@vellumai/assistant 0.5.1 → 0.5.3

package/src/config/bundled-skills/image-studio/tools/media-generate-image.ts

@@ -1,55 +1,22 @@
 import { getConfig } from "../../../../config/loader.js";
-import {
-  type AttachmentContext,
-  isAttachmentVisible,
-} from "../../../../daemon/media-visibility-policy.js";
 import {
   generateImage,
   type ImageGenCredentials,
   mapGeminiError,
 } from "../../../../media/gemini-image-service.js";
-import {
-  getAttachmentContent,
-  getAttachmentsByIds,
-} from "../../../../memory/attachments-store.js";
-import { getConversationType } from "../../../../memory/conversation-crud.js";
+import { getFilePathBySourcePath } from "../../../../memory/attachments-store.js";
 import {
   buildManagedBaseUrl,
   resolveManagedProxyContext,
 } from "../../../../providers/managed-proxy/context.js";
 import type { ImageContent } from "../../../../providers/types.js";
 import { getProviderKeyAsync } from "../../../../security/secure-keys.js";
-import { getAttachmentSourceConversations } from "../../../../tools/assets/search.js";
+import { sandboxPolicy } from "../../../../tools/shared/filesystem/path-policy.js";
 import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
 
-/**
- * Check whether an attachment is visible from the given context.
- * Mirrors the logic in tools/assets/search.ts:isAttachmentVisibleFromContext.
- */
-function isAttachmentAccessible(
-  attachmentId: string,
-  currentContext: AttachmentContext,
-): boolean {
-  const sources = getAttachmentSourceConversations(attachmentId);
-  if (sources.length === 0) {
-    return true; // orphan attachments are universally visible
-  }
-  const hasStandard = sources.some((s) => s.conversationType !== "private");
-  if (hasStandard) {
-    return true;
-  }
-  // All sources are private - visible only if the caller is in one of those conversations
-  return sources.some((s) =>
-    isAttachmentVisible(
-      { conversationId: s.conversationId, isPrivate: true },
-      currentContext,
-    ),
-  );
-}
-
 export async function run(
   input: Record<string, unknown>,
   context: ToolContext,
@@ -87,54 +54,60 @@ export async function run(
 
   const prompt = input.prompt as string;
   const mode = (input.mode as "generate" | "edit") ?? "generate";
-  const attachmentIds = input.attachment_ids as string[] | undefined;
+  const sourcePaths = input.source_paths as string[] | undefined;
   const model =
     (input.model as string | undefined) ??
     config.services["image-generation"].model;
   const variants = input.variants as number | undefined;
 
-  // Resolve source images from attachments for edit mode
+  // Resolve source images from file paths (sandboxed to workingDir, edit mode only)
   let sourceImages: Array<{ mimeType: string; dataBase64: string }> | undefined;
 
