@vellumai/assistant 0.6.4 → 0.6.5

package/src/config/llm-resolver.ts

@@ -0,0 +1,128 @@
+import { z } from "zod";
+
+import {
+  type LLMCallSite,
+  LLMConfigBase,
+  type LLMConfigFragment,
+  type LLMSchema,
+} from "./schemas/llm.js";
+
+/**
+ * Resolves a fully-specified `LLMConfigBase` for a given call site by layering
+ * the call-site override on top of an optional named profile on top of the
+ * required `llm.default`.
+ *
+ * Resolution order (highest precedence wins):
+ *   1. `llm.callSites[callSite]` fields (call-site override)
+ *   2. `llm.profiles[site.profile]` fields (named profile)
+ *   3. `llm.default` fields (required base)
+ *
+ * Nested objects (`thinking`, `contextWindow`, and
+ * `contextWindow.overflowRecovery`) are deep-merged so partial overrides at
+ * any nesting level merge into — rather than replace — the corresponding
+ * base value.
+ *
+ * Pure & synchronous: no I/O, no async work.
+ */
+export function resolveCallSiteConfig(
+  callSite: LLMCallSite,
+  llm: z.infer<typeof LLMSchema>,
+): z.infer<typeof LLMConfigBase> {
+  const site = llm.callSites?.[callSite];
+
+  // No site-level entry: deep-merge `default` against an empty fragment so
+  // every code path goes through the same merge codepath.
+  if (site == null) {
+    return finalize(deepMerge(llm.default as Mergeable, {} as Mergeable));
+  }
+
+  let profileFragment: LLMConfigFragment | undefined;
+  if (site.profile != null) {
+    profileFragment = llm.profiles?.[site.profile];
+    if (profileFragment == null) {
+      // Defensive: `LLMSchema.superRefine` already rejects unknown profile
+      // references at config load, so this branch is unreachable for any
+      // config that survived schema validation. Throw a clear error in case
+      // a hand-crafted (un-parsed) config slips through.
+      throw new Error(
+        `LLM call site "${callSite}" references undefined profile "${site.profile}"`,
+      );
+    }
+  }
+
+  // Strip the `profile` discriminator before merging — it isn't a
+  // `LLMConfigBase` field.
+  const { profile: _profile, ...siteFragment } = site;
+
+  const merged = deepMerge(
+    llm.default as Mergeable,
+    (profileFragment ?? {}) as Mergeable,
+    siteFragment as Mergeable,
+  );
+
+  return finalize(merged);
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+type Mergeable = Record<string, unknown>;
+
+/**
+ * Returns true for objects we should recurse into during deep merge. We
+ * deliberately exclude arrays so that array-valued fields (e.g.
+ * `pricingOverrides` siblings) get full replacement semantics.
+ */
+function isPlainObject(value: unknown): value is Mergeable {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  );
+}
+
+/**
+ * Deep-merges a sequence of fragments where each rightward source overrides
+ * the previous. For nested plain objects, recurse so partial overrides merge
+ * leaf-by-leaf rather than wholesale-replacing the nested object.
+ *
+ * `undefined` values in a source are skipped (treated as "no opinion"); this
+ * matches Zod fragment semantics where unset optional fields are absent.
+ *
+ * Plain-object values are always cloned (via recursion) rather than aliased,
+ * so the returned config is an isolated snapshot — mutating any nested object
+ * on the result cannot affect `llm.default`, named profiles, or other call
+ * sites' resolutions. Arrays and primitives are copied by reference; the
+ * resolver does not return arrays, and primitives are immutable.
+ */
+function deepMerge(...sources: Mergeable[]): Mergeable {
+  const out: Mergeable = {};
+  for (const source of sources) {
+    for (const [key, value] of Object.entries(source)) {
+      if (value === undefined) continue;
+      const existing = out[key];
+      if (isPlainObject(value)) {
+        // Recurse for any plain-object source. Using `existing` as the base
+        // when it's also a plain object preserves leaf-by-leaf merge
+        // semantics; otherwise we recurse against an empty object so the
+        // result is a freshly-allocated clone rather than an alias.
+        const base = isPlainObject(existing) ? existing : ({} as Mergeable);
+        out[key] = deepMerge(base, value);
+      } else {
+        out[key] = value;
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Cast helper that documents the intent: after merging `llm.default` (which
+ * is `LLMConfigBase`) with optional fragments, every required field is still
+ * present, so the result satisfies `LLMConfigBase`.
+ */
+function finalize(merged: Mergeable): z.infer<typeof LLMConfigBase> {
+  return merged as unknown as z.infer<typeof LLMConfigBase>;
+}

