@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/workspace/migrations/150-stt-flux-provider-to-model-family.ts

@@ -0,0 +1,139 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Fold the Flux provider ids back into their parent plus a model family.
+ *
+ * Flux shipped as its own `services.stt.provider` value, which made a model
+ * choice look like a provider choice. That cost an entry in the provider
+ * enum, a row in every settings picker, and a place in each
+ * managed-versus-BYOK predicate for a backend that shares its parent's
+ * credential and account. Model families now live where the rest of a
+ * provider's settings do:
+ *
+ *   provider: "deepgram-flux"  ->  provider: "deepgram"
+ *                                  providers.deepgram.model: "flux"
+ *
+ * The same rewrite applies to the managed pair. Any other provider value is
+ * left untouched, and an existing `providers.<parent>` entry keeps every key
+ * it already had.
+ *
+ * The same pass drops any `providers.<id>.model` a known provider cannot
+ * serve. That key was free-form before this change and read by nothing, so
+ * existing values carry no meaning, but the schema validates it now: leaving
+ * a stale one behind would fail the parse and drop the workspace onto the
+ * loader's salvage path, which resets the entire `services` section and takes
+ * unrelated STT and TTS settings with it.
+ *
+ * Idempotent: a config already naming a parent provider has nothing to
+ * rewrite, and a model key already naming a family it can serve is left
+ * alone.
+ */
+const FLUX_PROVIDER_PARENTS: Record<string, string> = {
+  "deepgram-flux": "deepgram",
+  "vellum-flux": "vellum",
+};
+
+/**
+ * The model families each provider served when this migration was written,
+ * inlined rather than read from the provider catalog.
+ *
+ * A published migration has to behave identically every time it runs, and it
+ * reruns on newly initialized workspaces and after an interrupted checkpoint.
+ * Reading the live catalog would let a later change to it alter what this
+ * migration deletes from configs it has already seen.
+ */
+const KNOWN_MODEL_FAMILIES: Record<string, readonly string[]> = {
+  deepgram: ["nova-3", "flux"],
+  vellum: ["nova-3", "flux"],
+};
+
+export const sttFluxProviderToModelFamilyMigration: WorkspaceMigration = {
+  id: "150-stt-flux-provider-to-model-family",
+  description:
+    "Rewrite services.stt.provider Flux ids to the parent provider plus providers.<id>.model",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      config = JSON.parse(readFileSync(configPath, "utf8")) as Record<
+        string,
+        unknown
+      >;
+    } catch {
+      // A config that does not parse is the loader's problem to report, not
+      // this migration's to guess at.
+      return;
+    }
+
+    const services = asRecord(config.services);
+    const stt = asRecord(services?.stt);
+    if (!stt || typeof stt.provider !== "string") {
+      return;
+    }
+
+    const providers = asRecord(stt.providers) ?? {};
+    let changed = dropUnservableModels(providers);
+
+    const parent = FLUX_PROVIDER_PARENTS[stt.provider];
+    if (parent !== undefined) {
+      stt.provider = parent;
+      const parentSettings = asRecord(providers[parent]) ?? {};
+      parentSettings.model = "flux";
+      providers[parent] = parentSettings;
+      changed = true;
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    stt.providers = providers;
+    writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: the Flux provider ids are gone from the config enum, so
+    // restoring one would produce a config the schema rejects.
+  },
+};
+
+/**
+ * Remove `model` values a provider known at the time of writing cannot serve.
+ * Entries for any other provider are left untouched: that map is deliberately
+ * open to ids from future builds, and the schema does not validate them
+ * either.
+ */
+function dropUnservableModels(providers: Record<string, unknown>): boolean {
+  let changed = false;
+  for (const [providerId, value] of Object.entries(providers)) {
+    const settings = asRecord(value);
+    if (!settings || settings.model === undefined) {
+      continue;
+    }
+    const families = KNOWN_MODEL_FAMILIES[providerId];
+    if (families === undefined) {
+      continue;
+    }
+    if (
+      typeof settings.model !== "string" ||
+      !families.includes(settings.model)
+    ) {
+      delete settings.model;
+      changed = true;
+    }
+  }
+  return changed;
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}

package/src/workspace/migrations/__tests__/150-stt-flux-provider-to-model-family.test.ts

