@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -21,6 +21,7 @@ import { getDb } from "../../persistence/db-connection.js";
 import {
   type Auth,
   AuthSchema,
+  CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
   type ConnectionModel,
   ConnectionModelSchema,
   ConnectionProviderSchema,
@@ -205,14 +206,26 @@ function deriveConnectionAuth(provider: string, credential: unknown): Auth {
 function assertAuthMatchesProvider(provider: string, auth: Auth): void {
   const managedAuth = auth.type === "platform";
   const managedProvider = provider === VELLUM_MANAGED_PROVIDER;
-  if (managedAuth === managedProvider) {
-    return;
+  if (managedAuth !== managedProvider) {
+    throw new BadRequestError(
+      managedAuth
+        ? `Auth type "platform" is only valid for provider "${VELLUM_MANAGED_PROVIDER}", not "${provider}". Vellum-managed routing is selected by the provider, so omit "auth" to derive it.`
+        : `Provider "${VELLUM_MANAGED_PROVIDER}" is always platform-authenticated; "${auth.type}" auth is not valid for it. Omit "auth" to derive it, or name a real provider for key-based auth.`,
+    );
+  }
+  // Same rule for the subscription identity: provider "chatgpt" and
+  // oauth_subscription auth record one fact and must pair, or a key-auth
+  // row under the identity would dispatch against the API while the user
+  // believes they are on subscription billing.
+  const subscriptionAuth = auth.type === "oauth_subscription";
+  const subscriptionProvider = provider === "chatgpt";
+  if (subscriptionAuth !== subscriptionProvider) {
+    throw new BadRequestError(
+      subscriptionAuth
+        ? `Auth type "oauth_subscription" is only valid for provider "chatgpt", not "${provider}". Run the ChatGPT sign-in flow to connect a subscription.`
+        : `Provider "chatgpt" is always subscription-authenticated; "${auth.type}" auth is not valid for it. Run the ChatGPT sign-in flow, or name a real provider for key-based auth.`,
+    );
   }
-  throw new BadRequestError(
-    managedAuth
-      ? `Auth type "platform" is only valid for provider "${VELLUM_MANAGED_PROVIDER}", not "${provider}". Vellum-managed routing is selected by the provider, so omit "auth" to derive it.`
-      : `Provider "${VELLUM_MANAGED_PROVIDER}" is always platform-authenticated; "${auth.type}" auth is not valid for it. Omit "auth" to derive it, or name a real provider for key-based auth.`,
-  );
 }
 
 /**
@@ -323,6 +336,15 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Connection name "${name}" is reserved for the Vellum-managed connection. Pick another name.`,
     );
   }
+  // Provider ids and routing identities are labels in profile config, so an
+  // entry under one of those names could never be referenced by name (the
+  // label reads as the vendor), and a future catalog addition must never
+  // capture an existing user name. Reserve the whole vocabulary.
+  if (VALID_CONNECTION_PROVIDERS.includes(name)) {
+    throw new BadRequestError(
+      `Connection name "${name}" is reserved as a provider id. Pick another name.`,
+    );
+  }
 
   const providerResult = ConnectionProviderSchema.safeParse(provider);
   if (!providerResult.success) {
@@ -330,15 +352,27 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Invalid provider "${String(provider)}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
     );
   }
+  // The chatgpt identity lives on its canonical row: routing resolves the
+  // subscription by that name, so an identity row under any other name can
+  // never dispatch.
+  if (
+    providerResult.data === "chatgpt" &&
+    name !== CHATGPT_SUBSCRIPTION_CONNECTION_NAME
+  ) {
+    throw new BadRequestError(
+      `Provider "chatgpt" is reserved for the "${CHATGPT_SUBSCRIPTION_CONNECTION_NAME}" connection. Run the ChatGPT sign-in flow to connect a subscription.`,
+    );
+  }
   const authResult = AuthSchema.safeParse(
     auth ?? deriveConnectionAuth(providerResult.data, body.credential),
   );
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
-  if (auth !== undefined) {
-    assertAuthMatchesProvider(providerResult.data, authResult.data);
-  }
+  // Asserted on derived auth as well: derivation pairs every provider
+  // correctly except the chatgpt identity, whose fallthrough would mint
+  // api_key auth from a bare credential.
+  assertAuthMatchesProvider(providerResult.data, authResult.data);
 