package/src/config/loader.ts

@@ -6,11 +6,14 @@ import {
   statSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
-import { ConfigError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import { ensureDataDir, getWorkspaceConfigPath } from "../util/platform.js";
+import {
+  ensureDataDir,
+  getWorkspaceConfigPath,
+  getWorkspaceDir,
+} from "../util/platform.js";
 import { isAssistantFeatureFlagEnabled } from "./assistant-feature-flags.js";
 import { AssistantConfigSchema } from "./schema.js";
 import type { AssistantConfig } from "./types.js";
@@ -47,6 +50,116 @@ function cloneDefaultConfig(): AssistantConfig {
   return applyNestedDefaults({});
 }
 
+/**
+ * Build a filesystem-safe ISO-8601 timestamp for use in quarantine filenames.
+ * Replaces `:` (invalid on Windows, confusing on macOS Finder) with `-` so the
+ * resulting string is safe on every supported platform.
+ */
+function filesystemSafeTimestamp(date: Date = new Date()): string {
+  return date.toISOString().replace(/:/g, "-");
+}
+
+/**
+ * Rename a corrupt config file to a quarantine path so the bad content is
+ * preserved for debug while the daemon falls through to defaults. Logs at
+ * `error` level with a remediation hint. Best-effort: if the rename itself
+ * fails (missing permissions, readonly FS, etc.) we still fall through to
+ * defaults — startup must never block.
+ *
+ * The quarantine filename encodes a millisecond-precision timestamp and ends
+ * in `.json` so editors syntax-highlight the preserved content:
+ *   `<path>.corrupt-<ISO-timestamp>.json`
+ *
+ * On a successful rename, also appends a bulletin to `<workspace>/UPDATES.md`
+ * so the background update-bulletin job surfaces the event to the user
+ * proactively on their next interaction (log-level errors alone are invisible
+ * to users).
+ */
+function quarantineCorruptConfig(configPath: string, err: unknown): string {
+  const quarantinePath = `${configPath}.corrupt-${filesystemSafeTimestamp()}.json`;
+  try {
+    renameSync(configPath, quarantinePath);
+    log.error(
+      `config file at ${configPath} was corrupt (${String(err)}); ` +
+        `quarantined to ${quarantinePath} and loaded defaults. ` +
+        `Inspect the quarantined file to recover any hand-edited settings.`,
+    );
+    appendQuarantineBulletin(configPath, quarantinePath);
+  } catch (renameErr) {
+    log.error(
+      { renameErr },
+      `config file at ${configPath} was corrupt (${String(err)}) but could ` +
+        `not be renamed for quarantine; loaded defaults.`,
+    );
+  }
+  return quarantinePath;
+}
+
+/**
+ * Append a config-quarantine bulletin to `<workspace>/UPDATES.md`. On the
+ * next daemon boot the background update-bulletin job picks up UPDATES.md
+ * and processes it inside a background-only conversation (not the user's
+ * chat). The agent decides whether and when to surface the event — typical
