nodal-agents 0.3.10 → 0.4.2

package/README.md

@@ -7,9 +7,20 @@
 [![Node](https://img.shields.io/badge/node-22%2B-339933?logo=node.js&logoColor=white)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/typescript-strict-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org)
 
-Build and orchestrate AI agents on your own hardware. Multi-LLM,
-multi-channel, multi-connector — **no SaaS lock-in, no per-token markup,
-no cloud roundtrip.** Runs on any machine with Node 22+ — Mac, PC, Linux.
+Build and orchestrate a **team of AI agents** on your own hardware —
+each with its own personality, tools, memory, and model. Talk to them in
+the dashboard or on Telegram; they research, write files, call your
+connectors, and delegate to each other to get the job done.
+
+**No SaaS lock-in. No per-token markup. No cloud roundtrip.** Two commands
+to install, runs on any machine with Node 22+ (Mac, PC, Linux), and works
+with **any LLM** — frontier or local, paid or free.
+
+> **Run the models others choke on.** DeepSeek V4 works out of the box —
+> including the cheap, fast OpenRouter routes — because the runtime quietly
+> handles its quirks (non-standard tool-call payloads) instead of failing.
+> Mix the right model per agent: a frontier model where judgment matters, a
+> near-free one where it doesn't.
 
 ---
 
@@ -18,9 +29,11 @@ no cloud roundtrip.** Runs on any machine with Node 22+ — Mac, PC, Linux.
 | | |
 | --- | --- |
 | 🏠  **Local-first** | Single binary, embedded Postgres, zero cloud dependency. Your conversations, memory, and credentials stay on your machine. |
-| 🔌  **LLM-agnostic** | Anthropic, OpenAI, Google, Groq, Mistral, OpenRouter, or any OpenAI-compatible local model (LM Studio, Ollama). Per-agent key, swap providers without code changes. |
+| 🔌  **Any model, per agent** | Anthropic, OpenAI, Google, Groq, Mistral, OpenRouter, or any local model (LM Studio, Ollama). Setup is just an API key per provider — **each agent picks its own model**, so you can run Claude for the orchestrator and **DeepSeek V4** for the workers. The quirks of OSS frontier models (DeepSeek's non-spec tool args, Kimi/Qwen/GLM XML tool formats) are handled automatically. |
+| 🛟  **Provider failover** | Give an agent a backup key chain — if its provider 5xx's, times out, or hits quota mid-job, the runner fails over to the next one and keeps going (and fails loud only when the whole chain is down). |
 | 🧠  **Memory that compounds** | Persistent facts (entity-scoped, auto-injected into every job) and chat-thread continuity (your agent remembers what it said 30 seconds ago — and what it said yesterday). |
-| 🤝  **Orchestrators that finish** | Router and planner orchestrators delegate to specialist sub-agents. Hard guards against runaway loops — turn caps, chain caps, per-slug delegation budgets, smart retry on side-effect-free failures. |
+| 🤝  **Orchestrators that finish** | Router and planner orchestrators delegate to specialist sub-agents, then resume on completion to wrap up the answer. |
+| 🛡️  **Agents that don't lie, loop, or die** | Generic runtime guards: a per-job token budget and a no-progress detector kill runaway loops; a no-false-success guard refuses to report "done" when an action actually failed (fail loud, never fake it); turn/chain/delegation caps bound everything. |
 | 🔧  **Multi-instance connectors** | Gmail perso *and* Gmail boulot on the same install. OAuth *and* API-key supported. Active list + Marketplace UI in the dashboard. |
 | 🗂️  **Workspaces** | Multiple isolated workspaces on one install (personal vs work) — each with its own agents, skills, connectors, jobs and memory. Switch from the sidebar. |
 | 🤖  **Self-extending (ROOT agent)** | Designate an orchestrator as ROOT and let it create skills/agents and assign them on your behalf — gated by per-grant toggles and an autonomy level (propose-confirm → fully-autonomous). |
@@ -48,8 +61,8 @@ nodal-agents up
 
 Open <http://localhost:3000>. The CLI spawns an embedded Postgres on a
 free port, applies migrations, seeds the system skills, and starts the
-runner (`:3001`) and dashboard (`:3000`). Configure your LLM provider
-from **Settings → LLM Keys** in the dashboard.
+runner (`:3001`) and dashboard (`:3000`). Connect an LLM provider from
+**LLM Providers** in the dashboard — paste an API key and you're running.
 
