@vellumai/assistant 0.12.4-staging.1 → 0.12.4-staging.2

package/src/workspace/migrations/159-rename-colliding-jev-profile-name.ts

@@ -0,0 +1,344 @@
+/**
+ * Workspace migration `159-rename-colliding-jev-profile-name`.
+ *
+ * `jev-managed` became a reserved code-owned profile name (the managed Jev
+ * profile). From this release on, that name resolves to the code body no
+ * matter what `llm.profiles` holds, and the schema rejects it as
+ * `activeProfile` or `advisorProfile`, so a user-created profile that
+ * happens to carry the name would be silently replaced in the effective
+ * catalog and its selections stranded.
+ *
+ * This migration runs before the reservation can take effect (workspace
+ * migrations run ahead of the first config load and the profile seeder) and
+ * gives such a profile a fresh key, rewriting every reference to it so the
+ * user keeps both the profile and its wiring:
+ *
+ *   - `llm.profiles` key (insertion order preserved)
+ *   - `llm.activeProfile`, `llm.advisorProfile`
+ *   - `llm.profileOrder` entries
+ *   - `llm.callSites.<site>.profile` pins
+ *   - `llm.profiles.<key>.mix[].profile` arms
+ *   - `llm.profiles.<key>.fallbackProfile` targets
+ *   - `conversations.inference_profile` and `cron_jobs.inference_profile`
+ *     rows
+ *
+ * The new key is `jev-managed-custom`, suffixed `-custom-2`, `-custom-3`,
+ * ... when that is taken. Candidates are checked against every existing
+ * profile key AND every reserved code-defined name, so a rename never lands
+ * on another name the catalog owns.
+ *
+ * Only a workspace-owned profile is renamed. An entry whose `source` is
+ * `managed` is a thin stub for the code-owned profile, and a non-object
+ * value under the key is not a profile at all; both are left alone.
+ *
+ * The DB rewrite is not best effort: a pin the rewrite abandons would route
+ * through the managed Jev profile instead of the user's own, so a database
+ * that exists but cannot be written is retried with a short backoff and a
+ * failure that outlives the retries throws; `retryFailedCheckpoint` re-runs
+ * the whole migration on the next boot. The DB rewrite runs before the
+ * config write, so a throw leaves config.json holding the old key.
+ *
+ * Idempotent: after a successful run no workspace-owned profile carries the
+ * reserved name, so a re-run finds nothing to rename and writes nothing.
+ */
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger(
+  "workspace-migration-159-rename-colliding-jev-profile-name",
+);
+
+/**
+ * The newly reserved key this migration clears. Frozen snapshot as of
+ * 2026-09-22 (migrations are self-contained).
+ */
+const RESERVED_KEYS = ["jev-managed"];
+
+/**
+ * Every code-defined profile name as of 2026-09-22: the default keys, the
+ * backups, the flag-gated `os-beta`, and the Jev profile. A renamed profile
+ * must not land on any of them, or the rename would just move the collision.
+ */
+const RESERVED_PROFILE_NAMES = new Set<string>([
+  "balanced",
+  "quality-optimized",
+  "cost-optimized",
+  "latency-optimized",
+  "balanced-backup",
+  "quality-optimized-backup",
+  "cost-optimized-backup",
+  "latency-optimized-backup",
+  "os-beta",
+  ...RESERVED_KEYS,
+]);
+
+const RENAME_SUFFIX = "-custom";
+
+/** Total attempts at the pin rewrite, the first one included. */
+const DB_ATTEMPTS = 4;
+
+/** First backoff step; each further wait doubles it (50, 100, 200 ms). */
+const DB_RETRY_BASE_DELAY_MS = 50;
+
+export const renameCollidingJevProfileNameMigration: WorkspaceMigration = {
+  id: "159-rename-colliding-jev-profile-name",
+  description:
+    "Rename a user profile colliding with the reserved managed Jev profile key and rewrite its references",
+  // The failure this migration can hit is a database it cannot write, and
+  // both halves of the run are idempotent, so a failed checkpoint is worth
+  // re-running: the config still holds the old keys, the mapping rebuilds
+  // from them, and the pin rewrite matches on the old name.
