@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/util/think-tag-stream.ts

@@ -0,0 +1,95 @@
+/**
+ * Shared primitives for streaming think-tag scanning.
+ *
+ * Two consumers parse inline `<think>` spans out of streamed model content
+ * and must not drift apart (single source of truth):
+ *
+ * - `providers/openai/chat-completions-provider.ts` ROUTES the spans to
+ *   `thinking_delta` events (content preserved, case-sensitive `<think>`
+ *   only, matching the models that emit it).
+ * - `tts/reasoning-tag-filter.ts` DROPS the spans from the spoken stream
+ *   (case-insensitive, `<think>` and `<thinking>` variants).
+ *
+ * The state machines stay separate because they do different things with
+ * the reasoning; what they share is the tag scanning below. All scanning is
+ * positionally exact on the ORIGINAL string: case-insensitive mode folds
+ * A-Z per character code and never calls `toLowerCase()` on the haystack,
+ * because Unicode lowercasing can change string length (e.g. dotted capital
+ * I, U+0130, lowers to two code units) and shift every subsequent index.
+ * Tags must be given in lowercase ASCII.
+ */
+
+function foldedCharCode(code: number, caseInsensitive: boolean): number {
+  return caseInsensitive && code >= 65 && code <= 90 ? code + 32 : code;
+}
+
+function tagMatchesAt(
+  haystack: string,
+  start: number,
+  tag: string,
+  caseInsensitive: boolean,
+): boolean {
+  if (start + tag.length > haystack.length) {
+    return false;
+  }
+  for (let k = 0; k < tag.length; k += 1) {
+    if (
+      foldedCharCode(haystack.charCodeAt(start + k), caseInsensitive) !==
+      tag.charCodeAt(k)
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * First occurrence of any tag in `haystack`, by original-string index.
+ * When several tags match at the same index the longest wins, so
+ * `<thinking>` is not consumed as `<think>` plus stray text.
+ */
+export function indexOfTag(
+  haystack: string,
+  tags: readonly string[],
+  caseInsensitive: boolean,
+): { index: number; tag: string } | null {
+  for (let i = 0; i < haystack.length; i += 1) {
+    let bestTag: string | null = null;
+    for (const tag of tags) {
+      if (tagMatchesAt(haystack, i, tag, caseInsensitive)) {
+        if (bestTag === null || tag.length > bestTag.length) {
+          bestTag = tag;
+        }
+      }
+    }
+    if (bestTag !== null) {
+      return { index: i, tag: bestTag };
+    }
+  }
+  return null;
+}
+
+/**
+ * Length of the longest suffix of `text` that is a proper prefix of any
+ * listed tag. Streaming scanners hold that many characters back so a tag
+ * split across deltas is not emitted before it can be recognized.
+ */
+export function partialTagSuffix(
+  text: string,
+  tags: readonly string[],
+  caseInsensitive: boolean,
+): number {
+  const longest = Math.max(...tags.map((tag) => tag.length)) - 1;
+  for (let len = Math.min(text.length, longest); len > 0; len -= 1) {
+    const start = text.length - len;
+    for (const tag of tags) {
+      if (
+        len < tag.length &&
+        tagMatchesAt(text, start, tag.slice(0, len), caseInsensitive)
+      ) {
+        return len;
+      }
+    }
+  }
+  return 0;
+}

package/src/util/worker-process.ts

@@ -16,7 +16,7 @@ import {
   readFileSync,
   unlinkSync,
 } from "node:fs";
-import { dirname } from "node:path";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { getCurrentLogFilePath } from "./logger.js";
@@ -122,6 +122,37 @@ export interface SpawnWorkerProcessOptions {
   detached?: boolean;
 }
 
