@vellumai/assistant 0.12.0 → 0.12.1-dev.202609141913.5e16607

package/src/workspace/migrations/154-repair-retired-codex-gpt-5-4-model-ids.ts

@@ -0,0 +1,258 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair `gpt-5.4` and `gpt-5.4-mini` pins on fragments that dispatch
+ * through the ChatGPT subscription.
+ *
+ * OpenAI serves neither model under ChatGPT sign-in: the Codex endpoint
+ * rejects them with HTTP 400 ("not supported when using Codex with a
+ * ChatGPT account"), so both are out of `CODEX_SUBSCRIPTION_MODEL_IDS`.
+ * API-key access is unaffected, so a fragment on any other route keeps
+ * its model.
+ *
+ * Two stored shapes dispatch through the subscription. The `chatgpt`
+ * routing identity fails `LLMSchema.superRefine` once the allowlist drops
+ * the model, and the loader's per-section salvage then resets the whole
+ * `llm` section, losing every profile and call-site tuning: this is the
+ * repair that prevents data loss. A profile bound to the subscription row
+ * (row kind `chatgpt`, or an `oauth_subscription` auth on the
+ * pre-DB-migration-366 row shape) bypasses the auto-resolution compat
+ * gate and 400s on every request; the row is named by the legacy
+ * `provider_connection` binding when present (dispatch honors it first,
+ * and the name is only ever a row name), otherwise by an entry-name
+ * `provider`. Both shapes are swept in `llm.default`, `llm.callSites.*`,
+ * and `llm.profiles.*`; call-site fragments carry no binding (the schema
+ * strips a raw `provider_connection`), so only their declared provider
+ * counts.
+ *
+ * A providerless call-site pin is deliberately left alone. It overlays
+ * whichever profile wins the site for a turn: on an API-key or managed
+ * winner it still serves the model, and on a subscription winner the
+ * request already fails upstream and keeps failing, with no config loss
+ * either way. Rewriting such pins would change API-key users' model and
+ * price to cover a winner that may never be selected.
+ *
+ * Replacements: `gpt-5.4` becomes `gpt-5.5` (its successor) and
+ * `gpt-5.4-mini` becomes `gpt-5.6-luna` (the subscription's Balanced model;
+ * on the subscription every model bills the same).
+ */
+export const repairRetiredCodexGpt54ModelIdsMigration: WorkspaceMigration = {
+  id: "154-repair-retired-codex-gpt-5-4-model-ids",
+  description:
+    "Repair gpt-5.4 and gpt-5.4-mini pins on ChatGPT-subscription LLM fragments in workspace config",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    // Read outside the parse catch: a transient filesystem error (EIO,
+    // EACCES) must reach the runner so the migration retries, while
+    // malformed JSON is a permanent state this migration cannot repair.
+    const rawText = readFileSync(configPath, "utf-8");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(rawText);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    // Entry rows load lazily: only a stale fragment naming a row needs
+    // them. An unreadable DB then fails the run (retried next boot) rather
+    // than checkpointing a pass that skips entry-bound profiles.
+    let rows: Map<string, boolean> | null | undefined;
+    const isSubscriptionRow = (name: unknown): boolean => {
+      if (typeof name !== "string" || name.length === 0) {
+        return false;
+      }
+      if (rows === undefined) {
+        rows = readConnectionRows(workspaceDir);
+      }
+      if (rows === null) {
+        throw new Error(
+          "provider_connections is not readable; retrying the model-ID repair on the next run",
+        );
+      }
+      return rows.get(name) === true;
+    };
+    // A `provider` value: the identity dispatches to the subscription, a
+    // known vendor never does, and any other value is an entry name.
+    const isSubscriptionProvider = (provider: unknown): boolean =>
+      provider === CHATGPT_IDENTITY ||
+      (typeof provider === "string" &&
+        !KNOWN_PROVIDERS.has(provider) &&
+        isSubscriptionRow(provider));
+    // The binding is authoritative when present, since dispatch honors it
+    // ahead of the declared provider; the identity is repaired regardless
+    // (the schema rejects the pair whatever the binding).
+    const isBound = (fragment: Record<string, unknown>): boolean => {
+      if (fragment.provider === CHATGPT_IDENTITY) {
+        return true;
+      }
+      const binding = fragment.provider_connection;
+      return typeof binding === "string" && binding.length > 0
+        ? isSubscriptionRow(binding)
+        : isSubscriptionProvider(fragment.provider);
+    };
+    const isProviderBound = (fragment: Record<string, unknown>): boolean =>
+      isSubscriptionProvider(fragment.provider);
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default), isBound) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed =
+          repairFragment(readObject(rawConfig), isProviderBound) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile), isBound) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    // Write-then-rename so an interrupted write cannot leave config.json
+    // truncated: a torn in-place write would parse as invalid JSON on the
+    // retry, which the catch above treats as "nothing to do", letting the
+    // runner checkpoint the migration as completed against a corrupt file.