+  retryFailedCheckpoint: true,
+
+  async run(workspaceDir: string): Promise<void> {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!isPlainObject(parsed)) {
+        return;
+      }
+      config = parsed;
+    } catch {
+      return;
+    }
+
+    const llm = asObject(config.llm);
+    const profiles = llm === null ? null : asObject(llm.profiles);
+    if (llm === null || profiles === null) {
+      return;
+    }
+
+    const renames = planRenames(profiles);
+    if (renames.size === 0) {
+      return;
+    }
+
+    // The DB rewrite runs first so an interrupted or failed migration re-runs
+    // with the config still holding the old keys, i.e. with the mapping
+    // intact. A rewrite that cannot be completed throws out of here, which
+    // stops the config rename below rather than stranding the pins.
+    await rewriteDbReferences(workspaceDir, renames);
+
+    llm.profiles = renameProfileKeys(profiles, renames);
+    rewriteConfigReferences(llm, renames);
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    log.info(
+      { renames: Object.fromEntries(renames) },
+      "Renamed a user profile colliding with the reserved managed Jev profile key",
+    );
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: the reserved names cannot be handed back.
+  },
+};
+
+/**
+ * Old key -> new key for a workspace-owned profile sitting on the reserved
+ * name. Deterministic: each assigned name is reserved against later
+ * candidates, so the same config always produces the same mapping.
+ */
+function planRenames(profiles: Record<string, unknown>): Map<string, string> {
+  const renames = new Map<string, string>();
+  const taken = new Set<string>([
+    ...Object.keys(profiles),
+    ...RESERVED_PROFILE_NAMES,
+  ]);
+
+  for (const key of RESERVED_KEYS) {
+    if (!(key in profiles)) {
+      continue;
+    }
+    const entry = asObject(profiles[key]);
+    if (entry === null) {
+      log.warn(
+        { profile: key },
+        "Left a non-object value under the reserved Jev profile key; it is not a profile to preserve",
+      );
+      continue;
+    }
+    if (entry.source === "managed") {
+      // A managed stub is the workspace's overlay slot for the code-owned
+      // profile, not a user profile; renaming it would manufacture a phantom
+      // user profile.
+      continue;
+    }
+    let candidate = `${key}${RENAME_SUFFIX}`;
+    let counter = 2;
+    while (taken.has(candidate)) {
+      candidate = `${key}${RENAME_SUFFIX}-${counter}`;
+      counter += 1;
+    }
+    taken.add(candidate);
+    renames.set(key, candidate);
+  }
+
+  return renames;
+}
+
+/** Rebuild the profiles record with the renamed keys, preserving order. */
+function renameProfileKeys(
+  profiles: Record<string, unknown>,
+  renames: Map<string, string>,
+): Record<string, unknown> {
+  const renamed: Record<string, unknown> = {};
+  for (const [name, value] of Object.entries(profiles)) {
+    renamed[renames.get(name) ?? name] = value;
+  }
+  return renamed;
+}
+
+/** Point every config reference at the renamed key. */
+function rewriteConfigReferences(
+  llm: Record<string, unknown>,
+  renames: Map<string, string>,
+): void {
+  for (const field of ["activeProfile", "advisorProfile"]) {
+    const current = llm[field];
+    if (typeof current === "string" && renames.has(current)) {
+      llm[field] = renames.get(current);
+    }
+  }
+
+  if (Array.isArray(llm.profileOrder)) {
+    llm.profileOrder = (llm.profileOrder as unknown[]).map((name) =>
+      typeof name === "string" ? (renames.get(name) ?? name) : name,
+    );
+  }
+
+  const callSites = asObject(llm.callSites);
+  if (callSites !== null) {
+    for (const value of Object.values(callSites)) {
+      const site = asObject(value);
+      if (
+        site !== null &&
+        typeof site.profile === "string" &&
+        renames.has(site.profile)
+      ) {
+        site.profile = renames.get(site.profile);
+      }
+    }
+  }
+
+  const profiles = asObject(llm.profiles);
+  if (profiles === null) {
+    return;
+  }
+  for (const value of Object.values(profiles)) {
+    const entry = asObject(value);
+    if (entry === null) {
+      continue;
+    }
+    if (
+      typeof entry.fallbackProfile === "string" &&
+      renames.has(entry.fallbackProfile)
+    ) {
+      entry.fallbackProfile = renames.get(entry.fallbackProfile);
+    }
+    if (!Array.isArray(entry.mix)) {
+      continue;
+    }
+    for (const armValue of entry.mix as unknown[]) {
+      const arm = asObject(armValue);
+      if (
+        arm !== null &&
+        typeof arm.profile === "string" &&
+        renames.has(arm.profile)
+      ) {
+        arm.profile = renames.get(arm.profile);
+      }
+    }
+  }
+}
+
+/**
+ * Repoint the profile pins stored outside config.json: the sticky
+ * per-conversation profile and the per-schedule profile.