+export type PackagedWorkerEntry =
+  | "monitoring"
+  | "schedule"
+  | "memory"
+  | "routes"
+  | "db-integrity";
+
+interface WorkerCommandRuntime {
+  platform: NodeJS.Platform;
+  execPath: string;
+  executableExists: (path: string) => boolean;
+}
+
+export function resolveWorkerCommand(
+  entry: URL,
+  packagedEntry: PackagedWorkerEntry | undefined,
+  runtime: WorkerCommandRuntime = {
+    platform: process.platform,
+    execPath: process.execPath,
+    executableExists: existsSync,
+  },
+): string[] {
+  if (runtime.platform === "win32" && packagedEntry) {
+    const executable = join(dirname(runtime.execPath), "vellum-worker.exe");
+    if (runtime.executableExists(executable)) {
+      return [executable, packagedEntry];
+    }
+  }
+  return ["bun", "--smol", "run", fileURLToPath(entry)];
+}
+
 type WorkerReadyOutcome = "ready" | "exited" | "timeout";
 
 /**
@@ -178,6 +209,8 @@ export async function spawnWorkerProcess(args: {
   pidPath: string;
   /** Worker entry script, e.g. `new URL("./worker.ts", import.meta.url)`. */
   entry: URL;
+  /** Entry bundled into vellum-worker.exe for packaged Windows runtimes. */
+  packagedEntry?: PackagedWorkerEntry;
   /** Human-readable name used in spawn-failure messages, e.g. "Memory worker". */
   workerLabel: string;
   options?: SpawnWorkerProcessOptions;
@@ -208,15 +241,15 @@ export async function spawnWorkerProcess(args: {
     // output is at least visible to the spawning process.
   }
 
-  // Workers are latency-insensitive, so run them in bun's small-heap mode
-  // with a RAM-size hint sized to the container — see worker-memory.ts.
+  // Source workers use bun's small-heap mode. Packaged Windows workers use the
+  // compiled worker executable. Both receive the RAM hint from worker-memory.
   //
   // `fileURLToPath`, not `.pathname`: a URL's pathname is percent-encoded, so
   // an install path containing a space (every macOS desktop install lives
   // under "Application Support") would reach bun as "Application%20Support"
   // and the entry would not be found.
   const child = Bun.spawn({
-    cmd: ["bun", "--smol", "run", fileURLToPath(args.entry)],
+    cmd: resolveWorkerCommand(args.entry, args.packagedEntry),
     env: workerMemoryEnv(),
     stdio: ["ignore", "ignore", stderrFd],
     detached,

package/src/windows-compiled-cli.ts

@@ -0,0 +1,32 @@
+import { setBundledCliModules } from "./cli/bundled-modules.js";
+import * as pluginDiff from "./cli/lib/diff-plugin.js";
+import * as pluginInspect from "./cli/lib/inspect-plugin.js";
+import * as pluginInstallGitHub from "./cli/lib/install-from-github.js";
+import * as pluginInstallPlatform from "./cli/lib/install-from-platform.js";
+import * as pluginInstalled from "./cli/lib/list-installed-plugins.js";
+import * as pluginCatalogCache from "./cli/lib/plugin-catalog-cache.js";
+import * as pluginCatalogLocal from "./cli/lib/plugin-catalog-local.js";
+import * as pluginPinHistory from "./cli/lib/plugin-pin-history.js";
+import * as pluginSurfaces from "./cli/lib/plugin-surfaces.js";
+import * as pluginSearch from "./cli/lib/search-plugins.js";
+import * as pluginUninstall from "./cli/lib/uninstall-plugin.js";
+import * as pluginUpgrade from "./cli/lib/upgrade-plugin.js";
+import * as configEnv from "./config/env.js";
+import * as providerSecretCatalog from "./providers/provider-secret-catalog.js";
+
+setBundledCliModules({
+  configEnv,
+  providerSecretCatalog,
+  pluginCatalogCache,
+  pluginCatalogLocal,
+  pluginDiff,
+  pluginInspect,
+  pluginInstallGitHub,
+  pluginInstallPlatform,
+  pluginInstalled,
+  pluginPinHistory,
+  pluginSearch,
+  pluginSurfaces,
+  pluginUninstall,
+  pluginUpgrade,
+});

package/src/windows-compiled-entry.ts

@@ -0,0 +1,4 @@
+import "./windows-compiled-logger.js";
+import "./windows-compiled-cli.js";
+
+await import("./index.js");

package/src/windows-compiled-logger.ts

@@ -0,0 +1,6 @@
+import pino from "pino";
+import pinoPretty from "pino-pretty";
+
+import { setBundledLoggerModules } from "./util/logger.js";
+
+setBundledLoggerModules(pino, pinoPretty);