+    const tmpPath = `${configPath}.migration-154.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+  },
+  // The exact-match rewrite is idempotent, so a transient failure (full
+  // disk, I/O error) is safe to retry on later startups.
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the retired model IDs would fail schema
+    // validation once the allowlist no longer carries them.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const CHATGPT_IDENTITY = "chatgpt";
+
+// Frozen snapshot of `KNOWN_LLM_PROVIDERS`: the vendor and identity values
+// that dispatch without a connection row, so none of them is an entry name.
+const KNOWN_PROVIDERS = new Set([
+  "anthropic",
+  "openai",
+  "gemini",
+  "ollama",
+  "fireworks",
+  "openrouter",
+  "vercel-ai-gateway",
+  "openai-compatible",
+  "minimax",
+  "atlascloud",
+  "together",
+  "litellm",
+  "opencode",
+  "baseten",
+  "poolside",
+  "vellum",
+  "chatgpt",
+]);
+
+const REPLACEMENTS: ReadonlyMap<string, string> = new Map([
+  ["gpt-5.4", "gpt-5.5"],
+  ["gpt-5.4-mini", "gpt-5.6-luna"],
+]);
+
+function repairFragment(
+  fragment: Record<string, unknown> | null,
+  isSubscriptionRouted: (fragment: Record<string, unknown>) => boolean,
+): boolean {
+  if (fragment === null || typeof fragment.model !== "string") {
+    return false;
+  }
+  const replacement = REPLACEMENTS.get(fragment.model);
+  if (replacement === undefined) {
+    return false;
+  }
+  if (!isSubscriptionRouted(fragment)) {
+    return false;
+  }
+  fragment.model = replacement;
+  return true;
+}
+
+/**
+ * `provider_connections` row name to whether the row dispatches to the
+ * ChatGPT subscription, or null when the DB or table is not readable. The
+ * caller fails the run on null: entry-name providers must be judged against
+ * real rows, never guessed. An absent DB file is a real state (no rows, so
+ * every entry name is dangling).
+ */
+function readConnectionRows(workspaceDir: string): Map<string, boolean> | null {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    return new Map();
+  }
+  let db: Database;
+  try {
+    db = new Database(dbPath, { readonly: true });
+  } catch {
+    return null;
+  }
+  try {
+    const rows = db
+      .query(`SELECT name, provider, auth FROM provider_connections`)
+      .all() as Array<{ name: string; provider: string; auth: string }>;
+    return new Map(
+      rows.map((row) => [
+        row.name,
+        row.provider === CHATGPT_IDENTITY || isSubscriptionAuth(row.auth),
+      ]),
+    );
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+function isSubscriptionAuth(auth: string): boolean {
+  try {
+    const parsed: unknown = JSON.parse(auth);
+    return (
+      parsed !== null &&
+      typeof parsed === "object" &&
+      (parsed as { type?: unknown }).type === "oauth_subscription"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/155-move-front-model-config-to-voice.ts

@@ -0,0 +1,78 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-155");
+
+/**
+ * Move `liveVoice.frontModel` to `voice.frontModel` in `config.json`.
+ *
+ * The front-door tuning (endpointing budgets and progress narration cadence)
+ * is read by phone calls as well as live voice, so it lives under a
+ * transport-agnostic key. A `voice.frontModel` already present wins field by
+ * field; the `liveVoice` block is removed either way so raw-config saves do
+ * not write it back.
+ */
+export const moveFrontModelConfigToVoiceMigration: WorkspaceMigration = {
+  id: "155-move-front-model-config-to-voice",
+  description: "Move liveVoice.frontModel to voice.frontModel in config.json",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const liveVoice = readObject(config.liveVoice);
+    if (liveVoice === null || !Object.hasOwn(liveVoice, "frontModel")) {
+      return;
+    }
+    const legacy = readObject(liveVoice.frontModel);
+    delete liveVoice.frontModel;
+
+    if (legacy !== null) {
+      const voice = readObject(config.voice) ?? {};
+      const current = readObject(voice.frontModel) ?? {};
+      const legacyProgress = readObject(legacy.progress) ?? {};
+      const currentProgress = readObject(current.progress) ?? {};
+      const merged: Record<string, unknown> = { ...legacy, ...current };
+      if (
+        Object.keys(legacyProgress).length > 0 ||
+        Object.keys(currentProgress).length > 0
+      ) {
+        merged.progress = { ...legacyProgress, ...currentProgress };
+      }
+      voice.frontModel = merged;
+      config.voice = voice;
+    }
+
+    const tmpPath = `${configPath}.migration-155.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+    log.info("Moved liveVoice.frontModel to voice.frontModel in config.json");
+  },
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: the schema reads voice.frontModel and strips unknown
+    // liveVoice keys, so a block moved back is dropped on the next load.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/156-extract-workspace-mcp-json.ts

@@ -0,0 +1,214 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const WORKSPACE_MCP_FILENAME = "mcp.json";
+
+// Inlined Agent Plugins 1.0.0 schema URL so this migration stays
+// self-contained if the production constant later changes or moves.
