@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/tools/acp/spawn.test.ts

@@ -147,6 +147,11 @@ const { _resetAdapterInstallCacheForTests } =
   await import("../../acp/auto-install.js");
 const { ACP_CLAUDE_OAUTH_MISSING_CODE } =
   await import("../../acp/prepare-agent-env.js");
+const { ACP_CLAUDE_AUTH_REQUIRED_CODE, AcpAuthRequiredError } =
+  await import("../../acp/auth-required.js");
+const { hasAcpConnectCardRaised } =
+  await import("../../acp/acp-connect-card-state.js");
+const { AcpAgentProcess } = await import("../../acp/agent-process.js");
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -547,3 +552,95 @@ describe("executeAcpSpawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
     expect(result.errorCode).toBe(ACP_CLAUDE_OAUTH_MISSING_CODE);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Pre-spawn Claude auth rejection
+// ---------------------------------------------------------------------------
+
+describe("pre-spawn Claude auth rejection", () => {
+  test("raises the recovery surface: errorCode, card guidance, registry mark", async () => {
+    // The adapter can reject session creation with auth_required (a stored
+    // credential the server refuses). The error thrown here is produced by
+    // the REAL conversion seam, not hand-built: a wire-shaped JSON-RPC
+    // auth_required rejection driven through AcpAgentProcess.createSession's
+    // actual retry path, so this test fails if that seam stops yielding the
+    // typed error the tool boundary maps to the recovery surface.
+    const proc = new AcpAgentProcess(
+      "claude",
+      { command: "claude-agent-acp", args: [] },
+      (() => ({})) as never,
+    );
+    (proc as unknown as { connection: unknown }).connection = {
+      newSession: () =>
+        Promise.reject({ code: -32000, message: "Authentication required" }),
+    };
+    (proc as unknown as { initializeResponse: unknown }).initializeResponse = {
+      authMethods: [
+        {
+          id: "claude-ai-login",
+          name: "Claude Subscription",
+          type: "terminal",
+        },
+      ],
+    };
+    (proc as unknown as { spawnedEnv: unknown }).spawnedEnv = {};
+    const realSeamError: unknown = await proc.createSession("/tmp").then(
+      () => null,
+      (e: unknown) => e,
+    );
+    expect(realSeamError).toBeInstanceOf(AcpAuthRequiredError);
+
+    spawnMock.mockImplementationOnce(async () => {
+      throw realSeamError;
+    });
+
+    const context = { ...makeContext(), conversationId: "conv-prespawn-auth" };
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something" },
+      context,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.errorCode).toBe(ACP_CLAUDE_AUTH_REQUIRED_CODE);
+    expect(result.content).toContain("Connect Claude Code");
+    expect(hasAcpConnectCardRaised("conv-prespawn-auth")).toBe(true);
+  });
+
+  test("a raw wire auth_required object (unwrapped initialize path) gets the same surface", async () => {
+    // initialize() cannot ride withAuthRetry (its response advertises the
+    // methods the retry selects from), so its rejection arrives as the plain
+    // JSON-RPC object rather than the typed error. The gate must recognize
+    // both shapes or this path silently flattens to a generic failure.
+    spawnMock.mockImplementationOnce(async () => {
+      throw { code: -32000, message: "Authentication required" };
+    });
+
+    const context = { ...makeContext(), conversationId: "conv-prespawn-raw" };
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something" },
+      context,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.errorCode).toBe(ACP_CLAUDE_AUTH_REQUIRED_CODE);
+    expect(result.content).toContain("Connect Claude Code");
+    expect(hasAcpConnectCardRaised("conv-prespawn-raw")).toBe(true);
+  });
+
+  test("a non-auth spawn failure keeps the plain flattened result", async () => {
+    spawnMock.mockImplementationOnce(async () => {
+      throw new Error("adapter exploded");
+    });
+
+    const context = { ...makeContext(), conversationId: "conv-prespawn-boom" };
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something" },
+      context,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.errorCode).toBeUndefined();
+    expect(result.content).toContain("adapter exploded");
+    expect(hasAcpConnectCardRaised("conv-prespawn-boom")).toBe(false);
+  });
+});

