@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/calls/__tests__/telephony-synthesis-language.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Telephony synthesis-language resolution.
+ *
+ * The pin half of this resolver is gated on whether the provider transcribing
+ * the call honors manual language selection, so these cover which provider
+ * that gate reads: the telephony role's, which is what the call dials.
+ */
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { setConfig } from "../../__tests__/helpers/set-config.js";
+import { resolveTelephonySynthesisLanguage } from "../telephony-synthesis-language.js";
+
+function seedStt(stt: Record<string, unknown>): void {
+  setConfig("services", { stt });
+}
+
+afterEach(() => {
+  setConfig("services", {});
+});
+
+describe("resolveTelephonySynthesisLanguage", () => {
+  test("a detected caller language outranks the configured pin", () => {
+    seedStt({ provider: "deepgram", language: "es" });
+
+    expect(resolveTelephonySynthesisLanguage("hi-IN")).toBe("hi");
+  });
+
+  test("reads the pin gate from the telephony role, not the global provider", () => {
+    // Whisper auto-detects and ignores services.stt.language, so reading the
+    // global provider drops the pin. The call is transcribed by the telephony
+    // role's deepgram, which is pinned to Hindi and honors it.
+    seedStt({
+      provider: "openai-whisper",
+      language: "hi",
+      roles: { telephony: { provider: "deepgram" } },
+    });
+
+    expect(resolveTelephonySynthesisLanguage()).toBe("hi");
+  });
+
+  test("a telephony role that auto-detects drops a pin the global would honor", () => {
+    // The inverse: the global honors the pin but no call reaches it, so
+    // hinting Hindi would contradict what the caller is actually heard by.
+    seedStt({
+      provider: "deepgram",
+      language: "hi",
+      roles: { telephony: { provider: "openai-whisper" } },
+    });
+
+    expect(resolveTelephonySynthesisLanguage()).toBeUndefined();
+  });
+
+  test("an unset telephony role reads the global provider", () => {
+    seedStt({
+      provider: "deepgram",
+      language: "hi",
+      roles: { liveVoice: { provider: "openai-whisper" } },
+    });
+
+    expect(resolveTelephonySynthesisLanguage()).toBe("hi");
+  });
+
+  test('"multi" is auto-detection, not a pin', () => {
+    seedStt({
+      provider: "openai-whisper",
+      language: "multi",
+      roles: { telephony: { provider: "deepgram" } },
+    });
+
+    expect(resolveTelephonySynthesisLanguage()).toBeUndefined();
+  });
+
+  test("no configured language yields no hint", () => {
+    seedStt({
+      provider: "openai-whisper",
+      roles: { telephony: { provider: "deepgram" } },
+    });
+
+    expect(resolveTelephonySynthesisLanguage()).toBeUndefined();
+  });
+});

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -390,6 +390,7 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
     );
     expect(fake.lastPersistOpts()?.metadata).toEqual({
       voiceSessionTurn: true,
+      scripted: true,
       hidden: true,
       messageKind: VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND,
     });
@@ -404,8 +405,11 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
 
     await startVoiceTurn(makeTurnOptions()); // content: CALL_OPENING_MARKER
 
+    // Visible AND scripted: the opener is shown, but the assistant wrote it,
+    // so it is not the user taking a turn.
     expect(fake.lastPersistOpts()?.metadata).toEqual({
       voiceSessionTurn: true,
+      scripted: true,
     });
   });
 
@@ -425,6 +429,7 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
     // analytics already read.
     expect(fake.lastPersistOpts()?.metadata).toEqual({
       voiceSessionTurn: true,
+      scripted: true,
       client: {
         voice: true,
         voice_session_id: "session-123",
@@ -444,10 +449,41 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
 
     expect(fake.lastPersistOpts()?.metadata).toEqual({
       voiceSessionTurn: true,
+      scripted: true,
       client: { voice: true, voice_session_id: "session-123" },
     });
   });
 