 > Requires Node 22+. No external Postgres, no Redis, no cloud config.
 > Data lives at `~/.nodalai/` — wipe with `rm -rf ~/.nodalai`.
@@ -77,7 +90,7 @@ When a newer version is available, `nodal-agents up` also prints a one-line
 notice:
 
 ```
-ℹ v0.4.0 available — run `nodal-agents update`
+ℹ v0.4.2 available — run `nodal-agents update`
 ```
 
 ### Build from source
@@ -131,7 +144,8 @@ Delegations create child jobs that resume the parent on completion.
 
 | Route | Purpose |
 | --- | --- |
-| `/agents` | Create, edit, assign skills + connectors + MCP servers to agents. |
+| `/agents` | Create, edit, assign skills + connectors + MCP servers to agents — and pick each agent's provider + model (with an optional failover chain). |
+| `/llm-providers` | Connect each LLM provider with a single API key — enable/disable inline. Models are chosen per-agent, not here. |
 | `/jobs` | Live job stream — task, agent, status, full transcript, tool I/O. |
 | `/connectors` | Active connector instances + Marketplace (multi-instance, OAuth or API-key). |
 | `/mcp` | Active MCP servers + Marketplace — HTTP & stdio, a growing catalogue, plus add/edit your own custom servers. |
@@ -140,7 +154,7 @@ Delegations create child jobs that resume the parent on completion.
 | `/logs` | Tool-call audit — input/output JSON per call, filterable by tool name. |
 | `/approvals` | Human-in-the-loop gates for risky tools (and the ROOT agent's meta-tools under propose-confirm). |
 | `/automations` | Cron-scheduled agent triggers. |
-| `/settings` | LLM keys, auth mode, network (loopback / LAN), bot tokens, workspace management, ROOT-agent designation + grants/autonomy. |
+| `/settings` | Auth mode, network (loopback / LAN), bot tokens, workspace management, ROOT-agent grants + autonomy. |
 
 ---
 
@@ -204,23 +218,34 @@ pnpm deps:check   # runs locally and in CI before every release
 
 ## Status
 
-**Current release:** `0.3.10` on npm `latest`. Used daily by the
+**Current release:** `0.4.2` on npm `latest`. Used daily by the
 maintainer, stable enough for personal production. Pre-1.0 — breaking
 changes are still possible between minors.
 
 ### Shipped and working
 
-- Multi-LLM provider routing with per-agent keys
+- Multi-LLM, **per-agent model selection** — provider setup is just an API key
+  (one per provider); each agent chooses its own model on top. Frontier and
+  local providers, including **DeepSeek V4** (non-spec tool-call args normalized
+  automatically), plus native tool-call parsing for Kimi K2 / Qwen3-Coder / GLM
+- **Provider failover** — an opt-in ordered key chain per agent; on a 5xx /
+  timeout / quota mid-job the runner fails over to the next key, and fails loud
+  (`all_providers_failed`) only when the whole chain is exhausted
+- **Reliability guards (generic, model-agnostic)** — per-job token budget +
+  no-progress detector (kill runaway loops), and a no-false-success guard that
+  refuses to complete a job as "success" when a tool action failed and was never
+  resolved (fail loud, never fake it)
 - Persistent memory (sanitation, dedup, importance ranking, auto-injection,
   feedback loop)
 - Session-thread continuity on chat channels (Telegram today)
-- Orchestrator (router + planner) with delegation chains and anti-runaway
-  caps
+- Orchestrator (router + planner) with delegation chains that resume the
+  parent on completion
 - Multi-instance connectors with OAuth (Gmail, Drive, Sheets, Docs, Notion,
   Airtable) and API-key (Notion, Airtable, Apify, Firecrawl, Tavily)
 - MCP catalog — Streamable HTTP *and* stdio (local subprocess) servers, API-key auth; a growing catalogue (Stripe, n8n, Supabase, Airtable, Notion…) with a "test pending" badge on entries not yet verified live, plus add *and edit* your own custom HTTP/stdio servers from the dashboard
 - Top-level workspaces — multiple isolated entities (agents/skills/connectors/jobs/memory per workspace), switch in the sidebar
-- ROOT agent — designate an orchestrator that can create *and update* skills, create agents and assign them, gated by per-grant toggles + an autonomy/approval level; skill authoring is grounded in the workspace's real tools (a linter rejects skills referencing tools the agent doesn't have)
+- In-app ROOT chat — talk to your workspace ROOT right in the dashboard: conversation-first (pure chat never creates a job — recall is free, the agent's memory is auto-loaded), multiple conversations with searchable history, and inline "dispatched to N agents" cards when it escalates a real action into a tracked job
+- ROOT agent — your first orchestrator automatically becomes the workspace ROOT (the single top-level agent; later orchestrators slot under it). It can create *and update* skills, create agents and assign them, and create MCP servers + API connectors — each gated by per-grant toggles + an autonomy/approval level (powers start off, opt in per grant). Provisioning verifies before it writes (an MCP server is connected and its tools listed first); skill authoring is grounded in the workspace's real tools (a linter rejects skills referencing tools the agent doesn't have)
 - Office file editing — Excel in-place edit, Word/PowerPoint create, in the agent workspace (office-editing skill)
 - Multiple filesystem folders per agent (sandboxed `file_*` tools)
 - Telegram delivery (long-poll, group filters, multi-agent routing,
@@ -237,9 +262,8 @@ changes are still possible between minors.
 
