@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/workspace/migrations/143-repair-deprecated-codex-model-id.ts

@@ -0,0 +1,134 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair the deprecated `gpt-5.3-codex` model ID on ChatGPT-subscription
+ * config fragments.
+ *
+ * OpenAI deprecated `gpt-5.3-codex` under ChatGPT sign-in (the Codex
+ * endpoint rejects it with HTTP 400), so it is being removed from
+ * `CODEX_SUBSCRIPTION_MODEL_IDS`. A workspace can still pin it on
+ * `provider: "chatgpt"` fragments (migration 133 wrote exactly that shape
+ * for `chatgpt-subscription` entries), and once the ID leaves the allowlist,
+ * `LLMSchema.superRefine` rejects such a fragment. The loader's leaf
+ * recovery then deletes the fragment's `model`, which still fails ("chatgpt"
+ * requires an explicit model), and per-section salvage resets the whole
+ * `llm` section, discarding the user's other LLM settings.
+ *
+ * Repair rewrites the model to `gpt-5.6-terra` (OpenAI's recommended
+ * everyday Codex model) on an exact `provider: "chatgpt"` + model match in
+ * `llm.default`, `llm.callSites.*`, and `llm.profiles.*`. A call-site
+ * fragment is also repaired when it pins the model with no provider of its
+ * own: at resolve time such a fragment overlays the winning profile, so the
+ * stale pin rides whatever provider and connection the winner supplies
+ * (including the subscription connection, which routes it to the Codex
+ * endpoint). Fragments with any other explicit provider are left untouched:
+ * the allowlist only gates the "chatgpt" routing identity, and a provider
+ * like `openai-compatible` may legitimately serve this id.
+ */
+export const repairDeprecatedCodexModelIdMigration: WorkspaceMigration = {
+  id: "143-repair-deprecated-codex-model-id",
+  description:
+    'Repair deprecated gpt-5.3-codex model ID on provider "chatgpt" fragments in workspace LLM config',
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    // Read outside the parse catch: a transient filesystem error (EIO,
+    // EACCES) must reach the runner so the migration retries, while
+    // malformed JSON is a permanent state this migration cannot repair.
+    const rawText = readFileSync(configPath, "utf-8");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(rawText);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default)) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed =
+          repairFragment(readObject(rawConfig), {
+            repairMissingProvider: true,
+          }) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile)) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    // Write-then-rename so an interrupted write cannot leave config.json
+    // truncated: a torn in-place write would parse as invalid JSON on the
+    // retry, which the catch above treats as "nothing to do", letting the
+    // runner checkpoint the migration as completed against a corrupt file.
+    const tmpPath = `${configPath}.migration-143.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+  },
+  // The exact-match rewrite is idempotent, so a transient failure (full
+  // disk, I/O error) is safe to retry on later startups.
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the deprecated model ID would fail schema
+    // validation once the allowlist no longer carries it.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const DEPRECATED_MODEL_ID = "gpt-5.3-codex";
+const REPLACEMENT_MODEL_ID = "gpt-5.6-terra";
+
+function repairFragment(
+  fragment: Record<string, unknown> | null,
+  options?: { repairMissingProvider?: boolean },
+): boolean {
+  if (fragment === null || fragment.model !== DEPRECATED_MODEL_ID) {
+    return false;
+  }
+  const providerRepairable =
+    fragment.provider === "chatgpt" ||
+    (options?.repairMissingProvider === true &&
+      fragment.provider === undefined);
+  if (!providerRepairable) {
+    return false;
+  }
+  fragment.model = REPLACEMENT_MODEL_ID;
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/144-convert-stranded-subscription-openai-profiles.ts

@@ -0,0 +1,265 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("migration-144");
+
+/**
+ * Convert stranded subscription-only `provider: "openai"` fragments to the
+ * `chatgpt` routing identity.
+ *
+ * The ChatGPT-subscription connection row carries `provider: "chatgpt"`
+ * (DB migration 366 stamps existing rows). An UNPINNED profile or call-site
+ * fragment with `provider: "openai"` resolves by listing active openai
+ * connections at dispatch; in a workspace whose only OpenAI access is the
+ * subscription, that listing is now empty and every request on the fragment
+ * fails with missing_connection. Workspace migration 133 converted fragments
+ * that PINNED the subscription row; this converts the unpinned cohort.
