@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/calls/voice-session-bridge.ts

@@ -55,6 +55,7 @@ import {
   stripInternalSpeechMarkers,
 } from "./voice-control-protocol.js";
 import {
+  createFrontDoorStreamGate,
   escalatedContinuationRule,
   ESCALATION_CONTINUATION_CONTENT,
   frontDoorCapabilityDigest,
@@ -407,18 +408,6 @@ export interface VoiceTurnHandle {
  * on a live phone call" framing (the session system prompt already
  * provides assistant identity) and guardian context (injected separately).
  */
-/**
- * Steering shared by every voice channel. A sign-in flow opens a browser
- * window mid-call that the caller may be unable to see or complete, whether it
- * is reached through a ui-surface tool or through shell and CLI tools (e.g.
- * `assistant oauth connect`). Tell the model to speak the limitation and defer
- * the flow to text chat instead.
- *
- * This outlives the ui-surface restriction it was written alongside: a
- * live-voice call can now show surfaces, but a browser window handing control
- * to a third party mid-call is a different problem, and one a minimized room
- * does not solve.
- */
 /**
  * How long a live-voice call waits on an approval before deciding it itself.
  *
@@ -429,8 +418,23 @@ export interface VoiceTurnHandle {
  */
 const VOICE_APPROVAL_TIMEOUT_MS = 45_000;
 
-export const VOICE_NO_SETUP_FLOWS_RULE =
-  "Never start account connections, OAuth or sign-in flows, or any other action that opens a browser window or needs the user's screen during this call — not even through shell or CLI tools. If the task needs one, say so briefly and offer to finish it in text chat after the call.";
+/**
+ * Telephony-only steering. A sign-in flow opens a browser window on a screen
+ * the caller does not have in front of them, whether it is reached through a
+ * ui-surface tool or through shell and CLI tools (e.g. `assistant oauth
+ * connect`). Tell the model to speak the limitation and defer the flow to text
+ * chat instead.
+ *
+ * Scoped to the phone because the screen is what decides it. A phone call has
+ * no screen, so the `open_url` signal a CLI tool can reach lands somewhere the
+ * caller will never see, and that signal bus carries no capability or
+ * conversation context, so this rule is the only thing standing in front of it
+ * here. A live-voice call is the opposite case: the user is holding the screen,
+ * and the room minimizes itself to hand it back (see
+ * LIVE_VOICE_SETUP_FLOW_TEACHING).
+ */
+const PHONE_NO_SETUP_FLOWS_RULE =
+  "Never start account connections, OAuth or sign-in flows, or any other action that opens a browser window or needs the user's screen during this call, not even through shell or CLI tools. If the task needs one, say so briefly and offer to finish it in text chat after the call.";
 
 /**
  * The pre-speech tail of the speak-the-caller's-language rule. A monolingual
@@ -551,7 +555,7 @@ function buildVoiceCallControlPrompt(opts: {
     '10. Do not make up information. If you are unsure, use [ASK_GUARDIAN: your question] to consult your guardian. For tool permission requests, use [ASK_GUARDIAN_APPROVAL: {"question":"...","toolName":"...","input":{...}}].',
     `11. Your text is sent directly to a text-to-speech engine. Never use markdown formatting (asterisks, headers, backticks, links) or emojis in your spoken responses. Write plain conversational text only. Protocol markers like ${opts.isCallerGuardian ? "[END_CALL]" : "[ASK_GUARDIAN: ...] and [END_CALL]"} are not spoken text and should still be used normally.`,
     `12. Speak the caller's language: reply in the language of the caller's most recent actual speech, and follow them if they switch languages mid-call. Synthetic user turns (parenthetical markers like the call-connected and verification-completed notices) are not caller speech and never set the language. Before the caller has spoken, such as on the opening greeting turn, ${preSpeechLanguageRuleFragment(config.services.stt.language, config.services.stt.provider)}.`,
-    `13. ${VOICE_NO_SETUP_FLOWS_RULE}`,
+    `13. ${PHONE_NO_SETUP_FLOWS_RULE}`,
   );
 
   // Triage-and-escalate routing rules. The front-door leg decides and may
@@ -1447,6 +1451,34 @@ export async function startVoiceTurn(
   // Set by the handle's discard(): the whole leg must leave no trace.
   let discarded = false;
 
