@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/providers/call-site-routing.ts

@@ -37,8 +37,13 @@ import {
   isConnectionCompatibleWithModel,
 } from "./connection-model-compat.js";
 import {
+  connectionProviderKind,
   ConnectionResolutionError,
+  dispatchProviderResolvable,
+  expectedVendorProvider,
   isManagedConnectionRoute,
+  resolveEntryConnectionName,
+  resolveEntryProviderKind,
   resolveRoutingIdentity,
   tryResolveProviderForConnectionName,
 } from "./connection-resolution.js";
@@ -112,7 +117,7 @@ export class CallSiteRoutingProvider implements Provider {
      */
     private readonly resolveByConnection: (
       connectionName: string,
-      expectedProvider: string,
+      expectedProvider: string | undefined,
       model: string | undefined,
     ) => Promise<Provider | null>,
     private readonly defaultRouteAttribution?: ProviderRouteAttribution,
@@ -203,9 +208,17 @@ export class CallSiteRoutingProvider implements Provider {
       forceOverrideProfile: options?.config?.forceOverrideProfile,
       selectionSeed: options?.config?.selectionSeed,
     });
+    // Capability follows the same row dispatch selects: an explicit
+    // provider_connection wins, then an entry-name label's row, then the
+    // resolved provider itself. Kept in this order so a label paired with a
+    // conflicting connection cannot enable a capability the dispatched
+    // transport lacks.
+    const routedKind = resolved.provider_connection
+      ? connectionProviderKind(resolved.provider_connection, resolved.model)
+      : resolveEntryProviderKind(resolved.provider, resolved.model);
     return shouldUseNativeWebSearch(
       getConfig(),
-      resolved.provider,
+      routedKind ?? resolved.provider,
       resolved.model,
     );
   }
@@ -256,6 +269,7 @@ export class CallSiteRoutingProvider implements Provider {
         overrideProfile,
         forceOverrideProfile,
         selectionSeed,
+        isResolvableProvider: dispatchProviderResolvable,
       },
     );
 
@@ -273,6 +287,16 @@ export class CallSiteRoutingProvider implements Provider {
       )?.connectionName;
     }
 
+    // An entry-name provider IS the connection name: the label points at a
+    // row, and the row's own provider drives dispatch, so no expected
+    // provider is threaded (the label is not a vendor).
+    const entryRoute = connectionName
+      ? null
+      : resolveEntryConnectionName(resolved.provider);
+    if (entryRoute) {
+      connectionName = entryRoute;
+    }
+
     // When no connection is set, auto-resolve one for the resolved provider —
     // including when the provider matches the default's name. The default
     // transport may ride the managed (platform-billed) connection, so reusing
@@ -301,9 +325,12 @@ export class CallSiteRoutingProvider implements Provider {
     }
 
     if (connectionName) {
+      // The vendor guard covers both the entry route and a config carrying
+      // an entry label alongside an explicit provider_connection: a label
+      // that is not a vendor never threads into the row-equality check.
       const connectionProvider = await this.resolveByConnection(
         connectionName,
-        resolved.provider,
+        expectedVendorProvider(resolved.provider, resolved.model),
         resolved.model,
       );
       if (connectionProvider) {

package/src/providers/connection-resolution.ts

@@ -32,6 +32,7 @@ import {
   resolveCallSiteConfig,
   selectWinningProfile,
 } from "../config/llm-resolver.js";
+import { unknownLlmProviderIssue } from "../config/schemas/llm.js";
 import { getDb } from "../persistence/db-connection.js";
 import { credentialKey } from "../security/credential-key.js";
 import { ProviderNotConfiguredError } from "../util/errors.js";
@@ -40,6 +41,7 @@ import {
   describeSubscriptionModelIncompatibility,
   isConnectionCompatibleWithModel,
 } from "./connection-model-compat.js";
+import { VALID_CONNECTION_PROVIDERS } from "./inference/auth.js";
 import {
   canonicalVellumConnection,
   getConnection,
@@ -55,6 +57,7 @@ import {
 } from "./routing-identity.js";
 import type { Provider } from "./types.js";
 import {
+  getManagedUpstream,
   isVellumManagedConnection,
   MANAGED_ROUTABLE_PROVIDERS,
   VELLUM_MANAGED_CONNECTION_NAME,
@@ -64,6 +67,132 @@ export { ConnectionResolutionError, resolveRoutingIdentity };
 
 const log = getLogger("providers/connection-resolution");
 