@@ -0,0 +1,160 @@
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { sttFluxProviderToModelFamilyMigration } from "../150-stt-flux-provider-to-model-family.js";
+import { WORKSPACE_MIGRATIONS } from "../registry.js";
+
+function workspaceWith(config: unknown): string {
+  const dir = mkdtempSync(join(tmpdir(), "stt-flux-migration-"));
+  writeFileSync(join(dir, "config.json"), JSON.stringify(config, null, 2));
+  return dir;
+}
+
+function readConfig(dir: string): any {
+  return JSON.parse(readFileSync(join(dir, "config.json"), "utf8"));
+}
+
+describe("150-stt-flux-provider-to-model-family", () => {
+  test("is registered as the newest migration", () => {
+    expect(sttFluxProviderToModelFamilyMigration.id).toBe(
+      "150-stt-flux-provider-to-model-family",
+    );
+    expect(WORKSPACE_MIGRATIONS.at(-1)?.id).toBe(
+      "150-stt-flux-provider-to-model-family",
+    );
+  });
+
+  test("rewrites a Flux provider id to its parent plus a model family", () => {
+    const dir = workspaceWith({
+      services: { stt: { provider: "deepgram-flux", providers: {} } },
+    });
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir).services.stt).toEqual({
+      provider: "deepgram",
+      providers: { deepgram: { model: "flux" } },
+    });
+  });
+
+  test("rewrites the managed pair the same way", () => {
+    const dir = workspaceWith({
+      services: { stt: { provider: "vellum-flux", providers: {} } },
+    });
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir).services.stt.provider).toBe("vellum");
+    expect(readConfig(dir).services.stt.providers.vellum.model).toBe("flux");
+  });
+
+  test("keeps existing settings on the parent's entry", () => {
+    const dir = workspaceWith({
+      services: {
+        stt: {
+          provider: "deepgram-flux",
+          providers: { deepgram: { someExistingKey: 1 } },
+        },
+      },
+    });
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir).services.stt.providers.deepgram).toEqual({
+      someExistingKey: 1,
+      model: "flux",
+    });
+  });
+
+  test("drops a model a known provider cannot serve", () => {
+    // That key was free-form and read by nothing before this change, so an
+    // existing value is meaningless -- but the schema validates it now, and
+    // leaving one behind drops the workspace onto the loader's salvage path,
+    // which resets the whole services section.
+    const dir = workspaceWith({
+      services: {
+        stt: {
+          provider: "deepgram",
+          providers: { deepgram: { model: "nova-2", keepMe: true } },
+        },
+      },
+    });
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir).services.stt.providers.deepgram).toEqual({
+      keepMe: true,
+    });
+  });
+
+  test("keeps a model the provider can serve", () => {
+    const dir = workspaceWith({
+      services: {
+        stt: {
+          provider: "deepgram",
+          providers: { deepgram: { model: "flux" } },
+        },
+      },
+    });
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir).services.stt.providers.deepgram.model).toBe("flux");
+  });
+
+  test("leaves entries for providers the catalog does not know", () => {
+    // The map is deliberately open to ids from future builds, and the schema
+    // does not validate those either.
+    const before = {
+      services: {
+        stt: {
+          provider: "deepgram",
+          providers: { "future-provider": { model: "next-gen" } },
+        },
+      },
+    };
+    const dir = workspaceWith(before);
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir)).toEqual(before);
+  });
+
+  test("leaves a non-Flux provider untouched", () => {
+    const before = {
+      services: { stt: { provider: "deepgram", providers: {} } },
+    };
+    const dir = workspaceWith(before);
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir)).toEqual(before);
+  });
+
+  test("is idempotent", () => {
+    const dir = workspaceWith({
+      services: { stt: { provider: "deepgram-flux", providers: {} } },
+    });
+
+    sttFluxProviderToModelFamilyMigration.run(dir);
+    const once = readConfig(dir);
+    sttFluxProviderToModelFamilyMigration.run(dir);
+
+    expect(readConfig(dir)).toEqual(once);
+  });
+
+  test("does nothing without a config file, or with an unparseable one", () => {
+    const empty = mkdtempSync(join(tmpdir(), "stt-flux-migration-"));
+    expect(() =>
+      sttFluxProviderToModelFamilyMigration.run(empty),
+    ).not.toThrow();
+
+    const broken = mkdtempSync(join(tmpdir(), "stt-flux-migration-"));
+    writeFileSync(join(broken, "config.json"), "{not json");
+    expect(() =>
+      sttFluxProviderToModelFamilyMigration.run(broken),
+    ).not.toThrow();
+  });
+});

