@vellumai/assistant 0.11.8 → 0.11.9-staging.1

package/src/approvals/AGENTS.md

@@ -7,7 +7,7 @@ The end-to-end lifecycle of interactive guardian requests (approvals, questions)
 - **Rich delivery failures must degrade gracefully.** If delivering a rich approval prompt (e.g., Telegram inline buttons) fails, fall back to plain text with instructions (e.g., `Reply "yes" to approve`) — never auto-deny.
 - **Non-rich channels** (http-api) receive plain-text approval prompts. The conversational approval engine handles free-text responses.
 - **Race conditions:** Always check whether a decision has already been resolved before delivering the engine's optimistic reply. If `handleChannelDecision` returns `applied: false`, deliver an "already resolved" notice and return `stale_ignored`.
-- **Unified guardian decision primitive:** All guardian decision paths (callback buttons, conversational engine, channel reactions and text) must route through `applyGuardianDecision()` in `assistant/src/approvals/guardian-decision-primitive.ts`. Do not inline decision logic (CAS resolution, resolver dispatch, grant minting) at individual callsites.
+- **Unified guardian decision primitive:** All guardian decision paths (callback buttons, conversational engine, channel text) must route through `applyGuardianDecision()` in `assistant/src/approvals/guardian-decision-primitive.ts`. Do not inline decision logic (CAS resolution, resolver dispatch, grant minting) at individual callsites.
 
 ## Single-Guardian Invariant
 

package/src/channels/__tests__/gateway-guardian-requests.test.ts

@@ -327,21 +327,6 @@ describe("request lookups", () => {
     });
   });
 
-  test("getPendingRequestByDestinationMessageOrNull maps the destination triple", async () => {
-    ipcResponse = null;
-    expect(
-      await client.getPendingRequestByDestinationMessageOrNull(
-        "telegram",
-        "chat-456",
-        "msg-1",
-      ),
-    ).toBeNull();
-    expect(ipcCalls[0]).toEqual({
-      method: "guardian_requests_get_by_destination_message",
-      params: { channel: "telegram", chatId: "chat-456", messageId: "msg-1" },
-    });
-  });
-
   test("getPendingRequestByCallSession and getRequestByPendingQuestionOrNull map params", async () => {
     const request = makeWireRequest({ callSessionId: "call-1" });
     ipcResponse = request;
@@ -378,18 +363,11 @@ describe("request lookups", () => {
 
     ipcError = new Error("gateway unavailable");
     expect(await client.getGuardianRequestByCodeOrNull("AB12")).toBeNull();
-    expect(
-      await client.getPendingRequestByDestinationMessageOrNull(
-        "telegram",
-        "chat-456",
-        "msg-1",
-      ),
-    ).toBeNull();
     expect(
       await client.getPendingRequestByCallSessionOrNull("call-1"),
     ).toBeNull();
     expect(await client.getRequestByPendingQuestionOrNull("pq-1")).toBeNull();
-    expect(warnCalls).toHaveLength(5);
+    expect(warnCalls).toHaveLength(4);
   });
 
   test("OrNull variants pass successful reads through untouched", async () => {

package/src/channels/__tests__/types.test.ts

@@ -21,6 +21,7 @@ describe("INTERFACE_IDS", () => {
     for (const id of [
       "macos",
       "windows",
+      "linux",
       "ios",
       "cli",
       "telegram",
@@ -45,6 +46,7 @@ describe("INTERACTIVE_INTERFACES", () => {
   test("includes desktop clients", () => {
     expect(INTERACTIVE_INTERFACES.has("macos")).toBe(true);
     expect(INTERACTIVE_INTERFACES.has("windows")).toBe(true);
+    expect(INTERACTIVE_INTERFACES.has("linux")).toBe(true);
   });
 });
 
@@ -56,6 +58,7 @@ describe("isInterfaceId", () => {
   test("returns true for desktop interfaces", () => {
     expect(isInterfaceId("macos")).toBe(true);
     expect(isInterfaceId("windows")).toBe(true);
+    expect(isInterfaceId("linux")).toBe(true);
   });
 
   test("returns false for unknown interface", () => {
@@ -72,6 +75,7 @@ describe("parseInterfaceId", () => {
     expect(parseInterfaceId("web")).toBe("web");
     expect(parseInterfaceId("macos")).toBe("macos");
     expect(parseInterfaceId("windows")).toBe("windows");
+    expect(parseInterfaceId("linux")).toBe("linux");
   });
 
   test("normalizes legacy 'vellum' alias to 'web'", () => {
@@ -117,6 +121,16 @@ describe("supportsHostProxy", () => {
     expect(supportsHostProxy("windows", "host_app_control")).toBe(false);
   });
 
