@vellumai/assistant 0.6.4 → 0.6.6

package/src/config/loader.ts

@@ -6,11 +6,14 @@ import {
   statSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
-import { ConfigError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import { ensureDataDir, getWorkspaceConfigPath } from "../util/platform.js";
+import {
+  ensureDataDir,
+  getWorkspaceConfigPath,
+  getWorkspaceDir,
+} from "../util/platform.js";
 import { isAssistantFeatureFlagEnabled } from "./assistant-feature-flags.js";
 import { AssistantConfigSchema } from "./schema.js";
 import type { AssistantConfig } from "./types.js";
@@ -47,6 +50,116 @@ function cloneDefaultConfig(): AssistantConfig {
   return applyNestedDefaults({});
 }
 
+/**
+ * Build a filesystem-safe ISO-8601 timestamp for use in quarantine filenames.
+ * Replaces `:` (invalid on Windows, confusing on macOS Finder) with `-` so the
+ * resulting string is safe on every supported platform.
+ */
+function filesystemSafeTimestamp(date: Date = new Date()): string {
+  return date.toISOString().replace(/:/g, "-");
+}
+
+/**
+ * Rename a corrupt config file to a quarantine path so the bad content is
+ * preserved for debug while the daemon falls through to defaults. Logs at
+ * `error` level with a remediation hint. Best-effort: if the rename itself
+ * fails (missing permissions, readonly FS, etc.) we still fall through to
+ * defaults — startup must never block.
+ *
+ * The quarantine filename encodes a millisecond-precision timestamp and ends
+ * in `.json` so editors syntax-highlight the preserved content:
+ *   `<path>.corrupt-<ISO-timestamp>.json`
+ *
+ * On a successful rename, also appends a bulletin to `<workspace>/UPDATES.md`
+ * so the background update-bulletin job surfaces the event to the user
+ * proactively on their next interaction (log-level errors alone are invisible
+ * to users).
+ */
+function quarantineCorruptConfig(configPath: string, err: unknown): string {
+  const quarantinePath = `${configPath}.corrupt-${filesystemSafeTimestamp()}.json`;
+  try {
+    renameSync(configPath, quarantinePath);
+    log.error(
+      `config file at ${configPath} was corrupt (${String(err)}); ` +
+        `quarantined to ${quarantinePath} and loaded defaults. ` +
+        `Inspect the quarantined file to recover any hand-edited settings.`,
+    );
+    appendQuarantineBulletin(configPath, quarantinePath);
+  } catch (renameErr) {
+    log.error(
+      { renameErr },
+      `config file at ${configPath} was corrupt (${String(err)}) but could ` +
+        `not be renamed for quarantine; loaded defaults.`,
+    );
+  }
+  return quarantinePath;
+}
+
+/**
+ * Append a config-quarantine bulletin to `<workspace>/UPDATES.md`. On the
+ * next daemon boot the background update-bulletin job picks up UPDATES.md
+ * and processes it inside a background-only conversation (not the user's
+ * chat). The agent decides whether and when to surface the event — typical
+ * cases are the user asking why their settings changed or noticing missing
+ * API keys. The bulletin is agent-visible context, not a push notification.
+ *
+ * Idempotency: the appended block embeds a marker keyed on the quarantine
+ * filename's basename. If that marker is already present in UPDATES.md (a
+ * prior append succeeded but the process crashed before control returned, or
+ * the file was hand-edited), the function is a no-op. This mirrors the
+ * pattern release-notes workspace migrations use — see the "Release Update
+ * Hygiene" section in the root `AGENTS.md`.
+ *
+ * Best-effort: any write failure is logged at `warn` and swallowed. The
+ * quarantine path must never block startup, and the error log from
+ * `quarantineCorruptConfig` remains the authoritative record.
+ *
+ * Exported with an underscore-prefixed alias (`_appendQuarantineBulletin`) so
+ * tests can exercise the idempotent-skip branch directly with a deterministic
+ * quarantine basename. Non-test callers should never import the underscore
+ * alias — the wiring into `quarantineCorruptConfig` is the production entry
+ * point.
+ */
+function appendQuarantineBulletin(
+  originalPath: string,
+  quarantinePath: string,
+): void {
+  try {
+    const updatesPath = join(getWorkspaceDir(), "UPDATES.md");
+    const quarantineBasename = basename(quarantinePath);
+    const marker = `<!-- config-quarantine:${quarantineBasename} -->`;
+
+    const existing = existsSync(updatesPath)
+      ? readFileSync(updatesPath, "utf-8")
+      : "";
+    if (existing.includes(marker)) return;
+
+    const timestamp = new Date().toISOString();
+    const block =
+      `## Config was reset to defaults\n\n` +
+      `Your \`config.json\` was unreadable at ${timestamp} and couldn't be parsed ` +
+      `as JSON. The assistant preserved the original file at \`${quarantinePath}\` ` +
+      `and loaded defaults so the app stays working.\n\n` +
+      `If you had custom settings (API keys, model choices, voice preferences), ` +
+      `they are still in the quarantined file — \`cat ${quarantinePath}\` to ` +
+      `recover them, then re-enter through Settings or the CLI.\n\n` +
+      `${marker}\n`;
+
+    const toWrite = existing.length === 0 ? block : `${existing}\n${block}`;
+    writeFileSync(updatesPath, toWrite, "utf-8");
+    log.info(
+      `Appended config-quarantine bulletin to ${updatesPath} for ${originalPath} ` +
+        `(quarantined as ${quarantineBasename}).`,
+    );
+  } catch (bulletinErr) {
+    log.warn(
+      { bulletinErr },
+      `Failed to append config-quarantine bulletin to UPDATES.md; ` +
+        `the quarantine event is still recorded in the assistant logs.`,
+    );
+  }
+}
+
 /**
  * Validate a raw config object with Zod. Invalid fields are logged as warnings
  * and replaced with defaults (matching prior behavior of per-field fallback).
@@ -206,10 +319,53 @@ export function deepMergeMissing(
   return changed;
 }
 
