@vellumai/assistant 0.12.3 → 0.12.4-dev.202609231620.a15f321

package/src/workspace/migrations/158-repoint-opencode-host-provider-fragments.ts

@@ -0,0 +1,163 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repoint legacy-shape LLM fragments (`provider: "openai-compatible"` plus a
+ * `provider_connection` binding) whose bound row's endpoint host is
+ * opencode.ai to `provider: "opencode"`.
+ *
+ * DB migration 383 restamps such rows as provider "opencode", and dispatch
+ * requires a bound row's provider to equal the fragment's declared provider,
+ * so a fragment left declaring "openai-compatible" would either mismatch or
+ * auto-resolve to an unrelated generic row. Entry-shape fragments (provider
+ * holds the row name) derive their kind from the row and need no rewrite.
+ * Rows are judged by their base_url host, not their provider column, so the
+ * result is the same whichever migration runs first.
+ *
+ * Swept in `llm.default` and `llm.profiles.*`; call-site fragments carry no
+ * binding (the schema strips a raw `provider_connection`).
+ */
+export const repointOpencodeHostProviderFragmentsMigration: WorkspaceMigration =
+  {
+    id: "158-repoint-opencode-host-provider-fragments",
+    description:
+      "Repoint openai-compatible LLM fragments bound to opencode.ai connections to provider opencode",
+    run(workspaceDir: string): void {
+      const configPath = join(workspaceDir, "config.json");
+      if (!existsSync(configPath)) {
+        return;
+      }
+
+      // Read outside the parse catch: a transient filesystem error must reach
+      // the runner so the migration retries, while malformed JSON is a
+      // permanent state this migration cannot repair.
+      const rawText = readFileSync(configPath, "utf-8");
+
+      let config: Record<string, unknown>;
+      try {
+        const raw = JSON.parse(rawText);
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+          return;
+        }
+        config = raw as Record<string, unknown>;
+      } catch {
+        return;
+      }
+
+      const llm = readObject(config.llm);
+      if (llm === null) {
+        return;
+      }
+
+      // Rows load lazily: only a legacy-shape openai-compatible fragment
+      // needs them. An unreadable DB then fails the run (retried next boot)
+      // rather than checkpointing a pass that skipped bound fragments.
+      let openCodeRows: Set<string> | null | undefined;
+      const isOpenCodeRow = (name: unknown): boolean => {
+        if (typeof name !== "string" || name.length === 0) {
+          return false;
+        }
+        if (openCodeRows === undefined) {
+          openCodeRows = readOpenCodeRowNames(workspaceDir);
+        }
+        if (openCodeRows === null) {
+          throw new Error(
+            "provider_connections is not readable; retrying the opencode repoint on the next run",
+          );
+        }
+        return openCodeRows.has(name);
+      };
+
+      const repoint = (fragment: Record<string, unknown> | null): boolean => {
+        if (
+          fragment === null ||
+          fragment.provider !== "openai-compatible" ||
+          !isOpenCodeRow(fragment.provider_connection)
+        ) {
+          return false;
+        }
+        fragment.provider = "opencode";
+        return true;
+      };
+
+      let changed = repoint(readObject(llm.default));
+      const profiles = readObject(llm.profiles);
+      if (profiles !== null) {
+        for (const rawProfile of Object.values(profiles)) {
+          changed = repoint(readObject(rawProfile)) || changed;
+        }
+      }
+      if (!changed) {
+        return;
+      }
+
+      // Write-then-rename so an interrupted write cannot leave config.json
+      // truncated for the retry to misread as "nothing to do".
+      const tmpPath = `${configPath}.migration-158.tmp`;
+      writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+      renameSync(tmpPath, configPath);
+    },
+    // The exact-match rewrite is idempotent, so a transient failure is safe
+    // to retry on later startups.
+    retryFailedCheckpoint: true,
+    down(_workspaceDir: string): void {
+      // Forward-only: the rows these fragments bind now carry provider
+      // "opencode", so reverting the fragments would recreate the mismatch.
+    },
+  };
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+/**
+ * Names of `provider_connections` rows whose base_url host is opencode.ai or
+ * a subdomain, or null when the DB or table is not readable. An absent DB
+ * file is a real state (no rows, so no fragment is bound to one).