+  test("linux exposes the same host capabilities as windows", () => {
+    expect(supportsHostProxy("linux")).toBe(true);
+    expect(supportsHostProxy("linux", "host_bash")).toBe(true);
+    expect(supportsHostProxy("linux", "host_file")).toBe(true);
+    expect(supportsHostProxy("linux", "host_cu")).toBe(true);
+    expect(supportsHostProxy("linux", "host_browser")).toBe(true);
+    expect(supportsHostProxy("linux", "host_ui_snapshot")).toBe(true);
+    expect(supportsHostProxy("linux", "host_app_control")).toBe(false);
+  });
+
   // ── chrome-extension: only host_browser. ──
   test("chrome-extension returns false (no capability)", () => {
     // Chrome extension does not support "any host proxy at all" — it only
@@ -185,13 +199,20 @@ describe("parseClientOs", () => {
     );
   });
 
+  test("includes linux (Electron desktop client)", () => {
+    expect(parseClientOs("linux")).toBe("linux");
+    expect((CLIENT_OS_VALUES as readonly string[]).includes("linux")).toBe(
+      true,
+    );
+  });
+
   test("rejects transport-only interface ids and unknown values", () => {
     // `clientOs` is an OS surface, not a transport interface — values like
     // "cli"/"telegram" (real interfaces) are not valid OS surfaces.
     expect(parseClientOs("cli")).toBeNull();
     expect(parseClientOs("telegram")).toBeNull();
     expect(parseClientOs("vellum")).toBeNull();
-    expect(parseClientOs("linux")).toBeNull();
+    expect(parseClientOs("plan9")).toBeNull();
     expect(parseClientOs(undefined)).toBeNull();
     expect(parseClientOs(42)).toBeNull();
   });

package/src/channels/gateway-guardian-requests.ts

@@ -301,28 +301,6 @@ export async function listGuardianRequestDeliveriesByChat(
   );
 }
 
-/**
- * Reaction routing: the pending request whose delivered card is the
- * reacted-to message. Throws on transport failure.
- */
-async function getPendingRequestByDestinationMessage(
-  channel: string,
-  chatId: string,
-  messageId: string,
-): Promise<GuardianRequestWire | null> {
-  return callGateway(
-    GUARDIAN_REQUESTS_IPC_METHODS.getByDestinationMessage,
-    { channel, chatId, messageId },
-    GuardianRequestLookupIpcResponseSchema,
-  );
-}
-
-/** `getPendingRequestByDestinationMessage` deny-path variant: degrades to null. */
-export const getPendingRequestByDestinationMessageOrNull = degradeOnFailure(
-  getPendingRequestByDestinationMessage,
-  null,
-);
-
 /**
  * Reply routing: pending requests delivered to a destination conversation
  * (`conversationId`, optionally narrowed by `channel`) or chat

package/src/channels/types.ts

@@ -187,6 +187,7 @@ export const CHANNEL_METADATA: Partial<Record<ChannelId, ChannelInfo>> = {
 export const INTERFACE_IDS = [
   "macos",
   "windows",
+  "linux",
   "ios",
   "cli",
   "telegram",
@@ -263,6 +264,7 @@ export const CLIENT_OS_VALUES = [
   "ios",
   "macos",
   "windows",
+  "linux",
   "android",
 ] as const;
 
@@ -286,6 +288,7 @@ export function parseClientOs(value: unknown): ClientOs | null {
 export const INTERACTIVE_INTERFACES: ReadonlySet<InterfaceId> = new Set([
   "macos",
   "windows",
+  "linux",
   "ios",
   "cli",
   "web",
@@ -297,8 +300,8 @@ export function isInteractiveInterface(id: InterfaceId): boolean {
 
 /**
  * Host proxy capabilities that an interface can support. macOS supports all
- * of them, Windows withholds app control, and chrome-extension supports only
- * host_browser through the Chrome DevTools Protocol proxy.
+ * of them, Windows and Linux withhold app control, and chrome-extension
+ * supports only host_browser through the Chrome DevTools Protocol proxy.
  */
 export const HOST_PROXY_CAPABILITIES = [
   "host_bash",
@@ -317,10 +320,9 @@ export type HostProxyCapability = (typeof HOST_PROXY_CAPABILITIES)[number];
  * `supportsHostProxy(id)` type predicate.
  *
  * Extend this literal type AND the `supportsHostProxy` implementation
- * below in lock-step when adding a new host-capable client such as native
- * Linux.
+ * below in lock-step when adding a new host-capable client.
  */
-export type HostProxyInterfaceId = "macos" | "windows";
+export type HostProxyInterfaceId = "macos" | "windows" | "linux";
 