+/**
+ * Recursively strip `null` leaves from a plain-object value, returning a
+ * deep clone with all `null`-valued keys removed at every nesting level.
+ * Non-object inputs (scalars, arrays, `null` itself) are returned as-is.
+ *
+ * Used to sanitize `overrides` before assigning whole subtrees in
+ * `deepMergeOverwrite`, so deletion-sentinel semantics apply uniformly
+ * even when the corresponding `target` key does not yet exist.
+ */
+function stripNullLeaves(value: unknown): unknown {
+  if (value == null || typeof value !== "object" || Array.isArray(value)) {
+    return value;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    if (v === null) continue;
+    out[k] = stripNullLeaves(v);
+  }
+  return out;
+}
+
 /**
  * Deep-merge `overrides` into `target`, overwriting leaf values.
  * Recursively merges nested objects; scalars and arrays from `overrides`
  * replace corresponding values in `target`.
+ *
+ * JSON `null` semantics depend on what the target currently holds at
+ * that key:
+ *
+ * - **Target holds a non-null object** (not array): `null` deletes the
+ *   key, removing the entire subtree. This supports "clear entry"
+ *   semantics (e.g. the macOS SettingsStore clearing a call-site
+ *   override via `{ callSites: { memoryRetrieval: null } }`).
+ *
+ * - **Target holds a scalar, null, or array**: `null` is assigned as the
+ *   value, preserving nullable config fields like `activeHoursStart`
+ *   and `llmRequestLogRetentionMs` where `null` is a valid schema
+ *   value meaning "disabled / no limit".
+ *
+ * - **Key absent from target**: no-op. Assigning null to a missing key
+ *   would create a spurious entry; callers that want to establish a
+ *   null value should set the key to its default first.
+ *
+ * When an override assigns a whole object subtree to a key that does
+ * not yet exist on `target` (or whose existing value is a scalar/array),
+ * `stripNullLeaves` drops any `null` leaves inside that subtree before
+ * assignment so no invalid nulls get persisted for non-nullable fields.
  */
 export function deepMergeOverwrite(
   target: Record<string, unknown>,
@@ -217,8 +373,20 @@ export function deepMergeOverwrite(
 ): void {
   for (const key of Object.keys(overrides)) {
     const ov = overrides[key];
-    if (
-      ov != null &&
+    if (ov === null) {
+      if (!(key in target)) continue;
+      const existing = target[key];
+      if (
+        existing != null &&
+        typeof existing === "object" &&
+        !Array.isArray(existing)
+      ) {
+        delete target[key];
+      } else {
+        target[key] = null;
+      }
+    } else if (
+      ov !== undefined &&
       typeof ov === "object" &&
       !Array.isArray(ov) &&
       target[key] != null &&
@@ -230,7 +398,7 @@ export function deepMergeOverwrite(
         ov as Record<string, unknown>,
       );
     } else {
-      target[key] = ov;
+      target[key] = stripNullLeaves(ov);
     }
   }
 }
@@ -363,9 +531,14 @@ export function loadConfig(): AssistantConfig {
       try {
         fileConfig = JSON.parse(readFileSync(configPath, "utf-8"));
       } catch (err) {
-        throw new ConfigError(
-          `Failed to parse config at ${configPath}: ${err}`,
-        );
+        // The daemon must never block startup (assistant/CLAUDE.md). A config
+        // file that fails JSON.parse — truncated during a mid-write crash, or
+        // hand-edited to invalid JSON — is quarantined so the content is
+        // preserved for debug, and startup proceeds with the same default-
+        // config path used when config.json does not exist.
+        quarantineCorruptConfig(configPath, err);
+        fileConfig = {};
+        configFileExisted = false;
       }
     } else {
       configFileExisted = false;
@@ -521,7 +694,11 @@ export function loadRawConfig(): Record<string, unknown> {
     try {
       raw = JSON.parse(readFileSync(configPath, "utf-8"));
     } catch (err) {
-      throw new ConfigError(`Failed to parse config at ${configPath}: ${err}`);
+      // Mirror loadConfig(): quarantine the corrupt file and return an empty
+      // object rather than throwing. This prevents /v1/config from surfacing
+      // a 500 when the user's config.json is malformed.
+      quarantineCorruptConfig(configPath, err);
+      raw = {};
     }
   }
 
