@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/providers/__tests__/dispatch-connection-routing.test.ts

@@ -65,6 +65,10 @@ const fakeConnections = new Map<string, Connection>();
 mock.module("../inference/connections.js", () => ({
   getConnection: (_db: unknown, name: string) =>
     fakeConnections.get(name) ?? null,
+  listConnections: (_db: unknown, filter?: { provider?: string }) =>
+    Array.from(fakeConnections.values()).filter(
+      (c) => !filter?.provider || c.provider === filter.provider,
+    ),
 }));
 
 mock.module("../registry.js", () => ({
@@ -449,11 +453,43 @@ describe("routing identities", () => {
       },
     } as never);
     expect(resolveProviderCalls[0]?.name).toBe("chatgpt-subscription");
-    // No override needed: the subscription row itself carries provider
-    // "openai", so the adapter resolves from the row.
+    // A pre-migration row carries provider "openai": no override needed, the
+    // adapter resolves from the row.
     expect(resolveProviderCalls[0]?.provider).toBe("openai");
   });
 
+  test("a chatgpt-identity subscription row dispatches with an openai override", async () => {
+    // Migration 366 stamps the row with the "chatgpt" identity; the identity
+    // must never reach adapter construction, so dispatch threads the openai
+    // upstream as providerOverride, mirroring the vellum sentinel.
+    fakeConnections.set("chatgpt-subscription", {
+      name: "chatgpt-subscription",
+      provider: "chatgpt",
+      auth: {
+        type: "oauth_subscription",
+        credential: "credential/chatgpt/access_token",
+      },
+    });
+    fakeProviders.set("conn:chatgpt-subscription", {
+      name: "openai",
+      tag: "subscription",
+    });
+
+    const provider = await tryResolveProviderForConnectionName(
+      "ignored",
+      { llm: {} } as never,
+      "chatgpt",
+      "gpt-5.5",
+    );
+
+    expect(provider?.routeAttribution).toEqual({
+      connectionName: "chatgpt-subscription",
+      isManagedRoute: false,
+    });
+    expect(resolveProviderCalls[0]?.name).toBe("chatgpt-subscription");
+    expect(resolveProviderOpts[0]?.providerOverride).toBe("openai");
+  });
+
   // A second managed row is creatable under any non-reserved name: only the
   // canonical name is refused at the create route, and `provider: "vellum"`
   // derives platform auth. Managed-ness is the row, never its name.
@@ -492,3 +528,179 @@ describe("routing identities", () => {
     ).rejects.toMatchObject({ reason: "not_found" });
   });
 });
+
+// ---------------------------------------------------------------------------
+// Entry-name providers — a profile provider naming a connection row directly.
+// Write surfaces reject these until the entries model enables them; dispatch
+// translates them so hand-edited configs (and the collapse migration later)
+// route through the named row.
+// ---------------------------------------------------------------------------
+
+describe("entry-name providers", () => {
+  beforeEach(() => {
+    resolveProviderCalls.length = 0;
+    resolveProviderOpts.length = 0;
+    fakeConnections.clear();
+    fakeProviders.clear();
+    setConfig("llm", {});
+  });
+
+  test("a profile naming an entry dispatches through that row", async () => {
+    registerConnection(
+      {
+        name: "anthropic-work",
+        provider: "anthropic",
+        auth: {
+          type: "api_key",
+          credential: "credential/anthropic-work/api_key",
+        },
+      },
+      { name: "anthropic", tag: "work-key" },
+    );
+    setLlmConfig({
+      profiles: {
+        work: { provider: "anthropic-work", model: "claude-opus-4-8" },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "work",
+    });
+
+    expect(result).not.toBeNull();
+    expect(resolveProviderCalls.length).toBe(1);
+    expect(resolveProviderCalls[0]?.name).toBe("anthropic-work");
+    // The label is not a vendor: the row's own provider drives dispatch,
+    // so no override is threaded.
+    expect(resolveProviderOpts[0]?.providerOverride).toBeUndefined();
+  });
+
+  test("a vellum-kind entry derives its upstream from the model", async () => {
+    registerConnection(
+      { name: "work-managed", provider: "vellum", auth: { type: "platform" } },
