@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/workspace/byok-default-profile-ensure.ts

@@ -18,6 +18,7 @@ import {
   type LLMProvider,
   type ProfileEntry,
 } from "../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
 import { getLogger } from "../util/logger.js";
 import { completedProfileBody } from "./custom-profile-ensure.js";
 
@@ -135,10 +136,26 @@ const ERA_COPY_LABEL_SUFFIX = " (Custom Provider)";
 /**
  * Comparison ignores `label` and `status` (user overlay state, preserved via
  * `userOverlayState`) and `model` (checked separately against the current
- * intent resolution and `HISTORICAL_INTENT_MODELS`).
+ * intent resolution and `HISTORICAL_INTENT_MODELS`). The CONVENTIONAL
+ * `<vendor>-personal` binding is normalized away before comparison (it was
+ * machinery-written across several eras); a non-conventional binding is a
+ * user selection and keeps blocking conversion.
  */
 const IGNORED_COMPARISON_KEYS = new Set(["label", "status", "model"]);
 
+/**
+ * Fold the conventional personal entry name back to its vendor. The entries
+ * collapse (migration 145) rewrites a hatch copy's binding into its
+ * provider as `<vendor>-personal`; the matcher folds that shape so every
+ * era of stored copy keeps converting (the same discipline as
+ * `HISTORICAL_INTENT_MODELS`).
+ */
+function foldPersonalEntryName(provider: string): string {
+  return provider.endsWith("-personal")
+    ? provider.slice(0, -"-personal".length)
+    : provider;
+}
+
 /**
  * Per-provider model ids that earlier intent eras pinned onto `custom-*`
  * copies, verified against `providers/model-intents.ts` git history. Hatch
@@ -146,9 +163,10 @@ const IGNORED_COMPARISON_KEYS = new Set(["label", "status", "model"]);
  * 2026-05-05, #29755), and the profile-model migrations (100, 103, 109, 113,
  * 123) deliberately rewrite only the managed default entries (`custom-*` is
  * the user's to manage), so an untouched copy still carries whichever value
- * its hatch-era intent resolved to. Migration 136 is the one exception: it
- * rewrote kimi-k2p5 pins (`custom-*` included) to deepseek-v4-flash in
- * place. A model listed here counts as unedited only when every non-model
+ * its hatch-era intent resolved to. Migrations 136 and 146 are the
+ * exceptions: they rewrite stale Fireworks pins (`custom-*` included) in
+ * place, so their targets are machinery-authored values too. A model listed
+ * here counts as unedited only when every non-model
  * field still matches the template.
  */
 const HISTORICAL_INTENT_MODELS: Record<
@@ -156,6 +174,10 @@ const HISTORICAL_INTENT_MODELS: Record<
   Partial<Record<string, readonly string[]>>
 > = {
   balanced: {
+    openai: [
+      // balanced intent 2026-05-05 (#29755) to the 2026-08-10 gpt-5.6 repoint.
+      "gpt-5.4-mini",
+    ],
     fireworks: [
       // balanced intent 2026-05-05 (#29755) to 2026-05-19 (#31068).
       "accounts/fireworks/models/kimi-k2p5",
@@ -163,9 +185,15 @@ const HISTORICAL_INTENT_MODELS: Record<
       "accounts/fireworks/models/kimi-k2p6",
       // migration 136's in-place rewrite of a kimi-k2p5 pin.
       "accounts/fireworks/models/deepseek-v4-flash",
+      // the ID migration 146 writes over stale deepseek-v4-flash pins.
+      "accounts/fireworks/models/deepseek-v4-flash-0731",
     ],
   },
   "quality-optimized": {
+    openai: [
+      // quality intent 2026-05-05 (#29755) to the 2026-08-10 gpt-5.6 repoint.
+      "gpt-5.4",
+    ],
     anthropic: [
       // quality intent 2026-05-05 (#29755) to 2026-06-11 (#34498).
       "claude-opus-4-7",
@@ -183,6 +211,8 @@ const HISTORICAL_INTENT_MODELS: Record<
       "accounts/fireworks/models/kimi-k2p5",
       // migration 136's in-place rewrite of a kimi-k2p5 pin.
       "accounts/fireworks/models/deepseek-v4-flash",
+      // the ID migration 146 writes over stale deepseek-v4-flash pins.
+      "accounts/fireworks/models/deepseek-v4-flash-0731",
     ],
   },
   "cost-optimized": {
@@ -196,10 +226,14 @@ const HISTORICAL_INTENT_MODELS: Record<
     ],
     fireworks: [
       // latency intent 2026-05-05 (#29755) to 2026-07-28 (#39446). On live
-      // configs migration 136 rewrote it to deepseek-v4-flash (the current
-      // intent), so this survives only in configs restored from pre-136
-      // backups.
+      // configs migration 136 rewrites it to deepseek-v4-flash, so this
+      // survives only in configs restored from pre-136 backups.
       "accounts/fireworks/models/kimi-k2p5",
+      // latency intent 2026-07-28 (#39446) to the 2026-08-17 dated-ID
+      // repoint; also the ID migration 136 writes. On live configs migration
+      // 146 rewrites it to the dated ID, so this survives only in pre-146
+      // backups.
+      "accounts/fireworks/models/deepseek-v4-flash",
     ],
   },
 };
@@ -259,11 +293,13 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
   const completionBase = LLMConfigBase.safeParse(llm.default ?? {}).data;
 
