fix: reconcile SQLite migrations across plugin and npm releases

[mldangelo-oai]

Summary

• Reconcile the desktop plugin's legacy execution-profile migrations 11/12 with the canonical deep-scan and continuation-thread migrations.
• Move the public CLI's historical completion-warning migration from version 25 to version 26 and materialize the canonical model-settings migration at version 25.
• Preserve legacy execution-profile values and constraints, existing completion warnings, and previously saved scans across mixed or partially normalized databases.
• Add real upgrade regression coverage for both legacy-profile/public-CLI collisions and existing public CLI databases.

Why

Desktop plugin 0.1.14, desktop plugin 0.1.15, and public npm CLI 0.1.5 assigned different meanings to the same SQLite migration versions. Databases upgraded across those surfaces could fail with missing deep_scan_owner_thread_id, duplicate reasoning_effort, or duplicate completion_warnings_json columns.

Validation

• Full public SDK suite: 708 passed, 5 skipped.
• Focused upgrade regressions: 2 passed.
• pnpm run types and pnpm run format.
• Built and validated the actual npm tarball with the installed-package smoke and package-contract checks.
• Verified the public source, monorepo source, and packed npm artifact against real plugin 0.1.14, npm CLI 0.1.5, mixed-history, and active-database snapshots.

[mldangelo-oai]

@codex review

Please review the current head 0eb85cbe711d741132f1b09ed7183d3363ac906a, with particular attention to SQLite migration ordering, legacy constraint preservation, cross-release compatibility, and idempotency.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0eb85cbe71

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0eb85cbe71

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review Please review the exact updated head 86ea5ae5da04faaaae6b38224e3103743b782891. This follow-up accepts released scan continuation threads at v12 after legacy profile v11, normalizes historical phase-progress v12 before profile migrations, and rejects unknown v11/v12 names before mutating migration history.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 86ea5ae5da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 86ea5ae5da

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.