@vellumai/assistant 0.6.3 → 0.6.5

package/src/config/loader.ts

@@ -6,28 +6,21 @@ import {
   statSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
-import { ConfigError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import { ensureDataDir, getWorkspaceConfigPath } from "../util/platform.js";
+import {
+  ensureDataDir,
+  getWorkspaceConfigPath,
+  getWorkspaceDir,
+} from "../util/platform.js";
 import { isAssistantFeatureFlagEnabled } from "./assistant-feature-flags.js";
 import { AssistantConfigSchema } from "./schema.js";
 import type { AssistantConfig } from "./types.js";
 
-const log = getLogger("config");
+export { API_KEY_PROVIDERS } from "../providers/provider-secret-catalog.js";
 
-// Providers that store API keys in secure storage (superset of VALID_PROVIDERS)
-export const API_KEY_PROVIDERS = [
-  "anthropic",
-  "openai",
-  "gemini",
-  "ollama",
-  "fireworks",
-  "openrouter",
-  "brave",
-  "perplexity",
-] as const;
+const log = getLogger("config");
 
 let cached: AssistantConfig | null = null;
 let loading = false;
@@ -57,6 +50,116 @@ function cloneDefaultConfig(): AssistantConfig {
   return applyNestedDefaults({});
 }
 
+/**
+ * Build a filesystem-safe ISO-8601 timestamp for use in quarantine filenames.
+ * Replaces `:` (invalid on Windows, confusing on macOS Finder) with `-` so the
+ * resulting string is safe on every supported platform.
+ */
+function filesystemSafeTimestamp(date: Date = new Date()): string {
+  return date.toISOString().replace(/:/g, "-");
+}
+
+/**
+ * Rename a corrupt config file to a quarantine path so the bad content is
+ * preserved for debug while the daemon falls through to defaults. Logs at
+ * `error` level with a remediation hint. Best-effort: if the rename itself
+ * fails (missing permissions, readonly FS, etc.) we still fall through to
+ * defaults — startup must never block.
+ *
+ * The quarantine filename encodes a millisecond-precision timestamp and ends
+ * in `.json` so editors syntax-highlight the preserved content:
+ *   `<path>.corrupt-<ISO-timestamp>.json`
+ *
+ * On a successful rename, also appends a bulletin to `<workspace>/UPDATES.md`
+ * so the background update-bulletin job surfaces the event to the user
+ * proactively on their next interaction (log-level errors alone are invisible
+ * to users).
+ */
+function quarantineCorruptConfig(configPath: string, err: unknown): string {
+  const quarantinePath = `${configPath}.corrupt-${filesystemSafeTimestamp()}.json`;
+  try {
+    renameSync(configPath, quarantinePath);
+    log.error(
+      `config file at ${configPath} was corrupt (${String(err)}); ` +
+        `quarantined to ${quarantinePath} and loaded defaults. ` +
+        `Inspect the quarantined file to recover any hand-edited settings.`,
+    );
+    appendQuarantineBulletin(configPath, quarantinePath);
+  } catch (renameErr) {
+    log.error(
+      { renameErr },
+      `config file at ${configPath} was corrupt (${String(err)}) but could ` +
+        `not be renamed for quarantine; loaded defaults.`,
+    );
+  }
+  return quarantinePath;
+}
+
+/**
+ * Append a config-quarantine bulletin to `<workspace>/UPDATES.md`. On the
+ * next daemon boot the background update-bulletin job picks up UPDATES.md
+ * and processes it inside a background-only conversation (not the user's
+ * chat). The agent decides whether and when to surface the event — typical
+ * cases are the user asking why their settings changed or noticing missing
+ * API keys. The bulletin is agent-visible context, not a push notification.
+ *
+ * Idempotency: the appended block embeds a marker keyed on the quarantine
+ * filename's basename. If that marker is already present in UPDATES.md (a
+ * prior append succeeded but the process crashed before control returned, or
+ * the file was hand-edited), the function is a no-op. This mirrors the
+ * pattern release-notes workspace migrations use — see the "Release Update
+ * Hygiene" section in the root `AGENTS.md`.
+ *
+ * Best-effort: any write failure is logged at `warn` and swallowed. The
+ * quarantine path must never block startup, and the error log from
+ * `quarantineCorruptConfig` remains the authoritative record.
+ *
+ * Exported with an underscore-prefixed alias (`_appendQuarantineBulletin`) so
+ * tests can exercise the idempotent-skip branch directly with a deterministic
+ * quarantine basename. Non-test callers should never import the underscore
+ * alias — the wiring into `quarantineCorruptConfig` is the production entry
+ * point.
+ */
+function appendQuarantineBulletin(
+  originalPath: string,
+  quarantinePath: string,
+): void {
+  try {
+    const updatesPath = join(getWorkspaceDir(), "UPDATES.md");
+    const quarantineBasename = basename(quarantinePath);
+    const marker = `<!-- config-quarantine:${quarantineBasename} -->`;
+
+    const existing = existsSync(updatesPath)
+      ? readFileSync(updatesPath, "utf-8")
+      : "";
+    if (existing.includes(marker)) return;
+
+    const timestamp = new Date().toISOString();
+    const block =
+      `## Config was reset to defaults\n\n` +
+      `Your \`config.json\` was unreadable at ${timestamp} and couldn't be parsed ` +
+      `as JSON. The assistant preserved the original file at \`${quarantinePath}\` ` +
+      `and loaded defaults so the app stays working.\n\n` +
+      `If you had custom settings (API keys, model choices, voice preferences), ` +
+      `they are still in the quarantined file — \`cat ${quarantinePath}\` to ` +
+      `recover them, then re-enter through Settings or the CLI.\n\n` +
+      `${marker}\n`;
+
+    const toWrite = existing.length === 0 ? block : `${existing}\n${block}`;
+    writeFileSync(updatesPath, toWrite, "utf-8");
+    log.info(
+      `Appended config-quarantine bulletin to ${updatesPath} for ${originalPath} ` +
+        `(quarantined as ${quarantineBasename}).`,
+    );
+  } catch (bulletinErr) {
+    log.warn(
+      { bulletinErr },
+      `Failed to append config-quarantine bulletin to UPDATES.md; ` +
+        `the quarantine event is still recorded in the assistant logs.`,
+    );
+  }
+}
+
 /**
  * Validate a raw config object with Zod. Invalid fields are logged as warnings
  * and replaced with defaults (matching prior behavior of per-field fallback).
@@ -216,10 +319,53 @@ export function deepMergeMissing(
   return changed;
 }
 