   // The default provider on a BYOK default, or the uniform hatch provider
-  // across the complete copy set on a vellum default; null converts nothing.
-  const candidateProvider =
-    parsedDefault.data.provider !== "vellum"
-      ? parsedDefault.data.provider
-      : uniformCopyProvider(profiles);
+  // across the complete copy set on a routing-identity default (vellum,
+  // chatgpt); null converts nothing.
+  const candidateProvider = ROUTING_IDENTITY_PROVIDERS.has(
+    parsedDefault.data.provider,
+  )
+    ? uniformCopyProvider(profiles)
+    : parsedDefault.data.provider;
   const convertibleProvider =
     candidateProvider !== null && isByokDefaultProviderChoice(candidateProvider)
       ? candidateProvider
@@ -339,7 +375,11 @@ function isKnownUneditedBody(
   // (hatch materialized it once; the default provider may have changed
   // since); equality with the corroborated provider rules out a user
   // re-provision.
-  if (convertibleProvider === null || entry.provider !== convertibleProvider) {
+  if (
+    convertibleProvider === null ||
+    typeof entry.provider !== "string" ||
+    foldPersonalEntryName(entry.provider) !== convertibleProvider
+  ) {
     return false;
   }
   const copyProvider = convertibleProvider;
@@ -347,11 +387,13 @@ function isKnownUneditedBody(
   if (template === undefined) {
     return false;
   }
-  const materialized = materializeProfile(
-    template,
-    copyProvider,
-    `${copyProvider}-personal`,
-  ) as Record<string, unknown>;
+  // No connection binding: the bare provider means the default entry of
+  // that kind, and a stamped binding would re-introduce the collapsed
+  // field on disk.
+  const materialized = materializeProfile(template, copyProvider) as Record<
+    string,
+    unknown
+  >;
   if (
     entry.model !== materialized.model &&
     !(HISTORICAL_INTENT_MODELS[key][copyProvider] ?? []).includes(entry.model)
@@ -361,11 +403,20 @@ function isKnownUneditedBody(
   // Completion skips managed-source bodies, so a copy from the era whose
   // templates wrote `source: "managed"` (#29755 to #29768, 2026-05-05) is
   // compared as if user-source to keep both sides normalized identically.
+  const normalizedEntry: Record<string, unknown> = {
+    ...entry,
+    provider: copyProvider,
+    ...(entry.source === "managed" ? { source: "user" } : {}),
+  };
+  // The conventional personal binding is machinery-written (hatch stamps,
+  // completion re-stamps); normalize it away. Any other binding is user
+  // state and stays in the comparison, where the unbound template side
+  // makes it block conversion.
+  if (normalizedEntry.provider_connection === `${copyProvider}-personal`) {
+    delete normalizedEntry.provider_connection;
+  }
   const body = comparableBody(
-    withCompletionBaked(
-      entry.source === "managed" ? { ...entry, source: "user" } : entry,
-      completionBase,
-    ),
+    withCompletionBaked(normalizedEntry, completionBase),
   );
   const known = comparableBody(
     withCompletionBaked(materialized, completionBase),
@@ -392,9 +443,10 @@ function uniformCopyProvider(profiles: Record<string, unknown>): string | null {
     if (typeof entry.provider !== "string") {
       return null;
     }
+    const entryProvider = foldPersonalEntryName(entry.provider);
     if (provider === null) {
-      provider = entry.provider;
-    } else if (provider !== entry.provider) {
+      provider = entryProvider;
+    } else if (provider !== entryProvider) {
       return null;
     }
   }