+ */
+function readOpenCodeRowNames(workspaceDir: string): Set<string> | null {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    return new Set();
+  }
+  let db: Database;
+  try {
+    db = new Database(dbPath, { readonly: true });
+  } catch {
+    return null;
+  }
+  try {
+    const rows = db
+      .query(
+        `SELECT name, base_url FROM provider_connections WHERE base_url IS NOT NULL`,
+      )
+      .all() as Array<{ name: string; base_url: string }>;
+    return new Set(
+      rows.filter((row) => isOpenCodeHost(row.base_url)).map((row) => row.name),
+    );
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+function isOpenCodeHost(baseUrl: string): boolean {
+  let host: string;
+  try {
+    host = new URL(baseUrl).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return host === "opencode.ai" || host.endsWith(".opencode.ai");
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/159-rename-colliding-jev-profile-name.ts

@@ -0,0 +1,344 @@
+/**
+ * Workspace migration `159-rename-colliding-jev-profile-name`.
+ *
+ * `jev-managed` became a reserved code-owned profile name (the managed Jev
+ * profile). From this release on, that name resolves to the code body no
+ * matter what `llm.profiles` holds, and the schema rejects it as
+ * `activeProfile` or `advisorProfile`, so a user-created profile that
+ * happens to carry the name would be silently replaced in the effective
+ * catalog and its selections stranded.
+ *
+ * This migration runs before the reservation can take effect (workspace
+ * migrations run ahead of the first config load and the profile seeder) and
+ * gives such a profile a fresh key, rewriting every reference to it so the
+ * user keeps both the profile and its wiring:
+ *
+ *   - `llm.profiles` key (insertion order preserved)
+ *   - `llm.activeProfile`, `llm.advisorProfile`
+ *   - `llm.profileOrder` entries
+ *   - `llm.callSites.<site>.profile` pins
+ *   - `llm.profiles.<key>.mix[].profile` arms
+ *   - `llm.profiles.<key>.fallbackProfile` targets
+ *   - `conversations.inference_profile` and `cron_jobs.inference_profile`
+ *     rows
+ *
+ * The new key is `jev-managed-custom`, suffixed `-custom-2`, `-custom-3`,
+ * ... when that is taken. Candidates are checked against every existing
+ * profile key AND every reserved code-defined name, so a rename never lands
+ * on another name the catalog owns.
+ *
+ * Only a workspace-owned profile is renamed. An entry whose `source` is
+ * `managed` is a thin stub for the code-owned profile, and a non-object
+ * value under the key is not a profile at all; both are left alone.
+ *
+ * The DB rewrite is not best effort: a pin the rewrite abandons would route
+ * through the managed Jev profile instead of the user's own, so a database
+ * that exists but cannot be written is retried with a short backoff and a
+ * failure that outlives the retries throws; `retryFailedCheckpoint` re-runs
+ * the whole migration on the next boot. The DB rewrite runs before the
+ * config write, so a throw leaves config.json holding the old key.
+ *
+ * Idempotent: after a successful run no workspace-owned profile carries the
+ * reserved name, so a re-run finds nothing to rename and writes nothing.
+ */
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger(
+  "workspace-migration-159-rename-colliding-jev-profile-name",
+);
+
+/**
+ * The newly reserved key this migration clears. Frozen snapshot as of
+ * 2026-09-22 (migrations are self-contained).
+ */
+const RESERVED_KEYS = ["jev-managed"];
+
+/**
+ * Every code-defined profile name as of 2026-09-22: the default keys, the
+ * backups, the flag-gated `os-beta`, and the Jev profile. A renamed profile
+ * must not land on any of them, or the rename would just move the collision.
+ */
+const RESERVED_PROFILE_NAMES = new Set<string>([
+  "balanced",
+  "quality-optimized",
+  "cost-optimized",
+  "latency-optimized",
+  "balanced-backup",
+  "quality-optimized-backup",
+  "cost-optimized-backup",
+  "latency-optimized-backup",
+  "os-beta",
+  ...RESERVED_KEYS,
+]);
+
+const RENAME_SUFFIX = "-custom";
+
+/** Total attempts at the pin rewrite, the first one included. */
+const DB_ATTEMPTS = 4;
+
+/** First backoff step; each further wait doubles it (50, 100, 200 ms). */
+const DB_RETRY_BASE_DELAY_MS = 50;
+
+export const renameCollidingJevProfileNameMigration: WorkspaceMigration = {
+  id: "159-rename-colliding-jev-profile-name",
+  description:
+    "Rename a user profile colliding with the reserved managed Jev profile key and rewrite its references",
+  // The failure this migration can hit is a database it cannot write, and
+  // both halves of the run are idempotent, so a failed checkpoint is worth
+  // re-running: the config still holds the old keys, the mapping rebuilds
+  // from them, and the pin rewrite matches on the old name.