+  test("a turn the user really spoke is left unmarked, not marked false", async () => {
+    // Absent means UNKNOWN and falls through to the legacy classifier, which
+    // is the safe answer here. Stamping `false` would assert this turn was
+    // typed by the user, and a wrong `false` is trusted downstream.
+    const fake = makeFakeConversation({ processing: false });
+    fakeConversation = fake.conversation;
+
+    await startVoiceTurn({
+      ...makeTurnOptions(),
+      content: "what is on my calendar",
+    });
+
+    expect(fake.lastPersistOpts()?.metadata).not.toHaveProperty("scripted");
+  });
+
+  test("scripted is not derived from hidden", async () => {
+    // The two answer different questions, and the opener is the case that
+    // separates them: shown to the user, written by the assistant. Deriving
+    // one from the other lets every visible-but-scripted turn count as
+    // activation, which is the largest single source of funnel inflation.
+    const fake = makeFakeConversation({ processing: false });
+    fakeConversation = fake.conversation;
+
+    await startVoiceTurn(makeTurnOptions()); // content: CALL_OPENING_MARKER
+
+    const metadata = fake.lastPersistOpts()?.metadata;
+    expect(metadata?.scripted).toBe(true);
+    expect(metadata).not.toHaveProperty("hidden");
+  });
+
   test("a phone turn carries no client bag", async () => {
     const fake = makeFakeConversation({ processing: false });
     fakeConversation = fake.conversation;
@@ -501,6 +537,7 @@ describe("startVoiceTurn hiddenSyntheticPrompt", () => {
     expect(fake.lastPersistOpts()?.content).toBe(SYNTHETIC_CONTENT);
     expect(fake.lastPersistOpts()?.metadata).toEqual({
       voiceSessionTurn: true,
+      scripted: true,
       hidden: true,
     });
     expect(echoes).toHaveLength(0);
@@ -634,6 +671,26 @@ describe("default call protocol numbered rules", () => {
     }
   });
 
+  test("the pre-speech pin reads the telephony role, not the global provider", async () => {
+    // Whisper ignores services.stt.language, so reading the global provider
+    // drops the pin and opens in English. The caller is transcribed by the
+    // telephony role's deepgram, which is listening in Spanish.
+    setConfig("services", {
+      stt: {
+        provider: "openai-whisper",
+        language: "es",
+        roles: { telephony: { provider: "deepgram" } },
+      },
+    });
+    try {
+      const installed = captureInstalledPrompt();
+      await startVoiceTurn(makeTurnOptions());
+      expect(installed()).toContain('configured listening language ("es")');
+    } finally {
+      setConfig("services", {});
+    }
+  });
+
   test("a language pin on an auto-detecting provider keeps the English fallback", () => {
     // google-gemini and openai-whisper ignore services.stt.language entirely
     // (languageSelection: "auto"), so a persisted "es" pin must not force a

package/src/calls/media-stream-stt-session.ts

@@ -432,6 +432,7 @@ export class MediaStreamSttSession {
     let transcriber: StreamingTranscriber | null = null;
     try {
       transcriber = await resolveStreamingTranscriber({
+        role: "telephony",
         sampleRate: STREAMING_SAMPLE_RATE,
         utteranceBoundaryFinals: true,
         utteranceEndMs: getConfig().calls.voice.utteranceEndMs,
@@ -688,7 +689,7 @@ export class MediaStreamSttSession {
     // Resolve a batch transcriber for the configured provider.
     let transcriber;
     try {
-      transcriber = await resolveBatchTranscriber();
+      transcriber = await resolveBatchTranscriber({ role: "telephony" });
     } catch (err) {
       if (this.disposed) {
         return;

package/src/calls/telephony-synthesis-language.ts

@@ -7,14 +7,15 @@
  * is a no-op for providers that cannot). Resolution mirrors live voice's
  * per-utterance turn language (live-voice-session.ts): the caller's
  * latest STT-detected language when the transcriber tags finals, else a
- * monolingual `services.stt.language` pin when the configured provider
- * honors manual language selection, else undefined (no hint, provider
- * default behavior).
+ * monolingual `services.stt.language` pin when the provider serving the
+ * telephony role honors manual language selection, else undefined (no hint,
+ * provider default behavior).
  */
 
 import { getConfig } from "../config/loader.js";
 import type { AssistantConfig } from "../config/types.js";
 import { pinnedListeningLanguage } from "../providers/speech-to-text/provider-catalog.js";
+import { sttCatalogKeyForRole } from "../stt/roles.js";
 import { resolveLanguageVoiceOverride } from "../tts/language-voices.js";
 import { resolveTtsConfig } from "../tts/tts-config-resolver.js";
 import type { TtsProviderId } from "../tts/types.js";
@@ -37,7 +38,7 @@ export function resolveTelephonySynthesisLanguage(
     return detected;
   }
 