package/src/tools/acp/spawn.ts

@@ -3,6 +3,12 @@ import { basename } from "node:path";
 import { z } from "zod";
 
 import { markAcpConnectCardRaised } from "../../acp/acp-connect-card-state.js";
+import {
+  ACP_AUTH_RECOVERY_GUIDANCE,
+  ACP_CLAUDE_AUTH_REQUIRED_CODE,
+  CLAUDE_ACP_COMMAND,
+  isAcpAuthRequired,
+} from "../../acp/auth-required.js";
 import { resolveAgentWithAutoInstall } from "../../acp/auto-install.js";
 import { getAcpSessionManager } from "../../acp/index.js";
 import {
@@ -147,6 +153,32 @@ export async function executeAcpSpawn(
 
     return { content: payload, isError: false };
   } catch (err) {
+    // A pre-spawn rejection of the stored Claude credential (the adapter
+    // raises auth_required during session creation) gets the same recovery
+    // surface as the missing-token preflight: the errorCode raises the inline
+    // Connect card off this failed tool call, the registry mark dedups a
+    // redundant secure prompt, and the guidance keeps the model pointed at
+    // the card. Adapter-gated: the card repairs Claude credentials only.
+    // `isAcpAuthRequired` rather than an instanceof: it also recognizes the
+    // raw JSON-RPC auth_required object, which is how a rejection reaches
+    // this catch from the one protocol call `withAuthRetry` cannot wrap
+    // (`initialize`, whose response is what advertises the auth methods the
+    // retry would need).
+    if (
+      isAcpAuthRequired(err) &&
+      basename(agentConfig.command) === CLAUDE_ACP_COMMAND
+    ) {
+      const message =
+        err instanceof Error
+          ? err.message
+          : String((err as { message?: unknown }).message ?? err);
+      markAcpConnectCardRaised(context.conversationId);
+      return {
+        content: `${message}\n\n${ACP_AUTH_RECOVERY_GUIDANCE}`,
+        isError: true,
+        errorCode: ACP_CLAUDE_AUTH_REQUIRED_CODE,
+      };
+    }
     const msg =
       err instanceof Error
         ? err.message

package/src/tools/document/document-tool.ts

@@ -426,13 +426,22 @@ export function executeDocumentUpdate(
     };
   }
 
+  // The store drops append content that merely restates the document's tail,
+  // so the client renders what actually landed rather than the submission.
+  const applied = result.appliedMarkdown;
+  const message = result.duplicateLeadingContentSkipped
+    ? applied.length === 0
+      ? "Nothing appended: the content is already at the end of the document"
+      : "Document content updated (leading content already at the end of the document was skipped)"
+    : "Document content updated";
+
   // Send document_editor_update message to update the built-in RTE
   if (context.sendToClient) {
     context.sendToClient({
       type: "document_editor_update",
       conversationId: context.conversationId,
       surfaceId,
-      markdown: content,
+      markdown: applied,
       mode,
     });
 
@@ -441,7 +450,7 @@ export function executeDocumentUpdate(
         success: true,
         surface_id: surfaceId,
         mode,
-        message: "Document content updated",
+        message,
       }),
       isError: false,
     };
@@ -458,7 +467,7 @@ export function executeDocumentUpdate(
       success: true,
       surface_id: surfaceId,
       mode,
-      message: "Document content updated (no client connected to render it)",
+      message: `${message} (no client connected to render it)`,
     }),
     isError: false,
   };

package/src/tools/registry.ts

@@ -431,7 +431,8 @@ export function unregisterPluginTools(pluginName: string): void {
  * {@link import("../plugins/mtime-cache.js").getActiveUserPluginTools} and diffs
  * the result into the registry: plugins that vanished are unregistered, new
  * plugins register, and a plugin whose per-tool source mtimes moved is
- * re-registered. Mirrors how hooks resolve through `getUserHookEntriesFor`.
+ * re-registered. Mirrors how hooks resolve through `getUserHookEntriesFor`
+ * in `hooks/registry.ts`.
  *
  * This is a pure read of the plugin cache — it does NOT reconcile the cache
  * against the source-versions sentinel, so it never activates a plugin or runs