+  retryFailedCheckpoint: true,
+
+  async run(workspaceDir: string): Promise<void> {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!isPlainObject(parsed)) {
+        return;
+      }
+      config = parsed;
+    } catch {
+      return;
+    }
+
+    const llm = asObject(config.llm);
+    const profiles = llm === null ? null : asObject(llm.profiles);
+    if (llm === null || profiles === null) {
+      return;
+    }
+
+    const renames = planRenames(profiles);
+    if (renames.size === 0) {
+      return;
+    }
+
+    // The DB rewrite runs first so an interrupted or failed migration re-runs
+    // with the config still holding the old keys, i.e. with the mapping
+    // intact. A rewrite that cannot be completed throws out of here, which
+    // stops the config rename below rather than stranding the pins.
+    await rewriteDbReferences(workspaceDir, renames);
+
+    llm.profiles = renameProfileKeys(profiles, renames);
+    rewriteConfigReferences(llm, renames);
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    log.info(
+      { renames: Object.fromEntries(renames) },
+      "Renamed a user profile colliding with the reserved managed Jev profile key",
+    );
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: the reserved names cannot be handed back.
+  },
+};
+
+/**
+ * Old key -> new key for a workspace-owned profile sitting on the reserved
+ * name. Deterministic: each assigned name is reserved against later
+ * candidates, so the same config always produces the same mapping.
+ */
+function planRenames(profiles: Record<string, unknown>): Map<string, string> {
+  const renames = new Map<string, string>();
+  const taken = new Set<string>([
+    ...Object.keys(profiles),
+    ...RESERVED_PROFILE_NAMES,
+  ]);
+
+  for (const key of RESERVED_KEYS) {
+    if (!(key in profiles)) {
+      continue;
+    }
+    const entry = asObject(profiles[key]);
+    if (entry === null) {
+      log.warn(
+        { profile: key },
+        "Left a non-object value under the reserved Jev profile key; it is not a profile to preserve",
+      );
+      continue;
+    }
+    if (entry.source === "managed") {
+      // A managed stub is the workspace's overlay slot for the code-owned
+      // profile, not a user profile; renaming it would manufacture a phantom
+      // user profile.
+      continue;
+    }
+    let candidate = `${key}${RENAME_SUFFIX}`;
+    let counter = 2;
+    while (taken.has(candidate)) {
+      candidate = `${key}${RENAME_SUFFIX}-${counter}`;
+      counter += 1;
+    }
+    taken.add(candidate);
+    renames.set(key, candidate);
+  }
+
+  return renames;
+}
+
+/** Rebuild the profiles record with the renamed keys, preserving order. */
+function renameProfileKeys(
+  profiles: Record<string, unknown>,
+  renames: Map<string, string>,
+): Record<string, unknown> {
+  const renamed: Record<string, unknown> = {};
+  for (const [name, value] of Object.entries(profiles)) {
+    renamed[renames.get(name) ?? name] = value;
+  }
+  return renamed;
+}
+
+/** Point every config reference at the renamed key. */
+function rewriteConfigReferences(
+  llm: Record<string, unknown>,
+  renames: Map<string, string>,
+): void {
+  for (const field of ["activeProfile", "advisorProfile"]) {
+    const current = llm[field];
+    if (typeof current === "string" && renames.has(current)) {
+      llm[field] = renames.get(current);
+    }
+  }
+
+  if (Array.isArray(llm.profileOrder)) {
+    llm.profileOrder = (llm.profileOrder as unknown[]).map((name) =>
+      typeof name === "string" ? (renames.get(name) ?? name) : name,
+    );
+  }
+
+  const callSites = asObject(llm.callSites);
+  if (callSites !== null) {
+    for (const value of Object.values(callSites)) {
+      const site = asObject(value);
+      if (
+        site !== null &&
+        typeof site.profile === "string" &&
+        renames.has(site.profile)
+      ) {
+        site.profile = renames.get(site.profile);
+      }
+    }
+  }
+
+  const profiles = asObject(llm.profiles);
+  if (profiles === null) {
+    return;
+  }
+  for (const value of Object.values(profiles)) {
+    const entry = asObject(value);
+    if (entry === null) {
+      continue;
+    }
+    if (
+      typeof entry.fallbackProfile === "string" &&
+      renames.has(entry.fallbackProfile)
+    ) {
+      entry.fallbackProfile = renames.get(entry.fallbackProfile);
+    }
+    if (!Array.isArray(entry.mix)) {
+      continue;
+    }
+    for (const armValue of entry.mix as unknown[]) {
+      const arm = asObject(armValue);
+      if (
+        arm !== null &&
+        typeof arm.profile === "string" &&
+        renames.has(arm.profile)
+      ) {
+        arm.profile = renames.get(arm.profile);
+      }
+    }
+  }
+}
+
+/**
+ * Repoint the profile pins stored outside config.json: the sticky
+ * per-conversation profile and the per-schedule profile.