package/src/workspace/migrations/registry.ts

@@ -144,6 +144,10 @@ import { repairDeprecatedCodexModelIdMigration } from "./143-repair-deprecated-c
 import { convertStrandedSubscriptionOpenaiProfilesMigration } from "./144-convert-stranded-subscription-openai-profiles.js";
 import { collapseProfileBindingsToEntriesMigration } from "./145-collapse-profile-bindings-to-entries.js";
 import { repairRetiredFireworksDeepseekFlashModelIdMigration } from "./146-repair-retired-fireworks-deepseek-flash-model-id.js";
+import { renameCollidingBackupProfileNamesMigration } from "./147-rename-colliding-backup-profile-names.js";
+import { stripUnsupportedFallbackProfilesMigration } from "./148-strip-unsupported-fallback-profiles.js";
+import { repointBackupProfileSelectionsMigration } from "./149-repoint-backup-profile-selections.js";
+import { sttFluxProviderToModelFamilyMigration } from "./150-stt-flux-provider-to-model-family.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -303,4 +307,8 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   convertStrandedSubscriptionOpenaiProfilesMigration,
   collapseProfileBindingsToEntriesMigration,
   repairRetiredFireworksDeepseekFlashModelIdMigration,
+  renameCollidingBackupProfileNamesMigration,
+  stripUnsupportedFallbackProfilesMigration,
+  repointBackupProfileSelectionsMigration,
+  sttFluxProviderToModelFamilyMigration,
 ];

package/src/__tests__/permission-types.test.ts

@@ -1,17 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-import { isAllowDecision } from "../permissions/types.js";
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("isAllowDecision", () => {
-  test("returns true for 'allow'", () => {
-    expect(isAllowDecision("allow")).toBe(true);
-  });
-
-  test("returns false for 'deny'", () => {
-    expect(isAllowDecision("deny")).toBe(false);
-  });
-});

package/src/channels/gateway-discord-admission.ts

@@ -1,32 +0,0 @@
-/**
- * Daemon-side reader for how much Discord admits.
- *
- * The gateway owns the allow-list and the drop decision it feeds; the
- * readiness surface that reports channel setup to the user lives here. This is
- * the relay between them, and it exists for the same reason the socket-health
- * relay does: the fact lives on one side of the boundary and is reported from
- * the other.
- */
-
-import {
-  type DiscordAdmissionIpcResponse,
-  DiscordAdmissionIpcResponseSchema,
-} from "@vellumai/gateway-client/gateway-ipc-contracts";
-
-import { ipcCallPersistentValidated } from "../ipc/gateway-validated-call.js";
-
-/**
- * Ask the gateway how many channels Discord's allow-list admits.
- *
- * Throws on transport failure rather than reporting zero: an unreachable
- * gateway is a fact about the gateway, and answering zero would tell an
- * operator their allow-list is empty when nobody looked. Callers treat a throw
- * as indeterminate.
- */
-export async function readDiscordAdmission(): Promise<DiscordAdmissionIpcResponse> {
-  return ipcCallPersistentValidated(
-    "discord_admission",
-    {},
-    DiscordAdmissionIpcResponseSchema,
-  );
-}