+/**
+ * Recursively strip `null` leaves from a plain-object value, returning a
+ * deep clone with all `null`-valued keys removed at every nesting level.
+ * Non-object inputs (scalars, arrays, `null` itself) are returned as-is.
+ *
+ * Used to sanitize `overrides` before assigning whole subtrees in
+ * `deepMergeOverwrite`, so deletion-sentinel semantics apply uniformly
+ * even when the corresponding `target` key does not yet exist.
+ */
+function stripNullLeaves(value: unknown): unknown {
+  if (value == null || typeof value !== "object" || Array.isArray(value)) {
+    return value;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    if (v === null) continue;
+    out[k] = stripNullLeaves(v);
+  }
+  return out;
+}
+
 /**
  * Deep-merge `overrides` into `target`, overwriting leaf values.
  * Recursively merges nested objects; scalars and arrays from `overrides`
  * replace corresponding values in `target`.
+ *
+ * JSON `null` semantics depend on what the target currently holds at
+ * that key:
+ *
+ * - **Target holds a non-null object** (not array): `null` deletes the
+ *   key, removing the entire subtree. This supports "clear entry"
+ *   semantics (e.g. the macOS SettingsStore clearing a call-site
+ *   override via `{ callSites: { memoryRetrieval: null } }`).
+ *
+ * - **Target holds a scalar, null, or array**: `null` is assigned as the
+ *   value, preserving nullable config fields like `activeHoursStart`
+ *   and `llmRequestLogRetentionMs` where `null` is a valid schema
+ *   value meaning "disabled / no limit".
+ *
+ * - **Key absent from target**: no-op. Assigning null to a missing key
+ *   would create a spurious entry; callers that want to establish a
+ *   null value should set the key to its default first.
+ *
+ * When an override assigns a whole object subtree to a key that does
+ * not yet exist on `target` (or whose existing value is a scalar/array),
+ * `stripNullLeaves` drops any `null` leaves inside that subtree before
+ * assignment so no invalid nulls get persisted for non-nullable fields.
  */
 export function deepMergeOverwrite(
   target: Record<string, unknown>,
@@ -227,8 +373,20 @@ export function deepMergeOverwrite(
 ): void {
   for (const key of Object.keys(overrides)) {
     const ov = overrides[key];
-    if (
-      ov != null &&
+    if (ov === null) {
+      if (!(key in target)) continue;
+      const existing = target[key];
+      if (
+        existing != null &&
+        typeof existing === "object" &&
+        !Array.isArray(existing)
+      ) {
+        delete target[key];
+      } else {
+        target[key] = null;
+      }
+    } else if (
+      ov !== undefined &&
       typeof ov === "object" &&
       !Array.isArray(ov) &&
       target[key] != null &&
@@ -240,7 +398,7 @@ export function deepMergeOverwrite(
         ov as Record<string, unknown>,
       );
     } else {
-      target[key] = ov;
+      target[key] = stripNullLeaves(ov);
     }
   }
 }
@@ -373,9 +531,14 @@ export function loadConfig(): AssistantConfig {
       try {
         fileConfig = JSON.parse(readFileSync(configPath, "utf-8"));
       } catch (err) {
-        throw new ConfigError(
-          `Failed to parse config at ${configPath}: ${err}`,
-        );
+        // The daemon must never block startup (assistant/CLAUDE.md). A config
+        // file that fails JSON.parse — truncated during a mid-write crash, or
+        // hand-edited to invalid JSON — is quarantined so the content is
+        // preserved for debug, and startup proceeds with the same default-
+        // config path used when config.json does not exist.
+        quarantineCorruptConfig(configPath, err);
+        fileConfig = {};
+        configFileExisted = false;
       }
     } else {
       configFileExisted = false;
@@ -489,6 +652,30 @@ export function getConfig(): AssistantConfig {
   return loadConfig();
 }
 
