@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/util/logger.ts

@@ -215,12 +215,17 @@ function getRootLogger(): Logger {
   if (!rootLogger) {
     const pino = loadPino();
     const pinoPretty = loadPinoPretty();
-    const forceStderr =
+    const isTest =
       process.env.BUN_TEST === "1" || process.env.NODE_ENV === "test";
-    if (forceStderr) {
+    if (isTest) {
+      // Silent by default so test output stays readable without per-file
+      // `mock.module("../util/logger.js", …)` boilerplate — the mocks this
+      // replaces did exactly this, module-wide. Set VELLUM_TEST_LOG_LEVEL
+      // (e.g. "info", "debug") to see log output on stderr when debugging
+      // a test run.
       rootLogger = pino(
         {
-          level: "info",
+          level: process.env.VELLUM_TEST_LOG_LEVEL ?? "silent",
           serializers: logSerializers,
         },
         pino.destination(2),

package/src/{config/bundled-skills/messaging/tools/gmail-mime-helpers.ts → util/mime-type.ts}

@@ -1,5 +1,8 @@
 /**
- * Shared MIME type guessing for Gmail attachment support.
+ * Best-effort MIME type inference from a file path's extension.
+ *
+ * Used to label outbound attachments (Gmail/Outlook multipart parts, native
+ * email attachments) when the source is a local file with no declared type.
  */
 
 import { extname } from "node:path";

package/src/util/platform.ts

@@ -427,66 +427,6 @@ export function getProfilerRunDir(runId: string): string {
   return join(getProfilerRunsDir(), runId);
 }
 
-/**
- * Resolve the shipped source directory for a first-party skill (e.g.
- * `meet-join`) whose runtime is launched outside the compiled daemon
- * binary — notably the meet-host child process spawned via
- * `bun run <skill>/register.ts`.
- *
- * Layers on top of `getRepoSkillsDir()` from `skills/catalog-install.ts`:
- * that helper locates the first-party skills root (validated by
- * `catalog.json`); this helper appends the skill id and validates the
- * per-skill entry point (`register.ts`). Returns `undefined` when the
- * root is unavailable (e.g. dev-mode build without `VELLUM_DEV=1`) or
- * the skill directory has no `register.ts`.
- *
- * Implemented here instead of `skills/catalog-install.ts` to avoid
- * pulling that module's platform-API dependencies (fetch, memory graph)
- * into callers that only need a path resolution. Takes the first-party
- * skills root as a dependency to keep this module free of a reverse
- * import.
- */
-export function getSkillRuntimePath(
-  skillId: string,
-  firstPartySkillsRoot: string | undefined,
-): string | undefined {
-  if (!firstPartySkillsRoot) return undefined;
-  const candidate = join(firstPartySkillsRoot, skillId);
-  if (existsSync(join(candidate, "register.ts"))) {
-    return candidate;
-  }
-  return undefined;
-}
-
-/**
- * Resolve the on-disk path to a standalone `bun` binary that the meet-host
- * supervisor (PR 27) uses to spawn external skills. Prefers the
- * packaging-site-bundled copy before falling back to the shared
- * download/PATH resolver in `bun-runtime.ts`.
- *
- * Resolution order:
- *
- *   1. macOS `.app` bundle: `Contents/Resources/bun` — bundled at a version
- *      that matches `.tool-versions`.
- *   2. Next-to-binary: `<execDir>/bun` for Docker/generic compiled layouts
- *      that stage a bun binary alongside the daemon (PR 29 wires this up).
- *
- * Returns `undefined` when no bundled copy is present; callers should
- * fall back to `ensureBun()` from `./bun-runtime.ts`, which handles PATH
- * lookup and JIT download for bare-metal dev.
- */
-export function getBundledBunPath(): string | undefined {
-  const importDir = import.meta.dir;
-  if (!importDir.startsWith("/$bunfs/")) return undefined;
-
-  const execDir = dirname(process.execPath);
-  const resourcesPath = join(execDir, "..", "Resources", "bun");
-  if (existsSync(resourcesPath)) return resourcesPath;
-  const execDirPath = join(execDir, "bun");
-  if (existsSync(execDirPath)) return execDirPath;
-  return undefined;
-}
-
 export function ensureDataDir(): void {
   const root = vellumRoot();
   const workspace = getWorkspaceDir();

package/src/util/pricing.ts

@@ -12,6 +12,7 @@ interface ModelPricing {
   inputPer1M: number; // USD per 1M input tokens
   outputPer1M: number; // USD per 1M output tokens
   cacheReadPer1M?: number; // USD per 1M cache-read input tokens
+  cacheWritePer1M?: number; // USD per 1M cache-write input tokens
   tiers?: ModelPricingTier[];
 }
 
