@vellumai/assistant 0.7.2 → 0.7.3

package/src/memory/v2/sim.ts

@@ -30,7 +30,6 @@ import { applyCorrectionIfCalibrated } from "../anisotropy.js";
 import { embedWithBackend } from "../embedding-backend.js";
 import { clampUnitInterval } from "../validation.js";
 import { hybridQueryConceptPages } from "./qdrant.js";
-import { hybridQuerySkills } from "./skill-qdrant.js";
 import { generateBm25QueryEmbedding } from "./sparse-bm25.js";
 
 /**
@@ -147,6 +146,7 @@ export async function simBatch(
   text: string,
   candidateSlugs: readonly string[],
   config: AssistantConfig,
+  options?: { signal?: AbortSignal },
 ): Promise<Map<string, number>> {
   if (candidateSlugs.length === 0) {
     return new Map();
@@ -158,12 +158,16 @@ export async function simBatch(
   // Sparse uses BM25: the query side encodes binary occurrences per token,
   // and the stored doc vectors carry the IDF · TF-saturated weights — Qdrant
   // dot product then yields the BM25 score directly.
-  const denseResult = await embedWithBackend(config, [text]);
+  throwIfAborted(options?.signal);
+  const denseResult = await embedWithBackend(config, [text], {
+    signal: options?.signal,
+  });
   const denseVector = await applyCorrectionIfCalibrated(
     denseResult.vectors[0],
     denseResult.provider,
     denseResult.model,
   );
+  throwIfAborted(options?.signal);
   const sparseVector = generateBm25QueryEmbedding(text);
 
   const hits = await hybridQueryConceptPages(
@@ -192,92 +196,14 @@ export async function simBatch(
   for (const hit of hits) {
     scores.set(hit.slug, fuseHit(hit, maxSparse, denseWeight, sparseWeight));
   }
+
   return scores;
 }
 
-/**
- * Compute hybrid (dense + sparse) similarity scores between a query text and
- * a fixed set of candidate skill ids. Mirrors `simBatch` but targets the
- * dedicated `memory_v2_skills` Qdrant collection via `hybridQuerySkills`.
- *
- * Differences from `simBatch`:
- *   - Keys are skill `id` values (not concept-page slugs).
- *   - Restricts the query to the caller's candidate ids server-side via
- *     `hybridQuerySkills`'s `restrictToIds` parameter. Without this, when the
- *     skills collection has more skills than `ids.length`, Qdrant would
- *     return its global top-K and candidate ids absent from that top-K would
- *     silently score 0 — corrupting the activation calculation.
- *
- * Returns a `Map<id, score>` of fused scores in [0, 1]. Ids that did not hit
- * either channel are absent from the map.
- *
- * Edge cases:
- *   - Empty `ids` → returns an empty map without touching Qdrant or the
- *     embedding backend.
- *   - Empty / whitespace-only `text` → returns an empty map without touching
- *     Qdrant or the embedding backend. Same rationale as {@link simBatch}:
- *     Gemini rejects empty content with HTTP 400, so the activation pipeline
- *     would otherwise fail on turn 1 (where the assistant-text channel is
- *     `""`). Treating the channel's contribution as 0 matches a no-hit
- *     query.
- */
-export async function simSkillBatch(
-  text: string,
-  ids: readonly string[],
-  config: AssistantConfig,
-): Promise<Map<string, number>> {
-  if (ids.length === 0) {
-    return new Map();
-  }
-  if (text.trim().length === 0) {
-    return new Map();
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) {
+    throw new DOMException("Aborted", "AbortError");
   }
-
-  const denseResult = await embedWithBackend(config, [text]);
-  const denseVector = await applyCorrectionIfCalibrated(
-    denseResult.vectors[0],
-    denseResult.provider,
-    denseResult.model,
-  );
-  const sparseVector = generateBm25QueryEmbedding(text);
-
-  const hits = await hybridQuerySkills(
-    denseVector,
-    sparseVector,
-    ids.length,
-    ids,
-  );
-
-  if (hits.length === 0) {
-    return new Map();
-  }
-
-  // Defensive post-filter — `hybridQuerySkills` restricts server-side, so
-  // every hit should already be in `ids`, but keep this guard so a buggy
-  // payload (e.g. a missing/typoed id index) can't silently inject
-  // out-of-set ids into the score map.
-  const idSet = new Set(ids);
-  const filtered = hits.filter((h) => idSet.has(h.id));
-  if (filtered.length === 0) {
-    return new Map();
-  }
-
-  const maxSparse = computeMaxSparse(filtered);
-  const { dense_weight: baseDense, sparse_weight: baseSparse } =
-    config.memory.v2;
-  const { dense: denseWeight, sparse: sparseWeight } = effectiveWeights(
-    filtered,
-    maxSparse,
-    baseDense,
-    baseSparse,
-    config,
-  );
-
-  const scores = new Map<string, number>();
-  for (const hit of filtered) {
-    scores.set(hit.id, fuseHit(hit, maxSparse, denseWeight, sparseWeight));
-  }
-  return scores;
 }
 
