@vellumai/assistant 0.7.0 → 0.7.2

package/src/runtime/routes/trust-rules-routes.ts

@@ -1,10 +1,8 @@
 /**
- * Trust rule CRUD routes — gateway HTTP proxy.
+ * Trust rule listing route — gateway HTTP proxy.
  *
- * Each handler makes a single HTTP call to the gateway's trust-rules REST API
+ * The handler makes a single HTTP call to the gateway's trust-rules REST API
  * and surfaces the body's `.error` message on non-OK responses.
- *
- * Migrated from `ipc/routes/trust-rules.ts` into the shared ROUTES array.
  */
 import { z } from "zod";
 
@@ -44,28 +42,9 @@ const TrustRulesListParams = z
   })
   .strict();
 
-const TrustRulesCreateParams = z
-  .object({
-    tool: z.string(),
-    pattern: z.string(),
-    risk: z.string(),
-    description: z.string().optional(),
-  })
-  .strict();
-
-const TrustRulesUpdateBody = z
-  .object({
-    risk: z.string().optional(),
-    description: z.string().optional(),
-  })
-  .strict();
-
 // ── Handlers ────────────────────────────────────────────────────────────
 
-async function handleList({
-  queryParams = {},
-  body = {},
-}: RouteHandlerArgs) {
+async function handleList({ queryParams = {}, body = {} }: RouteHandlerArgs) {
   // HTTP GET delivers filters via queryParams; CLI IPC puts them in body.
   const source = Object.keys(queryParams).length > 0 ? queryParams : body;
   const p = TrustRulesListParams.parse(source);
@@ -77,47 +56,6 @@ async function handleList({
   return gatewayFetch(`/v1/trust-rules${query ? `?${query}` : ""}`);
 }
 
-async function handleCreate({ body = {} }: RouteHandlerArgs) {
-  const { tool, pattern, risk, description } = TrustRulesCreateParams.parse(body);
-  return gatewayFetch("/v1/trust-rules", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ tool, pattern, risk, description }),
-  });
-}
-
-async function handleUpdate({
-  pathParams = {},
-  body = {},
-}: RouteHandlerArgs) {
-  // HTTP path delivers id via pathParams; CLI IPC puts it in body.
-  const rawBody = body as Record<string, unknown>;
-  const id = pathParams.id ?? rawBody.id;
-  if (!id || typeof id !== "string") throw new Error("id is required");
-  const { id: _discarded, ...rest } = rawBody;
-  const fields = TrustRulesUpdateBody.parse(rest);
-  const patchBody: Record<string, unknown> = {};
-  if (fields.risk !== undefined) patchBody.risk = fields.risk;
-  if (fields.description !== undefined) patchBody.description = fields.description;
-  return gatewayFetch(`/v1/trust-rules/${encodeURIComponent(id)}`, {
-    method: "PATCH",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(patchBody),
-  });
-}
-
-async function handleRemove({
-  pathParams = {},
-  body = {},
-}: RouteHandlerArgs) {
-  // HTTP path delivers id via pathParams; CLI IPC puts it in body.
-  const id = pathParams.id ?? (body as Record<string, unknown>).id;
-  if (!id || typeof id !== "string") throw new Error("id is required");
-  return gatewayFetch(`/v1/trust-rules/${encodeURIComponent(id)}`, {
-    method: "DELETE",
-  });
-}
-
 // ── Route definitions ───────────────────────────────────────────────────
 
 export const ROUTES: RouteDefinition[] = [
@@ -136,33 +74,4 @@ export const ROUTES: RouteDefinition[] = [
       { name: "include_all", description: "Include unmodified defaults" },
     ],
   },
-  {
-    operationId: "trust_rules_create",
-    method: "POST",
-    endpoint: "trust-rules",
-    handler: handleCreate,
-    summary: "Create a trust rule",
-    description: "Create a new trust rule with tool, pattern, risk level, and optional description.",
-    tags: ["trust-rules"],
-    requestBody: TrustRulesCreateParams,
-  },
-  {
-    operationId: "trust_rules_update",
-    method: "PATCH",
-    endpoint: "trust-rules/:id",
-    handler: handleUpdate,
-    summary: "Update a trust rule",
-    description: "Update the risk level or description of an existing trust rule.",
-    tags: ["trust-rules"],
-    requestBody: TrustRulesUpdateBody,
-  },
-  {
-    operationId: "trust_rules_remove",
-    method: "DELETE",
-    endpoint: "trust-rules/:id",
-    handler: handleRemove,
-    summary: "Remove a trust rule",
-    description: "Delete a trust rule by ID.",
-    tags: ["trust-rules"],
-  },
 ];