+/**
+ * Resolve a provider label that names a connection row (an entry) to that
+ * row's name. Returns null for catalog providers and routing identities
+ * (those translate through their own rules) and for labels naming no row.
+ *
+ * The write surfaces reject entry-name providers until the entries model
+ * enables them, so a config carrying one reaches dispatch only through a
+ * hand edit today and through the collapse migration later; translating
+ * here makes both route explainably instead of failing as an unknown
+ * provider.
+ */
+export function resolveEntryConnectionName(
+  provider: string | undefined,
+): string | null {
+  if (!provider || VALID_CONNECTION_PROVIDERS.includes(provider)) {
+    return null;
+  }
+  try {
+    return getConnection(getDb(), provider) ? provider : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write-surface membership for a PROFILE provider value: the known vendor
+ * and identity set, plus existing connection entry rows. Fail-closed on DB
+ * unavailability (an unverifiable entry name is rejected; the write is
+ * retryable), unlike the selection-time predicate below, which is
+ * fail-open so a DB blip never heals away a valid profile. Call-site
+ * fragments keep vendor-only membership: overrides become model-only with
+ * the entries demolition, so entries must not leak into them meanwhile.
+ */
+export function writableProfileProviderIssue(provider: string): string | null {
+  const issue = unknownLlmProviderIssue(provider);
+  if (issue === null) {
+    return null;
+  }
+  try {
+    if (getConnection(getDb(), provider) != null) {
+      return null;
+    }
+  } catch {
+    // Unverifiable: fall through to the rejection.
+  }
+  return `Invalid provider "${provider}". Use a known provider or the name of an existing connection.`;
+}
+
+/**
+ * Selection-time predicate for `ResolveCallSiteOpts.isResolvableProvider`:
+ * a provider value dispatches when it is a known vendor/identity or names a
+ * connection entry row. Permissive on DB unavailability so a transient blip
+ * never heals away a valid entry profile; dispatch soft-fails on its own.
+ */
+export function dispatchProviderResolvable(provider: string): boolean {
+  if (VALID_CONNECTION_PROVIDERS.includes(provider)) {
+    return true;
+  }
+  try {
+    return getConnection(getDb(), provider) != null;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * The vendor a resolved provider value expects its connection row to serve:
+ * catalog ids and routing identities pass through, and an entry-name label
+ * resolves to its row's dispatchable kind, so a config carrying both an
+ * entry label and a `provider_connection` is held to the label's kind by
+ * the row-equality check (a conflicting row mismatches explainably or
+ * auto-recovers to a matching one). A label naming no row yields undefined.
+ */
+export function expectedVendorProvider(
+  provider: string | undefined,
+  model: string | undefined,
+): string | undefined {
+  if (!provider) {
+    return undefined;
+  }
+  if (VALID_CONNECTION_PROVIDERS.includes(provider)) {
+    return provider;
+  }
+  return resolveEntryProviderKind(provider, model) ?? undefined;
+}
+
+/**
+ * The dispatchable provider kind behind a connection row, or null when the
+ * row is missing or its kind cannot be derived. Identity-kind rows derive
+ * their upstream the way the identities themselves do. Sync and
+ * best-effort so capability probes can share dispatch's translation
+ * without replaying its async resolution.
+ */
+export function connectionProviderKind(
+  connectionName: string,
+  model: string | undefined,
+): string | null {
+  try {
+    const row = getConnection(getDb(), connectionName);
+    if (!row) {
+      return null;
+    }
+    if (isVellumManagedConnection(row)) {
+      return model ? getManagedUpstream(model) : null;
+    }
+    if (row.provider === "chatgpt") {
+      return "openai";
+    }
+    return row.provider;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The dispatchable provider kind behind an entry-name label, or null when
+ * the label is not an entry.
+ */
+export function resolveEntryProviderKind(
+  provider: string | undefined,
+  model: string | undefined,
+): string | null {
+  const entryName = resolveEntryConnectionName(provider);
+  return entryName ? connectionProviderKind(entryName, model) : null;
+}
+
 /**
  * Resolve a Provider through a named `provider_connection`.
  *
@@ -152,18 +281,36 @@ export async function tryResolveProviderForConnectionName(
   // fall back to the default provider.
   const isVellum = isVellumManagedConnection(connection);
   if (isVellum && !expectedProvider) {
-    throw new ConnectionResolutionError(
-      connectionName,
-      "provider_mismatch",
-      `provider_connection "${connectionName}" is the provider-agnostic Vellum-managed connection but the resolving profile declared no provider — set the profile's provider so the upstream can be selected`,
-    );
+    // An entry-name route carries no declared provider (the label is the
+    // row's name, not a vendor); a vellum-kind row derives its upstream
