@vellumai/assistant 0.11.2 → 0.11.3-dev.202608080427.92f668a

package/src/config/bundled-skills/transcribe/tools/transcribe-media.test.ts

@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { BatchTranscriber } from "../../../../stt/types.js";
+import { SttError } from "../../../../stt/types.js";
 import type { ToolContext } from "../../../../tools/types.js";
 
 // ---------------------------------------------------------------------------
@@ -8,9 +9,15 @@ import type { ToolContext } from "../../../../tools/types.js";
 // ---------------------------------------------------------------------------
 
 let mockTranscriber: BatchTranscriber | null = null;
+let mockResolveError: Error | null = null;
 
 mock.module("../../../../providers/speech-to-text/resolve.js", () => ({
-  resolveBatchTranscriber: async () => mockTranscriber,
+  resolveBatchTranscriber: async () => {
+    if (mockResolveError) {
+      throw mockResolveError;
+    }
+    return mockTranscriber;
+  },
 }));
 
 // Track calls to spawnWithTimeout so we can simulate ffmpeg/ffprobe results.
@@ -103,6 +110,7 @@ function makeMockTranscriber(
 describe("transcribe_media tool", () => {
   beforeEach(() => {
     mockTranscriber = null;
+    mockResolveError = null;
     spawnResults = {};
     accessiblePaths = new Set();
     mockFileContents = {};
@@ -119,6 +127,19 @@ describe("transcribe_media tool", () => {
         "No speech-to-text provider is configured",
       );
     });
+
+    test("surfaces a resolver error verbatim rather than the not-configured copy", async () => {
+      const reason =
+        'Deepgram Flux is streaming-only. Batch transcription requires the deepgram provider: set services.stt.provider to "deepgram".';
+      mockResolveError = new SttError("provider-error", reason, {
+        userFacing: true,
+      });
+
+      const result = await run({ file_path: "/tmp/test.mp3" }, makeContext());
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toBe(reason);
+    });
   });
 
   describe("input validation", () => {

package/src/config/bundled-skills/transcribe/tools/transcribe-media.ts

@@ -234,8 +234,15 @@ export async function run(
     };
   }
 
-  // Resolve the configured STT provider
-  const transcriber = await resolveBatchTranscriber();
+  // Resolve the configured STT provider. A typed resolver error already names
+  // the mismatch (e.g. a streaming-only provider) and its fix, so it reaches
+  // the model verbatim rather than as the "nothing configured" copy below.
+  let transcriber: BatchTranscriber | null;
+  try {
+    transcriber = await resolveBatchTranscriber();
+  } catch (err) {
+    return { content: (err as Error).message, isError: true };
+  }
   if (!transcriber) {
     return {
       content:

package/src/config/bundled-skills/visualize/SKILL.md

@@ -67,7 +67,7 @@ Semantic tokens flip automatically between light and dark. Use them for every su
 - Surfaces: --surface-base (page), --surface-lift (card), --surface-overlay, --surface-sunken (recessed tile), --surface-hover, --surface-active.
 - Text, strongest to faintest: --content-emphasised, --content-strong, --content-default (body), --content-secondary (labels and any text under 14px), --content-tertiary (14px and up only), --content-quiet, --content-faint, --content-disabled, --content-inset (on inverted fills). Text at 11 to 13px always takes --content-secondary or stronger.
 - Borders: --border-base (hairline), --border-subtle, --border-element (visible control edge), --border-hover, --border-active, --border-disabled.
-- Status pairs: --system-positive-strong/-weak, --system-negative-strong/-weak (and --system-negative-hover), --system-mid-strong/-weak, --system-info-strong/-weak.
+- Status pairs: --system-positive-strong/-weak, --system-negative-strong/-weak (and --system-negative-hover), --system-mid-strong/-weak, --system-info-strong/-weak. A non-text glyph sitting on its own -weak fill takes --system-positive-on-weak or --system-negative-on-weak; those clear the 3:1 that non-text indicators need, which --system-negative-strong misses on --system-negative-weak in the dark theme. Text on a -weak fill needs 4.5:1 and takes --content-default or stronger; --content-tertiary misses that on both fills in the light and dark themes, and --content-secondary misses it on the negative fill in light.
 - Type: --font-sans (default), --font-mono (identifiers, code, tabular numbers only), --font-serif (editorial pull-quotes only).
 - Radius: --radius-xs 2, --radius-sm 4, --radius-md 8, --radius-lg 12, --radius-xl 16, --radius-xxl 20, --radius-pill 999.
 