+  // Verdict-first gate on the hub broadcast. A front-door leg's raw stream
+  // carries its routing verdict, so hub subscribers (web, passive devices)
+  // read it through the gate and see only the text the caller heard. Every
+  // other leg, including the escalated continuation that answers for real,
+  // broadcasts its deltas untouched.
+  const frontDoorStreamGate =
+    opts.routingLeg === "front-door"
+      ? createFrontDoorStreamGate(opts.unifiedVerdict === true)
+      : null;
+
+  /**
+   * Broadcast one agent-loop event to hub subscribers, holding a front-door
+   * leg's control-plane text back at the boundary rather than emitting it and
+   * repairing the transcript afterwards. Text released by the gate travels as
+   * an ordinary delta on the leg's own reserved row, so a client that renders
+   * the stream lands on the same text the teardown hygiene pass persists.
+   */
+  const broadcastLegEvent = (msg: AssistantEvent): void => {
+    if (frontDoorStreamGate === null || msg.type !== "assistant_text_delta") {
+      broadcastMessage(msg);
+      return;
+    }
+    const released = frontDoorStreamGate.push(msg.text);
+    if (released.length > 0) {
+      broadcastMessage({ ...msg, text: released });
+    }
+  };
+
   /**
    * Teardown transcript hygiene. Runs after the agent loop has fully
    * settled — including the stranded-content fold that finalizes an aborted
@@ -1474,6 +1506,12 @@ export async function startVoiceTurn(
    * the escalated leg — blocked on this turn's teardown — snapshots it, so
    * the quality model never sees the marker text either. Best-effort: a
    * hiccup here must not escalate into a turn-level failure.
+   *
+   * This pass owns the PERSISTED row, which the agent loop writes from the
+   * model's raw output regardless of what was broadcast. The live hub stream
+   * is gated separately by `broadcastLegEvent`, so the refetch this pass
+   * publishes confirms text a subscriber already holds instead of correcting
+   * it.
    */
   const finalizeVoiceLegTranscript = async (): Promise<void> => {
     if (reservedAssistantRowId == null) {
@@ -1617,7 +1655,24 @@ export async function startVoiceTurn(
           } else if (msg.type === "conversation_error") {
             lastError = msg.userMessage;
           }
-          broadcastMessage(msg);
+          if (frontDoorStreamGate !== null && msg.type === "message_complete") {
+            // A leg that completed mid-bridge (a holding phrase with no
+            // sentence terminator) still hands off and speaks what arrived,
+            // so release it ahead of the completion frame. A cancelled leg
+            // never hands off, and correspondingly never flushes.
+            const trailing = frontDoorStreamGate.finish();
+            if (trailing.length > 0) {
+              broadcastMessage({
+                type: "assistant_text_delta",
+                text: trailing,
+                ...(reservedAssistantRowId !== null
+                  ? { messageId: reservedAssistantRowId }
+                  : {}),
+                conversationId: opts.conversationId,
+              });
+            }
+          }
+          broadcastLegEvent(msg);
 
           // Forward voice-relevant events to the real-time event sink
           if (msg.type === "assistant_text_delta") {

package/src/calls/voice-triage-escalate.ts

@@ -221,6 +221,108 @@ export function classifyFrontDoorLeading(
   return "answer";
 }
 