@@ -571,3 +748,10 @@ export function setNestedValue(
   }
   current[keys[keys.length - 1]] = value;
 }
+
+/**
+ * Test-only alias for `appendQuarantineBulletin`. Exists so the crash-mid-
+ * append idempotency branch can be exercised with a deterministic quarantine
+ * basename without widening the runtime surface. Not for production use.
+ */
+export const _appendQuarantineBulletin = appendQuarantineBulletin;

package/src/config/raw-config-utils.ts

@@ -1,11 +1,39 @@
+/**
+ * Safely set a nested field on a raw config object's `llm.default` map.
+ *
+ * Ensures the `llm` and `llm.default` objects exist before writing, so
+ * callers don't need to guard against undefined intermediate keys.
+ *
+ * Example: `setLlmDefaultField(raw, "model", "claude-sonnet-4-6")`
+ * produces `raw.llm.default.model = "claude-sonnet-4-6"`.
+ */
+export function setLlmDefaultField(
+  raw: Record<string, unknown>,
+  field: string,
+  value: unknown,
+): void {
+  const llm: Record<string, unknown> =
+    raw.llm != null && typeof raw.llm === "object" && !Array.isArray(raw.llm)
+      ? (raw.llm as Record<string, unknown>)
+      : {};
+  const existing = llm.default;
+  const defaultBlock: Record<string, unknown> =
+    existing != null && typeof existing === "object" && !Array.isArray(existing)
+      ? (existing as Record<string, unknown>)
+      : {};
+  defaultBlock[field] = value;
+  llm.default = defaultBlock;
+  raw.llm = llm;
+}
+
 /**
  * Safely set a nested field on a raw config object's `services` map.
  *
  * Ensures the `services` and service-level objects exist before writing,
  * so callers don't need to guard against undefined intermediate keys.
  *
- * Example: `setServiceField(raw, "inference", "model", "claude-sonnet-4-6")`
- * produces `raw.services.inference.model = "claude-sonnet-4-6"`.
+ * Example: `setServiceField(raw, "inference", "mode", "managed")`
+ * produces `raw.services.inference.mode = "managed"`.
  */
 export function setServiceField(
   raw: Record<string, unknown>,

