@vellumai/assistant 0.4.46 → 0.4.49

package/src/cli/commands/oauth/providers.ts

@@ -0,0 +1,242 @@
+import { type Command, InvalidArgumentError } from "commander";
+
+import {
+  getProvider,
+  listProviders,
+  registerProvider,
+} from "../../../oauth/oauth-store.js";
+import { getCliLogger } from "../../logger.js";
+import { shouldOutputJson, writeOutput } from "../../output.js";
+
+const log = getCliLogger("cli");
+
+/** Parse stored JSON string fields into their native types. */
+function parseProviderRow(row: ReturnType<typeof getProvider>) {
+  if (!row) return row;
+  return {
+    ...row,
+    defaultScopes: row.defaultScopes ? JSON.parse(row.defaultScopes) : [],
+    scopePolicy: row.scopePolicy ? JSON.parse(row.scopePolicy) : {},
+    extraParams: row.extraParams ? JSON.parse(row.extraParams) : null,
+    createdAt: new Date(row.createdAt).toISOString(),
+    updatedAt: new Date(row.updatedAt).toISOString(),
+  };
+}
+
+export function registerProviderCommands(oauth: Command): void {
+  const providers = oauth
+    .command("providers")
+    .description(
+      "Manage OAuth provider configurations (auth URLs, scopes, endpoints)",
+    );
+
+  providers.addHelpText(
+    "after",
+    `
+Providers define the protocol-level configuration for an OAuth integration:
+authorization URL, token URL, default scopes, and other endpoint details.
+
+They are seeded on startup for built-in integrations (e.g. Gmail, Twitter,
+Slack) but can also be registered dynamically via the "register" subcommand.
+
+Each provider is identified by a provider key (e.g. "integration:gmail").`,
+  );
+
+  // ---------------------------------------------------------------------------
+  // providers list
+  // ---------------------------------------------------------------------------
+
+  providers
+    .command("list")
+    .description("List all registered OAuth providers")
+    .option(
+      "--provider-key <key>",
+      'Filter by provider key substring (case-insensitive). Comma-separated values are OR\'d (e.g. "gmail,google")',
+    )
+    .addHelpText(
+      "after",
+      `
+Returns registered OAuth providers, including both built-in providers
+seeded at startup and any dynamically registered via "providers register".
+
+When --provider-key is specified, only providers whose key contains the
+given substring (case-insensitive) are returned. Multiple substrings can
+be OR'd together using commas (e.g. "gmail,google" matches any provider
+whose key contains "gmail" OR "google"). Without the flag, all providers
+are listed.
+
+Each provider row includes its key, auth URL, token URL, default scopes,
+and configuration timestamps.
+
+Examples:
+  $ assistant oauth providers list
+  $ assistant oauth providers list --provider-key gmail
+  $ assistant oauth providers list --provider-key "gmail,google"
+  $ assistant oauth providers list --provider-key slack --json`,
+    )
+    .action((opts: { providerKey?: string }, cmd: Command) => {
+      try {
+        let rows = listProviders().map(parseProviderRow);
+
+        if (opts.providerKey) {
+          const needles = opts.providerKey
+            .split(",")
+            .map((n) => n.trim().toLowerCase())
+            .filter(Boolean);
+          rows = rows.filter(
+            (r) =>
+              r &&
+              needles.some((needle) =>
+                r.providerKey.toLowerCase().includes(needle),
+              ),
+          );
+        }
+
+        if (!shouldOutputJson(cmd)) {
+          log.info(`Found ${rows.length} provider(s)`);
+        }
+
+        writeOutput(cmd, rows);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        writeOutput(cmd, { ok: false, error: message });
+        process.exitCode = 1;
+      }
+    });
+
+  // ---------------------------------------------------------------------------
+  // providers get <provider-key>
+  // ---------------------------------------------------------------------------
+
+  providers
+    .command("get <provider-key>")
+    .description("Show details of a specific OAuth provider")
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  provider-key   The full provider key (e.g. "integration:gmail").
+                 Must match the key used during registration or seeding.
+
+Returns the full provider configuration including auth URL, token URL,
+default scopes, scope policy, and extra parameters. Exits with code 1
+if the provider key is not found.
+
+Examples:
+  $ assistant oauth providers get integration:gmail
+  $ assistant oauth providers get integration:twitter --json`,
+    )