 - **MCP OAuth flow** → unlocks Linear, Notion remote, GitHub remote,
   Atlassian, Sentry, and the rest of the SaaS-as-MCP ecosystem.
-- **Dashboard chat for the ROOT companion** → talk to your ROOT agent in
-  the app, multi-turn, instead of via Telegram; plus a dry-run mode and a
-  test-workflow meta-tool.
+- **Dry-run mode + a test-workflow meta-tool** → preview what the ROOT would
+  do before it runs, and let it validate an automation end-to-end.
 - **pgvector binaries bundled in the npm pack** → semantic memory search
   active out-of-the-box. Today, installs without pgvector fall back to
   keyword search (which works, just less smart for cross-vocabulary

package/cli.js

@@ -11272,7 +11272,8 @@ var init_enums = __esm({
       "cron",
       "task-board",
       "slack",
-      "discord"
+      "discord",
+      "dashboard"
     ];
     JobChannelSchema = z2.enum(JOB_CHANNELS);
     JOB_STATUSES = [
@@ -12170,11 +12171,27 @@ var init_root_agent = __esm({
       createSkill: z19.boolean(),
       updateSkill: z19.boolean(),
       assignSkill: z19.boolean(),
+      createMcp: z19.boolean(),
+      createConnector: z19.boolean(),
       autonomy: AutonomyLevelSchema
     });
   }
 });
 
+// ../../packages/shared/src/connector-catalog.ts
+var init_connector_catalog = __esm({
+  "../../packages/shared/src/connector-catalog.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/model-catalog.ts
+var init_model_catalog = __esm({
+  "../../packages/shared/src/model-catalog.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/index.ts
 var init_src2 = __esm({
   "../../packages/shared/src/index.ts"() {
@@ -12199,6 +12216,8 @@ var init_src2 = __esm({
     init_operation();
     init_providers();
     init_root_agent();
+    init_connector_catalog();
+    init_model_catalog();
   }
 });
 
@@ -12353,7 +12372,6 @@ var init_llm_keys = __esm({
         apiKeyLast4: text("api_key_last4").notNull().default(""),
         baseUrl: text("base_url"),
         nickname: text("nickname"),
-        defaultModel: text("default_model"),
         isActive: boolean("is_active").notNull().default(true),
         createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -12382,6 +12400,14 @@ var init_agents = __esm({
         personality: text("personality").notNull(),
         model: text("model").default("claude-sonnet-4-6-20260217"),
         llmKeyId: uuid("llm_key_id").references(() => entityLlmKeys.id, { onDelete: "set null" }),
+        // Ordered LLM-key fallback chain (Guard 2). When the primary key
+        // (llmKeyId) exhausts retries / times out / hits quota mid-job, the runner
+        // fails over to these in order; all-down fails loud (`all_providers_failed`).
+        // Empty = no failover (default). Each link is a (keyId, model) pair so a
+        // fallback runs on a CHOSEN model (empty model ⇒ that provider's catalog
+        // default). FK integrity is enforced in the app layer; a deleted key is
+        // skipped at resolution time.
+        fallbackChain: jsonb("fallback_chain").$type().default(sql`'[]'::jsonb`),
         active: boolean("active").default(true),
         isDefault: boolean("is_default").default(false),
         role: text("role").default("agent"),
@@ -12531,7 +12557,7 @@ var init_jobs = __esm({
         ),
         check(
           "agent_jobs_channel_check",
-          sql`${table.channel} IN ('telegram','api','whatsapp','internal','cron','task-board','slack','discord')`
+          sql`${table.channel} IN ('telegram','api','whatsapp','internal','cron','task-board','slack','discord','dashboard')`
         )
       ]
     );
@@ -13290,6 +13316,56 @@ var init_agent_workspaces = __esm({
   }
 });
 
