@vellumai/assistant 0.6.5 → 0.6.6

package/src/tools/system/avatar-generator.ts

@@ -3,7 +3,6 @@ import { mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 
 import { generateAvatar } from "../../media/avatar-router.js";
-import { mapGeminiError } from "../../media/gemini-image-service.js";
 import { getLogger } from "../../util/logger.js";
 import { getAvatarImagePath } from "../../util/platform.js";
 
@@ -69,7 +68,12 @@ export async function generateAndSaveAvatar(
       isError: false,
     };
   } catch (error) {
-    const message = mapGeminiError(error);
+    // avatar-router already throws with a provider-aware, user-friendly
+    // message — just surface error.message directly.
+    const message =
+      error instanceof Error
+        ? error.message
+        : "An unexpected error occurred during image generation.";
     log.error({ error: message }, "Avatar generation failed");
     return {
       content: `Avatar generation failed: ${message}`,

package/src/tools/types.ts

@@ -207,6 +207,18 @@ export interface ToolContext {
    * to cdp-inspect or local Playwright.
    */
   transportInterface?: InterfaceId;
+  /**
+   * True when the host browser proxy's sender was overridden by a
+   * registry-routed extension connection (ChromeExtensionRegistry WebSocket).
+   * The CDP factory uses this to distinguish between an SSE-backed proxy
+   * (macOS, no extension) and an extension-backed proxy: only the latter
+   * should suppress desktop-auto cdp-inspect when temporarily unavailable,
+   * because the extension transport was explicitly expected and the
+   * disconnection is transient. An SSE-backed proxy that reports
+   * unavailable (e.g. non-interactive turn) should NOT suppress
+   * cdp-inspect — the proxy was never expected to service browser requests.
+   */
+  hostBrowserRegistryRouted?: boolean;
 }
 
 export interface DiffInfo {
@@ -242,6 +254,14 @@ export interface ToolExecutionResult {
    * the LLM voluntarily end its turn.
    */
   yieldToUser?: boolean;
+  /** Risk level from the classifier (populated during permission check). */
+  riskLevel?: string;
+  /** Human-readable reason for the risk classification. */
+  riskReason?: string;
+  /** Whether the daemon is running in a containerized (Docker) environment. */
+  isContainerized?: boolean;
+  /** Scope options ladder for the rule editor (narrowest to broadest). */
+  riskScopeOptions?: Array<{ pattern: string; label: string }>;
   /**
    * When present, indicates that a CES tool returned an `approval_required`
    * response. The executor uses the approval bridge to prompt the guardian,
@@ -273,6 +293,10 @@ export interface ProxyApprovalRequest {
     matchingPatterns?: string[];
   };
   sessionId: string;
+  /** HTTP method (plain HTTP only; undefined for HTTPS CONNECT tunnels). */
+  method?: string;
+  /** Curated non-sensitive headers (plain HTTP only). */
+  requestHeaders?: Record<string, string>;
 }
 
 /** Callback for proxy policy decisions requiring user confirmation. Returns true if approved. */
@@ -296,12 +320,14 @@ export interface Tool {
   defaultRiskLevel: RiskLevel;
   /** When set to 'proxy', the tool is forwarded to a connected client rather than executed locally. */
   executionMode?: "local" | "proxy";
-  /** Whether this tool is a core built-in, provided by a skill, or from an MCP server. */
-  origin?: "core" | "skill" | "mcp";
+  /** Whether this tool is a core built-in, provided by a skill, contributed by a plugin, or from an MCP server. */
+  origin?: "core" | "skill" | "mcp" | "plugin";
   /** If origin is 'skill', the ID of the owning skill. */
   ownerSkillId?: string;
   /** If origin is 'mcp', the ID of the owning MCP server. */
   ownerMcpServerId?: string;
+  /** If origin is 'plugin', the name of the owning plugin. */
+  ownerPluginId?: string;
   /** Content-hash of the owning skill's source at registration time. */
   ownerSkillVersionHash?: string;
   /** Whether the owning skill is bundled with the daemon (trusted first-party). */