   const labelRaw = body.label;
   if (
@@ -434,15 +468,31 @@ async function handleUpdateConnection({
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
+  // The canonical subscription row owns the "chatgpt" identity: writing
+  // subscription auth to it stamps the provider with the auth, mirroring
+  // the daemon's own sign-in exchange route. The CLI's login-chatgpt PATCHes
+  // auth through this route, and without the stamp a row the identity
+  // migration deliberately skipped (a claiming row with key auth) would end
+  // up as provider "openai" with subscription auth. Provider stays
+  // immutable for every other row.
+  const chatgptIdentityStamp =
+    name === CHATGPT_SUBSCRIPTION_CONNECTION_NAME &&
+    authResult.data.type === "oauth_subscription" &&
+    existing.provider !== "chatgpt";
+
   // The pairing is enforced on an actual auth change, not on the field being
   // present: the web editor and the CLI both resend the stored auth on every
   // edit, so a row whose columns already disagree stays relabelable and
-  // re-pointable.
+  // re-pointable. Judged against the stamped provider when the stamp
+  // applies, since that is the pair being written.
   if (
     body.auth !== undefined &&
     authFingerprint(authResult.data) !== authFingerprint(existing.auth)
   ) {
-    assertAuthMatchesProvider(existing.provider, authResult.data);
+    assertAuthMatchesProvider(
+      chatgptIdentityStamp ? "chatgpt" : existing.provider,
+      authResult.data,
+    );
   }
 
   const labelRaw = body.label;
@@ -473,6 +523,7 @@ async function handleUpdateConnection({
 
   const result = updateConnection(getDb(), name, {
     auth: authResult.data,
+    ...(chatgptIdentityStamp ? { provider: "chatgpt" } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
     ...customFields,
   });
@@ -574,10 +625,21 @@ async function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   // above; this keeps the scan a faithful backstop rather than one that
   // silently skips the defaults.
   const profiles = getEffectiveProfilesForProvider(config.llm?.profiles, dp);
+  // A binding lives in `provider` (the entry name) under the entries model,
+  // or in the legacy `provider_connection` field; both count, or deleting a
+  // bound entry would dangle the profile behind selection's silent healing.
+  // Provider values count only for non-vendor names: a profile saying
+  // "vellum" references the routing identity, never a row that happens to
+  // claim that name, and the claiming-row delete is the recovery path.
+  const nameIsEntryName = !VALID_CONNECTION_PROVIDERS.includes(name);
   const referencingProfiles = Object.entries(profiles)
-    .filter(
-      ([, p]) => (p as Record<string, unknown>).provider_connection === name,
-    )
+    .filter(([, p]) => {
+      const entry = p as Record<string, unknown>;
+      return (
+        entry.provider_connection === name ||
+        (nameIsEntryName && entry.provider === name)
+      );
+    })
     .map(([profileName]) => profileName);
 
   const result = deleteConnection(getDb(), name, {

package/src/runtime/routes/log-export-routes.ts

@@ -143,6 +143,9 @@ async function handleExport({
         ? [eq(messages.conversationId, conversationId)]
         : [];
 
+      // Any-state export, deliberately: this is a diagnostic surface, and an
+      // in-flight row (finalized = 0, content a { ref } into the turn's delta
+      // file) is often exactly what a bug report needs to show.
       const messageRows = capRows(
         db
           .select()

package/src/runtime/routes/mcp-auth-routes.ts

@@ -19,6 +19,7 @@ import type { McpConfig, McpServerConfig } from "../../config/schemas/mcp.js";
 import { estimateToolDefinitionTokens } from "../../context/token-estimator.js";
 import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
 import { McpClient } from "../../mcp/client.js";
+import { getMcpServerManager } from "../../mcp/manager.js";
 import { orchestrateMcpOAuthConnect } from "../../mcp/mcp-auth-orchestrator.js";
 import { getMcpAuthState } from "../../mcp/mcp-auth-state.js";
 import {
@@ -30,6 +31,7 @@ import {
   deleteMcpOAuthCredentials,
   hasMcpOAuthTokens,
 } from "../../mcp/mcp-oauth-provider.js";
+import { readPluginMcpServers } from "../../plugins/mcp-servers.js";
 import { getMcpToolsByServer } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
@@ -224,8 +226,33 @@ interface McpServerEntry {
   authHeaderName?: string;
   allowedTools?: string[];
   blockedTools?: string[];
+  /**
+   * Where the definition came from: the workspace `config.json` or a
+   * plugin's `mcp.json`. A plugin server is read-only from the CLI's
+   * perspective, since `mcp remove` and `mcp update` act on the workspace
+   * config, so the caller needs to be able to tell the two apart.
+   */
+  source: "workspace" | "plugin";
+  /** Plugin that declared this server. Present only when `source` is `plugin`. */
+  pluginName?: string;
 }
 