package/src/persistence/fork-message-copy.ts

@@ -1,239 +0,0 @@
-// ---------------------------------------------------------------------------
-// Fork message-copy — off-event-loop bulk copy of a conversation's messages.
-// ---------------------------------------------------------------------------
-//
-// The fork-based memory retrospective copies the visible tail of the source
-// conversation's message rows (rows at-or-after the inherited compaction
-// boundary) into a throwaway background conversation. Done in-process via
-// `bun:sqlite` (synchronous), that copy is the single longest uninterruptible
-// block on the daemon's event loop — on a multi-GB database it pegs the CPU
-// for minutes, stalling `/healthz` and the gateway's IPC calls (see the
-// runtime-freeze investigation).
-//
-// This module moves the message-row copy off the event loop via
-// {@link runAsyncSqlite}, which runs the statements in a `sqlite3` CLI
-// subprocess (its own connection; SQLite file-locking arbitrates with the
-// in-process handle). The content/metadata never round-trip through JS — they
-// are copied SELECT→INSERT inside SQLite — so there is no string-escaping
-// hazard and the heavy bytes stay in the database.
-//
-// Two properties matter for correctness:
-//
-//   1. **Lock-friendly batching.** The main connection runs `busy_timeout=5000`
-//      (`db-connection.ts`). A single `INSERT … SELECT` over the whole history
-//      is one implicit transaction that holds the write lock for its full
-//      duration — a concurrent in-process write (a live user turn persisting a
-//      message) would then block up to 5 s and throw `SQLITE_BUSY`. So the copy
-//      is split into batches that each auto-commit, releasing the lock between
-//      batches so in-process writers slip in.
-//
-//   2. **`cloneForkMessageMetadata` parity.** The in-process fork stamps
-//      `forkSourceMessageId` onto each copied row's metadata. The SQL `CASE`
-//      below is a faithful translation of that helper's three branches
-//      (object → preserve-or-stamp; null/non-object/invalid → fresh object).
-//      `client_message_id` is intentionally NOT copied, matching the
-//      in-process fork (a forked row is not a client-submitted message).
-
-import { setTimeout as sleep } from "node:timers/promises";
-
-import { BULK_BATCH_TIMEOUT_MS, withBulkWriteGate } from "./bulk-write-gate.js";
-import {
-  type AsyncSqliteBackend,
-  type AsyncSqliteResult,
-  runAsyncSqlite,
-} from "./db-async-query.js";
-
-/**
- * Default batch size for the chunked copy. Each batch is one `INSERT … SELECT`
- * that auto-commits, so this bounds how long the subprocess holds the write
- * lock before releasing it to in-process writers. Kept small so the worst-case
- * wait for a contending foreground write is one short batch, even on a bloated
- * database; per-batch statement overhead stays negligible against the row copy
- * and fork latency doesn't matter (nobody waits on a background fork).
- */
-export const DEFAULT_FORK_COPY_BATCH_SIZE = 50;
-
-/**
- * Pause inserted between batch subprocess calls. Without it the copy releases
- * the write lock on each batch's auto-commit but greedily re-acquires it
- * microseconds later, so a concurrent in-process writer (a live user turn
- * persisting a message) can lose every race. A brief yield lets foreground
- * writes reliably slip in between batches. The extra fork latency is free —
- * nothing waits on a background fork — so we trade copy speed for foreground
- * fairness.
- */
-export const DEFAULT_FORK_COPY_INTER_BATCH_DELAY_MS = 25;
-
-/**
- * A single source→fork message-id mapping. `oldId` is an existing source
- * message id; `newId` is the freshly-generated id the fork row will carry.
- * Generated by the caller (in JS) so the same map drives both this copy and
- * the in-process attachment relink that follows.
- */
-export interface ForkIdPair {
-  oldId: string;
-  newId: string;
-}
-
-export interface CopyForkMessagesOptions {
-  /** The fork conversation id every copied row is assigned to. */
-  forkConversationId: string;
-  /** Ordered source→fork id pairs for every message to copy. */
-  idPairs: readonly ForkIdPair[];
-  /** Override the per-batch row count (see {@link DEFAULT_FORK_COPY_BATCH_SIZE}). */
-  batchSize?: number;
-  /** Test-only passthrough to force the in-process backend. */
-  forceInProcess?: boolean;
-}
-
-// Server-generated ids only ever use this charset. We interpolate ids (never
-// message content) into the SQL script, so reject anything outside it as a
-// defense-in-depth guard against a malformed id breaking out of the literal.
-const SAFE_ID = /^[A-Za-z0-9_-]{1,64}$/;
-
-function assertSafeId(id: string): void {
-  if (!SAFE_ID.test(id)) {
-    throw new Error(
-      `fork message-copy: unsafe id literal: ${JSON.stringify(id)}`,
-    );
-  }
-}
-
-/**
- * SQL translation of `cloneForkMessageMetadata`. `m` is the source `messages`
- * row alias; the stamped value is the SOURCE message id (`m.id`), preserving an
- * existing `forkSourceMessageId` when the metadata is already an object.