+ *
+ * Retried as a whole rather than per statement: opening the database, reading
+ * `sqlite_master` and running the updates all fail the same way under write
+ * contention (`SQLITE_BUSY` from a second connection), and every step is
+ * idempotent, so re-running the block is the simplest recovery that cannot
+ * double-apply. A failure that outlives the attempts throws, which fails the
+ * migration for `retryFailedCheckpoint` to pick up on the next boot.
+ */
+async function rewriteDbReferences(
+  workspaceDir: string,
+  renames: Map<string, string>,
+): Promise<void> {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    // No database yet, so there are no pins that could be stranded.
+    return;
+  }
+  await withDbRetry(() => {
+    const db = new Database(dbPath);
+    try {
+      for (const table of ["conversations", "cron_jobs"]) {
+        const present = db
+          .query(
+            `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`,
+          )
+          .get(table);
+        if (!present) {
+          // A workspace whose schema does not carry this table holds no pins
+          // in it. Nothing to rewrite, and nothing to fail over.
+          log.info({ table }, "No profile pin table to repoint");
+          continue;
+        }
+        for (const [from, to] of renames) {
+          db.query(
+            `UPDATE ${table} SET inference_profile = ? WHERE inference_profile = ?`,
+          ).run(to, from);
+        }
+      }
+    } finally {
+      db.close();
+    }
+  });
+}
+
+/**
+ * Run the pin rewrite, retrying a transient database failure with a short
+ * doubling backoff. Rethrows once the attempts are spent so the caller stops
+ * before the config rename.
+ */
+async function withDbRetry(attempt: () => void): Promise<void> {
+  for (let index = 0; ; index += 1) {
+    try {
+      attempt();
+      return;
+    } catch (err) {
+      if (index >= DB_ATTEMPTS - 1) {
+        throw new Error(
+          `Could not repoint conversation and schedule profile pins after ${DB_ATTEMPTS} attempts; leaving the config unrenamed so the next boot retries`,
+          { cause: err },
+        );
+      }
+      log.warn(
+        { err, attempt: index },
+        "Could not repoint profile pins; retrying",
+      );
+      await Bun.sleep(DB_RETRY_BASE_DELAY_MS * 2 ** index);
+    }
+  }
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function asObject(value: unknown): Record<string, unknown> | null {
+  return isPlainObject(value) ? value : null;
+}

package/src/workspace/migrations/registry.ts

@@ -155,6 +155,7 @@ import { repairRetiredCodexGpt54ModelIdsMigration } from "./154-repair-retired-c
 import { moveFrontModelConfigToVoiceMigration } from "./155-move-front-model-config-to-voice.js";
 import { extractWorkspaceMcpJsonMigration } from "./156-extract-workspace-mcp-json.js";
 import { addDesktopFilesLauncherMigration } from "./157-add-desktop-files-launcher.js";
+import { renameCollidingJevProfileNameMigration } from "./159-rename-colliding-jev-profile-name.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -325,4 +326,5 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   moveFrontModelConfigToVoiceMigration,
   extractWorkspaceMcpJsonMigration,
   addDesktopFilesLauncherMigration,
+  renameCollidingJevProfileNameMigration,
 ];

package/src/runtime/routes/__tests__/dictation-cleanup-guard.test.ts

@@ -1,107 +0,0 @@
-/**
- * The dictation cleanup pass rewrites what the user actually said, so a
- * rewrite the provider cut off at the token cap must never become the