package/src/util/platform.ts

@@ -59,8 +59,14 @@ export function normalizeAssistantId(assistantId: string): string {
  * Docker mode relocates the workspace via `VELLUM_WORKSPACE_DIR` rather
  * than `BASE_DATA_DIR`, so honoring `BASE_DATA_DIR` here does not affect
  * containerized deployments.
+ *
+ * Exported so other daemon-side consumers (e.g. the meet-join orphan reaper
+ * in `skills/meet-join/daemon/docker-runner.ts`) can derive a per-instance
+ * identifier from the same canonical root. Do not replace with ad-hoc
+ * `process.env.BASE_DATA_DIR` reads — this helper is the single source of
+ * truth for per-instance path resolution.
  */
-function vellumRoot(): string {
+export function vellumRoot(): string {
   const baseDataDir = process.env.BASE_DATA_DIR?.trim();
   if (baseDataDir) return join(baseDataDir, ".vellum");
   return join(homedir(), ".vellum");
@@ -410,7 +416,6 @@ export function ensureDataDir(): void {
     // Workspace dirs
     workspace,
     join(workspace, "signals"),
-    join(workspace, "hooks"),
     join(workspace, "skills"),
     join(workspace, "routes"),
     join(workspace, "embedding-models"),

package/src/util/pricing.ts

@@ -23,9 +23,9 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
   anthropic: {
     "claude-opus-4-7": { inputPer1M: 5, outputPer1M: 25 },
     "claude-opus-4-6": { inputPer1M: 5, outputPer1M: 25 },
-    "claude-opus-4": { inputPer1M: 15, outputPer1M: 75 },
+    "claude-opus-4": { inputPer1M: 5, outputPer1M: 25 },
     "claude-sonnet-4": { inputPer1M: 3, outputPer1M: 15 },
-    "claude-haiku-4": { inputPer1M: 0.8, outputPer1M: 4 },
+    "claude-haiku-4": { inputPer1M: 1, outputPer1M: 5 },
   },
   openai: {
     "gpt-5.4": { inputPer1M: 2.5, outputPer1M: 15 },
@@ -51,9 +51,32 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
   fireworks: {
     "accounts/fireworks/models/kimi-k2p5": {
       inputPer1M: 0.6,
-      outputPer1M: 3.0,
+      outputPer1M: 2.5,
     },
   },
+  // Non-Anthropic OpenRouter models. Anthropic-on-OpenRouter is handled by a
+  // dedicated branch in resolvePricingForUsage that routes to the Anthropic
+  // catalog (OpenRouter bills those at Anthropic's direct rates). Rates here
+  // mirror the catalog metadata in model-catalog.ts so cost tracking has a
+  // priced value instead of falling back to 'unpriced'.
+  openrouter: {
+    "x-ai/grok-4.20-beta": { inputPer1M: 3, outputPer1M: 15 },
+    "x-ai/grok-4": { inputPer1M: 3, outputPer1M: 15 },
+    "deepseek/deepseek-r1-0528": { inputPer1M: 0.55, outputPer1M: 2.19 },
+    "deepseek/deepseek-chat-v3-0324": { inputPer1M: 0.27, outputPer1M: 1.1 },
+    "qwen/qwen3.5-plus-02-15": { inputPer1M: 0.8, outputPer1M: 2.4 },
+    "qwen/qwen3.5-397b-a17b": { inputPer1M: 0.9, outputPer1M: 2.7 },
+    "qwen/qwen3.5-flash-02-23": { inputPer1M: 0.2, outputPer1M: 0.6 },
+    "qwen/qwen3-coder-next": { inputPer1M: 0.5, outputPer1M: 1.5 },
+    "moonshotai/kimi-k2.6": { inputPer1M: 0.6, outputPer1M: 2.8 },
+    "moonshotai/kimi-k2.5": { inputPer1M: 0.6, outputPer1M: 2.5 },
+    "mistralai/mistral-medium-3": { inputPer1M: 0.4, outputPer1M: 2.0 },
+    "mistralai/mistral-small-2603": { inputPer1M: 0.2, outputPer1M: 0.6 },
+    "mistralai/devstral-2512": { inputPer1M: 0.1, outputPer1M: 0.3 },
+    "meta-llama/llama-4-maverick": { inputPer1M: 0.27, outputPer1M: 0.85 },
+    "meta-llama/llama-4-scout": { inputPer1M: 0.11, outputPer1M: 0.34 },
+    "amazon/nova-pro-v1": { inputPer1M: 0.8, outputPer1M: 3.2 },
+  },
 };
 
 /**

package/src/workspace/migrations/006-services-config.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { providerForImageModelPrefix } from "../../media/types.js";
 import { credentialKey } from "../../security/credential-key.js";
 import {
   getProviderKeyAsync,
@@ -110,10 +111,7 @@ export const servicesConfigMigration: WorkspaceMigration = {
     services["image-generation"] = {
       ...(existingServices["image-generation"] ?? {}),
       mode: "your-own",
-      provider:
-        imageGenModel.startsWith("dall-e") || imageGenModel.startsWith("gpt")
-          ? "openai"
-          : "gemini",
+      provider: providerForImageModelPrefix(imageGenModel),
       model: imageGenModel,
     };
 

package/src/workspace/migrations/022-move-hooks-to-workspace.ts

@@ -43,9 +43,8 @@ export const moveHooksToWorkspaceMigration: WorkspaceMigration = {
     if (!existsSync(oldHooksDir)) return;
 