 /**

package/src/memory/v2/skill-content.ts

@@ -2,9 +2,10 @@ import { getConfig } from "../../config/loader.js";
 import type { SkillCapabilityInput } from "../../skills/skill-memory.js";
 
 /**
- * Render the prose-style capability statement embedded into the
- * `memory_v2_skills` Qdrant collection and rendered in
- * `### Skills You Can Use`. Capped at 500 chars to match v1's behavior.
+ * Render the prose-style capability statement embedded into the unified
+ * `memory_v2_concept_pages` Qdrant collection (under the `skills/<id>` slug
+ * prefix) and rendered in `### Skills You Can Use`. Capped at 500 chars to
+ * match v1's behavior.
  */
 export function buildSkillContent(input: SkillCapabilityInput): string {
   let content = `The "${input.displayName}" skill (${input.id}) is available. ${input.description}.`;

package/src/memory/v2/skill-store.ts

@@ -2,18 +2,22 @@
 // Memory v2 — Skill catalog → embedded skill entries
 // ---------------------------------------------------------------------------
 //
-// Mirrors v1's `seedSkillGraphNodes` + `seedUninstalledCatalogSkillMemories`
-// (capability-seed.ts) for the v2 pipeline: enumerate the enabled-skill
-// catalog AND uninstalled catalog skills, render each skill's prose statement
-// via `buildSkillContent`, embed dense + sparse, upsert into the dedicated
-// `memory_v2_skills` Qdrant collection, and prune stale points from prior
-// catalog state. Including uninstalled catalog skills ensures their activation
-// hints are discoverable by intent so the model can auto-install them.
+// Enumerate the enabled-skill catalog AND uninstalled catalog skills, render
+// each skill's prose statement via `buildSkillContent`, embed dense + sparse,
+// and upsert into `memory_v2_concept_pages` under the slug `skills/<id>`.
+// Including uninstalled catalog skills ensures their activation hints are
+// discoverable by intent so the model can auto-install them.
 //
-// Unlike v1, skill entries are kept in a small in-process cache so the render
-// path can fetch a `SkillEntry` synchronously by id without round-tripping to
-// Qdrant. The cache is replaced atomically at the end of a successful seed
-// run; on error the prior cache stays intact (skills are best-effort).
+// Skills share the concept-page collection rather than living in a dedicated
+// one so the per-turn activation pipeline scores them against the same
+// candidate ANN as concept pages, with the same decay and spread machinery.
+// The render path branches on the `skills/` slug prefix to surface them as
+// the `### Skills You Can Use` subsection.
+//
+// Skill entries are kept in a small in-process cache so the render path can
+// fetch a `SkillEntry` synchronously by id without round-tripping to Qdrant.
+// The cache is replaced atomically at the end of a successful seed run; on
+// error the prior cache stays intact (skills are best-effort).
 
 import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { getConfig } from "../../config/loader.js";
@@ -30,15 +34,31 @@ import {
   embedWithBackend,
   generateSparseEmbedding,
 } from "../embedding-backend.js";
+import {
+  pruneSlugsWithPrefixExcept,
+  upsertConceptPageEmbedding,
+} from "./qdrant.js";
 import {
   augmentMcpSetupDescription,
   buildSkillContent,
 } from "./skill-content.js";
-import { pruneSkillsExcept, upsertSkillEmbedding } from "./skill-qdrant.js";
 import type { SkillEntry } from "./types.js";
 
 const log = getLogger("memory-v2-skill-store");
 