-  if (attachmentIds && attachmentIds.length > 0) {
-    const attachments = getAttachmentsByIds(attachmentIds);
-
-    // Build visibility context for the current conversation
-    const conversationType = getConversationType(context.conversationId);
-    const currentContext: AttachmentContext = {
-      conversationId: context.conversationId,
-      isPrivate: conversationType === "private",
-    };
-
-    // Filter to only visible attachments using their originating context
-    const visibleAttachments = attachments.filter((att) =>
-      isAttachmentAccessible(att.id, currentContext),
-    );
-
-    if (visibleAttachments.length === 0 && attachmentIds.length > 0) {
+  if (mode === "edit" && sourcePaths && sourcePaths.length > 0) {
+    const errors: string[] = [];
+    const validPathImages: Array<{ mimeType: string; dataBase64: string }> = [];
+    for (const filePath of sourcePaths) {
+      let resolvedPath: string;
+      const pathCheck = sandboxPolicy(filePath, context.workingDir);
+      if (!pathCheck.ok) {
+        // Fallback: if the source path is outside the sandbox (e.g. an image
+        // attached from ~/Desktop), check if the attachment store has a
+        // workspace-internal copy stored under its original source_path.
+        const storedPath = getFilePathBySourcePath(
+          filePath,
+          context.conversationId,
+        );
+        if (!storedPath) {
+          errors.push(pathCheck.error);
+          continue;
+        }
+        const fallbackCheck = sandboxPolicy(storedPath, context.workingDir);
+        if (!fallbackCheck.ok) {
+          errors.push(pathCheck.error);
+          continue;
+        }
+        resolvedPath = fallbackCheck.resolved;
+      } else {
+        resolvedPath = pathCheck.resolved;
+      }
+      const file = Bun.file(resolvedPath);
+      if (!(await file.exists())) {
+        errors.push(`File not found: ${filePath}`);
+        continue;
+      }
+      const buffer = Buffer.from(await file.arrayBuffer());
+      validPathImages.push({
+        mimeType: file.type,
+        dataBase64: buffer.toString("base64"),
+      });
+    }
+    if (validPathImages.length === 0) {
       return {
-        content:
-          "None of the specified attachments could be found or are accessible.",
+        content: `None of the specified file paths could be read.\n${errors.join("\n")}`,
         isError: true,
       };
     }
-
-    sourceImages = visibleAttachments
-      .map((att) => {
-        let buffer: Buffer | null | undefined;
-        try {
-          buffer = getAttachmentContent(att.id);
-        } catch {
-          // File-backed attachment may point to a missing or unreadable file
-          return undefined;
-        }
-        if (!buffer) return undefined;
-        return {
-          mimeType: att.mimeType,
-          dataBase64: buffer.toString("base64"),
-        };
-      })
-      .filter((img): img is NonNullable<typeof img> => img !== undefined);
+    sourceImages = validPathImages;
   }
 
   try {

package/src/config/bundled-skills/media-processing/tools/extract-keyframes.ts

@@ -4,7 +4,7 @@ import {
   getKeyframesForAsset,
   getMediaAssetById,
 } from "../../../../memory/media-store.js";
-import { getSecureKeyAsync } from "../../../../security/secure-keys.js";
+import { getProviderKeyAsync } from "../../../../security/secure-keys.js";
 import type {
   ToolContext,
   ToolExecutionResult,
@@ -31,7 +31,7 @@ export async function run(
 
   let openaiApiKey: string | undefined;
   if (includeAudio && (!transcriptionMode || transcriptionMode === "api")) {
-    openaiApiKey = (await getSecureKeyAsync("openai")) ?? undefined;
+    openaiApiKey = await getProviderKeyAsync("openai");
   }
 
   const options: PreprocessOptions = {

package/src/config/bundled-skills/messaging/tools/shared.ts

@@ -137,5 +137,5 @@ export async function getProviderConnection(
   account?: string,
 ): Promise<OAuthConnection | string> {
   if (await provider.isConnected?.()) return "";
-  return resolveOAuthConnection(provider.credentialService, account);
+  return resolveOAuthConnection(provider.credentialService, { account });
 }

package/src/config/bundled-skills/settings/tools/voice-config-update.ts

@@ -4,6 +4,7 @@ import {
   saveRawConfig,
   setNestedValue,
 } from "../../../../config/loader.js";
+import { VALID_CONVERSATION_TIMEOUTS } from "../../../../config/schemas/elevenlabs.js";
 import { normalizeActivationKey } from "../../../../daemon/handlers/config-voice.js";
 import type {
   ToolContext,
@@ -29,7 +30,7 @@ type VoiceSettingName = keyof typeof VOICE_SETTINGS;
 
 const VALID_SETTINGS = Object.keys(VOICE_SETTINGS) as VoiceSettingName[];
 