     // Move hook entries from root to workspace. The old (user) entries take
-    // precedence over anything already at the destination (e.g. template
-    // files written by installTemplates(), which runs before migrations).
-    // We remove the destination first so renameSync succeeds atomically.
+    // precedence over anything already at the destination. We remove the
+    // destination first so renameSync succeeds atomically.
     try {
       const entries = readdirSync(oldHooksDir);
       for (const entry of entries) {

package/src/workspace/migrations/041-backfill-google-gmail-settings-scope.ts

@@ -7,10 +7,9 @@ const GMAIL_SETTINGS_BASIC_SCOPE =
 /**
  * Backfill the `gmail.settings.basic` scope for existing Google provider rows.
  *
- * The scope was added to PROVIDER_SEED_DATA in #25970, but `seedProviders()`
- * intentionally preserves `defaultScopes` on conflict (the `onConflictDoUpdate`
- * in `oauth-store.ts` omits `defaultScopes` and `scopePolicy`). Any workspace
- * that already had a `google` provider row never picked up the new scope.
+ * The scope was added to PROVIDER_SEED_DATA in #25970. This migration ensures
+ * existing workspace rows that were created before the seed update also include
+ * the scope.
  *
  * This migration reads the current `defaultScopes` JSON array for the `google`
  * provider and appends the scope if it is not already present.

package/src/workspace/migrations/046-seed-conversation-starters-callsite.ts

@@ -0,0 +1,108 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Seed a latency-optimized default for the `conversationStarters` LLM
+ * call site.
+ *
+ * `conversationStarters` drives the reply-suggestion chip rendered in the
+ * macOS client after every assistant turn. Migration 040 seeded most
+ * trivial copy-generation call sites to haiku-4.5 but missed this one, so
+ * it falls through to `llm.default` — on workspaces where the default is
+ * a high-effort / extended-thinking configured model (e.g. Opus 4.x at
+ * `effort: "xhigh"`), every turn completion kicks off an expensive
+ * reasoning call that, to add insult to injury, rejects the assistant
+ * message prefill the suggestion generator previously relied on with an
+ * HTTP 400.
+ *
+ * Follows the same contract as `040-seed-latency-callsite-defaults`:
+ *   - Skip entirely when `VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH` is set
+ *     (platform overlay owns call-site seeds).
+ *   - Skip when the resolved provider is not Anthropic (the seeded
+ *     model IDs are Anthropic-shaped, so mixing with another provider
+ *     would guarantee invalid-model errors).
+ *   - No-op when `llm.callSites.conversationStarters` is already set.
+ *
+ * Idempotent, append-only — existing 040 entries are untouched.
+ */
+export const seedConversationStartersCallsiteMigration: WorkspaceMigration = {
+  id: "046-seed-conversation-starters-callsite",
+  description:
+    "Seed latency-optimized default for conversationStarters LLM call site",
+  run(workspaceDir: string): void {
+    if (process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH) return;
+
+    const configPath = join(workspaceDir, "config.json");
+    const configExisted = existsSync(configPath);
+
+    let config: Record<string, unknown> = {};
+    if (configExisted) {
+      try {
+        const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+        config = raw as Record<string, unknown>;
+      } catch {
+        return;
+      }
+    }
+
+    const llm = readObject(config.llm) ?? {};
+    const defaultBlock = readObject(llm.default);
+
+    const explicitProvider = readString(defaultBlock?.provider);
+    if (
+      explicitProvider !== undefined &&
+      explicitProvider !== "anthropic" &&
+      explicitProvider !== "openrouter"
+    ) {
+      return;
+    }
+    const provider = explicitProvider ?? "anthropic";
+    const fastModel = resolveLatencyModel(provider);
+    if (fastModel === undefined) return;
+
+    const callSites = readObject(llm.callSites) ?? {};
+    if (readObject(callSites.conversationStarters) !== null) return;
+
+    callSites.conversationStarters = {
+      model: fastModel,
+      effort: "low",
+      thinking: { enabled: false },
+    };
+
+    llm.callSites = callSites;
+    config.llm = llm;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only: removing the seeded default would reintroduce the
+    // cost/latency regression and the assistant-prefill 400 that this
+    // migration fixes.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers — self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const PROVIDER_LATENCY_MODELS: Record<string, string> = {
+  anthropic: "claude-haiku-4-5-20251001",
+  openrouter: "anthropic/claude-haiku-4.5",
+};
+
+function resolveLatencyModel(provider: string): string | undefined {
+  return PROVIDER_LATENCY_MODELS[provider];
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}