package/src/runtime/routes/types.ts

@@ -113,10 +113,10 @@ export interface RouteDefinition {
    */
   isPublic?: boolean;
   /**
-   * When true, the route requires scope-based policy enforcement that
-   * the HTTP server performs via `enforcePolicy()`. The IPC adapter
-   * excludes these routes until the gateway implements equivalent
-   * scope checking (ATL-315).
+   * When true, the route requires scope-based policy enforcement.
+   * The HTTP server enforces via `enforcePolicy()`. The IPC adapter
+   * includes the resolved policy in the route schema so the gateway's
+   * IPC proxy enforces equivalent scope/principal checks.
    */
   requirePolicyEnforcement?: boolean;
   /**

package/src/runtime/routes/upgrade-broadcast-routes.ts

@@ -12,7 +12,6 @@ import type {
 } from "../../daemon/message-types/upgrades.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -50,9 +49,7 @@ async function handleUpgradeBroadcast({ body }: RouteHandlerArgs) {
       expectedDowntimeSeconds: downtime,
     };
 
-    await assistantEventHub.publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message),
-    );
+    await assistantEventHub.publish(buildAssistantEvent(message));
 
     return { ok: true };
   }
@@ -71,9 +68,7 @@ async function handleUpgradeBroadcast({ body }: RouteHandlerArgs) {
       statusMessage,
     };
 
-    await assistantEventHub.publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message),
-    );
+    await assistantEventHub.publish(buildAssistantEvent(message));
 
     return { ok: true };
   }
@@ -114,9 +109,7 @@ async function handleUpgradeBroadcast({ body }: RouteHandlerArgs) {
         : {}),
     };
 
-    await assistantEventHub.publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message),
-    );
+    await assistantEventHub.publish(buildAssistantEvent(message));
 
     return { ok: true };
   }

package/src/runtime/routes/usage-routes.ts

@@ -3,7 +3,8 @@
  *
  * GET /v1/usage/totals?from=&to=              — aggregate totals for a time range
  * GET /v1/usage/daily?from=&to=               — per-day buckets for a time range
- * GET /v1/usage/breakdown?from=&to=&groupBy=  — grouped breakdown (actor, provider, model, or conversation)
+ * GET /v1/usage/breakdown?from=&to=&groupBy=  — grouped breakdown
+ * GET /v1/usage/series?from=&to=&granularity=&groupBy= — grouped time-series buckets
  */
 
 import { z } from "zod";
@@ -11,14 +12,22 @@ import { z } from "zod";
 import {
   getUsageDayBuckets,
   getUsageGroupBreakdown,
+  getUsageGroupedSeries,
   getUsageHourBuckets,
   getUsageTotals,
+  type GroupByDimension,
+  USAGE_GROUP_BY_DIMENSIONS,
+  USAGE_SERIES_GROUP_BY_DIMENSIONS,
+  type UsageGranularity,
 } from "../../memory/llm-usage-store.js";
 import { validateTimezone } from "../../memory/usage-buckets.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-const VALID_GROUP_BY = new Set(["actor", "provider", "model", "conversation"]);
+const VALID_GROUP_BY = new Set<string>(USAGE_GROUP_BY_DIMENSIONS);
+const VALID_SERIES_GROUP_BY = new Set<string>(USAGE_SERIES_GROUP_BY_DIMENSIONS);
+const GROUP_BY_DESCRIPTION = USAGE_GROUP_BY_DIMENSIONS.join(", ");
+const SERIES_GROUP_BY_DESCRIPTION = USAGE_SERIES_GROUP_BY_DIMENSIONS.join(", ");
 