+ * cases are the user asking why their settings changed or noticing missing
+ * API keys. The bulletin is agent-visible context, not a push notification.
+ *
+ * Idempotency: the appended block embeds a marker keyed on the quarantine
+ * filename's basename. If that marker is already present in UPDATES.md (a
+ * prior append succeeded but the process crashed before control returned, or
+ * the file was hand-edited), the function is a no-op. This mirrors the
+ * pattern release-notes workspace migrations use — see the "Release Update
+ * Hygiene" section in the root `AGENTS.md`.
+ *
+ * Best-effort: any write failure is logged at `warn` and swallowed. The
+ * quarantine path must never block startup, and the error log from
+ * `quarantineCorruptConfig` remains the authoritative record.
+ *
+ * Exported with an underscore-prefixed alias (`_appendQuarantineBulletin`) so
+ * tests can exercise the idempotent-skip branch directly with a deterministic
+ * quarantine basename. Non-test callers should never import the underscore
+ * alias — the wiring into `quarantineCorruptConfig` is the production entry
+ * point.
+ */
+function appendQuarantineBulletin(
+  originalPath: string,
+  quarantinePath: string,
+): void {
+  try {
+    const updatesPath = join(getWorkspaceDir(), "UPDATES.md");
+    const quarantineBasename = basename(quarantinePath);
+    const marker = `<!-- config-quarantine:${quarantineBasename} -->`;
+
+    const existing = existsSync(updatesPath)
+      ? readFileSync(updatesPath, "utf-8")
+      : "";
+    if (existing.includes(marker)) return;
+
+    const timestamp = new Date().toISOString();
+    const block =
+      `## Config was reset to defaults\n\n` +
+      `Your \`config.json\` was unreadable at ${timestamp} and couldn't be parsed ` +
+      `as JSON. The assistant preserved the original file at \`${quarantinePath}\` ` +
+      `and loaded defaults so the app stays working.\n\n` +
+      `If you had custom settings (API keys, model choices, voice preferences), ` +
+      `they are still in the quarantined file — \`cat ${quarantinePath}\` to ` +
+      `recover them, then re-enter through Settings or the CLI.\n\n` +
+      `${marker}\n`;
+
+    const toWrite = existing.length === 0 ? block : `${existing}\n${block}`;
+    writeFileSync(updatesPath, toWrite, "utf-8");
+    log.info(
+      `Appended config-quarantine bulletin to ${updatesPath} for ${originalPath} ` +
+        `(quarantined as ${quarantineBasename}).`,
+    );
+  } catch (bulletinErr) {
+    log.warn(
+      { bulletinErr },
+      `Failed to append config-quarantine bulletin to UPDATES.md; ` +
+        `the quarantine event is still recorded in the assistant logs.`,
+    );
+  }
+}
+
 /**
  * Validate a raw config object with Zod. Invalid fields are logged as warnings
  * and replaced with defaults (matching prior behavior of per-field fallback).
@@ -206,10 +319,53 @@ export function deepMergeMissing(
   return changed;
 }
 