+// ../../packages/db/src/schema/chat-messages.ts
+var conversations, chatMessages;
+var init_chat_messages = __esm({
+  "../../packages/db/src/schema/chat-messages.ts"() {
+    "use strict";
+    init_pg_core();
+    init_drizzle_orm();
+    init_entities();
+    init_agents();
+    init_jobs();
+    conversations = pgTable(
+      "conversations",
+      {
+        id: uuid("id").primaryKey().defaultRandom(),
+        entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
+        // The agent this conversation is with (the ROOT, today).
+        agentId: uuid("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+        title: text("title").notNull().default(""),
+        createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
+        // Bumped on each new turn — drives the recency sort in the sidebar.
+        updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
+      },
+      (table) => [
+        index("idx_conversations_entity_agent").on(table.entityId, table.agentId, table.updatedAt)
+      ]
+    );
+    chatMessages = pgTable(
+      "chat_messages",
+      {
+        id: uuid("id").primaryKey().defaultRandom(),
+        entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
+        agentId: uuid("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+        conversationId: uuid("conversation_id").references(() => conversations.id, {
+          onDelete: "cascade"
+        }),
+        role: text("role").notNull(),
+        content: text("content").notNull(),
+        // Set when this (assistant) turn escalated into a real action job — lets the
+        // UI render the job's dispatch/progress inline. NULL for pure conversation.
+        jobId: uuid("job_id").references(() => agentJobs.id, { onDelete: "set null" }),
+        createdAt: timestamp("created_at", { withTimezone: true }).defaultNow()
+      },
+      (table) => [
+        index("idx_chat_messages_conversation").on(table.conversationId, table.createdAt),
+        check("chat_messages_role_check", sql`${table.role} IN ('user','assistant')`)
+      ]
+    );
+  }
+});
+
 // ../../packages/db/src/schema/index.ts
 var schema_exports = {};
 __export(schema_exports, {
@@ -13331,8 +13407,10 @@ __export(schema_exports, {
   agents: () => agents,
   approvalRequests: () => approvalRequests,
   approvalRules: () => approvalRules,
+  chatMessages: () => chatMessages,
   configuratorSessions: () => configuratorSessions,
   connectors: () => connectors,
+  conversations: () => conversations,
   credentials: () => credentials,
   entities: () => entities,
   entityLlmKeys: () => entityLlmKeys,
@@ -13373,6 +13451,7 @@ var init_schema2 = __esm({
     init_auth();
     init_agent_connector_assignments();
     init_agent_workspaces();
+    init_chat_messages();
   }
 });
 
@@ -13433,7 +13512,9 @@ var init_credentials2 = __esm({
 var init_agents2 = __esm({
   "../../packages/db/src/repos/agents.ts"() {
     "use strict";
+    init_src2();
     init_agents();
+    init_entities();
   }
 });
 

package/migrations/0024_agent_jobs_dashboard_channel.sql

@@ -0,0 +1,11 @@
+-- 0024_agent_jobs_dashboard_channel.sql
+-- V4 — in-app ROOT chat (2026-05-31):
+--   Allow 'dashboard' as an agent_jobs.channel value so the dashboard chat with
+--   the ROOT agent reuses the same job lifecycle + thread continuity as Telegram.
+--   Rebuild the CHECK constraint to include 'dashboard'. Idempotent.
+
+ALTER TABLE agent_jobs DROP CONSTRAINT IF EXISTS agent_jobs_channel_check;
+
+ALTER TABLE agent_jobs
+  ADD CONSTRAINT agent_jobs_channel_check
+  CHECK (channel IN ('telegram','api','whatsapp','internal','cron','task-board','slack','discord','dashboard'));