 function resolveTimezone(queryParams: Record<string, string>): string {
   const tz = queryParams.tz ?? "UTC";
@@ -88,20 +97,50 @@ function handleUsageBreakdown({ queryParams }: RouteHandlerArgs) {
   const groupBy = qp.groupBy;
   if (!groupBy) {
     throw new BadRequestError(
-      'Missing required query parameter: "groupBy" (one of: actor, provider, model, conversation)',
+      `Missing required query parameter: "groupBy" (one of: ${GROUP_BY_DESCRIPTION})`,
     );
   }
   if (!VALID_GROUP_BY.has(groupBy)) {
     throw new BadRequestError(
-      `Invalid "groupBy" value: "${groupBy}". Must be one of: actor, provider, model, conversation`,
+      `Invalid "groupBy" value: "${groupBy}". Must be one of: ${GROUP_BY_DESCRIPTION}`,
     );
   }
 
-  const breakdown = getUsageGroupBreakdown(
+  const breakdown = getUsageGroupBreakdown(range, groupBy as GroupByDimension);
+  return { breakdown };
+}
+
+function handleUsageSeries({ queryParams }: RouteHandlerArgs) {
+  const qp = queryParams ?? {};
+  const range = parseTimeRange(qp);
+  const granularity = qp.granularity ?? "daily";
+  if (granularity !== "daily" && granularity !== "hourly") {
+    throw new BadRequestError(
+      `Invalid "granularity" value: "${granularity}". Must be one of: daily, hourly`,
+    );
+  }
+
+  const groupBy = qp.groupBy;
+  if (!groupBy) {
+    throw new BadRequestError(
+      `Missing required query parameter: "groupBy" (one of: ${SERIES_GROUP_BY_DESCRIPTION})`,
+    );
+  }
+  if (!VALID_SERIES_GROUP_BY.has(groupBy)) {
+    throw new BadRequestError(
+      `Invalid "groupBy" value: "${groupBy}". Must be one of: ${SERIES_GROUP_BY_DESCRIPTION}`,
+    );
+  }
+
+  const tz = resolveTimezone(qp);
+  const buckets = getUsageGroupedSeries(
     range,
-    groupBy as "actor" | "provider" | "model" | "conversation",
+    groupBy as Exclude<GroupByDimension, "conversation">,
+    granularity as UsageGranularity,
+    tz,
+    { fillEmpty: true },
   );
-  return { breakdown };
+  return { buckets };
 }
 
 export const ROUTES: RouteDefinition[] = [
@@ -166,7 +205,7 @@ export const ROUTES: RouteDefinition[] = [
     method: "GET",
     summary: "Get usage breakdown",
     description:
-      "Return grouped usage breakdown (by actor, provider, model, or conversation).",
+      "Return grouped usage breakdown. Prefer call_site for user-facing task breakdowns; actor is a legacy/internal dimension.",
     tags: ["usage"],
     queryParams: [
       {
@@ -181,8 +220,7 @@ export const ROUTES: RouteDefinition[] = [
       },
       {
         name: "groupBy",
-        description:
-          "Group by: actor, provider, model, or conversation (required)",
+        description: `Group by: ${GROUP_BY_DESCRIPTION} (required)`,
       },
     ],
     responseBody: z.object({
@@ -190,4 +228,43 @@ export const ROUTES: RouteDefinition[] = [
     }),
     handler: handleUsageBreakdown,
   },
+  {
+    operationId: "usage_series",
+    endpoint: "usage/series",
+    method: "GET",
+    summary: "Get grouped usage series",
+    description:
+      "Return usage buckets with per-group values for stacked charts. Prefer call_site for user-facing task stacks.",
+    tags: ["usage"],
+    queryParams: [
+      {
+        name: "from",
+        type: "integer",
+        description: "Start epoch millis (required)",
+      },
+      {
+        name: "to",
+        type: "integer",
+        description: "End epoch millis (required)",
+      },
+      {
+        name: "granularity",
+        schema: { type: "string", enum: ["daily", "hourly"] },
+        description: 'Bucket granularity: "daily" (default) or "hourly"',
+      },
+      {
+        name: "groupBy",
+        description: `Group by: ${SERIES_GROUP_BY_DESCRIPTION} (required)`,
+      },
+      {
+        name: "tz",
+        description:
+          'IANA timezone identifier (e.g. "America/Los_Angeles"). Bucket boundaries and display labels are computed in this timezone. Defaults to "UTC".',
+      },
+    ],
+    responseBody: z.object({
+      buckets: z.array(z.unknown()).describe("Grouped usage bucket objects"),
+    }),
+    handler: handleUsageSeries,
+  },
 ];

package/src/runtime/routes/user-routes.ts

@@ -63,42 +63,28 @@ function synthesizeRequest(method: string, args: RouteHandlerArgs): Request {
 }
 
