Q88: a sign-in is saved only if a run can use and renew it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/agent-instructions.test.ts

@@ -135,7 +135,7 @@ describe("agent instruction wiring", () => {
       capturedInstructions = input.instructions ?? "";
       return { text: "done", toolCalls: [], rawResponseJson: JSON.stringify({ id: "resp-1" }) };
     };
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     const execution = new TaskExecutionService(connection.db, providers);
 
     let orgId = "";
@@ -190,7 +190,7 @@ describe("agent instruction wiring", () => {
       capturedPrompt = first.text;
       return { text: "done", toolCalls: [], rawResponseJson: JSON.stringify({ id: "resp-1" }) };
     };
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     const execution = new TaskExecutionService(connection.db, providers);
     let orgId = "";
     let taskId = "";

tests/unit/char-accounting.test.ts

@@ -19,7 +19,7 @@ describe("character accounting", () => {
     const toolCalls = [{ id: "c1", name: "send_message", arguments: { channel: "general", body: "Shipping today." } }];
     const turn = async (): Promise<AgentTurnResult> => ({ text: "Posting.", toolCalls, rawResponseJson: "{}" });
     const connection = new DatabaseConnection(join(tmpdir(), `ac-chars-${randomUUID()}.db`));
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, turn);
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, turn);
     let orgId = "";
     let providerId = "";
     connection.transaction(() => {

tests/unit/model-check.test.ts

@@ -21,7 +21,7 @@ const TEXT_ONLY = async (): Promise<AgentTurnResult> => ({ text: "Sure, the code
 
 function harness(turn: (input: ProviderToolTurnInput) => Promise<AgentTurnResult>) {
   const connection = new DatabaseConnection(join(tmpdir(), `ac-model-check-${randomUUID()}.db`));
-  const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, turn);
+  const providers = new ProviderService(connection.db, providerAdapters, testVault, turn);
   let orgId = "";
   let providerId = "";
   connection.transaction(() => {

tests/unit/provider-error-codes.test.ts

@@ -109,7 +109,7 @@ describe("provider errors keep their status and machine code", () => {
   test("our own monthly limit is a typed error, and a failed request keeps its status and code", async () => {
     const connection = new DatabaseConnection(join(tmpdir(), `ac-codes-${randomUUID()}.db`));
     const vault = { encryptSecret: (secret: string) => Buffer.from(secret, "utf8"), decryptSecret: (ciphertext: Buffer) => ciphertext.toString("utf8") };
-    const providers = new ProviderService(connection.db, providerAdapters, vault, undefined, async () => { throw new ProviderHttpError("Overloaded", null, 529, false, "overloaded_error"); });
+    const providers = new ProviderService(connection.db, providerAdapters, vault, async () => { throw new ProviderHttpError("Overloaded", null, 529, false, "overloaded_error"); });
     let orgId = "";
     let providerId = "";
     connection.transaction(() => {

tests/unit/provider-oauth.test.ts

@@ -5,7 +5,7 @@ import { interpretKimiPollResponse } from "../../src/main/services/oauth/kimi-co
 import { extractAccountId } from "../../src/main/services/oauth/openai-codex-flow";
 import { readProjectId, requireAntigravityClientSecret } from "../../src/main/services/oauth/google-antigravity-flow";
 import { generatePkce } from "../../src/main/services/oauth/pkce";
-import { parseAccessToken, parseAccountToken } from "../../src/main/services/provider-auth-profiles";
+import { providerAdapters } from "../../src/main/services/provider-adapters";
 
 function makeJwt(claims: Record<string, unknown>): string {
   const part = (value: unknown) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -112,18 +112,20 @@ describe("pkce generation", () => {
 });
 
 describe("oauth credential parsing", () => {
-  test("accepts a raw token", () => {
-    expect(parseAccessToken("ghu_raw")).toEqual({ type: "access_token", accessToken: "ghu_raw" });
-    expect(parseAccountToken("chatgpt_raw")).toEqual({ type: "account_token", accessToken: "chatgpt_raw" });
+  const signIn = (extra: Record<string, unknown> = {}) => JSON.stringify({ access: "live_token", refresh: "r", expires: 1_900_000_000_000, ...extra });
+
+  test("a stored sign-in is accepted only with what a run needs to use and renew it", () => {
+    expect(providerAdapters["github-copilot"].parseAuthProfile(signIn())).toEqual({ type: "access_token", accessToken: "live_token" });
+    expect(providerAdapters["gpt-account"].parseAuthProfile(signIn({ accountId: "acct_1" }))).toEqual({ type: "account_token", accessToken: "live_token" });
+    expect(providerAdapters["google-antigravity"].parseAuthProfile(signIn({ projectId: "proj-1" }))).toEqual({ type: "access_token", accessToken: "live_token" });
   });
 