-  let stt: { provider: string; language?: string };
+  let stt: AssistantConfig["services"]["stt"];
   try {
     stt = getConfig().services.stt;
   } catch {
@@ -45,7 +46,14 @@ export function resolveTelephonySynthesisLanguage(
     return undefined;
   }
 
-  return pinnedListeningLanguage(stt.provider, stt.language);
+  // The pin only counts when the provider transcribing the call honors
+  // manual language selection, so the gate reads the telephony role rather
+  // than the global provider: those differ whenever a role override is set,
+  // and it is the role's transcriber the caller is actually heard by.
+  return pinnedListeningLanguage(
+    sttCatalogKeyForRole(stt, "telephony"),
+    stt.language,
+  );
 }
 
 /**

package/src/calls/voice-session-bridge.ts

@@ -43,6 +43,7 @@ import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
+import { sttCatalogKeyForRole } from "../stt/roles.js";
 import { getAllTools } from "../tools/registry.js";
 import { sensitiveToolReach } from "../tools/tool-approval-handler.js";
 import { createAbortReason } from "../util/abort-reasons.js";
@@ -478,12 +479,13 @@ const PHONE_NO_SETUP_FLOWS_RULE =
  * caller's language (the transcriber is already listening in it, see
  * media-stream-stt-session.ts and providers/speech-to-text/resolve.ts), so it
  * outranks the English default; "multi" and unset mean auto-detect, where
- * English remains the fallback. The pin only counts when the active provider
+ * English remains the fallback. The pin only counts when the provider
  * honors manual language selection (see pinnedListeningLanguage):
  * auto-detecting providers (gemini, whisper) ignore a persisted language
  * entirely, so greeting in it would contradict what the transcriber
- * actually hears. Exported for tests: the default test config exercises
- * only the auto-detect branch.
+ * actually hears. `sttProvider` is the telephony role's catalog key, since
+ * that is the transcriber the caller is heard by. Exported for tests: the
+ * default test config exercises only the auto-detect branch.
  */
 export function preSpeechLanguageRuleFragment(
   sttLanguage: string | undefined,
@@ -590,7 +592,7 @@ function buildVoiceCallControlPrompt(opts: {
     "9. After the opening greeting turn, treat the Task field as background context only — do not re-execute its instructions on subsequent turns.",
     '10. Do not make up information. If you are unsure, use [ASK_GUARDIAN: your question] to consult your guardian. For tool permission requests, use [ASK_GUARDIAN_APPROVAL: {"question":"...","toolName":"...","input":{...}}].',
     `11. Your text is sent directly to a text-to-speech engine. Never use markdown formatting (asterisks, headers, backticks, links) or emojis in your spoken responses. Write plain conversational text only. Protocol markers like ${opts.isCallerGuardian ? "[END_CALL]" : "[ASK_GUARDIAN: ...] and [END_CALL]"} are not spoken text and should still be used normally.`,
-    `12. Speak the caller's language: reply in the language of the caller's most recent actual speech, and follow them if they switch languages mid-call. Synthetic user turns (parenthetical markers like the call-connected and verification-completed notices) are not caller speech and never set the language. Before the caller has spoken, such as on the opening greeting turn, ${preSpeechLanguageRuleFragment(config.services.stt.language, config.services.stt.provider)}.`,
+    `12. Speak the caller's language: reply in the language of the caller's most recent actual speech, and follow them if they switch languages mid-call. Synthetic user turns (parenthetical markers like the call-connected and verification-completed notices) are not caller speech and never set the language. Before the caller has spoken, such as on the opening greeting turn, ${preSpeechLanguageRuleFragment(config.services.stt.language, sttCatalogKeyForRole(config.services.stt, "telephony"))}.`,
     `13. ${PHONE_NO_SETUP_FLOWS_RULE}`,
   );
 