@@ -20,6 +21,7 @@ interface ModelPricingTier {
   inputPer1M: number;
   outputPer1M: number;
   cacheReadPer1M?: number;
+  cacheWritePer1M?: number;
 }
 
 const ANTHROPIC_PROMPT_CACHE_MULTIPLIERS = {
@@ -69,6 +71,7 @@ function catalogPricingToInternal(p: CatalogModelPricing): ModelPricing {
     inputPer1M: p.inputPer1mTokens,
     outputPer1M: p.outputPer1mTokens,
     cacheReadPer1M: p.cacheReadPer1mTokens,
+    cacheWritePer1M: p.cacheWritePer1mTokens,
     tiers: p.tiers?.map(catalogTierToInternal),
   };
 }
@@ -81,6 +84,7 @@ function catalogTierToInternal(
     inputPer1M: tier.inputPer1mTokens,
     outputPer1M: tier.outputPer1mTokens,
     cacheReadPer1M: tier.cacheReadPer1mTokens,
+    cacheWritePer1M: tier.cacheWritePer1mTokens,
   };
 }
 
@@ -260,6 +264,7 @@ function selectPricingTier(
     inputPer1M: selectedTier.inputPer1M,
     outputPer1M: selectedTier.outputPer1M,
     cacheReadPer1M: selectedTier.cacheReadPer1M ?? pricing.cacheReadPer1M,
+    cacheWritePer1M: selectedTier.cacheWritePer1M ?? pricing.cacheWritePer1M,
   };
 }
 
@@ -318,6 +323,10 @@ function calculateUsageCost(
       tieredPricing.cacheReadPer1M == null
         ? undefined
         : tieredPricing.cacheReadPer1M * speedMultiplier,
+    cacheWritePer1M:
+      tieredPricing.cacheWritePer1M == null
+        ? undefined
+        : tieredPricing.cacheWritePer1M * speedMultiplier,
   };
 
   const directInputCost = calculateTokenCost(
@@ -334,7 +343,7 @@ function calculateUsageCost(
       directInputCost +
       outputCost +
       calculateTokenCost(
-        effectivePricing.inputPer1M,
+        effectivePricing.cacheWritePer1M ?? effectivePricing.inputPer1M,
         usage.cacheCreationInputTokens,
       ) +
       calculateTokenCost(

package/src/util/telemetry-db-path.ts

@@ -3,13 +3,15 @@ import { join } from "node:path";
 import { getDataDir } from "./platform.js";
 
 /**
- * Path to the dedicated SQLite file that houses telemetry event tables
- * (starting with `watchdog_events`). It lives in the same `data/db` directory
- * as the main DB and is opened on its own connection (see `getTelemetryDb()`
- * in `memory/db-connection.ts`). Splitting telemetry tables into their own
- * file keeps the main DB — and its WAL — small and lets the two files
- * VACUUM/checkpoint independently, so a burst of watchdog events can no longer
- * bloat the main database.
+ * Path to the dedicated SQLite file that houses the telemetry-only tables:
+ * `telemetry_events` (the generic outbox of wire `TelemetryEvent` payloads,
+ * deleted on successful flush) and `flush_checkpoints` (watermark cursors for
+ * the main-DB-backed sources: usage, turns, tool_executed). It lives in the
+ * same `data/db` directory as the main DB and is opened on its own connection
+ * (see `getTelemetryDb()` in `persistence/db-connection.ts`). Splitting
+ * telemetry tables into their own file keeps the main DB — and its WAL —
+ * small and lets the two files VACUUM/checkpoint independently, so a burst of
+ * telemetry events cannot bloat the main database.
  *
  * Kept in its own leaf module rather than alongside `getDbPath()` in
  * `platform.ts`: `platform.ts` is imported very early and widely, and adding an

package/src/watcher/__tests__/telemetry.test.ts

@@ -8,12 +8,17 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import type { LifecycleEvent } from "../../persistence/lifecycle-events-store.js";
+
 const checkpoints = new Map<string, string>();
 const recordedEvents: string[] = [];
 let fakeEnabledWatchers: Array<{ providerId: string }> = [];
-let recordImpl: (name: string) => void = (name) => {
+let shareAnalytics = true;
+const recordAndReturnEvent = (name: string): LifecycleEvent => {
   recordedEvents.push(name);
+  return { id: "evt-1", eventName: name, createdAt: 0 };
 };
+let recordImpl: (name: string) => LifecycleEvent | null = recordAndReturnEvent;
 