+/**
+ * Recursively strip `null` leaves from a plain-object value, returning a
+ * deep clone with all `null`-valued keys removed at every nesting level.
+ * Non-object inputs (scalars, arrays, `null` itself) are returned as-is.
+ *
+ * Used to sanitize `overrides` before assigning whole subtrees in
+ * `deepMergeOverwrite`, so deletion-sentinel semantics apply uniformly
+ * even when the corresponding `target` key does not yet exist.
+ */
+function stripNullLeaves(value: unknown): unknown {
+  if (value == null || typeof value !== "object" || Array.isArray(value)) {
+    return value;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    if (v === null) continue;
+    out[k] = stripNullLeaves(v);
+  }
+  return out;
+}
+
 /**
  * Deep-merge `overrides` into `target`, overwriting leaf values.
  * Recursively merges nested objects; scalars and arrays from `overrides`
  * replace corresponding values in `target`.
+ *
+ * JSON `null` semantics depend on what the target currently holds at
+ * that key:
+ *
+ * - **Target holds a non-null object** (not array): `null` deletes the
+ *   key, removing the entire subtree. This supports "clear entry"
+ *   semantics (e.g. the macOS SettingsStore clearing a call-site
+ *   override via `{ callSites: { memoryRetrieval: null } }`).
+ *
+ * - **Target holds a scalar, null, or array**: `null` is assigned as the
+ *   value, preserving nullable config fields like `activeHoursStart`
+ *   and `llmRequestLogRetentionMs` where `null` is a valid schema
+ *   value meaning "disabled / no limit".
+ *
+ * - **Key absent from target**: no-op. Assigning null to a missing key
+ *   would create a spurious entry; callers that want to establish a
+ *   null value should set the key to its default first.
+ *
+ * When an override assigns a whole object subtree to a key that does
+ * not yet exist on `target` (or whose existing value is a scalar/array),
+ * `stripNullLeaves` drops any `null` leaves inside that subtree before
+ * assignment so no invalid nulls get persisted for non-nullable fields.
  */
 export function deepMergeOverwrite(
   target: Record<string, unknown>,
@@ -217,8 +373,20 @@ export function deepMergeOverwrite(
 ): void {
   for (const key of Object.keys(overrides)) {
     const ov = overrides[key];
-    if (
-      ov != null &&
+    if (ov === null) {
+      if (!(key in target)) continue;
+      const existing = target[key];
+      if (
+        existing != null &&
+        typeof existing === "object" &&
+        !Array.isArray(existing)
+      ) {
+        delete target[key];
+      } else {
+        target[key] = null;
+      }
+    } else if (
+      ov !== undefined &&
       typeof ov === "object" &&
       !Array.isArray(ov) &&
       target[key] != null &&
@@ -230,7 +398,7 @@ export function deepMergeOverwrite(
         ov as Record<string, unknown>,
       );
     } else {
-      target[key] = ov;
+      target[key] = stripNullLeaves(ov);
     }
   }
 }
@@ -363,9 +531,14 @@ export function loadConfig(): AssistantConfig {
       try {
         fileConfig = JSON.parse(readFileSync(configPath, "utf-8"));
       } catch (err) {
-        throw new ConfigError(
-          `Failed to parse config at ${configPath}: ${err}`,
-        );
+        // The daemon must never block startup (assistant/CLAUDE.md). A config
+        // file that fails JSON.parse — truncated during a mid-write crash, or
+        // hand-edited to invalid JSON — is quarantined so the content is
+        // preserved for debug, and startup proceeds with the same default-
+        // config path used when config.json does not exist.
+        quarantineCorruptConfig(configPath, err);
+        fileConfig = {};
+        configFileExisted = false;
       }
     } else {
       configFileExisted = false;
@@ -521,7 +694,11 @@ export function loadRawConfig(): Record<string, unknown> {
     try {
       raw = JSON.parse(readFileSync(configPath, "utf-8"));
     } catch (err) {
-      throw new ConfigError(`Failed to parse config at ${configPath}: ${err}`);
+      // Mirror loadConfig(): quarantine the corrupt file and return an empty
+      // object rather than throwing. This prevents /v1/config from surfacing
+      // a 500 when the user's config.json is malformed.
+      quarantineCorruptConfig(configPath, err);
+      raw = {};
     }
   }
 
@@ -571,3 +748,10 @@ export function setNestedValue(
   }
   current[keys[keys.length - 1]] = value;
 }
+
+/**
+ * Test-only alias for `appendQuarantineBulletin`. Exists so the crash-mid-
+ * append idempotency branch can be exercised with a deterministic quarantine
+ * basename without widening the runtime surface. Not for production use.
+ */
+export const _appendQuarantineBulletin = appendQuarantineBulletin;