package/src/windows-compiled-worker-entry.ts

@@ -0,0 +1,29 @@
+import "./windows-compiled-logger.js";
+
+const worker = process.argv[2];
+
+switch (worker) {
+  case "monitoring":
+    await import("./monitoring/worker.js");
+    break;
+  case "schedule":
+    await import("./schedule/worker.js");
+    break;
+  case "memory":
+    await (
+      await import("./plugins/defaults/worker-entrypoints.js")
+    ).loadDefaultMemoryWorker();
+    break;
+  case "routes":
+    await import("./embedded/plugin-api.js");
+    await import("./routes/worker.js");
+    break;
+  case "db-integrity": {
+    const { runIntegrityCheck } =
+      await import("./monitoring/db-integrity-check.js");
+    console.log(JSON.stringify(runIntegrityCheck(process.argv[3] ?? "")));
+    break;
+  }
+  default:
+    throw new Error(`Unknown Windows worker entry: ${worker ?? "missing"}`);
+}

package/src/workspace/byok-default-profile-ensure.ts

@@ -18,6 +18,7 @@ import {
   type LLMProvider,
   type ProfileEntry,
 } from "../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
 import { getLogger } from "../util/logger.js";
 import { completedProfileBody } from "./custom-profile-ensure.js";
 
@@ -135,10 +136,26 @@ const ERA_COPY_LABEL_SUFFIX = " (Custom Provider)";
 /**
  * Comparison ignores `label` and `status` (user overlay state, preserved via
  * `userOverlayState`) and `model` (checked separately against the current
- * intent resolution and `HISTORICAL_INTENT_MODELS`).
+ * intent resolution and `HISTORICAL_INTENT_MODELS`). The CONVENTIONAL
+ * `<vendor>-personal` binding is normalized away before comparison (it was
+ * machinery-written across several eras); a non-conventional binding is a
+ * user selection and keeps blocking conversion.
  */
 const IGNORED_COMPARISON_KEYS = new Set(["label", "status", "model"]);
 