 mock.module("../../persistence/checkpoints.js", () => ({
   getMemoryCheckpoint: (key: string) => checkpoints.get(key) ?? null,
@@ -23,10 +28,11 @@ mock.module("../../persistence/checkpoints.js", () => ({
 }));
 
 mock.module("../../persistence/lifecycle-events-store.js", () => ({
-  recordLifecycleEvent: (name: string) => {
-    recordImpl(name);
-    return null;
-  },
+  recordLifecycleEvent: (name: string) => recordImpl(name),
+}));
+
+mock.module("../../platform/consent-cache.js", () => ({
+  getCachedShareAnalytics: () => shareAnalytics,
 }));
 
 mock.module("../watcher-store.js", () => ({
@@ -48,9 +54,8 @@ beforeEach(() => {
   checkpoints.clear();
   recordedEvents.length = 0;
   fakeEnabledWatchers = [];
-  recordImpl = (name) => {
-    recordedEvents.push(name);
-  };
+  shareAnalytics = true;
+  recordImpl = recordAndReturnEvent;
 });
 
 describe("recordWatcherInventoryIfDue", () => {
@@ -108,14 +113,39 @@ describe("recordWatcherInventoryIfDue", () => {
     // instead of skipping a day of inventory.
     expect(checkpoints.get(INVENTORY_KEY)).toBeUndefined();
 
-    recordImpl = (name) => {
-      recordedEvents.push(name);
-    };
+    recordImpl = recordAndReturnEvent;
     recordWatcherInventoryIfDue(BASE + 3);
 
     expect(recordedEvents).toEqual(["watcher_enabled:gmail"]);
     expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 3));
   });
+
+  test("leaves the checkpoint for retry when the telemetry DB is unavailable with consent on", () => {
+    fakeEnabledWatchers = [{ providerId: "gmail" }];
+    // Degraded mode: consent granted but the store reports nothing recorded.
+    recordImpl = () => null;
+
+    recordWatcherInventoryIfDue(BASE + 2);
+    expect(checkpoints.get(INVENTORY_KEY)).toBeUndefined();
+
+    recordImpl = recordAndReturnEvent;
+    recordWatcherInventoryIfDue(BASE + 3);
+
+    expect(recordedEvents).toEqual(["watcher_enabled:gmail"]);
+    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 3));
+  });
+
+  test("advances the checkpoint when consent is off", () => {
+    fakeEnabledWatchers = [{ providerId: "gmail" }];
+    shareAnalytics = false;
+    // Consent-off skip: the store records nothing and returns null.
+    recordImpl = () => null;
+
+    recordWatcherInventoryIfDue(BASE + 4);
+
+    expect(recordedEvents).toEqual([]);
+    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 4));
+  });
 });
 
 describe("recordWatcherLlmProcessed", () => {

package/src/watcher/providers/google-calendar.ts

@@ -204,7 +204,14 @@ async function incrementalSync(
   let nextSyncToken: string | undefined;
 
   do {
-    const query: Record<string, string> = { syncToken };
+    // Match fetchInitialSyncToken's query shape. Google's sync guide asks that
+    // allowed params stay consistent between initial and incremental requests.
+    // The sync stream is intentionally kept COLLAPSED (no singleEvents): a
+    // single change to a recurring series then yields one changed parent event
+    // rather than one event per expanded instance, which would otherwise flood
+    // the watcher/LLM. Instance expansion happens only in the bounded display
+    // query (fallbackFetch), which pairs singleEvents with a timeMin window.
+    const query: Record<string, string> = { syncToken, maxResults: "250" };
     if (pageToken) query.pageToken = pageToken;
 
     const resp = await connection.request({
@@ -238,6 +245,72 @@ async function incrementalSync(
   return { items: allItems, nextSyncToken };
 }
 