 /**
  * Whether the interface supports a host proxy capability.
@@ -352,7 +354,7 @@ export function supportsHostProxy(
   if (id === "macos") {
     return true;
   }
-  if (id === "windows") {
+  if (id === "windows" || id === "linux") {
     return capability == null || capability !== "host_app_control";
   }
   if (id === "chrome-extension" && capability === "host_browser") {

package/src/cli/__tests__/catalog-search-help.test.ts

@@ -9,6 +9,7 @@
 import { describe, expect, test } from "bun:test";
 
 import { buildCliCommandHelpContent } from "../../plugins/defaults/memory/substrate/cli-command-content.js";
+import { channelsHelp } from "../commands/channels/index.help.js";
 import { pluginsHelp } from "../commands/plugins.help.js";
 import { skillsHelp } from "../commands/skills.help.js";
 
@@ -33,6 +34,8 @@ describe("catalog search help for setup-intent retrieval", () => {
     expect(indexed.toLowerCase()).toContain("before searching the web");
     expect(indexed).toContain("assistant plugins search");
     expect(indexed).toContain("assistant skills search");
+    expect(indexed.toLowerCase()).toContain("channels");
+    expect(pluginsHelp.description).toContain("channels");
     expect(indexed.toLowerCase()).not.toContain("empty query");
   });
 
@@ -47,4 +50,13 @@ describe("catalog search help for setup-intent retrieval", () => {
     expect(indexed).toContain("assistant skills search");
     expect(indexed).toContain("try web search");
   });
+
+  test("channels help points missing channels at plugin search", () => {
+    const indexed = buildCliCommandHelpContent(channelsHelp);
+    const list = channelsHelp.subcommands?.find((sub) => sub.name === "list");
+
+    expect(list?.helpText).toBeDefined();
+    expect(indexed).toContain("assistant plugins search <name>");
+    expect(indexed).toContain("not listed");
+  });
 });

package/src/cli/commands/channels/__tests__/channels.test.ts

@@ -89,6 +89,32 @@ describe("assistant channels", () => {
         queryParams: { includeRemote: "true" },
       });
     });
+
+    test("human list output points missing channels at plugin search", async () => {
+      mockResponses = [
+        {
+          ok: true,
+          result: { success: true, snapshots: [emptySnapshot("slack")] },
+        },
+      ];
+      const out = await runCli("channels", "list");
+      expect(out).toContain("assistant plugins search <name>");
+      expect(out).toContain("not listed");
+    });
+
+    test("json list output omits the plugin-search hint", async () => {
+      mockResponses = [
+        {
+          ok: true,
+          result: { success: true, snapshots: [emptySnapshot("slack")] },
+        },
+      ];
+      const out = await runCli("channels", "list", "--json");
+      expect(out).not.toContain("assistant plugins search");
+      expect(JSON.parse(out)).toEqual({
+        snapshots: [emptySnapshot("slack")],
+      });
+    });
   });
 
   describe("two-axis rendering", () => {

package/src/cli/commands/channels/index.help.ts

@@ -14,6 +14,9 @@ export const KNOWN_CHANNELS = [
   "a2a",
 ] as const;
 
+export const CHANNELS_PLUGIN_SEARCH_HINT =
+  "If the channel you are looking for is not listed, search the plugin marketplace with 'assistant plugins search <name>'.";
+
 export const channelsHelp: CliCommandHelp = {
   name: "channels",
   description:
@@ -23,6 +26,9 @@ Channels are the messaging surfaces the assistant talks over — slack,
 telegram, whatsapp, email, phone, vellum, platform, a2a. Each channel
 has a probe that reports whether it's configured and reachable.
 