package/src/tools/workflows/run-workflow.ts

@@ -55,8 +55,7 @@ export const runWorkflowInputSchema = z.looseObject({
  */
 function resolveTrustContext(context: ToolContext): TrustContext {
   const conversation = findConversation(context.conversationId);
-  const fromConversation =
-    conversation?.currentTurnTrustContext ?? conversation?.trustContext;
+  const fromConversation = conversation?.getTurnOrRestingTrust();
   if (fromConversation) {
     return fromConversation;
   }

package/src/tts/__tests__/reasoning-tag-filter.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, test } from "bun:test";
+
+import { createReasoningTagFilter } from "../reasoning-tag-filter.js";
+
+function run(chunks: string[]): string {
+  const filter = createReasoningTagFilter();
+  let out = "";
+  for (const chunk of chunks) {
+    out += filter.push(chunk);
+  }
+  out += filter.flush();
+  return out;
+}
+
+describe("ReasoningTagFilter", () => {
+  test("passes plain text through unchanged", () => {
+    expect(run(["Hello ", "there."])).toBe("Hello there.");
+  });
+
+  test("drops a complete think span within one delta", () => {
+    expect(run(["<think>hm, let me reason</think>Answer."])).toBe("Answer.");
+  });
+
+  test("drops a reasoning span crossing many deltas", () => {
+    expect(
+      run(["<thi", "nk>step one", " step two", "</th", "ink>Spoken reply"]),
+    ).toBe("Spoken reply");
+  });
+
+  test("drops thinking-tag variant and is case-insensitive", () => {
+    expect(run(["<Thinking>inner</Thinking>ok"])).toBe("ok");
+  });
+
+  test("keeps text before and after the span", () => {
+    expect(run(["Sure. <think>secret</think> Done."])).toBe("Sure.  Done.");
+  });
+
+  test("handles multiple spans in one turn", () => {
+    expect(run(["a<think>x</think>b", "<think>y", "z</think>c"])).toBe("abc");
+  });
+
+  test("an unclosed span at end of stream stays dropped", () => {
+    expect(run(["ok<think>never closes"])).toBe("ok");
+  });
+
+  test("a dangling partial open tag is released as literal text at flush", () => {
+    expect(run(["price <th"])).toBe("price <th");
+  });
+
+  test("a false partial that disambiguates to text is released", () => {
+    expect(run(["a <th", "ree-step plan"])).toBe("a <three-step plan");
+  });
+
+  test("does not touch angle brackets that are not think tags", () => {
+    expect(run(["use <b>bold</b> and x < y"])).toBe(
+      "use <b>bold</b> and x < y",
+    );
+  });
+
+  test("holds back nothing across an empty stream", () => {
+    expect(run([""])).toBe("");
+  });
+});

