@mycadet/assistant 0.12.11 → 0.13.0

package/src/config/cloud-speech-defaults.ts

@@ -1,300 +0,0 @@
-/**
- * Managed-speech defaulting.
- *
- * When the cloud connection is usable and a speech service has no working
- * BYOK credential, that service's effective provider is `"cadet"` so a fresh
- * Cadet connection gets voice features with zero configuration. A service
- * whose BYOK credential is configured is never redirected — connecting Cadet
- * must not silently reroute an existing voice setup — and a service already on
- * Cadet is left alone.
- *
- * {@link resolveEffectiveSpeechProviders} is the single definition of that
- * rule. It writes nothing, so runtime paths that only need to know which
- * provider they will actually use (live-voice readiness, transcription,
- * synthesis) resolve the same ids the scope-gated writer
- * {@link maybeDefaultSpeechToCloud} would persist, without needing write
- * access to the config.
- */
-
-import { ttsSecretResolves } from "../calls/telephony-tts-capability.js";
-import { managedSpeechAvailable } from "../cloud/cloud-speech.js";
-import { fluxModelForLanguage } from "../providers/speech-to-text/deepgram-flux-frames.js";
-import {
-  baseModelFamilyFor,
-  getProviderEntry,
-  isCloudSttProvider,
-  resolveSttCatalogKey,
-  sttConfigForCatalogKey,
-  supportsProviderTurnDetection,
-} from "../providers/speech-to-text/provider-catalog.js";
-import { sttProviderKeyResolves } from "../providers/speech-to-text/resolve.js";
-import {
-  STT_ROLES,
-  sttCatalogKeyForRole,
-  type SttRole,
-  sttRoleCapabilityGap,
-  sttSelectionForRole,
-} from "../stt/roles.js";
-import type { SttProviderId } from "../stt/types.js";
-import { getCatalogProvider } from "../tts/provider-catalog.js";
-import type { TtsProviderId } from "../tts/types.js";
-import { getLogger } from "../util/logger.js";
-import {
-  getConfig,
-  invalidateConfigCache,
-  loadRawConfig,
-  saveRawConfig,
-  setNestedValue,
-} from "./loader.js";
-import type { AssistantConfig } from "./types.js";
-
-const log = getLogger("cloud-speech-defaults");
-
-/** Whether the configured BYOK STT provider has a usable credential. */
-async function sttByokCredentialResolves(provider: string): Promise<boolean> {
-  const entry = getProviderEntry(provider as SttProviderId);
-  if (!entry) {
-    return false;
-  }
-  return sttProviderKeyResolves(entry.credentialProvider);
-}
-
-/** Whether the configured BYOK TTS provider has all its secrets. */
-async function ttsByokCredentialsResolve(provider: string): Promise<boolean> {
-  let entry;
-  try {
-    entry = getCatalogProvider(provider);
-  } catch {
-    return false;
-  }
-  for (const secret of entry.secretRequirements) {
-    if (!(await ttsSecretResolves(secret.credentialStoreKey))) {
-      return false;
-    }
-  }
-  return true;
-}
-
-/**
- * The cloud provider that stands in for a configured one whose credential
- * did not resolve.
- *
- * Cloud speech has two STT entries, and they are not interchangeable:
- * `cadet-flux` decides end-of-turn itself, `cadet` leaves it to the
- * session's silence timer. Substituting the plain one for a provider that had
- * provider turn detection would keep live voice working while quietly
- * changing how it takes turns, which reads as "Flux is no better" rather than
- * as a missing credential. Match the capability instead.
- */
-function managedStandInFor(
-  configured: SttProviderId,
-  language: string | undefined,
-): SttProviderId {
-  if (!supportsProviderTurnDetection(configured)) {
-    return "cadet";
-  }
-  // Flux has a model for ten languages. Outside them the relay rejects the
-  // dial outright, so standing in with it would hand the speaker a mic that
-  // does not work at all rather than one that detects turns less well. The
-  // language is the one the resolver will actually send.
-  return fluxModelForLanguage(language) === null ? "cadet" : "cadet-flux";
-}
-
-/** The speech providers a runtime path uses, after cloud-speech defaulting. */
-export interface EffectiveSpeechProviders {
-  stt: SttProviderId;
-  tts: TtsProviderId;
-}
-
-/**
- * Resolve the speech providers the runtime actually uses.