+      { name: "anthropic", tag: "managed-stub" },
+    );
+    setLlmConfig({
+      profiles: {
+        managed: { provider: "work-managed", model: "claude-opus-4-8" },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "managed",
+    });
+
+    expect(result).not.toBeNull();
+    expect(resolveProviderCalls[0]?.name).toBe("work-managed");
+    expect(resolveProviderOpts[0]?.providerOverride).toBe("anthropic");
+  });
+
+  test("an entry label alongside an explicit provider_connection still dispatches", async () => {
+    // The step-3 collapse migration rewrites provider to an entry name; a
+    // stale provider_connection left beside it must not fail the vendor
+    // equality against a label that is not a vendor.
+    registerConnection(
+      {
+        name: "anthropic-work",
+        provider: "anthropic",
+        auth: {
+          type: "api_key",
+          credential: "credential/anthropic-work/api_key",
+        },
+      },
+      { name: "anthropic", tag: "work-key" },
+    );
+    setLlmConfig({
+      profiles: {
+        work: {
+          provider: "anthropic-work",
+          provider_connection: "anthropic-work",
+          model: "claude-opus-4-8",
+        },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "work",
+    });
+
+    expect(result).not.toBeNull();
+    expect(resolveProviderCalls[0]?.name).toBe("anthropic-work");
+    expect(resolveProviderOpts[0]?.providerOverride).toBeUndefined();
+  });
+
+  test("a label with a conflicting provider_connection is held to the label's kind", async () => {
+    // The label's row kind threads as the expected vendor, so a stale or
+    // conflicting connection cannot silently dispatch a different vendor:
+    // the equality mismatch auto-recovers to a row matching the kind.
+    registerConnection(
+      {
+        name: "anthropic-work",
+        provider: "anthropic",
+        auth: {
+          type: "api_key",
+          credential: "credential/anthropic-work/api_key",
+        },
+      },
+      { name: "anthropic", tag: "work-key" },
+    );
+    registerConnection(
+      { name: "ollama-local", provider: "ollama", auth: { type: "none" } },
+      { name: "ollama", tag: "local" },
+    );
+    setLlmConfig({
+      profiles: {
+        conflicted: {
+          provider: "anthropic-work",
+          provider_connection: "ollama-local",
+          model: "claude-opus-4-8",
+        },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "conflicted",
+    });
+
+    expect(result).not.toBeNull();
+    expect(resolveProviderCalls[0]?.name).toBe("anthropic-work");
+  });
+
+  test("a profile naming no row is healed away at selection", async () => {
+    // Selection treats an unresolvable provider like an incomplete profile:
+    // the broken winner loses and the next rung's model AND transport apply
+    // together, restoring the pre-open-schema self-healing. The anchor is
+    // the managed default, so the heal lands on the vellum route.
+    registerConnection(
+      { name: "vellum", provider: "vellum", auth: { type: "platform" } },
+      { name: "anthropic", tag: "managed-anchor" },
+    );
+    setLlmConfig({
+      profiles: {
+        ghost: { provider: "no-such-entry", model: "claude-opus-4-8" },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "ghost",
+    });
+
+    expect(result).not.toBeNull();
+    expect(resolveProviderCalls[0]?.name).toBe("vellum");
+  });
+
+  test("healing hands off to the anchor, whose own failures stay loud", async () => {
+    // With the broken profile healed away, resolution rests on the managed
+    // anchor; its canonical row missing is a boot-seeding violation and
+    // throws explainably rather than masquerading as the ghost profile.
+    setLlmConfig({
+      profiles: {
+        ghost: { provider: "no-such-entry", model: "claude-opus-4-8" },
+      },
+    });
+
+    await expect(
+      getConfiguredProvider("mainAgent", { overrideProfile: "ghost" }),
+    ).rejects.toMatchObject({ reason: "not_found", connectionName: "vellum" });
+  });
+});

package/src/providers/__tests__/preflight-resolved-config.test.ts

@@ -220,6 +220,63 @@ describe("preflightResolvedConfig", () => {
     ).resolves.toBeUndefined();
   });
 