+/**
+ * Slug prefix under which skill embeddings are indexed in
+ * `memory_v2_concept_pages`. Concept-page slugs must match
+ * `[a-z0-9][a-z0-9-]*(/...)*`, and `skills` matches that pattern, so the
+ * prefix coexists with hand-authored concept pages without escape work.
+ */
+export const SKILL_SLUG_PREFIX = "skills/";
+
+/** Compose the unified-collection slug for a skill id. */
+export function skillSlugFor(id: string): string {
+  return `${SKILL_SLUG_PREFIX}${id}`;
+}
+
 /**
  * Module-level cache of rendered skill entries keyed by skill id. `null` until
  * the first successful seed run completes; replaced atomically on each
@@ -47,30 +67,27 @@ const log = getLogger("memory-v2-skill-store");
 let entries: Map<string, SkillEntry> | null = null;
 
 /**
- * Seed (or re-seed) the v2 skill embedding collection from the live skill
- * catalog. Idempotent: safe to call repeatedly. Best-effort: never throws —
- * any failure leaves the prior `entries` cache in place and logs a warning.
+ * Seed (or re-seed) skill embeddings into the unified concept-page collection.
+ * Idempotent: safe to call repeatedly. Best-effort: never throws — any
+ * failure leaves the prior `entries` cache in place and logs a warning.
  *
  * Steps:
- *   1. Enumerate the local skill catalog and resolve each skill's enabled state
- *      (`resolveSkillStates`).
- *   2. Build a `SkillCapabilityInput` per enabled skill, applying the
- *      mcp-setup augmentation (mirrors v1) and the prose-style content render
- *      (`buildSkillContent`, capped at 500 chars).
+ *   1. Enumerate the local skill catalog and resolve each skill's enabled
+ *      state (`resolveSkillStates`).
+ *   2. Build a `SkillEntry` per enabled skill, applying the mcp-setup
+ *      augmentation and the prose-style content render (`buildSkillContent`,
+ *      capped at 500 chars).
  *   3. Defense-in-depth feature-flag filter: drop any skill whose declared
- *      `metadata.vellum.feature-flag` is currently disabled. `resolveSkillStates`
- *      already enforces this, but we mirror v1's enforcement point so the v2
- *      collection never holds an embedding for a flag-gated skill if the two
- *      ever drift.
- *   3b. Fetch the full remote catalog and seed any uninstalled skills so their
- *      activation hints are discoverable by semantic search. Best-effort: if
- *      the catalog fetch fails, only installed skills are seeded.
+ *      `metadata.vellum.feature-flag` is currently disabled.
+ *   3b. Fetch the full remote catalog and seed any uninstalled skills so
+ *      their activation hints are discoverable by semantic search. Best-effort:
+ *      if the catalog fetch fails, only installed skills are seeded.
  *   4. Embed all `content` strings in a single dense `embedWithBackend` call,
  *      and a per-skill synchronous `generateSparseEmbedding`.
- *   5. Upsert one Qdrant point per skill via `upsertSkillEmbedding` (keyed
- *      deterministically on id so re-runs replace in place).
- *   6. Call `pruneSkillsExcept` with the active id list to drop any stale
- *      points from prior catalog state (e.g. uninstalled skills).
+ *   5. Upsert one Qdrant point per skill via `upsertConceptPageEmbedding`
+ *      keyed deterministically on slug `skills/<id>`.
+ *   6. Call `pruneSlugsWithPrefixExcept(SKILL_SLUG_PREFIX, ...)` to drop any
+ *      stale points from prior catalog state (e.g. uninstalled skills).
  *   7. Replace the module-level `entries` cache with the freshly built map.
  */
 export async function seedV2SkillEntries(): Promise<void> {
@@ -83,8 +100,7 @@ export async function seedV2SkillEntries(): Promise<void> {
     // Track every locally-installed skill id (regardless of enabled/disabled
     // state) so the catalog-seeding loop below treats them all as "installed"
     // and never re-seeds a disabled skill from `getCatalog()` as if it were
-    // uninstalled. Mirrors v1's `seedUninstalledCatalogSkillMemories`, which
-    // keys off `loadSkillCatalog()` (the installed set) for the same reason.
+    // uninstalled.
     const installedIds = new Set<string>(catalog.map((s) => s.id));
 