- *
- * A configured service whose BYOK credential does not resolve is reported as
- * its managed stand-in while cloud speech is available (see
- * {@link managedStandInFor}, which preserves provider turn detection); every
- * other service keeps its configured provider. Read-only: callers that hold no `settings.write`
- * scope (the live-voice WebSocket transport) resolve the same verdict the
- * preflight route does without persisting anything.
- *
- * `config` selects the configuration to read the configured providers from,
- * for callers already holding one (defaults to the loaded config). `role`
- * selects which consumer's STT override applies; omitting it reads the global
- * provider.
- */
-export async function resolveEffectiveSpeechProviders(
-  config?: AssistantConfig,
-  options: { role?: SttRole } = {},
-): Promise<EffectiveSpeechProviders> {
-  const services = (config ?? getConfig()).services;
-  const configuredStt = sttCatalogKeyForRole(services.stt, options.role);
-  const configuredTts = services.tts.provider as TtsProviderId;
-
-  if (!(await managedSpeechAvailable())) {
-    return { stt: configuredStt, tts: configuredTts };
-  }
-
-  const stt =
-    !isCloudSttProvider(configuredStt) &&
-    !(await sttByokCredentialResolves(configuredStt))
-      ? managedStandInFor(configuredStt, services.stt.language)
-      : configuredStt;
-
-  const tts =
-    configuredTts !== "cadet" &&
-    !(await ttsByokCredentialsResolve(configuredTts))
-      ? "cadet"
-      : configuredTts;
-
-  return {
-    stt: managedLiveVoiceModelFamily(stt, options.role, services.stt),
-    tts,
-  };
-}
-
-/**
- * Managed live voice runs Flux.
- *
- * Turn detection is the reason to reach for Flux at all, and managed users
- * cannot ask for it: the provider picker offers no model family, so `cadet`
- * is as specific as they can be. Deciding it here rather than persisting a
- * `services.stt.roles.liveVoice` entry keeps managed opinionated without
- * writing config on anyone's behalf, and reaches installs already on `cadet`
- * that a substitution rule never sees.
- *
- * Two things still win over it. A family the user named is honoured, because
- * `services.stt.providers.cadet.model` accepts `nova-3` and quietly ignoring
- * a valid setting is the silent substitution roles exist to prevent. And a
- * language outside Flux's roster stays on nova-3, since the relay refuses the
- * dial rather than degrading (see `managedStandInFor`).
- *
- * Live voice only: Flux streams and nothing else, so every other consumer
- * would lose its transcriber.
- */
-function managedLiveVoiceModelFamily(
-  resolved: SttProviderId,
-  role: SttRole | undefined,
-  stt: AssistantConfig["services"]["stt"],
-): SttProviderId {
-  if (role !== "liveVoice" || resolved !== "cadet") {
-    return resolved;
-  }
-  if (sttSelectionForRole(stt, role).model !== undefined) {
-    return resolved;
-  }
-  return fluxModelForLanguage(stt.language) === null ? "cadet" : "cadet-flux";
-}
-
-/**
- * Whether a provider can serve every consumer, or only the one that chose it.
- *
- * `cadet` covers every boundary, so substituting it is safe everywhere. A
- * narrowing row like `cadet-flux` streams and nothing else, and the roles it
- * fails are exactly the consumers that must not be moved onto it.
- */
-function servesEveryRole(provider: SttProviderId): boolean {
-  const selection = sttConfigForCatalogKey(provider);
-  return STT_ROLES.every(
-    (role) => sttRoleCapabilityGap(role, selection) === null,
-  );
-}
-
-/**
- * The writes that put `selection` in force as the global provider.
- *
- * The family is always written, including the base one. Substituting away
- * from a variant leaves its `model` behind otherwise, and the next load
- * resolves straight back to the variant this substitution just rejected: the
- * provider would read as plain cadet while running Flux, with batch and
- * telephony quietly unavailable. A provider with no families has no name to
- * write, and no variant to have left a stale value behind either.
- */
-function globalSttUpdates(selection: {
-  provider: string;
-  model?: string | undefined;
-}): { path: string; provider: string }[] {
-  const updates = [
-    { path: "services.stt.provider", provider: selection.provider },
-  ];
-  const family =
-    selection.model ?? baseModelFamilyFor(selection.provider as SttProviderId);
-  if (family !== undefined) {
-    updates.push({
-      path: `services.stt.providers.${selection.provider}.model`,
-      provider: family,
-    });
-  }
-  return updates;
-}
-
-/**
- * Persist the effective speech providers resolved by
- * {@link resolveEffectiveSpeechProviders} whenever they differ from the
- * configured ones.