+/**
+ * Verdict-first gate over a front-door leg's delta stream: given the leg's
+ * raw deltas in order, it releases only the text the caller actually hears.
+ * A front-door leg's raw stream is a control plane, not assistant speech,
+ * until its leading tokens classify, so anything downstream of the model
+ * that shows text to a person reads the stream through this gate.
+ *
+ * `push` returns the text released by that delta (empty while the gate is
+ * holding). `finish` is called when the leg completes normally and releases
+ * a bridge that stopped short of a sentence terminator. A leg that is
+ * cancelled instead spoke nothing past what `push` already released, so it
+ * simply never calls `finish`.
+ */
+export interface FrontDoorStreamGate {
+  push(deltaText: string): string;
+  finish(): string;
+}
+
+/**
+ * Build a {@link FrontDoorStreamGate}. `holdEnabled` mirrors
+ * {@link classifyFrontDoorLeading}: true only for speculative (unified
+ * front-door) legs, whose decision rule is the only one that teaches the
+ * hold token.
+ *
+ * The three verdicts release differently, matching what the caller hears:
+ *
+ * - `hold`: the leg is discarded and its row deleted, so nothing is ever
+ *   released.
+ * - `escalate`: the only spoken text is the capped holding phrase, released
+ *   in one piece once the bridge is complete (exactly what
+ *   {@link capEscalationBridge} yields, so the released text, the audio, and
+ *   the persisted row agree). The verdict token and anything streamed past
+ *   the cap are dropped. A bridge shorter than
+ *   {@link MIN_SPOKEN_BRIDGE_CHARS} releases nothing at all: the session
+ *   substitutes an audio-only canned fallback for it, so there is no
+ *   displayed text for the gate to agree with.
+ * - `answer`: the leg's output IS the reply, so every delta passes through,
+ *   including the leading text held back while the verdict was pending.
+ */
+export function createFrontDoorStreamGate(
+  holdEnabled: boolean,
+): FrontDoorStreamGate {
+  let raw = "";
+  let stage: "deciding" | "answer" | "bridging" | "done" = "deciding";
+  let bridgeRaw = "";
+  let releasedChars = 0;
+
+  const releaseBridge = (): string => {
+    stage = "done";
+    const capped = capEscalationBridge(bridgeRaw);
+    // Below the spoken threshold the session throws the model's bridge away
+    // and plays a canned fallback that is audio-only, deleting the row rather
+    // than persisting a phrase the model never really produced (see
+    // `usesFallbackBridge` in `live-voice-session.ts`). Releasing the capped
+    // text here would put words on a subscriber's screen that the caller never
+    // heard, which is the same spoken/displayed divergence this gate exists to
+    // prevent.
+    return capped.length < MIN_SPOKEN_BRIDGE_CHARS ? "" : capped;
+  };
+
+  return {
+    push(deltaText: string): string {
+      raw += deltaText;
+      if (stage === "done") {
+        return "";
+      }
+      if (stage === "bridging") {
+        bridgeRaw += deltaText;
+        return isEscalationBridgeComplete(bridgeRaw) ? releaseBridge() : "";
+      }
+      if (stage === "deciding") {
+        const verdict = classifyFrontDoorLeading(raw.trimStart(), holdEnabled);
+        if (verdict === "pending") {
+          return "";
+        }
+        if (verdict === "hold") {
+          stage = "done";
+          return "";
+        }
+        if (verdict === "escalate") {
+          stage = "bridging";
+          bridgeRaw = raw.trimStart().slice(ESCALATE_VERDICT_TOKEN.length);
+          return isEscalationBridgeComplete(bridgeRaw) ? releaseBridge() : "";
+        }
+        stage = "answer";
+      }
+      // Answer stage: release everything not yet released, which on the
+      // transition includes the leading text the pending verdict held.
+      const chunk = raw.slice(releasedChars);
+      releasedChars = raw.length;
+      return chunk;
+    },
+    finish(): string {
+      if (stage === "bridging") {
+        return releaseBridge();
+      }
+      stage = "done";
+      return "";
+    },
+  };
+}
+
 /**
  * The escalated leg runs as its own voice turn. Rather than re-persist the
  * caller's utterance (it is already in history from the front-door leg), the
@@ -273,8 +375,8 @@ export function frontDoorDecisionRule(opts?: {
           // Hold requires positive evidence of an unfinished sentence, never
           // mere uncertainty, because the two mistakes cost differently. A
           // false hold is silent: the verdict, the extension window, and the
-          // replay dispatch all elapse with the thinking frame and ack
-          // deferred until commit, roughly tripling felt latency. A false
+          // replay dispatch all elapse before the turn commits, roughly
+          // tripling felt latency. A false
           // release only answers a beat early, which barge-in absorbs.
           `- If the caller's words are visibly unfinished (a trailing conjunction, a dangling clause, a list still being dictated) output ONLY ${HOLD_VERDICT_TOKEN} and stop, no other text. Judge the words themselves: a complete question or statement means they are done, even when it is short or leans on earlier context ("What do you think?", "Why?", "And then?"). Callers may speak any language: those examples are English exemplars only, and completeness is judged by the grammar of the language being spoken. In verb-final languages such as Hindi, Japanese, or Korean the sentence-final verb usually marks completion, so a missing final verb is the unfinished signal, not a missing conjunction. Never hold merely because more could follow.`,
         ]