package/src/config/call-site-defaults.ts

@@ -121,22 +121,21 @@ export const CALL_SITE_DEFAULTS: Record<LLMCallSite, CallSiteDefaultConfig> = {
     effort: "low",
     thinking: { enabled: false },
   },
-  // Endpoint decisions gate live-voice turn-end latency, and `cost-optimized`'s
-  // upstream cannot fit any usable decision budget (~1s+ per forced tool call).
+  // Progress narration only helps when it arrives before the next real output.
   // `latency-optimized` is the latency-class profile (see
   // default-profile-catalog.ts): managed installs get the pinned latency model,
   // BYOK installs resolve their own provider's latency model through the intent
   // table rather than a model id they may hold no credential for. The profile
   // is user-facing ("Speed"), so a user edit to it moves this call site too.
-  voiceFrontDecision: {
+  voiceProgressNarration: {
     profile: "latency-optimized",
     effort: "low",
     thinking: { enabled: false },
   },
   // The front-door leg fronts EVERY unified live-voice turn and its leading
   // tokens ARE the endpointing/triage verdict, so both TTFT variance and
-  // judgment quality gate the whole call. Same latency class as the endpoint
-  // decider: live drives showed the cost-optimized upstream with multi-second
+  // judgment quality gate the whole call. Live drives showed the
+  // cost-optimized upstream with multi-second
   // cross-session TTFT tails and over-escalation of small talk under open-task
   // context pressure.
   voiceFrontDoor: {

package/src/config/default-profile-catalog.ts

@@ -135,7 +135,11 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     label: "Speed",
     description: "Fastest responses, with reasoning turned off",
     maxTokens: 8192,
-    effort: "low",
+    // Explicit reasoning opt-out, matching `cost-optimized` above: this
+    // profile advertises reasoning as off, and OpenAI-compat APIs default
+    // reasoning to "medium" when the field is omitted, so the opt-out has to
+    // be stated rather than implied.
+    effort: "none",
     thinking: { enabled: false, streamThinking: false },
     contextWindow: {
       maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
@@ -194,7 +198,7 @@ const BYOK_PROFILE_IMPLS: Record<
     label: "Speed",
     description: "Fastest responses, with reasoning turned off",
     maxTokens: 8192,
-    effort: "low",
+    effort: "none",
     thinking: { enabled: false, streamThinking: false },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
@@ -298,9 +302,9 @@ export const OS_BETA_PROFILE_TEMPLATE: DefaultProfileTemplate = {
 /**
  * Profiles whose body is code-owned outright: no workspace overlay, and no
  * user-owned shadow. The shadow rule below lets a user replace a default they
- * can select, but `latency-optimized` fronts every live-voice turn through
- * `voiceFrontDecision`/`voiceFrontDoor`, where a model outside the latency
- * envelope is audible dead air rather than a slow reply. A same-named
+ * can select, but `latency-optimized` serves `voiceFrontDoor` and
+ * `voiceProgressNarration`, where a model outside the latency envelope is
+ * audible dead air rather than a slow reply. A same-named
  * workspace entry stays on disk and stays listed; it just never governs what
  * this name resolves to.
  */