-  test("extracts the access token from native OAuth credential JSON", () => {
-    const secret = JSON.stringify({ access: "live_token", refresh: "r", expires: 123 });
-    expect(parseAccessToken(secret)).toEqual({ type: "access_token", accessToken: "live_token" });
-    expect(parseAccountToken(secret)).toEqual({ type: "account_token", accessToken: "live_token" });
-  });
-
-  test("rejects credential JSON without an access token", () => {
-    expect(() => parseAccessToken(JSON.stringify({ refresh: "r" }))).toThrow("missing an access token");
+  test("a pasted token, or a sign-in missing its refresh token, expiry or provider extras, is refused at save time", () => {
+    expect(() => providerAdapters["github-copilot"].parseAuthProfile("ghu_raw")).toThrow("Sign in to GitHub Copilot");
+    expect(() => providerAdapters["claude-pro"].parseAuthProfile(JSON.stringify({ access: "a", expires: 1 }))).toThrow("missing its refresh token");
+    expect(() => providerAdapters["kimi-code"].parseAuthProfile(JSON.stringify({ access: "a", refresh: "r" }))).toThrow("missing its expiry");
+    expect(() => providerAdapters["gpt-account"].parseAuthProfile(signIn())).toThrow("missing its ChatGPT account id");
+    expect(() => providerAdapters["google-antigravity"].parseAuthProfile(signIn())).toThrow("missing its Google Cloud project id");
   });
 });
+

tests/unit/provider-service.test.ts

@@ -141,7 +141,7 @@ describe("provider service", () => {
     let mode: "capable" | "text" | "down" = "capable";
     const seen: string[] = [];
     const capable: (input: ProviderToolTurnInput) => Promise<AgentTurnResult> = answeringModelCheck(async () => ({ text: "", toolCalls: [], rawResponseJson: "{}" }));
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, async (input) => {
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, async (input) => {
       seen.push(`${input.credential.apiKey}:${input.model}`);
       if (mode === "down") throw new Error("401 invalid x-api-key");
       return mode === "text" ? { text: "I am healthy.", toolCalls: [], rawResponseJson: "{}" } : capable(input);
@@ -173,98 +173,27 @@ describe("provider service", () => {
     connection.close();
   });
 
-  test("audits provider sign-in launches with the employee actor", () => {
+  test("a sign-in provider saves only a native sign-in, recorded as coming from the OAuth login", () => {
     const connection = createConnection();
     const organization = new OrganizationService(connection.db);
     const snapshot = new SnapshotService(connection.db);
-    let launched: { providerId: string; label: string; signInUrl: string; partition: string } | null = null;
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, (input) => { launched = input; });
+    const providers = new ProviderService(connection.db, providerAdapters, testVault);
     let orgId = "";
-    let employeeId = "";
     let copilotProviderId = "";
+    const signIn = JSON.stringify({ access: "ghu_live_provider", refresh: "ghr_refresh", expires: 1_900_000_000_000 });
 
     connection.transaction(() => {
       orgId = createOrganization(organization);
-      employeeId = (connection.db.prepare("select id from employees where org_id = ?").get(orgId) as { id: string }).id;
       copilotProviderId = providerId(connection, orgId, "github-copilot");
     });
 
-    expect(() => providers.launchSignInWindow({
-      orgId,
-      providerId: copilotProviderId,
-      employeeId: "emp_missing",
-    })).toThrow("Provider sign-in employee was not found.");
-
-    connection.transaction(() => providers.launchSignInWindow({ orgId, providerId: copilotProviderId, employeeId }));
-
-    const state = snapshot.load();
-    expect(launched).toMatchObject({
-      providerId: copilotProviderId,
-      label: "GitHub Copilot",
-      signInUrl: "https://github.com/login/device",
-      partition: `persist:agentcompany-provider-${copilotProviderId}`,
-    });
-    expect(state.providerAuthSessions[0]).toMatchObject({
-      orgId,
-      providerId: copilotProviderId,
-      providerKey: "github-copilot",
-      employeeId,
-      partition: `persist:agentcompany-provider-${copilotProviderId}`,
-      completedAt: null,
-    });
-    expect(state.providerAuthSessions[0]?.state).toHaveLength(32);
-    expect(state.providerAuthSessions[0]?.nonce).toHaveLength(32);
-    expect(state.providerAuthSessions[0]?.codeVerifierSha256).toHaveLength(64);
-    expect(state.auditEvents).toContainEqual(expect.objectContaining({
-      entityType: "provider",
-      entityId: copilotProviderId,
-      actorType: "employee",
-      actorId: employeeId,
-      action: "sign_in_window_opened",
-    }));
-    connection.close();
-  });
-
-  test("binds OAuth credentials to a sign-in session source", () => {
-    const connection = createConnection();
-    const organization = new OrganizationService(connection.db);
-    const snapshot = new SnapshotService(connection.db);
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, () => {});
-    let orgId = "";
-    let employeeId = "";
-    let copilotProviderId = "";
-
-    connection.transaction(() => {
-      orgId = createOrganization(organization);
-      employeeId = (connection.db.prepare("select id from employees where org_id = ?").get(orgId) as { id: string }).id;
-      copilotProviderId = providerId(connection, orgId, "github-copilot");
-    });
-
-    expect(() => connection.transaction(() => providers.saveCredential({
-      orgId,
-      providerId: copilotProviderId,
-      secret: "ghu_live_provider",
-      model: "claude-opus-4-5",
-      employeeId,
-    }))).toThrow("Provider sign-in session is required.");
-
-    connection.transaction(() => {
-      providers.launchSignInWindow({ orgId, providerId: copilotProviderId, employeeId });
-      providers.saveCredential({
-        orgId,
-        providerId: copilotProviderId,
-        secret: "ghu_live_provider",
-        model: "claude-opus-4-5",
-        employeeId,
-      });
-    });
+    expect(() => connection.transaction(() => providers.saveCredential({ orgId, providerId: copilotProviderId, secret: "ghu_live_provider", model: "claude-opus-4-5" })))
+      .toThrow("Sign in to GitHub Copilot; a pasted token cannot be renewed when it expires.");
+    connection.transaction(() => providers.saveCredential({ orgId, providerId: copilotProviderId, secret: signIn, model: "claude-opus-4-5" }));
 
