@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/config/bundled-skills/system-storage-cleanup/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: system-storage-cleanup
+description: "Handle disk pressure, critically low storage, safe storage limits, and storage cleanup mode by inspecting disk usage and proposing safe cleanup steps."
+compatibility: "Designed for Vellum personal assistants"
+metadata:
+  emoji: "\U0001F9F9"
+  vellum:
+    display-name: "System Storage Cleanup"
+    category: "system"
+    activation-hints:
+      - "Critical disk usage or disk-pressure lock is blocking normal work"
+      - "The assistant is in storage cleanup mode or normal work is suspended due to low storage"
+      - "User asks to inspect large files or find what is using disk space"
+      - "User asks to free workspace storage safely"
+      - "User asks to delete caches, logs, temp files, Docker artifacts, or other storage safely"
+---
+
+You are operating under a critical storage cleanup contract. Your only goal is to free enough storage for the assistant to resume normal work without damaging user data.
+
+## Cleanup Contract
+
+Start by warning the user that storage is critically low and normal work is suspended until storage cleanup mode clears. Stay scoped to freeing storage until the disk-pressure lock clears or the guardian explicitly overrides it.
+
+Prefer foreground inspection with available cleanup-safe tools before any mutation. Identify both the target volume that is actually full and the workspace path before proposing deletions. Do not work on unrelated tasks, refactors, installs, upgrades, or product changes while the storage lock is active.
+
+Ask for explicit approval before deleting files, caches, logs, package caches, Docker artifacts, or any other data unless the user has already approved that exact action. Before asking, present each proposed deletion with:
+
+- Exact path or artifact name.
+- Estimated reclaimable size.
+- Expected consequence, including whether it is regenerable or may remove user-visible history.
+
+If the user approves a broad category, narrow it to exact paths or artifacts before deleting. If the user approves one exact path, do not treat that as approval for adjacent paths.
+
+Never delete credentials, security material, workspace database files, config files, active profiler runs, migrations, skill source, app source, conversation records, memory graph nodes or segments, `journal/`, `data/reflections/`, PKB files, backups, or backup keys unless the user explicitly names that path and accepts the consequence.
+
+## Inspection Procedure
+
+Use local/container-visible inspection first. Prefer `df -h` on the current workspace path and on `VELLUM_WORKSPACE_DIR` when that variable is available. In Docker/container mode, `/workspace` is the persistent volume and cleanup should normally focus there.
+
+Use `du` one level at a time and sort by size to identify large directories before drilling deeper. Keep each pass readable and bounded to the volume or workspace that is actually full. Avoid whole-filesystem scans unless the target volume cannot be isolated.
+
+Use `host_bash` only when the sandbox cannot see the volume that is actually full and host-level inspection is necessary. Explain why host-level inspection is needed before using it.
+
+## SQLite Diagnosis Only
+
+If `data/db/assistant.db` dominates disk usage, inspect it only through read-only `sqlite3` access. Diagnostics may use `PRAGMA` and `SELECT` queries for:
+
+- `page_size`
+- `page_count`
+- `freelist_count`
+- `dbstat` object-size breakdowns
+
+The purpose is to determine whether growth comes from specific tables/indexes or from free-page bloat. Do not edit the database manually.
+
+Never run ad hoc `DELETE`, `UPDATE`, `INSERT`, `DROP`, `REINDEX`, schema changes, `VACUUM`, `PRAGMA writable_schema`, or any other mutating SQLite command from this skill. If SQLite tables are the main culprit, tell the user this needs product-owned retention or maintenance work rather than manual database editing.
+
+## Safer Cleanup Candidates
+
+Good candidates to inspect and propose, when they are clearly nonessential and user-approved, include:
+
+- Scratch or temporary downloads created by the assistant.
+- Generated build artifacts.
+- Old logs.
+- Stale temporary directories.
+- Completed profiler runs that are no longer active.
+- Stale caches.
+- Large old diagnostic text attachments such as spindumps.