package/src/config/feature-flag-registry.json

@@ -101,6 +101,14 @@
       "description": "Enable the Quick Input popover on right-click of the menu bar icon",
       "defaultEnabled": false
     },
+    {
+      "id": "companion-surface",
+      "scope": "client",
+      "key": "companion-surface",
+      "label": "Companion Surface",
+      "description": "Show the macOS companion surface: the floating avatar that carries Talk, Type and the running call, and its tray item. Read in the Electron main process, which decides whether the window opens at all",
+      "defaultEnabled": false
+    },
     {
       "id": "expand-completed-steps",
       "scope": "client",
@@ -197,14 +205,6 @@
       "description": "Show the Velvet theme option in the macOS appearance settings. Velvet is a dark-mode variant with red/pink accent colors.",
       "defaultEnabled": false
     },
-    {
-      "id": "queue-steering",
-      "scope": "assistant",
-      "key": "queue-steering",
-      "label": "Queue Steering",
-      "description": "Enable the 'Push to agent' button on queued messages, allowing users to steer the assistant to a specific queued message by aborting the current generation and promoting the message to the head of the queue.",
-      "defaultEnabled": false
-    },
     {
       "id": "chat-pull-to-refresh-enabled",
       "scope": "client",
@@ -213,14 +213,6 @@
       "description": "Enable pull-to-refresh gesture in the chat view.",
       "defaultEnabled": false
     },
-    {
-      "id": "platform-notifications",
-      "scope": "client",
-      "key": "platform-notifications",
-      "label": "Platform Notifications",
-      "description": "Enable the Notifications tab in settings.",
-      "defaultEnabled": false
-    },
     {
       "id": "centralized-assistant-status",
       "scope": "client",
@@ -346,7 +338,7 @@
       "scope": "client",
       "key": "assistant-switcher",
       "label": "Assistant Switcher",
-      "description": "Show the Switch Assistant section in General settings (local mode only), linking to the assistant chooser.",
+      "description": "Show the Switch Assistant section in General settings, linking to the assistant chooser. Covers local clients, signed-in cloud-hub users, remote-gateway origins, and native mobile shells; remote-gateway desktop browsers hand off to the hub chooser with a self-registration param. Also makes the chooser's selection authoritative for the app's active assistant on every surface including the platform hub, a job that previously belonged to multi-platform-assistant alone.",
       "defaultEnabled": false
     },
     {
@@ -364,6 +356,22 @@
       "label": "Assistant Reply Push",
       "description": "Gates the `chat.assistant_reply` push notification the assistant sends at the end of a user-initiated turn whose reply the user has not seen. On by default; turn it off to silence the push without disabling the rest of the notification pipeline.",
       "defaultEnabled": true
+    },
+    {
+      "id": "desktop-presence-suppression",
+      "scope": "assistant",
+      "key": "desktop-presence-suppression",
+      "label": "Desktop Presence Suppression",
+      "description": "Gates whether a `chat.assistant_reply` push is suppressed while a Mac desktop client reports itself attended. On by default; turn it off to restore unconditional reply pushes.",
+      "defaultEnabled": true
+    },
+    {
+      "id": "plugin-schedules",
+      "scope": "assistant",
+      "key": "plugin-schedules",
+      "label": "Plugin Schedules",
+      "description": "Plugins declare recurring schedules as files that register and run automatically",
+      "defaultEnabled": false
     }
   ]
 }

package/src/config/llm-resolver.ts

@@ -40,7 +40,7 @@ import {
  *   3. `llm.callSites[callSite].profile` (the call site's named profile)
  *   4. `CALL_SITE_DEFAULTS[callSite].profile` intent resolved through
  *      `llm.defaultProvider`
- *   5. balanced intent through `llm.defaultProvider` — the code-owned anchor
+ *   5. balanced intent through `llm.defaultProvider`: the code-owned anchor
  *      for profileless call sites, or when nothing above is usable
  *
  * A winner must carry its own `provider` AND `model`: the base layer's schema
@@ -157,9 +157,11 @@ export function resolveCallSiteConfig(
 //
 // The request config is the base + winner + site-tweak composition:
 // code-owned schema defaults, then the single winning profile, then the call
-// site's own tuning fragment. Selection is pure either/or — no profile ever
-// contributes a field to another profile; `deepMerge` here only makes nested
-// tweaks (`thinking.enabled`) combine leaf-wise instead of wiping siblings.
+// site's own tuning fragment (its shipped `CALL_SITE_DEFAULTS` tuning with
+// the workspace `llm.callSites` entry layered over it, field by field).
+// Selection is pure either/or: no profile ever contributes a field to
+// another profile, and `deepMerge` only makes nested tweaks
+// (`thinking.enabled`) combine leaf-wise instead of wiping siblings.
 // `temperature`/`topP` come from the winner (or an explicit tweak);
 // `logitBias` only ever from the winner.
 // `forceOverrideProfile` is a no-op here (the override is already first).
@@ -221,8 +223,9 @@ export function selectWinningProfile(
   }
   // Anchor: profileless call sites (`vision`, `workflowLeaf`) and any
   // resolution whose every named rung was unusable land on balanced intent
-  // through the default provider. `profileName` stays null — the anchor is
-  // not a selection.
+  // through the default provider, bottoming out on the code-owned catalog,
+  // so it always resolves. `profileName` stays null on the catalog path:
+  // the anchor itself is not a selection.
   return {
     profileName: null,
     source: "default",
@@ -380,15 +383,10 @@ function resolveOverrideOrDefault(
   const winnerFragment: Mergeable =
     selection.entry == null ? {} : winnerConfigFragment(selection.entry);
 