+    .action((providerKey: string, _opts: unknown, cmd: Command) => {
+      try {
+        const row = getProvider(providerKey);
+
+        if (!row) {
+          writeOutput(cmd, {
+            ok: false,
+            error: `Provider not found: ${providerKey}`,
+          });
+          process.exitCode = 1;
+          return;
+        }
+
+        writeOutput(cmd, parseProviderRow(row));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        writeOutput(cmd, { ok: false, error: message });
+        process.exitCode = 1;
+      }
+    });
+
+  // ---------------------------------------------------------------------------
+  // providers register
+  // ---------------------------------------------------------------------------
+
+  providers
+    .command("register")
+    .description("Register a new OAuth provider configuration")
+    .requiredOption("--provider-key <key>", "Provider key")
+    .requiredOption("--auth-url <url>", "Authorization endpoint URL")
+    .requiredOption("--token-url <url>", "Token endpoint URL")
+    .option("--base-url <url>", "API base URL")
+    .option("--userinfo-url <url>", "Userinfo endpoint URL")
+    .option("--scopes <scopes>", "Comma-separated default scopes")
+    .option("--token-auth-method <method>", "Token endpoint auth method")
+    .option("--callback-transport <transport>", "Callback transport")
+    .option("--loopback-port <port>", "Loopback port", (value: string) => {
+      const port = parseInt(value, 10);
+      if (isNaN(port) || port <= 0 || port > 65535) {
+        throw new InvalidArgumentError(
+          "Port must be a number between 1 and 65535",
+        );
+      }
+      return port;
+    })
+    .addHelpText(
+      "after",
+      `
+Arguments (via options):
+  --provider-key        Unique identifier for this provider (e.g. "integration:custom-service").
+                        Must not collide with an existing provider key.
+  --auth-url            The OAuth authorization endpoint URL.
+  --token-url           The OAuth token endpoint URL.
+  --base-url            Optional API base URL for the service.
+  --userinfo-url        Optional OpenID Connect userinfo endpoint.
+  --scopes              Comma-separated list of default scopes (e.g. "read,write,profile").
+  --token-auth-method   How the client authenticates at the token endpoint
+                        (e.g. "client_secret_post", "client_secret_basic").
+  --callback-transport  Transport method for the OAuth callback.
+  --loopback-port       Port number for the local loopback callback server (1-65535).
+
+Registers a new OAuth provider configuration in the local store. This is
+used for custom integrations not covered by the built-in provider seeds.
+On success, returns the full provider row including generated timestamps.
+
+Examples:
+  $ assistant oauth providers register \\
+      --provider-key integration:custom-api \\
+      --auth-url https://custom-api.example.com/oauth/authorize \\
+      --token-url https://custom-api.example.com/oauth/token
+  $ assistant oauth providers register \\
+      --provider-key integration:my-service \\
+      --auth-url https://my-service.com/auth \\
+      --token-url https://my-service.com/token \\
+      --scopes read,write --json`,
+    )
+    .action(
+      (
+        opts: {
+          providerKey: string;
+          authUrl: string;
+          tokenUrl: string;
+          baseUrl?: string;
+          userinfoUrl?: string;
+          scopes?: string;
+          tokenAuthMethod?: string;
+          callbackTransport?: string;
+          loopbackPort?: number;
+        },
+        cmd: Command,
+      ) => {
+        try {
+          const row = registerProvider({
+            providerKey: opts.providerKey,
+            authUrl: opts.authUrl,
+            tokenUrl: opts.tokenUrl,
+            baseUrl: opts.baseUrl,
+            userinfoUrl: opts.userinfoUrl,
+            defaultScopes: opts.scopes ? opts.scopes.split(",") : [],
+            scopePolicy: {},
+            tokenEndpointAuthMethod: opts.tokenAuthMethod,
+            callbackTransport: opts.callbackTransport,
+            loopbackPort: opts.loopbackPort,
+          });
+
+          writeOutput(cmd, parseProviderRow(row));
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          writeOutput(cmd, { ok: false, error: message });
+          process.exitCode = 1;
+        }
+      },
+    );
+}

package/src/cli/commands/skills.ts

@@ -1,348 +1,14 @@
-import { execSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { gunzipSync } from "node:zlib";
-
 import type { Command } from "commander";
 