+ *
+ * Retried as a whole rather than per statement: opening the database, reading
+ * `sqlite_master` and running the updates all fail the same way under write
+ * contention (`SQLITE_BUSY` from a second connection), and every step is
+ * idempotent, so re-running the block is the simplest recovery that cannot
+ * double-apply. A failure that outlives the attempts throws, which fails the
+ * migration for `retryFailedCheckpoint` to pick up on the next boot.
+ */
+async function rewriteDbReferences(
+  workspaceDir: string,
+  renames: Map<string, string>,
+): Promise<void> {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    // No database yet, so there are no pins that could be stranded.
+    return;
+  }
+  await withDbRetry(() => {
+    const db = new Database(dbPath);
+    try {
+      for (const table of ["conversations", "cron_jobs"]) {
+        const present = db
+          .query(
+            `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`,
+          )
+          .get(table);
+        if (!present) {
+          // A workspace whose schema does not carry this table holds no pins
+          // in it. Nothing to rewrite, and nothing to fail over.
+          log.info({ table }, "No profile pin table to repoint");
+          continue;
+        }
+        for (const [from, to] of renames) {
+          db.query(
+            `UPDATE ${table} SET inference_profile = ? WHERE inference_profile = ?`,
+          ).run(to, from);
+        }
+      }
+    } finally {
+      db.close();
+    }
+  });
+}
+
+/**
+ * Run the pin rewrite, retrying a transient database failure with a short
+ * doubling backoff. Rethrows once the attempts are spent so the caller stops
+ * before the config rename.
+ */
+async function withDbRetry(attempt: () => void): Promise<void> {
+  for (let index = 0; ; index += 1) {
+    try {
+      attempt();
+      return;
+    } catch (err) {
+      if (index >= DB_ATTEMPTS - 1) {
+        throw new Error(
+          `Could not repoint conversation and schedule profile pins after ${DB_ATTEMPTS} attempts; leaving the config unrenamed so the next boot retries`,
+          { cause: err },
+        );
+      }
+      log.warn(
+        { err, attempt: index },
+        "Could not repoint profile pins; retrying",
+      );
+      await Bun.sleep(DB_RETRY_BASE_DELAY_MS * 2 ** index);
+    }
+  }
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function asObject(value: unknown): Record<string, unknown> | null {
+  return isPlainObject(value) ? value : null;
+}

package/src/workspace/migrations/__tests__/158-repoint-opencode-host-provider-fragments.test.ts

@@ -0,0 +1,188 @@
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { WORKSPACE_MIGRATIONS } from "../registry.js";
+
+const migration = WORKSPACE_MIGRATIONS.find(
+  (entry) => entry.id === "158-repoint-opencode-host-provider-fragments",
+)!;
+
+const workspaces: string[] = [];
+afterEach(() => {
+  for (const workspace of workspaces.splice(0)) {
+    rmSync(workspace, { recursive: true, force: true });
+  }
+});
+
+function setup(): string {
+  const workspace = mkdtempSync(join(tmpdir(), "opencode-repoint-migration-"));
+  workspaces.push(workspace);
+  return workspace;
+}
+
+function writeConfig(workspace: string, data: Record<string, unknown>): void {
+  writeFileSync(
+    join(workspace, "config.json"),
+    JSON.stringify(data, null, 2) + "\n",
+  );
+}
+
+function readLlm(workspace: string): Record<string, any> {
+  return JSON.parse(readFileSync(join(workspace, "config.json"), "utf-8")).llm;
+}
+
+function seedRows(
+  workspace: string,
+  rows: Array<{ name: string; provider: string; baseUrl: string | null }>,
+): void {
+  mkdirSync(join(workspace, "data", "db"), { recursive: true });
+  const db = new Database(join(workspace, "data", "db", "assistant.db"));
+  db.run(`CREATE TABLE provider_connections (
+    name TEXT PRIMARY KEY,
+    provider TEXT NOT NULL,
+    auth TEXT NOT NULL,
+    base_url TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  )`);
+  for (const row of rows) {