+- Package cache cleanup or Docker cache/artifact cleanup after the user approves the exact package manager or Docker action.
+
+Treat source files, persistent records, and user-authored content as protected unless the user explicitly names them for deletion and accepts the consequence.
+
+## Non-Goals
+
+ATL-450 product work is out of scope for this skill. Do not implement configurable trace or audit retention jobs, attachment retention or compression jobs, upload-time image re-encoding, first-class disk-usage UI, one-click cleanup buttons, or scheduled SQLite vacuuming. If inspection shows those are needed, report that as follow-up product work after the immediate storage cleanup path is safe.

package/src/config/bundled-skills/workflows/SKILL.md

@@ -105,7 +105,7 @@ Use `agent` for a single sequential leaf (throws on failure). Use `parallel`/`ma
 
 | Option    | Type                       | Effect                                                                                  |
 | --------- | -------------------------- | --------------------------------------------------------------------------------------- |
-| `schema`  | JSON Schema object literal | Forces structured output via a tool. A schema leaf runs with **no tools** (pure judge/extractor). Use a plain JSON Schema literal, not Zod. |
+| `schema`  | JSON Schema object literal | Forces structured output via a tool. A schema leaf runs with **no tools** — no `file_read`/`file_list`/`recall`/`web_search`, so it **cannot read files or recall memory** (pure judge/extractor). Pass anything it must judge **inline** in the prompt; a schema leaf told to "read these files" answers from the model's prior, not real data. Use a plain JSON Schema literal, not Zod. |
 | `label`   | string                     | Short display/diagnostic label for the leaf.                                            |
 | `profile` | string                     | Overrides the model profile. Must exist in `llm.profiles` or the leaf throws. See [Listing profiles](#listing-available-profiles). |
 | `persona` | boolean                    | `true` makes the leaf speak AS the assistant (identity + memory) — use for output meant to be in the assistant's voice. Default is anonymous — use for impartial judging/extraction. |
@@ -128,8 +128,9 @@ workflow**.
 }
 ```
 
-- **Read-only baseline** (always available, no declaration, no launch prompt):
-  `file_read`, `file_list`, `recall`, `web_search`.
+- **Read-only baseline** (available to **tool** leaves, no declaration, no launch prompt):
+  `file_read`, `file_list`, `recall`, `web_search`. **A schema leaf gets none of these**
+  (it runs as a single forced-tool-choice call) — pass it inline content, never tell it to read.
 - **`web_fetch` is NOT in the baseline** — an outbound fetch is side-effecting (its
   URL can exfiltrate read data), so a leaf that must fetch a URL has to declare
   `"web_fetch"` in `capabilities.tools`.

package/src/config/call-site-defaults.ts

@@ -69,9 +69,18 @@ export const CALL_SITE_DEFAULTS: Record<LLMCallSite, CallSiteDefaultConfig> = {
   meetConsentMonitor: { profile: "cost-optimized" },
   meetChatOpportunity: { profile: "cost-optimized" },
   inference: { profile: "cost-optimized" },
-  // The advisor consults the strongest managed profile by default; a workspace
-  // overrides this via `llm.advisorProfile` (which floats above this).
+  // The advisor consults the strongest managed profile (`frontier`, Opus),
+  // which seeding writes into `llm.advisorProfile` on boot and floats above this
+  // layer. This static fallback — used only when no `advisorProfile` resolves —
+  // stays on the always-reserved `quality-optimized` so it can never resolve to
+  // a user-owned profile that happens to be named `frontier`.
   advisor: { profile: "quality-optimized" },
+  // Vision captioning for the image-fallback plugin. No pinned profile — the
+  // plugin resolves a vision-capable profile itself via `doesSupportVision` and
+  // passes it as an `overrideProfile`, so the call-site default is a fallback
+  // that inherits the workspace default. Pinning a managed profile would break
+  // BYOK installs where managed profiles are uncredentialed.