+import type { CatalogSkill } from "../../skills/catalog-install.js";
 import {
-  getWorkspaceConfigPath,
-  getWorkspaceSkillsDir,
-  readPlatformToken,
-} from "../../util/platform.js";
-import { log } from "../logger.js";
-
-// ---------------------------------------------------------------------------
-// Path helpers
-// ---------------------------------------------------------------------------
-
-function getSkillsIndexPath(): string {
-  return join(getWorkspaceSkillsDir(), "SKILLS.md");
-}
-
-/**
- * Resolve the repo-level skills/ directory when running in dev mode.
- * Returns the path if VELLUM_DEV is set and the directory exists, or undefined.
- */
-function getRepoSkillsDir(): string | undefined {
-  if (!process.env.VELLUM_DEV) return undefined;
-
-  // assistant/src/cli/commands/skills.ts -> ../../../../skills/
-  const candidate = join(import.meta.dir, "..", "..", "..", "..", "skills");
-  if (existsSync(join(candidate, "catalog.json"))) {
-    return candidate;
-  }
-  return undefined;
-}
-
-/**
- * Read skills from the repo-local catalog.json.
- */
-function readLocalCatalog(repoSkillsDir: string): CatalogSkill[] {
-  try {
-    const raw = readFileSync(join(repoSkillsDir, "catalog.json"), "utf-8");
-    const manifest = JSON.parse(raw) as CatalogManifest;
-    if (!Array.isArray(manifest.skills)) return [];
-    return manifest.skills;
-  } catch {
-    return [];
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Platform API client
-// ---------------------------------------------------------------------------
-
-function getConfigPlatformUrl(): string | undefined {
-  try {
-    const configPath = getWorkspaceConfigPath();
-    if (!existsSync(configPath)) return undefined;
-    const raw = JSON.parse(readFileSync(configPath, "utf-8")) as Record<
-      string,
-      unknown
-    >;
-    const platform = raw.platform as Record<string, unknown> | undefined;
-    const baseUrl = platform?.baseUrl;
-    if (typeof baseUrl === "string" && baseUrl.trim()) return baseUrl.trim();
-  } catch {
-    // ignore
-  }
-  return undefined;
-}
-
-function getPlatformUrl(): string {
-  return (
-    process.env.VELLUM_ASSISTANT_PLATFORM_URL ??
-    getConfigPlatformUrl() ??
-    "https://platform.vellum.ai"
-  );
-}
-
-function buildHeaders(): Record<string, string> {
-  const headers: Record<string, string> = {};
-  const token = readPlatformToken();
-  if (token) {
-    headers["X-Session-Token"] = token;
-  }
-  return headers;
-}
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-interface CatalogSkill {
-  id: string;
-  name: string;
-  description: string;
-  emoji?: string;
-  includes?: string[];
-  version?: string;
-}
-
-interface CatalogManifest {
-  version: number;
-  skills: CatalogSkill[];
-}
-
-// ---------------------------------------------------------------------------
-// Catalog operations
-// ---------------------------------------------------------------------------
-
-async function fetchCatalog(): Promise<CatalogSkill[]> {
-  const url = `${getPlatformUrl()}/v1/skills/`;
-  const response = await fetch(url, {
-    headers: buildHeaders(),
-    signal: AbortSignal.timeout(10000),
-  });
-
-  if (!response.ok) {
-    throw new Error(
-      `Platform API error ${response.status}: ${response.statusText}`,
-    );
-  }
-
-  const manifest = (await response.json()) as CatalogManifest;