package/src/tts/reasoning-tag-filter.ts

@@ -0,0 +1,110 @@
+/**
+ * Streaming reasoning-tag filter for the TTS pipelines.
+ *
+ * Some OpenAI-compatible reasoning models emit their chain of thought inline
+ * in the content stream as `<think>...</think>` (or `<thinking>...</thinking>`)
+ * spans. When a profile has not opted into the chat-completions provider's
+ * `parseThinkTags` (which re-routes those spans to `thinking_delta`), the raw
+ * reasoning rides `text_delta`, and anything downstream that speaks text
+ * deltas would read the model's inner monologue aloud and delay real speech
+ * by the full length of the reasoning.
+ *
+ * This filter is the TTS-boundary guard: voice output must never speak
+ * reasoning regardless of profile configuration. It is stateful because a
+ * tag or a reasoning span routinely crosses delta boundaries; feed every
+ * delta through {@link ReasoningTagFilter.push} and call
+ * {@link ReasoningTagFilter.flush} when the turn's stream ends.
+ *
+ * Display paths are deliberately untouched: `assistant_text_delta` frames
+ * keep the raw text, exactly like the markdown handling in
+ * `calls/tts-text-sanitizer.ts`.
+ */
+
+const OPEN_TAGS = ["<think>", "<thinking>"] as const;
+const CLOSE_TAGS = ["</think>", "</thinking>"] as const;
+
+/** Longest suffix of `text` that is a proper prefix of any listed tag. */
+function partialTagSuffix(text: string, tags: readonly string[]): number {
+  const max = Math.max(...tags.map((tag) => tag.length)) - 1;
+  const window = Math.min(max, text.length);
+  for (let len = window; len > 0; len -= 1) {
+    const suffix = text.slice(text.length - len).toLowerCase();
+    if (tags.some((tag) => tag.startsWith(suffix))) {
+      return len;
+    }
+  }
+  return 0;
+}
+
+function indexOfAny(
+  haystack: string,
+  tags: readonly string[],
+): { index: number; tag: string } | null {
+  const lower = haystack.toLowerCase();
+  let best: { index: number; tag: string } | null = null;
+  for (const tag of tags) {
+    const index = lower.indexOf(tag);
+    if (index >= 0 && (best === null || index < best.index)) {
+      best = { index, tag };
+    }
+  }
+  return best;
+}
+
+export class ReasoningTagFilter {
+  private insideReasoning = false;
+  private pending = "";
+
+  /**
+   * Feed one streamed delta; returns the speakable text it releases.
+   * Reasoning spans are dropped; a partial tag at the end of the buffer is
+   * held back until the next delta disambiguates it.
+   */
+  push(text: string): string {
+    this.pending += text;
+    let out = "";
+    for (;;) {
+      if (this.insideReasoning) {
+        const close = indexOfAny(this.pending, CLOSE_TAGS);
+        if (close) {
+          this.pending = this.pending.slice(close.index + close.tag.length);
+          this.insideReasoning = false;
+          continue;
+        }
+        // Everything buffered is reasoning except a possible partial close
+        // tag at the end; drop the reasoning, keep the partial.
+        const partial = partialTagSuffix(this.pending, CLOSE_TAGS);
+        this.pending = partial > 0 ? this.pending.slice(-partial) : "";
+        return out;
+      }
+      const open = indexOfAny(this.pending, OPEN_TAGS);
+      if (open) {
+        out += this.pending.slice(0, open.index);
+        this.pending = this.pending.slice(open.index + open.tag.length);
+        this.insideReasoning = true;
+        continue;
+      }
+      const partial = partialTagSuffix(this.pending, OPEN_TAGS);
+      const safeLength = this.pending.length - partial;
+      out += this.pending.slice(0, safeLength);
+      this.pending = partial > 0 ? this.pending.slice(safeLength) : "";
+      return out;
+    }
+  }
+
+  /**
+   * End of stream: release any held-back partial. Outside a reasoning span a
+   * dangling "<thin" was ordinary text after all; inside one, the span never
+   * closed and its content stays dropped.
+   */
+  flush(): string {
+    const rest = this.insideReasoning ? "" : this.pending;
+    this.pending = "";
+    this.insideReasoning = false;
+    return rest;
+  }
+}
+
+export function createReasoningTagFilter(): ReasoningTagFilter {
+  return new ReasoningTagFilter();
+}

package/src/workspace/byok-default-profile-ensure.ts

@@ -18,6 +18,7 @@ import {
   type LLMProvider,
   type ProfileEntry,
 } from "../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
 import { getLogger } from "../util/logger.js";
 import { completedProfileBody } from "./custom-profile-ensure.js";
 
@@ -135,10 +136,26 @@ const ERA_COPY_LABEL_SUFFIX = " (Custom Provider)";
 /**
  * Comparison ignores `label` and `status` (user overlay state, preserved via
  * `userOverlayState`) and `model` (checked separately against the current
- * intent resolution and `HISTORICAL_INTENT_MODELS`).
+ * intent resolution and `HISTORICAL_INTENT_MODELS`). The CONVENTIONAL
+ * `<vendor>-personal` binding is normalized away before comparison (it was
+ * machinery-written across several eras); a non-conventional binding is a
+ * user selection and keeps blocking conversion.
  */
 const IGNORED_COMPARISON_KEYS = new Set(["label", "status", "model"]);
 