package/src/channels/__tests__/plugin-channel-declarations.test.ts

@@ -0,0 +1,161 @@
+/**
+ * Channels that installed plugins bring.
+ *
+ * `getWorkspacePluginsDir` is mocked to a scratch directory so these read real
+ * files off disk without touching the machine's workspace.
+ */
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const workspacePluginsDir = mkdtempSync(join(tmpdir(), "plugin-channels-"));
+
+const realPlatform = await import("../../util/platform.js");
+
+mock.module("../../util/platform.js", () => ({
+  ...realPlatform,
+  getWorkspacePluginsDir: () => workspacePluginsDir,
+}));
+
+const { discoverPluginChannels } = await import(
+  "../plugin-channel-declarations.js"
+);
+
+interface PluginOptions {
+  /** Contents of `channels/ingress.json`; omit for a plugin with no ingress. */
+  ingress?: string;
+  manifest?: Record<string, unknown>;
+}
+
+const INGRESS = JSON.stringify({
+  routes: [{ path: "events", kind: "http", description: "inbound" }],
+});
+
+function writePlugin(name: string, options: PluginOptions = {}): string {
+  const dir = join(workspacePluginsDir, name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify({ name, ...options.manifest }),
+  );
+  if (options.ingress !== undefined) {
+    mkdirSync(join(dir, "channels"), { recursive: true });
+    writeFileSync(join(dir, "channels", "ingress.json"), options.ingress);
+  }
+  return dir;
+}
+
+beforeEach(() => {
+  rmSync(workspacePluginsDir, { recursive: true, force: true });
+  mkdirSync(workspacePluginsDir, { recursive: true });
+});
+
+afterAll(() => {
+  rmSync(workspacePluginsDir, { recursive: true, force: true });
+});
+
+describe("discoverPluginChannels", () => {
+  test("a plugin is a channel because it declares ingress", async () => {
+    writePlugin("courier", {
+      ingress: INGRESS,
+      manifest: {
+        displayName: "Courier",
+        description: "Reach the assistant by carrier pigeon.",
+        icon: "send",
+      },
+    });
+
+    expect(await discoverPluginChannels()).toEqual([
+      {
+        id: "courier",
+        source: "plugin:courier",
+        label: "Courier",
+        subtitle: "Reach the assistant by carrier pigeon.",
+        icon: "send",
+        supportsVerification: false,
+        setupMessages: {
+          guardian: "I want to set up Courier. Can you help me?",
+          contact:
+            "I'd like to reach you on Courier. Can you help me get set up?",
+        },
+      },
+    ]);
+  });
+
+  test("ignores a plugin that declares no ingress", async () => {
+    // Presentation alone does not make a channel: reaching the assistant from
+    // outside is what one is, and ingress is where that is declared.
+    writePlugin("notes", { manifest: { displayName: "Notes", icon: "send" } });
+
+    expect(await discoverPluginChannels()).toEqual([]);
+  });
+
+  test("surfaces a channel whose ingress the gateway would reject", async () => {
+    // Validation belongs to the gateway, which owns the schema. A plugin with
+    // a broken declaration is a channel with broken ingress, and saying so
+    // beats dropping it off the page a guardian would look at.
+    writePlugin("courier", {
+      ingress: "{ not json",
+      manifest: { displayName: "Courier" },
+    });
+
+    expect((await discoverPluginChannels())[0]?.label).toBe("Courier");
+  });
+
+  test("skips a disabled plugin", async () => {
+    // Same source of truth the loader uses for hooks, tools and routes: a
+    // disabled plugin would otherwise offer a setup flow that cannot run.
+    const dir = writePlugin("courier", { ingress: INGRESS });
+    writeFileSync(join(dir, ".disabled"), "");
+
+    expect(await discoverPluginChannels()).toEqual([]);
+  });
+
+  test("refuses to let a plugin take a built-in channel's id", async () => {
+    // Two rows sharing an id would be ambiguous to any client keying on one,
+    // and letting the plugin win would let it impersonate a built-in.
+    writePlugin("slack", {
+      ingress: INGRESS,
+      manifest: { displayName: "Slack" },
+    });
+
+    expect(await discoverPluginChannels()).toEqual([]);
+  });
+
+  test("titles a plugin that names no display name", async () => {
+    // Presentation is best-effort, so a bare manifest costs a nicer title and
+    // never the row itself.
+    writePlugin("meeting-bot", { ingress: INGRESS });
+
+    expect(await discoverPluginChannels()).toMatchObject([
+      {
+        id: "meeting-bot",
+        source: "plugin:meeting-bot",
+        label: "Meeting Bot",
+        subtitle: "Provided by the Meeting Bot plugin",
+        icon: "message-square",
+      },
+    ]);
+  });
+
+  test("still lists a channel whose manifest cannot be read", async () => {
+    // The directory is the plugin's identity, so an unparseable manifest
+    // costs its presentation and not its existence.
+    const dir = writePlugin("courier", { ingress: INGRESS });
+    writeFileSync(join(dir, "package.json"), "{ not json");
+
+    expect((await discoverPluginChannels())[0]?.label).toBe("Courier");
+  });
+
+  test("never claims a plugin channel supports verification", async () => {
+    // There is no client-side verification flow for one, so clients render it
+    // display-only rather than pre-warming a status that cannot arrive.
+    writePlugin("courier", { ingress: INGRESS });
+
+    expect((await discoverPluginChannels())[0]?.supportsVerification).toBe(
+      false,
+    );
+  });
+});