+  vision: {},
 
   heartbeatAgent: {
     profile: "cost-optimized",

package/src/config/feature-flag-registry.json

@@ -290,14 +290,6 @@
       "description": "Show the Velvet theme option in the macOS appearance settings. Velvet is a dark-mode variant with red/pink accent colors.",
       "defaultEnabled": false
     },
-    {
-      "id": "query-complexity-routing",
-      "scope": "assistant",
-      "key": "query-complexity-routing",
-      "label": "Query Complexity Routing",
-      "description": "Automatically route user messages to the most appropriate inference profile based on query complexity. Simple queries use the speed profile, complex queries escalate to the quality profile. The user is notified of each switch and can opt out by pinning a profile on the conversation.",
-      "defaultEnabled": false
-    },
     {
       "id": "queue-steering",
       "scope": "assistant",

package/src/config/llm-resolver.ts

@@ -17,7 +17,13 @@ import {
  * Merge layers (low → high precedence; later layers override earlier) for
  * non-main-agent call sites:
  *   1. `llm.default` fields (required base)
- *   2. `llm.profiles[llm.activeProfile]` (workspace-wide active profile)
+ *   2. `llm.profiles[llm.activeProfile]` (workspace-wide active profile) —
+ *      folded in ONLY when the call site resolves no profile of its own (a
+ *      profile-less leaf like `vision`/`workflowLeaf`, or a BYOK install whose
+ *      pinned managed profile was stripped). When the call site resolves a
+ *      profile, that profile is the authoritative provider config and the
+ *      active profile does not contribute — otherwise a deep-merge would let
+ *      its orphan fields bleed onto a different provider.
  *   3. `llm.profiles[opts.overrideProfile]` (per-call ad-hoc override)
  *   4. `llm.profiles[site.profile]` fields (call-site's named profile)
  *   5. `llm.callSites[callSite]` fields (call-site override)
@@ -50,6 +56,15 @@ import {
  * any nesting level merge into — rather than replace — the corresponding
  * base value.
  *
+ * `temperature` and `top_p` are provider-coupled, so they do NOT deep-merge
+ * field-by-field with the rest of the config: only the winning profile (the
+ * highest-precedence profile that determines provider/model) contributes them,
+ * and an explicit `llm.callSites[callSite]` override still wins. A lower-
+ * precedence profile whose model is shadowed never leaks its sampling onto a
+ * different provider (which would trip e.g. Anthropic's "temperature and top_p
+ * cannot both be specified" constraint). `logitBias` is winning-profile-scoped
+ * the same way.
+ *
  * `activeProfile` and `overrideProfile` are resolved by name lookup against
  * `llm.profiles`. Missing references silently fall through (no throw) so the
  * resolver stays pure; schema validation in `LLMSchema.superRefine` catches
@@ -108,6 +123,19 @@ export function resolveCallSiteConfig(
   // call-site default selected by `effectiveDefault`.
   const biasRef: LogitBiasRef = { preset: undefined };
 
+  // Effective sampling params, tracked outside the deep-merge for the same
+  // reason as `logitBias`: `temperature`/`top_p` are provider-coupled, so only
+  // the winning profile may contribute them. A profile clears what a lower
+  // PROFILE set where it is silent (so a shadowed profile's sampling can't
+  // leak), while an explicit call-site override is sticky and survives a later
+  // silent profile (see `applyProfileSampling` / `appendCallSiteLayers`).
+  const samplingRef: SamplingRef = {
+    temperature: undefined,
+    topP: undefined,
+    temperatureFromCallSite: false,
+    topPFromCallSite: false,
+  };
+
   const activeFragment = resolveProfileFragment(llm.activeProfile, llm, opts);
   const overrideFragment = resolveProfileFragment(
     opts.overrideProfile,
@@ -119,22 +147,55 @@ export function resolveCallSiteConfig(
     effectiveDefault(callSite, llm, opts.overrideProfile != null);
 
   if (callSite === "mainAgent") {
-    appendCallSiteLayers(layers, callSite, llm, site, opts, biasRef);
-    appendProfileLayer(layers, activeFragment, biasRef);
-    appendProfileLayer(layers, overrideFragment, biasRef);
+    appendCallSiteLayers(
+      layers,
+      callSite,
+      llm,
+      site,
+      opts,
+      biasRef,
+      samplingRef,
+    );
+    appendProfileLayer(layers, activeFragment, biasRef, samplingRef);
+    appendProfileLayer(layers, overrideFragment, biasRef, samplingRef);
   } else if (opts.forceOverrideProfile === true && overrideFragment != null) {
     // Escape hatch: float the override profile above the call-site layers,
     // mirroring mainAgent's treatment of the user's chat-model selection.