+/**
+ * Read-only config accessor: returns the current config without creating
+ * directories or writing files. Reads config.json if it exists on disk;
+ * returns schema defaults otherwise. Unlike `getConfig()` / `loadConfig()`,
+ * this never calls `ensureDataDir()` or writes a default config to disk,
+ * making it safe to call during CLI program construction before the
+ * workspace-existence check runs.
+ */
+export function getConfigReadOnly(): AssistantConfig {
+  if (cached) return cached;
+
+  const configPath = getConfigPath();
+  let fileConfig: Record<string, unknown> = {};
+  if (existsSync(configPath)) {
+    try {
+      fileConfig = JSON.parse(readFileSync(configPath, "utf-8"));
+    } catch {
+      return cloneDefaultConfig();
+    }
+  }
+
+  return validateWithSchema(fileConfig);
+}
+
 export function invalidateConfigCache(): void {
   cached = null;
   loading = false;
@@ -507,7 +694,11 @@ export function loadRawConfig(): Record<string, unknown> {
     try {
       raw = JSON.parse(readFileSync(configPath, "utf-8"));
     } catch (err) {
-      throw new ConfigError(`Failed to parse config at ${configPath}: ${err}`);
+      // Mirror loadConfig(): quarantine the corrupt file and return an empty
+      // object rather than throwing. This prevents /v1/config from surfacing
+      // a 500 when the user's config.json is malformed.
+      quarantineCorruptConfig(configPath, err);
+      raw = {};
     }
   }
 