@@ -1029,6 +1031,19 @@ export async function startVoiceTurn(
         // Durable "this turn came from an open voice session" marker; see
         // `isVoiceSessionUserMessage` for why the channel fields cannot carry it.
         voiceSessionTurn: true,
+        // Auto-sent on the user's behalf rather than spoken or typed by them,
+        // so activation metrics exclude it (see the `scripted` contract on the
+        // send route). Keyed off the synthetic set, NOT off
+        // `isHiddenSyntheticPrompt`: the two answer different questions, and
+        // deriving one from the other is what lets a visible-but-scripted turn
+        // through. `hidden` decides whether a human sees the row; `scripted`
+        // decides whether it counts as the user taking a turn.
+        //
+        // Only ever `true` here. A genuine voice turn is left absent rather
+        // than stamped `false`, because absent means UNKNOWN and falls through
+        // to the legacy classifier, while a wrong `false` is trusted
+        // downstream.
+        ...(isSyntheticVoicePrompt ? { scripted: true } : {}),
         ...(isHiddenSyntheticPrompt ? { hidden: true } : {}),
         ...(isEscalationContinuation
           ? { messageKind: VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND }

package/src/channels/config.ts

@@ -6,7 +6,7 @@
  * to compile until a policy is added below.
  */
 
-import type { ChannelId } from "./types.js";
+import { CHANNEL_IDS, type ChannelId } from "./types.js";
 
 export type ConversationStrategy =
   | "start_new_conversation"
@@ -77,12 +77,12 @@ const CHANNEL_POLICIES = {
     notification: {
       // Replies to an inbound Discord message do not read this flag: they
       // route by `replyCallbackUrl` through the channel transport. This gates
-      // proactive notification only, which needs a guardian binding to
-      // address and a destination resolver to reach it. Discord has neither,
-      // and `NotificationChannel` is derived from this flag, so enabling it
-      // early would let the decision engine pick a channel that resolves to
-      // nothing.
-      deliveryEnabled: false,
+      // proactive notification, which addresses the verified guardian
+      // directly: the adapter resolves a DM channel from the guardian
+      // binding's user snowflake, so a notification can never land in a
+      // guild room whose id merely looks like a DM's (both are bare
+      // snowflakes).
+      deliveryEnabled: true,
       conversationStrategy: "continue_existing_conversation",
     },
   },
@@ -110,20 +110,31 @@ export function getChannelPolicy(
   return CHANNEL_POLICIES[channelId];
 }
 
+/**
+ * The channels whose policy enables proactive delivery, derived from the
+ * registry's literal flags: flipping a channel's deliveryEnabled changes
+ * this union, and every exhaustive switch over it, at compile time.
+ */
+export type DeliverableChannelId = {
+  [K in keyof ChannelPolicies]: ChannelPolicies[K]["notification"]["deliveryEnabled"] extends true
+    ? K
+    : never;
+}[keyof ChannelPolicies];
+
 /**
  * Returns the list of channels where notification delivery is enabled.
  *
  * The return type is derived from the registry so downstream consumers
  * get a narrow union rather than the full ChannelId set.
  */
-export function getDeliverableChannels(): ChannelId[] {
-  return (Object.keys(CHANNEL_POLICIES) as ChannelId[]).filter(
-    (id) => CHANNEL_POLICIES[id].notification.deliveryEnabled,
-  );
+export function getDeliverableChannels(): DeliverableChannelId[] {
+  return CHANNEL_IDS.filter(isNotificationDeliverable);
 }
 
 /** Whether notification delivery is enabled for the given channel. */
-export function isNotificationDeliverable(channelId: ChannelId): boolean {
+export function isNotificationDeliverable(
+  channelId: ChannelId,
+): channelId is DeliverableChannelId {
   return CHANNEL_POLICIES[channelId].notification.deliveryEnabled;
 }
 

package/src/cli/AGENTS.md

@@ -12,12 +12,14 @@ Commands here operate on a **single running assistant's** local state — config
 
 For commands that manage the **lifecycle of assistant instances** (create, start, stop, delete), see `cli/AGENTS.md`.
 
-Examples: `config`, `contacts`, `memory`, `autonomy`, `conversations` belong here. `hatch`, `wake`, `sleep`, `retire`, `ps`, `ssh` belong in `cli/`.
+Examples: `config`, `contacts` (reads), `memory`, `autonomy`, `conversations` belong here. `hatch`, `wake`, `sleep`, `retire`, `ps`, `ssh` belong in `cli/`. Contact ACL writes belong on `gateway contacts`.
 