+  test("an explicit connection outranks an entry-name provider, matching dispatch", async () => {
+    // A healthy entry row must not mask the row the request actually uses.
+    connectionsByName["anthropic-work"] = {
+      name: "anthropic-work",
+      provider: "anthropic",
+      auth: {
+        type: "api_key",
+        credential: "credential/anthropic-work/api_key",
+      },
+    };
+    secureKeys["credential/anthropic-work/api_key"] = "healthy";
+
+    const err = await preflightError(
+      resolved({
+        provider: "anthropic-work",
+        provider_connection: "deleted-row",
+        model: "claude-opus-4-8",
+      }),
+    );
+    expect(err?.reason).toBe("not_found");
+    expect(err?.connectionName).toBe("deleted-row");
+  });
+
+  test("a chatgpt-identity subscription row preflights the same way", async () => {
+    // Migration 366 stamps the row with provider "chatgpt"; preflight judges
+    // its subscription credential, not a provider equality with the openai
+    // upstream.
+    connectionsByName["chatgpt-subscription"] = {
+      name: "chatgpt-subscription",
+      provider: "chatgpt",
+      auth: {
+        type: "oauth_subscription",
+        credential: "credential/chatgpt/access_token",
+      },
+    };
+    const missing = await preflightError(
+      resolved({
+        provider: "chatgpt",
+        provider_connection: "",
+        model: "gpt-5.5",
+      }),
+    );
+    expect(missing?.reason).toBe("missing_credential");
+
+    secureKeys["credential/chatgpt/access_token"] = "tok";
+    await expect(
+      preflightResolvedConfig(
+        resolved({
+          provider: "chatgpt",
+          provider_connection: "",
+          model: "gpt-5.5",
+        }),
+        {},
+      ),
+    ).resolves.toBeUndefined();
+  });
+
   test("a chatgpt identity with no subscription row throws not_found", async () => {
     const err = await preflightError(
       resolved({

package/src/providers/__tests__/retry-callsite.test.ts

@@ -337,7 +337,7 @@ describe("RetryProvider — callSite resolution", () => {
     expect(config.max_tokens).toBe(expected.maxTokens as number);
   });
 
-  test("live-voice front-door call sites reach OpenAI with reasoning off", async () => {
+  test("latency-sensitive live-voice call sites reach OpenAI with reasoning off", async () => {
     // The `latency-optimized` pin's whole value is time-to-first-token, and on
     // an OpenAI upstream that depends entirely on disabled thinking being
     // encoded as `effort: "none"`. OpenAI-compatible APIs reason by default
@@ -351,7 +351,10 @@ describe("RetryProvider — callSite resolution", () => {
     setLlmConfig({});
 
     const expected = CODE_DEFAULT_PROFILE_ENTRIES["latency-optimized"];
-    for (const callSite of ["voiceFrontDoor", "voiceFrontDecision"] as const) {
+    for (const callSite of [
+      "voiceFrontDoor",
+      "voiceProgressNarration",
+    ] as const) {
       let seen: SendMessageOptions | undefined;
       const wrapped = new RetryProvider(
         makeProvider("openai", (options) => {

package/src/providers/call-site-routing.ts

@@ -37,8 +37,13 @@ import {
   isConnectionCompatibleWithModel,
 } from "./connection-model-compat.js";
 import {
+  connectionProviderKind,
   ConnectionResolutionError,
+  dispatchProviderResolvable,
+  expectedVendorProvider,
   isManagedConnectionRoute,
+  resolveEntryConnectionName,
+  resolveEntryProviderKind,
   resolveRoutingIdentity,
   tryResolveProviderForConnectionName,
 } from "./connection-resolution.js";
@@ -112,7 +117,7 @@ export class CallSiteRoutingProvider implements Provider {
      */
     private readonly resolveByConnection: (
       connectionName: string,
-      expectedProvider: string,
+      expectedProvider: string | undefined,
       model: string | undefined,
     ) => Promise<Provider | null>,
     private readonly defaultRouteAttribution?: ProviderRouteAttribution,
@@ -203,9 +208,17 @@ export class CallSiteRoutingProvider implements Provider {
       forceOverrideProfile: options?.config?.forceOverrideProfile,
       selectionSeed: options?.config?.selectionSeed,
     });
+    // Capability follows the same row dispatch selects: an explicit
+    // provider_connection wins, then an entry-name label's row, then the
+    // resolved provider itself. Kept in this order so a label paired with a
+    // conflicting connection cannot enable a capability the dispatched
+    // transport lacks.
+    const routedKind = resolved.provider_connection
+      ? connectionProviderKind(resolved.provider_connection, resolved.model)
+      : resolveEntryProviderKind(resolved.provider, resolved.model);
     return shouldUseNativeWebSearch(
       getConfig(),
-      resolved.provider,
+      routedKind ?? resolved.provider,
       resolved.model,
     );
   }
@@ -256,6 +269,7 @@ export class CallSiteRoutingProvider implements Provider {
         overrideProfile,
         forceOverrideProfile,
         selectionSeed,
+        isResolvableProvider: dispatchProviderResolvable,
       },
     );
 