+    db.query(
+      `INSERT INTO provider_connections (name, provider, auth, base_url, created_at, updated_at)
+       VALUES (?, ?, '{"type":"api_key","credential":"cred"}', ?, 1, 1)`,
+    ).run(row.name, row.provider, row.baseUrl);
+  }
+  db.close();
+}
+
+describe("migration 158: repoint opencode-host provider fragments", () => {
+  test("repoints legacy-shape fragments bound to an opencode.ai row, whichever provider the row stores", () => {
+    const workspace = setup();
+    seedRows(workspace, [
+      {
+        name: "go",
+        provider: "openai-compatible",
+        baseUrl: "https://opencode.ai/zen/go/v1",
+      },
+      {
+        name: "zen",
+        provider: "opencode",
+        baseUrl: "https://opencode.ai/zen/v1",
+      },
+      {
+        name: "vllm",
+        provider: "openai-compatible",
+        baseUrl: "http://localhost:8080/v1",
+      },
+    ]);
+    writeConfig(workspace, {
+      llm: {
+        default: {
+          provider: "openai-compatible",
+          provider_connection: "go",
+          model: "m",
+        },
+        profiles: {
+          a: {
+            provider: "openai-compatible",
+            provider_connection: "go",
+            model: "m",
+          },
+          b: {
+            provider: "openai-compatible",
+            provider_connection: "zen",
+            model: "m",
+          },
+          c: {
+            provider: "openai-compatible",
+            provider_connection: "vllm",
+            model: "m",
+          },
+          entry: { provider: "go", model: "m" },
+          unbound: { provider: "openai-compatible", model: "m" },
+          dangling: {
+            provider: "openai-compatible",
+            provider_connection: "gone",
+            model: "m",
+          },
+        },
+      },
+    });
+
+    migration.run(workspace);
+
+    const llm = readLlm(workspace);
+    expect(llm.default.provider).toBe("opencode");
+    expect(llm.default.provider_connection).toBe("go");
+    expect(llm.profiles.a.provider).toBe("opencode");
+    expect(llm.profiles.b.provider).toBe("opencode");
+    expect(llm.profiles.c.provider).toBe("openai-compatible");
+    expect(llm.profiles.entry.provider).toBe("go");
+    expect(llm.profiles.unbound.provider).toBe("openai-compatible");
+    expect(llm.profiles.dangling.provider).toBe("openai-compatible");
+  });
+
+  test("no-ops without config, without a db, or with nothing bound", () => {
+    const noConfig = setup();
+    expect(() => migration.run(noConfig)).not.toThrow();
+
+    const noDb = setup();
+    writeConfig(noDb, {
+      llm: {
+        profiles: {
+          a: { provider: "openai-compatible", provider_connection: "go" },
+        },
+      },
+    });
+    migration.run(noDb);
+    expect(readLlm(noDb).profiles.a.provider).toBe("openai-compatible");
+  });
+
+  test("fails the run instead of checkpointing when the db is unreadable", () => {
+    const workspace = setup();
+    seedRows(workspace, []);
+    writeFileSync(
+      join(workspace, "data", "db", "assistant.db"),
+      "not a database",
+    );
+    writeConfig(workspace, {
+      llm: {
+        profiles: {
+          a: { provider: "openai-compatible", provider_connection: "go" },
+        },
+      },
+    });
+    expect(() => migration.run(workspace)).toThrow(/not readable/);
+  });
+
+  test("is idempotent", () => {
+    const workspace = setup();
+    seedRows(workspace, [
+      {
+        name: "go",
+        provider: "openai-compatible",
+        baseUrl: "https://opencode.ai/zen/go/v1",
+      },
+    ]);
+    writeConfig(workspace, {
+      llm: {
+        profiles: {
+          a: { provider: "openai-compatible", provider_connection: "go" },
+        },
+      },
+    });
+    migration.run(workspace);
+    const once = readFileSync(join(workspace, "config.json"), "utf-8");
+    migration.run(workspace);
+    expect(readFileSync(join(workspace, "config.json"), "utf-8")).toBe(once);
+    expect(readLlm(workspace).profiles.a.provider).toBe("opencode");
+  });
+});