@vellumai/assistant 0.6.5 → 0.6.6

package/src/messaging/providers/slack/render-transcript.test.ts

@@ -12,6 +12,7 @@ import { describe, expect, test } from "bun:test";
 import type { Message } from "../../../providers/types.js";
 import {
   extractTagLineTexts,
+  isReactionTagLine,
   parentAlias,
   type RenderableSlackMessage,
   renderSlackTranscript,
@@ -228,11 +229,17 @@ describe("renderSlackTranscript — basics", () => {
     ]);
   });
 
-  test("omits sender label for assistant-role message (role slot conveys identity)", () => {
+  test("assistant-role message emits content with no tag-line wrapper", () => {
+    // Rationale: the `role` slot already conveys identity, and the
+    // assistant responds ~immediately after the triggering user message
+    // so the timestamp would add little beyond chronological adjacency.
+    // Keeping a bracketed tag on assistant rows caused the model to
+    // mimic the `[MM/DD/YY HH:MM]:` format as a literal prefix in new
+    // outbound Slack replies.
     const out = renderSlackTranscript([
       userMsg(TS_14_25, null, "yo 👋", { role: "assistant" }),
     ]);
-    expect(out).toEqual([textMsg("assistant", "[11/14/23 14:25]: yo 👋")]);
+    expect(out).toEqual([textMsg("assistant", "yo 👋")]);
   });
 
   test("omits sender label for user-role message with null senderLabel (no displayName)", () => {
@@ -245,41 +252,38 @@ describe("renderSlackTranscript — basics", () => {
     expect(out).toEqual([textMsg("user", "[11/14/23 14:25]: hi")]);
   });
 
-  test("omits sender label in thread-reply tag for assistant row", () => {
-    const alias = parentAlias(TS_14_25);
+  test("thread-reply assistant row emits content-only — no tag wrapper, no thread arrow", () => {
     const out = renderSlackTranscript([
       userMsg(TS_14_28, null, "got it", {
         threadTs: TS_14_25,
         role: "assistant",
       }),
     ]);
-    expect(out).toEqual([
-      textMsg("assistant", `[11/14/23 14:28 → ${alias}]: got it`),
-    ]);
+    expect(out).toEqual([textMsg("assistant", "got it")]);
   });
 
-  test("omits sender label in deleted tag for assistant row", () => {
+  test("deleted assistant row collapses to the `[deleted]` sentinel", () => {
+    // Chronology must still be preserved — we emit a stable short sentinel
+    // rather than eliding the row entirely. The sentinel is intentionally
+    // different from the user-row `[MM/DD/YY — deleted MM/DD/YY]` form so
+    // the model has no timestamp pattern to mimic in new outbound replies.
     const out = renderSlackTranscript([
       userMsg(TS_14_25, null, "(removed)", {
         deletedAt: MS_14_32,
         role: "assistant",
       }),
     ]);
-    expect(out).toEqual([
-      textMsg("assistant", "[11/14/23 14:25 — deleted 11/14/23 14:32]"),
-    ]);
+    expect(out).toEqual([textMsg("assistant", "[deleted]")]);
   });
 
-  test("omits sender label in edited tag for assistant row", () => {
+  test("edited assistant row emits the latest content verbatim — no edit suffix", () => {
     const out = renderSlackTranscript([
       userMsg(TS_14_25, null, "v2", {
         editedAt: MS_14_30,
         role: "assistant",
       }),
     ]);
-    expect(out).toEqual([
-      textMsg("assistant", "[11/14/23 14:25, edited 11/14/23 14:30]: v2"),
-    ]);
+    expect(out).toEqual([textMsg("assistant", "v2")]);
   });
 
   test("reaction with null senderLabel falls back on role-derived subject", () => {
@@ -381,6 +385,50 @@ describe("parentAlias", () => {
   });
 });
 