+/**
+ * Establish the initial syncToken (stored as the watermark).
+ *
+ * Sends a bare listing request (maxResults only) that does NOT carry timeMin
+ * or other filter params — Google withholds nextSyncToken when the request is
+ * filtered. The resulting syncToken encodes the current calendar state so
+ * subsequent incrementalSync() calls detect changes without needing a time
+ * window.
+ *
+ * singleEvents is deliberately omitted so the sync stream stays collapsed: a
+ * change to a recurring series yields one changed parent event rather than one
+ * event per expanded instance (which would flood the watcher, especially for
+ * open-ended recurrences that have no expansion bound). Instances are expanded
+ * only in the bounded display query (fallbackFetch), which pairs singleEvents
+ * with a timeMin window.
+ *
+ * Google's sync guide says params must be "consistent" between initial and
+ * incremental requests to avoid undefined behavior: incrementalSync() omits
+ * timeMin (it's forbidden with syncToken) and sends the same consistent subset
+ * (syncToken + maxResults).
+ *
+ * Returns no items; the watermark marks the current point so the first
+ * incremental sync picks up only events that change afterward.
+ */
+async function fetchInitialSyncToken(
+  connection: OAuthConnection,
+): Promise<string | undefined> {
+  let pageToken: string | undefined;
+  let syncToken: string | undefined;
+
+  do {
+    // Google withholds nextSyncToken on filtered requests — no timeMin. Also no
+    // singleEvents: the token stream stays collapsed so a recurring-series edit
+    // surfaces as one changed parent, not one event per expanded instance.
+    const query: Record<string, string> = {
+      maxResults: "250",
+    };
+    if (pageToken) query.pageToken = pageToken;
+
+    const resp = await connection.request({
+      method: "GET",
+      path: "/calendars/primary/events",
+      query,
+      baseUrl: GOOGLE_CALENDAR_BASE_URL,
+    });
+
+    if (resp.status < 200 || resp.status >= 300) {
+      const bodyStr =
+        typeof resp.body === "string"
+          ? resp.body
+          : JSON.stringify(resp.body ?? "");
+      throw new CalendarApiError(
+        resp.status,
+        "",
+        `Calendar API ${resp.status}: ${bodyStr}`,
+      );
+    }
+
+    const page = (resp.body ?? {}) as CalendarEventsListResponse;
+    syncToken = page.nextSyncToken;
+    pageToken = page.nextPageToken;
+  } while (pageToken && !syncToken);
+
+  return syncToken;
+}
+
 class SyncTokenExpiredError extends Error {
   constructor(message: string) {
     super(message);
@@ -253,24 +326,7 @@ export const googleCalendarProvider: WatcherProvider = {
   async getInitialWatermark(credentialService: string): Promise<string> {
     const connection = await resolveOAuthConnection(credentialService);
 
-    // Do a full sync with a narrow window to get the initial syncToken.
-    // The API may paginate even for small result sets, so follow nextPageToken
-    // until we reach the final page that carries the nextSyncToken.
-    const now = new Date().toISOString();
-    let pageToken: string | undefined;
-    let syncToken: string | undefined;
-
-    do {
-      const result = await listEvents(connection, "primary", {
-        timeMin: now,
-        maxResults: 250,
-        singleEvents: true,
-        pageToken,
-      });
-      syncToken = result.nextSyncToken;
-      pageToken = result.nextPageToken;
-    } while (pageToken && !syncToken);
-
+    const syncToken = await fetchInitialSyncToken(connection);
     if (!syncToken) {
       throw new Error("Calendar API did not return a syncToken");
     }
@@ -286,22 +342,8 @@ export const googleCalendarProvider: WatcherProvider = {
     const connection = await resolveOAuthConnection(credentialService);
 
     if (!watermark) {
-      // No watermark — paginate through to get the initial syncToken, return no items
-      const now = new Date().toISOString();
-      let pageToken: string | undefined;
-      let syncToken: string | undefined;
-
-      do {
-        const result = await listEvents(connection, "primary", {
-          timeMin: now,
-          maxResults: 250,
-          singleEvents: true,
-          pageToken,
-        });
-        syncToken = result.nextSyncToken;
-        pageToken = result.nextPageToken;
-      } while (pageToken && !syncToken);
-
+      // No watermark — establish the initial syncToken and return no items.
+      const syncToken = await fetchInitialSyncToken(connection);
       return { items: [], watermark: syncToken ?? "" };
     }
 
@@ -358,20 +400,10 @@ async function fallbackFetch(
     eventToItem(event, "new_calendar_event"),
   );
 