-  if (!Array.isArray(manifest.skills)) {
-    throw new Error("Platform catalog has invalid skills array");
-  }
-  return manifest.skills;
-}
-
-/**
- * Extract all files from a tar archive (uncompressed) into a directory.
- * Returns true if a SKILL.md was found in the archive.
- */
-function extractTarToDir(tarBuffer: Buffer, destDir: string): boolean {
-  let foundSkillMd = false;
-  let offset = 0;
-  while (offset + 512 <= tarBuffer.length) {
-    const header = tarBuffer.subarray(offset, offset + 512);
-
-    // End-of-archive (two consecutive zero blocks)
-    if (header.every((b) => b === 0)) break;
-
-    // Filename (bytes 0-99, null-terminated)
-    const nameEnd = header.indexOf(0, 0);
-    const name = header
-      .subarray(0, Math.min(nameEnd >= 0 ? nameEnd : 100, 100))
-      .toString("utf-8");
-
-    // File type (byte 156): '5' = directory, '0' or '\0' = regular file
-    const typeFlag = header[156];
-
-    // File size (bytes 124-135, octal)
-    const sizeStr = header.subarray(124, 136).toString("utf-8").trim();
-    const size = parseInt(sizeStr, 8) || 0;
-
-    offset += 512; // past header
-
-    // Skip directories and empty names
-    if (name && typeFlag !== 53 /* '5' */) {
-      // Prevent path traversal
-      const normalizedName = name.replace(/^\.\//, "");
-      if (!normalizedName.startsWith("..") && !normalizedName.includes("/..")) {
-        const destPath = join(destDir, normalizedName);
-        mkdirSync(dirname(destPath), { recursive: true });
-        writeFileSync(destPath, tarBuffer.subarray(offset, offset + size));
-
-        if (
-          normalizedName === "SKILL.md" ||
-          normalizedName.endsWith("/SKILL.md")
-        ) {
-          foundSkillMd = true;
-        }
-      }
-    }
-
-    // Skip to next header (data padded to 512 bytes)
-    offset += Math.ceil(size / 512) * 512;
-  }
-  return foundSkillMd;
-}
-
-async function fetchAndExtractSkill(
-  skillId: string,
-  destDir: string,
-): Promise<void> {
-  const url = `${getPlatformUrl()}/v1/skills/${encodeURIComponent(skillId)}/`;
-  const response = await fetch(url, {
-    headers: buildHeaders(),
-    signal: AbortSignal.timeout(15000),
-  });
-
-  if (!response.ok) {
-    throw new Error(
-      `Failed to fetch skill "${skillId}": HTTP ${response.status}`,
-    );
-  }
-
-  const gzipBuffer = Buffer.from(await response.arrayBuffer());
-  const tarBuffer = gunzipSync(gzipBuffer);
-  const foundSkillMd = extractTarToDir(tarBuffer, destDir);
-
-  if (!foundSkillMd) {
-    throw new Error(`SKILL.md not found in archive for "${skillId}"`);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Managed skill installation
-// ---------------------------------------------------------------------------
-
-function atomicWriteFile(filePath: string, content: string): void {
-  const dir = dirname(filePath);
-  mkdirSync(dir, { recursive: true });
-  const tmpPath = join(dir, `.tmp-${randomUUID()}`);
-  writeFileSync(tmpPath, content, "utf-8");
-  renameSync(tmpPath, filePath);
-}
-
-function upsertSkillsIndex(id: string): void {
-  const indexPath = getSkillsIndexPath();
-  let lines: string[] = [];
-  if (existsSync(indexPath)) {
-    lines = readFileSync(indexPath, "utf-8").split("\n");
-  }
-
-  const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`^[-*]\\s+(?:\`)?${escaped}(?:\`)?\\s*$`);