+const AGENT_PLUGINS_MCP_SCHEMA_URL =
+  "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
+
+const log = getLogger("workspace-migration-156");
+
+/**
+ * Move user-owned MCP servers from `config.json` into a spec-pure
+ * `/workspace/mcp.json`. Presence of a server is what starts it. Headers
+ * that were still on a transport are copied onto the spec entry so the
+ * credential-store migration can lift them on the next MCP reload.
+ */
+export const extractWorkspaceMcpJsonMigration: WorkspaceMigration = {
+  id: "156-extract-workspace-mcp-json",
+  description:
+    "Extract workspace MCP servers from config.json into a spec-pure mcp.json",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    const config = readJsonObject(configPath);
+    if (config === null) {
+      return;
+    }
+
+    if (!Object.hasOwn(config, "mcp")) {
+      return;
+    }
+
+    const extracted = extractSpecServers(config.mcp);
+    const mcpPath = join(workspaceDir, WORKSPACE_MCP_FILENAME);
+    const existing = readExistingMcpServers(mcpPath);
+    const merged: Record<string, unknown> = {
+      ...extracted,
+      ...existing.servers,
+    };
+
+    if (Object.keys(merged).length > 0 || existing.present) {
+      const document = {
+        $schema: existing.schema ?? AGENT_PLUGINS_MCP_SCHEMA_URL,
+        mcpServers: merged,
+      };
+      atomicWrite(mcpPath, document);
+    }
+
+    delete config.mcp;
+    atomicWrite(configPath, config);
+    log.info("Extracted workspace MCP servers into mcp.json");
+  },
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: mcp.json is the store. Putting servers back under
+    // config.json would just be extracted again on the next load.
+  },
+};
+
+function extractSpecServers(mcp: unknown): Record<string, unknown> {
+  const block = readObject(mcp);
+  if (block === null) {
+    return {};
+  }
+
+  const servers: Record<string, unknown> = {};
+  const rawServers = block.servers;
+  if (Array.isArray(rawServers)) {
+    for (const entry of rawServers) {
+      const object = readObject(entry);
+      if (object === null) {
+        continue;
+      }
+      const name = object.name;
+      if (typeof name !== "string" || name.trim().length === 0) {
+        continue;
+      }
+      const spec = toSpecServer(object);
+      if (spec !== null) {
+        servers[name] = spec;
+      }
+    }
+    return servers;
+  }
+
+  const serverMap = readObject(rawServers);
+  if (serverMap === null) {
+    return {};
+  }
+  for (const [id, entry] of Object.entries(serverMap)) {
+    if (id.trim().length === 0) {
+      continue;
+    }
+    const object = readObject(entry);
+    if (object === null) {
+      continue;
+    }
+    const spec = toSpecServer(object);
+    if (spec !== null) {
+      servers[id] = spec;
+    }
+  }
+  return servers;
+}
+
+function toSpecServer(entry: Record<string, unknown>): Record<string, unknown> | null {
+  const transport = readObject(entry.transport);
+  if (transport === null) {
+    return null;
+  }
+  const type = transport.type;
+  if (type === "stdio") {
+    if (typeof transport.command !== "string" || transport.command.length === 0) {
+      return null;
+    }
+    const spec: Record<string, unknown> = {
+      type: "stdio",
+      command: transport.command,
+    };
+    if (
+      Array.isArray(transport.args) &&
+      transport.args.length > 0 &&
+      transport.args.every((arg) => typeof arg === "string")
+    ) {
+      spec.args = transport.args;
+    }
+    const env = readStringRecord(transport.env);
+    if (env !== null) {
+      spec.env = env;
+    }
+    return spec;
+  }
+  if (type === "sse" || type === "streamable-http" || type === "http") {
+    if (typeof transport.url !== "string" || transport.url.length === 0) {
+      return null;
+    }
+    const spec: Record<string, unknown> = {
+      type: type === "http" ? "streamable-http" : type,
+      url: transport.url,
+    };
+    const headers = readStringRecord(transport.headers);
+    if (headers !== null) {
+      spec.headers = headers;
+    }
+    return spec;
+  }
+  return null;
+}
+
+function readExistingMcpServers(path: string): {
+  present: boolean;
+  schema?: string;
+  servers: Record<string, unknown>;
+} {
+  if (!existsSync(path)) {