package/src/config/sanitize-for-transfer.ts

@@ -7,6 +7,18 @@
  * - `ingress.enabled` → deleted
  * - `daemon` → deleted entirely
  * - `skills.load.extraDirs` → set to `[]`
+ * - `hostBrowser.cdpInspect.desktopAuto` → deleted **only when the source
+ *   either relies on the schema default or explicitly sets
+ *   `enabled: true`**. An explicit `enabled: false` is preserved so a
+ *   platform→local teleport doesn't silently re-enable auto-attach
+ *   against the user's opt-out.
+ *
+ * `logFile.dir` is intentionally *not* stripped: the logger's container
+ * fallback (`util/logger.ts#resolveLogDir`) already redirects to the
+ * default log dir with a warning when the configured path can't be
+ * created, and stripping `dir` would disable rotating file logging
+ * entirely because `lifecycle.ts` gates `initLogger` on a truthy
+ * `config.logFile.dir`.
  */
 export function sanitizeConfigForTransfer(configJson: string): string {
   let config: Record<string, unknown>;
@@ -43,5 +55,28 @@ export function sanitizeConfigForTransfer(configJson: string): string {
     }
   }
 
+  // Strip hostBrowser.cdpInspect.desktopAuto — the auto-attach-to-Chrome
+  // behavior is gated on a macOS-originated turn; preserving a
+  // source-host-derived `enabled: true` inside a Linux managed pod's
+  // config is misleading and brittle. Preserve an explicit
+  // `enabled: false` opt-out, though — the schema default is `true`,
+  // so unconditionally stripping this subobject would re-enable
+  // auto-attach after a platform→local teleport.
+  if (config.hostBrowser && typeof config.hostBrowser === "object") {
+    const hostBrowser = config.hostBrowser as Record<string, unknown>;
+    if (hostBrowser.cdpInspect && typeof hostBrowser.cdpInspect === "object") {
+      const cdpInspect = hostBrowser.cdpInspect as Record<string, unknown>;
+      const desktopAuto = cdpInspect.desktopAuto;
+      const isExplicitOptOut =
+        desktopAuto !== null &&
+        typeof desktopAuto === "object" &&
+        !Array.isArray(desktopAuto) &&
+        (desktopAuto as Record<string, unknown>).enabled === false;
+      if (!isExplicitOptOut) {
+        delete cdpInspect.desktopAuto;
+      }
+    }
+  }
+
   return JSON.stringify(config, null, 2) + "\n";
 }