     // Guarded on a resolved fragment so a missing profile reference degrades
     // to the normal precedence below instead of silently dropping the
-    // call-site layers' standing.
-    appendProfileLayer(layers, activeFragment, biasRef);
-    appendCallSiteLayers(layers, callSite, llm, site, opts, biasRef);
-    appendProfileLayer(layers, overrideFragment, biasRef);
+    // call-site layers' standing. The active profile stays the bottom fallback
+    // (its sampling can't leak — a higher profile's REPLACE clears it).
+    appendProfileLayer(layers, activeFragment, biasRef, samplingRef);
+    appendCallSiteLayers(
+      layers,
+      callSite,
+      llm,
+      site,
+      opts,
+      biasRef,
+      samplingRef,
+    );
+    appendProfileLayer(layers, overrideFragment, biasRef, samplingRef);
   } else {
-    appendProfileLayer(layers, activeFragment, biasRef);
-    appendProfileLayer(layers, overrideFragment, biasRef);
-    appendCallSiteLayers(layers, callSite, llm, site, opts, biasRef);
+    // The active profile is a low-precedence FALLBACK for call sites that
+    // resolve no profile of their own — profile-less leaves (`vision`,
+    // `workflowLeaf`) and BYOK installs where the pinned managed profile was
+    // stripped. When the call site DOES resolve its own profile, that profile
+    // is the authoritative provider config, so the active profile must not
+    // contribute its orphan fields to a different provider.
+    if (site?.profile == null) {
+      appendProfileLayer(layers, activeFragment, biasRef, samplingRef);
+    }
+    appendProfileLayer(layers, overrideFragment, biasRef, samplingRef);
+    appendCallSiteLayers(
+      layers,
+      callSite,
+      llm,
+      site,
+      opts,
+      biasRef,
+      samplingRef,
+    );
   }
 
   const resolved = finalize(
@@ -149,11 +210,34 @@ export function resolveCallSiteConfig(
   } else {
     delete (resolved as { logitBias?: unknown }).logitBias;
   }
+  // `temperature`/`top_p` are winning-profile-scoped like `logitBias`, but an
+  // explicit call-site override may also set them. Apply the tracked value,
+  // overriding whatever a shadowed profile may have left in the merge. An
+  // `undefined` ref means no profile or override opted in, so the `llm.default`
+  // base already in `resolved` stands.
+  if (samplingRef.temperature !== undefined) {
+    resolved.temperature = samplingRef.temperature;
+  }
+  if (samplingRef.topP !== undefined) {
+    resolved.topP = samplingRef.topP;
+  }
   return resolved;
 }
 
 type LogitBiasRef = { preset: ProfileEntry["logitBias"] };
 
+type SamplingRef = {
+  temperature: ProfileEntry["temperature"];
+  topP: ProfileEntry["topP"];
+  // Provenance of the current pair: `true` when a field came from an explicit
+  // call-site override (deliberate, sticky), `false` when it came from a profile
+  // (clearable by a higher-precedence profile that determines the model). Lets a
+  // silent higher profile clear a lower profile's sampling without discarding a
+  // deliberate call-site override.