+/**
+ * Status reported for a plugin-declared server the MCP manager holds no
+ * live client for — it has not been started yet, or its connection failed.
+ *
+ * A plugin server is never health-checked the way a workspace server is.
+ * `checkMachineReadableHealth` constructs its own `McpClient`, which
+ * resolves `mcp:<serverId>:headers` and `mcp:<serverId>:tokens` from the
+ * credential store, and a plugin controls both its server key and its URL,
+ * so probing one would send workspace-owned credentials to an endpoint the
+ * plugin chose whenever an id happens to match a stored key. Skipping the
+ * probe also avoids spawning a plugin's declared stdio command as a side
+ * effect of listing. The manager's own client — started with credentials
+ * isolated — is the only thing consulted instead.
+ */
+const PLUGIN_SERVER_STATUS = "declared";
+
 function detectAuthType(headers: Record<string, string>): "bearer" | "api-key" {
   const authValue = headers["Authorization"] ?? headers["authorization"];
   if (authValue?.startsWith("Bearer ")) {
@@ -240,65 +267,129 @@ async function handleMcpList(_args: {
   const raw = loadRawConfig();
   const mcpConfig = raw.mcp as Partial<McpConfig> | undefined;
   const servers = mcpConfig?.servers ?? {};
-  const entries = Object.entries(servers) as [string, McpServerConfig][];
-
-  const results: McpServerEntry[] = await Promise.all(
-    entries
-      .filter(([, config]) => config && typeof config === "object")
-      .map(async ([id, config]) => {
-        const enabled = config.enabled !== false;
-        let status: string;
-        if (!enabled) {
-          status = "disabled";
-        } else {
-          status = await checkMachineReadableHealth(id, config);
-        }
-        const hasOAuth =
-          config.transport.type !== "stdio"
-            ? await hasMcpOAuthTokens(id)
-            : false;
-
-        // Check credential store for stored static auth headers
-        const storedHeaders = await getMcpHeaders(id);
-        // Also check legacy config-level headers
-        const configHeaders =
-          config.transport.type !== "stdio"
-            ? config.transport.headers
-            : undefined;
-        const effectiveHeaders = storedHeaders ?? configHeaders;
-        const hasStaticAuth =
-          !!effectiveHeaders && Object.keys(effectiveHeaders).length > 0;
-        const authType: "none" | "bearer" | "api-key" = hasStaticAuth
-          ? detectAuthType(effectiveHeaders!)
-          : "none";
-        const authHeaderName =
-          authType === "api-key" && effectiveHeaders
-            ? Object.keys(effectiveHeaders).find(
-                (k) => k.toLowerCase() !== "authorization",
-              )
-            : undefined;
-
-        // Strip headers from transport — never return secrets
-        const { headers: _stripped, ...safeTransport } =
-          config.transport as Record<string, unknown>;
-
-        return {
-          id,
-          status,
-          transport: safeTransport as McpServerEntry["transport"],
-          enabled,
-          defaultRiskLevel: config.defaultRiskLevel ?? "high",
-          hasOAuth,
-          hasStaticAuth,
-          authType,
-          ...(authHeaderName && { authHeaderName }),
-          ...(config.allowedTools && { allowedTools: config.allowedTools }),
-          ...(config.blockedTools && { blockedTools: config.blockedTools }),
-        };
-      }),
+  const configEntries = (
+    Object.entries(servers) as [string, McpServerConfig][]
+  ).filter(([, config]) => config && typeof config === "object");
+
+  const workspaceEntries: McpServerEntry[] = await Promise.all(
+    configEntries.map(async ([id, config]) => {
+      const enabled = config.enabled !== false;
+      let status: string;
+      if (!enabled) {
+        status = "disabled";
+      } else {
+        status = await checkMachineReadableHealth(id, config);
+      }
+      const hasOAuth =
+        config.transport.type !== "stdio" ? await hasMcpOAuthTokens(id) : false;
+
+      // Check credential store for stored static auth headers
+      const storedHeaders = await getMcpHeaders(id);
+      // Also check legacy config-level headers
+      const configHeaders =
+        config.transport.type !== "stdio"
+          ? config.transport.headers
+          : undefined;
+      const effectiveHeaders = storedHeaders ?? configHeaders;
+      const hasStaticAuth =
+        !!effectiveHeaders && Object.keys(effectiveHeaders).length > 0;
+      const authType: "none" | "bearer" | "api-key" = hasStaticAuth
+        ? detectAuthType(effectiveHeaders!)
+        : "none";
+      const authHeaderName =
+        authType === "api-key" && effectiveHeaders
+          ? Object.keys(effectiveHeaders).find(
+              (k) => k.toLowerCase() !== "authorization",
+            )
+          : undefined;
+
+      // Strip headers from transport, never return secrets
+      const { headers: _stripped, ...safeTransport } =
+        config.transport as Record<string, unknown>;
+
+      return {
+        id,
+        status,
+        transport: safeTransport as McpServerEntry["transport"],
+        enabled,
+        defaultRiskLevel: config.defaultRiskLevel ?? "high",
+        hasOAuth,
+        hasStaticAuth,
+        authType,
+        ...(authHeaderName && { authHeaderName }),
+        ...(config.allowedTools && { allowedTools: config.allowedTools }),
+        ...(config.blockedTools && { blockedTools: config.blockedTools }),
+        source: "workspace" as const,
+      };
+    }),
   );
 