package/src/config/schema.ts

@@ -43,6 +43,8 @@ export {
   TwilioConfigSchema,
   WhatsAppConfigSchema,
 } from "./schemas/channels.js";
+export type { ConversationsConfig } from "./schemas/conversations.js";
+export { ConversationsConfigSchema } from "./schemas/conversations.js";
 export {
   DEFAULT_ELEVENLABS_VOICE_ID,
   VALID_CONVERSATION_TIMEOUTS,
@@ -62,17 +64,13 @@ export {
 export type {
   ContextOverflowRecoveryConfig,
   ContextWindowConfig,
-  Effort,
   ModelPricingOverride,
-  Speed,
   ThinkingConfig,
 } from "./schemas/inference.js";
 export {
   ContextOverflowRecoveryConfigSchema,
   ContextWindowConfigSchema,
-  EffortSchema,
   ModelPricingOverrideSchema,
-  SpeedSchema,
   ThinkingConfigSchema,
 } from "./schemas/inference.js";
 export type {
@@ -87,6 +85,14 @@ export {
 } from "./schemas/ingress.js";
 export type { JournalConfig } from "./schemas/journal.js";
 export { JournalConfigSchema } from "./schemas/journal.js";
+export type {
+  LLMCallSite,
+  LLMCallSiteConfig,
+  LLMConfig,
+  LLMConfigBase,
+  LLMConfigFragment,
+} from "./schemas/llm.js";
+export { LLMCallSiteEnum, LLMSchema } from "./schemas/llm.js";
 export type { AuditLogConfig, LogFileConfig } from "./schemas/logging.js";
 export {
   AuditLogConfigSchema,
@@ -236,18 +242,13 @@ import {
   TwilioConfigSchema,
   WhatsAppConfigSchema,
 } from "./schemas/channels.js";
+import { ConversationsConfigSchema } from "./schemas/conversations.js";
 import { FilingConfigSchema } from "./schemas/filing.js";
 import { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 import { HostBrowserConfigSchema } from "./schemas/host-browser.js";
-import {
-  ContextWindowConfigSchema,
-  EffortSchema,
-  ModelPricingOverrideSchema,
-  SpeedSchema,
-  ThinkingConfigSchema,
-} from "./schemas/inference.js";
 import { IngressConfigSchema } from "./schemas/ingress.js";
 import { JournalConfigSchema } from "./schemas/journal.js";
+import { LLMSchema } from "./schemas/llm.js";
 import {
   AuditLogConfigSchema,
   LogFileConfigSchema,
@@ -276,18 +277,6 @@ import { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 export const AssistantConfigSchema = z
   .object({
     services: ServicesSchema.default(ServicesSchema.parse({})),
-    maxTokens: z
-      .number({ error: "maxTokens must be a number" })
-      .int("maxTokens must be an integer")
-      .positive("maxTokens must be a positive integer")
-      .default(64000)
-      .describe("Maximum number of output tokens per LLM response"),
-    effort: EffortSchema,
-    speed: SpeedSchema,
-    thinking: ThinkingConfigSchema.default(ThinkingConfigSchema.parse({})),
-    contextWindow: ContextWindowConfigSchema.default(
-      ContextWindowConfigSchema.parse({}),
-    ),
     memory: MemoryConfigSchema.default(MemoryConfigSchema.parse({})),
     dataDir: z
       .string({ error: "dataDir must be a string" })
@@ -305,18 +294,25 @@ export const AssistantConfigSchema = z
     logFile: LogFileConfigSchema.default(
       LogFileConfigSchema.parse({ dir: getDataDir() + "/logs" }),
     ),
-    pricingOverrides: z
-      .array(ModelPricingOverrideSchema)
-      .default([])
-      .describe(
-        "Custom pricing overrides for specific provider/model combinations",
-      ),
+    // Unified LLM configuration block. The unique source of truth for
+    // provider/model/maxTokens/effort/speed/temperature/thinking/contextWindow
+    // and pricing overrides for every call site in the assistant.
+    //
+    // Default values live on each leaf inside `LLMSchema` (see
+    // `schemas/llm.ts`), so `LLMSchema.parse({})` returns a fully-populated
+    // object. This matches the pattern used by sibling schemas above and
+    // ensures the loader's leaf-deletion recovery path can repair a partially
+    // invalid `llm` block without falling back to `cloneDefaultConfig()`.
+    llm: LLMSchema.default(LLMSchema.parse({})),
     filing: FilingConfigSchema.default(FilingConfigSchema.parse({})),
     heartbeat: HeartbeatConfigSchema.default(HeartbeatConfigSchema.parse({})),
     updates: UpdatesConfigSchema.default(UpdatesConfigSchema.parse({})),
     hostBrowser: HostBrowserConfigSchema.default(
       HostBrowserConfigSchema.parse({}),
     ),
+    conversations: ConversationsConfigSchema.default(
+      ConversationsConfigSchema.parse({}),
+    ),
     journal: JournalConfigSchema.default(JournalConfigSchema.parse({})),
     analysis: AnalysisConfigSchema.default(AnalysisConfigSchema.parse({})),
     backup: BackupConfigSchema.default(BackupConfigSchema.parse({})),
@@ -338,6 +334,19 @@ export const AssistantConfigSchema = z
       NotificationsConfigSchema.parse({}),
     ),
     ui: UiConfigSchema.default(UiConfigSchema.parse({})),
+    // Per-plugin config blocks keyed by plugin name. The schema is intentionally
+    // permissive — each plugin's manifest supplies its own validator which the
+    // plugin bootstrap (`external-plugins-bootstrap.ts`) runs against the raw
+    // block under `plugins.<name>` before handing the parsed result to the
+    // plugin's `init()`. Keeping this open here means adding a new plugin does
+    // not require a core-schema change, while invalid configs still surface
+    // through the plugin's own validator at bootstrap.
+    plugins: z
+      .record(z.string(), z.unknown())
+      .optional()
+      .describe(
+        "Per-plugin configuration keyed by plugin name. Validated downstream by each plugin's manifest.config validator at bootstrap.",
+      ),
     collectUsageData: z
       .boolean()
       .default(true)
@@ -364,30 +373,29 @@ export const AssistantConfigSchema = z
       ),
   })
   .superRefine((config, ctx) => {
+    const llmContextWindow = config.llm?.default?.contextWindow;
     if (
-      config.contextWindow?.targetBudgetRatio != null &&
-      config.contextWindow?.compactThreshold != null &&
-      config.contextWindow.targetBudgetRatio >=
-        config.contextWindow.compactThreshold
+      llmContextWindow?.targetBudgetRatio != null &&
+      llmContextWindow?.compactThreshold != null &&
+      llmContextWindow.targetBudgetRatio >= llmContextWindow.compactThreshold
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetBudgetRatio"],
+        path: ["llm", "default", "contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetBudgetRatio must be less than contextWindow.compactThreshold",
+          "llm.default.contextWindow.targetBudgetRatio must be less than llm.default.contextWindow.compactThreshold",
       });
     }
     if (
-      config.contextWindow?.targetBudgetRatio != null &&
-      config.contextWindow?.summaryBudgetRatio != null &&
-      config.contextWindow.targetBudgetRatio <=
-        config.contextWindow.summaryBudgetRatio
+      llmContextWindow?.targetBudgetRatio != null &&
+      llmContextWindow?.summaryBudgetRatio != null &&
+      llmContextWindow.targetBudgetRatio <= llmContextWindow.summaryBudgetRatio
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetBudgetRatio"],
+        path: ["llm", "default", "contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetBudgetRatio must be greater than contextWindow.summaryBudgetRatio",
+          "llm.default.contextWindow.targetBudgetRatio must be greater than llm.default.contextWindow.summaryBudgetRatio",
       });
     }
     const segmentation = config.memory?.segmentation;