 ## Full CRUD for Resource Namespaces
 
 Every namespace that manages a resource (schedules, contacts, tasks, …) must expose the full CRUD surface — create, get/list, update, delete — each wired to a daemon route. Intentional exceptions (e.g. create restricted to one mode) must be documented inline in the namespace help text so agents know the gap is deliberate. Partial surfaces are not a smaller scope, they are a hazard: when a CRUD verb is missing, the model bypasses the CLI and hand-writes SQLite rows instead.
 
+**No write CLI for gateway-owned contact ACL.** Do not add `assistant contacts` verbs that persist contact ACL (risk ceilings, and any new ACL write). Those writes live on `gateway contacts`. `assistant contacts` may list and inspect.
+
 ## Conventions
 
 - Commands use [Commander.js](https://github.com/tj/commander.js) and follow the `registerXCommand(program: Command)` pattern.

package/src/cli/commands/backup.help.ts

@@ -11,8 +11,8 @@ trust rules, hooks, the SQLite database) as a .vbundle file. Credentials are
 NOT included — they live in the OS keychain / CES and users re-authenticate
 integrations after a restore (via the gateway). The automated worker runs on a configurable
 interval and writes to a local pool under ~/.vellum/backups/local/, optionally
-mirroring each snapshot to one or more offsite destinations (iCloud Drive by
-default).
+mirroring each snapshot to one or more offsite destinations. macOS uses
+encrypted iCloud Drive by default. Windows and Linux require an explicit path.
 
 Offsite destinations can be per-destination encrypted (AES-256-GCM) or
 plaintext — plaintext only makes sense when the user owns physical access to
@@ -70,11 +70,9 @@ Examples:
       description: "Manage offsite backup destinations",
       helpText: `
 Offsite destinations are absolute paths the backup worker writes a copy of
-each snapshot to after the local write succeeds. The default destination is
-the iCloud Drive VellumAssistant folder, and it is used implicitly until an
-explicit destinations array is configured. The first 'destinations add' or
-'destinations remove' materializes the iCloud default before applying the
-change, so the default is never lost on an accidental "clear all".
+each snapshot to after the local write succeeds. macOS uses the iCloud Drive
+VellumAssistant folder until an explicit destinations array is configured.
+Windows and Linux have no implicit offsite destination.
 
 Each destination has an 'encrypt' flag. When true (the default), snapshots
 are written as .vbundle.enc (AES-256-GCM). When false, snapshots are copied
@@ -90,9 +88,9 @@ Examples:
           name: "list",
           description: "List configured offsite destinations",
           helpText: `
-Resolves the current destinations array (materializing the iCloud default if
-no explicit array is configured) and prints a table with the path and
-encryption flag per row.
+Resolves the current destinations array and prints each path and encryption
+flag. On macOS this includes the implicit iCloud default when configured paths
+are null.
 
 Examples:
   $ assistant backup destinations list`,
@@ -114,9 +112,8 @@ Arguments:
          caller controls; the backup worker writes files inside this
          directory, not the directory itself.
 
-If backup.offsite.destinations is currently null (the implicit iCloud default),
-the iCloud default is materialized first so the new entry appends to a
-2-element array rather than replacing the default.
+On macOS, adding the first explicit destination preserves the implicit iCloud
+destination. Windows and Linux start with only the destination supplied here.
 
 Examples:
   $ assistant backup destinations add /Volumes/BackupSSD/vellum --plaintext

package/src/cli/commands/contacts.help.ts

@@ -75,9 +75,10 @@ Examples:
 Arguments:
   id   UUID of the contact to retrieve. Run 'assistant contacts list' to find IDs.
 
-Returns the full contact record including role, display name, and all
-channel memberships (phone numbers, Telegram IDs, email addresses, etc.).
-For assistant-type contacts, additional assistant metadata is included.
+Returns the full contact record including role, display name, assistant
+access ceiling, and all channel memberships (phone numbers, Telegram
+IDs, email addresses, etc.). For assistant-type contacts, additional
+assistant metadata is included.
 