     // Build the input list, applying the mcp-setup description augmentation
@@ -100,8 +116,8 @@ export async function seedV2SkillEntries(): Promise<void> {
     }
 
     // Seed uninstalled catalog skills so their activation hints are
-    // discoverable by intent (mirrors v1's seedUninstalledCatalogSkillMemories).
-    // Track whether the catalog was available so we can guard pruning below.
+    // discoverable by intent. Track whether the catalog was available so we
+    // can guard pruning below.
     let catalogAvailable = false;
     try {
       const fullCatalog = await getCatalog();
@@ -135,24 +151,29 @@ export async function seedV2SkillEntries(): Promise<void> {
 
     const now = Date.now();
     const nextEntries = new Map<string, SkillEntry>();
-    for (let i = 0; i < seeds.length; i++) {
-      const seed = seeds[i];
-      await upsertSkillEmbedding({
-        ...seed,
-        dense: denseVectors[i],
-        sparse: generateSparseEmbedding(seed.content),
-        updatedAt: now,
-      });
+    await Promise.all(
+      seeds.map((seed, i) =>
+        upsertConceptPageEmbedding({
+          slug: skillSlugFor(seed.id),
+          dense: denseVectors[i],
+          sparse: generateSparseEmbedding(seed.content),
+          updatedAt: now,
+        }),
+      ),
+    );
+    for (const seed of seeds) {
       nextEntries.set(seed.id, seed);
     }
 
-    // Prune stale points. When the catalog is unavailable (empty array from
-    // network failure or cold cache), we cannot enumerate which uninstalled
-    // catalog skills should exist, so skip pruning entirely to avoid
-    // aggressively removing previously-seeded catalog skill embeddings.
-    // Mirrors v1's safeguard in capability-seed.ts (lines 124–143).
+    // Prune stale skill slugs. When the catalog is unavailable (empty array
+    // from network failure or cold cache), we cannot enumerate which
+    // uninstalled catalog skills should exist, so skip pruning entirely to
+    // avoid aggressively removing previously-seeded catalog skill embeddings.
     if (catalogAvailable) {
-      await pruneSkillsExcept(seeds.map((s) => s.id));
+      await pruneSlugsWithPrefixExcept(
+        SKILL_SLUG_PREFIX,
+        seeds.map((s) => s.id),
+      );
     } else {
       log.info(
         "Catalog unavailable — skipping skill pruning to preserve prior catalog embeddings",
@@ -169,20 +190,22 @@ export async function seedV2SkillEntries(): Promise<void> {
 /**
  * Synchronous lookup of a previously-seeded `SkillEntry` by skill id. Returns
  * `null` when the cache has not yet been populated, when the id is unknown,
- * or when a prior seed run dropped the id (e.g. the skill was disabled). Used
- * by the render path to attach skill-related content to outgoing prompts.
+ * or when a prior seed run dropped the id (e.g. the skill was disabled).
+ *
+ * Accepts either a bare skill id (`example-skill`) or its unified-collection
+ * slug (`skills/example-skill`) so render-side callers can pass through what
+ * they have without a manual prefix strip.
  */
-export function getSkillCapability(id: string): SkillEntry | null {
+export function getSkillCapability(idOrSlug: string): SkillEntry | null {
+  const id = idOrSlug.startsWith(SKILL_SLUG_PREFIX)
+    ? idOrSlug.slice(SKILL_SLUG_PREFIX.length)
+    : idOrSlug;
   return entries?.get(id) ?? null;
 }
 
-/**
- * Every skill id in the cache — both installed-and-enabled skills and
- * uninstalled-catalog skills. Empty before the first `seedV2SkillEntries`
- * run completes.
- */
-export function getAllSkillIds(): string[] {
-  return entries ? [...entries.keys()] : [];
+/** True iff the slug refers to a skill entry in the unified collection. */
+export function isSkillSlug(slug: string): boolean {
+  return slug.startsWith(SKILL_SLUG_PREFIX);
 }
 
 /** @internal Test-only: clear the module-level cache. */

package/src/memory/v2/static-context.ts

@@ -17,6 +17,7 @@
 // content through when `mode === "full"` (first turn / post-compaction),
 // matching the existing PKB auto-inject pattern.
 