+  temperatureFromCallSite: boolean;
+  topPFromCallSite: boolean;
+};
+
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -311,13 +395,41 @@ function withImpliedProviderForKnownModel(source: Mergeable): Mergeable {
   };
 }
 
+/**
+ * Fold a profile's sampling into `samplingRef`. A profile determines
+ * provider/model, so its pair supersedes any LOWER PROFILE's: set each field the
+ * profile specifies, and clear a lower profile's value where the profile is
+ * silent. A deliberate call-site override is NOT a profile and outranks a silent
+ * profile — it survives until a profile EXPLICITLY sets the field. (The mirror
+ * COALESCE for call-site overrides lives in `appendCallSiteLayers`.)
+ */
+function applyProfileSampling(
+  samplingRef: SamplingRef,
+  profile: ProfileEntry,
+): void {
+  if (profile.temperature !== undefined) {
+    samplingRef.temperature = profile.temperature;
+    samplingRef.temperatureFromCallSite = false;
+  } else if (!samplingRef.temperatureFromCallSite) {
+    samplingRef.temperature = undefined;
+  }
+  if (profile.topP !== undefined) {
+    samplingRef.topP = profile.topP;
+    samplingRef.topPFromCallSite = false;
+  } else if (!samplingRef.topPFromCallSite) {
+    samplingRef.topP = undefined;
+  }
+}
+
 function appendProfileLayer(
   layers: Mergeable[],
   profile: ProfileEntry | undefined,
   biasRef: LogitBiasRef,
+  samplingRef: SamplingRef,
 ): void {
   if (profile != null) {
     biasRef.preset = profile.logitBias;
+    applyProfileSampling(samplingRef, profile);
     layers.push(profileConfigFragment(profile));
   }
 }
@@ -329,6 +441,7 @@ function appendCallSiteLayers(
   site: z.infer<typeof LLMSchema>["callSites"][LLMCallSite] | undefined,
   opts: ResolveCallSiteOpts,
   biasRef: LogitBiasRef,
+  samplingRef: SamplingRef,
 ): void {
   if (site != null) {
     if (site.profile != null) {
@@ -343,11 +456,29 @@ function appendCallSiteLayers(
         );
       }
       biasRef.preset = profileFragment.logitBias;
+      applyProfileSampling(samplingRef, profileFragment);
       layers.push(profileConfigFragment(profileFragment));
     }
-    // Strip the `profile` discriminator before merging — it isn't a
-    // `LLMConfigBase` field.
-    const { profile: _profile, ...siteFragment } = site;
+    // Strip the `profile` discriminator (not a `LLMConfigBase` field) and the
+    // sampling params before merging. An explicit call-site `temperature` /
+    // `topP` is a deliberate per-site choice, so it COALESCES over the winning
+    // profile's pair (only overriding the fields it sets) and is marked sticky
+    // so a later silent profile can't clear it — routed through `samplingRef` so
+    // it never inherits a shadowed profile's value via merge.
+    const {
+      profile: _profile,
+      temperature: siteTemperature,
+      topP: siteTopP,
+      ...siteFragment
+    } = site;
+    if (siteTemperature !== undefined) {
+      samplingRef.temperature = siteTemperature;
+      samplingRef.temperatureFromCallSite = true;
+    }
+    if (siteTopP !== undefined) {
+      samplingRef.topP = siteTopP;
+      samplingRef.topPFromCallSite = true;
+    }
     layers.push(siteFragment as Mergeable);
   }
 }
@@ -369,6 +500,12 @@ function profileConfigFragment(profile: ProfileEntry): Mergeable {
     // Per-profile advisor toggle is profile identity, not inheritable model
     // config — strip it so it can't leak into the merged `LLMConfigBase`.
     advisorEnabled: _advisorEnabled,
+    // `temperature`/`top_p` are provider-coupled: only the winning profile
+    // contributes them (tracked via `samplingRef`, applied post-merge), so a
+    // shadowed profile's sampling can never reach a different provider through
+    // the deep-merge. Strip here so no profile's sampling enters the merge.
+    temperature: _temperature,
+    topP: _topP,
     ...config
   } = profile;
   return config as Mergeable;

package/src/config/loader.ts

@@ -300,14 +300,20 @@ function validateWithSchema(raw: Record<string, unknown>): AssistantConfig {
   }
 
   // Strip invalid fields by setting them to undefined so Zod defaults apply,
-  // then re-parse. We walk the error paths and delete the offending keys.
