@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/config/loader.ts

@@ -3,6 +3,7 @@ import {
   mkdirSync,
   readFileSync,
   renameSync,
+  rmSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
@@ -12,6 +13,7 @@ import { getLogger } from "../util/logger.js";
 import {
   ensureDataDir,
   getConfigQuarantineNoticePath,
+  getConfigValidationResetNoticePath,
   getWorkspaceConfigPath,
 } from "../util/platform.js";
 import { pruneSeededCallsiteDefaultsFromConfig } from "./prune-seeded-callsite-defaults.js";
@@ -25,6 +27,23 @@ let cachedFileSignature: ConfigFileSignature | null = null;
 let loading = false;
 let suppressConfigDiskWritesDepth = 0;
 
+/**
+ * The most recent effective config in this process. Captured inside
+ * {@link validateWithSchema} on every validation-success path, then overwritten
+ * by {@link loadConfig} with the deployment-context-filled config whenever
+ * context defaults apply — so it reflects the config as consumers actually see
+ * it (managed service modes and all), not just the pre-fill schema-defaulted
+ * view. It is a safety net for the recovery ladder — when config.json later
+ * fails validation even after per-key cleanup, the last-known-good config is
+ * preferred over discarding the user's entire configuration and falling back to
+ * schema defaults.
+ *
+ * Deliberately NOT cleared by {@link invalidateConfigCache}: cache
+ * invalidation forces a re-read from disk, but the safety net must survive a
+ * re-read so it can rescue a subsequently-corrupted config.
+ */
+let lastKnownGoodConfig: AssistantConfig | null = null;
+
 type ConfigFileSignature =
   | {
       path: string;
@@ -287,14 +306,122 @@ function writeQuarantineNotice(
   }
 }
 