-  if (lines.some((line) => pattern.test(line))) return;
-
-  const nonEmpty = lines.filter((l) => l.trim());
-  nonEmpty.push(`- ${id}`);
-  const content = nonEmpty.join("\n");
-  atomicWriteFile(indexPath, content.endsWith("\n") ? content : content + "\n");
-}
-
-function removeSkillsIndexEntry(id: string): void {
-  const indexPath = getSkillsIndexPath();
-  if (!existsSync(indexPath)) return;
-
-  const lines = readFileSync(indexPath, "utf-8").split("\n");
-  const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`^[-*]\\s+(?:\`)?${escaped}(?:\`)?\\s*$`);
-  const filtered = lines.filter((line) => !pattern.test(line));
-
-  // If nothing changed, skip the write
-  if (filtered.length === lines.length) return;
-
-  const content = filtered.join("\n");
-  atomicWriteFile(indexPath, content.endsWith("\n") ? content : content + "\n");
-}
-
-function uninstallSkillLocally(skillId: string): void {
-  const skillDir = join(getWorkspaceSkillsDir(), skillId);
-
-  if (!existsSync(skillDir)) {
-    throw new Error(`Skill "${skillId}" is not installed.`);
-  }
-
-  rmSync(skillDir, { recursive: true, force: true });
-  removeSkillsIndexEntry(skillId);
-}
-
-async function installSkillLocally(
-  skillId: string,
-  catalogEntry: CatalogSkill,
-  overwrite: boolean,
-): Promise<void> {
-  const skillDir = join(getWorkspaceSkillsDir(), skillId);
-  const skillFilePath = join(skillDir, "SKILL.md");
-
-  if (existsSync(skillFilePath) && !overwrite) {
-    throw new Error(
-      `Skill "${skillId}" is already installed. Use --overwrite to replace it.`,
-    );
-  }
-
-  mkdirSync(skillDir, { recursive: true });
-
-  // In dev mode, install from the local repo skills directory if available
-  const repoSkillsDir = getRepoSkillsDir();
-  const repoSkillSource = repoSkillsDir
-    ? join(repoSkillsDir, skillId)
-    : undefined;
-
-  if (repoSkillSource && existsSync(join(repoSkillSource, "SKILL.md"))) {
-    cpSync(repoSkillSource, skillDir, { recursive: true });
-  } else {
-    await fetchAndExtractSkill(skillId, skillDir);
-  }
-
-  // Write version metadata
-  if (catalogEntry.version) {
-    const meta = {
-      version: catalogEntry.version,
-      installedAt: new Date().toISOString(),
-    };
-    atomicWriteFile(
-      join(skillDir, "version.json"),
-      JSON.stringify(meta, null, 2) + "\n",
-    );
-  }
-
-  // Install npm dependencies if the skill has a package.json
-  if (existsSync(join(skillDir, "package.json"))) {
-    const bunPath = `${homedir()}/.bun/bin`;
-    execSync("bun install", {
-      cwd: skillDir,
-      stdio: "inherit",
-      env: { ...process.env, PATH: `${bunPath}:${process.env.PATH}` },
-    });
-  }
-
-  // Register in SKILLS.md only after all steps succeed
-  upsertSkillsIndex(skillId);
-}
-
-// ---------------------------------------------------------------------------
-// Exported types and functions for testing
-// ---------------------------------------------------------------------------
-
-export type { CatalogManifest, CatalogSkill };
-
-export {
-  extractTarToDir,
-  fetchAndExtractSkill,
   fetchCatalog,
-  getSkillsIndexPath,
+  getRepoSkillsDir,
   installSkillLocally,
   readLocalCatalog,
-  removeSkillsIndexEntry,
   uninstallSkillLocally,
-  upsertSkillsIndex,
-};
+} from "../../skills/catalog-install.js";
+import { log } from "../logger.js";
 