package/src/channels/config.ts

@@ -86,6 +86,19 @@ const CHANNEL_POLICIES = {
       conversationStrategy: "continue_existing_conversation",
     },
   },
+  plugin: {
+    notification: {
+      // Every plugin-brought channel shares this row, so the answer has to
+      // hold for all of them. A reply to an inbound plugin message routes by
+      // `replyCallbackUrl` and does not read this flag; proactive notification
+      // does, and it needs a guardian binding plus a destination resolver to
+      // reach. Neither exists per-plugin, and `NotificationChannel` is derived
+      // from this flag, so enabling it would let the decision engine pick a
+      // channel that resolves to nothing for whichever plugin it landed on.
+      deliveryEnabled: false,
+      conversationStrategy: "continue_existing_conversation",
+    },
+  },
 } as const satisfies Record<ChannelId, ChannelNotificationPolicy>;
 
 export type ChannelPolicies = typeof CHANNEL_POLICIES;

package/src/channels/plugin-channel-declarations.ts

@@ -0,0 +1,108 @@
+/**
+ * Channels that installed plugins bring.
+ *
+ * A plugin is a channel because it declares ingress: `channels/ingress.json`
+ * is the list of routes the outside world may reach it on, and reaching the
+ * assistant from outside is what being a channel means. There is no second
+ * file saying so, and nothing a plugin can set to claim the status without
+ * declaring the reach that constitutes it.
+ *
+ * What the gateway does with that file is a separate matter, and stays the
+ * gateway's: validating the routes, digesting them, holding them behind a
+ * guardian's approval. This reads its presence and nothing else, so a
+ * declaration the gateway rejects still surfaces here. That is the honest
+ * report, the plugin is a channel and its ingress is broken, and it keeps a
+ * schema this module does not own from deciding what a settings page lists.
+ *
+ * Presentation comes from the plugin's own manifest, where a plugin's title,
+ * description and icon already belong. All three are optional and none gate
+ * anything: a plugin with ingress and a bare `package.json` still appears,
+ * titled from its directory.
+ */
+
+import { statSync } from "node:fs";
+import { join } from "node:path";
+
+import { isPluginDisabled } from "../plugins/disabled-state.js";
+import { parsePluginPresentation } from "../plugins/external-plugin-loader.js";
+import { listInstalledPluginDirs } from "../plugins/installed-plugin-dirs.js";
+import { type AvailableChannel, isChannelId } from "./types.js";
+
+/**
+ * The declaration that makes a plugin a channel. Owned by the gateway, which
+ * parses it; named here only to test for it.
+ */
+export const PLUGIN_INGRESS_MANIFEST_RELPATH = "channels/ingress.json";
+
+/** Icon for a plugin naming none. The generic "a message arrives here" glyph. */
+const FALLBACK_ICON = "message-square";
+
+/**
+ * Title for a plugin with no `displayName`.
+ *
+ * Derived rather than defaulted to the raw directory name so `meeting-bot`
+ * reads as "Meeting Bot" beside "Slack" and "Telegram". A plugin whose casing
+ * matters sets `displayName` and this never runs.
+ */
+function titleFromDirectory(name: string): string {
+  return name
+    .split(/[-_]/)
+    .filter((part) => part.length > 0)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join(" ");
+}
+
+/** True when the plugin declares ingress routes. */
+function declaresIngress(pluginDir: string): boolean {
+  return (
+    statSync(join(pluginDir, PLUGIN_INGRESS_MANIFEST_RELPATH), {
+      throwIfNoEntry: false,
+    })?.isFile() === true
+  );
+}
+
+/**
+ * Every channel brought by an installed, enabled plugin.
+ *