 /**
- * Decompose a Web API `Response` into the return types the route adapters
- * understand: plain objects for JSON, `RouteResponse` for everything else.
+ * Collect response headers into a plain record.
  */
-async function decomposeResponse(
-  response: Response,
-): Promise<RouteResponse | Record<string, unknown>> {
-  const contentType = response.headers.get("content-type") ?? "";
-
-  // JSON responses → return as plain object so both HTTP and IPC adapters
-  // can serialize natively.
-  if (contentType.includes("application/json")) {
-    const json = (await response.json()) as Record<string, unknown>;
-
-    // If the status is non-200, wrap in a RouteResponse so the adapter
-    // preserves the status code (plain object returns default to 200).
-    if (response.status !== 200) {
-      const headers: Record<string, string> = {};
-      response.headers.forEach((v, k) => {
-        headers[k] = v;
-      });
-      return new RouteResponse(JSON.stringify(json), headers, response.status);
-    }
-
-    return json;
-  }
-
-  // Non-JSON responses → wrap body + headers in a RouteResponse.
+function collectHeaders(response: Response): Record<string, string> {
   const headers: Record<string, string> = {};
   response.headers.forEach((v, k) => {
     headers[k] = v;
   });
-  return new RouteResponse(
-    response.body ?? new Uint8Array(0),
-    headers,
-    response.status,
-  );
+  return headers;
+}
+
+/**
+ * Decompose a Web API `Response` into a `RouteResponse` that the route
+ * adapters (HTTP and IPC) can handle.
+ *
+ * Always wraps in `RouteResponse` so that status codes, custom headers
+ * (CORS, Cache-Control, etc.), and null bodies (204/304) are preserved
+ * faithfully. The body stream is passed through as-is — no
+ * parse/stringify round-trip.
+ */
+function decomposeResponse(response: Response): RouteResponse {
+  const headers = collectHeaders(response);
+  return new RouteResponse(response.body, headers, response.status);
 }
 
 /**

package/src/runtime/routes/work-items-routes.ts

@@ -36,7 +36,6 @@ import {
 } from "../../work-items/work-item-store.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import {
   BadRequestError,
   ConflictError,
@@ -52,9 +51,7 @@ const log = getLogger("work-items-routes");
 // ---------------------------------------------------------------------------
 
 function publishEvent(msg: ServerMessage): void {
-  void assistantEventHub.publish(
-    buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, msg),
-  );
+  void assistantEventHub.publish(buildAssistantEvent(msg));
 }
 
 function broadcastWorkItemStatus(id: string): void {

package/src/runtime/services/__tests__/analyze-conversation.test.ts

@@ -190,7 +190,7 @@ describe("analyzeConversation", () => {
     expect(currentConversation.runAgentLoop).toHaveBeenCalledWith(
       expect.any(String),
       "msg-1",
-      expect.any(Function),
+      undefined,
       expect.objectContaining({
         isInteractive: false,
         isUserMessage: true,
@@ -364,7 +364,7 @@ describe("analyzeConversation", () => {
     expect(currentConversation.runAgentLoop).toHaveBeenCalledWith(
       expect.any(String),
       "msg-1",
-      expect.any(Function),
+      undefined,
       expect.objectContaining({ callSite: "analyzeConversation" }),
     );
   });

package/src/runtime/services/analyze-conversation.ts

@@ -21,7 +21,6 @@
  * when no override is set).
  */
 import { getOrCreateConversation } from "../../daemon/conversation-store.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
 import {
   AUTO_ANALYSIS_GROUP_ID,
   AUTO_ANALYSIS_SOURCE,
@@ -36,9 +35,10 @@ import {
 } from "../../memory/conversation-crud.js";
 import { resolveConversationId } from "../../memory/conversation-key-store.js";
 import { getLogger } from "../../util/logger.js";
-import { buildAssistantEvent } from "../assistant-event.js";
-import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "../assistant-event-hub.js";
 import {
   buildAutoAnalysisPrompt,
   neutralizeTranscriptSentinel,
@@ -243,21 +243,11 @@ export async function analyzeConversation(
   }
 
   const hasLiveSubscriber = assistantEventHub.hasSubscribersForEvent({
-    assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
     conversationId: analysisConversationId,
   });
 