+/**
+ * Fold the conventional personal entry name back to its vendor. The entries
+ * collapse (migration 145) rewrites a hatch copy's binding into its
+ * provider as `<vendor>-personal`; the matcher folds that shape so every
+ * era of stored copy keeps converting (the same discipline as
+ * `HISTORICAL_INTENT_MODELS`).
+ */
+function foldPersonalEntryName(provider: string): string {
+  return provider.endsWith("-personal")
+    ? provider.slice(0, -"-personal".length)
+    : provider;
+}
+
 /**
  * Per-provider model ids that earlier intent eras pinned onto `custom-*`
  * copies, verified against `providers/model-intents.ts` git history. Hatch
@@ -146,9 +163,10 @@ const IGNORED_COMPARISON_KEYS = new Set(["label", "status", "model"]);
  * 2026-05-05, #29755), and the profile-model migrations (100, 103, 109, 113,
  * 123) deliberately rewrite only the managed default entries (`custom-*` is
  * the user's to manage), so an untouched copy still carries whichever value
- * its hatch-era intent resolved to. Migration 136 is the one exception: it
- * rewrote kimi-k2p5 pins (`custom-*` included) to deepseek-v4-flash in
- * place. A model listed here counts as unedited only when every non-model
+ * its hatch-era intent resolved to. Migrations 136 and 146 are the
+ * exceptions: they rewrite stale Fireworks pins (`custom-*` included) in
+ * place, so their targets are machinery-authored values too. A model listed
+ * here counts as unedited only when every non-model
  * field still matches the template.
  */
 const HISTORICAL_INTENT_MODELS: Record<
@@ -156,6 +174,10 @@ const HISTORICAL_INTENT_MODELS: Record<
   Partial<Record<string, readonly string[]>>
 > = {
   balanced: {
+    openai: [
+      // balanced intent 2026-05-05 (#29755) to the 2026-08-10 gpt-5.6 repoint.
+      "gpt-5.4-mini",
+    ],
     fireworks: [
       // balanced intent 2026-05-05 (#29755) to 2026-05-19 (#31068).
       "accounts/fireworks/models/kimi-k2p5",
@@ -163,9 +185,15 @@ const HISTORICAL_INTENT_MODELS: Record<
       "accounts/fireworks/models/kimi-k2p6",
       // migration 136's in-place rewrite of a kimi-k2p5 pin.
       "accounts/fireworks/models/deepseek-v4-flash",
+      // the ID migration 146 writes over stale deepseek-v4-flash pins.
+      "accounts/fireworks/models/deepseek-v4-flash-0731",
     ],
   },
   "quality-optimized": {
+    openai: [
+      // quality intent 2026-05-05 (#29755) to the 2026-08-10 gpt-5.6 repoint.
+      "gpt-5.4",
+    ],
     anthropic: [
       // quality intent 2026-05-05 (#29755) to 2026-06-11 (#34498).
       "claude-opus-4-7",
@@ -183,6 +211,8 @@ const HISTORICAL_INTENT_MODELS: Record<
       "accounts/fireworks/models/kimi-k2p5",
       // migration 136's in-place rewrite of a kimi-k2p5 pin.
       "accounts/fireworks/models/deepseek-v4-flash",
+      // the ID migration 146 writes over stale deepseek-v4-flash pins.
+      "accounts/fireworks/models/deepseek-v4-flash-0731",
     ],
   },
   "cost-optimized": {
@@ -196,10 +226,14 @@ const HISTORICAL_INTENT_MODELS: Record<
     ],
     fireworks: [
       // latency intent 2026-05-05 (#29755) to 2026-07-28 (#39446). On live
-      // configs migration 136 rewrote it to deepseek-v4-flash (the current
-      // intent), so this survives only in configs restored from pre-136
-      // backups.
+      // configs migration 136 rewrites it to deepseek-v4-flash, so this
+      // survives only in configs restored from pre-136 backups.
       "accounts/fireworks/models/kimi-k2p5",
+      // latency intent 2026-07-28 (#39446) to the 2026-08-17 dated-ID
+      // repoint; also the ID migration 136 writes. On live configs migration
+      // 146 rewrites it to the dated ID, so this survives only in pre-146
+      // backups.
+      "accounts/fireworks/models/deepseek-v4-flash",
     ],
   },
 };
@@ -259,11 +293,13 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
   const completionBase = LLMConfigBase.safeParse(llm.default ?? {}).data;
 