+  // then re-parse. We walk the error paths and delete the offending keys,
+  // pruning any ancestor object the deletion leaves empty. Pruning matters for
+  // nested overrides like `llm.callSites.<id>.profile`: stripping just the
+  // invalid `.profile` leaf would leave `llm.callSites.<id> = {}`, which the
+  // resolver treats as a present (non-default) override and so skips the
+  // shipped call-site default — silently downgrading the call site to the
+  // active profile. Removing the emptied object lets that default apply.
   const cleaned = structuredClone(raw);
   for (const issue of result.error.issues) {
     if (issue.path.length === 0) {
       // Top-level error — return full defaults
       return cloneDefaultConfig();
     }
-    deleteNestedKey(cleaned, issue.path as (string | number)[]);
+    deleteNestedKey(cleaned, issue.path as (string | number)[], true);
   }
 
   const retry = AssistantConfigSchema.safeParse(cleaned);
@@ -320,17 +326,42 @@ function validateWithSchema(raw: Record<string, unknown>): AssistantConfig {
   return cloneDefaultConfig();
 }
 
+/**
+ * Delete the key at `path` from `obj`. When `pruneEmptyAncestors` is set, also
+ * remove any ancestor object the deletion leaves empty, walking up until the
+ * first ancestor that still holds other keys. Only empty plain objects are
+ * pruned (arrays are left alone), and a still-populated ancestor stops the walk
+ * so a container holding other config is never removed.
+ */
 function deleteNestedKey(
   obj: Record<string, unknown>,
   path: (string | number)[],
+  pruneEmptyAncestors = false,
 ): void {
+  // Record each (container, key) hop on the way down so we can prune upward
+  // after deleting the leaf.
+  const chain: Array<{ container: Record<string, unknown>; key: string }> = [];
   let current: unknown = obj;
   for (let i = 0; i < path.length - 1; i++) {
     if (current == null || typeof current !== "object") return;
-    current = (current as Record<string, unknown>)[String(path[i])];
+    const key = String(path[i]);
+    chain.push({ container: current as Record<string, unknown>, key });
+    current = (current as Record<string, unknown>)[key];
   }
-  if (current != null && typeof current === "object") {
-    delete (current as Record<string, unknown>)[String(path[path.length - 1])];
+  if (current == null || typeof current !== "object") return;
+  delete (current as Record<string, unknown>)[String(path[path.length - 1])];
+
+  if (!pruneEmptyAncestors) return;
+  // Remove ancestors emptied by the deletion, deepest first; stop at the first
+  // that still has keys.
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const { container, key } = chain[i];
+    const child = container[key];
+    if (isPlainObject(child) && Object.keys(child).length === 0) {
+      delete container[key];
+    } else {
+      break;
+    }
   }
 }
 

package/src/config/profile-dispatchability.ts

@@ -0,0 +1,11 @@
+export type DispatchableProfileEntry = {
+  provider?: unknown;
+  model?: unknown;
+  mix?: unknown;
+};
+
+export function isDispatchableProfile(
+  entry: DispatchableProfileEntry,
+): boolean {
+  return entry.provider != null || entry.model != null || entry.mix != null;
+}

package/src/config/schemas/__tests__/memory-v3.test.ts

@@ -22,6 +22,7 @@ describe("MemoryV3ConfigSchema", () => {
       needleK: 100,
       denseK: 100,
       replyQueryK: 12,
+      selectorPromptPath: null,
       edge: { hubDegree: 30, seedCount: 18, perSeed: 6, cap: 45 },
     });
   });

package/src/config/schemas/call-site-catalog.ts

@@ -307,6 +307,13 @@ const CATALOG_RECORD: CatalogRecord = {
       "Stronger reviewer model consulted mid-task to shape or pressure-test the plan.",
     domain: "skills",
   },
+  vision: {