+/** Minimal structural view of the Zod issues the recovery ladder consumes. */
+type ValidationIssue = { path: PropertyKey[]; message: string };
+
+/** Join a Zod issue's path/message into a single human-readable clause. */
+function describeIssues(issues: ValidationIssue[]): string {
+  return issues
+    .map((issue) => {
+      const path = issue.path.join(".");
+      return path ? `"${path}": ${issue.message}` : issue.message;
+    })
+    .join("; ");
+}
+
+/**
+ * Record a "config.json did not take effect as written" event so the per-turn
+ * `config-validation-reset-notice` injector can surface it to the agent. Unlike
+ * {@link writeQuarantineNotice} (JSON-corrupt file, quarantined), this fires
+ * when `config.json` parses as valid JSON but fails schema validation hard
+ * enough that per-key cleanup cannot repair it and {@link validateWithSchema}
+ * hands off to {@link recoverFromInvalidConfig} — e.g. an unknown key that masks
+ * a `superRefine` violation until the strip unmasks it. Every rung of that
+ * ladder leaves at least part of the user's saved configuration inactive, and
+ * the rungs that reset a section (or the whole config) to schema defaults
+ * silently revert settings the user never touched: managed service modes, model
+ * choices, API keys. The on-disk file is left intact, so the user's values are
+ * still present but inactive until the invalid entries are fixed.
+ *
+ * Deliberately NOT gated on `suppressConfigDiskWritesDepth`. The only suppressed
+ * `getConfig()` is the re-parse inside `commitConfigWrite`, which runs *after*
+ * `saveRawConfig` — so it reflects the persisted config, not a transient one. A
+ * bad conversational `config set` must surface the degradation it just caused;
+ * skipping the write here would leave that live-session event silent, because
+ * the recovered config is then cached against the invalid file signature and
+ * later loads short-circuit before re-validating. The sentinel is a separate
+ * file, so writing it does not conflict with the suppression's purpose
+ * (blocking the first-launch-seed / deprecated-strip rewrites of config.json).
+ *
+ * Best-effort — any failure is logged and swallowed; the `log.error` recovery
+ * lines remain the authoritative record. `invalidPaths` is capped so a
+ * pathological config cannot bloat the sentinel.
+ */
+function recordConfigValidationReset(invalidPaths: string[]): void {
+  try {
+    const noticePath = getConfigValidationResetNoticePath();
+    const dir = dirname(noticePath);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const dedupedPaths = [...new Set(invalidPaths.filter(Boolean))].slice(
+      0,
+      50,
+    );
+    const notice = {
+      resetAt: new Date().toISOString(),
+      invalidPaths: dedupedPaths,
+    };
+    writeFileSync(noticePath, JSON.stringify(notice, null, 2) + "\n", "utf-8");
+    log.warn(
+      `Wrote config-validation-reset notice to ${noticePath}; config.json ` +
+        `failed schema validation and did not fully take effect (${
+          dedupedPaths.length
+        } invalid path(s): ${dedupedPaths.join(", ") || "top-level"}).`,
+    );
+  } catch (noticeErr) {
+    log.warn(
+      { noticeErr },
+      `Failed to write config-validation-reset notice; the event is still ` +
+        `recorded in the assistant logs.`,
+    );
+  }
+}
+
 /**
- * Validate a raw config object with Zod. Invalid fields are logged as warnings
- * and replaced with defaults (matching prior behavior of per-field fallback).
+ * Clear any stale config-validation-reset sentinel once the config validates
+ * cleanly again — the event is recoverable (fix the invalid entry and the values
+ * come back), so the notice must stop as soon as the config parses, not linger
+ * until age-out like a quarantine. Not gated on suppression (see {@link
+ * recordConfigValidationReset}): the suppressed re-parse inside
+ * `commitConfigWrite` is exactly when a user fixes their config via `config
+ * set`, and the config it produced is about to be cached against the new
+ * signature — so if we skipped clearing here, later short-circuiting loads
+ * would keep injecting the stale notice until age-out. Best-effort.
+ */
+function clearConfigValidationResetNotice(): void {
+  try {
+    rmSync(getConfigValidationResetNoticePath(), { force: true });
+  } catch {
+    // Best-effort — a failed delete just means the injector re-checks (and the
+    // sentinel ages out) next turn.
+  }
+}
+
+/**
+ * Validate a raw config object with Zod, applying schema defaults for absent
+ * keys. Invalid fields are logged and stripped so their schema defaults apply,
+ * then the config is re-parsed.
+ *
+ * When cleanup fails to produce a valid config, recovery follows a ladder
+ * (see {@link recoverFromInvalidConfig}) that prefers preserving as much of the
+ * user's configuration as possible over discarding it wholesale:
+ *   1. the last-known-good config validated earlier in this process,
+ *   2. a per-section salvage that keeps every top-level section that validates
+ *      on its own and defaults only the ones that do not, and
+ *   3. full schema defaults as the true last resort.
+ *
+ * Every success path records a `structuredClone` of the returned config as the
+ * last-known-good safety net. Cloning is required because `loadConfig` mutates
+ * the returned object in place via `fillContextDefaultsForMissingKeys`.
  */
 function validateWithSchema(raw: Record<string, unknown>): AssistantConfig {
   const result = AssistantConfigSchema.safeParse(raw);
   if (result.success) {
-    return applyNestedDefaults(result.data);
+    clearConfigValidationResetNotice();
+    const config = applyNestedDefaults(result.data);
+    lastKnownGoodConfig = structuredClone(config);
+    return config;
   }
 
   // Log each validation issue as a warning
@@ -318,22 +445,190 @@ function validateWithSchema(raw: Record<string, unknown>): AssistantConfig {
   const cleaned = structuredClone(raw);
   for (const issue of result.error.issues) {
     if (issue.path.length === 0) {
-      // Top-level error — return full defaults
-      return cloneDefaultConfig();
+      // Top-level error — individual keys cannot be stripped. Recover working
+      // from the clone as-is (its top-level sections are still iterable).
+      return recoverFromInvalidConfig(
+        cleaned,
+        [...result.error.issues],
+        issuePaths(result.error.issues),
+      );
     }
     deleteNestedKey(cleaned, issue.path as (string | number)[], true);
   }
 