package/src/workspace/migrations/047-remove-watch-callsites.ts

@@ -0,0 +1,54 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Remove `watchCommentary` and `watchSummary` entries from
+ * `llm.callSites` in existing config files. These call-sites were seeded
+ * by migration 040 but the screen-watch feature has been removed, so the
+ * keys are no longer valid members of the `LLMCallSiteEnum` and would
+ * trigger repeated validation warnings if left on disk.
+ */
+export const removeWatchCallsitesMigration: WorkspaceMigration = {
+  id: "047-remove-watch-callsites",
+  description:
+    "Remove watchCommentary and watchSummary from llm.callSites (screen-watch removed)",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = config.llm;
+    if (!llm || typeof llm !== "object" || Array.isArray(llm)) return;
+
+    const callSites = (llm as Record<string, unknown>).callSites;
+    if (!callSites || typeof callSites !== "object" || Array.isArray(callSites))
+      return;
+
+    const sites = callSites as Record<string, unknown>;
+    let mutated = false;
+
+    for (const key of ["watchCommentary", "watchSummary"]) {
+      if (key in sites) {
+        delete sites[key];
+        mutated = true;
+      }
+    }
+
+    if (!mutated) return;
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // no-op — keys are obsolete
+  },
+};

package/src/workspace/migrations/048-remove-workspace-hooks.ts

@@ -0,0 +1,81 @@
+/**
+ * Workspace migration 046: Remove legacy `workspace/hooks/` directory.
+ *
+ * Migration 022 moved `~/.vellum/hooks/` into `~/.vellum/workspace/hooks/`.
+ * With the hook system entirely removed, that directory is dead state — it is
+ * no longer read or written by the assistant. This migration deletes the
+ * directory (and everything under it) so stale hook manifests, config, and
+ * executables do not linger in user workspaces.
+ *
+ * Idempotent: safe to re-run after interruption. A no-op when the directory
+ * is already absent.
+ */
+
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-048-remove-workspace-hooks");
+
+/**
+ * Count files under `dir` recursively. Best-effort — returns the count we
+ * could successfully stat, and silently skips entries that fail (e.g. a
+ * symlink whose target is missing, a file removed concurrently). This is
+ * only used for log output, so a slightly stale count is acceptable.
+ */
+function countFilesRecursive(dir: string): number {
+  let count = 0;
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    const entryPath = join(dir, entry);
+    try {
+      const s = statSync(entryPath);
+      if (s.isDirectory()) {
+        count += countFilesRecursive(entryPath);
+      } else {
+        count += 1;
+      }
+    } catch {
+      // best-effort
+    }
+  }
+  return count;
+}
+
+export const removeWorkspaceHooksMigration: WorkspaceMigration = {
+  id: "048-remove-workspace-hooks",
+  description:
+    "Remove legacy workspace/hooks/ directory now that the hook system is gone",
+
+  run(workspaceDir: string): void {
+    const hooksDir = join(workspaceDir, "hooks");
+    if (!existsSync(hooksDir)) return;
+
+    const fileCount = countFilesRecursive(hooksDir);
+    try {
+      rmSync(hooksDir, { recursive: true, force: true });
+      log.info(
+        { path: hooksDir, fileCount },
+        "Removed legacy workspace hooks directory",
+      );
+    } catch (err) {
+      log.warn(
+        { err, path: hooksDir },
+        "Failed to remove legacy workspace hooks directory; leaving in place",
+      );
+    }
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: the hook system is gone and the directory contained no
+    // data the assistant still consumes. Restoring an empty directory would
+    // just reintroduce dead state.
+  },
+};