+// ── isReactionTagLine ────────────────────────────────────────────────────────
+
+describe("isReactionTagLine", () => {
+  // Pinned to the exact shapes `renderReaction` and the overflow trailer
+  // produce. The helper is the public contract that lets consumers
+  // re-label the transcript without double-attributing reaction lines,
+  // so drift here silently breaks `buildActiveThreadBlockFromRenderable`.
+  const alias = parentAlias("1700000000.000100");
+
+  test("matches reaction-add line", () => {
+    expect(
+      isReactionTagLine(`[11/14/23 14:28 @bob reacted 👍 to ${alias}]`),
+    ).toBe(true);
+  });
+
+  test("matches reaction-remove line", () => {
+    expect(
+      isReactionTagLine(`[11/14/23 14:28 @bob removed 👍 from ${alias}]`),
+    ).toBe(true);
+  });
+
+  test("matches overflow trailer line", () => {
+    expect(isReactionTagLine(`[…and 2 more reactions to ${alias}]`)).toBe(true);
+  });
+
+  test("does not match a regular message tag line", () => {
+    expect(isReactionTagLine("[11/14/23 14:25 @alice]: hi")).toBe(false);
+  });
+
+  test("does not match content-only assistant output", () => {
+    expect(isReactionTagLine("on it. here's the answer")).toBe(false);
+  });
+
+  test("does not match the `[deleted]` sentinel", () => {
+    expect(isReactionTagLine("[deleted]")).toBe(false);
+  });
+
+  test("does not match a user-deleted marker", () => {
+    expect(
+      isReactionTagLine("[11/14/23 14:25 @alice — deleted 11/14/23 14:32]"),
+    ).toBe(false);
+  });
+});
+
 // ── reaction cap ─────────────────────────────────────────────────────────────
 
 describe("renderSlackTranscript — reaction cap", () => {
@@ -709,11 +757,11 @@ describe("renderSlackTranscript — mixed legacy + post-upgrade", () => {
     expect(texts[1].includes("→")).toBe(false);
   });
 
-  test("legacy assistant row carries assistant role", () => {
+  test("legacy assistant row carries assistant role and emits content verbatim", () => {
     const out = renderSlackTranscript([
       legacyMsg(MS_14_25, "@bot", "ack", "assistant"),
     ]);
-    expect(out).toEqual([textMsg("assistant", "[11/14/23 14:25 @bot]: ack")]);
+    expect(out).toEqual([textMsg("assistant", "ack")]);
   });
 
   test("preserves message role faithfully across mixed inputs", () => {
@@ -873,7 +921,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
     expect(out[0]).toEqual({
       role: "assistant",
       content: [
-        { type: "text", text: "[11/14/23 14:25]: looking it up" },
+        { type: "text", text: "looking it up" },
         { type: "tool_use", id: "tu_1", name: "search", input: { q: "x" } },
       ],
     });
@@ -921,7 +969,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
         role: "assistant",
         content: [
           { type: "thinking", thinking: "let me think", signature: "sig-abc" },
-          { type: "text", text: "[11/14/23 14:25]: here's the answer" },
+          { type: "text", text: "here's the answer" },
         ],
       },
     ]);
@@ -946,7 +994,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
       {
         role: "assistant",
         content: [
-          { type: "text", text: "[11/14/23 14:25]: doing a thing" },
+          { type: "text", text: "doing a thing" },
           { type: "tool_use", id: "tu_A", name: "op", input: {} },
           { type: "tool_result", tool_use_id: "tu_A", content: "ok" },
         ],
@@ -954,7 +1002,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
     ]);
   });
 