+ * A plugin whose directory name is one of the assistant's own channels is
+ * skipped: two rows sharing an id would be ambiguous to any client keying on
+ * one, and the resolution that lets a plugin win would let it impersonate a
+ * built-in channel. The assistant's keep the name.
+ *
+ * Disabled plugins are skipped too, matching the source of truth the loader
+ * uses for hooks, tools and routes: a disabled plugin holds no ingress either,
+ * and one that reappeared here would offer a setup flow that cannot run.
+ *
+ * Order follows the plugins directory, and is stable for a stable install set.
+ */
+export async function discoverPluginChannels(): Promise<AvailableChannel[]> {
+  const channels: AvailableChannel[] = [];
+
+  for (const { name, dir } of listInstalledPluginDirs()) {
+    if (isPluginDisabled(name) || isChannelId(name) || !declaresIngress(dir)) {
+      continue;
+    }
+    const presentation = await parsePluginPresentation(dir);
+    const label = presentation?.displayName ?? titleFromDirectory(name);
+    channels.push({
+      id: name,
+      source: `plugin:${name}`,
+      label,
+      subtitle: presentation?.description ?? `Provided by the ${label} plugin`,
+      icon: presentation?.icon ?? FALLBACK_ICON,
+      // No client-side verification flow exists for a plugin channel, so
+      // clients render it display-only and never pre-warm a status for it.
+      supportsVerification: false,
+      // Openers for a setup conversation, which is what this field is for.
+      // Deliberately not the verification copy the built-ins carry: there is
+      // no identity to verify here, and inventing that wording would send
+      // someone down a flow that does not exist.
+      setupMessages: {
+        guardian: `I want to set up ${label}. Can you help me?`,
+        contact: `I'd like to reach you on ${label}. Can you help me get set up?`,
+      },
+    });
+  }
+
+  return channels;
+}

package/src/channels/types.ts

@@ -51,6 +51,32 @@ export interface ChannelInfo {
   };
 }
 
+/**
+ * Source that contributes a channel, in the `<kind>[:<id>]` form the tool
+ * catalog and process tree already use: `default` for one the assistant ships,
+ * `plugin:<name>` for one an installed plugin brings.
+ *
+ * Composed from the plugin's install directory rather than from anything it
+ * declares, so a manifest cannot claim to be another source or pass itself off
+ * as built in.
+ */
+export type ChannelSource = "default" | `plugin:${string}`;
+
+/**
+ * A channel as `/v1/channels/available` reports it: the display metadata plus
+ * where it came from.
+ *
+ * `id` widens to a string here because a plugin channel's id is its plugin
+ * name, which is not a member of the closed {@link ChannelId} union. The union
+ * still governs everything the assistant routes, verifies and applies
+ * admission policy to; `source` is what tells a client which kind it is
+ * holding, so nothing has to infer it from the id.
+ */
+export interface AvailableChannel extends Omit<ChannelInfo, "id"> {
+  id: string;
+  source: ChannelSource;
+}
+
 /**
  * Per-channel display metadata for the channels the gateway can currently
  * surface to clients. Add an entry here when surfacing a new channel via
@@ -155,6 +181,10 @@ export const INTERFACE_IDS = [
   // device/service callbacks). Non-interactive — permission prompts route
   // through the guardian system, not an interactive client — and non-host-proxy.
   "route",
+  // Turns a plugin-brought channel delivered through the gateway. One id for
+  // every plugin, matching the `plugin` channel; which plugin it was is in
+  // `sourceMetadata.plugin`.
+  "plugin",
 ] as const;
 