-const VALID_TIMEOUTS = [5, 10, 15, 30, 60];
+const VALID_TIMEOUTS: readonly number[] = VALID_CONVERSATION_TIMEOUTS;
 
 const FRIENDLY_NAMES: Record<VoiceSettingName, string> = {
   activation_key: "PTT activation key",
@@ -132,12 +133,14 @@ export async function run(
   const meta = VOICE_SETTINGS[setting as VoiceSettingName];
   const friendlyName = FRIENDLY_NAMES[setting as VoiceSettingName];
 
-  // Send client_settings_update message to write to UserDefaults
+  // Send client_settings_update message to write to UserDefaults.
+  // Always stringify the value — Swift's ClientSettingsUpdate.value is typed
+  // as String, so a bare JSON number would fail to decode.
   if (context.sendToClient) {
     context.sendToClient({
       type: "client_settings_update",
       key: meta.userDefaultsKey,
-      value: validation.coerced,
+      value: String(validation.coerced),
     });
   }
 
@@ -150,6 +153,19 @@ export async function run(
     invalidateConfigCache();
   }
 
+  // For conversation_timeout, persist to the config file
+  // (elevenlabs.conversationTimeoutSeconds).
+  if (setting === "conversation_timeout") {
+    const raw = loadRawConfig();
+    setNestedValue(
+      raw,
+      "elevenlabs.conversationTimeoutSeconds",
+      validation.coerced,
+    );
+    saveRawConfig(raw);
+    invalidateConfigCache();
+  }
+
   return {
     content: `${friendlyName} updated to ${JSON.stringify(
       validation.coerced,

package/src/config/bundled-skills/skill-management/SKILL.md

@@ -7,7 +7,7 @@ metadata:
     display-name: "Skill Management"
 ---
 
-Manage the lifecycle of custom managed skills in `~/.vellum/workspace/skills`.
+Manage the lifecycle of custom managed skills in `{workspaceDir}/skills`.
 
 ## Capabilities
 

package/src/config/bundled-skills/skill-management/TOOLS.json

@@ -3,7 +3,7 @@
   "tools": [
     {
       "name": "scaffold_managed_skill",
-      "description": "Create or update a managed skill in ~/.vellum/workspace/skills. The skill becomes available for skill_load immediately. Never persist a skill without explicit user consent. Before persisting, test the snippet: write to a temp file with bash and run with `bun run /tmp/vellum-eval/snippet.ts`. Iterate up to 3 attempts, then ask the user. Clean up temp files after. Do not use file_write for temp files outside the working directory. After a skill is written, the next turn may run in a recreated session due to file-watcher eviction - continue normally.",
+      "description": "Create or update a managed skill in {workspaceDir}/skills. The skill becomes available for skill_load immediately. Never persist a skill without explicit user consent. Before persisting, test the snippet: write to a temp file with bash and run with `bun run /tmp/vellum-eval/snippet.ts`. Iterate up to 3 attempts, then ask the user. Clean up temp files after. Do not use file_write for temp files outside the working directory. After a skill is written, the next turn may run in a recreated conversation due to file-watcher eviction - continue normally.",
       "category": "skills",
       "risk": "high",
       "input_schema": {
@@ -54,7 +54,7 @@
     },
     {
       "name": "delete_managed_skill",
-      "description": "Delete a managed skill from ~/.vellum/workspace/skills and remove it from the SKILLS.md index. Never delete a skill without explicit user confirmation. After deletion, the next turn may run in a recreated session due to file-watcher eviction - continue normally.",
+      "description": "Delete a managed skill from {workspaceDir}/skills and remove it from the SKILLS.md index. Never delete a skill without explicit user confirmation. After deletion, the next turn may run in a recreated conversation due to file-watcher eviction - continue normally.",
       "category": "skills",
       "risk": "high",
       "input_schema": {

package/src/config/bundled-skills/slack/tools/shared.ts

@@ -2,8 +2,8 @@
  * Shared utilities for slack skill tools.
  */
 
-import type { OAuthConnection } from "../../../../oauth/connection.js";
-import { resolveOAuthConnection } from "../../../../oauth/connection-resolver.js";
+import { credentialKey } from "../../../../security/credential-key.js";
+import { getSecureKeyAsync } from "../../../../security/secure-keys.js";
 import type { ToolExecutionResult } from "../../../../tools/types.js";
 
 export function ok(content: string): ToolExecutionResult {
@@ -14,6 +14,21 @@ export function err(message: string): ToolExecutionResult {
   return { content: message, isError: true };
 }
 