- *
- * Safe to call repeatedly (idempotent) and safe to fire-and-forget. Callers
- * must hold the `settings.write` scope — this is the only path that writes
- * `services.stt/tts.provider` on behalf of cloud-speech defaulting.
- */
-export async function maybeDefaultSpeechToCloud(): Promise<void> {
-  try {
-    const services = getConfig().services;
-    const effective = await resolveEffectiveSpeechProviders();
-
-    const updates: { path: string; provider: string }[] = [];
-    if (effective.stt !== resolveSttCatalogKey(services.stt)) {
-      // A variant row is not a valid services.stt.provider value, so persist
-      // the pair that selects it. Writing the key itself would put an id the
-      // schema rejects on disk, and an unparseable services block is how the
-      // loader's salvage ladder ends up resetting the whole section.
-      const standIn = sttConfigForCatalogKey(effective.stt);
-      if (servesEveryRole(effective.stt)) {
-        updates.push(...globalSttUpdates(standIn));
-      } else {
-        // A stand-in that cannot serve every consumer belongs to the one that
-        // chose it. Live voice is that consumer: provider turn detection is
-        // the only reason managedStandInFor reaches for a narrow row, and
-        // writing that row globally would take batch transcription and
-        // telephony from every other consumer in a single write.
-        updates.push({
-          path: "services.stt.roles.liveVoice.provider",
-          provider: standIn.provider,
-        });
-        if (standIn.model !== undefined) {
-          updates.push({
-            path: "services.stt.roles.liveVoice.model",
-            provider: standIn.model,
-          });
-        }
-        // The other consumers still need a provider that answers, and the
-        // narrow stand-in's own base is the cloud row that serves them.
-        if (servesEveryRole(standIn.provider as SttProviderId)) {
-          updates.push(...globalSttUpdates({ provider: standIn.provider }));
-        }
-      }
-    }
-    if (effective.tts !== services.tts.provider) {
-      updates.push({ path: "services.tts.provider", provider: effective.tts });
-    }
-
-    if (updates.length === 0) {
-      return;
-    }
-
-    const raw = loadRawConfig();
-    for (const { path, provider } of updates) {
-      setNestedValue(raw, path, provider);
-    }
-    saveRawConfig(raw);
-    invalidateConfigCache();
-    log.info(
-      { defaulted: updates.map(({ path }) => path) },
-      "Defaulted unconfigured speech services to the Cadet provider after connection",
-    );
-  } catch (err) {
-    // Convenience defaulting must never break credential storage.
-    log.warn(
-      { error: err instanceof Error ? err.message : String(err) },
-      "Cloud speech defaulting failed (non-fatal)",
-    );
-  }
-}

package/src/config/sanitize-for-transfer.ts

@@ -1,111 +0,0 @@
-import {
-  INGRESS_ASSISTANT_ID_KEY,
-  INGRESS_LAST_TUNNEL_KEY,
-  INGRESS_PAIRING_TUNNEL_KEY,
-} from "@mycadet/service-contracts/ingress";
-
-/**
- * Strips environment-specific fields from config JSON before transferring
- * between local and platform environments (teleport/restore).
- *
- * Fields removed or reset:
- * - `ingress.publicBaseUrl` → set to `""`
- * - `ingress.enabled` → deleted
- * - `ingress.publicBaseUrlManagedBy` → deleted
- * - `ingress.lastTunnel` → deleted
- * - `ingress.pairingTunnel` → deleted
- * - `ingress.assistantId` → deleted
- * - `telegram.registeredWebhookUrl` → deleted
- * - `daemon` → deleted entirely
- * - `skills.load.extraDirs` → set to `[]`
- * - `hostBrowser.cdpInspect.desktopAuto` → deleted **only when the source
- *   either relies on the schema default or explicitly sets
- *   `enabled: true`**. An explicit `enabled: false` is preserved so a
- *   platform→local teleport doesn't silently re-enable auto-attach
- *   against the user's opt-out.
- *
- * `logFile.dir` is intentionally *not* stripped: the logger's container
- * fallback (`util/logger.ts#resolveLogDir`) already redirects to the
- * default log dir with a warning when the configured path can't be
- * created, and stripping `dir` would disable rotating file logging
- * entirely because `lifecycle.ts` gates `initLogger` on a truthy
- * `config.logFile.dir`.