+import type { ChannelId } from "../../channels/types.js";
 import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { loadConfig } from "../../config/loader.js";
 import { readPromptFile } from "../../prompts/system-prompt.js";
@@ -61,3 +62,24 @@ export function readMemoryV2StaticContent(): string | null {
   }
   return sections.length > 0 ? sections.join("\n\n") : null;
 }
+
+/**
+ * Static memory holds the user's aggregate personal pages
+ * (essentials/threads/recent/buffer). Block injection when a non-guardian
+ * actor reaches the assistant over a remote channel — otherwise the model
+ * can be prompt-injected into reciting private memory. Internal flows
+ * (`sourceChannel: "vellum"`) and turns with no trust context pass through
+ * unchanged; this gate exists only to keep remote untrusted actors out.
+ */
+export function shouldLoadMemoryV2Static(args: {
+  shouldInjectNowAndPkb: boolean;
+  sourceChannel: ChannelId | undefined;
+  isTrustedActor: boolean;
+}): boolean {
+  if (!args.shouldInjectNowAndPkb) return false;
+  const isRemoteUntrustedActor =
+    args.sourceChannel !== undefined &&
+    args.sourceChannel !== "vellum" &&
+    !args.isTrustedActor;
+  return !isRemoteUntrustedActor;
+}

package/src/memory/v2/types.ts

@@ -85,20 +85,20 @@ export const ActivationStateSchema = z.object({
 export type ActivationState = z.infer<typeof ActivationStateSchema>;
 
 // ---------------------------------------------------------------------------
-// Skill autoinjection (synthetic in-memory entries, not on-disk pages)
+// Skill entries (synthetic concept-collection rows, not on-disk pages)
 // ---------------------------------------------------------------------------
 
 /**
- * Per-skill capability snapshot held in-process and embedded into the
- * `memory_v2_skills` Qdrant collection. `content` is the rendered
- * `buildSkillContent` string — already capped at 500 chars upstream and
- * already containing the skill's display name — and is what we embed and
- * what we render verbatim in `### Skills You Can Use`.
+ * Per-skill capability snapshot held in-process and embedded into the unified
+ * `memory_v2_concept_pages` Qdrant collection under the slug `skills/<id>`.
+ * `content` is the rendered `buildSkillContent` string — already capped at
+ * 500 chars upstream and already containing the skill's display name — and
+ * is what we embed and what we render verbatim in `### Skills You Can Use`.
  *
- * Plain interface (no Zod) because skill data does not cross a
- * serialization boundary: it is built in-process by `seedV2SkillEntries`
- * and read in-process by `renderInjectionBlock`. The Qdrant payload is
- * not parsed back through this type.
+ * Plain interface (no Zod) because skill data does not cross a serialization
+ * boundary: it is built in-process by `seedV2SkillEntries` and read in-process
+ * by `renderInjectionBlock`. The Qdrant payload is not parsed back through
+ * this type.
  */
 export interface SkillEntry {
   id: string;

package/src/notifications/copy-composer.ts

@@ -505,6 +505,19 @@ const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
     body: str(payload.body, "A watcher event requires your attention"),
   }),
 