-  // The call site's own tweak fragment: the workspace override replaces the
-  // code default wholesale. `profile` is the selection discriminator and
-  // `logitBias` is winner-owned, so neither enters the merge.
-  const site = llm.callSites?.[callSite] ?? CALL_SITE_DEFAULTS[callSite];
-  const {
-    profile: _siteProfile,
-    logitBias: _siteBias,
-    ...tweak
-  } = (site ?? {}) as Record<string, unknown>;
+  const tweak = composeCallSiteTweak(
+    CALL_SITE_DEFAULTS[callSite] as Mergeable | undefined,
+    llm.callSites?.[callSite] as Mergeable | undefined,
+  );
 
   // Direct call-site model overrides are fragments by design: when the tweak
   // pins a model the winner's provider does not serve, stamp the catalog
@@ -471,6 +469,38 @@ function winnerConfigFragment(entry: ProfileEntry): Mergeable {
 
 type Mergeable = Record<string, unknown>;
 
+/**
+ * The call site's tuning fragment: its shipped `CALL_SITE_DEFAULTS` tuning
+ * with the workspace `llm.callSites` entry layered over it, field by field.
+ * An entry that only names a profile therefore repoints the selection while
+ * the tuning the call site ships with still applies, and a field the entry
+ * sets wins for that field alone.
+ *
+ * `profile` is the selection discriminator and `logitBias` is winner-owned,
+ * so neither survives into the fragment. A workspace entry also owns the
+ * selection for its own call site: when one exists the shipped layer
+ * contributes tuning only, so a shipped `provider`/`model` pin can never
+ * override the profile or the custom model the user chose there. With no
+ * workspace entry the shipped fragment applies whole, pin included.
+ */
+export function composeCallSiteTweak(
+  shipped: Mergeable | undefined,
+  workspace: Mergeable | undefined,
+): Mergeable {
+  const {
+    provider: _shippedProvider,
+    model: _shippedModel,
+    ...shippedTuning
+  } = shipped ?? {};
+  const shippedLayer = workspace == null ? (shipped ?? {}) : shippedTuning;
+  const {
+    profile: _siteProfile,
+    logitBias: _siteBias,
+    ...tweak
+  } = deepMerge(shippedLayer, workspace ?? {});
+  return tweak;
+}
+
 /**
  * FNV-1a 32-bit string hash → unit float in [0, 1). Deterministic and stable
  * across runtimes — the mix-pick contract depends on identical output for

package/src/config/loader.ts

@@ -1,12 +1,13 @@
 import {
   existsSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
 import { safeStatSync } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
@@ -319,6 +320,53 @@ function writeQuarantineNotice(
   }
 }
 
+/**
+ * Whether the newest quarantined config next to `configPath`
+ * (`config.json.corrupt-*.json`, written by {@link quarantineCorruptConfig})
+ * carried `memory.v3.live: true`. Quarantine filenames embed a
+ * filesystem-safe ISO timestamp, so a lexicographic sort is chronological.
+ *
+ * The first-launch seed asks this so a quarantine-reseed carries the memory
+ * tier forward: without it, reseeding an existing memory-v3 assistant
+ * silently demotes it to v2: the reseeded file records no `live` decision,
+ * migration 105 is already checkpointed on an existing workspace and never
+ * re-runs, and the schema default is `false`. Only `true` is ever salvaged:
+ * carrying `false` forward would re-pin a workspace to the schema default,
+ * the exact bug the seed's absent-leaf contract exists to prevent.
+ *
+ * A quarantined file usually fails `JSON.parse` (that is why it was
+ * quarantined); every config writer serializes via
+ * `JSON.stringify(config, null, 2)` and `memory.v3.live` is the only config
+ * key named `"live"`, so a literal `"live": true` match on the raw text is
+ * an unambiguous fallback for truncated files.
+ */
+function quarantinedConfigSaidMemoryV3Live(configPath: string): boolean {
+  try {
+    const dir = dirname(configPath);
+    const prefix = `${basename(configPath)}.corrupt-`;
+    const quarantines = readdirSync(dir)
+      .filter((name) => name.startsWith(prefix) && name.endsWith(".json"))
+      .sort();
+    const newest = quarantines[quarantines.length - 1];
+    if (!newest) {
+      return false;
+    }
+    const raw = readFileSync(join(dir, newest), "utf-8");
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (!isPlainObject(parsed) || !isPlainObject(parsed.memory)) {
+        return false;
+      }
+      const v3 = parsed.memory.v3;
+      return isPlainObject(v3) && v3.live === true;
+    } catch {
+      return /"live"\s*:\s*true/.test(raw);
+    }
+  } catch {
+    return false;
+  }
+}
+
 /** Minimal structural view of the Zod issues the recovery ladder consumes. */
 type ValidationIssue = { path: PropertyKey[]; message: string };
 