+  // Deleting an invalid array element via `deleteNestedKey` uses `delete
+  // arr[i]` semantics, which leaves a sparse hole that the re-parse reads as
+  // `undefined` and rejects — one bad element in any array field would
+  // otherwise invalidate the whole cleaned config. Compact the holes away
+  // before re-parsing. An array that is emptied purely by stripping invalid
+  // elements is removed from its parent (and any ancestor object the removal
+  // empties is pruned too) so the schema default applies, matching how
+  // `deleteNestedKey` prunes emptied objects — `[]` is not equivalent to the
+  // default for fields like `backup.offsite.destinations` (default `null` =
+  // iCloud) or `skills.allowBundled` (default `null` = all bundled skills).
+  compactSparseArrays(cleaned);
+
   const retry = AssistantConfigSchema.safeParse(cleaned);
   if (retry.success) {
-    return applyNestedDefaults(retry.data);
+    clearConfigValidationResetNotice();
+    const config = applyNestedDefaults(retry.data);
+    lastKnownGoodConfig = structuredClone(config);
+    return config;
   }
 
-  // If still failing, fall back to full defaults
-  log.warn("Config validation failed after cleanup. Using full defaults.");
+  // Record BOTH the first-parse paths (what was stripped) and the retry paths
+  // (what still failed) so the notice can name what went wrong — a first-parse
+  // `invalid_key` can abort the record parse and mask a latent `superRefine`
+  // that only the retry surfaces, and vice versa.
+  return recoverFromInvalidConfig(
+    cleaned,
+    [...retry.error.issues],
+    [...issuePaths(result.error.issues), ...issuePaths(retry.error.issues)],
+  );
+}
+
+/** Dotted paths for a set of Zod issues; a top-level issue yields `""`. */
+function issuePaths(issues: readonly ValidationIssue[]): string[] {
+  return issues.map((issue) => issue.path.join("."));
+}
+
+/**
+ * Recover a usable config when {@link validateWithSchema}'s strip-and-reparse
+ * cleanup cannot produce a valid config, minimizing how much of the user's
+ * configuration is discarded.
+ *
+ * Ladder:
+ *   1. If a last-known-good config was captured earlier in this process, keep
+ *      it — config.json on disk is untouched, so only the in-memory view is
+ *      degraded and the previous good values are the closest safe substitute.
+ *   2. Otherwise (first load after startup), salvage section-by-section: keep
+ *      every top-level section of `cleaned` that validates on its own and reset
+ *      only the sections that do not. This rung requires `cleaned` to be a plain
+ *      object; a top-level non-object config (JSON `null`, a primitive, or an
+ *      array) has no sections to iterate and is skipped straight to rung 3.
+ *   3. If even the combined kept sections fail to parse, return full schema
+ *      defaults.
+ *
+ * Every rung leaves some part of the user's saved config inactive, so all of
+ * them record the validation-reset sentinel (see {@link
+ * recordConfigValidationReset}) — the agent needs to explain a setting that
+ * reverted (rungs 2 and 3) or a `config set` that never took effect (rung 1).
+ *
+ * `issues` are the ones still unresolved after cleanup, used for the operator
+ * log; `invalidPaths` spans every parse attempt and is what the sentinel
+ * records.
+ */
+function recoverFromInvalidConfig(
+  cleaned: unknown,
+  issues: ValidationIssue[],
+  invalidPaths: string[],
+): AssistantConfig {
+  recordConfigValidationReset(invalidPaths);
+  const issueSummary = describeIssues(issues);
+
+  if (lastKnownGoodConfig) {
+    log.error(
+      `config.json failed validation even after stripping invalid fields; ` +
+        `keeping the last-known-good configuration from this process. Fix ` +
+        `config.json to apply your changes (validation issues: ${issueSummary}).`,
+    );
+    return structuredClone(lastKnownGoodConfig);
+  }
+
+  if (!isPlainObject(cleaned)) {
+    // The per-section salvage below walks `Object.entries(cleaned)`, which
+    // throws on `null` and yields no config sections for a primitive or array.
+    // A top-level non-object config carries no recoverable sections, so load
+    // full schema defaults.
+    log.error(
+      `config.json is not a JSON object at the top level; loading full ` +
+        `defaults. Fix config.json to restore your settings (validation ` +
+        `issues: ${issueSummary}).`,
+    );
+    return cloneDefaultConfig();
+  }
+
+  const kept: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(cleaned)) {
+    const sectionResult = AssistantConfigSchema.safeParse({ [key]: value });
+    if (sectionResult.success) {
+      kept[key] = value;
+    } else {
+      log.error(
+        `config.json section "${key}" failed validation; resetting it to ` +
+          `defaults.`,
+      );
+    }
+  }
+
+  const salvaged = AssistantConfigSchema.safeParse(kept);
+  if (salvaged.success) {
+    const config = applyNestedDefaults(salvaged.data);
+    lastKnownGoodConfig = structuredClone(config);
+    return config;
+  }
+
+  log.error(
+    `config.json could not be salvaged section-by-section; loading full ` +
+      `defaults. Fix config.json to restore your settings (validation ` +
+      `issues: ${describeIssues([...salvaged.error.issues])}).`,
+  );
   return cloneDefaultConfig();
 }
 