+  "heartbeat.alert": (payload) => {
+    const body = str(
+      payload.summary,
+      str(payload.body, "Your assistant found something worth your attention."),
+    );
+    return {
+      title: str(payload.title, "Heartbeat Alert"),
+      body,
+      conversationTitle: str(payload.conversationTitle, "Heartbeat"),
+      conversationSeedMessage: body,
+    };
+  },
+
   "tool_confirmation.required_action": (payload) => ({
     title: "Tool Confirmation",
     body: str(payload.toolName, "A tool") + " requires your confirmation",

package/src/notifications/signal.ts

@@ -101,6 +101,10 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     description:
       "OAuth credential health issue detected (expired, revoked, missing scopes)",
   },
+  {
+    id: "heartbeat.alert",
+    description: "Heartbeat found something worth surfacing to the guardian",
+  },
 ] as const;
 
 export type NotificationSourceEventName =

package/src/oauth/AGENTS.md

@@ -54,7 +54,9 @@ Most existing logos come from [Simple Icons](https://simpleicons.org) (CC0-licen
 
 If the service is not on Simple Icons, source or create an SVG and convert it the same way. The result must be a true vector PDF (not a rasterized image wrapped in PDF) so it scales cleanly.
 
-The `logoUrl` field in `seed-providers.ts` still serves as the remote fallback (typically a Simple Icons CDN URL like `https://cdn.simpleicons.org/acme`). The client renders the local PDF first, then falls back to `logoUrl`, then to an initials avatar.
+The `logoUrl` field in `seed-providers.ts` serves as the remote fallback (most providers use a Simple Icons CDN URL like `https://cdn.simpleicons.org/acme`). The client renders the local PDF first, then falls back to `logoUrl`, then to an initials avatar.
+
+For brands Simple Icons doesn't host (e.g. Salesforce, which Simple Icons removed for trademark reasons), use the same `glincker/thesvg` source via jsDelivr — `https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/<key>/default.svg`. The recognised `logoUrl` prefixes are enforced by `oauth-provider-seed-logos.test.ts`; if you need a third source, extend that allowlist alongside the manifest in `clients/shared/Resources/integration-logos-manifest.json`.
 