package/src/workspace/migrations/049-release-notes-default-sonnet.ts

@@ -0,0 +1,80 @@
+import {
+  appendFileSync,
+  existsSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-049-release-notes-default-sonnet");
+
+const MIGRATION_ID = "049-release-notes-default-sonnet";
+const MARKER = `<!-- release-note-id:${MIGRATION_ID} -->`;
+
+const RELEASE_NOTE = `${MARKER}
+## Default LLM is now Claude Sonnet 4.6 (main agent stays on Opus)
+
+The schema-level default for \`llm.default.model\` is now
+\`claude-sonnet-4-6\` instead of \`claude-opus-4-7\`, so background call
+sites that fall through to the default now use Sonnet. If you've
+already chosen a model, your persisted config takes precedence.
+
+The main agent conversation loop remains on Opus: a companion
+migration seeds \`llm.callSites.mainAgent = { model: "claude-opus-4-7" }\`
+when it's unset, and the \`quality-optimized\` model intent also still
+resolves to Opus.
+
+To switch the main agent to Sonnet, clear the call-site override:
+
+\`\`\`bash
+assistant config unset llm.callSites.mainAgent
+\`\`\`
+
+To switch the overall default back to Opus, run:
+
+\`\`\`bash
+assistant config set llm.default.model claude-opus-4-7
+\`\`\`
+`;
+
+export const releaseNotesDefaultSonnetMigration: WorkspaceMigration = {
+  id: MIGRATION_ID,
+  description:
+    "Append release notes for default LLM switch to Claude Sonnet 4.6 to UPDATES.md",
+
+  run(workspaceDir: string): void {
+    const updatesPath = join(workspaceDir, "UPDATES.md");
+
+    try {
+      if (existsSync(updatesPath)) {
+        const existing = readFileSync(updatesPath, "utf-8");
+        if (existing.includes(MARKER)) {
+          return;
+        }
+        const needsLeadingNewline = !existing.endsWith("\n\n");
+        const prefix = existing.endsWith("\n") ? "\n" : "\n\n";
+        appendFileSync(
+          updatesPath,
+          needsLeadingNewline ? `${prefix}${RELEASE_NOTE}` : RELEASE_NOTE,
+          "utf-8",
+        );
+      } else {
+        writeFileSync(updatesPath, RELEASE_NOTE, "utf-8");
+      }
+      log.info({ path: updatesPath }, "Appended default-Sonnet release note");
+    } catch (err) {
+      log.warn(
+        { err, path: updatesPath },
+        "Failed to append default-Sonnet release note to UPDATES.md",
+      );
+    }
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: UPDATES.md is a user-facing bulletin the assistant
+    // processes and deletes on its own.
+  },
+};

package/src/workspace/migrations/050-seed-main-agent-opus-callsite.ts

@@ -0,0 +1,86 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Seed `callSites.mainAgent = { model: "claude-opus-4-7" }` so the main
+ * agent conversation loop stays on Opus even though the schema-level
+ * default dropped to Sonnet. Runs in two modes, mirroring migration 040:
+ *
+ *   1. **Existing workspace** (config.json present): merge the seed into
+ *      `llm.callSites` without overwriting a user-defined override.
+ *   2. **Fresh install** (config.json absent): write a minimal starter
+ *      config with just this seed. `loadConfig()` runs after migrations
+ *      and backfills the remaining schema defaults via `deepMergeMissing`.
+ *
+ * Applied only when:
+ *   - the resolved provider is Anthropic (other providers own their
+ *     own mainAgent model choice), **and**
+ *   - `llm.default.model` is either unset or equal to the previous
+ *     schema default `claude-opus-4-7` — a user who explicitly picked
+ *     a different Anthropic model (e.g. Haiku) kept their own choice,
+ *     so forcing Opus onto their mainAgent would be surprising.
+ */
+export const seedMainAgentOpusCallsiteMigration: WorkspaceMigration = {
+  id: "050-seed-main-agent-opus-callsite",
+  description: "Seed callSites.mainAgent to claude-opus-4-7 for Anthropic",
+  run(workspaceDir: string): void {
+    // Defer to platform-provided overlays.
+    if (process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH) return;
+
+    const configPath = join(workspaceDir, "config.json");
+    const configExisted = existsSync(configPath);
+
+    let config: Record<string, unknown> = {};
+    if (configExisted) {
+      try {
+        const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+        config = raw as Record<string, unknown>;
+      } catch {
+        return;
+      }
+    }
+
+    const llm = readObject(config.llm) ?? {};
+    const defaultBlock = readObject(llm.default);
+
+    const explicitProvider = readString(defaultBlock?.provider);
+    if (explicitProvider !== undefined && explicitProvider !== "anthropic") {
+      return;
+    }
+
+    const explicitModel = readString(defaultBlock?.model);
+    if (explicitModel !== undefined && explicitModel !== "claude-opus-4-7") {
+      return;
+    }
+
+    const callSites = readObject(llm.callSites) ?? {};
+
+    if (readObject(callSites.mainAgent) !== null) return;
+
+    // maxTokens: 32000 matches Opus's maxOutputTokens (see
+    // model-catalog.ts); without it the site would inherit the
+    // default's 64000 and overshoot the model capability.
+    callSites.mainAgent = { model: "claude-opus-4-7", maxTokens: 32000 };
+    llm.callSites = callSites;
+    config.llm = llm;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only: removing the seed would silently downgrade the main
+    // agent loop to Sonnet on every re-run.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}