@@ -273,6 +287,16 @@ export class CallSiteRoutingProvider implements Provider {
       )?.connectionName;
     }
 
+    // An entry-name provider IS the connection name: the label points at a
+    // row, and the row's own provider drives dispatch, so no expected
+    // provider is threaded (the label is not a vendor).
+    const entryRoute = connectionName
+      ? null
+      : resolveEntryConnectionName(resolved.provider);
+    if (entryRoute) {
+      connectionName = entryRoute;
+    }
+
     // When no connection is set, auto-resolve one for the resolved provider —
     // including when the provider matches the default's name. The default
     // transport may ride the managed (platform-billed) connection, so reusing
@@ -301,9 +325,12 @@ export class CallSiteRoutingProvider implements Provider {
     }
 
     if (connectionName) {
+      // The vendor guard covers both the entry route and a config carrying
+      // an entry label alongside an explicit provider_connection: a label
+      // that is not a vendor never threads into the row-equality check.
       const connectionProvider = await this.resolveByConnection(
         connectionName,
-        resolved.provider,
+        expectedVendorProvider(resolved.provider, resolved.model),
         resolved.model,
       );
       if (connectionProvider) {

package/src/providers/connection-resolution.ts

@@ -32,6 +32,7 @@ import {
   resolveCallSiteConfig,
   selectWinningProfile,
 } from "../config/llm-resolver.js";
+import { unknownLlmProviderIssue } from "../config/schemas/llm.js";
 import { getDb } from "../persistence/db-connection.js";
 import { credentialKey } from "../security/credential-key.js";
 import { ProviderNotConfiguredError } from "../util/errors.js";
@@ -40,6 +41,7 @@ import {
   describeSubscriptionModelIncompatibility,
   isConnectionCompatibleWithModel,
 } from "./connection-model-compat.js";
+import { VALID_CONNECTION_PROVIDERS } from "./inference/auth.js";
 import {
   canonicalVellumConnection,
   getConnection,
@@ -55,6 +57,7 @@ import {
 } from "./routing-identity.js";
 import type { Provider } from "./types.js";
 import {
+  getManagedUpstream,
   isVellumManagedConnection,
   MANAGED_ROUTABLE_PROVIDERS,
   VELLUM_MANAGED_CONNECTION_NAME,
@@ -64,6 +67,132 @@ export { ConnectionResolutionError, resolveRoutingIdentity };
 
 const log = getLogger("providers/connection-resolution");
 