 Examples:
   $ assistant contacts get 7a3b1c2d-4e5f-6789-abcd-ef0123456789
@@ -120,11 +121,22 @@ Examples:
             "How long to wait for the user to submit (ms). Defaults to match the server-side prompt timeout.",
           defaultValue: String(310_000),
         },
+        {
+          flags: "--verify",
+          description:
+            "Mark the submitted channel verified (same attest as Contacts Verify me)",
+        },
       ],
       helpText: `
 Opens a contact address prompt in the user's app. The user enters a channel
 address (phone number, email, Telegram ID, etc.). The address is saved with
-status "unverified". Verification is a separate step.
+status "unverified" unless --verify is set, which attests the channel the
+same way Contacts Verify me does.
+
+Examples:
+  $ assistant contacts prompt --channel phone --role guardian
+  $ assistant contacts prompt --channel imessage --role guardian --verify \\
+      --label "Your iMessage number" --placeholder "+15551234567"
 
 Run \`assistant contacts prompt --help\` for full option details.`,
     },

package/src/cli/commands/contacts.ts

@@ -35,6 +35,7 @@ interface ContactWithChannels {
   createdAt: string | number;
   updatedAt: string | number;
   interactionCount: number | null;
+  autoApproveThreshold?: string | null;
   channels: ContactChannel[];
 }
 
@@ -131,6 +132,7 @@ function formatContactDetail(
     lines.push(`Role:         ${c.role}`);
   }
   lines.push(`Type:         ${c.contactType}`);
+  lines.push(`Access:       ${c.autoApproveThreshold ?? "inherit"}`);
   if (c.notes) {
     lines.push(`Notes:        ${c.notes}`);
   }
@@ -262,6 +264,7 @@ export function registerContactsCommand(program: Command): void {
             label?: string;
             description?: string;
             timeout?: string;
+            verify?: boolean;
           },
           cmd: Command,
         ) => {
@@ -276,6 +279,7 @@ export function registerContactsCommand(program: Command): void {
                 role: opts.role ?? "unknown",
                 label: opts.label,
                 description: opts.description,
+                verify: opts.verify === true,
               },
             },
             { timeoutMs },
@@ -302,7 +306,7 @@ export function registerContactsCommand(program: Command): void {
               `Registered ${result.channelType} channel: ${result.address}\n` +
                 `  Channel ID: ${result.channelId}\n` +
                 `  Contact ID: ${result.contactId}\n` +
-                `  Status:     unverified\n`,
+                `  Status:     ${opts.verify ? "verified" : "unverified"}\n`,
             );
           }
         },

package/src/cli/commands/credentials.help.ts

@@ -178,7 +178,7 @@ Arguments:
   id   (optional) Credential UUID for lookup by ID
 
 Shows everything known about a credential without revealing the secret value.
-The secret is masked to show only the last 4 characters (e.g. ****c123).
+The secret is masked to show only the first 4 characters (e.g. cfat****).
 
 Displayed fields include: label, creation/update timestamps, allowed tools,
 allowed domains, OAuth2 scopes, account info, and injection template count.

package/src/cli/commands/inference-providers.ts

@@ -20,7 +20,6 @@
 import type { Command } from "commander";
 
 import { cliIpcCall } from "../../ipc/cli-client.js";
-import type { OAuth2Config } from "../../security/oauth2.js";
 import { subcommand } from "../lib/cli-command-help.js";
 import { writeCliError } from "../lib/cli-output.js";
 import { openInHostBrowser } from "../lib/open-browser.js";
@@ -448,19 +447,6 @@ function attachDeleteSubcommand(parent: Command): void {
   );
 }
 