   // The default provider on a BYOK default, or the uniform hatch provider
-  // across the complete copy set on a vellum default; null converts nothing.
-  const candidateProvider =
-    parsedDefault.data.provider !== "vellum"
-      ? parsedDefault.data.provider
-      : uniformCopyProvider(profiles);
+  // across the complete copy set on a routing-identity default (vellum,
+  // chatgpt); null converts nothing.
+  const candidateProvider = ROUTING_IDENTITY_PROVIDERS.has(
+    parsedDefault.data.provider,
+  )
+    ? uniformCopyProvider(profiles)
+    : parsedDefault.data.provider;
   const convertibleProvider =
     candidateProvider !== null && isByokDefaultProviderChoice(candidateProvider)
       ? candidateProvider
@@ -339,7 +375,11 @@ function isKnownUneditedBody(
   // (hatch materialized it once; the default provider may have changed
   // since); equality with the corroborated provider rules out a user
   // re-provision.
-  if (convertibleProvider === null || entry.provider !== convertibleProvider) {
+  if (
+    convertibleProvider === null ||
+    typeof entry.provider !== "string" ||
+    foldPersonalEntryName(entry.provider) !== convertibleProvider
+  ) {
     return false;
   }
   const copyProvider = convertibleProvider;
@@ -347,11 +387,13 @@ function isKnownUneditedBody(
   if (template === undefined) {
     return false;
   }
-  const materialized = materializeProfile(
-    template,
-    copyProvider,
-    `${copyProvider}-personal`,
-  ) as Record<string, unknown>;
+  // No connection binding: the bare provider means the default entry of
+  // that kind, and a stamped binding would re-introduce the collapsed
+  // field on disk.
+  const materialized = materializeProfile(template, copyProvider) as Record<
+    string,
+    unknown
+  >;
   if (
     entry.model !== materialized.model &&
     !(HISTORICAL_INTENT_MODELS[key][copyProvider] ?? []).includes(entry.model)
@@ -361,11 +403,20 @@ function isKnownUneditedBody(
   // Completion skips managed-source bodies, so a copy from the era whose
   // templates wrote `source: "managed"` (#29755 to #29768, 2026-05-05) is
   // compared as if user-source to keep both sides normalized identically.
+  const normalizedEntry: Record<string, unknown> = {
+    ...entry,
+    provider: copyProvider,
+    ...(entry.source === "managed" ? { source: "user" } : {}),
+  };
+  // The conventional personal binding is machinery-written (hatch stamps,
+  // completion re-stamps); normalize it away. Any other binding is user
+  // state and stays in the comparison, where the unbound template side
+  // makes it block conversion.
+  if (normalizedEntry.provider_connection === `${copyProvider}-personal`) {
+    delete normalizedEntry.provider_connection;
+  }
   const body = comparableBody(
-    withCompletionBaked(
-      entry.source === "managed" ? { ...entry, source: "user" } : entry,
-      completionBase,
-    ),
+    withCompletionBaked(normalizedEntry, completionBase),
   );
   const known = comparableBody(
     withCompletionBaked(materialized, completionBase),
@@ -392,9 +443,10 @@ function uniformCopyProvider(profiles: Record<string, unknown>): string | null {
     if (typeof entry.provider !== "string") {
       return null;
     }
+    const entryProvider = foldPersonalEntryName(entry.provider);
     if (provider === null) {
-      provider = entry.provider;
-    } else if (provider !== entry.provider) {
+      provider = entryProvider;
+    } else if (provider !== entryProvider) {
       return null;
     }
   }

package/src/workspace/custom-profile-ensure.ts

@@ -3,7 +3,10 @@ import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 import { invalidateConfigCache } from "../config/loader.js";
-import { completeCustomProfile } from "../config/profile-materialization.js";
+import {
+  completeCustomProfile,
+  mergePreservingUnknownKeys,
+} from "../config/profile-materialization.js";
 import { LLMConfigBase, ProfileEntry } from "../config/schemas/llm.js";
 import { getLogger } from "../util/logger.js";
 
@@ -113,29 +116,6 @@ export function completedProfileBody(
   );
 }
 
-/**
- * `{...raw, ...completed}` recursively: completed (schema-known) values win,
- * raw keys the schema stripped survive at every depth. (Duplicated in the
- * write-path normalization in conversation-query-routes.ts — the two land in
- * independent PRs; consolidate when either next changes.)
- */
-function mergePreservingUnknownKeys(
-  raw: Record<string, unknown>,
-  completed: Record<string, unknown>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw, ...completed };
-  for (const [key, value] of Object.entries(completed)) {
-    const rawValue = raw[key];
-    if (readObject(value) !== null && readObject(rawValue) !== null) {
-      out[key] = mergePreservingUnknownKeys(
-        rawValue as Record<string, unknown>,
-        value as Record<string, unknown>,
-      );
-    }
-  }
-  return out;
-}
-
 function readObject(value: unknown): Record<string, unknown> | null {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return null;

package/src/workspace/migrations/142-consolidate-voice-front-door.ts

@@ -0,0 +1,70 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+const OLD_CALLSITE = "voiceFrontDecision";
+const PROGRESS_CALLSITE = "voiceProgressNarration";
+const RETIRED_ACK_KEYS = [
+  "ackFirstDeltaTimeoutMs",
+  "ackGenerationTimeoutMs",
+] as const;
+
+export const consolidateVoiceFrontDoorMigration: WorkspaceMigration = {
+  id: "142-consolidate-voice-front-door",
+  description:
+    "Rename the progress narration callsite and remove retired generated-ack tuning",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    let changed = false;
+    const llm = readObject(config.llm);
+    const callSites = readObject(llm?.callSites);
+    if (callSites && Object.hasOwn(callSites, OLD_CALLSITE)) {
+      if (!Object.hasOwn(callSites, PROGRESS_CALLSITE)) {
+        callSites[PROGRESS_CALLSITE] = callSites[OLD_CALLSITE];
+      }
+      delete callSites[OLD_CALLSITE];
+      changed = true;
+    }
+
+    const liveVoice = readObject(config.liveVoice);
+    const frontModel = readObject(liveVoice?.frontModel);
+    if (frontModel) {
+      for (const key of RETIRED_ACK_KEYS) {
+        if (Object.hasOwn(frontModel, key)) {
+          delete frontModel[key];
+          changed = true;
+        }
+      }
+    }
+
+    if (changed) {
+      writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    }
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/143-repair-deprecated-codex-model-id.ts