-  return { servers: results };
+  return {
+    servers: [...workspaceEntries, ...listPluginServerEntries(configEntries)],
+  };
+}
+
+/**
+ * Project plugin-declared servers onto listing entries.
+ *
+ * Nothing here touches the credential store or the network: a plugin
+ * server carries no auth state the assistant owns, and its status comes
+ * from the manager's in-memory client rather than a probe (see
+ * {@link PLUGIN_SERVER_STATUS}).
+ */
+function listPluginServerEntries(
+  configEntries: [string, McpServerConfig][],
+): McpServerEntry[] {
+  const { servers, issues } = readPluginMcpServers();
+  for (const issue of issues) {
+    log.warn(
+      {
+        plugin: issue.pluginName,
+        ...(issue.serverKey && { serverKey: issue.serverKey }),
+      },
+      `Plugin MCP declaration problem: ${issue.message}`,
+    );
+  }
+
+  // A workspace entry outranks a plugin's declaration of the same id: the
+  // user's own configuration is the more specific statement, and it is the
+  // one they can edit. `buildEffectiveMcpConfig` applies the same
+  // precedence, so this listing describes the set the daemon actually runs.
+  const workspaceIds = new Set(configEntries.map(([id]) => id));
+  const manager = getMcpServerManager();
+
+  return servers
+    .filter((server) => {
+      if (!workspaceIds.has(server.id)) {
+        return true;
+      }
+      log.warn(
+        { plugin: server.pluginName, serverId: server.id },
+        "Plugin MCP server shadowed by a workspace server of the same id; skipping",
+      );
+      return false;
+    })
+    .map((server) => {
+      const { headers: _stripped, ...safeTransport } = server.config
+        .transport as Record<string, unknown>;
+      return {
+        id: server.id,
+        status: manager.getClient(server.id)?.isConnected
+          ? "connected"
+          : PLUGIN_SERVER_STATUS,
+        transport: safeTransport as McpServerEntry["transport"],
+        enabled: true,
+        defaultRiskLevel: server.config.defaultRiskLevel,
+        // A plugin server has no assistant-owned credentials. Resolving
+        // these against `mcp:<id>:*` would report, and could disclose, a
+        // workspace credential that happens to share the id.
+        hasOAuth: false,
+        hasStaticAuth: false,
+        authType: "none" as const,
+        source: "plugin" as const,
+        pluginName: server.pluginName,
+      };
+    });
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/plugins-routes.ts

@@ -85,6 +85,7 @@ import {
 } from "../../cli/lib/uninstall-plugin.js";
 import {
   PluginMergeBaselineError,
+  PluginNotCuratedError,
   PluginNotUpgradableError,
   upgradePlugin,
 } from "../../cli/lib/upgrade-plugin.js";
@@ -606,6 +607,12 @@ const pluginUpgradeRequestSchema = z.object({
     .describe(
       "How to reconcile local edits with the pin. `overwrite` (default) discards local edits and re-installs the pin; `ours`/`theirs` three-way merge, resolving conflicting hunks toward the local edit or the pin respectively; `assistant` is not yet supported.",
     ),
+  marketplaceOnly: z
+    .boolean()
+    .optional()
+    .describe(
+      "Refuse the upgrade (409) when the marketplace does not claim this plugin, instead of advancing it to whatever its recorded GitHub ref now resolves to. Set by unattended callers such as the automatic update sweep, for which running code no curator reviewed is never an acceptable outcome. Defaults to false.",
+    ),
 });
 
 const pluginUpgradeResponseSchema = z.object({
@@ -1465,6 +1472,11 @@ async function handleUpgradePlugin({
     typeof body.strategy === "string"
       ? (body.strategy as PluginUpgradeStrategy)
       : undefined;
+  // Enforced here, not just by whoever decided to call: `upgradePlugin` fetches
+  // the catalog itself, so an entry that vanishes between a caller's own check
+  // and this handler would otherwise reroute a curated upgrade onto the
+  // install's mutable recorded ref.
+  const marketplaceOnly = body.marketplaceOnly === true;
 