+${CHANNELS_PLUGIN_SEARCH_HINT} Plugins can bundle additional channels
+from other Vellum users.
+
   list                    Overview of every channel + ready state
   get <channel>           Live snapshot of one channel (always re-probes)
 
@@ -45,6 +51,14 @@ Examples:
           defaultValue: false,
         },
       ],
+      helpText: `
+Shows readiness for every built-in channel.
+
+${CHANNELS_PLUGIN_SEARCH_HINT}
+
+Examples:
+  $ assistant channels list
+  $ assistant channels list --json`,
     },
     {
       name: "get",
@@ -53,7 +67,7 @@ Examples:
       arguments: [
         {
           name: "<channel>",
-          description: `Channel id: ${KNOWN_CHANNELS.join(", ")}`,
+          description: `Channel id: ${KNOWN_CHANNELS.join(", ")}. If the channel is not in this list, run 'assistant plugins search <name>'.`,
         },
       ],
       options: [

package/src/cli/commands/channels/index.ts

@@ -20,7 +20,7 @@ import { applyCommandHelp, subcommand } from "../../lib/cli-command-help.js";
 import { registerCommand } from "../../lib/register-command.js";
 import { log } from "../../logger.js";
 import { shouldOutputJson, writeOutput } from "../../output.js";
-import { channelsHelp } from "./index.help.js";
+import { CHANNELS_PLUGIN_SEARCH_HINT, channelsHelp } from "./index.help.js";
 
 // ---------------------------------------------------------------------------
 // Snapshot shape
@@ -95,6 +95,8 @@ function renderList(snapshots: ChannelSnapshot[]): void {
   for (const s of sorted) {
     log.info(`${statusGlyph(s)} ${s.channel.padEnd(12)}  ${statusState(s)}`);
   }
+  log.info("");
+  log.info(CHANNELS_PLUGIN_SEARCH_HINT);
 }
 
 function renderSnapshot(s: ChannelSnapshot): void {
@@ -185,7 +187,9 @@ export function registerChannelsCommand(program: Command): void {
             (s) => s.channel === channel,
           );
           if (!snapshot) {
-            log.error(`No readiness probe registered for channel: ${channel}`);
+            log.error(
+              `No readiness probe registered for channel: ${channel}. If you are looking for a community channel, run 'assistant plugins search ${channel}'.`,
+            );
             process.exitCode = 1;
             return;
           }

package/src/cli/commands/db/__tests__/status.test.ts

@@ -169,6 +169,8 @@ describe("assistant db status — happy path", () => {
     // (memory_checkpoints has 3 rows.)
     expect(stdout).toContain("Largest tables");
     expect(stdout.indexOf("messages")).toBeLessThan(stdout.indexOf("small"));
+    expect(stdout).toContain("Schema contract");
+    expect(stdout).toContain("missing");
   });
 
   test("reports the latest 'completed' migration, ignoring 'started'", async () => {
@@ -212,6 +214,26 @@ describe("assistant db status — happy path", () => {
     expect(parsed.db.largest.length).toBeGreaterThan(0);
     // Either 'bytes' (if dbstat is available) or 'rows' fallback.
     expect(["bytes", "rows"]).toContain(parsed.db.sizingMethod);
+    expect(Array.isArray(parsed.schemaContract.missingTables)).toBe(true);
+    expect(Array.isArray(parsed.schemaContract.missingColumns)).toBe(true);
+    // The seed is a 3-table stub, so the drizzle catalog reports misses.
+    expect(parsed.schemaContract.missingTables.length).toBeGreaterThan(0);
+  });
+
+  test("reports conversations.fork_strategy when the table exists without that column", async () => {
+    seedDb();
+    const db = new Database(dbPath);
+    try {
+      db.exec(`CREATE TABLE conversations (id TEXT PRIMARY KEY, title TEXT)`);
+    } finally {
+      db.close();
+    }
+
+    const { stdout, exitCode } = await runStatus(["status"]);
+
+    expect(exitCode).toBe(0);
+    expect(stdout).toContain("Schema contract");
+    expect(stdout).toContain("conversations.fork_strategy");
   });
 });
 

package/src/cli/commands/db/index.help.ts

@@ -12,7 +12,7 @@ export const dbHelp: CliCommandHelp = {
     {
       name: "status",
       description:
-        "Show database path, size, key pragmas, and the 5 largest tables",
+        "Show database path, size, key pragmas, largest tables, and drizzle schema misses",
     },
     {
       name: "repair",

package/src/cli/commands/db/status.ts

@@ -16,6 +16,8 @@
  *     callers will see the row-count path today)
  *   - latest applied workspace migration (proxy for schema version, read
  *     from the `memory_checkpoints` rows the migration runner writes)
+ *   - drizzle-vs-SQLite schema contract (columns the current binary
+ *     selects that no live database file has)
  *   - file mtime + age, for "is this DB live?" triage at a glance
  *
  * If the DB file is missing, exits with code 1 after a loud error. If the file
@@ -28,6 +30,7 @@ import { Database } from "bun:sqlite";
 
 import type { Command } from "commander";
 