package/migrations/0025_agent_jobs_conversational.sql

@@ -0,0 +1,9 @@
+-- 0025_agent_jobs_conversational.sql
+-- V4 — in-app ROOT chat, "jobless" conversation model (2026-05-31):
+--   A chat turn that only used conversational tools (text + memory + delivery)
+--   is conversation, not work — it belongs in /chat, never in /jobs. The runner
+--   flags it at completion; the dashboard filters Runs/stats on this column.
+--   Default false → all existing + non-chat jobs remain visible as Runs.
+
+ALTER TABLE agent_jobs
+  ADD COLUMN IF NOT EXISTS conversational boolean NOT NULL DEFAULT false;

package/migrations/0026_chat_messages.sql

@@ -0,0 +1,19 @@
+-- 0026_chat_messages.sql
+-- V4 — conversation-first in-app chat (2026-05-31):
+--   A conversation is NOT a job. Pure chat turns (text + memory) are stored here
+--   and never create an agent_jobs row. Only an ACTION turn escalates to a job,
+--   whose id is linked via job_id so the UI shows progress inline.
+
+CREATE TABLE IF NOT EXISTS chat_messages (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  entity_id uuid REFERENCES entities(id) ON DELETE CASCADE,
+  agent_id uuid NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  thread_id text NOT NULL DEFAULT 'main',
+  role text NOT NULL CHECK (role IN ('user','assistant')),
+  content text NOT NULL,
+  job_id uuid REFERENCES agent_jobs(id) ON DELETE SET NULL,
+  created_at timestamptz DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_chat_messages_thread
+  ON chat_messages (entity_id, agent_id, thread_id, created_at);

package/migrations/0027_drop_agent_jobs_conversational.sql

@@ -0,0 +1,6 @@
+-- 0027_drop_agent_jobs_conversational.sql
+-- Revert the short-lived "conversational" flag (migration 0025). The in-app chat
+-- is now conversation-first: pure chat lives in chat_messages and never creates
+-- an agent_jobs row at all, so flagging/hiding jobs is no longer needed.
+
+ALTER TABLE agent_jobs DROP COLUMN IF EXISTS conversational;

package/migrations/0028_conversations.sql

@@ -0,0 +1,27 @@
+-- 0028_conversations.sql
+-- V4 chat — multi-conversation backbone (2026-06-01):
+--   Group chat_messages under named `conversations` (the sidebar entries), so
+--   the chat gets multiple threads, "+ New", recency sort, and a clean history
+--   model. Replaces the single hardcoded thread_id on chat_messages.
+
+CREATE TABLE IF NOT EXISTS conversations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  entity_id uuid REFERENCES entities(id) ON DELETE CASCADE,
+  agent_id uuid NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  title text NOT NULL DEFAULT '',
+  created_at timestamptz DEFAULT now(),
+  updated_at timestamptz DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_conversations_entity_agent
+  ON conversations (entity_id, agent_id, updated_at);
+
+ALTER TABLE chat_messages
+  ADD COLUMN IF NOT EXISTS conversation_id uuid REFERENCES conversations(id) ON DELETE CASCADE;
+
+-- thread_id is superseded by conversation_id. Existing dev rows (if any) had
+-- thread_id='main' and get a NULL conversation_id (orphaned, not shown).
+ALTER TABLE chat_messages DROP COLUMN IF EXISTS thread_id;
+
+CREATE INDEX IF NOT EXISTS idx_chat_messages_conversation
+  ON chat_messages (conversation_id, created_at);