-export async function getSlackConnection(): Promise<OAuthConnection> {
-  return resolveOAuthConnection("integration:slack");
+/**
+ * Resolve the Slack bot token from credential storage.
+ *
+ * Slack uses direct bot/app tokens (Socket Mode), not OAuth connections.
+ * The client functions accept `OAuthConnection | string`, so we return the
+ * raw token string.
+ */
+export async function getSlackConnection(): Promise<string> {
+  const token = await getSecureKeyAsync(
+    credentialKey("slack_channel", "bot_token"),
+  );
+  if (!token) {
+    throw new Error(
+      "No Slack bot token found. Configure Slack with: assistant credentials set --service slack_channel --field bot_token",
+    );
+  }
+  return token;
 }

package/src/config/bundled-skills/slack/tools/slack-scan-digest.ts

@@ -1,7 +1,6 @@
 import { getConfig } from "../../../../config/loader.js";
 import * as slack from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
-import type { OAuthConnection } from "../../../../oauth/connection.js";
 import type {
   ToolContext,
   ToolExecutionResult,
@@ -28,7 +27,7 @@ interface ChannelDigest {
 const userNameCache = new Map<string, string>();
 
 async function resolveUserName(
-  connection: OAuthConnection,
+  connection: string,
   userId: string,
 ): Promise<string> {
   if (!userId) return "unknown";
@@ -50,7 +49,7 @@ async function resolveUserName(
 }
 
 async function scanChannel(
-  connection: OAuthConnection,
+  connection: string,
   conv: SlackConversation,
   oldestTs: string,
   includeThreads: boolean,

package/src/config/bundled-skills/transcribe/SKILL.md

@@ -22,7 +22,7 @@ If the user says "local", "offline", "private", or "on-device" → use `local`.
 
 ## Usage Notes
 
-- The tool accepts either a `file_path` (absolute path to a local file) or an `attachment_id` (for uploaded attachments). Prefer `file_path` when the user references a file on disk.
+- The tool accepts a `file_path` (absolute path to a local audio or video file) to transcribe.
 - Supported formats: any video (mp4, mov, etc.) or audio (mp3, wav, m4a, etc.) file.
 - For video files, audio is automatically extracted via ffmpeg before transcription.
 - The API mode has a 25MB per-request limit - large files are automatically split into chunks.

package/src/config/bundled-skills/transcribe/TOOLS.json

@@ -3,7 +3,7 @@
   "tools": [
     {
       "name": "transcribe_media",
-      "description": "Transcribe an audio or video file using Whisper. Provide either a file_path to a local file or an attachment_id for an uploaded attachment. Set mode to 'api' (OpenAI cloud) or 'local' (whisper.cpp on-device). Ask the user which mode they prefer before calling.",
+      "description": "Transcribe an audio or video file using Whisper. Provide a file_path to the media file. Set mode to 'api' (OpenAI cloud) or 'local' (whisper.cpp on-device). Ask the user which mode they prefer before calling.",
       "category": "transcribe",
       "risk": "low",
       "input_schema": {
@@ -13,10 +13,6 @@
             "type": "string",
             "description": "Absolute path to a local audio or video file to transcribe"
           },
-          "attachment_id": {
-            "type": "string",
-            "description": "The ID of an attached audio or video file to transcribe"
-          },
           "mode": {
             "type": "string",
             "enum": ["api", "local"],
@@ -27,7 +23,7 @@
             "description": "Brief non-technical explanation of why this tool is being called"
           }
         },
-        "required": ["mode"]
+        "required": ["mode", "file_path"]
       },
       "executor": "tools/transcribe-media.ts",
       "execution_target": "host"

package/src/config/bundled-skills/transcribe/tools/transcribe-media.ts

@@ -10,10 +10,6 @@ import {
 import { tmpdir } from "node:os";
 import { extname, join } from "node:path";
 