+    // from the model, same as the vellum identity itself.
+    expectedProvider = model
+      ? (getManagedUpstream(model) ?? undefined)
+      : undefined;
+    if (!expectedProvider) {
+      throw new ConnectionResolutionError(
+        connectionName,
+        "provider_mismatch",
+        `provider_connection "${connectionName}" is the provider-agnostic Vellum-managed connection but the resolving profile declared no provider — set the profile's provider so the upstream can be selected`,
+      );
+    }
   }
   const isVellumRoute =
     isVellum &&
     !!expectedProvider &&
     MANAGED_ROUTABLE_PROVIDERS.has(expectedProvider);
+  // The ChatGPT-subscription row stores the "chatgpt" routing identity in
+  // its provider column, so the equality never holds for its openai
+  // upstream. The identity dispatches with the upstream threaded as
+  // `providerOverride`, mirroring the vellum sentinel; the upstream is
+  // always openai (`resolveRoutingIdentity`). Any other declared provider
+  // on a chatgpt row is a genuine mismatch and falls through below.
+  const isChatgptRoute =
+    connection.provider === "chatgpt" &&
+    (expectedProvider === undefined || expectedProvider === "openai");
   if (
     !isVellumRoute &&
+    !isChatgptRoute &&
     expectedProvider &&
     connection.provider !== expectedProvider
   ) {
@@ -225,7 +372,11 @@ export async function tryResolveProviderForConnectionName(
   try {
     const provider = await resolveProviderFromConnection(connection, config, {
       model,
-      providerOverride: isVellumRoute ? expectedProvider : undefined,
+      providerOverride: isVellumRoute
+        ? expectedProvider
+        : isChatgptRoute
+          ? "openai"
+          : undefined,
     });
     return attachProviderRoute(provider, connection);
   } catch (err) {
@@ -324,7 +475,9 @@ async function resolveThroughPlatform(
 export async function resolveDefaultProvider(
   config: ProvidersConfig,
 ): Promise<Provider | null> {
-  const resolved = resolveCallSiteConfig("mainAgent", config.llm);
+  const resolved = resolveCallSiteConfig("mainAgent", config.llm, {
+    isResolvableProvider: dispatchProviderResolvable,
+  });
   let connectionName = resolved.provider_connection;
   // A routing-identity provider names its own connection row; the
   // provider-keyed auto-resolve scan below cannot find it ("chatgpt" rows
@@ -335,6 +488,19 @@ export async function resolveDefaultProvider(
       resolved.model,
     )?.connectionName;
   }
+  // An entry-name provider IS the connection name: the label points at a
+  // row, and the row's own provider drives dispatch.
+  const entryName = connectionName
+    ? null
+    : resolveEntryConnectionName(resolved.provider);
+  if (entryName) {
+    return tryResolveProviderForConnectionName(
+      entryName,
+      config,
+      undefined,
+      resolved.model,
+    );
+  }
   if (!connectionName) {
     // The merged config has no provider_connection — the profile likely set
     // provider without a connection ("Any active" selection), and the merge
@@ -387,7 +553,7 @@ export async function resolveDefaultProvider(
   return tryResolveProviderForConnectionName(
     connectionName,
     config,
-    resolved.provider,
+    expectedVendorProvider(resolved.provider, resolved.model),
     resolved.model,
   );
 }
@@ -423,9 +589,21 @@ export async function preflightResolvedConfig(
   // upstream; an unroutable vellum model throws here — it is statically
   // detectable, exactly what preflight exists to surface.
   const identity = resolveRoutingIdentity(resolved.provider, resolved.model);
-  const provider = identity?.expectedProvider ?? resolved.provider;
+  // An entry-name provider IS the connection name, and the row's kind is
+  // what the checks below judge against (same translation dispatch uses).
+  // Precedence matches dispatch exactly: an explicit provider_connection
+  // wins over the entry name, so preflight judges the row the request
+  // actually uses rather than a healthy entry the request ignores.
+  const entryName = identity
+    ? null
+    : resolveEntryConnectionName(resolved.provider);
+  const provider = identity
+    ? identity.expectedProvider
+    : entryName
+      ? (connectionProviderKind(entryName, resolved.model) ?? resolved.provider)
+      : resolved.provider;
   const connectionName =
-    identity?.connectionName ?? resolved.provider_connection;
+    identity?.connectionName ?? resolved.provider_connection ?? entryName;
   if (!connectionName) {
     return;
   }
@@ -512,7 +690,12 @@ export async function preflightResolvedConfig(
     }
     return;
   }
-  if (connection.provider !== provider) {
+  // The ChatGPT-subscription row stores the "chatgpt" identity while its
+  // upstream is openai; the credential-presence switch below is the right
+  // preflight for it (the subscription token is its credential).
+  const isChatgptRow =
+    connection.provider === "chatgpt" && provider === "openai";
+  if (!isChatgptRow && connection.provider !== provider) {
     throw new ConnectionResolutionError(
       connectionName,
       "provider_mismatch",