@@ -719,6 +767,11 @@ const DEPRECATED_FIELDS: Record<string, string> = {
     "daemon.reapOrphanedSubprocesses has been removed. The daemon now reaps " +
     "orphaned subprocesses automatically whenever it runs as PID 1 on Linux. " +
     "The field will be removed from your config file.",
+  "calls.voice.language":
+    "calls.voice.language has been removed; it had no effect. Use " +
+    "services.stt.language for the spoken language and " +
+    "services.tts.providers.<id>.languageVoices for per-language voices. " +
+    "The field will be removed from your config file.",
 };
 
 /**
@@ -1137,6 +1190,27 @@ export function loadConfig(): AssistantConfig {
         // `memory.v3.live=false` override still wins by merging after
         // migrations.
         seed.memory.v3 = {} as (typeof seed.memory)["v3"];
+        // Exception: a quarantine-reseed carries the memory tier forward.
+        // When the missing config.json is explained by a quarantined
+        // predecessor that had `live: true`, this is an EXISTING memory-v3
+        // assistant being reseeded, not a first launch: migration 105 is
+        // already checkpointed here and never re-runs, so leaving the leaf
+        // absent would silently demote the assistant to v2. Persist the
+        // carried value and apply it to this load's effective config so the
+        // current boot already runs v3.
+        if (quarantinedConfigSaidMemoryV3Live(configPath)) {
+          seed.memory.v3 = { live: true } as (typeof seed.memory)["v3"];
+          config.memory.v3.live = true;
+          // Refresh the last-known-good safety net (mirrors the
+          // deployment-context refresh above): its snapshot was taken before
+          // the carry, so a later in-process validation recovery would
+          // otherwise restore live=false and demote the assistant in memory
+          // despite the reseeded file on disk carrying true.
+          lastKnownGoodConfig = structuredClone(config);
+          log.info(
+            "Carried memory.v3.live=true forward from the quarantined config",
+          );
+        }
         // Strip dataDir (runtime-derived) from the persisted config
         const { dataDir: _, ...persistable } = seed;
         writeFileSync(configPath, JSON.stringify(persistable, null, 2) + "\n");