+/**
+ * Recursively remove holes from every array reachable inside `value`, mutating
+ * in place, and report whether `value` should be removed from its parent.
+ *
+ * Config values come from `JSON.parse`, which cannot encode holes (or
+ * `undefined`), so any hole is the residue of a `deleteNestedKey` strip of an
+ * invalid array element and is safe to drop. Surviving elements are recursed
+ * into so nested arrays are compacted too.
+ *
+ * `removeFromParent` is set for a value the parent must drop so the schema
+ * default applies:
+ *
+ * - An **array** that had at least one element removed by compaction (a hole
+ *   from a stripped invalid element, or a nested child array that itself
+ *   collapsed) and is now empty. An array that was already `[]` on disk keeps
+ *   `removeFromParent` false — no element was stripped, so `[]` is the user's
+ *   explicit choice and is preserved.
+ * - A **plain object** that a compaction removal emptied. This mirrors
+ *   `deleteNestedKey(…, true)` pruning emptied ancestor objects: an emptied
+ *   wrapper left behind can still read as a present, non-default override. An
+ *   object that was already empty on disk removed no child, so it is left alone.
+ */
+function compactSparseArrays(value: unknown): { removeFromParent: boolean } {
+  if (Array.isArray(value)) {
+    let removedElement = false;
+    for (let i = value.length - 1; i >= 0; i--) {
+      if (i in value) {
+        if (compactSparseArrays(value[i]).removeFromParent) {
+          value.splice(i, 1);
+          removedElement = true;
+        }
+      } else {
+        value.splice(i, 1);
+        removedElement = true;
+      }
+    }
+    return { removeFromParent: removedElement && value.length === 0 };
+  }
+  if (isPlainObject(value)) {
+    let removedChild = false;
+    for (const key of Object.keys(value)) {
+      if (compactSparseArrays(value[key]).removeFromParent) {
+        delete value[key];
+        removedChild = true;
+      }
+    }
+    return {
+      removeFromParent: removedChild && Object.keys(value).length === 0,
+    };
+  }
+  return { removeFromParent: false };
+}
+
 /**
  * Delete the key at `path` from `obj`. When `pruneEmptyAncestors` is set, also
  * remove any ancestor object the deletion leaves empty, walking up until the
@@ -571,11 +866,22 @@ function emptyDefaultWorkspaceConfigMergeResult(): DefaultWorkspaceConfigMergeRe
  * Schema defaults are no longer materialized into the file on load — the
  * in-memory `loadConfig()` cache applies them at access time instead.
  */
-export function mergeDefaultWorkspaceConfig(): DefaultWorkspaceConfigMergeResult {
+/**
+ * Whether an unconsumed onboarding overlay is waiting to be merged this boot.
+ * The overlay file is renamed away on merge, so this is true for at most the
+ * single boot that consumes it.
+ */
+export function hasPendingDefaultWorkspaceConfig(): boolean {
   const defaultConfigPath = process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
-  if (!defaultConfigPath || !existsSync(defaultConfigPath)) {
+  return Boolean(defaultConfigPath && existsSync(defaultConfigPath));
+}
+
+export function mergeDefaultWorkspaceConfig(): DefaultWorkspaceConfigMergeResult {
+  if (!hasPendingDefaultWorkspaceConfig()) {
     return emptyDefaultWorkspaceConfigMergeResult();
   }
+  const defaultConfigPath = process.env
+    .VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH as string;
 
