Q92: an unreadable or unrenewable credential is logged on its request

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/services/provider-background-service.ts

@@ -69,7 +69,8 @@ export class ProviderBackgroundService {
     input.onRequestCreated?.(requestId);
     const startedAt = Date.now();
     try {
-      const authProfile = execution.adapter.parseAuthProfile(execution.credential.secret);
+      // Read inside the request's try, so an unreadable credential is logged as this request's failure.
+      const authProfile = execution.adapter.parseAuthProfile(this.loadCredential(input.orgId, execution.provider).secret);
       const result = await execution.adapter.createBackgroundResponse({
         authProfile,
         model: execution.provider.model,
@@ -234,7 +235,6 @@ export class ProviderBackgroundService {
       instructions: input.instructions?.trim() || null,
       provider: { ...provider, model: provider.model },
       adapter: this.requireAdapter(provider.provider_key, provider.auth_type),
-      credential: this.loadCredential(input.orgId, provider),
     };
   }
 
@@ -326,7 +326,6 @@ interface PreparedBackgroundExecution {
   instructions: string | null;
   provider: ProviderRow & { model: string };
   adapter: ProviderAdapterRegistry[string];
-  credential: { secret: string };
 }
 
 interface ProviderRow {

src/main/services/provider-response-runner.ts

@@ -62,7 +62,8 @@ export class ProviderResponseRunner {
     input.onRequestCreated?.(requestId);
     const startedAt = Date.now();
     try {
-      const authProfile = execution.adapter.parseAuthProfile(execution.credential.secret);
+      // Read inside the request's try, so an unreadable credential is logged as this request's failure.
+      const authProfile = execution.adapter.parseAuthProfile(loadCredential(this.deps.authBroker, execution.orgId, execution.provider).secret);
       const result = await execution.adapter.createResponse({
         authProfile,
         model: execution.provider.model,
@@ -240,7 +241,8 @@ export class ProviderResponseRunner {
     let providerResponseId: string | null = null;
     let finished = false;
     try {
-      const authProfile = execution.adapter.parseAuthProfile(execution.credential.secret);
+      // Read inside the request's try, so an unreadable credential is logged as this request's failure.
+      const authProfile = execution.adapter.parseAuthProfile(loadCredential(this.deps.authBroker, execution.orgId, execution.provider).secret);
       const result = await execution.adapter.streamResponse({
         authProfile,
         model: execution.provider.model,
@@ -376,7 +378,6 @@ export class ProviderResponseRunner {
       executionMode,
       provider: { ...provider, model: provider.model },
       adapter: requireAdapter(this.deps.adapters, provider.provider_key, provider.auth_type),
-      credential: loadCredential(this.deps.authBroker, input.orgId, provider),
     };
   }
 
@@ -429,7 +430,6 @@ interface PreparedProviderExecution {
   executionMode: ProviderExecutionMode;
   provider: ProviderRow & { model: string };
   adapter: ProviderAdapterRegistry[string];
-  credential: { secret: string };
 }
 
 interface TurnCaller {