-import {
-  getAttachmentsByIds,
-  getFilePathForAttachment,
-} from "../../../../memory/attachments-store.js";
 import { getProviderKeyAsync } from "../../../../security/secure-keys.js";
 import type {
   ToolContext,
@@ -123,84 +119,31 @@ async function splitAudio(
 
 async function resolveSource(
   input: Record<string, unknown>,
-): Promise<
-  | { inputPath: string; isVideo: boolean; tempFile: string | null }
-  | ToolExecutionResult
-> {
+): Promise<{ inputPath: string; isVideo: boolean } | ToolExecutionResult> {
   const filePath = input.file_path as string | undefined;
-  const attachmentId = input.attachment_id as string | undefined;
 
-  if (filePath) {
-    try {
-      await access(filePath);
-    } catch {
-      return { content: `File not found: ${filePath}`, isError: true };
-    }
-    const ext = extname(filePath).toLowerCase();
-    const isVideo = VIDEO_EXTENSIONS.has(ext);
-    const isAudio = AUDIO_EXTENSIONS.has(ext);
-    if (!isVideo && !isAudio) {
-      return {
-        content: `Unsupported file type: ${ext}. Only video and audio files can be transcribed.`,
-        isError: true,
-      };
-    }
-    return { inputPath: filePath, isVideo, tempFile: null };
+  if (!filePath) {
+    return {
+      content: "Provide a file_path to the audio or video file to transcribe.",
+      isError: true,
+    };
   }
 
-  if (attachmentId) {
-    const attachments = getAttachmentsByIds([attachmentId]);
-    if (attachments.length === 0) {
-      return {
-        content: `Attachment not found: ${attachmentId}`,
-        isError: true,
-      };
-    }
-    const attachment = attachments[0];
-    const mime = attachment.mimeType;
-    if (!mime.startsWith("video/") && !mime.startsWith("audio/")) {
-      return {
-        content: `Unsupported file type: ${mime}. Only video and audio files can be transcribed.`,
-        isError: true,
-      };
-    }
-    // Check if this is a file-backed attachment (large files stored on disk)
-    const onDiskPath = getFilePathForAttachment(attachment.id);
-    if (onDiskPath) {
-      // File-backed attachment - use the on-disk file directly
-      try {
-        await access(onDiskPath);
-      } catch {
-        return {
-          content: `Attachment file not found on disk: ${onDiskPath}`,
-          isError: true,
-        };
-      }
-      return {
-        inputPath: onDiskPath,
-        isVideo: mime.startsWith("video/"),
-        tempFile: null,
-      };
-    }
-
-    // Inline attachment - decode base64 to a temp file
-    const ext = mime.startsWith("video/") ? ".mp4" : ".m4a";
-    const tempPath = join(
-      tmpdir(),
-      `vellum-transcribe-in-${randomUUID()}${ext}`,
-    );
-    await writeFile(tempPath, Buffer.from(attachment.dataBase64, "base64"));
+  try {
+    await access(filePath);
+  } catch {
+    return { content: `File not found: ${filePath}`, isError: true };
+  }
+  const ext = extname(filePath).toLowerCase();
+  const isVideo = VIDEO_EXTENSIONS.has(ext);
+  const isAudio = AUDIO_EXTENSIONS.has(ext);
+  if (!isVideo && !isAudio) {
     return {
-      inputPath: tempPath,
-      isVideo: mime.startsWith("video/"),
-      tempFile: tempPath,
+      content: `Unsupported file type: ${ext}. Only video and audio files can be transcribed.`,
+      isError: true,
     };
   }
-
-  return {
-    content: "Provide either file_path or attachment_id.",
-    isError: true,
-  };
+  return { inputPath: filePath, isVideo };
 }
 