   let defaults: unknown;
   try {
@@ -747,6 +1053,13 @@ export function loadConfig(): AssistantConfig {
         fileConfig,
         contextDefaults,
       );
+      // Refresh the last-known-good safety net with the effective config.
+      // `validateWithSchema` captured a snapshot before these deployment-context
+      // fills (e.g. IS_PLATFORM=true → managed OAuth service modes) were layered
+      // on, so its snapshot reflects pre-fill schema defaults. The fills are part
+      // of this run's effective configuration, so a later recovery must restore
+      // them rather than flip a managed service mode back to its schema default.
+      lastKnownGoodConfig = structuredClone(config);
     }
 
     // First-launch seed only: when config.json does not exist, write the
@@ -987,3 +1300,25 @@ export function setNestedValue(
  * production use.
  */
 export const _writeQuarantineNotice = writeQuarantineNotice;
+
+/**
+ * Test-only alias for `recoverFromInvalidConfig`. The strip-and-reparse
+ * cleanup (including sparse-array compaction) repairs every known real-world
+ * config shape, so no config.json fixture reliably reaches the recovery
+ * ladder through `loadConfig` — the ladder is defense-in-depth for schema
+ * shapes the cleanup does not anticipate. Tests exercise its rungs (last
+ * known good, per-section salvage, full defaults) by calling it directly.
+ * Not for production use.
+ */
+export const _recoverFromInvalidConfigForTests = recoverFromInvalidConfig;
+
+/**
+ * Test-only reset for the module-level last-known-good config safety net.
+ * Exists so tests can exercise the first-load-after-startup salvage path (where
+ * no last-known-good config exists yet) deterministically. Not for production
+ * use: {@link invalidateConfigCache} deliberately preserves the safety net, so
+ * production code never clears it.
+ */
+export function _resetLastKnownGoodConfigForTests(): void {
+  lastKnownGoodConfig = null;
+}