- * payload: the raw transcript is sent instead.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import {
-  computeMaxTokens,
-  resolveCleanedDictation,
-} from "../diagnostics-routes.js";
-
-const SPOKEN =
-  "Hello Quill can you generate a list of 20 open HR coordinator or HR " +
-  "related roles that are remote and pay about 50 to 60 K per year";
-
-describe("resolveCleanedDictation", () => {
-  test("accepts an ordinary cleanup", () => {
-    const cleaned =
-      "Hello Quill, can you generate a list of 20 open HR coordinator or HR " +
-      "related roles that are remote and pay about 50 to 60K per year?";
-    expect(resolveCleanedDictation(SPOKEN, cleaned, "end_turn")).toEqual({
-      text: cleaned,
-      rejected: null,
-    });
-  });
-
-  test("trims surrounding whitespace off an accepted cleanup", () => {
-    const { text } = resolveCleanedDictation(
-      "so um I think we should ship the thing on Tuesday you know",
-      "  I think we should ship the thing on Tuesday.  ",
-      "end_turn",
-    );
-    expect(text).toBe("I think we should ship the thing on Tuesday.");
-  });
-
-  test("rejects a rewrite cut off by max_tokens and keeps the raw words", () => {
-    expect(
-      resolveCleanedDictation(
-        SPOKEN,
-        "Hello Quill, can you create a list",
-        "max_tokens",
-      ),
-    ).toEqual({ text: SPOKEN, rejected: "truncated" });
-  });
-
-  test("rejects a max_tokens rewrite even when it kept most of the words", () => {
-    const nearlyComplete = SPOKEN.slice(0, SPOKEN.length - 4);
-    const { rejected } = resolveCleanedDictation(
-      SPOKEN,
-      nearlyComplete,
-      "max_tokens",
-    );
-    expect(rejected).toBe("truncated");
-  });
-
-  test("rejects the token-cap stop under every provider's name for it", () => {
-    for (const stopReason of ["length", "max_output_tokens", "MAX_TOKENS "]) {
-      expect(
-        resolveCleanedDictation(SPOKEN, "Hello Quill, can you", stopReason)
-          .rejected,
-      ).toBe("truncated");
-    }
-  });
-
-  test("a missing stop reason is not treated as a truncation", () => {
-    const cleaned = "Hello Quill, can you generate a list?";
-    expect(resolveCleanedDictation(SPOKEN, cleaned, undefined)).toEqual({
-      text: cleaned,
-      rejected: null,
-    });
-  });
-
-  test("a much shorter rewrite is the model's call, not a rejection", () => {
-    // The prompt asks for fillers and vague phrasing to go, so a concise
-    // rewrite of a rambling utterance is a correct cleanup.
-    const spoken =
-      "um you know I just kind of wanted to say like thank you so much you know";
-    expect(
-      resolveCleanedDictation(spoken, "Thank you so much.", "end_turn"),
-    ).toEqual({ text: "Thank you so much.", rejected: null });
-  });
-
-  test("an empty rewrite falls back to raw without flagging a rejection", () => {
-    // The model returned nothing usable; there is no rewrite to distrust.
-    expect(resolveCleanedDictation(SPOKEN, "   ", "end_turn")).toEqual({
-      text: SPOKEN,
-      rejected: null,
-    });
-  });
-});
-
-describe("computeMaxTokens", () => {
-  test("budgets room for the transcript, reasoning, and JSON scaffolding", () => {
-    // The tool call carries the whole transcript back in `text`, so the
-    // budget has to clear the input's own token count with room to spare.
-    const estimatedInputTokens = Math.ceil(SPOKEN.length / 3);
-    expect(computeMaxTokens(SPOKEN.length)).toBeGreaterThan(
-      estimatedInputTokens * 2,
-    );
-  });
-
-  test("holds a floor for very short transcripts", () => {
-    expect(computeMaxTokens(5)).toBe(512);
-  });
-});