package/src/config/raw-config-utils.ts

@@ -1,11 +1,39 @@
+/**
+ * Safely set a nested field on a raw config object's `llm.default` map.
+ *
+ * Ensures the `llm` and `llm.default` objects exist before writing, so
+ * callers don't need to guard against undefined intermediate keys.
+ *
+ * Example: `setLlmDefaultField(raw, "model", "claude-sonnet-4-6")`
+ * produces `raw.llm.default.model = "claude-sonnet-4-6"`.
+ */
+export function setLlmDefaultField(
+  raw: Record<string, unknown>,
+  field: string,
+  value: unknown,
+): void {
+  const llm: Record<string, unknown> =
+    raw.llm != null && typeof raw.llm === "object" && !Array.isArray(raw.llm)
+      ? (raw.llm as Record<string, unknown>)
+      : {};
+  const existing = llm.default;
+  const defaultBlock: Record<string, unknown> =
+    existing != null && typeof existing === "object" && !Array.isArray(existing)
+      ? (existing as Record<string, unknown>)
+      : {};
+  defaultBlock[field] = value;
+  llm.default = defaultBlock;
+  raw.llm = llm;
+}
+
 /**
  * Safely set a nested field on a raw config object's `services` map.
  *
  * Ensures the `services` and service-level objects exist before writing,
  * so callers don't need to guard against undefined intermediate keys.
  *
- * Example: `setServiceField(raw, "inference", "model", "claude-sonnet-4-6")`
- * produces `raw.services.inference.model = "claude-sonnet-4-6"`.
+ * Example: `setServiceField(raw, "inference", "mode", "managed")`
+ * produces `raw.services.inference.mode = "managed"`.
  */
 export function setServiceField(
   raw: Record<string, unknown>,

package/src/config/sanitize-for-transfer.ts

@@ -7,6 +7,18 @@
  * - `ingress.enabled` → deleted
  * - `daemon` → deleted entirely
  * - `skills.load.extraDirs` → set to `[]`
+ * - `hostBrowser.cdpInspect.desktopAuto` → deleted **only when the source
+ *   either relies on the schema default or explicitly sets
+ *   `enabled: true`**. An explicit `enabled: false` is preserved so a
+ *   platform→local teleport doesn't silently re-enable auto-attach
+ *   against the user's opt-out.
+ *
+ * `logFile.dir` is intentionally *not* stripped: the logger's container
+ * fallback (`util/logger.ts#resolveLogDir`) already redirects to the
+ * default log dir with a warning when the configured path can't be
+ * created, and stripping `dir` would disable rotating file logging
+ * entirely because `lifecycle.ts` gates `initLogger` on a truthy
+ * `config.logFile.dir`.
  */
 export function sanitizeConfigForTransfer(configJson: string): string {
   let config: Record<string, unknown>;
@@ -43,5 +55,28 @@ export function sanitizeConfigForTransfer(configJson: string): string {
     }
   }
 
+  // Strip hostBrowser.cdpInspect.desktopAuto — the auto-attach-to-Chrome
+  // behavior is gated on a macOS-originated turn; preserving a
+  // source-host-derived `enabled: true` inside a Linux managed pod's
+  // config is misleading and brittle. Preserve an explicit
+  // `enabled: false` opt-out, though — the schema default is `true`,
+  // so unconditionally stripping this subobject would re-enable
+  // auto-attach after a platform→local teleport.
+  if (config.hostBrowser && typeof config.hostBrowser === "object") {
+    const hostBrowser = config.hostBrowser as Record<string, unknown>;
+    if (hostBrowser.cdpInspect && typeof hostBrowser.cdpInspect === "object") {
+      const cdpInspect = hostBrowser.cdpInspect as Record<string, unknown>;
+      const desktopAuto = cdpInspect.desktopAuto;
+      const isExplicitOptOut =
+        desktopAuto !== null &&
+        typeof desktopAuto === "object" &&
+        !Array.isArray(desktopAuto) &&
+        (desktopAuto as Record<string, unknown>).enabled === false;
+      if (!isExplicitOptOut) {
+        delete cdpInspect.desktopAuto;
+      }
+    }
+  }
+
   return JSON.stringify(config, null, 2) + "\n";
 }