@@ -557,3 +748,10 @@ export function setNestedValue(
   }
   current[keys[keys.length - 1]] = value;
 }
+
+/**
+ * Test-only alias for `appendQuarantineBulletin`. Exists so the crash-mid-
+ * append idempotency branch can be exercised with a deterministic quarantine
+ * basename without widening the runtime surface. Not for production use.
+ */
+export const _appendQuarantineBulletin = appendQuarantineBulletin;

package/src/config/raw-config-utils.ts

@@ -1,11 +1,39 @@
+/**
+ * Safely set a nested field on a raw config object's `llm.default` map.
+ *
+ * Ensures the `llm` and `llm.default` objects exist before writing, so
+ * callers don't need to guard against undefined intermediate keys.
+ *
+ * Example: `setLlmDefaultField(raw, "model", "claude-sonnet-4-6")`
+ * produces `raw.llm.default.model = "claude-sonnet-4-6"`.
+ */
+export function setLlmDefaultField(
+  raw: Record<string, unknown>,
+  field: string,
+  value: unknown,
+): void {
+  const llm: Record<string, unknown> =
+    raw.llm != null && typeof raw.llm === "object" && !Array.isArray(raw.llm)
+      ? (raw.llm as Record<string, unknown>)
+      : {};
+  const existing = llm.default;
+  const defaultBlock: Record<string, unknown> =
+    existing != null && typeof existing === "object" && !Array.isArray(existing)
+      ? (existing as Record<string, unknown>)
+      : {};
+  defaultBlock[field] = value;
+  llm.default = defaultBlock;
+  raw.llm = llm;
+}
+
 /**
  * Safely set a nested field on a raw config object's `services` map.
  *
  * Ensures the `services` and service-level objects exist before writing,
  * so callers don't need to guard against undefined intermediate keys.
  *
- * Example: `setServiceField(raw, "inference", "model", "claude-sonnet-4-6")`
- * produces `raw.services.inference.model = "claude-sonnet-4-6"`.
+ * Example: `setServiceField(raw, "inference", "mode", "managed")`
+ * produces `raw.services.inference.mode = "managed"`.
  */
 export function setServiceField(
   raw: Record<string, unknown>,

package/src/config/sanitize-for-transfer.ts

@@ -7,6 +7,18 @@
  * - `ingress.enabled` → deleted
  * - `daemon` → deleted entirely
  * - `skills.load.extraDirs` → set to `[]`
+ * - `hostBrowser.cdpInspect.desktopAuto` → deleted **only when the source
+ *   either relies on the schema default or explicitly sets
+ *   `enabled: true`**. An explicit `enabled: false` is preserved so a
+ *   platform→local teleport doesn't silently re-enable auto-attach
+ *   against the user's opt-out.
+ *
+ * `logFile.dir` is intentionally *not* stripped: the logger's container
+ * fallback (`util/logger.ts#resolveLogDir`) already redirects to the
+ * default log dir with a warning when the configured path can't be
+ * created, and stripping `dir` would disable rotating file logging
+ * entirely because `lifecycle.ts` gates `initLogger` on a truthy
+ * `config.logFile.dir`.
  */
 export function sanitizeConfigForTransfer(configJson: string): string {
   let config: Record<string, unknown>;
@@ -43,5 +55,28 @@ export function sanitizeConfigForTransfer(configJson: string): string {
     }
   }
 
+  // Strip hostBrowser.cdpInspect.desktopAuto — the auto-attach-to-Chrome
+  // behavior is gated on a macOS-originated turn; preserving a
+  // source-host-derived `enabled: true` inside a Linux managed pod's
+  // config is misleading and brittle. Preserve an explicit
+  // `enabled: false` opt-out, though — the schema default is `true`,
+  // so unconditionally stripping this subobject would re-enable
+  // auto-attach after a platform→local teleport.
+  if (config.hostBrowser && typeof config.hostBrowser === "object") {
+    const hostBrowser = config.hostBrowser as Record<string, unknown>;
+    if (hostBrowser.cdpInspect && typeof hostBrowser.cdpInspect === "object") {
+      const cdpInspect = hostBrowser.cdpInspect as Record<string, unknown>;
+      const desktopAuto = cdpInspect.desktopAuto;
+      const isExplicitOptOut =
+        desktopAuto !== null &&
+        typeof desktopAuto === "object" &&
+        !Array.isArray(desktopAuto) &&
+        (desktopAuto as Record<string, unknown>).enabled === false;
+      if (!isExplicitOptOut) {
+        delete cdpInspect.desktopAuto;
+      }
+    }
+  }
+
   return JSON.stringify(config, null, 2) + "\n";
 }