-  // Paginate through to get a fresh syncToken for the next watermark
-  let pageToken: string | undefined;
-  let syncToken: string | undefined;
-
-  do {
-    const syncResult = await listEvents(connection, "primary", {
-      timeMin: now,
-      maxResults: 250,
-      singleEvents: true,
-      pageToken,
-    });
-    syncToken = syncResult.nextSyncToken;
-    pageToken = syncResult.nextPageToken;
-  } while (pageToken && !syncToken);
+  // Re-establish a fresh syncToken for the next watermark via the same
+  // paging-only request as initialization; a filtered request would withhold
+  // nextSyncToken.
+  const syncToken = await fetchInitialSyncToken(connection);
 
   return { items, watermark: syncToken ?? "" };
 }

package/src/watcher/telemetry.ts

@@ -24,6 +24,7 @@ import {
   setMemoryCheckpoint,
 } from "../persistence/checkpoints.js";
 import { recordLifecycleEvent } from "../persistence/lifecycle-events-store.js";
+import { getCachedShareAnalytics } from "../platform/consent-cache.js";
 import { getLogger } from "../util/logger.js";
 import { listWatchers } from "./watcher-store.js";
 
@@ -32,22 +33,38 @@ const log = getLogger("watcher-telemetry");
 const INVENTORY_CHECKPOINT_KEY = "telemetry:watchers:inventory_last_recorded";
 export const WATCHER_INVENTORY_INTERVAL_MS = 24 * 60 * 60 * 1000;
 
+let warnedInventoryDbUnavailable = false;
+
 /**
  * Record one `watcher_enabled:<providerId>` lifecycle event per enabled
  * watcher, at most once per 24h. Called from every watcher tick; the
  * checkpoint advances only after the events are recorded, so a transient
- * storage failure retries on the next tick instead of skipping a day.
- * Retries can duplicate events for watchers recorded before the failure
- * point — an acceptable overcount for best-effort telemetry, where losing
- * a full day's inventory would not be.
+ * storage failure (a throw, or a degraded-mode `null` while analytics
+ * consent is granted) retries on the next tick instead of skipping a day.
+ * A consent-off `null` is a deliberate skip and still advances. Retries
+ * can duplicate events for watchers recorded before the failure point —
+ * an acceptable overcount for best-effort telemetry, where losing a full
+ * day's inventory would not be.
  */
 export function recordWatcherInventoryIfDue(now: number): void {
   try {
     const last = Number(getMemoryCheckpoint(INVENTORY_CHECKPOINT_KEY) ?? "0");
     if (now - last < WATCHER_INVENTORY_INTERVAL_MS) return;
     for (const watcher of listWatchers({ enabledOnly: true })) {
-      recordLifecycleEvent(`watcher_enabled:${watcher.providerId}`);
+      const recorded = recordLifecycleEvent(
+        `watcher_enabled:${watcher.providerId}`,
+      );
+      if (recorded === null && getCachedShareAnalytics()) {
+        if (!warnedInventoryDbUnavailable) {
+          warnedInventoryDbUnavailable = true;
+          log.warn(
+            "Telemetry DB unavailable; watcher inventory retries next tick",
+          );
+        }
+        return;
+      }
     }
+    warnedInventoryDbUnavailable = false;
     setMemoryCheckpoint(INVENTORY_CHECKPOINT_KEY, String(now));
   } catch (err) {
     log.warn({ err }, "Failed to record watcher inventory telemetry");

package/src/workflows/engine-integration.test.ts

@@ -39,8 +39,6 @@
 
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { makeMockLogger } from "../__tests__/helpers/mock-logger.js";
-
 // ---------------------------------------------------------------------------
 // Mocks — defined before importing the module under test.
 //
@@ -49,10 +47,6 @@ import { makeMockLogger } from "../__tests__/helpers/mock-logger.js";
 // capabilities, config — is the real implementation.
 // ---------------------------------------------------------------------------
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () => makeMockLogger(),
-}));
-
 interface SendOptions {
   signal?: AbortSignal;
 }

package/src/workflows/engine.test.ts

@@ -1,15 +1,7 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
-
-// Silence the logger.
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 import type { WorkflowsConfig } from "../config/schemas/workflows.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";

package/src/workflows/journal-store.test.ts

@@ -1,12 +1,4 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-// Silence the logger.
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeEach, describe, expect, test } from "bun:test";
 
 import { getDb, getSqlite } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";

package/src/workflows/leaf-runner.test.ts

@@ -19,31 +19,18 @@ import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { z } from "zod";
 
-import { makeMockLogger } from "../__tests__/helpers/mock-logger.js";
+import { setConfig } from "../__tests__/helpers/set-config.js";
 