-  test("[text, ui_surface] assistant row strips ui_surface — only tag line remains", () => {
+  test("[text, ui_surface] assistant row strips ui_surface — only content remains", () => {
     const base: RenderableSlackMessage = {
       ...userMsg(TS_14_25, null, "reply body", { role: "assistant" }),
       contentBlocks: [
@@ -969,7 +1017,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
     expect(out).toEqual([
       {
         role: "assistant",
-        content: [{ type: "text", text: "[11/14/23 14:25]: reply body" }],
+        content: [{ type: "text", text: "reply body" }],
       },
     ]);
   });
@@ -991,7 +1039,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
     expect(out).toEqual([
       {
         role: "assistant",
-        content: [{ type: "text", text: "[11/14/23 14:25]: web search" }],
+        content: [{ type: "text", text: "web search" }],
       },
     ]);
   });
@@ -1077,7 +1125,7 @@ describe("renderSlackTranscript — replayable content-block preservation", () =
         content: [
           {
             type: "text",
-            text: "[11/14/23 14:25]: ran a web search [stripped non-replayable: server_tool_use(web_search), ui_surface]",
+            text: "ran a web search [stripped non-replayable: server_tool_use(web_search), ui_surface]",
           },
         ],
       },
@@ -1155,7 +1203,7 @@ describe("renderSlackTranscript — orphan tool_use / tool_result filter", () =>
     expect(out).toEqual([
       {
         role: "assistant",
-        content: [{ type: "text", text: "[11/14/23 14:25]: looking it up" }],
+        content: [{ type: "text", text: "looking it up" }],
       },
     ]);
   });
@@ -1206,7 +1254,7 @@ describe("renderSlackTranscript — orphan tool_use / tool_result filter", () =>
       {
         role: "assistant",
         content: [
-          { type: "text", text: "[11/14/23 14:25]: running op" },
+          { type: "text", text: "running op" },
           { type: "tool_use", id: "tu_paired", name: "op", input: { a: 1 } },
         ],
       },
@@ -1296,7 +1344,7 @@ describe("renderSlackTranscript — orphan tool_use / tool_result filter", () =>
       {
         role: "assistant",
         content: [
-          { type: "text", text: "[11/14/23 14:25]: running op" },
+          { type: "text", text: "running op" },
           { type: "tool_use", id: "tu_paired", name: "op", input: {} },
         ],
       },
@@ -1308,7 +1356,7 @@ describe("renderSlackTranscript — orphan tool_use / tool_result filter", () =>
       },
       {
         role: "assistant",
-        content: [{ type: "text", text: "[11/14/23 14:28]: looking" }],
+        content: [{ type: "text", text: "looking" }],
       },
       {
         role: "user",
@@ -1365,7 +1413,7 @@ describe("renderSlackTranscript — orphan tool_use / tool_result filter", () =>
               filename: "doc.pdf",
             },
           },
-          { type: "text", text: "[11/14/23 14:25]: here you go" },
+          { type: "text", text: "here you go" },
         ],
       },
     ]);

package/src/messaging/providers/slack/render-transcript.ts

@@ -95,6 +95,31 @@ export function parentAlias(channelTs: string): string {
   return `M${hash.slice(0, 6)}`;
 }
 