+ *
+ * Conversion requires proof from the workspace DB that the fragment is
+ * genuinely stranded: the canonical subscription row exists (matched by
+ * name + oauth_subscription auth, valid for both the pre- and post-366 row
+ * shapes) and no `provider: "openai"` row exists (an API-key row means
+ * openai fragments still resolve). An absent DB or table converts nothing;
+ * an open or query failure on an existing DB propagates so the runner
+ * records a failed checkpoint and retries on a later boot.
+ *
+ * A converted fragment gets `provider: "chatgpt"`, and a model outside the
+ * Codex subscription set is replaced with `gpt-5.6-terra` (the "chatgpt"
+ * identity requires a Codex-servable model at schema validation; on the
+ * subscription every model bills the same). An unpinned
+ * `llm.defaultProvider` of "openai" converts the same way: it anchors the
+ * code-owned default profiles and background call sites, which are equally
+ * stranded. Fragments with a `provider_connection` pin, a pinned
+ * defaultProvider connectionName, any other provider, or a managed source
+ * are left untouched. `llm.default` is not swept: migration 133 drops that
+ * legacy blob and runs earlier in the chain.
+ */
+export const convertStrandedSubscriptionOpenaiProfilesMigration: WorkspaceMigration =
+  {
+    id: "144-convert-stranded-subscription-openai-profiles",
+    description:
+      'Convert unpinned provider "openai" LLM fragments to the "chatgpt" routing identity in subscription-only workspaces',
+    run(workspaceDir: string): void {
+      const configPath = join(workspaceDir, "config.json");
+      if (!existsSync(configPath)) {
+        return;
+      }
+      if (!isSubscriptionOnlyWorkspace(workspaceDir)) {
+        return;
+      }
+
+      // Read outside the parse catch: a transient filesystem error (EIO,
+      // EACCES) must reach the runner so the migration retries, while
+      // malformed JSON is a permanent state this migration cannot repair.
+      const rawText = readFileSync(configPath, "utf-8");
+
+      let config: Record<string, unknown>;
+      try {
+        const raw = JSON.parse(rawText);
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+          return;
+        }
+        config = raw as Record<string, unknown>;
+      } catch {
+        return;
+      }
+
+      const llm = readObject(config.llm);
+      if (llm === null) {
+        return;
+      }
+
+      let changed = false;
+
+      const profiles = readObject(llm.profiles);
+      if (profiles !== null) {
+        for (const [name, rawProfile] of Object.entries(profiles)) {
+          if (convertFragment(readObject(rawProfile))) {
+            changed = true;
+            log.info({ profile: name }, "Converted stranded openai profile");
+          }
+        }
+      }
+
+      const callSites = readObject(llm.callSites);
+      if (callSites !== null) {
+        for (const [id, rawConfig] of Object.entries(callSites)) {
+          if (convertFragment(readObject(rawConfig))) {
+            changed = true;
+            log.info(
+              { callSite: id },
+              "Converted stranded openai call-site fragment",
+            );
+          }
+        }
+      }
+
+      const defaultProvider = readObject(llm.defaultProvider);
+      if (
+        defaultProvider !== null &&
+        defaultProvider.provider === "openai" &&
+        !isConnectionPin(defaultProvider.connectionName)
+      ) {
+        defaultProvider.provider = "chatgpt";
+        // An invalid connectionName leaf (null, empty) would fail
+        // DefaultProviderSchema at load, whose catch drops the whole value.
+        if ("connectionName" in defaultProvider) {
+          delete defaultProvider.connectionName;
+        }
+        changed = true;
+        log.info("Converted stranded openai default provider");
+      }
+
+      if (!changed) {
+        return;
+      }
+
+      // Write-then-rename so an interrupted write cannot leave config.json
+      // truncated: a torn in-place write would parse as invalid JSON on the
+      // retry, which the catch above treats as "nothing to do", letting the
+      // runner checkpoint the migration as completed against a corrupt file.
+      const tmpPath = `${configPath}.migration-144.tmp`;
+      writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+      renameSync(tmpPath, configPath);
+    },
+    // The exact-match rewrite is idempotent, so a transient failure (full
+    // disk, I/O error) is safe to retry on later startups.