package/src/config/profile-materialization.ts

@@ -0,0 +1,151 @@
+import {
+  getCatalogProviderForModel,
+  isModelInCatalog,
+} from "../providers/model-catalog.js";
+import {
+  MANAGED_ROUTABLE_PROVIDERS,
+  VELLUM_MANAGED_CONNECTION_NAME,
+} from "../providers/vellum-model-routing.js";
+import type { LLMConfigBase, ProfileEntry } from "./schemas/llm.js";
+
+/**
+ * Materializes a partial custom profile into a complete, standalone
+ * override: what `resolveCallSiteConfig` produces when this profile is the
+ * only profile layer above `llm.default`. Replicates the deep-merge
+ * resolver's non-obvious rules exactly:
+ *
+ * - Non-null default `temperature`/`topP` ARE inherited — winning-profile
+ *   scoping only blocks one profile's sampling from leaking under another;
+ *   `llm.default`'s base sampling stands when no profile opts in. Null
+ *   defaults are skipped (same resolved result, no noise). `logitBias` is
+ *   NEVER inherited — the resolver deletes non-profile values post-merge.
+ * - A model-only profile gets the provider `withImpliedProviders` would
+ *   stamp: the default provider when it serves the model, else the model's
+ *   catalog owner.
+ *
+ * Mix profiles (no config fields, schema-enforced) and managed profiles
+ * (bodies owned by the code catalog) pass through untouched. Idempotent,
+ * pure, and the result never aliases `dflt`'s nested objects.
+ */
+export function completeCustomProfile(
+  dflt: LLMConfigBase,
+  profile: ProfileEntry,
+): ProfileEntry {
+  if (profile.mix != null || profile.source === "managed") {
+    return profile;
+  }
+
+  const completed: ProfileEntry = { ...profile };
+
+  if (profile.provider === undefined) {
+    completed.provider = dflt.provider;
+  }
+  if (profile.model === undefined) {
+    completed.model = dflt.model;
+  }
+  if (profile.maxTokens === undefined) {
+    completed.maxTokens = dflt.maxTokens;
+  }
+  if (profile.effort === undefined) {
+    completed.effort = dflt.effort;
+  }
+  if (profile.speed === undefined) {
+    completed.speed = dflt.speed;
+  }
+  if (profile.verbosity === undefined) {
+    completed.verbosity = dflt.verbosity;
+  }
+  if (profile.disableCache === undefined && dflt.disableCache !== undefined) {
+    completed.disableCache = dflt.disableCache;
+  }
+  if (profile.temperature === undefined && dflt.temperature != null) {
+    completed.temperature = dflt.temperature;
+  }
+  if (profile.topP === undefined && dflt.topP != null) {
+    completed.topP = dflt.topP;
+  }
+
+  completed.thinking = mergeNestedFragment(dflt.thinking, profile.thinking);
+  completed.contextWindow = mergeNestedFragment(
+    dflt.contextWindow,
+    profile.contextWindow,
+  );
+  completed.openrouter = mergeNestedFragment(
+    dflt.openrouter,
+    profile.openrouter,
+  );
+
+  if (
+    profile.model !== undefined &&
+    profile.provider === undefined &&
+    !isModelInCatalog(dflt.provider, profile.model)
+  ) {
+    const implied = getCatalogProviderForModel(profile.model);
+    if (implied !== undefined) {
+      completed.provider = implied as ProfileEntry["provider"];
+    }
+  }
+
+  // A provider-specific connection baked onto a different provider would pin
+  // a mismatch (dispatch auto-resolves an absent connection by provider
+  // instead). The Vellum managed connection must survive a provider change —
+  // dispatch routes it via `expectedProvider` — but only onto providers it
+  // can actually route; a non-managed-routable provider (openrouter, ollama)
+  // would hit the mismatch path instead of auto-resolution.
+  const vellumRoutable =
+    dflt.provider_connection === VELLUM_MANAGED_CONNECTION_NAME &&
+    completed.provider !== undefined &&
+    MANAGED_ROUTABLE_PROVIDERS.has(completed.provider);
+  if (
+    profile.provider_connection === undefined &&
+    dflt.provider_connection !== undefined &&
+    (completed.provider === dflt.provider || vellumRoutable)
+  ) {
+    completed.provider_connection = dflt.provider_connection;
+  }
+
+  return structuredClone(completed);
+}
+
+type PlainObject = Record<string, unknown>;
+
+function isPlainObject(value: unknown): value is PlainObject {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  );
+}
+
+/**
+ * Merge a partial nested fragment into the default's full object with the
+ * same semantics as the resolver's `deepMerge`: `undefined` fragment values
+ * are "no opinion", plain objects recurse, everything else replaces.
+ *
+ * Intentionally re-declared rather than shared with `llm-resolver.ts`:
+ * materialization is a semantic snapshot of the merge behavior profiles were
+ * created under, and its output must not drift when the resolver's own merge
+ * evolves. (Mirrors the resolver's self-contained `seededUnitFloat`
+ * rationale.)
+ */
+function mergeNestedFragment<T>(base: T, fragment: unknown): T {
+  if (fragment === undefined) {
+    return base;
+  }
+  if (!isPlainObject(base) || !isPlainObject(fragment)) {
+    return fragment as T;
+  }
+  const out: PlainObject = { ...base };
+  for (const [key, value] of Object.entries(fragment)) {
+    if (value === undefined) {
+      continue;
+    }
+    const existing = out[key];
+    out[key] =
+      isPlainObject(value) && isPlainObject(existing)
+        ? mergeNestedFragment(existing, value)
+        : value;
+  }
+  return out as T;
+}

package/src/config/schema.ts

@@ -3,7 +3,6 @@ import { z } from "zod";
 import { getDataDir } from "../util/platform.js";
 
 // Re-export domain schemas that have external consumers
-export { AnalysisConfigSchema } from "./schemas/analysis.js";
 export type { BackupConfig, BackupDestination } from "./schemas/backup.js";
 export { BackupConfigSchema } from "./schemas/backup.js";
 export { VALID_CALLER_IDENTITY_MODES } from "./schemas/calls.js";
@@ -16,7 +15,6 @@ export type { SkillEntryConfig } from "./schemas/skills.js";
 