-// ---------------------------------------------------------------------------
-// OpenAI Codex OAuth config (PKCE, no client secret)
-// ---------------------------------------------------------------------------
-
-const OPENAI_CODEX_OAUTH_CONFIG: OAuth2Config = {
-  authorizeUrl: "https://auth.openai.com/oauth/authorize",
-  tokenExchangeUrl: "https://auth.openai.com/oauth/token",
-  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-  scopes: ["openid", "profile", "email", "offline_access"],
-  scopeSeparator: " ",
-  authorizeParams: { id_token_add_organizations: "true" },
-};
-
 // ---------------------------------------------------------------------------
 // Subcommand: login-chatgpt
 // ---------------------------------------------------------------------------
@@ -469,10 +455,18 @@ function attachLoginChatgptSubcommand(providers: Command): void {
   subcommand(providers, "login-chatgpt").action(
     async (opts: { json?: boolean }) => {
       try {
-        // Deferred: loads the OAuth and secure-key graphs on demand.
-        const [{ startOAuth2Flow }, { setSecureKeyAsync }] = await Promise.all([
+        // Deferred: loads the OAuth and credential graphs on demand.
+        const [
+          { startOAuth2Flow },
+          {
+            CHATGPT_SUBSCRIPTION_AUTH_INPUT,
+            CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
+            OPENAI_OAUTH_CONFIG,
+            storeChatgptSubscriptionCredentials,
+          },
+        ] = await Promise.all([
           import("../../security/oauth2.js"),
-          import("../../security/secure-keys.js"),
+          import("../../providers/inference/chatgpt-subscription-credentials.js"),
         ]);
         // Step 1: Run browser-based PKCE OAuth flow
         if (!opts.json) {
@@ -481,7 +475,7 @@ function attachLoginChatgptSubcommand(providers: Command): void {
           );
         }
         const result = await startOAuth2Flow(
-          OPENAI_CODEX_OAUTH_CONFIG,
+          OPENAI_OAUTH_CONFIG,
           {
             openUrl: (url) => {
               openInHostBrowser(url);
@@ -496,43 +490,14 @@ function attachLoginChatgptSubcommand(providers: Command): void {
             loopbackCallbackPath: "/auth/callback",
           },
         );
-        const tokens = result.tokens;
-
         // Step 2: Store tokens in CES
-        const accessStored = await setSecureKeyAsync(
-          "credential/chatgpt/access_token",
-          tokens.accessToken,
-        );
-        if (!accessStored) {
-          writeCliError("Failed to store access token", opts.json);
-          return;
-        }
-
-        if (tokens.refreshToken) {
-          const refreshStored = await setSecureKeyAsync(
-            "credential/chatgpt/refresh_token",
-            tokens.refreshToken,
-          );
-          if (!refreshStored) {
-            writeCliError("Failed to store refresh token", opts.json);
-            return;
-          }
-        }
-
-        if (tokens.expiresIn) {
-          const expiresAt = Math.floor(Date.now() / 1000 + tokens.expiresIn);
-          await setSecureKeyAsync(
-            "credential/chatgpt/expires_at",
-            String(expiresAt),
-          );
-        }
+        await storeChatgptSubscriptionCredentials(result.tokens);
 
-        // Step 3: Create (or update) the provider entry via IPC
-        const connectionName = "chatgpt-subscription";
-        const authInput = {
-          type: "oauth_subscription",
-          credential: "credential/chatgpt/access_token",
-        };
+        // Step 3: Create (or update) the provider entry via IPC. The CLI runs
+        // outside the daemon and has no database handle, so the connection
+        // upsert goes over IPC rather than through the shared store helper.
+        const connectionName = CHATGPT_SUBSCRIPTION_CONNECTION_NAME;
+        const authInput = CHATGPT_SUBSCRIPTION_AUTH_INPUT;
 
         // Try to update first; if the entry doesn't exist, create it.
         const updateResult = await cliIpcCall<ProviderConnection>(

package/src/cli/commands/mcp.help.ts

@@ -97,8 +97,8 @@ Examples:
         },
         {
           flags: "-r, --risk <level>",
-          description: "Default risk level: low, medium, or high",
-          defaultValue: "high",
+          description:
+            "Risk level tools from this server start at: low, medium, or high",
         },
       ],
       helpText: `
@@ -110,9 +110,10 @@ Transport-specific requirements:
   sse               Requires --url pointing to the SSE endpoint
   streamable-http   Requires --url pointing to the HTTP endpoint
 
-The --risk flag sets the default risk level for all tools from this server
-(defaults to "high" if not specified). The server starts enabled unless
---disabled is passed.
+The --risk flag sets the risk level tools from this server start at. Omit it
+and the server tracks the shipped default, "medium". A tool's own MCP
+annotations move it one step from there: destructiveHint up, readOnlyHint
+down. The server starts enabled unless --disabled is passed.
 
 The --header (-H) flag adds custom HTTP headers to sse/streamable-http
 transports. Use it for Bearer Token or API Key authentication. The flag