package/src/config/schema.ts

@@ -10,6 +10,10 @@ export {
 } from "../permissions/permission-mode.js";
 export type { AcpAgentConfig, AcpConfig } from "./acp-schema.js";
 export { AcpAgentConfigSchema, AcpConfigSchema } from "./acp-schema.js";
+export type { AnalysisConfig } from "./schemas/analysis.js";
+export { AnalysisConfigSchema } from "./schemas/analysis.js";
+export type { BackupConfig, BackupDestination } from "./schemas/backup.js";
+export { BackupConfigSchema } from "./schemas/backup.js";
 export type {
   CallerIdentityConfig,
   CallsConfig,
@@ -39,38 +43,32 @@ export {
   TwilioConfigSchema,
   WhatsAppConfigSchema,
 } from "./schemas/channels.js";
-export type { ElevenLabsConfig } from "./schemas/elevenlabs.js";
 export {
   DEFAULT_ELEVENLABS_VOICE_ID,
-  ElevenLabsConfigSchema,
   VALID_CONVERSATION_TIMEOUTS,
 } from "./schemas/elevenlabs.js";
-export type { FishAudioConfig } from "./schemas/fish-audio.js";
-export { FishAudioConfigSchema } from "./schemas/fish-audio.js";
 export type { HeartbeatConfig } from "./schemas/heartbeat.js";
 export { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 export type {
+  DesktopAutoCdpInspectConfig,
   HostBrowserCdpInspectConfig,
   HostBrowserConfig,
 } from "./schemas/host-browser.js";
 export {
+  DesktopAutoCdpInspectConfigSchema,
   HostBrowserCdpInspectConfigSchema,
   HostBrowserConfigSchema,
 } from "./schemas/host-browser.js";
 export type {
   ContextOverflowRecoveryConfig,
   ContextWindowConfig,
-  Effort,
   ModelPricingOverride,
-  Speed,
   ThinkingConfig,
 } from "./schemas/inference.js";
 export {
   ContextOverflowRecoveryConfigSchema,
   ContextWindowConfigSchema,
-  EffortSchema,
   ModelPricingOverrideSchema,
-  SpeedSchema,
   ThinkingConfigSchema,
 } from "./schemas/inference.js";
 export type {
@@ -85,6 +83,14 @@ export {
 } from "./schemas/ingress.js";
 export type { JournalConfig } from "./schemas/journal.js";
 export { JournalConfigSchema } from "./schemas/journal.js";
+export type {
+  LLMCallSite,
+  LLMCallSiteConfig,
+  LLMConfig,
+  LLMConfigBase,
+  LLMConfigFragment,
+} from "./schemas/llm.js";
+export { LLMCallSiteEnum, LLMSchema } from "./schemas/llm.js";
 export type { AuditLogConfig, LogFileConfig } from "./schemas/logging.js";
 export {
   AuditLogConfigSchema,
@@ -192,16 +198,41 @@ export {
   SkillsInstallConfigSchema,
   SkillsLoadConfigSchema,
 } from "./schemas/skills.js";
+export type { SttProviders, SttService } from "./schemas/stt.js";
+export {
+  SttProvidersSchema,
+  SttServiceSchema,
+  VALID_STT_PROVIDERS,
+} from "./schemas/stt.js";
 export type { RateLimitConfig, TimeoutConfig } from "./schemas/timeouts.js";
 export {
   RateLimitConfigSchema,
   TimeoutConfigSchema,
 } from "./schemas/timeouts.js";
+export type {
+  TtsDeepgramProviderConfig,
+  TtsElevenLabsProviderConfig,
+  TtsFishAudioProviderConfig,
+  TtsProviders,
+  TtsService,
+} from "./schemas/tts.js";
+export {
+  TtsDeepgramProviderConfigSchema,
+  TtsElevenLabsProviderConfigSchema,
+  TtsFishAudioProviderConfigSchema,
+  TtsProvidersSchema,
+  TtsServiceSchema,
+  VALID_TTS_PROVIDERS as VALID_TTS_SERVICE_PROVIDERS,
+} from "./schemas/tts.js";
+export type { UpdatesConfig } from "./schemas/updates.js";
+export { UpdatesConfigSchema } from "./schemas/updates.js";
 export type { WorkspaceGitConfig } from "./schemas/workspace-git.js";
 export { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 
 // Imports for AssistantConfigSchema composition
 import { AcpConfigSchema } from "./acp-schema.js";
+import { AnalysisConfigSchema } from "./schemas/analysis.js";
+import { BackupConfigSchema } from "./schemas/backup.js";
 import { CallsConfigSchema } from "./schemas/calls.js";
 import {
   SlackConfigSchema,
@@ -209,20 +240,12 @@ import {
   TwilioConfigSchema,
   WhatsAppConfigSchema,
 } from "./schemas/channels.js";
-import { ElevenLabsConfigSchema } from "./schemas/elevenlabs.js";
 import { FilingConfigSchema } from "./schemas/filing.js";
-import { FishAudioConfigSchema } from "./schemas/fish-audio.js";
 import { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 import { HostBrowserConfigSchema } from "./schemas/host-browser.js";
-import {
-  ContextWindowConfigSchema,
-  EffortSchema,
-  ModelPricingOverrideSchema,
-  SpeedSchema,
-  ThinkingConfigSchema,
-} from "./schemas/inference.js";
 import { IngressConfigSchema } from "./schemas/ingress.js";
 import { JournalConfigSchema } from "./schemas/journal.js";
+import { LLMSchema } from "./schemas/llm.js";
 import {
   AuditLogConfigSchema,
   LogFileConfigSchema,
@@ -245,23 +268,12 @@ import {
   RateLimitConfigSchema,
   TimeoutConfigSchema,
 } from "./schemas/timeouts.js";
+import { UpdatesConfigSchema } from "./schemas/updates.js";
 import { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 
 export const AssistantConfigSchema = z
   .object({