+/**
+ * Trailing signature of a reaction or reaction-overflow line, both of
+ * which end with a `parentAlias` target and a closing bracket:
+ * `[... reacted 👍 to M1a2b3c]`, `[... removed 👍 from M1a2b3c]`,
+ * `[…and N more reactions to M1a2b3c]`. Regular message tag lines end
+ * with the message body, not with `]`, so they never match.
+ */
+const REACTION_TAG_LINE_SUFFIX = /M[0-9a-f]{6}\]$/;
+
+/**
+ * Whether a rendered tag-line string was produced by the reaction or
+ * reaction-overflow code paths (`renderReaction` / the overflow trailer).
+ *
+ * Reaction lines already embed the actor attribution inline
+ * (`[11/14/23 14:28 @assistant reacted 👍 to M1a2b3c]`), so consumers
+ * that flatten the rendered transcript and re-apply role labels should
+ * skip these lines to avoid double-attribution.
+ *
+ * Co-located with `renderReaction` and `parentAlias` so the format
+ * knowledge lives with the functions that own the line shape.
+ */
+export function isReactionTagLine(text: string): boolean {
+  return REACTION_TAG_LINE_SUFFIX.test(text);
+}
+
 /**
  * Format a Slack ts (`"1700000000.000100"`) as `MM/DD/YY HH:MM` (UTC).
  *
@@ -140,8 +165,41 @@ function sortKey(msg: RenderableSlackMessage): number {
 /**
  * Render a single non-reaction message (post-upgrade or legacy) as one
  * tagged line.
+ *
+ * Assistant rows emit their content verbatim with no bracketed wrapper.
+ * The `role` slot already conveys identity, and the assistant replies
+ * ~immediately after the triggering user message so the chronological
+ * adjacency carries the same information as a timestamp. Keeping a
+ * `[MM/DD/YY HH:MM]:` prefix on the assistant's own past turns caused
+ * the model to mimic the exact format as a literal prefix in new
+ * outbound Slack replies (`[04/22/26 21:25]: on it. ...`). Deleted
+ * assistant rows collapse to the short `[deleted]` sentinel so chronology
+ * is preserved without carrying a mimickable timestamp.
+ *
+ * Tradeoffs deliberately accepted by this simplification:
+ * - Thread arrows (`→ Mxxxxxx`) are dropped from assistant rows. In the
+ *   common single-thread-at-a-time case, role alternation + chronological
+ *   adjacency tells the model which user turn each assistant reply answers,
+ *   so no attribution is lost. The degenerate case is a channel where the
+ *   assistant is fielding two thread conversations in parallel and the
+ *   model has to disambiguate which reply lands in which thread from the
+ *   full chronological transcript — the bracketed arrow previously carried
+ *   that signal and is now absent. The `<active_thread>` focus block
+ *   (single thread by construction) is unaffected.
+ * - Edited assistant rows render only the latest content, not an edit
+ *   marker. Edits are rare for the assistant and the latest content is the
+ *   only replayable signal anyway.
+ *
+ * Any alternative "subtle" marker (e.g. an unbracketed `→ Mxxxxxx`) would
+ * reintroduce a consistent, mimickable prefix pattern — the very problem
+ * this function is designed to avoid — so we keep the content-only form.
  */
 function renderMessage(msg: RenderableSlackMessage): string {
+  if (msg.role === "assistant") {
+    if (msg.metadata?.deletedAt !== undefined) return "[deleted]";
+    return msg.content;
+  }
+
   const meta = msg.metadata;
   const senderPart = msg.senderLabel ? ` ${msg.senderLabel}` : "";
   if (!meta) {

package/src/notifications/conversation-pairing.ts

@@ -8,8 +8,12 @@
  *
  * Resolution order:
  * 1. Explicit `reuse_existing` conversation action — highest precedence.
- * 2. Binding-key reuse — for `continue_existing_conversation` channels,
- *    looks up a previously bound conversation by (sourceChannel, externalChatId).
+ * 2. Binding-key reuse — for `continue_existing_conversation` channels:
+ *    a. Inbound conversation lookup — checks the un-prefixed binding
+ *       (sourceChannel, externalChatId) for a conversation created by
+ *       the inbound message handler. Preferred for reply continuity.
+ *    b. Notification-scoped binding — checks the `notification:`-prefixed
+ *       binding for a prior notification conversation.
  * 3. Default — creates a fresh conversation and, when binding context is
  *    present, upserts it into the external-conversation store for future reuse.
  */
@@ -78,8 +82,11 @@ export interface PairingOptions {
  *
  * Resolution precedence:
  * 1. `options.conversationAction === "reuse_existing"` — reuse the explicit target.
- * 2. `continue_existing_conversation` strategy with binding context —
- *    look up a previously bound conversation by (sourceChannel, externalChatId).
+ * 2. `continue_existing_conversation` strategy with binding context:
+ *    a. Un-prefixed (inbound) binding — preferred for reply continuity so
+ *       the user's replies include the notification in their history.
+ *    b. `notification:`-prefixed binding — used when no inbound conversation
+ *       exists yet (e.g. first notification before the user has messaged).
  * 3. Create a new conversation (and upsert the binding when context is present).
  *
  * Invalid/stale targets at any level fall through to the next.
@@ -228,21 +235,73 @@ export async function pairDeliveryWithConversation(
       bindingContext?.sourceChannel &&
       bindingContext?.externalChatId
     ) {
-      // Look up by namespaced key first; fall back to pre-namespace key for
-      // bindings created before the notification: prefix was introduced.
-      const existingBinding =
-        getBindingByChannelChat(
-          notificationChannel(bindingContext.sourceChannel),
-          bindingContext.externalChatId,
-        ) ??
-        getBindingByChannelChat(
-          bindingContext.sourceChannel,
-          bindingContext.externalChatId,
+      // ── Step 1: Prefer the inbound conversation for reply continuity ──
+      //
+      // When the user has previously messaged in this channel, the inbound
+      // pipeline created a binding at the un-prefixed (sourceChannel,
+      // externalChatId) key.  Posting to that conversation means the
+      // user's subsequent replies will include the notification in their
+      // conversation history — avoiding "split brain" where proactive
+      // messages live in one conversation and replies route to another.
+      //
+      // The source check is intentionally skipped here: the inbound
+      // conversation will have a different source (typically null) from
+      // notifications, but it is the correct target for reply continuity.
+      const inboundBinding = getBindingByChannelChat(
+        bindingContext.sourceChannel,
+        bindingContext.externalChatId,
+      );
+
+      if (inboundBinding) {
+        const inboundConversation = getConversation(
+          inboundBinding.conversationId,
         );
 