package/src/workspace/custom-profile-ensure.ts

@@ -3,7 +3,10 @@ import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 import { invalidateConfigCache } from "../config/loader.js";
-import { completeCustomProfile } from "../config/profile-materialization.js";
+import {
+  completeCustomProfile,
+  mergePreservingUnknownKeys,
+} from "../config/profile-materialization.js";
 import { LLMConfigBase, ProfileEntry } from "../config/schemas/llm.js";
 import { getLogger } from "../util/logger.js";
 
@@ -113,29 +116,6 @@ export function completedProfileBody(
   );
 }
 
-/**
- * `{...raw, ...completed}` recursively: completed (schema-known) values win,
- * raw keys the schema stripped survive at every depth. (Duplicated in the
- * write-path normalization in conversation-query-routes.ts — the two land in
- * independent PRs; consolidate when either next changes.)
- */
-function mergePreservingUnknownKeys(
-  raw: Record<string, unknown>,
-  completed: Record<string, unknown>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw, ...completed };
-  for (const [key, value] of Object.entries(completed)) {
-    const rawValue = raw[key];
-    if (readObject(value) !== null && readObject(rawValue) !== null) {
-      out[key] = mergePreservingUnknownKeys(
-        rawValue as Record<string, unknown>,
-        value as Record<string, unknown>,
-      );
-    }
-  }
-  return out;
-}
-
 function readObject(value: unknown): Record<string, unknown> | null {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return null;

package/src/workspace/migrations/142-consolidate-voice-front-door.ts

@@ -0,0 +1,70 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+const OLD_CALLSITE = "voiceFrontDecision";
+const PROGRESS_CALLSITE = "voiceProgressNarration";
+const RETIRED_ACK_KEYS = [
+  "ackFirstDeltaTimeoutMs",
+  "ackGenerationTimeoutMs",
+] as const;
+
+export const consolidateVoiceFrontDoorMigration: WorkspaceMigration = {
+  id: "142-consolidate-voice-front-door",
+  description:
+    "Rename the progress narration callsite and remove retired generated-ack tuning",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    let changed = false;
+    const llm = readObject(config.llm);
+    const callSites = readObject(llm?.callSites);
+    if (callSites && Object.hasOwn(callSites, OLD_CALLSITE)) {
+      if (!Object.hasOwn(callSites, PROGRESS_CALLSITE)) {
+        callSites[PROGRESS_CALLSITE] = callSites[OLD_CALLSITE];
+      }
+      delete callSites[OLD_CALLSITE];
+      changed = true;
+    }
+
+    const liveVoice = readObject(config.liveVoice);
+    const frontModel = readObject(liveVoice?.frontModel);
+    if (frontModel) {
+      for (const key of RETIRED_ACK_KEYS) {
+        if (Object.hasOwn(frontModel, key)) {
+          delete frontModel[key];
+          changed = true;
+        }
+      }
+    }
+
+    if (changed) {
+      writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    }
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/143-repair-deprecated-codex-model-id.ts

