db-connection.js";
+import {
+  conversations,
+  messages,
+} from "../../persistence/schema/conversations.js";
 import { getLogger } from "../../util/logger.js";
 import type { WorkspaceMigration } from "./types.js";
 

package/src/workspace/migrations/031-drop-user-md.ts

@@ -115,6 +115,30 @@ function isValidSlug(slug: string): boolean {
   return basename(slug) === slug && slug !== "." && slug !== "..";
 }
 
+/** Names of the columns present on a table, via `PRAGMA table_info`. */
+function tableColumns(db: Database, table: string): Set<string> {
+  const rows = db
+    .query<{ name: string }, []>(`PRAGMA table_info(${table})`)
+    .all();
+  return new Set(rows.map((r) => r.name));
+}
+
+/**
+ * The guardian read below depends on the legacy ACL columns
+ * `contacts.role` and `contact_channels.status` / `verified_at`. Guardian ACL
+ * is gateway-owned, so these columns may be absent from the assistant DB; this
+ * one-time cleanup is skipped when they are.
+ */
+function aclColumnsPresent(db: Database): boolean {
+  const contactCols = tableColumns(db, "contacts");
+  const channelCols = tableColumns(db, "contact_channels");
+  return (
+    contactCols.has("role") &&
+    channelCols.has("status") &&
+    channelCols.has("verified_at")
+  );
+}
+
 /**
  * Strip LIKE metacharacters so the prefix match runs literally. SQLite has
  * no default LIKE escape character, so strip rather than escape. Inlined
@@ -201,6 +225,8 @@ export const dropUserMdMigration: WorkspaceMigration = {
     }
 
     try {
+      if (!aclColumnsPresent(db)) return; // ACL columns dropped — cleanup is a no-op.
+
       // Resolve the guardian contact from the local DB. Prefer the
       // vellum-channel binding (the canonical native guardian); fall back to
       // whichever guardian has the most recently verified active channel.

package/src/workspace/migrations/041-backfill-google-gmail-settings-scope.ts

@@ -1,4 +1,4 @@
-import { rawGet, rawRun } from "../../memory/raw-query.js";
+import { rawGet, rawRun } from "../../persistence/raw-query.js";
 import type { WorkspaceMigration } from "./types.js";
 
 const GMAIL_SETTINGS_BASIC_SCOPE =

package/src/workspace/migrations/113-swap-balanced-profile-to-glm-5p2.ts

@@ -0,0 +1,101 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Bring an existing workspace's managed `balanced` profile in line with the
+// current code template: it now runs GLM 5.2 (Fireworks) at effort `high`,
+// taking over the model the managed `quality-optimized` profile used to serve.
+// The slot keeps its own `label` and `description`.
+//
+// A migration is needed even though the seeder reconciles managed-profile
+// content from the templates on every boot, because the seeder only consults a
+// template when it reseeds that profile. Off-platform installs reseed every
+// boot, but a platform workspace keeps the profile it was hatched with (the
+// seeder skips overlay-supplied profiles, and the overlay is consumed once). A
+// platform workspace whose `balanced` profile still resolves to Together
+// MiniMax M3 therefore relies on this migration to move it to GLM 5.2.
+//
+// Scope: only the managed `balanced` profile is rewritten. `balanced` is a
+// canonical name reserved since migration 052, which seeded it source-less, so
+// absent `source` means legacy managed — treat it as ours. An explicit
+// `source: "user"` (a profile the user took ownership of) or one whose model the
+// user retargeted to something other than the MiniMax/GLM defaults is left
+// untouched. The profile key stays `balanced`, so persisted `inference_profile`
+// pins on conversations/schedules keep resolving.
+//
+// Two on-disk states are reconciled:
+//   1. Still on Together MiniMax M3 (`OLD_MODEL`): swap to GLM 5.2 on Fireworks
+//      at effort `high`, and drop the seeded `topP`.
+//   2. Already on GLM 5.2 (`NEW_MODEL`): the boot seeder may have rewritten the
+//      model before this migration ran (it runs on every boot, even when DB
+//      init failure skips the migration runner) while preserving the old
+//      `topP: 0.95` by key-presence. Strip that stale seeded `topP` so the
+//      profile matches the new template, which carries no sampling override.
+//
+// In both cases only the seeded default `topP` (0.95) is dropped — a
+// user-customized `topP` (any other value) is preserved. Matching on the model
+// id keeps the migration idempotent and leaves a user-retargeted profile alone.
+
+const OLD_MODEL = "MiniMaxAI/MiniMax-M3";
+const NEW_MODEL = "accounts/fireworks/models/glm-5p2";
+const SEEDED_TOP_P = 0.95;
+
+export const swapBalancedProfileToGlm52Migration: WorkspaceMigration = {
+  id: "113-swap-balanced-profile-to-glm-5p2",
+  description: "Set the managed balanced profile to GLM 5.2 (Fireworks)",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) return;
+
+    const profiles = readObject(llm.profiles);
+    if (profiles === null) return;
+
+    const profile = readObject(profiles["balanced"]);
+    if (profile === null || profile.source === "user") return;
+
+    let changed = false;
+    if (profile.model === OLD_MODEL) {
+      profile.model = NEW_MODEL;
+      profile.provider = "fireworks";
+      profile.provider_connection = "fireworks-managed";
+      profile.effort = "high";
+      changed = true;
+    }
+    // Drop the stale seeded topP — whether we just swapped from MiniMax above or
+    // the boot seeder already rewrote the model to GLM (carrying topP by
+    // key-presence) before this migration had a chance to run.
+    if (profile.model === NEW_MODEL && profile.topP === SEEDED_TOP_P) {
+      delete profile.topP;
+      changed = true;
+    }
+    if (!changed) return;
+
+    profiles["balanced"] = profile;
+    llm.profiles = profiles;
+    config.llm = llm;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}