package/src/config/profile-tool-support.ts

@@ -0,0 +1,110 @@
+import type { z } from "zod";
+
+import { PROVIDER_CATALOG } from "../providers/model-catalog.js";
+import { resolveDefaultProfileForProvider } from "./default-profile-catalog.js";
+import { selectWinningProfile } from "./llm-resolver.js";
+import type { AssistantConfig } from "./schema.js";
+import type { LLMSchema } from "./schemas/llm.js";
+
+/**
+ * Whether a named inference profile is KNOWN to support tool calling.
+ *
+ * Tri-state on purpose. The model catalog is not exhaustive: BYOK installs
+ * point profiles at models the catalog has never heard of, and a
+ * `supportsToolUse` flag it does not carry is not evidence of anything. So
+ * only `false` is a verdict:
+ *   - `true`  the catalog states the model supports tool use
+ *   - `false` the catalog states the model does NOT support tool use
+ *   - `undefined` the model is unknown to the catalog, or the catalog entry
+ *     is silent on tool use
+ *
+ * A `mix` profile is answered across ALL of its arms rather than by expanding
+ * it, because the arm a mix lands on is a function of the running
+ * conversation's `selectionSeed` and no such conversation exists at probe
+ * time. A verdict is only returned when it holds for every arm: all-denied is
+ * `false`, all-capable is `true`, and a mix of the two is `undefined` (which
+ * arm runs is unknowable here, so there is no honest verdict).
+ *
+ * Callers gate on `=== false` so an unknown model is never punished (fail
+ * open).
+ */
+export function profileSupportsTools(
+  profileKey: string,
+  config: AssistantConfig,
+): boolean | undefined {
+  const arms = mixArms(profileKey, config.llm);
+  if (arms == null) {
+    return concreteProfileSupportsTools(profileKey, config);
+  }
+  const verdicts = arms.map((arm) => concreteProfileSupportsTools(arm, config));
+  if (verdicts.length === 0) {
+    return undefined;
+  }
+  if (verdicts.every((verdict) => verdict === false)) {
+    return false;
+  }
+  if (verdicts.every((verdict) => verdict === true)) {
+    return true;
+  }
+  return undefined;
+}
+
+/** The arm profile names of a `mix` profile, or `undefined` if not a mix. */
+function mixArms(
+  profileKey: string,
+  llm: z.infer<typeof LLMSchema>,
+): string[] | undefined {
+  const entry = resolveDefaultProfileForProvider(
+    llm.profiles,
+    profileKey,
+    llm.defaultProvider ?? null,
+  );
+  return entry?.mix?.map((arm) => arm.profile);
+}
+
+/**
+ * Verdict for a profile expected to name one concrete model. A key that is
+ * itself a mix yields no verdict: `LLMSchema.superRefine` forbids nesting, so
+ * this is only reachable from a hand-written config that never went through
+ * the schema, and expanding it would reintroduce the unseeded random pick.
+ */
+function concreteProfileSupportsTools(
+  profileKey: string,
+  config: AssistantConfig,
+): boolean | undefined {
+  if (mixArms(profileKey, config.llm) != null) {
+    return undefined;
+  }
+  // Run the profile through the real resolver so a catalog default and a
+  // workspace shadow alike yield the model the child would actually run on.
+  // Feeding the key in as the override rung means a profile the resolver
+  // cannot use falls through to a different rung, and a non-`override` winner
+  // tells us the key never resolved: unknown, so no verdict.
+  const winner = selectWinningProfile("subagentSpawn", config.llm, {
+    overrideProfile: profileKey,
+  });
+  if (winner.source !== "override") {
+    return undefined;
+  }
+  const model = winner.entry?.model;
+  return model == null ? undefined : modelSupportsTools(model);
+}
+
+/**
+ * Look a model id up across every catalog provider. A model offered by more
+ * than one provider (e.g. the same id direct and through OpenRouter) is
+ * matched several times; any entry claiming tool support settles it, keeping
+ * the answer on the fail-open side.
+ */
+function modelSupportsTools(modelId: string): boolean | undefined {
+  const matches = PROVIDER_CATALOG.flatMap((provider) =>
+    provider.models.filter((model) => model.id === modelId),
+  );
+  if (matches.some((model) => model.supportsToolUse === true)) {
+    return true;
+  }
+  if (matches.some((model) => model.supportsToolUse === false)) {
+    return false;
+  }
+  return undefined;
+}

package/src/config/sanitize-for-transfer.ts

@@ -6,6 +6,7 @@
  * - `ingress.publicBaseUrl` → set to `""`
  * - `ingress.enabled` → deleted
  * - `ingress.publicBaseUrlManagedBy` → deleted
+ * - `telegram.registeredWebhookUrl` → deleted
  * - `daemon` → deleted entirely
  * - `skills.load.extraDirs` → set to `[]`
  * - `hostBrowser.cdpInspect.desktopAuto` → deleted **only when the source
@@ -45,6 +46,16 @@ export function sanitizeConfigForTransfer(configJson: string): string {
     delete ingress.publicBaseUrlManagedBy;
   }
 
+  // Strip the recorded Telegram webhook URL. It records where *this*
+  // deployment pointed Telegram, so carrying it across a teleport would have
+  // the destination compare its own registration against the source's address
+  // and report a mismatch on a channel that is fine. Absent, the health sweep
+  // reports unverified until the destination reconciles and records its own.
+  if (config.telegram && typeof config.telegram === "object") {
+    const telegram = config.telegram as Record<string, unknown>;
+    delete telegram.registeredWebhookUrl;
+  }
+
   // Strip daemon entirely
   delete config.daemon;
 

package/src/config/schema.ts

@@ -50,6 +50,7 @@ import {
   PlatformConfigSchema,
   UiConfigSchema,
 } from "./schemas/platform.js";
+import { PluginUpdatesConfigSchema } from "./schemas/plugin-updates.js";
 import { SecretDetectionConfigSchema } from "./schemas/security.js";
 import { ServicesSchema } from "./schemas/services.js";
 import { SkillsConfigSchema } from "./schemas/skills.js";
@@ -142,6 +143,9 @@ export const AssistantConfigSchema = z.object({
     .describe(
       "Per-plugin configuration keyed by plugin name. Validated downstream by each plugin's manifest.config validator at bootstrap.",
     ),
+  pluginUpdates: PluginUpdatesConfigSchema.default(
+    PluginUpdatesConfigSchema.parse({}),
+  ),
   legacyTelemetryOptOut: z
     .boolean()
     .optional()