package/src/providers/inference/__tests__/adapter-factory-openai-compatible.test.ts

@@ -43,6 +43,10 @@ describe("adapter factory", () => {
       useNativeWebSearch: false,
     });
     expect(adapter).toBeInstanceOf(OpenAIChatCompletionsProvider);
+    expect(
+      (adapter as unknown as { omitToolChoiceWhenReasoning: boolean })
+        .omitToolChoiceWhenReasoning,
+    ).toBe(true);
   });
 
   test("createAdapterFromConnection wires baseURL from ResolvedAuth", () => {

package/src/providers/inference/adapter-factory.ts

@@ -139,6 +139,9 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       providerName: "openai-compatible",
       providerLabel: "OpenAI-compatible",
       streamTimeoutMs,
+      // Custom OpenAI-compatible endpoints may front strict reasoning
+      // models (DeepSeek thinking) that 400 on any explicit tool_choice.
+      omitToolChoiceWhenReasoning: true,
       ...(baseURL ? { baseURL } : {}),
     }),
   minimax: ({ apiKey, model, streamTimeoutMs }) =>

package/src/providers/inference/auth.ts

@@ -126,6 +126,12 @@ export const VALID_CONNECTION_PROVIDERS: readonly string[] = [
   // persisted `vellum` rows — the routing threaded in via `providerOverride`
   // never runs on a row that fails to load.
   VELLUM_MANAGED_PROVIDER,
+  // The ChatGPT-subscription row stores the "chatgpt" routing identity in its
+  // `provider` column for the same reason: the row IS the subscription route
+  // (auth modality = provider identity), and dispatch derives the openai
+  // upstream per-request. Allowlisted explicitly or the DB loaders would drop
+  // the persisted row.
+  "chatgpt",
 ];
 