+    retryFailedCheckpoint: true,
+    down(_workspaceDir: string): void {
+      // Forward-only: converting back would restore fragments that cannot
+      // resolve a connection.
+    },
+  };
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const SUBSCRIPTION_CONNECTION_NAME = "chatgpt-subscription";
+
+const LEGACY_MANAGED_OPENAI_NAME = "openai-managed";
+
+const CODEX_SUBSCRIPTION_MODEL_IDS = new Set([
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5.4-mini",
+]);
+
+const FALLBACK_CODEX_MODEL = "gpt-5.6-terra";
+
+/**
+ * True only when the workspace DB proves the stranded condition: the
+ * canonical subscription row is present and no openai row exists. Any
+ * failure to read counts as unproven.
+ */
+function isSubscriptionOnlyWorkspace(workspaceDir: string): boolean {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    return false;
+  }
+
+  // An open or query failure on an existing DB (locked, I/O error, corrupt
+  // header) is not proof of anything: swallowing it would checkpoint the
+  // migration as completed against unread state. Let it propagate so
+  // retryFailedCheckpoint reattempts on a later boot.
+  const db = new Database(dbPath, { readonly: true });
+  try {
+    const tableExists = db
+      .query(
+        `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'provider_connections'`,
+      )
+      .get();
+    if (!tableExists) {
+      return false;
+    }
+
+    const subscription = db
+      .query(`SELECT auth FROM provider_connections WHERE name = ?`)
+      .get(SUBSCRIPTION_CONNECTION_NAME) as { auth: string } | null;
+    if (!subscription) {
+      return false;
+    }
+    try {
+      const parsed: unknown = JSON.parse(subscription.auth);
+      const authType =
+        parsed !== null && typeof parsed === "object"
+          ? (parsed as { type?: unknown }).type
+          : undefined;
+      if (authType !== "oauth_subscription") {
+        return false;
+      }
+    } catch {
+      return false;
+    }
+
+    // Two openai-provider rows do not count as usable openai connections.
+    // The canonical row itself stores provider "openai" until DB migration
+    // 366 flips it, and this migration checkpoints once; counting it would
+    // skip the conversion forever on exactly the upgrade boot that needs it
+    // (its subscription auth is already verified above). The legacy
+    // "openai-managed" row is a pre-consolidation platform leftover that the
+    // connection listings hide (LEGACY_MANAGED_CONNECTION_NAMES in
+    // providers/inference/connections.ts); treating it as a live connection
+    // would block the repair on installs that still carry it.
+    const openaiRow = db
+      .query(
+        `SELECT 1 FROM provider_connections WHERE provider = 'openai' AND name NOT IN (?, ?)`,
+      )
+      .get(SUBSCRIPTION_CONNECTION_NAME, LEGACY_MANAGED_OPENAI_NAME);
+    return openaiRow === null;
+  } finally {
+    db.close();
+  }
+}
+
+/**
+ * Only a non-empty string names a pinned connection. The config loader
+ * strips `null`, empty, or non-string values as invalid leaves, so runtime
+ * treats fragments carrying them as unpinned; the conversion must judge
+ * them the same way or those fragments stay stranded.
+ */
+function isConnectionPin(value: unknown): boolean {
+  return typeof value === "string" && value.length > 0;
+}
+
+function convertFragment(fragment: Record<string, unknown> | null): boolean {
+  if (fragment === null) {
+    return false;
+  }
+  if (
+    fragment.provider !== "openai" ||
+    isConnectionPin(fragment.provider_connection)
+  ) {
+    return false;
+  }
+  if (fragment.source === "managed") {
+    return false;
+  }
+  fragment.provider = "chatgpt";
+  // An invalid pin leaf (null, empty) rode along as unpinned; the chatgpt
+  // identity carries no connection reference, so drop it outright.
+  if ("provider_connection" in fragment) {
+    delete fragment.provider_connection;
+  }
+  if (
+    typeof fragment.model !== "string" ||
+    !CODEX_SUBSCRIPTION_MODEL_IDS.has(fragment.model)
+  ) {
+    fragment.model = FALLBACK_CODEX_MODEL;
+  }
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}