package/src/config/schema.ts

@@ -62,17 +62,13 @@ export {
 export type {
   ContextOverflowRecoveryConfig,
   ContextWindowConfig,
-  Effort,
   ModelPricingOverride,
-  Speed,
   ThinkingConfig,
 } from "./schemas/inference.js";
 export {
   ContextOverflowRecoveryConfigSchema,
   ContextWindowConfigSchema,
-  EffortSchema,
   ModelPricingOverrideSchema,
-  SpeedSchema,
   ThinkingConfigSchema,
 } from "./schemas/inference.js";
 export type {
@@ -87,6 +83,14 @@ export {
 } from "./schemas/ingress.js";
 export type { JournalConfig } from "./schemas/journal.js";
 export { JournalConfigSchema } from "./schemas/journal.js";
+export type {
+  LLMCallSite,
+  LLMCallSiteConfig,
+  LLMConfig,
+  LLMConfigBase,
+  LLMConfigFragment,
+} from "./schemas/llm.js";
+export { LLMCallSiteEnum, LLMSchema } from "./schemas/llm.js";
 export type { AuditLogConfig, LogFileConfig } from "./schemas/logging.js";
 export {
   AuditLogConfigSchema,
@@ -239,15 +243,9 @@ import {
 import { FilingConfigSchema } from "./schemas/filing.js";
 import { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 import { HostBrowserConfigSchema } from "./schemas/host-browser.js";
-import {
-  ContextWindowConfigSchema,
-  EffortSchema,
-  ModelPricingOverrideSchema,
-  SpeedSchema,
-  ThinkingConfigSchema,
-} from "./schemas/inference.js";
 import { IngressConfigSchema } from "./schemas/ingress.js";
 import { JournalConfigSchema } from "./schemas/journal.js";
+import { LLMSchema } from "./schemas/llm.js";
 import {
   AuditLogConfigSchema,
   LogFileConfigSchema,
@@ -276,18 +274,6 @@ import { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 export const AssistantConfigSchema = z
   .object({
     services: ServicesSchema.default(ServicesSchema.parse({})),
-    maxTokens: z
-      .number({ error: "maxTokens must be a number" })
-      .int("maxTokens must be an integer")
-      .positive("maxTokens must be a positive integer")
-      .default(64000)
-      .describe("Maximum number of output tokens per LLM response"),
-    effort: EffortSchema,
-    speed: SpeedSchema,
-    thinking: ThinkingConfigSchema.default(ThinkingConfigSchema.parse({})),
-    contextWindow: ContextWindowConfigSchema.default(
-      ContextWindowConfigSchema.parse({}),
-    ),
     memory: MemoryConfigSchema.default(MemoryConfigSchema.parse({})),
     dataDir: z
       .string({ error: "dataDir must be a string" })
@@ -305,12 +291,16 @@ export const AssistantConfigSchema = z
     logFile: LogFileConfigSchema.default(
       LogFileConfigSchema.parse({ dir: getDataDir() + "/logs" }),
     ),
-    pricingOverrides: z
-      .array(ModelPricingOverrideSchema)
-      .default([])
-      .describe(
-        "Custom pricing overrides for specific provider/model combinations",
-      ),
+    // Unified LLM configuration block. The unique source of truth for
+    // provider/model/maxTokens/effort/speed/temperature/thinking/contextWindow
+    // and pricing overrides for every call site in the assistant.
+    //
+    // Default values live on each leaf inside `LLMSchema` (see
+    // `schemas/llm.ts`), so `LLMSchema.parse({})` returns a fully-populated
+    // object. This matches the pattern used by sibling schemas above and
+    // ensures the loader's leaf-deletion recovery path can repair a partially
+    // invalid `llm` block without falling back to `cloneDefaultConfig()`.
+    llm: LLMSchema.default(LLMSchema.parse({})),
     filing: FilingConfigSchema.default(FilingConfigSchema.parse({})),
     heartbeat: HeartbeatConfigSchema.default(HeartbeatConfigSchema.parse({})),
     updates: UpdatesConfigSchema.default(UpdatesConfigSchema.parse({})),
@@ -364,30 +354,29 @@ export const AssistantConfigSchema = z
       ),
   })
   .superRefine((config, ctx) => {
+    const llmContextWindow = config.llm?.default?.contextWindow;
     if (
-      config.contextWindow?.targetBudgetRatio != null &&
-      config.contextWindow?.compactThreshold != null &&
-      config.contextWindow.targetBudgetRatio >=
-        config.contextWindow.compactThreshold
+      llmContextWindow?.targetBudgetRatio != null &&
+      llmContextWindow?.compactThreshold != null &&
+      llmContextWindow.targetBudgetRatio >= llmContextWindow.compactThreshold
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetBudgetRatio"],
+        path: ["llm", "default", "contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetBudgetRatio must be less than contextWindow.compactThreshold",
+          "llm.default.contextWindow.targetBudgetRatio must be less than llm.default.contextWindow.compactThreshold",
       });
     }
     if (
-      config.contextWindow?.targetBudgetRatio != null &&
-      config.contextWindow?.summaryBudgetRatio != null &&
-      config.contextWindow.targetBudgetRatio <=
-        config.contextWindow.summaryBudgetRatio
+      llmContextWindow?.targetBudgetRatio != null &&
+      llmContextWindow?.summaryBudgetRatio != null &&
+      llmContextWindow.targetBudgetRatio <= llmContextWindow.summaryBudgetRatio
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetBudgetRatio"],
+        path: ["llm", "default", "contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetBudgetRatio must be greater than contextWindow.summaryBudgetRatio",
+          "llm.default.contextWindow.targetBudgetRatio must be greater than llm.default.contextWindow.summaryBudgetRatio",
       });
     }
     const segmentation = config.memory?.segmentation;