- */
-export function sanitizeConfigForTransfer(configJson: string): string {
-  let config: Record<string, unknown>;
-  try {
-    const parsed = JSON.parse(configJson);
-    if (
-      typeof parsed !== "object" ||
-      parsed === null ||
-      Array.isArray(parsed)
-    ) {
-      return configJson;
-    }
-    config = parsed;
-  } catch {
-    return configJson;
-  }
-
-  // Strip ingress environment-specific fields
-  if (config.ingress && typeof config.ingress === "object") {
-    const ingress = config.ingress as Record<string, unknown>;
-    ingress.publicBaseUrl = "";
-    delete ingress.enabled;
-    delete ingress.publicBaseUrlManagedBy;
-    // The remembered tunnels and the assistant they fronted belong to the
-    // source host; carrying them over makes tunnel-status UIs name the old
-    // deployment, and the pairing record would have the destination advertise
-    // an address on the source's tailnet.
-    delete ingress[INGRESS_LAST_TUNNEL_KEY];
-    delete ingress[INGRESS_PAIRING_TUNNEL_KEY];
-    delete ingress[INGRESS_ASSISTANT_ID_KEY];
-  }
-
-  // Strip the recorded Telegram webhook URL. It records where *this*
-  // deployment pointed Telegram, so carrying it across a teleport would have
-  // the destination compare its own registration against the source's address
-  // and report a mismatch on a channel that is fine. Absent, the health sweep
-  // reports unverified until the destination reconciles and records its own.
-  if (config.telegram && typeof config.telegram === "object") {
-    const telegram = config.telegram as Record<string, unknown>;
-    delete telegram.registeredWebhookUrl;
-  }
-
-  // Strip daemon entirely
-  delete config.daemon;
-
-  // Strip skills.load.extraDirs
-  if (config.skills && typeof config.skills === "object") {
-    const skills = config.skills as Record<string, unknown>;
-    if (skills.load && typeof skills.load === "object") {
-      const load = skills.load as Record<string, unknown>;
-      load.extraDirs = [];
-    }
-  }
-
-  // Strip hostBrowser.cdpInspect.desktopAuto — the auto-attach-to-Chrome
-  // behavior is gated on a macOS-originated turn; preserving a
-  // source-host-derived `enabled: true` inside a Linux managed pod's
-  // config is misleading and brittle. Preserve an explicit
-  // `enabled: false` opt-out, though — the schema default is `true`,
-  // so unconditionally stripping this subobject would re-enable
-  // auto-attach after a cloud→local teleport.
-  if (config.hostBrowser && typeof config.hostBrowser === "object") {
-    const hostBrowser = config.hostBrowser as Record<string, unknown>;
-    if (hostBrowser.cdpInspect && typeof hostBrowser.cdpInspect === "object") {
-      const cdpInspect = hostBrowser.cdpInspect as Record<string, unknown>;
-      const desktopAuto = cdpInspect.desktopAuto;
-      const isExplicitOptOut =
-        desktopAuto !== null &&
-        typeof desktopAuto === "object" &&
-        !Array.isArray(desktopAuto) &&
-        (desktopAuto as Record<string, unknown>).enabled === false;
-      if (!isExplicitOptOut) {
-        delete cdpInspect.desktopAuto;
-      }
-    }
-  }
-
-  return JSON.stringify(config, null, 2) + "\n";
-}

package/src/live-voice/__tests__/live-voice-cloud-speech-fallback.test.ts

@@ -1,250 +0,0 @@
-/**
- * Live voice on cloud speech without a config write.
- *
- * `/v1/live-voice` validates guardian identity only — it does not enforce the
- * caller's `settings.write` scope — so the WebSocket transport must never
- * persist `services.stt/tts.provider`. Instead every live-voice leg resolves
- * the EFFECTIVE providers: while cloud speech is available, a configured
- * BYOK provider whose credential does not resolve is served by `"cadet"`.
- * These tests pin both halves of that contract — the readiness verdict and
- * the runtime legs agree, and `config.json` is byte-identical afterwards.
- *
- * `mock.module` is process-global in Bun and leaks into sibling files that run
- * later in the same `bun test` invocation, so each stub delegates to the real
- * implementation unless this file's tests are active (`fallbackMocksActive`,
- * toggled in beforeAll/afterAll). Run this file on its own.