     services: ServicesSchema.default(ServicesSchema.parse({})),
-    maxTokens: z
-      .number({ error: "maxTokens must be a number" })
-      .int("maxTokens must be an integer")
-      .positive("maxTokens must be a positive integer")
-      .default(64000)
-      .describe("Maximum number of output tokens per LLM response"),
-    effort: EffortSchema,
-    speed: SpeedSchema,
-    thinking: ThinkingConfigSchema.default(ThinkingConfigSchema.parse({})),
-    contextWindow: ContextWindowConfigSchema.default(
-      ContextWindowConfigSchema.parse({}),
-    ),
     memory: MemoryConfigSchema.default(MemoryConfigSchema.parse({})),
     dataDir: z
       .string({ error: "dataDir must be a string" })
@@ -279,18 +291,25 @@ export const AssistantConfigSchema = z
     logFile: LogFileConfigSchema.default(
       LogFileConfigSchema.parse({ dir: getDataDir() + "/logs" }),
     ),
-    pricingOverrides: z
-      .array(ModelPricingOverrideSchema)
-      .default([])
-      .describe(
-        "Custom pricing overrides for specific provider/model combinations",
-      ),
+    // Unified LLM configuration block. The unique source of truth for
+    // provider/model/maxTokens/effort/speed/temperature/thinking/contextWindow
+    // and pricing overrides for every call site in the assistant.
+    //
+    // Default values live on each leaf inside `LLMSchema` (see
+    // `schemas/llm.ts`), so `LLMSchema.parse({})` returns a fully-populated
+    // object. This matches the pattern used by sibling schemas above and
+    // ensures the loader's leaf-deletion recovery path can repair a partially
+    // invalid `llm` block without falling back to `cloneDefaultConfig()`.
+    llm: LLMSchema.default(LLMSchema.parse({})),
     filing: FilingConfigSchema.default(FilingConfigSchema.parse({})),
     heartbeat: HeartbeatConfigSchema.default(HeartbeatConfigSchema.parse({})),
+    updates: UpdatesConfigSchema.default(UpdatesConfigSchema.parse({})),
     hostBrowser: HostBrowserConfigSchema.default(
       HostBrowserConfigSchema.parse({}),
     ),
     journal: JournalConfigSchema.default(JournalConfigSchema.parse({})),
+    analysis: AnalysisConfigSchema.default(AnalysisConfigSchema.parse({})),
+    backup: BackupConfigSchema.default(BackupConfigSchema.parse({})),
     mcp: McpConfigSchema.default(McpConfigSchema.parse({})),
     acp: AcpConfigSchema.default(AcpConfigSchema.parse({})),
     skills: SkillsConfigSchema.default(SkillsConfigSchema.parse({})),
@@ -299,10 +318,6 @@ export const AssistantConfigSchema = z
     ),
     twilio: TwilioConfigSchema.default(TwilioConfigSchema.parse({})),
     calls: CallsConfigSchema.default(CallsConfigSchema.parse({})),
-    elevenlabs: ElevenLabsConfigSchema.default(
-      ElevenLabsConfigSchema.parse({}),
-    ),
-    fishAudio: FishAudioConfigSchema.default(FishAudioConfigSchema.parse({})),
     whatsapp: WhatsAppConfigSchema.default(WhatsAppConfigSchema.parse({})),
     telegram: TelegramConfigSchema.default(TelegramConfigSchema.parse({})),
     slack: SlackConfigSchema.default(SlackConfigSchema.parse({})),
@@ -339,30 +354,29 @@ export const AssistantConfigSchema = z
       ),
   })
   .superRefine((config, ctx) => {
+    const llmContextWindow = config.llm?.default?.contextWindow;
     if (
-      config.contextWindow?.targetBudgetRatio != null &&
-      config.contextWindow?.compactThreshold != null &&
-      config.contextWindow.targetBudgetRatio >=
-        config.contextWindow.compactThreshold
+      llmContextWindow?.targetBudgetRatio != null &&
+      llmContextWindow?.compactThreshold != null &&
+      llmContextWindow.targetBudgetRatio >= llmContextWindow.compactThreshold
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetBudgetRatio"],
+        path: ["llm", "default", "contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetBudgetRatio must be less than contextWindow.compactThreshold",
+          "llm.default.contextWindow.targetBudgetRatio must be less than llm.default.contextWindow.compactThreshold",
       });
     }
     if (
-      config.contextWindow?.targetBudgetRatio != null &&
-      config.contextWindow?.summaryBudgetRatio != null &&
-      config.contextWindow.targetBudgetRatio <=
-        config.contextWindow.summaryBudgetRatio
+      llmContextWindow?.targetBudgetRatio != null &&
+      llmContextWindow?.summaryBudgetRatio != null &&
+      llmContextWindow.targetBudgetRatio <= llmContextWindow.summaryBudgetRatio
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetBudgetRatio"],
+        path: ["llm", "default", "contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetBudgetRatio must be greater than contextWindow.summaryBudgetRatio",
+          "llm.default.contextWindow.targetBudgetRatio must be greater than llm.default.contextWindow.summaryBudgetRatio",
       });
     }
     const segmentation = config.memory?.segmentation;