 // Imports for AssistantConfigSchema composition
 import { AcpConfigSchema } from "./acp-schema.js";
-import { AnalysisConfigSchema } from "./schemas/analysis.js";
 import { BackupConfigSchema } from "./schemas/backup.js";
 import { CallsConfigSchema } from "./schemas/calls.js";
 import {
@@ -34,6 +32,7 @@ import { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 import { HostBrowserConfigSchema } from "./schemas/host-browser.js";
 import { IngressConfigSchema } from "./schemas/ingress.js";
 import { JournalConfigSchema } from "./schemas/journal.js";
+import { LiveVoiceConfigSchema } from "./schemas/live-voice.js";
 import { LLMSchema } from "./schemas/llm.js";
 import { LlmRequestLogsConfigSchema } from "./schemas/llm-request-logs.js";
 import {
@@ -106,7 +105,6 @@ export const AssistantConfigSchema = z
       ConversationsConfigSchema.parse({}),
     ),
     journal: JournalConfigSchema.default(JournalConfigSchema.parse({})),
-    analysis: AnalysisConfigSchema.default(AnalysisConfigSchema.parse({})),
     backup: BackupConfigSchema.default(BackupConfigSchema.parse({})),
     mcp: McpConfigSchema.default(McpConfigSchema.parse({})),
     acp: AcpConfigSchema.default(AcpConfigSchema.parse({})),
@@ -120,6 +118,7 @@ export const AssistantConfigSchema = z
     compactionLogs: CompactionLogsConfigSchema,
     twilio: TwilioConfigSchema.default(TwilioConfigSchema.parse({})),
     calls: CallsConfigSchema.default(CallsConfigSchema.parse({})),
+    liveVoice: LiveVoiceConfigSchema.default(LiveVoiceConfigSchema.parse({})),
     whatsapp: WhatsAppConfigSchema.default(WhatsAppConfigSchema.parse({})),
     telegram: TelegramConfigSchema.default(TelegramConfigSchema.parse({})),
     slack: SlackConfigSchema.default(SlackConfigSchema.parse({})),
@@ -192,55 +191,6 @@ export const AssistantConfigSchema = z
           "llm.default.contextWindow.targetBudgetRatio must be greater than llm.default.contextWindow.summaryBudgetRatio",
       });
     }
-    const segmentation = config.memory?.segmentation;
-    if (
-      segmentation &&
-      segmentation.overlapTokens >= segmentation.targetTokens
-    ) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["memory", "segmentation", "overlapTokens"],
-        message:
-          "memory.segmentation.overlapTokens must be less than memory.segmentation.targetTokens",
-      });
-    }
-    const dynamicBudget = config.memory?.retrieval?.dynamicBudget;
-    if (
-      dynamicBudget &&
-      dynamicBudget.minInjectTokens > dynamicBudget.maxInjectTokens
-    ) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["memory", "retrieval", "dynamicBudget"],
-        message:
-          "memory.retrieval.dynamicBudget.minInjectTokens must be <= memory.retrieval.dynamicBudget.maxInjectTokens",
-      });
-    }
-    const injection = config.memory?.retrieval?.injection;
-    const ctxLoad = injection?.contextLoad;
-    if (
-      ctxLoad &&
-      ctxLoad.capabilityReserve + ctxLoad.serendipitySlots >= ctxLoad.maxNodes
-    ) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["memory", "retrieval", "injection", "contextLoad"],
-        message:
-          "memory.retrieval.injection.contextLoad.capabilityReserve + serendipitySlots must be less than maxNodes",
-      });
-    }
-    const perTurn = injection?.perTurn;
-    if (
-      perTurn &&
-      perTurn.capabilityReserve + perTurn.serendipitySlots >= perTurn.maxNodes
-    ) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["memory", "retrieval", "injection", "perTurn"],
-        message:
-          "memory.retrieval.injection.perTurn.capabilityReserve + serendipitySlots must be less than maxNodes",
-      });
-    }
   });
 
 export type AssistantConfig = z.infer<typeof AssistantConfigSchema>;