 export type InterfaceId = (typeof INTERFACE_IDS)[number];

package/src/cli/AGENTS.md

@@ -123,10 +123,13 @@ registerFooCommand(program);
    _synchronously_ at command registration (so it can't be a lazy
    `import()`) may stay hoisted behind a scoped
    `// eslint-disable-next-line cli/no-daemon-internals` with a comment
-   explaining why. The only current case is `browser/operation-meta`, in
+   explaining why. The current cases are `browser/operation-meta`, in
    `commands/browser.ts` (it drives synchronous subcommand generation and
    deliberately pulls no Playwright graph) and `commands/browser.help.ts`
-   (which derives the declarative help from the same contract).
+   (which derives the declarative help from the same contract); and
+   `providers/speech-to-text/provider-catalog`, in `commands/stt.help.ts`
+   (a literal map behind type-only imports, which the help text reads to
+   name the providers that serve the batch transcription boundary).
 
 2. **Lazy-import daemon functionality inside the action.** Running daemon
    logic in-process is encouraged where it avoids an IPC round-trip (which

package/src/cli/commands/credentials.help.ts

@@ -293,8 +293,8 @@ encrypted vault with the specified metadata.
 Requires the assistant to be running with at least one connected client.
 
 This command BLOCKS until the user answers the prompt, so it returns only once
-the prompt has already closed. Tell the user what to paste BEFORE running it —
-anything said afterwards reaches them after the input is gone, and pointing
+the prompt has already closed. Tell the user what to paste BEFORE running it.
+Anything said afterwards reaches them after the input is gone, and pointing
 them at a closed prompt makes them re-submit a value that was already received.
 The --label and --description text renders inside the prompt itself, so put the
 instructions there rather than in a follow-up message.

package/src/cli/commands/inference-providers.ts

@@ -519,7 +519,7 @@ function attachLoginChatgptSubcommand(providers: Command): void {
             {
               body: {
                 name: connectionName,
-                provider: "openai",
+                provider: "chatgpt",
                 auth: authInput,
               },
             },

package/src/cli/commands/mcp.help.ts

@@ -7,7 +7,8 @@ export const mcpHelp: CliCommandHelp = {
   description: "Manage MCP (Model Context Protocol) servers",
   helpText: `
 MCP servers extend the assistant's capabilities with external tools. Servers
-are configured in the assistant's config.json under the mcp.servers key. Each
+are configured in the assistant's config.json under the mcp.servers key, or
+declared by an installed plugin in its root mcp.json. Each
 server uses one of three transport types:
 
   stdio             Local process communicating over stdin/stdout
@@ -28,13 +29,21 @@ Examples:
       description: "List configured MCP servers and their status",
       options: [{ flags: "--json", description: "Output as JSON" }],
       helpText: `
-Shows each configured MCP server with its current status and configuration:
+Shows each MCP server with its current status and configuration. Servers come
+from two places: the mcp.servers key in config.json, and the root mcp.json of
+any installed plugin that declares one.
 
-  Name         The server identifier used in config.json
-  Status       Health check result:
+  Name         The server identifier
+  Status       Health check result for workspace servers:
                  ✓  Connected and responding
                  ✗  Error or disabled
                  !  Needs authentication (OAuth required)
+               Plugin-declared servers report "declared" instead. They are
+               listed but not connected by the assistant, and they are not
+               health-checked, so no stored credential can reach a URL a
+               plugin chose.
+  Source       Shown only for plugin-declared servers, naming the plugin.
+               Servers from config.json print no Source line.
   Transport    stdio, sse, or streamable-http
   URL/Command  The server URL (sse/streamable-http) or command (stdio)
   Risk         Default risk level: low, medium, or high