package/src/config/schemas/analysis.ts

@@ -24,28 +24,9 @@ export const AnalysisConfigSchema = z
       .describe(
         "Milliseconds of idle time after the last message before the debounced analysis job fires",
       ),
-
-    // Optional model intent for the analysis agent loop. When omitted,
-    // the analysis agent uses the same model as the main agent.
-    // Accepted values match the main agent's model-intent vocabulary.
-    modelIntent: z
-      .enum(["latency-optimized", "quality-optimized", "vision-optimized"], {
-        error: "analysis.modelIntent must be a valid model intent",
-      })
-      .optional()
-      .describe(
-        "Model selection strategy for the analysis agent loop — falls back to the main agent's model when omitted",
-      ),
-
-    // Optional explicit model override (provider/model string). Takes
-    // precedence over modelIntent when both are set.
-    modelOverride: z
-      .string({ error: "analysis.modelOverride must be a string" })
-      .optional()
-      .describe(
-        "Explicit model override (provider/model string) for the analysis agent loop — takes precedence over modelIntent when both are set",
-      ),
   })
-  .describe("Controls the auto-analyze agent loop triggered by conversation activity");
+  .describe(
+    "Controls the auto-analyze agent loop triggered by conversation activity. Model selection lives under llm.callSites.analyzeConversation.",
+  );
 