+    id: "vision",
+    displayName: "Vision",
+    description:
+      "Captions images via a vision-capable profile for text-only model fallback.",
+    domain: "skills",
+  },
   homeGreeting: {
     id: "homeGreeting",
     displayName: "Home Greeting",

package/src/config/schemas/llm.ts

@@ -24,6 +24,7 @@ export const LLMProvider = z
     "openai-compatible",
     "minimax",
     "atlascloud",
+    "together",
   ])
   .meta({ id: "LLMProvider" });
 type LLMProvider = z.infer<typeof LLMProvider>;
@@ -79,6 +80,7 @@ export const LLMCallSiteEnum = z.enum([
   "meetChatOpportunity",
   "inference",
   "advisor",
+  "vision",
   "trustRuleSuggestion",
   "homeGreeting",
   "homeSuggestedPrompts",

package/src/config/schemas/memory-lifecycle.ts

@@ -78,6 +78,17 @@ export const MemoryJobsConfigSchema = MemoryJobsConfigInputSchema.transform(
   },
 ).describe("Memory background job processing configuration");
 
+export const MemoryWorkerConfigSchema = z
+  .object({
+    enabled: z
+      .boolean({ error: "memory.worker.enabled must be a boolean" })
+      .default(false)
+      .describe(
+        "Whether the memory jobs worker runs as a separate OS process spawned at daemon startup (the `assistant memory worker` implementation) instead of on the daemon's main event loop. Only affects daemon startup; shutdown stops whichever worker is actually running.",
+      ),
+  })
+  .describe("Memory jobs worker process configuration");
+
 export const MemoryRetentionConfigSchema = z
   .object({
     keepRawForever: z
@@ -169,7 +180,7 @@ export const MemoryMaintenanceConfigSchema = z
       .positive("memory.maintenance.intervalMs must be a positive integer")
       .default(24 * 60 * 60 * 1000)
       .describe(
-        "Minimum interval between database maintenance (VACUUM / PRAGMA optimize) runs, in milliseconds",
+        "Minimum interval between database maintenance (PRAGMA optimize / WAL checkpoint) runs, in milliseconds",
       ),
     quietPeriodMs: z
       .number({ error: "memory.maintenance.quietPeriodMs must be a number" })
@@ -177,12 +188,15 @@ export const MemoryMaintenanceConfigSchema = z
       .nonnegative("memory.maintenance.quietPeriodMs must be non-negative")
       .default(3 * 60 * 60 * 1000)
       .describe(
-        "Database maintenance is deferred unless at least this many milliseconds have elapsed since the last user message, so the VACUUM's exclusive lock never collides with an active user (0 disables the quiet-period gate)",
+        "Database maintenance is deferred unless at least this many milliseconds have elapsed since the last user message, so maintenance's write locks never collide with an active user (0 disables the quiet-period gate)",
       ),
   })
-  .describe("Database maintenance (VACUUM / PRAGMA optimize) scheduling");
+  .describe(
+    "Database maintenance (PRAGMA optimize / WAL checkpoint) scheduling",
+  );
 
 export type MemoryJobsConfig = z.infer<typeof MemoryJobsConfigSchema>;
+export type MemoryWorkerConfig = z.infer<typeof MemoryWorkerConfigSchema>;
 export type MemoryRetentionConfig = z.infer<typeof MemoryRetentionConfigSchema>;
 export type MemoryCleanupConfig = z.infer<typeof MemoryCleanupConfigSchema>;
 export type MemoryMaintenanceConfig = z.infer<

package/src/config/schemas/memory-v3.ts

@@ -259,6 +259,13 @@ export const MemoryV3ConfigSchema = z
       .describe(
         "Per-lane article budget for the reply-query finder pass: needle and dense each re-run over the assistant's previous message as separate queries (never concatenated with the user's message). 0 disables the pass. Deliberately small next to needleK/denseK — the pass adds the assistant-side retrieval signal, not a second full sweep.",
       ),
+    selectorPromptPath: z