   // Like install, the upgrade target ref is the curated marketplace pin
   // (resolved inside `upgradePlugin` via `inspectPlugin`), never a
@@ -1498,7 +1510,7 @@ async function handleUpgradePlugin({
     // upgraded revision adds is surfaced to the user by the schedule
     // reconciler's `schedule.declared` notification when it arms.
     const result = await upgradePlugin(
-      { name, dryRun, strategy },
+      { name, dryRun, strategy, marketplaceOnly },
       {
         fetch: globalThis.fetch.bind(globalThis),
         // Tear the old version down BEFORE the staged tree replaces its
@@ -1568,6 +1580,12 @@ async function handleUpgradePlugin({
     if (err instanceof PluginNotUpgradableError) {
       throw new ConflictError(err.message);
     }
+    // A `marketplaceOnly` caller asked about an install the catalog does not
+    // claim. Retrying changes nothing; only a human upgrading it deliberately
+    // (without the flag) can move it, so 409 rather than a retryable 503.
+    if (err instanceof PluginNotCuratedError) {
+      throw new ConflictError(err.message);
+    }
     // A rate-limited or temporarily-down source (the plugin repo or the
     // marketplace catalog) is a retryable outage, not a conflict — 503.
     if (err instanceof PluginSourceUnavailableError) {
@@ -2039,7 +2057,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Upgrade a plugin to its source's current revision",
     description:
-      'Move an installed plugin to its source\'s current revision, re-materializing it under `<workspaceDir>/plugins/<name>/`. A marketplace plugin advances to the curated pin; a plugin installed directly from a GitHub URL (untrusted, not in the marketplace) advances to whatever its recorded ref now resolves to — a pinned SHA is immutable (a no-op), a branch/tag/HEAD moves as upstream does — re-materialized verbatim with no curated adapter overlay, exactly as the original untrusted install was. The target ref is never taken from the request (no caller-supplied ref), mirroring `plugins install`\'s curation boundary. A no-op (`outcome: "already-up-to-date"`) when the installed commit already equals the target; pass `dryRun` to preview the move (`outcome: "would-upgrade"`) without touching the install. Installs lacking provenance are re-pinned to the current SHA. The upgraded code is picked up live on the next read (no restart required). `strategy` controls how local edits are reconciled: `overwrite` (default) discards them and re-installs the target wholesale; `ours`/`theirs`/`assistant` perform a three-way merge against the re-materialized install commit, carrying non-conflicting edits from both sides forward and resolving conflicting hunks toward the local edit (`ours`) or the target (`theirs`), or writing git conflict markers into the file and reporting them in `conflicts`/`binaryConflicts` for the assistant to resolve (`assistant`). A merge strategy whose install-time baseline cannot be reconstructed returns 409. Mirrors the CLI\'s `assistant plugins upgrade <name> [--strategy <s>]`.',
+      'Move an installed plugin to its source\'s current revision, re-materializing it under `<workspaceDir>/plugins/<name>/`. A marketplace plugin advances to the curated pin; a plugin installed directly from a GitHub URL (untrusted, not in the marketplace) advances to whatever its recorded ref now resolves to — a pinned SHA is immutable (a no-op), a branch/tag/HEAD moves as upstream does — re-materialized verbatim with no curated adapter overlay, exactly as the original untrusted install was. The target ref is never taken from the request (no caller-supplied ref), mirroring `plugins install`\'s curation boundary. A no-op (`outcome: "already-up-to-date"`) when the installed commit already equals the target; pass `dryRun` to preview the move (`outcome: "would-upgrade"`) without touching the install. Installs lacking provenance are re-pinned to the current SHA. The upgraded code is picked up live on the next read (no restart required). `strategy` controls how local edits are reconciled: `overwrite` (default) discards them and re-installs the target wholesale; `ours`/`theirs`/`assistant` perform a three-way merge against the re-materialized install commit, carrying non-conflicting edits from both sides forward and resolving conflicting hunks toward the local edit (`ours`) or the target (`theirs`), or writing git conflict markers into the file and reporting them in `conflicts`/`binaryConflicts` for the assistant to resolve (`assistant`). A merge strategy whose install-time baseline cannot be reconstructed returns 409. Pass `marketplaceOnly` to refuse the untrusted direct path outright (409), which is what the unattended auto-update sweep does. Mirrors the CLI\'s `assistant plugins upgrade <name> [--strategy <s>]`.',
     tags: ["plugins"],
     pathParams: [
       {
@@ -2062,7 +2080,7 @@ export const ROUTES: RouteDefinition[] = [
       },
       "409": {
         description:
-          "The install has neither a marketplace entry nor a recorded GitHub source to advance to, or a merge strategy was requested whose install-time baseline cannot be reconstructed.",
+          "The install has neither a marketplace entry nor a recorded GitHub source to advance to, a `marketplaceOnly` upgrade was requested for an install the marketplace does not claim, or a merge strategy was requested whose install-time baseline cannot be reconstructed.",
       },
       "503": {
         description:

package/src/runtime/routes/stt-routes.ts

@@ -223,6 +223,35 @@ const STT_ERROR_MAP: Record<SttErrorCategory, () => RouteError> = {
   "provider-error": () => new BadGatewayError("STT provider error"),
 };
 
+/**
+ * Resolve the configured batch transcriber, or fail the request with a 503
+ * naming which kind of unavailability this is.
+ *
+ * A typed {@link SttError} already names the situation and its fix (a
+ * configured provider that cannot batch transcribe), so its message is
+ * surfaced verbatim. `null` means nothing is configured at all, and any other
+ * throw is an unexpected resolver failure.
+ */
+async function resolveBatchTranscriberOrUnavailable(): Promise<BatchTranscriber> {
+  let transcriber: BatchTranscriber | null;
+  try {
+    transcriber = await resolveBatchTranscriber();
+  } catch (err) {
+    if (err instanceof SttError) {
+      throw new ServiceUnavailableError(err.message);
+    }
+    log.error({ err }, "Failed to resolve STT transcriber");
+    throw new ServiceUnavailableError("STT provider is not available");
+  }
+
+  if (!transcriber) {
+    throw new ServiceUnavailableError(
+      "No speech-to-text provider is configured",
+    );
+  }
+  return transcriber;
+}
+
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -288,19 +317,7 @@ async function handleTranscribe({ body }: RouteHandlerArgs) {
   }
 
   // -- Resolve transcriber --------------------------------------------------
-  let transcriber;
-  try {
-    transcriber = await resolveBatchTranscriber();
-  } catch (err) {
-    log.error({ err }, "Failed to resolve STT transcriber");
-    throw new ServiceUnavailableError("STT provider is not available");
-  }
-
-  if (!transcriber) {
-    throw new ServiceUnavailableError(
-      "No speech-to-text provider is configured",
-    );
-  }
+  const transcriber = await resolveBatchTranscriberOrUnavailable();
 
   // -- Transcribe with timeout ----------------------------------------------
   const abortController = new AbortController();
@@ -358,18 +375,7 @@ async function handleTranscribeFile({ body }: RouteHandlerArgs) {
     );
   }
 
-  let transcriber;
-  try {
-    transcriber = await resolveBatchTranscriber();
-  } catch (err) {
-    log.error({ err }, "Failed to resolve STT transcriber");
-    throw new ServiceUnavailableError("STT provider is not available");
-  }
-  if (!transcriber) {
-    throw new ServiceUnavailableError(
-      "No speech-to-text provider is configured",
-    );
-  }
+  const transcriber = await resolveBatchTranscriberOrUnavailable();
 
   const startTime = Date.now();
   let wavPath: string | null = null;

package/src/runtime/routes/surface-conversation-resolver.ts

@@ -64,6 +64,9 @@ export async function resolveSurfaceConversation(
   const escaped = surfaceId.replace(/[\\%_]/g, "\\$&");
   const row = rawGet<{ conversation_id: string }>(
     "surfaceResolver:resolveConversation",
+    // Unfinalized rows cannot match: their content is a { ref } pointer,
+    // never inline surface JSON, so the LIKE probes below see finalized
+    // content only by shape. No completeness predicate needed.
     `SELECT conversation_id FROM messages
      WHERE content LIKE ? ESCAPE '\\'
      ORDER BY created_at DESC