+import type { SchemaContractReport } from "../../../persistence/schema-contract.js";
 import { getLogsDbPath } from "../../../util/logs-db-path.js";
 import { getMemoryDbPath } from "../../../util/memory-db-path.js";
 import { getDbPath } from "../../../util/platform.js";
@@ -110,6 +113,12 @@ interface StatusReport {
    */
   telemetryFile?: FileFacts;
   telemetryDb?: DbFacts | null;
+  /**
+   * Drizzle source catalog vs the union of columns in every live SQLite
+   * file (main, logs, memory, telemetry). Extra SQLite-only columns are
+   * ignored. Omitted when the main file could not be opened.
+   */
+  schemaContract?: SchemaContractReport;
 }
 
 interface MigrationSummary {
@@ -260,6 +269,83 @@ function readDbFacts(path: string): DbFacts {
   }
 }
 
+/** Quote a SQLite identifier that came from sqlite_master (never user input). */
+function quoteIdent(name: string): string {
+  return `"${name.replaceAll('"', '""')}"`;
+}
+
+/**
+ * Read table → column names from one SQLite file. Skips `sqlite_*`
+ * internals and tables whose `PRAGMA table_info` fails.
+ */
+function readSqliteColumns(path: string): Map<string, Set<string>> {
+  const db = new Database(path, { readonly: true });
+  try {
+    const tables = db
+      .query<{ name: string }, []>(
+        `SELECT name FROM sqlite_master
+         WHERE type='table' AND name NOT LIKE 'sqlite_%'`,
+      )
+      .all();
+    const out = new Map<string, Set<string>>();
+    for (const table of tables) {
+      try {
+        const columns = db
+          .query<{ name: string }, []>(
+            `PRAGMA table_info(${quoteIdent(table.name)})`,
+          )
+          .all();
+        out.set(table.name, new Set(columns.map((column) => column.name)));
+      } catch {
+        // Virtual or unreadable table. Skip so one failure does not hide
+        // the rest of the contract.
+      }
+    }
+    return out;
+  } finally {
+    db.close();
+  }
+}
+
+/** Union column sets from several files. Same table name keeps every column. */
+function mergeSqliteColumns(
+  files: Array<Map<string, Set<string>>>,
+): Map<string, Set<string>> {
+  const merged = new Map<string, Set<string>>();
+  for (const file of files) {
+    for (const [table, columns] of file) {
+      const existing = merged.get(table);
+      if (!existing) {
+        merged.set(table, new Set(columns));
+        continue;
+      }
+      for (const column of columns) {
+        existing.add(column);
+      }
+    }
+  }
+  return merged;
+}
+
+async function readSchemaContract(
+  paths: string[],
+): Promise<SchemaContractReport> {
+  // Lazy so the drizzle catalog stays out of the CLI's static graph
+  // (cli/no-daemon-internals).
+  const { diffDrizzleSchemaContract } =
+    await import("../../../persistence/schema-contract.js");
+  const live: Array<Map<string, Set<string>>> = [];
+  for (const path of paths) {
+    try {
+      live.push(readSqliteColumns(path));
+    } catch {
+      // File vanished or is unreadable. The main-file open already
+      // succeeded; skip this sidecar rather than fail the report.
+    }
+  }
+  return diffDrizzleSchemaContract(mergeSqliteColumns(live));
+}
+
 // ---------------------------------------------------------------------------
 // Rendering
 // ---------------------------------------------------------------------------
@@ -350,6 +436,7 @@ function renderHuman(report: StatusReport): string {
   // Cross-database migration summary — the checkpoint ledger lives only in
   // the main DB, so this is a single block at the end covering all three.
   out += renderSummary(report.migration);
+  out += renderSchemaContract(report.schemaContract);
 
   return out;
 }
@@ -469,6 +556,72 @@ function renderSummary(migration: MigrationSummary | undefined): string {
   return out;
 }
 