     const state = snapshot.load();
     const profile = state.providerAuthProfiles.find((item) => item.providerId === copilotProviderId && item.active);
-    const session = state.providerAuthSessions.find((item) => item.providerId === copilotProviderId);
-    if (!profile || !session) throw new Error("Provider auth evidence was not created.");
-    expect(profile).toMatchObject({ sourceType: "provider_sign_in_session", sourceRef: session.id });
-    expect(session.completedAt).toBeTruthy();
+    expect(profile).toMatchObject({ sourceType: "provider_oauth_login", sourceRef: null });
     expect(state.providers.find((item) => item.id === copilotProviderId)?.enabled).toBe(true);
     connection.close();
   });

tests/unit/quota-reservation.test.ts

@@ -27,7 +27,7 @@ describe("monthly quota reservation", () => {
       return { text: "done", toolCalls: [], rawResponseJson: "{}" };
     };
     const connection = new DatabaseConnection(join(tmpdir(), `ac-quota-${randomUUID()}.db`));
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, turn);
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, turn);
     let orgId = "";
     let providerId = "";
     connection.transaction(() => {

tests/unit/rate-limit-observation.test.ts

@@ -26,7 +26,7 @@ describe("rate limits seen on successful calls", () => {
     });
     const connection = new DatabaseConnection(join(tmpdir(), `ac-ratelimit-${randomUUID()}.db`));
     const organization = new OrganizationService(connection.db);
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, turn);
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, turn);
     const execution = new TaskExecutionService(connection.db, providers);
     let orgId = "";
     let providerId = "";

tests/unit/task-execution-service.test.ts

@@ -42,7 +42,7 @@ describe("task execution service", () => {
       if (first?.role === "user") capturedPrompt = first.text;
       return { text: "executed:gpt-5.4", toolCalls: [], rawResponseJson: JSON.stringify({ id: "resp-task-1" }) };
     };
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     const skills = new SkillService(connection.db, join(tmpdir(), `agentcompany-task-skills-${randomUUID()}`));
     const execution = new TaskExecutionService(connection.db, providers);
     const skillDir = join(tmpdir(), `agentcompany-task-skill-${randomUUID()}`);
@@ -154,7 +154,7 @@ describe("task execution service", () => {
       toolCalls: [],
       rawResponseJson: JSON.stringify({ id: "resp-task-approved" }),
     });
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     const execution = new TaskExecutionService(connection.db, providers);
     let orgId = "";
     let employeeId = "";
@@ -293,7 +293,7 @@ describe("task execution service", () => {
     const fakeToolTurn = async (): Promise<AgentTurnResult> => {
       throw new Error("provider rejected task");
     };
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     const execution = new TaskExecutionService(connection.db, providers);
     let orgId = "";
     let taskId = "";
@@ -351,7 +351,7 @@ describe("task execution service", () => {
       turns += 1;
       return { text: "done", toolCalls: [], rawResponseJson: JSON.stringify({ id: `resp-${turns}` }) };
     };
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     const execution = new TaskExecutionService(connection.db, providers);
     let orgId = "";
     let taskId = "";
@@ -850,7 +850,7 @@ describe("task execution service", () => {
     const fakeToolTurn = async (): Promise<AgentTurnResult> => {
       throw new ProviderHttpError("The usage limit has been reached", null, 429, false, "usage_limit_reached");
     };
-    const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, answeringModelCheck(fakeToolTurn));
+    const providers = new ProviderService(connection.db, providerAdapters, testVault, answeringModelCheck(fakeToolTurn));
     let nowMs = Date.now();
     const execution = new TaskExecutionService(connection.db, providers, undefined, undefined, () => nowMs);
     let orgId = "";