package/migrations/0029_backfill_root_agent.sql

@@ -0,0 +1,33 @@
+-- 0029_backfill_root_agent.sql
+-- Brique F — "ROOT = origin orchestrator" (2026-06-01).
+--
+-- Designate a ROOT for any entity that has at least one orchestrator but no
+-- root_agent_id yet: the earliest-created orchestrator wins. Additive only —
+-- entities that already have a ROOT (and its configured grants) are left
+-- untouched, so a manually-set ROOT and its powers are preserved.
+--
+-- Going forward, createAgentRepo auto-designates the first orchestrator of an
+-- entity as ROOT and forces subsequent ones under it. Grants start all-off
+-- (opt-in powers in Settings → ROOT agent); writing them explicitly matters
+-- because a null root_grants parses to all-on (un-gated meta-tools).
+--
+-- Idempotent: the `root_agent_id IS NULL` guard makes re-runs a no-op.
+
+UPDATE entities e
+SET
+  root_agent_id = sub.first_orch,
+  root_grants = '{"createAgent":false,"createSkill":false,"updateSkill":false,"assignSkill":false,"createMcp":false,"autonomy":"propose_confirm"}'::jsonb,
+  updated_at = now()
+FROM (
+  SELECT a.entity_id, a.id AS first_orch
+  FROM agents a
+  WHERE a.role = 'orchestrator'
+    AND NOT EXISTS (
+      SELECT 1 FROM agents a2
+      WHERE a2.entity_id = a.entity_id
+        AND a2.role = 'orchestrator'
+        AND (a2.created_at < a.created_at OR (a2.created_at = a.created_at AND a2.id < a.id))
+    )
+) AS sub
+WHERE e.id = sub.entity_id
+  AND e.root_agent_id IS NULL;

package/migrations/0030_agent_fallback_llm_keys.sql

@@ -0,0 +1,6 @@
+-- Guard 2 (provider failover): ordered LLM-key fallback chain per agent.
+-- When the agent's primary key (llm_key_id) exhausts retries / times out /
+-- hits quota mid-job, the runner fails over to these keys in order; all-down
+-- fails loud (`all_providers_failed`). Empty default = no failover.
+ALTER TABLE "agents"
+  ADD COLUMN IF NOT EXISTS "fallback_llm_key_ids" uuid[] DEFAULT '{}'::uuid[];

package/migrations/0031_llm_key_capabilities.sql

@@ -0,0 +1,7 @@
+-- T2 (per-model LLM capabilities): cache a key's tool-calling capability so the
+-- runtime can pick the right tool_choice WITHOUT a failed first call. NULL =
+-- unknown (runtime assumes supported; the tool_choice floor catches a wrong
+-- guess). Set from the model catalog or the live "Test" capability probe.
+ALTER TABLE "entity_llm_keys"
+  ADD COLUMN IF NOT EXISTS "supports_tools" boolean,
+  ADD COLUMN IF NOT EXISTS "supports_forced_tool_choice" boolean;

package/migrations/0032_drop_llm_key_model_caps.sql

@@ -0,0 +1,9 @@
+-- Simplify LLM providers: a key is now JUST credentials (provider + API key +
+-- base URL + active). The model is chosen per-AGENT, and tool capability is
+-- read from the code model catalog at runtime — so these per-key columns are
+-- dead weight. Drop them. (0030 fallback_llm_key_ids stays — failover is still a
+-- per-key concern.)
+ALTER TABLE "entity_llm_keys"
+  DROP COLUMN IF EXISTS "default_model",
+  DROP COLUMN IF EXISTS "supports_tools",
+  DROP COLUMN IF EXISTS "supports_forced_tool_choice";

package/migrations/0033_agent_fallback_chain.sql

@@ -0,0 +1,21 @@
+-- Per-fallback model selection (Guard 2). The failover chain now stores
+-- (keyId, model) pairs instead of bare key ids, so each fallback runs on a
+-- CHOSEN model rather than its provider's catalog default. Backfill existing
+-- id arrays with an empty model ('' ⇒ runtime uses the catalog default), then
+-- drop the old column.
+ALTER TABLE "agents"
+  ADD COLUMN IF NOT EXISTS "fallback_chain" jsonb DEFAULT '[]'::jsonb;
+
+UPDATE "agents"
+SET "fallback_chain" = COALESCE(
+  (
+    SELECT jsonb_agg(jsonb_build_object('keyId', kid::text, 'model', ''))
+    FROM unnest("fallback_llm_key_ids") AS kid
+  ),
+  '[]'::jsonb
+)
+WHERE "fallback_llm_key_ids" IS NOT NULL
+  AND array_length("fallback_llm_key_ids", 1) > 0;
+
+ALTER TABLE "agents"
+  DROP COLUMN IF EXISTS "fallback_llm_key_ids";