package/src/config/schemas/__tests__/stt.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  SttProvidersSchema,
+  SttServiceSchema,
+  VALID_STT_PROVIDERS,
+} from "../stt.js";
+
+describe("SttProvidersSchema", () => {
+  test("accepts a Deepgram entry with arbitrary fields (generic record)", () => {
+    const parsed = SttProvidersSchema.parse({
+      deepgram: { diarize: true },
+    });
+    expect(parsed).toEqual({ deepgram: { diarize: true } });
+  });
+
+  test("forward-compatible: unknown provider keys still pass validation", () => {
+    const parsed = SttProvidersSchema.parse({
+      "future-provider": { someField: 42 },
+    });
+    expect(parsed).toEqual({ "future-provider": { someField: 42 } });
+  });
+
+  test("empty providers map parses to {}", () => {
+    const parsed = SttProvidersSchema.parse({});
+    expect(parsed).toEqual({});
+  });
+});
+
+describe("SttServiceSchema", () => {
+  test("stt.provider=deepgram with providers.deepgram round-trips", () => {
+    const parsed = SttServiceSchema.parse({
+      provider: "deepgram",
+      providers: { deepgram: { diarize: true } },
+    });
+    expect(parsed.provider).toBe("deepgram");
+    expect(parsed.providers.deepgram).toEqual({ diarize: true });
+  });
+
+  test("VALID_STT_PROVIDERS includes deepgram", () => {
+    expect(VALID_STT_PROVIDERS).toContain("deepgram");
+  });
+});