+/**
+ * Resolve a provider label that names a connection row (an entry) to that
+ * row's name. Returns null for catalog providers and routing identities
+ * (those translate through their own rules) and for labels naming no row.
+ *
+ * The write surfaces reject entry-name providers until the entries model
+ * enables them, so a config carrying one reaches dispatch only through a
+ * hand edit today and through the collapse migration later; translating
+ * here makes both route explainably instead of failing as an unknown
+ * provider.
+ */
+export function resolveEntryConnectionName(
+  provider: string | undefined,
+): string | null {
+  if (!provider || VALID_CONNECTION_PROVIDERS.includes(provider)) {
+    return null;
+  }
+  try {
+    return getConnection(getDb(), provider) ? provider : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write-surface membership for a PROFILE provider value: the known vendor
+ * and identity set, plus existing connection entry rows. Fail-closed on DB
+ * unavailability (an unverifiable entry name is rejected; the write is
+ * retryable), unlike the selection-time predicate below, which is
+ * fail-open so a DB blip never heals away a valid profile. Call-site
+ * fragments keep vendor-only membership: overrides become model-only with
+ * the entries demolition, so entries must not leak into them meanwhile.
+ */
+export function writableProfileProviderIssue(provider: string): string | null {
+  const issue = unknownLlmProviderIssue(provider);
+  if (issue === null) {
+    return null;
+  }
+  try {
+    if (getConnection(getDb(), provider) != null) {
+      return null;
+    }
+  } catch {
+    // Unverifiable: fall through to the rejection.
+  }
+  return `Invalid provider "${provider}". Use a known provider or the name of an existing connection.`;
+}
+
+/**
+ * Selection-time predicate for `ResolveCallSiteOpts.isResolvableProvider`:
+ * a provider value dispatches when it is a known vendor/identity or names a
+ * connection entry row. Permissive on DB unavailability so a transient blip
+ * never heals away a valid entry profile; dispatch soft-fails on its own.
+ */
+export function dispatchProviderResolvable(provider: string): boolean {
+  if (VALID_CONNECTION_PROVIDERS.includes(provider)) {
+    return true;
+  }
+  try {
+    return getConnection(getDb(), provider) != null;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * The vendor a resolved provider value expects its connection row to serve:
+ * catalog ids and routing identities pass through, and an entry-name label
+ * resolves to its row's dispatchable kind, so a config carrying both an
+ * entry label and a `provider_connection` is held to the label's kind by
+ * the row-equality check (a conflicting row mismatches explainably or
+ * auto-recovers to a matching one). A label naming no row yields undefined.
+ */
+export function expectedVendorProvider(
+  provider: string | undefined,
+  model: string | undefined,
+): string | undefined {
+  if (!provider) {
+    return undefined;
+  }
+  if (VALID_CONNECTION_PROVIDERS.includes(provider)) {
+    return provider;
+  }
+  return resolveEntryProviderKind(provider, model) ?? undefined;
+}
+
+/**
+ * The dispatchable provider kind behind a connection row, or null when the
+ * row is missing or its kind cannot be derived. Identity-kind rows derive
+ * their upstream the way the identities themselves do. Sync and
+ * best-effort so capability probes can share dispatch's translation
+ * without replaying its async resolution.
+ */
+export function connectionProviderKind(
+  connectionName: string,
+  model: string | undefined,
+): string | null {
+  try {
+    const row = getConnection(getDb(), connectionName);
+    if (!row) {
+      return null;
+    }
+    if (isVellumManagedConnection(row)) {
+      return model ? getManagedUpstream(model) : null;
+    }
+    if (row.provider === "chatgpt") {
+      return "openai";
+    }
+    return row.provider;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The dispatchable provider kind behind an entry-name label, or null when
+ * the label is not an entry.
+ */
+export function resolveEntryProviderKind(
+  provider: string | undefined,
+  model: string | undefined,
+): string | null {
+  const entryName = resolveEntryConnectionName(provider);
+  return entryName ? connectionProviderKind(entryName, model) : null;
+}
+
 /**
  * Resolve a Provider through a named `provider_connection`.
  *
@@ -152,18 +281,36 @@ export async function tryResolveProviderForConnectionName(
   // fall back to the default provider.
   const isVellum = isVellumManagedConnection(connection);
   if (isVellum && !expectedProvider) {
-    throw new ConnectionResolutionError(
-      connectionName,
-      "provider_mismatch",
-      `provider_connection "${connectionName}" is the provider-agnostic Vellum-managed connection but the resolving profile declared no provider — set the profile's provider so the upstream can be selected`,
-    );
+    // An entry-name route carries no declared provider (the label is the
+    // row's name, not a vendor); a vellum-kind row derives its upstream