-      if (existingBinding) {
+        if (inboundConversation) {
+          const message = await addMessage(
+            inboundConversation.id,
+            "assistant",
+            messageContent,
+            undefined,
+            { skipIndexing: true },
+          );
+
+          log.info(
+            {
+              signalId: signal.signalId,
+              channel,
+              strategy,
+              conversationId: inboundConversation.id,
+              messageId: message.id,
+              bindingKey: `${bindingContext.sourceChannel}:${bindingContext.externalChatId}`,
+            },
+            "Appended notification to inbound conversation for reply continuity",
+          );
+
+          return {
+            conversationId: inboundConversation.id,
+            messageId: message.id,
+            strategy,
+            createdNewConversation: false,
+            conversationFallbackUsed: false,
+          };
+        }
+      }
+
+      // ── Step 2: Fall back to notification-scoped binding ──
+      //
+      // Before the user has ever messaged in this channel, there is no
+      // inbound binding.  Check the notification-prefixed namespace for a
+      // prior notification conversation so successive deliveries still
+      // accumulate in the same thread.
+      const notificationBinding = getBindingByChannelChat(
+        notificationChannel(bindingContext.sourceChannel),
+        bindingContext.externalChatId,
+      );
+
+      if (notificationBinding) {
         const boundConversation = getConversation(
-          existingBinding.conversationId,
+          notificationBinding.conversationId,
         );
 
         const effectiveSource =
@@ -272,7 +331,7 @@ export async function pairDeliveryWithConversation(
               messageId: message.id,
               bindingKey: `${bindingContext.sourceChannel}:${bindingContext.externalChatId}`,
             },
-            "Reused bound conversation for channel destination",
+            "Reused bound notification conversation for channel destination",
           );
 
           return {
@@ -290,11 +349,11 @@ export async function pairDeliveryWithConversation(
           {
             signalId: signal.signalId,
             channel,
-            boundConversationId: existingBinding.conversationId,
+            boundConversationId: notificationBinding.conversationId,
             boundConversationExists: !!boundConversation,
             boundConversationSource: boundConversation?.source,
           },
-          "Bound conversation stale or invalid — creating fresh conversation",
+          "Bound notification conversation stale or invalid — creating fresh conversation",
         );
       }
     }

package/src/notifications/copy-composer.ts

@@ -313,11 +313,6 @@ const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
     body: str(payload.message, str(payload.label, "A reminder has fired")),
   }),
 
-  "schedule.complete": (payload) => ({
-    title: "Schedule Complete",
-    body: `${str(payload.name, "A schedule")} has finished running`,
-  }),
-
   "guardian.question": (payload) => {
     const question = str(
       payload.questionText,

package/src/notifications/emit-signal.ts

@@ -146,7 +146,7 @@ function getConnectedChannels(): NotificationChannel[] {
 // ── Public API ─────────────────────────────────────────────────────────
 
 export interface EmitSignalParams<TEventName extends string = string> {
-  /** Free-form event name, e.g. 'schedule.notify', 'schedule.complete'. */
+  /** Free-form event name, e.g. 'schedule.notify', 'guardian.question'. */
   sourceEventName: TEventName;
   /** Source channel that produced the event — must be a registered channel. */
   sourceChannel: NotificationSourceChannel;