 // ---------------------------------------------------------------------------
 // Mocks — defined before importing the module under test.
 // ---------------------------------------------------------------------------
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () => makeMockLogger(),
-}));
-
-const TEST_PROFILES = { balanced: {}, "cost-optimized": {} };
-
-// Mutable config the mocked `getConfig` returns. Tests reassign this to drive
-// the active-profile and memory-enabled branches.
-let testConfig: {
-  llm: { profiles: Record<string, unknown>; activeProfile?: string };
-  memory: { enabled: boolean };
-} = {
-  llm: { profiles: TEST_PROFILES },
-  memory: { enabled: false },
-};
-
-mock.module("../config/loader.js", () => ({
-  getConfig: () => testConfig,
-}));
+// The leaf runner reads `llm.activeProfile` (persona override resolution),
+// `llm.profiles` (profile validation), and `memory.enabled` (persona memory
+// pipeline) via the real config loader; tests seed those via `setConfig`. The
+// default inference profiles (`balanced`, `cost-optimized`) always resolve from
+// the code catalog, so only `activeProfile` needs seeding, and `memory.enabled`
+// defaults to true.
 
 // Persona path — identity system prompt. A sentinel marks the persona prompt
 // so tests can assert identity was assembled (vs. the anonymous task prompt).
@@ -174,10 +161,9 @@ beforeEach(() => {
   graphMemoryInstances = 0;
   prepareMemoryCalls = 0;
   disposeCalls = 0;
-  testConfig = {
-    llm: { profiles: TEST_PROFILES },
-    memory: { enabled: false },
-  };
+  // Reset to defaults each test (all tests share one workspace config.json):
+  // no active profile, memory enabled by default.
+  setConfig("llm", {});
 });
 
 describe("runLeaf — schema path", () => {
@@ -598,10 +584,7 @@ describe("runLeaf — persona path", () => {
   };
 
   test("injects identity system prompt and runs the memory pipeline", async () => {
-    testConfig = {
-      llm: { profiles: TEST_PROFILES, activeProfile: "balanced" },
-      memory: { enabled: true },
-    };
+    setConfig("llm", { activeProfile: "balanced" });
     const schema = z.object({ a: z.string() });
     responseQueue = [personaResponse];
 
@@ -632,10 +615,7 @@ describe("runLeaf — persona path", () => {
   });
 
   test("resolves the workspace active profile by default", async () => {
-    testConfig = {
-      llm: { profiles: TEST_PROFILES, activeProfile: "balanced" },
-      memory: { enabled: true },
-    };
+    setConfig("llm", { activeProfile: "balanced" });
     const schema = z.object({ a: z.string() });
     responseQueue = [personaResponse];
 
@@ -645,10 +625,7 @@ describe("runLeaf — persona path", () => {
   });
 
   test("explicit profile beats the persona active-profile default", async () => {
-    testConfig = {
-      llm: { profiles: TEST_PROFILES, activeProfile: "balanced" },
-      memory: { enabled: true },
-    };
+    setConfig("llm", { activeProfile: "balanced" });
     const schema = z.object({ a: z.string() });
     responseQueue = [personaResponse];
 
@@ -664,12 +641,8 @@ describe("runLeaf — persona path", () => {
   });
 
   test("missing active profile falls through (no override)", async () => {
-    // No `activeProfile` set → persona resolves no overrideProfile, deferring
-    // to the shipped call-site default.
-    testConfig = {
-      llm: { profiles: TEST_PROFILES },
-      memory: { enabled: true },
-    };
+    // No `activeProfile` set (beforeEach resets it) → persona resolves no
+    // overrideProfile, deferring to the shipped call-site default.
     const schema = z.object({ a: z.string() });
     responseQueue = [personaResponse];
 
@@ -679,10 +652,7 @@ describe("runLeaf — persona path", () => {
   });
 
   test("anonymous leaf carries no identity and skips the memory pipeline", async () => {
-    testConfig = {
-      llm: { profiles: TEST_PROFILES, activeProfile: "balanced" },
-      memory: { enabled: true },
-    };
+    setConfig("llm", { activeProfile: "balanced" });
     const schema = z.object({ a: z.string() });
     responseQueue = [personaResponse];
 
@@ -708,10 +678,7 @@ describe("runLeaf — persona path", () => {
     const savedAuth = process.env.DISABLE_HTTP_AUTH;
     delete process.env.DISABLE_HTTP_AUTH;
     try {
-      testConfig = {
-        llm: { profiles: TEST_PROFILES, activeProfile: "balanced" },
-        memory: { enabled: true },
-      };
+      setConfig("llm", { activeProfile: "balanced" });
       const schema = z.object({ a: z.string() });
       responseQueue = [personaResponse];