+/**
+ * Fold the conventional personal entry name back to its vendor. The entries
+ * collapse (migration 145) rewrites a hatch copy's binding into its
+ * provider as `<vendor>-personal`; the matcher folds that shape so every
+ * era of stored copy keeps converting (the same discipline as
+ * `HISTORICAL_INTENT_MODELS`).
+ */
+function foldPersonalEntryName(provider: string): string {
+  return provider.endsWith("-personal")
+    ? provider.slice(0, -"-personal".length)
+    : provider;
+}
+
 /**
  * Per-provider model ids that earlier intent eras pinned onto `custom-*`
  * copies, verified against `providers/model-intents.ts` git history. Hatch
@@ -156,6 +173,10 @@ const HISTORICAL_INTENT_MODELS: Record<
   Partial<Record<string, readonly string[]>>
 > = {
   balanced: {
+    openai: [
+      // balanced intent 2026-05-05 (#29755) to the 2026-08-10 gpt-5.6 repoint.
+      "gpt-5.4-mini",
+    ],
     fireworks: [
       // balanced intent 2026-05-05 (#29755) to 2026-05-19 (#31068).
       "accounts/fireworks/models/kimi-k2p5",
@@ -166,6 +187,10 @@ const HISTORICAL_INTENT_MODELS: Record<
     ],
   },
   "quality-optimized": {
+    openai: [
+      // quality intent 2026-05-05 (#29755) to the 2026-08-10 gpt-5.6 repoint.
+      "gpt-5.4",
+    ],
     anthropic: [
       // quality intent 2026-05-05 (#29755) to 2026-06-11 (#34498).
       "claude-opus-4-7",
@@ -259,11 +284,13 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
   const completionBase = LLMConfigBase.safeParse(llm.default ?? {}).data;
 
   // The default provider on a BYOK default, or the uniform hatch provider
-  // across the complete copy set on a vellum default; null converts nothing.
-  const candidateProvider =
-    parsedDefault.data.provider !== "vellum"
-      ? parsedDefault.data.provider
-      : uniformCopyProvider(profiles);
+  // across the complete copy set on a routing-identity default (vellum,
+  // chatgpt); null converts nothing.
+  const candidateProvider = ROUTING_IDENTITY_PROVIDERS.has(
+    parsedDefault.data.provider,
+  )
+    ? uniformCopyProvider(profiles)
+    : parsedDefault.data.provider;
   const convertibleProvider =
     candidateProvider !== null && isByokDefaultProviderChoice(candidateProvider)
       ? candidateProvider
@@ -339,7 +366,11 @@ function isKnownUneditedBody(
   // (hatch materialized it once; the default provider may have changed
   // since); equality with the corroborated provider rules out a user
   // re-provision.
-  if (convertibleProvider === null || entry.provider !== convertibleProvider) {
+  if (
+    convertibleProvider === null ||
+    typeof entry.provider !== "string" ||
+    foldPersonalEntryName(entry.provider) !== convertibleProvider
+  ) {
     return false;
   }
   const copyProvider = convertibleProvider;
@@ -347,11 +378,13 @@ function isKnownUneditedBody(
   if (template === undefined) {
     return false;
   }
-  const materialized = materializeProfile(
-    template,
-    copyProvider,
-    `${copyProvider}-personal`,
-  ) as Record<string, unknown>;
+  // No connection binding: the bare provider means the default entry of
+  // that kind, and a stamped binding would re-introduce the collapsed
+  // field on disk.
+  const materialized = materializeProfile(template, copyProvider) as Record<
+    string,
+    unknown
+  >;
   if (
     entry.model !== materialized.model &&
     !(HISTORICAL_INTENT_MODELS[key][copyProvider] ?? []).includes(entry.model)
@@ -361,11 +394,20 @@ function isKnownUneditedBody(
   // Completion skips managed-source bodies, so a copy from the era whose
   // templates wrote `source: "managed"` (#29755 to #29768, 2026-05-05) is
   // compared as if user-source to keep both sides normalized identically.
+  const normalizedEntry: Record<string, unknown> = {
+    ...entry,
+    provider: copyProvider,
+    ...(entry.source === "managed" ? { source: "user" } : {}),
+  };
+  // The conventional personal binding is machinery-written (hatch stamps,
+  // completion re-stamps); normalize it away. Any other binding is user
+  // state and stays in the comparison, where the unbound template side
+  // makes it block conversion.
+  if (normalizedEntry.provider_connection === `${copyProvider}-personal`) {
+    delete normalizedEntry.provider_connection;
+  }
   const body = comparableBody(
-    withCompletionBaked(
-      entry.source === "managed" ? { ...entry, source: "user" } : entry,
-      completionBase,
-    ),
+    withCompletionBaked(normalizedEntry, completionBase),
   );
   const known = comparableBody(
     withCompletionBaked(materialized, completionBase),
@@ -392,9 +434,10 @@ function uniformCopyProvider(profiles: Record<string, unknown>): string | null {
     if (typeof entry.provider !== "string") {
       return null;
     }
+    const entryProvider = foldPersonalEntryName(entry.provider);
     if (provider === null) {
-      provider = entry.provider;
-    } else if (provider !== entry.provider) {
+      provider = entryProvider;
+    } else if (provider !== entryProvider) {
       return null;
     }
   }

