WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

scripts/fix_graph_model_thinking.cjs

@@ -0,0 +1,91 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const { execFileSync } = require('node:child_process')
+const { idle } = require('./publish_public_runtime.cjs')
+
+const root = path.resolve(__dirname, '../..')
+const modelID = '404e005b-83ae-5e2e-a3b3-999f9d5cd47e'
+const tenantID = 10059
+const report = { checked_at: new Date().toISOString(), model_id: modelID, tenant_id: tenantID, model_calls: 0, changed: false }
+let token, stage = 'snapshot'
+
+function snapshot() {
+  const sql = `BEGIN READ ONLY;
+SELECT json_build_object('model_id',id,'provider',parameters->>'provider',
+ 'thinking_control',parameters->'extra_config'->>'thinking_control',
+ 'unchanged_fields_sha256',encode(sha256(convert_to((to_jsonb(models) - 'updated_at' - 'parameters' ||
+ jsonb_build_object('parameters',parameters #- '{extra_config,thinking_control}'))::text,'UTF8')),'hex'))
+ FROM models WHERE id='${modelID}' AND tenant_id=${tenantID} AND deleted_at IS NULL;
+COMMIT;`
+  const result = execFileSync('docker', ['--context', 'colima-yawan', 'exec', '-i', 'WeKnora-postgres',
+    'psql', '-X', '-qAt', '-v', 'ON_ERROR_STOP=1', '-U', 'postgres', '-d', 'yawan_native_acceptance_20260915'],
+  { input: sql, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 15000 })
+  return JSON.parse(result)
+}
+
+async function api(route, method = 'GET', body) {
+  const response = await fetch(`http://127.0.0.1:18080/api/v1${route}`, {
+    method, headers: { 'Content-Type': 'application/json', ...(token ? { Authorization: `Bearer ${token}`, 'X-Tenant-ID': String(tenantID) } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body), signal: AbortSignal.timeout(30000),
+  })
+  assert.equal(response.status, 200)
+  const result = await response.json()
+  assert.notEqual(result.success, false)
+  return result.data || result
+}
+
+async function main() {
+  const before = snapshot()
+  report.before = before
+  assert.equal(before.provider, 'deepseek')
+  assert.equal(before.thinking_control, 'none')
+  if (!process.argv.includes('--apply')) {
+    console.log(JSON.stringify({ ...report, proposed: 'thinking_type', dry_run: true }))
+    return
+  }
+  stage = 'idle_check'
+  idle()
+  stage = 'login'
+  const credentials = JSON.parse(fs.readFileSync(path.join(root, 'acceptance/super-admin-login.json'), 'utf8'))
+  token = (await api('/auth/login', 'POST', credentials)).token
+  assert.ok(token)
+  stage = 'model_read'
+  const model = await api(`/models/${modelID}`)
+  assert.equal(model.tenant_id, tenantID)
+  assert.equal(model.name, 'deepseek-flash')
+  assert.equal(model.type, 'KnowledgeQA')
+  assert.equal(model.source, 'remote')
+  assert.equal(model.parameters.provider, 'deepseek')
+  assert.equal(new URL(model.parameters.base_url).hostname, 'api.deepseek.com')
+  assert.equal(model.parameters.extra_config?.thinking_control, 'none')
+  const receiptPath = path.join(root, 'acceptance', `graph-model-thinking-fix-${Date.now()}.json`)
+  fs.writeFileSync(receiptPath, JSON.stringify(report, null, 2) + '\n', { flag: 'wx', mode: 0o600 })
+  stage = 'compare_before_update'
+  assert.deepEqual(snapshot(), before)
+  stage = 'model_update'
+  await api(`/models/${modelID}`, 'PUT', {
+    name: model.name, display_name: model.display_name, description: model.description,
+    type: model.type, source: model.source,
+    parameters: { ...model.parameters, extra_config: { ...model.parameters.extra_config, thinking_control: 'thinking_type' } },
+  })
+  report.changed = true
+  stage = 'verify'
+  report.after = snapshot()
+  fs.writeFileSync(receiptPath, JSON.stringify(report, null, 2) + '\n', { mode: 0o600 })
+  assert.equal(report.after.thinking_control, 'thinking_type')
+  assert.equal(report.after.unchanged_fields_sha256, before.unchanged_fields_sha256)
+  const after = await api(`/models/${modelID}`)
+  assert.equal(after.parameters.extra_config.thinking_control, 'thinking_type')
+  report.passed = true
+  report.verified_at = new Date().toISOString()
+  fs.writeFileSync(receiptPath, JSON.stringify(report, null, 2) + '\n', { mode: 0o600 })
+  console.log(JSON.stringify({ passed: true, changed: true, before: 'none', after: 'thinking_type',
+    unrelated_fields_and_credentials_preserved: true, model_calls: 0, receipt_path: receiptPath }))
+}
+
+main().catch(() => {
+  console.error(JSON.stringify({ passed: false, stage, changed: report.changed, model_calls: 0,
+    error: 'Guarded model configuration update stopped; inspect the private receipt without printing credentials.' }))
+  process.exitCode = 1
+})