 /** Convert source to 16kHz mono WAV for consistent processing. */
@@ -462,7 +405,7 @@ export async function run(
   const source = await resolveSource(input);
   if ("isError" in source) return source;
 
-  const { inputPath, isVideo, tempFile } = source;
+  const { inputPath, isVideo } = source;
   let wavPath: string | null = null;
 
   try {
@@ -487,13 +430,6 @@ export async function run(
       isError: true,
     };
   } finally {
-    if (tempFile) {
-      try {
-        await unlink(tempFile);
-      } catch {
-        /* ignore */
-      }
-    }
     if (wavPath) {
       try {
         await unlink(wavPath);

package/src/config/bundled-tool-registry.ts

@@ -20,14 +20,8 @@ import * as acpStatus from "./bundled-skills/acp/tools/acp-status.js";
 // ── app-builder ────────────────────────────────────────────────────────────────
 import * as appCreate from "./bundled-skills/app-builder/tools/app-create.js";
 import * as appDelete from "./bundled-skills/app-builder/tools/app-delete.js";
-import * as appFileEdit from "./bundled-skills/app-builder/tools/app-file-edit.js";
-import * as appFileList from "./bundled-skills/app-builder/tools/app-file-list.js";
-import * as appFileRead from "./bundled-skills/app-builder/tools/app-file-read.js";
-import * as appFileWrite from "./bundled-skills/app-builder/tools/app-file-write.js";
 import * as appGenerateIcon from "./bundled-skills/app-builder/tools/app-generate-icon.js";
-import * as appList from "./bundled-skills/app-builder/tools/app-list.js";
-import * as appQuery from "./bundled-skills/app-builder/tools/app-query.js";
-import * as appUpdate from "./bundled-skills/app-builder/tools/app-update.js";
+import * as appRefresh from "./bundled-skills/app-builder/tools/app-refresh.js";
 // ── browser ────────────────────────────────────────────────────────────────────
 import * as browserClick from "./bundled-skills/browser/tools/browser-click.js";
 import * as browserClose from "./bundled-skills/browser/tools/browser-close.js";
@@ -193,14 +187,8 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
 
   // app-builder
   ["app-builder:tools/app-create.ts", appCreate],
-  ["app-builder:tools/app-list.ts", appList],
-  ["app-builder:tools/app-query.ts", appQuery],
-  ["app-builder:tools/app-update.ts", appUpdate],
   ["app-builder:tools/app-delete.ts", appDelete],
-  ["app-builder:tools/app-file-list.ts", appFileList],
-  ["app-builder:tools/app-file-read.ts", appFileRead],
-  ["app-builder:tools/app-file-edit.ts", appFileEdit],
-  ["app-builder:tools/app-file-write.ts", appFileWrite],
+  ["app-builder:tools/app-refresh.ts", appRefresh],
   ["app-builder:tools/app-generate-icon.ts", appGenerateIcon],
 