 export type AnalysisConfig = z.infer<typeof AnalysisConfigSchema>;

package/src/config/schemas/backup.ts

@@ -54,7 +54,7 @@ export const BackupConfigSchema = z
       .int("backup.retention must be an integer")
       .min(1, "backup.retention must be >= 1")
       .max(100, "backup.retention must be <= 100")
-      .default(7)
+      .default(3)
       .describe("Number of recent backups to retain"),
     offsite: BackupOffsiteConfigSchema.default(
       BackupOffsiteConfigSchema.parse({}),

package/src/config/schemas/calls.ts

@@ -222,10 +222,6 @@ export const CallsConfigSchema = z
     ),
     safety: CallsSafetyConfigSchema.default(CallsSafetyConfigSchema.parse({})),
     voice: CallsVoiceConfigSchema.default(CallsVoiceConfigSchema.parse({})),
-    model: z
-      .string({ error: "calls.model must be a string" })
-      .optional()
-      .describe("Override the default model for phone call conversations"),
     callerIdentity: CallerIdentityConfigSchema.default(
       CallerIdentityConfigSchema.parse({}),
     ),

package/src/config/schemas/conversations.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+export const ConversationsConfigSchema = z
+  .object({
+    skipAutoRetitling: z
+      .boolean({
+        error: "conversations.skipAutoRetitling must be a boolean",
+      })
+      .default(false)
+      .describe(
+        "When true, skip the second-pass title regeneration that fires after the third user turn. The initial auto-generated title and manual renames are unaffected.",
+      ),
+  })
+  .describe("Conversation behavior configuration");
+
+export type ConversationsConfig = z.infer<typeof ConversationsConfigSchema>;

package/src/config/schemas/filing.ts

@@ -1,14 +1,12 @@
 import { z } from "zod";
 
-import { SpeedSchema } from "./inference.js";
-
 export const FilingConfigSchema = z
   .object({
     enabled: z
       .boolean({ error: "filing.enabled must be a boolean" })
       .default(true)
       .describe(
-        "Whether periodic PKB filing is enabled — processes buffer.md into topic files and reviews knowledge base organization",
+        "Whether periodic Personal Knowledge Base filing is enabled — processes buffer.md into topic files and reviews knowledge base organization",
       ),
     intervalMs: z
       .number({ error: "filing.intervalMs must be a number" })
@@ -16,9 +14,6 @@ export const FilingConfigSchema = z
       .positive("filing.intervalMs must be a positive integer")
       .default(4 * 3_600_000)
       .describe("Time between filing runs in milliseconds"),
-    speed: SpeedSchema.default("standard").describe(
-      "Inference speed mode for filing conversations",
-    ),
     activeHoursStart: z
       .number({ error: "filing.activeHoursStart must be a number" })
       .int("filing.activeHoursStart must be an integer")
@@ -41,7 +36,7 @@ export const FilingConfigSchema = z
       ),
   })
   .describe(
-    "Periodic PKB (personal knowledge base) filing — processes the buffer into topic files and maintains knowledge organization",
+    "Periodic Personal Knowledge Base filing — processes the buffer into topic files and maintains knowledge organization",
   )
   .superRefine((config, ctx) => {
     const startNull = config.activeHoursStart == null;

package/src/config/schemas/heartbeat.ts

@@ -1,7 +1,5 @@
 import { z } from "zod";
 
-import { SpeedSchema } from "./inference.js";
-
 export const HeartbeatConfigSchema = z
   .object({
     enabled: z
@@ -14,9 +12,6 @@ export const HeartbeatConfigSchema = z
       .positive("heartbeat.intervalMs must be a positive integer")
       .default(6 * 3_600_000)
       .describe("Time between heartbeat checks in milliseconds"),
-    speed: SpeedSchema.default("standard").describe(
-      "Inference speed mode for heartbeat conversations — defaults to standard to avoid inheriting the global fast mode multiplier",
-    ),
     activeHoursStart: z
       .number({ error: "heartbeat.activeHoursStart must be a number" })
       .int("heartbeat.activeHoursStart must be an integer")