- */
-const METADATA_CLONE_EXPR = `CASE
-  WHEN json_valid(m.metadata) AND json_type(m.metadata) = 'object'
-    THEN json_set(m.metadata, '$.forkSourceMessageId',
-      coalesce(json_extract(m.metadata, '$.forkSourceMessageId'), m.id))
-  ELSE json_object('forkSourceMessageId', m.id)
-END`;
-
-/**
- * Build the multi-statement SQL script that copies the given id pairs into the
- * fork conversation in lock-friendly batches. Exported for unit testing the
- * generated SQL without spawning a subprocess.
- */
-export function buildForkCopyScript(options: CopyForkMessagesOptions): string {
-  const { forkConversationId, idPairs } = options;
-  assertSafeId(forkConversationId);
-  const batchSize = Math.max(
-    1,
-    options.batchSize ?? DEFAULT_FORK_COPY_BATCH_SIZE,
-  );
-
-  const statements: string[] = [
-    // Connection-scoped staging table holding the current batch's id map. The
-    // unqualified `messages` reference in the SELECT resolves to the main DB.
-    `CREATE TEMP TABLE IF NOT EXISTS _fork_id_map (old_id TEXT PRIMARY KEY, new_id TEXT NOT NULL);`,
-  ];
-
-  for (let i = 0; i < idPairs.length; i += batchSize) {
-    const batch = idPairs.slice(i, i + batchSize);
-    const values = batch
-      .map(({ oldId, newId }) => {
-        assertSafeId(oldId);
-        assertSafeId(newId);
-        return `('${oldId}','${newId}')`;
-      })
-      .join(",");
-
-    // Each batch auto-commits (no surrounding BEGIN), so the write lock is
-    // released between batches for in-process writers.
-    statements.push(`DELETE FROM _fork_id_map;`);
-    statements.push(
-      `INSERT INTO _fork_id_map (old_id, new_id) VALUES ${values};`,
-    );
-    statements.push(
-      `INSERT INTO messages (id, conversation_id, role, content, created_at, metadata)
-SELECT map.new_id, '${forkConversationId}', m.role, m.content, m.created_at, ${METADATA_CLONE_EXPR}
-FROM messages m JOIN _fork_id_map map ON map.old_id = m.id;`,
-    );
-  }
-
-  // Drop the staging table so the in-process fallback (which runs on the shared
-  // daemon connection) does not leave it lingering; harmless for the subprocess
-  // backend, whose connection is discarded on exit.
-  statements.push(`DROP TABLE IF EXISTS _fork_id_map;`);
-
-  return statements.join("\n");
-}
-
-/**
- * Copy the message rows for a fork off the event loop, in lock-friendly
- * batches. Each batch runs as its own subprocess call with a brief yield in
- * between (see {@link DEFAULT_FORK_COPY_INTER_BATCH_DELAY_MS}) so foreground
- * writers reliably acquire the write lock between batches instead of losing
- * every race to the copy's greedy lock re-acquisition. The whole batch stream
- * runs under the process-wide {@link withBulkWriteGate} so two copies (or a
- * copy and a batched delete) never convoy on the write lock — and the yields
- * go to foreground writers, not a sibling bulk stream. Resolves once every
- * batch has committed (or returns the failing batch's `ok: false` result on
- * subprocess failure — the caller is responsible for cleaning up the
- * partially-built fork).
- *
- * No-op (returns a synthetic ok result) when there is nothing to copy.
- */
-export async function copyForkMessagesViaSubprocess(
-  options: CopyForkMessagesOptions,
-): Promise<AsyncSqliteResult> {
-  if (options.idPairs.length === 0) {
-    return {
-      ok: true,
-      backend: "in-process-blocking",
-      error: null,
-      elapsedMs: 0,
-    };
-  }
-
-  return await withBulkWriteGate(
-    `fork-message-copy:${options.forkConversationId}`,
-    () => copyBatches(options),
-  );
-}
-
-async function copyBatches(
-  options: CopyForkMessagesOptions,
-): Promise<AsyncSqliteResult> {
-  const batchSize = Math.max(
-    1,
-    options.batchSize ?? DEFAULT_FORK_COPY_BATCH_SIZE,
-  );
-  const runOptions = options.forceInProcess
-    ? { forceBackend: "in-process-blocking" as const }
-    : {};
-
-  let totalElapsedMs = 0;
-  let backend: AsyncSqliteBackend = "in-process-blocking";
-
-  for (let i = 0; i < options.idPairs.length; i += batchSize) {
-    const batch = options.idPairs.slice(i, i + batchSize);
-    // One subprocess call per batch. Each generated script is self-contained
-    // (it creates and drops its own staging table), so splitting execution
-    // across calls is safe — and it's what lets us yield between batches below.
-    const sql = buildForkCopyScript({
-      forkConversationId: options.forkConversationId,
-      idPairs: batch,
-      batchSize,
-    });
-    const result = await runAsyncSqlite(
-      sql,
-      `fork-message-copy:copy-batch:${options.forkConversationId}`,
-      { ...runOptions, timeoutMs: BULK_BATCH_TIMEOUT_MS },
-    );
-    totalElapsedMs += result.elapsedMs;
-    backend = result.backend;
-    if (!result.ok) {
-      return { ...result, elapsedMs: totalElapsedMs };
-    }
-
-    const isLastBatch = i + batchSize >= options.idPairs.length;
-    if (!isLastBatch) {
-      await sleep(DEFAULT_FORK_COPY_INTER_BATCH_DELAY_MS);
-    }
-  }
-
-  return { ok: true, backend, error: null, elapsedMs: totalElapsedMs };
-}