package/src/config/schemas/analysis.ts

@@ -24,28 +24,9 @@ export const AnalysisConfigSchema = z
       .describe(
         "Milliseconds of idle time after the last message before the debounced analysis job fires",
       ),
-
-    // Optional model intent for the analysis agent loop. When omitted,
-    // the analysis agent uses the same model as the main agent.
-    // Accepted values match the main agent's model-intent vocabulary.
-    modelIntent: z
-      .enum(["latency-optimized", "quality-optimized", "vision-optimized"], {
-        error: "analysis.modelIntent must be a valid model intent",
-      })
-      .optional()
-      .describe(
-        "Model selection strategy for the analysis agent loop — falls back to the main agent's model when omitted",
-      ),
-
-    // Optional explicit model override (provider/model string). Takes
-    // precedence over modelIntent when both are set.
-    modelOverride: z
-      .string({ error: "analysis.modelOverride must be a string" })
-      .optional()
-      .describe(
-        "Explicit model override (provider/model string) for the analysis agent loop — takes precedence over modelIntent when both are set",
-      ),
   })
-  .describe("Controls the auto-analyze agent loop triggered by conversation activity");
+  .describe(
+    "Controls the auto-analyze agent loop triggered by conversation activity. Model selection lives under llm.callSites.analyzeConversation.",
+  );
 
 export type AnalysisConfig = z.infer<typeof AnalysisConfigSchema>;

package/src/config/schemas/calls.ts

@@ -222,10 +222,6 @@ export const CallsConfigSchema = z
     ),
     safety: CallsSafetyConfigSchema.default(CallsSafetyConfigSchema.parse({})),
     voice: CallsVoiceConfigSchema.default(CallsVoiceConfigSchema.parse({})),
-    model: z
-      .string({ error: "calls.model must be a string" })
-      .optional()
-      .describe("Override the default model for phone call conversations"),
     callerIdentity: CallerIdentityConfigSchema.default(
       CallerIdentityConfigSchema.parse({}),
     ),