package/src/notifications/signal.ts

@@ -41,7 +41,6 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     id: "schedule.notify",
     description: "Scheduled notification triggered (one-shot or recurring)",
   },
-  { id: "schedule.complete", description: "Scheduled task finished running" },
   {
     id: "guardian.question",
     description: "Guardian approval question requiring response",
@@ -191,7 +190,7 @@ export interface NotificationSignal<TEventName extends string = string> {
   createdAt: number; // epoch ms
   sourceChannel: NotificationSourceChannel; // see NOTIFICATION_SOURCE_CHANNELS registry
   sourceContextId: string;
-  sourceEventName: TEventName; // free-form: 'reminder_fired', 'schedule_complete', 'guardian_question', etc.
+  sourceEventName: TEventName; // free-form: 'reminder_fired', 'guardian_question', etc.
   contextPayload: NotificationContextPayload<TEventName>;
   attentionHints: AttentionHints;
   /** Routing intent from the source (e.g. reminder). Controls post-decision channel enforcement. */

package/src/oauth/AGENTS.md

@@ -6,7 +6,7 @@ When introducing a new built-in OAuth integration (one that appears in `seed-pro
 
 ### 1. Seed the provider — `seed-providers.ts`
 
-Add an entry to `PROVIDER_SEED_DATA`. Required fields: `provider`, `authorizeUrl`, `tokenExchangeUrl`, `defaultScopes`, `scopePolicy`, `displayLabel`, `description`, `dashboardUrl`, `clientIdPlaceholder`, `logoUrl`, and `injectionTemplates`. See existing entries for the full shape. The `provider` key must be snake_case and is used as the canonical identifier everywhere else.
+Add an entry to `PROVIDER_SEED_DATA`. Required fields: `provider`, `authorizeUrl`, `tokenExchangeUrl`, `defaultScopes`, `displayLabel`, `description`, `dashboardUrl`, `clientIdPlaceholder`, `logoUrl`, and `injectionTemplates`. Optional: `availableScopes` — either a structured array of `{scope, description?}` objects or a URL string pointing to the provider's scope documentation. See existing entries for the full shape. The `provider` key must be snake_case and is used as the canonical identifier everywhere else.
 
 If the provider will support managed mode, set `managedServiceConfigKey` to a slug matching the key you will add to `ServicesSchema` (e.g. `"acme-oauth"`).
 

package/src/oauth/__tests__/identity-verifier.test.ts

@@ -38,7 +38,7 @@ function makeProviderRow(
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
-    scopePolicy: "{}",
+    availableScopes: null,
     scopeSeparator: " ",
     authorizeParams: null,
     pingUrl: null,
@@ -48,6 +48,7 @@ function makeProviderRow(
     revokeUrl: null,
     revokeBodyTemplate: null,
     managedServiceConfigKey: null,
+    managedServiceIsPaid: false,
     displayLabel: null,
     description: null,
     dashboardUrl: null,

package/src/oauth/connect-orchestrator.ts

@@ -13,7 +13,6 @@
  *
  * The orchestrator handles:
  * - Provider config resolution (from DB)
- * - Scope policy enforcement
  * - Building the OAuth2Config
  * - Running the interactive or deferred flow
  * - Storing tokens on completion
@@ -23,10 +22,9 @@
 import type { TokenEndpointAuthMethod } from "../security/oauth2.js";
 import { prepareOAuth2Flow, startOAuth2Flow } from "../security/oauth2.js";
 import { getLogger } from "../util/logger.js";
-import type { OAuthConnectResult, OAuthScopePolicy } from "./connect-types.js";
+import type { OAuthConnectResult } from "./connect-types.js";
 import { verifyIdentity } from "./identity-verifier.js";
 import { getProvider } from "./oauth-store.js";
-import { resolveScopes } from "./scope-policy.js";
 import { storeOAuth2Tokens } from "./token-persistence.js";
 
 const log = getLogger("oauth-connect-orchestrator");
@@ -52,7 +50,7 @@ function safeJsonParse<T>(value: string | null | undefined, fallback: T): T {
 export interface OAuthConnectOptions {
   /** Canonical service name (e.g. "google", "slack"). */
   service: string;
-  /** Scopes to request beyond the provider's defaults. */
+  /** Scopes to request. When provided, used instead of the provider's default scopes. */
   requestedScopes?: string[];
   /** OAuth2 client ID (required). */
   clientId: string;
@@ -122,18 +120,6 @@ export async function orchestrateOAuthConnect(
   }
 