package/src/workspace/custom-profile-ensure.ts

@@ -3,7 +3,10 @@ import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 import { invalidateConfigCache } from "../config/loader.js";
-import { completeCustomProfile } from "../config/profile-materialization.js";
+import {
+  completeCustomProfile,
+  mergePreservingUnknownKeys,
+} from "../config/profile-materialization.js";
 import { LLMConfigBase, ProfileEntry } from "../config/schemas/llm.js";
 import { getLogger } from "../util/logger.js";
 
@@ -113,29 +116,6 @@ export function completedProfileBody(
   );
 }
 
-/**
- * `{...raw, ...completed}` recursively: completed (schema-known) values win,
- * raw keys the schema stripped survive at every depth. (Duplicated in the
- * write-path normalization in conversation-query-routes.ts — the two land in
- * independent PRs; consolidate when either next changes.)
- */
-function mergePreservingUnknownKeys(
-  raw: Record<string, unknown>,
-  completed: Record<string, unknown>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw, ...completed };
-  for (const [key, value] of Object.entries(completed)) {
-    const rawValue = raw[key];
-    if (readObject(value) !== null && readObject(rawValue) !== null) {
-      out[key] = mergePreservingUnknownKeys(
-        rawValue as Record<string, unknown>,
-        value as Record<string, unknown>,
-      );
-    }
-  }
-  return out;
-}
-
 function readObject(value: unknown): Record<string, unknown> | null {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return null;

package/src/workspace/migrations/142-consolidate-voice-front-door.ts

@@ -0,0 +1,70 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+const OLD_CALLSITE = "voiceFrontDecision";
+const PROGRESS_CALLSITE = "voiceProgressNarration";
+const RETIRED_ACK_KEYS = [
+  "ackFirstDeltaTimeoutMs",
+  "ackGenerationTimeoutMs",
+] as const;
+
+export const consolidateVoiceFrontDoorMigration: WorkspaceMigration = {
+  id: "142-consolidate-voice-front-door",
+  description:
+    "Rename the progress narration callsite and remove retired generated-ack tuning",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    let changed = false;
+    const llm = readObject(config.llm);
+    const callSites = readObject(llm?.callSites);
+    if (callSites && Object.hasOwn(callSites, OLD_CALLSITE)) {
+      if (!Object.hasOwn(callSites, PROGRESS_CALLSITE)) {
+        callSites[PROGRESS_CALLSITE] = callSites[OLD_CALLSITE];
+      }
+      delete callSites[OLD_CALLSITE];
+      changed = true;
+    }
+
+    const liveVoice = readObject(config.liveVoice);
+    const frontModel = readObject(liveVoice?.frontModel);
+    if (frontModel) {
+      for (const key of RETIRED_ACK_KEYS) {
+        if (Object.hasOwn(frontModel, key)) {
+          delete frontModel[key];
+          changed = true;
+        }
+      }
+    }
+
+    if (changed) {
+      writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    }
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}