@@ -0,0 +1,134 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair the deprecated `gpt-5.3-codex` model ID on ChatGPT-subscription
+ * config fragments.
+ *
+ * OpenAI deprecated `gpt-5.3-codex` under ChatGPT sign-in (the Codex
+ * endpoint rejects it with HTTP 400), so it is being removed from
+ * `CODEX_SUBSCRIPTION_MODEL_IDS`. A workspace can still pin it on
+ * `provider: "chatgpt"` fragments (migration 133 wrote exactly that shape
+ * for `chatgpt-subscription` entries), and once the ID leaves the allowlist,
+ * `LLMSchema.superRefine` rejects such a fragment. The loader's leaf
+ * recovery then deletes the fragment's `model`, which still fails ("chatgpt"
+ * requires an explicit model), and per-section salvage resets the whole
+ * `llm` section, discarding the user's other LLM settings.
+ *
+ * Repair rewrites the model to `gpt-5.6-terra` (OpenAI's recommended
+ * everyday Codex model) on an exact `provider: "chatgpt"` + model match in
+ * `llm.default`, `llm.callSites.*`, and `llm.profiles.*`. A call-site
+ * fragment is also repaired when it pins the model with no provider of its
+ * own: at resolve time such a fragment overlays the winning profile, so the
+ * stale pin rides whatever provider and connection the winner supplies
+ * (including the subscription connection, which routes it to the Codex
+ * endpoint). Fragments with any other explicit provider are left untouched:
+ * the allowlist only gates the "chatgpt" routing identity, and a provider
+ * like `openai-compatible` may legitimately serve this id.
+ */
+export const repairDeprecatedCodexModelIdMigration: WorkspaceMigration = {
+  id: "143-repair-deprecated-codex-model-id",
+  description:
+    'Repair deprecated gpt-5.3-codex model ID on provider "chatgpt" fragments in workspace LLM config',
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    // Read outside the parse catch: a transient filesystem error (EIO,
+    // EACCES) must reach the runner so the migration retries, while
+    // malformed JSON is a permanent state this migration cannot repair.
+    const rawText = readFileSync(configPath, "utf-8");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(rawText);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default)) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed =
+          repairFragment(readObject(rawConfig), {
+            repairMissingProvider: true,
+          }) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile)) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    // Write-then-rename so an interrupted write cannot leave config.json
+    // truncated: a torn in-place write would parse as invalid JSON on the
+    // retry, which the catch above treats as "nothing to do", letting the
+    // runner checkpoint the migration as completed against a corrupt file.
+    const tmpPath = `${configPath}.migration-143.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+  },
+  // The exact-match rewrite is idempotent, so a transient failure (full
+  // disk, I/O error) is safe to retry on later startups.
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the deprecated model ID would fail schema
+    // validation once the allowlist no longer carries it.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const DEPRECATED_MODEL_ID = "gpt-5.3-codex";
+const REPLACEMENT_MODEL_ID = "gpt-5.6-terra";
+
+function repairFragment(
+  fragment: Record<string, unknown> | null,
+  options?: { repairMissingProvider?: boolean },
+): boolean {
+  if (fragment === null || fragment.model !== DEPRECATED_MODEL_ID) {
+    return false;
+  }
+  const providerRepairable =
+    fragment.provider === "chatgpt" ||
+    (options?.repairMissingProvider === true &&
+      fragment.provider === undefined);
+  if (!providerRepairable) {
+    return false;
+  }
+  fragment.model = REPLACEMENT_MODEL_ID;
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}