-  // j. Build onEvent using inline hub publisher
-  const onEvent = (msg: ServerMessage) => {
-    assistantEventHub.publish(
-      buildAssistantEvent(
-        DAEMON_INTERNAL_ASSISTANT_ID,
-        msg,
-        analysisConversationId,
-      ),
-    );
-  };
-  analysisConversation.updateClient(onEvent, !hasLiveSubscriber);
+  // j. Wire broadcastMessage as the event publisher
+  analysisConversation.updateClient(broadcastMessage, !hasLiveSubscriber);
 
   // k. Set up processing state (required by runAgentLoop guard)
   analysisConversation.processing = true;
@@ -268,7 +258,7 @@ export async function analyzeConversation(
   // routes the per-call provider config through `resolveCallSiteConfig`
   // against `llm.callSites.analyzeConversation`.
   analysisConversation
-    .runAgentLoop(prompt, messageId, onEvent, {
+    .runAgentLoop(prompt, messageId, undefined, {
       isInteractive: false,
       isUserMessage: true,
       callSite: "analyzeConversation",

package/src/runtime/services/conversation-serializer.ts

@@ -27,9 +27,7 @@ import { getBindingsForConversations } from "../../memory/external-conversation-
 // Helpers
 // ---------------------------------------------------------------------------
 
-export function buildAssistantAttention(
-  attentionState: AttentionState | undefined,
-):
+function buildAssistantAttention(attentionState: AttentionState | undefined):
   | {
       hasUnseenLatestAssistantMessage: boolean;
       latestAssistantMessageAt?: number;
@@ -65,7 +63,7 @@ export function buildAssistantAttention(
   };
 }
 
-export function buildForkParent(
+function buildForkParent(
   conversation: ConversationRow,
   parentCache: Map<string, ConversationRow | null>,
 ): { conversationId: string; messageId: string; title: string } | undefined {

package/src/runtime/verification-outbound-actions.ts

@@ -476,7 +476,7 @@ function startOutboundVoice(
  * Deliver a verification Slack DM via the Slack Web API directly.
  * Returns a promise that resolves when the delivery attempt completes.
  */
-export async function deliverVerificationSlackAsync(
+async function deliverVerificationSlackAsync(
   userId: string,
   text: string,
   assistantId: string,

package/src/runtime/verification-rate-limiter.ts

@@ -7,7 +7,7 @@ const DEFAULT_MAX_FAILURES = 3;
 const DEFAULT_WINDOW_MS = 5 * 60_000; // 5 minutes
 const MAX_TRACKED_IDENTITIES = 10_000;
 
-export class VerificationRateLimiter {
+class VerificationRateLimiter {
   private failures = new Map<string, number[]>();
   private readonly maxFailures: number;
   private readonly windowMs: number;

package/src/runtime/verification-templates.ts

@@ -42,9 +42,6 @@ export const GUARDIAN_VERIFY_TEMPLATE_KEYS = {
   CHANNEL_BOOTSTRAP_BOUND: "guardian_verify.channel.bootstrap_bound",
 } as const;
 
-export type GuardianVerifyTemplateKey =
-  (typeof GUARDIAN_VERIFY_TEMPLATE_KEYS)[keyof typeof GUARDIAN_VERIFY_TEMPLATE_KEYS];
-
 /** Template keys for Telegram/Slack text-based verification messages. */
 type TextVerifyTemplateKey =
   | typeof GUARDIAN_VERIFY_TEMPLATE_KEYS.ALREADY_VERIFIED
@@ -56,7 +53,7 @@ type TextVerifyTemplateKey =
   | typeof GUARDIAN_VERIFY_TEMPLATE_KEYS.SLACK_TRUSTED_CONTACT_RESEND;
 