   // Deserialize JSON fields from the DB row
-  const dbDefaultScopes = safeJsonParse<string[]>(
-    providerRow.defaultScopes,
-    [],
-  );
-  const dbScopePolicy = safeJsonParse<OAuthScopePolicy>(
-    providerRow.scopePolicy,
-    {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
-  );
   const dbAuthorizeParams = safeJsonParse<Record<string, string> | undefined>(
     providerRow.authorizeParams,
     undefined,
@@ -151,24 +137,12 @@ export async function orchestrateOAuthConnect(
     options.callbackTransport ?? "loopback";
   const loopbackPort = providerRow.loopbackPort ?? undefined;
 
-  // Resolve scopes via the scope policy engine
-  const scopeProfile = {
-    service: options.service,
-    defaultScopes: dbDefaultScopes,
-    scopePolicy: dbScopePolicy,
-  };
-  const scopeResult = resolveScopes(scopeProfile, options.requestedScopes);
-  if (!scopeResult.ok) {
-    const guidance = scopeResult.allowedScopes
-      ? ` Allowed scopes: ${scopeResult.allowedScopes.join(", ")}`
-      : "";
-    return {
-      success: false,
-      error: `${scopeResult.error}${guidance}`,
-      safeError: true,
-    };
-  }
-  const finalScopes = scopeResult.scopes;
+  // Resolve scopes: use requested scopes when provided, otherwise fall back
+  // to the provider's default scopes. No validation layer — the OAuth
+  // provider itself rejects invalid scopes.
+  const finalScopes = options.requestedScopes?.length
+    ? options.requestedScopes
+    : safeJsonParse<string[]>(providerRow.defaultScopes, []);
 
   if (!authorizeUrl) {
     return {

package/src/oauth/connect-types.ts

@@ -12,18 +12,14 @@
  */
 
 // ---------------------------------------------------------------------------
-// Scope policy
+// Available scopes
 // ---------------------------------------------------------------------------
 
-/** Controls which additional scopes may be requested beyond the default set. */
-export interface OAuthScopePolicy {
-  /** Whether callers may request scopes not listed in defaultScopes. */
-  allowAdditionalScopes: boolean;
-  /** Scopes that may optionally be added beyond the defaults. */
-  allowedOptionalScopes: string[];
-  /** Scopes that must never be requested, regardless of other settings. */
-  forbiddenScopes: string[];
-}
+/** Informational scope metadata for the assistant. Either a structured list
+ * of scopes with optional descriptions, or a URL to the provider's scope docs. */
+export type AvailableScopes =
+  | Array<{ scope: string; description?: string }>
+  | string;
 
 // ---------------------------------------------------------------------------
 // Connect result

package/src/oauth/manual-token-connection.ts

@@ -21,6 +21,29 @@ import {
 /** Sentinel client_id used for non-OAuth providers that don't have a real app. */
 const MANUAL_TOKEN_CLIENT_ID = "manual-config";
 
+/**
+ * Return the secure-store key holding the primary access token for a
+ * manual-token provider, or null for OAuth providers whose tokens live at
+ * `oauth_connection/<id>/access_token`.
+ *
+ * Manual-token providers store their tokens under `credential/<provider>/<field>`
+ * via the generic credential store, so any code that validates tokens for these
+ * providers (e.g. credential-health checks) must resolve the path through here
+ * rather than assuming the OAuth access-token path.
+ */
+export function manualTokenAccessCredentialKey(
+  provider: string,
+): string | null {
+  switch (provider) {
+    case "slack_channel":
+      return credentialKey("slack_channel", "bot_token");
+    case "telegram":
+      return credentialKey("telegram", "bot_token");
+    default:
+      return null;
+  }
+}
+
 /**
  * Ensure an active oauth_connection row exists for the given manual-token
  * provider. Creates the synthetic oauth_app row on first use.