+    return { present: false, servers: {} };
+  }
+  const document = readJsonObject(path);
+  if (document === null) {
+    return { present: true, servers: {} };
+  }
+  const servers = readObject(document.mcpServers);
+  return {
+    present: true,
+    schema:
+      typeof document.$schema === "string" ? document.$schema : undefined,
+    servers: servers ?? {},
+  };
+}
+
+function readJsonObject(path: string): Record<string, unknown> | null {
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    return readObject(raw);
+  } catch {
+    return null;
+  }
+}
+
+function atomicWrite(path: string, value: unknown): void {
+  const tmpPath = `${path}.migration-156.tmp`;
+  writeFileSync(tmpPath, JSON.stringify(value, null, 2) + "\n");
+  renameSync(tmpPath, path);
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}
+
+function readStringRecord(value: unknown): Record<string, string> | null {
+  const object = readObject(value);
+  if (object === null) {
+    return null;
+  }
+  const result: Record<string, string> = {};
+  for (const [key, entry] of Object.entries(object)) {
+    if (typeof entry !== "string") {
+      return null;
+    }
+    result[key] = entry;
+  }
+  return Object.keys(result).length > 0 ? result : null;
+}

package/src/workspace/migrations/__tests__/155-move-front-model-config-to-voice.test.ts

@@ -0,0 +1,102 @@
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { moveFrontModelConfigToVoiceMigration } from "../155-move-front-model-config-to-voice.js";
+
+function workspaceWith(config: unknown): string {
+  const dir = mkdtempSync(join(tmpdir(), "move-front-model-"));
+  writeFileSync(join(dir, "config.json"), JSON.stringify(config, null, 2));
+  return dir;
+}
+
+function readConfig(dir: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(dir, "config.json"), "utf8")) as Record<
+    string,
+    unknown
+  >;
+}
+
+describe("155-move-front-model-config-to-voice", () => {
+  test("moves liveVoice.frontModel under voice and leaves the rest of liveVoice", () => {
+    const dir = workspaceWith({
+      liveVoice: {
+        vad: { silenceThresholdMs: 900 },
+        frontModel: {
+          endpointDecisionTimeoutMs: 300,
+          progress: { idleIntervalMs: 4_000 },
+        },
+      },
+    });
+
+    moveFrontModelConfigToVoiceMigration.run(dir);
+
+    expect(readConfig(dir)).toEqual({
+      liveVoice: { vad: { silenceThresholdMs: 900 } },
+      voice: {
+        frontModel: {
+          endpointDecisionTimeoutMs: 300,
+          progress: { idleIntervalMs: 4_000 },
+        },
+      },
+    });
+  });
+
+  test("an existing voice.frontModel wins field by field", () => {
+    const dir = workspaceWith({
+      liveVoice: {
+        frontModel: {
+          endpointDecisionTimeoutMs: 300,
+          endpointMaxExtensions: 1,
+          progress: { idleIntervalMs: 4_000, minGapMs: 2_000 },
+        },
+      },
+      voice: {
+        frontModel: {
+          endpointDecisionTimeoutMs: 800,
+          progress: { idleIntervalMs: 7_000 },
+        },
+      },
+    });
+
+    moveFrontModelConfigToVoiceMigration.run(dir);
+
+    expect(readConfig(dir)).toEqual({
+      liveVoice: {},
+      voice: {
+        frontModel: {
+          endpointDecisionTimeoutMs: 800,
+          endpointMaxExtensions: 1,
+          progress: { idleIntervalMs: 7_000, minGapMs: 2_000 },
+        },
+      },
+    });
+  });
+
+  test("a config without the old key is left untouched", () => {
+    const dir = workspaceWith({ liveVoice: { archiveAudio: true } });
+    const before = readFileSync(join(dir, "config.json"), "utf8");
+
+    moveFrontModelConfigToVoiceMigration.run(dir);
+
+    expect(readFileSync(join(dir, "config.json"), "utf8")).toBe(before);
+  });
+
+  test("is idempotent", () => {
+    const dir = workspaceWith({
+      liveVoice: { frontModel: { endpointExtensionMs: 2_000 } },
+    });
+
+    moveFrontModelConfigToVoiceMigration.run(dir);
+    const once = readConfig(dir);
+    moveFrontModelConfigToVoiceMigration.run(dir);
+
+    expect(readConfig(dir)).toEqual(once);
+  });
+
+  test("a missing config file is a no-op", () => {
+    const dir = mkdtempSync(join(tmpdir(), "move-front-model-empty-"));
+    expect(() => moveFrontModelConfigToVoiceMigration.run(dir)).not.toThrow();
+  });
+});