 /** Template keys for deterministic channel verification reply messages. */
-export type ChannelVerifyReplyTemplateKey =
+type ChannelVerifyReplyTemplateKey =
   | typeof GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_SUCCESS
   | typeof GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_FAILED
   | typeof GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_BOOTSTRAP_BOUND;
@@ -65,18 +62,18 @@ export type ChannelVerifyReplyTemplateKey =
 // Template Variables
 // ---------------------------------------------------------------------------
 
-export interface GuardianVerifyTemplateVars {
+interface GuardianVerifyTemplateVars {
   code: string;
   expiresInMinutes: number;
   assistantName?: string;
 }
 
-export interface GuardianVerifyVoiceTemplateVars {
+interface GuardianVerifyVoiceTemplateVars {
   /** Number of digits in the verification code. */
   codeDigits: number;
 }
 
-export interface ChannelVerifyReplyVars {
+interface ChannelVerifyReplyVars {
   /** Failure reason (anti-oracle: generic message). Only used for failed template. */
   failureReason?: string;
   /** Drives different success copy for guardian vs trusted contact verification. */

package/src/schedule/integration-status.ts

@@ -1,9 +1,73 @@
 import { hasTwilioCredentials } from "../calls/twilio-rest.js";
+import type { Services } from "../config/schemas/services.js";
 import {
   getConnectionByProvider,
+  getProvider,
   isProviderConnected,
 } from "../oauth/oauth-store.js";
 
+/**
+ * Check whether a provider has an active connection, handling both BYO
+ * (local SQLite) and managed (platform) modes.
+ */
+async function isOAuthProviderConnected(provider: string): Promise<boolean> {
+  const providerRow = getProvider(provider);
+  const managedKey = providerRow?.managedServiceConfigKey;
+
+  if (managedKey) {
+    try {
+      const { ServicesSchema, getServiceMode } =
+        await import("../config/schemas/services.js");
+
+      if (managedKey in ServicesSchema.shape) {
+        const { getConfig } = await import("../config/loader.js");
+        const services: Services = getConfig().services;
+        if (
+          getServiceMode(services, managedKey as keyof Services) === "managed"
+        ) {
+          return isProviderConnectedOnPlatform(provider);
+        }
+      }
+    } catch {
+      // Config unavailable — fall through to BYO check
+    }
+  }
+
+  return isProviderConnected(provider);
+}
+
+/**
+ * Check the platform for active connections for a managed provider.
+ * Returns false on any error (network, auth, etc.) rather than throwing.
+ */
+async function isProviderConnectedOnPlatform(
+  provider: string,
+): Promise<boolean> {
+  try {
+    const { VellumPlatformClient } = await import("../platform/client.js");
+    const client = await VellumPlatformClient.create();
+    if (!client?.platformAssistantId) return false;
+
+    const params = new URLSearchParams();
+    params.set("provider", provider);
+    params.set("status", "ACTIVE");
+
+    const path = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/connections/?${params.toString()}`;
+    const response = await client.fetch(path);
+
+    if (!response.ok) return false;
+
+    const body = (await response.json()) as unknown;
+    const connections = Array.isArray(body)
+      ? body
+      : ((body as Record<string, unknown>).results ?? []);
+
+    return (connections as unknown[]).length > 0;
+  } catch {
+    return false;
+  }
+}
+
 interface IntegrationProbe {
   name: string;
   category: string;
@@ -15,12 +79,12 @@ const INTEGRATION_PROBES: IntegrationProbe[] = [
   {
     name: "Gmail",
     category: "email",
-    isConnected: () => isProviderConnected("google"),
+    isConnected: () => isOAuthProviderConnected("google"),
   },
   {
     name: "Slack",
     category: "messaging",
-    isConnected: () => isProviderConnected("slack"),
+    isConnected: () => isOAuthProviderConnected("slack"),
   },
   {
     name: "Twilio",

package/src/schedule/recurrence-engine.ts

@@ -107,7 +107,10 @@ export function validateRruleSetLines(expression: string): string | null {
 export function isValidScheduleExpression(spec: ScheduleSpec): boolean {
   try {
     if (spec.syntax === "cron") {
-      new Cron(spec.expression, { maxRuns: 0 });
+      new Cron(spec.expression, {
+        maxRuns: 0,
+        timezone: spec.timezone ?? undefined,
+      });
       return true;
     }