@@ -0,0 +1,134 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair the deprecated `gpt-5.3-codex` model ID on ChatGPT-subscription
+ * config fragments.
+ *
+ * OpenAI deprecated `gpt-5.3-codex` under ChatGPT sign-in (the Codex
+ * endpoint rejects it with HTTP 400), so it is being removed from
+ * `CODEX_SUBSCRIPTION_MODEL_IDS`. A workspace can still pin it on
+ * `provider: "chatgpt"` fragments (migration 133 wrote exactly that shape
+ * for `chatgpt-subscription` entries), and once the ID leaves the allowlist,
+ * `LLMSchema.superRefine` rejects such a fragment. The loader's leaf
+ * recovery then deletes the fragment's `model`, which still fails ("chatgpt"
+ * requires an explicit model), and per-section salvage resets the whole
+ * `llm` section, discarding the user's other LLM settings.
+ *
+ * Repair rewrites the model to `gpt-5.6-terra` (OpenAI's recommended
+ * everyday Codex model) on an exact `provider: "chatgpt"` + model match in
+ * `llm.default`, `llm.callSites.*`, and `llm.profiles.*`. A call-site
+ * fragment is also repaired when it pins the model with no provider of its
+ * own: at resolve time such a fragment overlays the winning profile, so the
+ * stale pin rides whatever provider and connection the winner supplies
+ * (including the subscription connection, which routes it to the Codex
+ * endpoint). Fragments with any other explicit provider are left untouched:
+ * the allowlist only gates the "chatgpt" routing identity, and a provider
+ * like `openai-compatible` may legitimately serve this id.
+ */
+export const repairDeprecatedCodexModelIdMigration: WorkspaceMigration = {
+  id: "143-repair-deprecated-codex-model-id",
+  description:
+    'Repair deprecated gpt-5.3-codex model ID on provider "chatgpt" fragments in workspace LLM config',
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    // Read outside the parse catch: a transient filesystem error (EIO,
+    // EACCES) must reach the runner so the migration retries, while
+    // malformed JSON is a permanent state this migration cannot repair.
+    const rawText = readFileSync(configPath, "utf-8");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(rawText);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default)) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed =
+          repairFragment(readObject(rawConfig), {
+            repairMissingProvider: true,
+          }) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile)) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    // Write-then-rename so an interrupted write cannot leave config.json
+    // truncated: a torn in-place write would parse as invalid JSON on the
+    // retry, which the catch above treats as "nothing to do", letting the
+    // runner checkpoint the migration as completed against a corrupt file.
+    const tmpPath = `${configPath}.migration-143.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+  },
+  // The exact-match rewrite is idempotent, so a transient failure (full
+  // disk, I/O error) is safe to retry on later startups.
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the deprecated model ID would fail schema
+    // validation once the allowlist no longer carries it.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const DEPRECATED_MODEL_ID = "gpt-5.3-codex";
+const REPLACEMENT_MODEL_ID = "gpt-5.6-terra";
+
+function repairFragment(
+  fragment: Record<string, unknown> | null,
+  options?: { repairMissingProvider?: boolean },
+): boolean {
+  if (fragment === null || fragment.model !== DEPRECATED_MODEL_ID) {
+    return false;
+  }
+  const providerRepairable =
+    fragment.provider === "chatgpt" ||
+    (options?.repairMissingProvider === true &&
+      fragment.provider === undefined);
+  if (!providerRepairable) {
+    return false;
+  }
+  fragment.model = REPLACEMENT_MODEL_ID;
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}