 // ---------------------------------------------------------------------------
 // Command registration

package/src/cli/program.ts

@@ -12,15 +12,13 @@ import { registerConfigCommand } from "./commands/config.js";
 import { registerContactsCommand } from "./commands/contacts.js";
 import { registerCredentialsCommand } from "./commands/credentials.js";
 import { registerDefaultAction } from "./commands/default-action.js";
-import { registerDevCommand } from "./commands/dev.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
 import { registerEmailCommand } from "./commands/email.js";
 import { registerKeysCommand } from "./commands/keys.js";
-import { registerMapCommand } from "./commands/map.js";
 import { registerMcpCommand } from "./commands/mcp.js";
 import { registerMemoryCommand } from "./commands/memory.js";
 import { registerNotificationsCommand } from "./commands/notifications.js";
-import { registerOAuthCommand } from "./commands/oauth.js";
+import { registerOAuthCommand } from "./commands/oauth/index.js";
 import { registerPlatformCommand } from "./commands/platform.js";
 import { registerSequenceCommand } from "./commands/sequence.js";
 import { registerSessionsCommand } from "./commands/sessions.js";
@@ -36,7 +34,6 @@ export function buildCliProgram(): Command {
   program.name("assistant").description("Local AI assistant").version(version);
 
   registerDefaultAction(program);
-  registerDevCommand(program);
   registerSessionsCommand(program);
   registerConfigCommand(program);
   registerKeysCommand(program);
@@ -58,7 +55,6 @@ export function buildCliProgram(): Command {
   registerSkillsCommand(program);
   registerBrowserRelayCommand(program);
 
-  registerMapCommand(program);
   registerSequenceCommand(program);
 
   return program;

package/src/cli/reference.ts

@@ -10,7 +10,6 @@ Options:
   -h, --help                               display help for command
 
 Commands:
-  dev [options]                            Run the assistant in dev mode
   sessions                                 Manage sessions
   config                                   Manage configuration
   keys                                     Manage API keys in secure storage
@@ -28,9 +27,8 @@ Commands:
   completions <shell>                      Generate shell completion script (e.g. assistant completions bash >> ~/.bashrc)
   notifications [options]                  Send and inspect notifications through the unified notification router
   platform [options]                       Manage platform integration for containerized deployments
-  oauth [options]                          Manage OAuth tokens for connected integrations
+  oauth [options]                          Manage OAuth providers, apps, connections, and tokens
   skills                                   Browse and install skills from the Vellum catalog
   browser                                  Browser automation, extension relay, and Chrome CDP management
-  map [options] <domain>                   Auto-navigate a domain and produce a deduplicated API map. Launches Chrome with CDP, starts a Ride Shotgun learn session, then analyzes captured network traffic.
   sequence [options]                       Manage email sequences
 `;

package/src/cli.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname } from "node:path";
 import * as readline from "node:readline";
@@ -503,7 +504,7 @@ export async function startCli(): Promise<void> {
       const trimmed = answer.trim().toLowerCase();
       if (trimmed === "n") {
         // Create a new conversation by using a unique key
-        conversationKey = `builtin-cli:${Date.now()}`;
+        conversationKey = `builtin-cli:${randomUUID()}`;
         sessionId = "";
         pendingSessionPick = false;
         // Reconnect SSE with new conversation key
@@ -1147,7 +1148,7 @@ export async function startCli(): Promise<void> {
 
     if (content === "/new") {
       // Create a new conversation by using a unique key
-      conversationKey = `builtin-cli:${Date.now()}`;
+      conversationKey = `builtin-cli:${randomUUID()}`;
       sessionId = "";
       reconnectSse().then(() => {
         process.stdout.write(

package/src/config/assistant-feature-flags.ts

@@ -42,10 +42,7 @@ function loadDefaultsRegistry(): FeatureFlagDefaultsRegistry {
   if (cachedDefaults) return cachedDefaults;
 
   const thisDir = import.meta.dirname ?? __dirname;
-  const envPath = process.env.FEATURE_FLAG_DEFAULTS_PATH?.trim();
   const candidates = [
-    // Explicit override (primarily for tests / controlled environments)
-    ...(envPath ? [envPath] : []),
     // Bundled: co-located copy in the same directory as this source file.
     // Works in Docker / packaged builds where the repo-root `meta/` dir
     // is not available.

package/src/config/bundled-skills/_shared/CLI_RETRIEVAL_PATTERN.md

@@ -6,7 +6,7 @@ For account and auth workflows, prefer documented `assistant` CLI commands over
 any generic account registry:
 
 - `assistant credentials ...` for stored secrets and credential metadata
-- `assistant oauth token <service>` for OAuth-backed integrations
+- `assistant oauth connections token <provider-key>` for OAuth-backed integrations
 - `assistant mcp auth <name>` when an MCP server needs browser login
 - `assistant platform status` for platform-linked deployment/auth context