 ### 5. Secret patterns (if applicable) — `../security/secret-patterns.ts`
 

package/src/oauth/__tests__/oauth-connect-state.test.ts

@@ -0,0 +1,137 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  _clearAllOAuthConnectStates,
+  clearExpiredOAuthConnectStates,
+  getOAuthConnectState,
+  setOAuthConnectComplete,
+  setOAuthConnectError,
+  setOAuthConnectPending,
+} from "../oauth-connect-state.js";
+
+describe("oauth-connect-state", () => {
+  beforeEach(() => {
+    _clearAllOAuthConnectStates();
+  });
+
+  test("setOAuthConnectPending → getOAuthConnectState returns pending", () => {
+    setOAuthConnectPending("state-1", "google");
+    const result = getOAuthConnectState("state-1");
+    expect(result).toMatchObject({ status: "pending", service: "google" });
+  });
+
+  test("setOAuthConnectComplete without accountInfo → returns complete", () => {
+    setOAuthConnectComplete("state-1", "google");
+    const result = getOAuthConnectState("state-1");
+    expect(result).toMatchObject({ status: "complete", service: "google" });
+  });
+
+  test("setOAuthConnectComplete with accountInfo → returns complete with accountInfo", () => {
+    setOAuthConnectComplete("state-1", "google", "user@example.com");
+    const result = getOAuthConnectState("state-1");
+    expect(result).toMatchObject({
+      status: "complete",
+      service: "google",
+      accountInfo: "user@example.com",
+    });
+  });
+
+  test("setOAuthConnectComplete with grantedScopes → returns complete with grantedScopes", () => {
+    setOAuthConnectComplete("state-1", "google", "user@example.com", ["scope:read", "scope:write"]);
+    const result = getOAuthConnectState("state-1");
+    expect(result).toMatchObject({
+      status: "complete",
+      service: "google",
+      accountInfo: "user@example.com",
+      grantedScopes: ["scope:read", "scope:write"],
+    });
+  });
+
+  test("setOAuthConnectError → returns error with message", () => {
+    setOAuthConnectError("state-1", "google", "token exchange failed");
+    const result = getOAuthConnectState("state-1");
+    expect(result).toMatchObject({
+      status: "error",
+      service: "google",
+      error: "token exchange failed",
+    });
+  });
+
+  test("re-setting same state token overwrites previous", () => {
+    setOAuthConnectPending("state-1", "google");
+    setOAuthConnectComplete("state-1", "google", "user@example.com");
+    const result = getOAuthConnectState("state-1");
+    expect(result?.status).toBe("complete");
+  });
+
+  test("getOAuthConnectState returns null for unknown state", () => {
+    expect(getOAuthConnectState("nonexistent")).toBeNull();
+  });
+
+  test("_clearAllOAuthConnectStates removes all entries", () => {
+    setOAuthConnectPending("state-1", "google");
+    setOAuthConnectPending("state-2", "github");
+    _clearAllOAuthConnectStates();
+    expect(getOAuthConnectState("state-1")).toBeNull();
+    expect(getOAuthConnectState("state-2")).toBeNull();
+  });
+
+  test("clearExpiredOAuthConnectStates removes expired pending entries", () => {
+    setOAuthConnectPending("state-1", "google");
+    // Advance Date.now by 6 minutes past PENDING_TTL_MS (5 min)
+    const originalNow = Date.now;
+    Date.now = () => originalNow() + 6 * 60 * 1000;
+    clearExpiredOAuthConnectStates();
+    Date.now = originalNow;
+    expect(getOAuthConnectState("state-1")).toBeNull();
+  });
+
+  test("clearExpiredOAuthConnectStates removes expired complete entries (past 60s grace)", () => {
+    setOAuthConnectComplete("state-1", "google");
+    const originalNow = Date.now;
+    Date.now = () => originalNow() + 2 * 60 * 1000; // advance 2 minutes past 60s grace
+    clearExpiredOAuthConnectStates();
+    Date.now = originalNow;
+    expect(getOAuthConnectState("state-1")).toBeNull();
+  });
+
+  test("clearExpiredOAuthConnectStates removes expired error entries (past 60s grace)", () => {
+    setOAuthConnectError("state-1", "google", "token exchange failed");
+    const originalNow = Date.now;
+    Date.now = () => originalNow() + 2 * 60 * 1000; // advance 2 minutes past 60s grace
+    clearExpiredOAuthConnectStates();
+    Date.now = originalNow;
+    expect(getOAuthConnectState("state-1")).toBeNull();
+  });
+
+  test("clearExpiredOAuthConnectStates does not remove non-expired pending entries", () => {
+    setOAuthConnectPending("state-1", "google");
+    clearExpiredOAuthConnectStates(); // called without advancing time
+    expect(getOAuthConnectState("state-1")).not.toBeNull();
+  });
+
+  test("sweep-on-insert: setOAuthConnectPending purges expired entries before inserting new one", () => {
+    // 1. Add an entry that will expire
+    setOAuthConnectPending("expired-state", "google");
+
+    // 2. Advance Date.now past the PENDING_TTL_MS (5 min)
+    const originalNow = Date.now;
+    Date.now = () => originalNow() + 6 * 60 * 1000;
+
+    // 3. Insert a new entry — this should trigger clearExpiredOAuthConnectStates() internally
+    setOAuthConnectPending("new-state", "github");
+
+    // 4. Restore Date.now before assertions (getOAuthConnectState also calls clearExpiredOAuthConnectStates)
+    Date.now = originalNow;
+
+    // The expired entry must have been swept out during the insert
+    // Use the map directly via getOAuthConnectState — expired-state is gone
+    // We call _clearAllOAuthConnectStates in beforeEach so we know the map started empty.
+    // After the insert the map should only contain "new-state".
+    const expiredResult = getOAuthConnectState("expired-state");
+    expect(expiredResult).toBeNull();
+
+    const newResult = getOAuthConnectState("new-state");
+    expect(newResult).toMatchObject({ status: "pending", service: "github" });
+  });
+});

package/src/oauth/connect-orchestrator.ts

@@ -81,6 +81,7 @@ export interface OAuthConnectOptions {
     success: boolean;
     service: string;
     accountInfo?: string;
+    grantedScopes?: string[];
     error?: string;
   }) => void;
 }
@@ -256,6 +257,7 @@ export async function orchestrateOAuthConnect(
               success: true,
               service: options.service,
               accountInfo: stored.accountInfo ?? parsedAccountIdentifier,
+              grantedScopes: result.grantedScopes,
             });
           } catch (err) {
             log.error(