 export type ConnectionProvider = string;

package/src/providers/inference/connection-availability.ts

@@ -23,6 +23,10 @@ import {
   describeSubscriptionModelIncompatibility,
   isConnectionCompatibleWithModel,
 } from "../connection-model-compat.js";
+import {
+  connectionProviderKind,
+  resolveEntryConnectionName,
+} from "../connection-resolution.js";
 import { PROVIDER_CATALOG } from "../model-catalog.js";
 import { resolveManagedProxyContext } from "../platform-proxy/context.js";
 import {
@@ -161,7 +165,12 @@ export async function computeConnectionAvailability(
   if (resolvedConnectionName === VELLUM_MANAGED_CONNECTION_NAME) {
     return vellumConnectionAvailability();
   }
-  if (connection.provider !== provider) {
+  // The ChatGPT-subscription row stores the "chatgpt" identity while its
+  // upstream is openai; the credential switch below is the right check for
+  // it (the subscription token is its credential).
+  const isChatgptRow =
+    connection.provider === "chatgpt" && provider === "openai";
+  if (!isChatgptRow && connection.provider !== provider) {
     return {
       status: "provider_mismatch",
       message: `Connection "${resolvedConnectionName}" is for provider "${connection.provider}", but the requested provider is "${provider}". Pick a connection for "${provider}" ${SETTINGS_HINT}.`,
@@ -326,9 +335,22 @@ export async function computeProfileAvailability(
     }
   }
 
+  // Precedence matches dispatch: an explicit provider_connection wins over
+  // an entry-name provider, and the vendor judged is the entry's
+  // dispatchable kind either way (the same translation dispatch uses).
+  const entryName = resolveEntryConnectionName(provider);
+  const entryKind =
+    entryName !== null
+      ? (connectionProviderKind(entryName, model) ?? provider)
+      : provider;
+
   const pinned = entry.provider_connection;
   if (typeof pinned === "string") {
-    return computeConnectionAvailability(provider, pinned);
+    return computeConnectionAvailability(entryKind, pinned);
+  }
+
+  if (entryName !== null) {
+    return computeConnectionAvailability(entryKind, entryName);
   }
 
   // Mirror the dispatch-time auto-resolve (`resolveConfiguredProvider`): with

package/src/providers/inference/connections.ts

@@ -348,10 +348,12 @@ export function updateConnection(
     connection: {
       ...existing,
       auth,
+      provider: nextProvider,
       label: input.label !== undefined ? input.label : existing.label,
       baseUrl: nextBaseUrl,
       models: nextModels,
       updatedAt: now,
+      isManaged: isManagedRow({ name, provider: nextProvider, auth }),
     },
   };
 }

package/src/providers/model-catalog.ts

@@ -939,7 +939,7 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
         pricing: { inputPer1mTokens: 1.74, outputPer1mTokens: 3.48 },
       },
       {
-        id: "accounts/fireworks/models/deepseek-v4-flash",
+        id: "accounts/fireworks/models/deepseek-v4-flash-0731",
         displayName: "DeepSeek V4 Flash",
         contextWindowTokens: 1040000,
         maxOutputTokens: 131072,
@@ -951,11 +951,11 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
         pricing: {
           inputPer1mTokens: 0.14,
           outputPer1mTokens: 0.28,
-          cacheReadPer1mTokens: 0.03,
+          cacheReadPer1mTokens: 0.028,
         },
       },
     ],
-    defaultModel: "accounts/fireworks/models/deepseek-v4-flash",
+    defaultModel: "accounts/fireworks/models/deepseek-v4-flash-0731",
     apiKeyUrl: "https://fireworks.ai/account/api-keys",
     apiKeyPlaceholder: "fw_...",
   },

package/src/providers/model-intents.ts

@@ -1,4 +1,5 @@
 import { isModelInCatalog, PROVIDER_CATALOG } from "./model-catalog.js";
+import { isCodexSubscriptionModel } from "./openai/codex-models.js";
 import type { ModelIntent } from "./types.js";
 