+      .string({ error: "memory.v3.selectorPromptPath must be a string" })
+      .nullable()
+      .default(null)
+      .describe(
+        "Optional path to a file whose contents replace the bundled per-turn selector system prompt (the instructions that tell the selector which candidate pages to keep). Absolute paths are used as-is, a leading `~/` is expanded to the home directory, otherwise the path is resolved under the workspace root. The selector prompt takes no placeholders — the candidate pool is supplied separately as the user message — so the file is used verbatim. If the file is missing, unreadable, empty, or over 1 MiB, the bundled prompt is used and a warning is logged.",
+      ),
     edge: MemoryV3EdgeSchema.default(MemoryV3EdgeSchema.parse({})),
   })
   .describe("Memory v3 — section-grain lane retrieval");

package/src/config/schemas/memory.ts

@@ -5,6 +5,7 @@ import {
   MemoryJobsConfigSchema,
   MemoryMaintenanceConfigSchema,
   MemoryRetentionConfigSchema,
+  MemoryWorkerConfigSchema,
 } from "./memory-lifecycle.js";
 import {
   MemoryExtractionConfigSchema,
@@ -39,6 +40,9 @@ export const MemoryConfigSchema = z
       MemorySegmentationConfigSchema.parse({}),
     ),
     jobs: MemoryJobsConfigSchema.default(MemoryJobsConfigSchema.parse({})),
+    worker: MemoryWorkerConfigSchema.default(
+      MemoryWorkerConfigSchema.parse({}),
+    ),
     retention: MemoryRetentionConfigSchema.default(
       MemoryRetentionConfigSchema.parse({}),
     ),

package/src/config/schemas/timeouts.ts

@@ -28,6 +28,14 @@ export const TimeoutConfigSchema = z
       .describe(
         "How long to wait for user permission approval before timing out (seconds)",
       ),
+    questionResponseTimeoutSec: z
+      .number({ error: "timeouts.questionResponseTimeoutSec must be a number" })
+      .finite("timeouts.questionResponseTimeoutSec must be finite")
+      .positive("timeouts.questionResponseTimeoutSec must be a positive number")
+      .default(1800)
+      .describe(
+        "Backstop timeout for an unanswered ask_question prompt (seconds). The primary way an interactive user dismisses a prompt is by moving on — enqueuing another message supersedes it — so this only bounds a prompt left open with no response and no follow-up message.",
+      ),
     toolExecutionTimeoutSec: z
       .number({ error: "timeouts.toolExecutionTimeoutSec must be a number" })
       .finite("timeouts.toolExecutionTimeoutSec must be finite")
@@ -42,6 +50,30 @@ export const TimeoutConfigSchema = z
       .describe(
         "Timeout for waiting on the LLM provider's streaming response (seconds)",
       ),
+    backgroundTurnTimeoutSec: z
+      .number({ error: "timeouts.backgroundTurnTimeoutSec must be a number" })
+      .int("timeouts.backgroundTurnTimeoutSec must be an integer")
+      .positive("timeouts.backgroundTurnTimeoutSec must be a positive integer")
+      .max(
+        2147483,
+        "timeouts.backgroundTurnTimeoutSec must be at most 2147483 (setTimeout-safe limit)",
+      )
+      .default(1800)
+      .describe(
+        "Hard timeout for heartbeat and generic background agent turns (seconds)",
+      ),
+    scheduleTurnTimeoutSec: z
+      .number({ error: "timeouts.scheduleTurnTimeoutSec must be a number" })
+      .int("timeouts.scheduleTurnTimeoutSec must be an integer")
+      .positive("timeouts.scheduleTurnTimeoutSec must be a positive integer")
+      .max(
+        2147483,
+        "timeouts.scheduleTurnTimeoutSec must be at most 2147483 (setTimeout-safe limit)",
+      )
+      .default(1800)
+      .describe(
+        "Hard timeout for deliberately-launched scheduled (talk-mode) agent turns (seconds)",
+      ),
   })
   .describe("Timeout configuration for various operations");