+    // from the model, same as the vellum identity itself.
+    expectedProvider = model
+      ? (getManagedUpstream(model) ?? undefined)
+      : undefined;
+    if (!expectedProvider) {
+      throw new ConnectionResolutionError(
+        connectionName,
+        "provider_mismatch",
+        `provider_connection "${connectionName}" is the provider-agnostic Vellum-managed connection but the resolving profile declared no provider — set the profile's provider so the upstream can be selected`,
+      );
+    }
   }
   const isVellumRoute =
     isVellum &&
     !!expectedProvider &&
     MANAGED_ROUTABLE_PROVIDERS.has(expectedProvider);
+  // The ChatGPT-subscription row stores the "chatgpt" routing identity in
+  // its provider column, so the equality never holds for its openai
+  // upstream. The identity dispatches with the upstream threaded as
+  // `providerOverride`, mirroring the vellum sentinel; the upstream is
+  // always openai (`resolveRoutingIdentity`). Any other declared provider
+  // on a chatgpt row is a genuine mismatch and falls through below.
+  const isChatgptRoute =
+    connection.provider === "chatgpt" &&
+    (expectedProvider === undefined || expectedProvider === "openai");
   if (
     !isVellumRoute &&
+    !isChatgptRoute &&
     expectedProvider &&
     connection.provider !== expectedProvider
   ) {
@@ -225,7 +372,11 @@ export async function tryResolveProviderForConnectionName(
   try {
     const provider = await resolveProviderFromConnection(connection, config, {
       model,
-      providerOverride: isVellumRoute ? expectedProvider : undefined,
+      providerOverride: isVellumRoute
+        ? expectedProvider
+        : isChatgptRoute
+          ? "openai"
+          : undefined,
     });
     return attachProviderRoute(provider, connection);
   } catch (err) {
@@ -324,7 +475,9 @@ async function resolveThroughPlatform(
 export async function resolveDefaultProvider(
   config: ProvidersConfig,
 ): Promise<Provider | null> {
-  const resolved = resolveCallSiteConfig("mainAgent", config.llm);
+  const resolved = resolveCallSiteConfig("mainAgent", config.llm, {
+    isResolvableProvider: dispatchProviderResolvable,
+  });
   let connectionName = resolved.provider_connection;
   // A routing-identity provider names its own connection row; the
   // provider-keyed auto-resolve scan below cannot find it ("chatgpt" rows
@@ -335,6 +488,19 @@ export async function resolveDefaultProvider(
       resolved.model,
     )?.connectionName;
   }
+  // An entry-name provider IS the connection name: the label points at a
+  // row, and the row's own provider drives dispatch.
+  const entryName = connectionName
+    ? null
+    : resolveEntryConnectionName(resolved.provider);
+  if (entryName) {
+    return tryResolveProviderForConnectionName(
+      entryName,
+      config,
+      undefined,
+      resolved.model,
+    );
+  }
   if (!connectionName) {
     // The merged config has no provider_connection — the profile likely set
     // provider without a connection ("Any active" selection), and the merge
@@ -387,7 +553,7 @@ export async function resolveDefaultProvider(
   return tryResolveProviderForConnectionName(
     connectionName,
     config,
-    resolved.provider,
+    expectedVendorProvider(resolved.provider, resolved.model),
     resolved.model,
   );
 }
@@ -423,9 +589,21 @@ export async function preflightResolvedConfig(
   // upstream; an unroutable vellum model throws here — it is statically
   // detectable, exactly what preflight exists to surface.
   const identity = resolveRoutingIdentity(resolved.provider, resolved.model);
-  const provider = identity?.expectedProvider ?? resolved.provider;
+  // An entry-name provider IS the connection name, and the row's kind is
+  // what the checks below judge against (same translation dispatch uses).
+  // Precedence matches dispatch exactly: an explicit provider_connection
+  // wins over the entry name, so preflight judges the row the request
+  // actually uses rather than a healthy entry the request ignores.
+  const entryName = identity
+    ? null
+    : resolveEntryConnectionName(resolved.provider);
+  const provider = identity
+    ? identity.expectedProvider
+    : entryName
+      ? (connectionProviderKind(entryName, resolved.model) ?? resolved.provider)
+      : resolved.provider;
   const connectionName =
-    identity?.connectionName ?? resolved.provider_connection;
+    identity?.connectionName ?? resolved.provider_connection ?? entryName;
   if (!connectionName) {
     return;
   }
@@ -512,7 +690,12 @@ export async function preflightResolvedConfig(
     }
     return;
   }
-  if (connection.provider !== provider) {
+  // The ChatGPT-subscription row stores the "chatgpt" identity while its
+  // upstream is openai; the credential-presence switch below is the right
+  // preflight for it (the subscription token is its credential).
+  const isChatgptRow =
+    connection.provider === "chatgpt" && provider === "openai";
+  if (!isChatgptRow && connection.provider !== provider) {
     throw new ConnectionResolutionError(
       connectionName,
       "provider_mismatch",