 /**
@@ -10,8 +11,10 @@ const PROVIDER_DEFAULT_MODELS: Record<string, string> = Object.fromEntries(
 );
 
 // `cost-optimized` is the cheapest model a provider serves, `latency-optimized`
-// the fastest to first token. On anthropic, ollama and fireworks the same model
-// is both, so those columns repeat by construction rather than by oversight.
+// the fastest to first token. On anthropic, ollama, fireworks and openai the
+// same model is both, so those columns repeat by construction rather than by
+// oversight (openai's balanced repeats it too: the default-profile templates
+// split those tiers by reasoning effort, not model).
 const PROVIDER_MODEL_INTENTS: Record<string, Record<ModelIntent, string>> = {
   anthropic: {
     balanced: "claude-sonnet-4-6",
@@ -21,11 +24,11 @@ const PROVIDER_MODEL_INTENTS: Record<string, Record<ModelIntent, string>> = {
     "vision-optimized": "claude-opus-4-6",
   },
   openai: {
-    balanced: "gpt-5.4-mini",
-    "cost-optimized": "gpt-5.4-nano",
+    balanced: "gpt-5.6-luna",
+    "cost-optimized": "gpt-5.6-luna",
     "latency-optimized": "gpt-5.6-luna",
-    "quality-optimized": "gpt-5.4",
-    "vision-optimized": "gpt-5.4",
+    "quality-optimized": "gpt-5.6-sol",
+    "vision-optimized": "gpt-5.6-terra",
   },
   gemini: {
     balanced: "gemini-3-flash-preview",
@@ -43,8 +46,8 @@ const PROVIDER_MODEL_INTENTS: Record<string, Record<ModelIntent, string>> = {
   },
   fireworks: {
     balanced: "accounts/fireworks/models/minimax-m3",
-    "cost-optimized": "accounts/fireworks/models/deepseek-v4-flash",
-    "latency-optimized": "accounts/fireworks/models/deepseek-v4-flash",
+    "cost-optimized": "accounts/fireworks/models/deepseek-v4-flash-0731",
+    "latency-optimized": "accounts/fireworks/models/deepseek-v4-flash-0731",
     "quality-optimized": "accounts/fireworks/models/kimi-k2p6",
     "vision-optimized": "accounts/fireworks/models/kimi-k2p6",
   },
@@ -89,6 +92,23 @@ for (const [provider, intents] of Object.entries(PROVIDER_MODEL_INTENTS)) {
   }
 }
 
+// The openai column must additionally stay inside the ChatGPT Codex
+// subscription set: the subscription default provider is stored as
+// `llm.defaultProvider = { provider: "openai", connectionName:
+// "chatgpt-subscription" }`, so the materialized default profiles resolve
+// through this column while pinning the subscription connection, which
+// bypasses the auto-resolution compat gate and hard-routes to the Codex
+// endpoint, where a non-Codex model 400s on every request.
+for (const [intent, modelId] of Object.entries(PROVIDER_MODEL_INTENTS.openai)) {
+  if (!isCodexSubscriptionModel(modelId)) {
+    throw new Error(
+      `PROVIDER_MODEL_INTENTS[openai][${intent}] references model "${modelId}" ` +
+        `which the ChatGPT subscription cannot serve. Pick a model from ` +
+        `CODEX_SUBSCRIPTION_MODEL_IDS in openai/codex-models.ts.`,
+    );
+  }
+}
+
 export function isModelIntent(value: unknown): value is ModelIntent {
   return typeof value === "string" && MODEL_INTENTS.has(value as ModelIntent);
 }