+const HUMAN_COLUMN_MISS_LIMIT = 40;
+const HUMAN_TABLE_MISS_LIMIT = 15;
+
+function schemaContractIsClean(report: SchemaContractReport): boolean {
+  return (
+    report.missingTables.length === 0 && report.missingColumns.length === 0
+  );
+}
+
+function renderMissList(labels: string[], limit: number): string {
+  let out = "";
+  const shown = labels.slice(0, limit);
+  for (const label of shown) {
+    out += `  ${label}\n`;
+  }
+  if (labels.length > limit) {
+    out += `  … and ${formatCount(labels.length - limit)} more\n`;
+  }
+  return out;
+}
+
+function renderSchemaContract(
+  contract: SchemaContractReport | undefined,
+): string {
+  if (!contract) {
+    return "";
+  }
+
+  let out = "\nSchema contract (drizzle vs SQLite)\n";
+  if (schemaContractIsClean(contract)) {
+    out += row("Status", "ok");
+    return out;
+  }
+
+  const parts: string[] = [];
+  if (contract.missingColumns.length > 0) {
+    parts.push(
+      `${formatCount(contract.missingColumns.length)} missing column${
+        contract.missingColumns.length === 1 ? "" : "s"
+      }`,
+    );
+  }
+  if (contract.missingTables.length > 0) {
+    parts.push(
+      `${formatCount(contract.missingTables.length)} missing table${
+        contract.missingTables.length === 1 ? "" : "s"
+      }`,
+    );
+  }
+  out += row("Status", red(parts.join(", ")));
+
+  if (contract.missingColumns.length > 0) {
+    out += "Missing columns\n";
+    out += renderMissList(
+      contract.missingColumns.map((miss) => `${miss.table}.${miss.column}`),
+      HUMAN_COLUMN_MISS_LIMIT,
+    );
+  }
+  if (contract.missingTables.length > 0) {
+    out += "Missing tables\n";
+    out += renderMissList(contract.missingTables, HUMAN_TABLE_MISS_LIMIT);
+  }
+
+  return out;
+}
+
 function renderMissing(path: string): string {
   return (
     `${red("ERROR")}  Database not found at ${path}\n\n` +
@@ -487,7 +640,7 @@ function renderMissing(path: string): string {
 // ---------------------------------------------------------------------------
 
 export function registerDbStatus(parent: Command): void {
-  subcommand(parent, "status").action(function (this: Command) {
+  subcommand(parent, "status").action(async function (this: Command) {
     const file = readFileFacts(getDbPath());
 
     if (!file.exists) {
@@ -561,10 +714,28 @@ export function registerDbStatus(parent: Command): void {
       migration = null;
     }
 
+    const schemaPaths = [file.path];
+    if (logsFile.exists) {
+      schemaPaths.push(logsFile.path);
+    }
+    if (memoryFile.exists) {
+      schemaPaths.push(memoryFile.path);
+    }
+    if (telemetryFile.exists) {
+      schemaPaths.push(telemetryFile.path);
+    }
+    let schemaContract: SchemaContractReport | undefined;
+    try {
+      schemaContract = await readSchemaContract(schemaPaths);
+    } catch {
+      schemaContract = undefined;
+    }
+
     const report: StatusReport = {
       file,
       db,
       migration: migration ?? undefined,
+      schemaContract,
       logsFile,
       logsDb,
       memoryFile,

package/src/cli/commands/platform/__tests__/connect.test.ts

@@ -69,6 +69,35 @@ describe("assistant platform connect", () => {
     expect(parsed.showPlatformLogin).toBe(true);
   });
 
+  // A stored key the platform rejects is a recovery, not a first setup: the
+  // outcome has to reach the caller in the response, since the daemon's login
+  // signal has no shipped consumer.
+  test("a rejected stored credential is reported as such", async () => {
+    mockResponse = {
+      ok: true,
+      result: { showPlatformLogin: true, credentialRejected: true },
+    };
+
+    const program = buildProgram();
+    const stdoutChunks: string[] = [];
+    const origWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = ((chunk: unknown) => {
+      stdoutChunks.push(typeof chunk === "string" ? chunk : String(chunk));
+      return true;
+    }) as typeof process.stdout.write;
+
+    try {
+      await program.parseAsync(["node", "assistant", "connect", "--json"]);
+    } finally {
+      process.stdout.write = origWrite;
+    }
+
+    const parsed = JSON.parse(stdoutChunks.join(""));
+    expect(parsed.ok).toBe(true);
+    expect(parsed.credentialRejected).toBe(true);
+    expect(parsed.alreadyConnected).toBeUndefined();
+  });
+
   test("already connected returns success with existing base URL", async () => {
     mockResponse = {
       ok: true,