   // browser

package/src/config/feature-flag-registry.json

@@ -25,6 +25,14 @@
       "description": "Show the Contacts tab in Settings for viewing and managing contacts",
       "defaultEnabled": true
     },
+    {
+      "id": "custom-inference-provider",
+      "scope": "macos",
+      "key": "custom_inference_provider_enabled",
+      "label": "Custom Inference Provider",
+      "description": "Allow selecting a specific LLM provider and model for inference in Your Own mode",
+      "defaultEnabled": false
+    },
     {
       "id": "email-channel",
       "scope": "assistant",
@@ -249,6 +257,14 @@
       "description": "Show the Google OAuth service card in Models & Services settings",
       "defaultEnabled": false
     },
+    {
+      "id": "settings-embedding-provider",
+      "scope": "assistant",
+      "key": "feature_flags.settings-embedding-provider.enabled",
+      "label": "Embedding Provider Settings",
+      "description": "Show the Embedding service card in Models & Services settings",
+      "defaultEnabled": false
+    },
     {
       "id": "quick-input",
       "scope": "macos",
@@ -264,6 +280,14 @@
       "label": "Expand Completed Steps",
       "description": "Auto-expand completed tool call step groups instead of showing them collapsed",
       "defaultEnabled": false
+    },
+    {
+      "id": "inline-skill-commands",
+      "scope": "assistant",
+      "key": "feature_flags.inline-skill-commands.enabled",
+      "label": "Inline Skill Command Expansion",
+      "description": "Enable secure inline skill command expansion via !`command` syntax, with version-pinned approval and sandboxed execution at skill load time",
+      "defaultEnabled": true
     }
   ]
 }

package/src/config/loader.ts

@@ -29,6 +29,7 @@ export const API_KEY_PROVIDERS = [
   "fireworks",
   "openrouter",
   "brave",
+  "elevenlabs",
   "perplexity",
 ] as const;
 
@@ -118,6 +119,66 @@ function deleteNestedKey(
   }
 }
 
+/**
+ * Deprecated config fields that have been removed. Each entry maps a
+ * dot-separated path to the deprecation message shown to the user.
+ */
+const DEPRECATED_FIELDS: Record<string, string> = {
+  "rateLimit.maxTokensPerSession":
+    "rateLimit.maxTokensPerSession has been removed and is no longer enforced. " +
+    "Per-session token budget tracking is no longer supported. " +
+    "The field will be removed from your config file.",
+};
+
+/**
+ * Check for deprecated config fields, log a warning for each one found,
+ * and strip them from both the in-memory object and the on-disk config file
+ * so the warning is only emitted once.
+ */
+function warnAndStripDeprecatedFields(
+  fileConfig: Record<string, unknown>,
+  configPath: string,
+): void {
+  const found: string[] = [];
+  for (const dotPath of Object.keys(DEPRECATED_FIELDS)) {
+    if (getNestedValue(fileConfig, dotPath) !== undefined) {
+      log.warn(DEPRECATED_FIELDS[dotPath]);
+      found.push(dotPath);
+    }
+  }
+
+  if (found.length === 0) return;
+
+  // Strip from the in-memory object so Zod never sees them
+  for (const dotPath of found) {
+    deleteNestedKeyByDotPath(fileConfig, dotPath);
+  }
+
+  // Persist the cleaned config to disk so the warning doesn't repeat
+  try {
+    if (existsSync(configPath)) {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (raw != null && typeof raw === "object" && !Array.isArray(raw)) {
+        for (const dotPath of found) {
+          deleteNestedKeyByDotPath(raw as Record<string, unknown>, dotPath);
+        }
+        writeFileSync(configPath, JSON.stringify(raw, null, 2) + "\n");
+      }
+    }
+  } catch {
+    // Best-effort — if the file can't be rewritten, the warning will repeat
+    // on next load, which is acceptable.
+  }
+}
+
+function deleteNestedKeyByDotPath(
+  obj: Record<string, unknown>,
+  dotPath: string,
+): void {
+  const keys = dotPath.split(".");
+  deleteNestedKey(obj, keys);
+}
+
 /**
  * Deep-merge missing keys from `defaults` into `target`.
  * Only adds keys that do not already exist in `target`; never overwrites.
@@ -224,6 +285,10 @@ export function loadConfig(): AssistantConfig {
       configFileExisted = false;
     }
 
+    // Warn about and strip deprecated config fields so users know their
+    // settings are no longer honored rather than silently dropping them.
+    warnAndStripDeprecatedFields(fileConfig, configPath);
+
     // Validate and apply defaults via Zod schema
     const config = validateWithSchema(fileConfig);