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import {
-  afterAll,
-  afterEach,
-  beforeAll,
-  beforeEach,
-  describe,
-  expect,
-  mock,
-  test,
-} from "bun:test";
-
-import type { ResolveStreamingTranscriberOptions } from "../../providers/speech-to-text/resolve.js";
-import type { StreamingTranscriber } from "../../stt/types.js";
-
-let fallbackMocksActive = false;
-
-const realSttResolveModule = {
-  ...(await import("../../providers/speech-to-text/resolve.js")),
-};
-const realSecureKeysModule = {
-  ...(await import("../../security/secure-keys.js")),
-};
-const realCloudSpeechModule = {
-  ...(await import("../../cloud/cloud-speech.js")),
-};
-
-// -- Mutable stub state -------------------------------------------------------
-
-/** Whether the cloud connection can serve cloud speech. */
-let managedAvailable = false;
-/** Credential-store keys that resolve to a value. */
-let providerKeys: Record<string, string>;
-/** Provider ids `resolveStreamingTranscriber` was asked for, in call order. */
-let requestedSttProviders: (string | undefined)[];
-
-/** A provider yields a streaming transcriber when its credential resolves. */
-function transcriberFor(providerId: string | undefined): boolean {
-  // Both managed rows ride the same platform connection, so neither has a
-  // credential of its own. Live voice asks for the flux row specifically,
-  // since managed live voice resolves to it when no family is named.
-  return providerId === "cadet" || providerId === "cadet-flux"
-    ? managedAvailable
-    : providerId !== undefined && providerKeys[providerId] !== undefined;
-}
-
-mock.module("../../providers/speech-to-text/resolve.js", () => ({
-  ...realSttResolveModule,
-  resolveStreamingTranscriber: async (
-    options: ResolveStreamingTranscriberOptions = {},
-  ) => {
-    if (!fallbackMocksActive) {
-      return realSttResolveModule.resolveStreamingTranscriber(options);
-    }
-    requestedSttProviders.push(options.providerId);
-    return transcriberFor(options.providerId)
-      ? ({} as StreamingTranscriber)
-      : null;
-  },
-}));
-
-mock.module("../../security/secure-keys.js", () => ({
-  ...realSecureKeysModule,
-  getProviderKeyAsync: async (provider: string) =>
-    fallbackMocksActive
-      ? providerKeys[provider]
-      : realSecureKeysModule.getProviderKeyAsync(provider),
-  getSecureKeyAsync: async (account: string) =>
-    fallbackMocksActive
-      ? providerKeys[account]
-      : realSecureKeysModule.getSecureKeyAsync(account),
-}));
-
-mock.module("../../cloud/cloud-speech.js", () => ({
-  ...realCloudSpeechModule,
-  managedSpeechAvailable: async () =>
-    fallbackMocksActive
-      ? managedAvailable
-      : realCloudSpeechModule.managedSpeechAvailable(),
-}));
-
-import { resolveEffectiveSpeechProviders } from "../../config/cloud-speech-defaults.js";
-import { getConfig, invalidateConfigCache } from "../../config/loader.js";
-import {
-  _resetTtsProviderOverridesForTests,
-  _setTtsProviderForTests,
-} from "../../tts/provider-catalog.js";
-import type {
-  TtsProvider,
-  TtsSynthesisRequest,
-  TtsSynthesisResult,
-} from "../../tts/types.js";
-import { resolveLiveVoiceCredentialReadiness } from "../live-voice-credential-preflight.js";
-import { streamLiveVoiceTtsAudio } from "../live-voice-tts.js";
-
-const WORKSPACE_DIR = process.env.CADET_WORKSPACE_DIR!;
-const CONFIG_PATH = join(WORKSPACE_DIR, "config.json");
-
-/** Config with both speech services pointed at BYOK providers. */
-const BYOK_CONFIG = {
-  services: {
-    stt: { provider: "deepgram", providers: {} },
-    tts: { provider: "elevenlabs", providers: {} },
-  },
-};
-
-function writeConfig(obj: unknown): void {
-  if (!existsSync(WORKSPACE_DIR)) {
-    mkdirSync(WORKSPACE_DIR, { recursive: true });
-  }
-  writeFileSync(CONFIG_PATH, JSON.stringify(obj));
-  invalidateConfigCache();
-}
-
-function readConfigFile(): string {
-  return readFileSync(CONFIG_PATH, "utf8");
-}
-
-/** A streaming TTS adapter standing in for the cloud `cadet` provider. */
-function registerManagedTtsProvider(): TtsProvider {
-  const provider: TtsProvider = {
-    id: "cadet",
-    capabilities: { supportsStreaming: true, supportedFormats: ["pcm", "mp3"] },
-    async synthesize(): Promise<TtsSynthesisResult> {
-      throw new Error("buffered synthesis should not be used");
-    },
-    async synthesizeStream(
-      _request: TtsSynthesisRequest,
-      onChunk: (chunk: Uint8Array) => void,
-    ): Promise<TtsSynthesisResult> {
-      onChunk(Buffer.from("managed!"));
-      return { audio: Buffer.from("managed!"), contentType: "audio/pcm" };
-    },
-  };
-  _setTtsProviderForTests(provider);
-  return provider;
-}
-
-beforeAll(() => {
-  fallbackMocksActive = true;
-});
-
-afterAll(() => {
-  fallbackMocksActive = false;
-});
-
-afterEach(() => {
-  _resetTtsProviderOverridesForTests();
-});
-
-beforeEach(() => {
-  writeConfig(BYOK_CONFIG);
-  managedAvailable = false;
-  providerKeys = {};
-  requestedSttProviders = [];
-});
-
-describe("live voice on cloud speech", () => {
-  test("unkeyed BYOK TTS resolves the cloud provider and reports ready", async () => {
-    managedAvailable = true;
-    providerKeys = { deepgram: "test-key" };
-    const configBefore = readConfigFile();
-
-    const effective = await resolveEffectiveSpeechProviders();
-    expect(effective).toEqual({ stt: "deepgram", tts: "cadet" });
-
-    const readiness = await resolveLiveVoiceCredentialReadiness();
-    expect(readiness).toEqual({ status: "ready" });
-
-    expect(readConfigFile()).toBe(configBefore);
-  });
-
-  test("synthesis runs on the cloud provider while the config still names the BYOK one", async () => {
-    managedAvailable = true;
-    providerKeys = { deepgram: "test-key" };
-    registerManagedTtsProvider();
-    const configBefore = readConfigFile();
-
-    const chunks: string[] = [];
-    const result = await streamLiveVoiceTtsAudio({
-      text: "hello",
-      config: getConfig(),
-      onAudioChunk: (chunk) => {
-        chunks.push(chunk.dataBase64);
-      },
-    });
-
-    expect(result.provider).toBe("cadet");
-    expect(chunks).toHaveLength(1);
-    expect(getConfig().services.tts.provider).toBe("elevenlabs");
-    expect(readConfigFile()).toBe(configBefore);
-  });
-
-  test("unkeyed BYOK STT resolves the cloud provider and reports ready", async () => {
-    managedAvailable = true;
-    providerKeys = { elevenlabs: "test-key" };
-    const configBefore = readConfigFile();
-
-    const effective = await resolveEffectiveSpeechProviders();
-    expect(effective).toEqual({ stt: "cadet", tts: "elevenlabs" });
-
-    const readiness = await resolveLiveVoiceCredentialReadiness();
-    expect(readiness).toEqual({ status: "ready" });
-
-    // The transcriber the session arms is asked for the same provider the
-    // readiness verdict was earned on. Live voice resolves the flux row while
-    // the roleless verdict above stays on the base one, which is the whole
-    // point of resolving per role.
-    expect(requestedSttProviders).toEqual(["cadet-flux"]);
-    expect(readConfigFile()).toBe(configBefore);
-  });
-
-  test("cloud speech unavailable keeps the configured providers and reports not-ready", async () => {
-    managedAvailable = false;
-    const configBefore = readConfigFile();
-
-    const effective = await resolveEffectiveSpeechProviders();
-    expect(effective).toEqual({ stt: "deepgram", tts: "elevenlabs" });
-
-    const readiness = await resolveLiveVoiceCredentialReadiness();
-    expect(readiness.status).toBe("not-ready");
-    if (readiness.status !== "not-ready") {
-      throw new Error("expected not-ready");
-    }
-    expect(readiness.missing.map((gap) => gap.providerId)).toEqual([
-      "deepgram",
-      "elevenlabs",
-    ]);
-    expect(requestedSttProviders).toEqual(["deepgram"]);
-    expect(readConfigFile()).toBe(configBefore);
-  });
-});