improvement(credentials): resolve agent fallback credentials once, Vanta 401 grace, true refusal codes, headless client-credential modes, and registry cleanups

Author: waleedlatif1

apps/sim/connectors/aws-session.ts

@@ -1,3 +1,5 @@
+import { type AwsSigningKeys, awsSigningKeys } from '@/lib/internal/aws/signing-keys'
+
 /**
  * The AWS keys a saved AWS credential resolved to for one connector run.
  *
@@ -8,24 +10,13 @@
  * from one place and never from tool or user input. Server-only state: the
  * slot is never persisted or logged.
  */
-export interface ConnectorAwsSession {
-  accessKeyId: string
-  secretAccessKey: string
-  /** Present for STS sessions (assumed and keyless roles); absent for saved long-lived keys. */
-  sessionToken?: string
-}
+export type ConnectorAwsSession = AwsSigningKeys
 
 const AWS_SESSION_CONTEXT_KEY = 'credentialAwsSession'
 
 /** The `syncContext` entries that carry a resolved AWS session to a connector. */
 export function awsSessionSyncContext(session: ConnectorAwsSession): Record<string, unknown> {
-  return {
-    [AWS_SESSION_CONTEXT_KEY]: {
-      accessKeyId: session.accessKeyId,
-      secretAccessKey: session.secretAccessKey,
-      ...(session.sessionToken ? { sessionToken: session.sessionToken } : {}),
-    },
-  }
+  return { [AWS_SESSION_CONTEXT_KEY]: awsSigningKeys(session) }
 }
 
 /** The AWS session seeded into this run, or undefined when the connector signs with inline keys. */
@@ -40,5 +31,5 @@ export function readAwsSession(
   if (sessionToken !== undefined && (typeof sessionToken !== 'string' || !sessionToken)) {
     return undefined
   }
-  return { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) }
+  return awsSigningKeys({ accessKeyId, secretAccessKey, sessionToken })
 }

apps/sim/executor/handlers/agent/handler.test.ts

@@ -1228,6 +1228,35 @@ describe('AgentBlockHandler', () => {
       expect(mockResolveBedrockCredentialSession).toHaveBeenCalledTimes(1)
     })
 
+    it('resolves the AWS credential once for a fallback on the same provider', async () => {
+      const session = {
+        credentialId: 'aws-cred',
+        accessKeyId: 'ASIASESSIONKEY000001',
+        secretAccessKey: 'session-secret',
+        sessionToken: 'session-token',
+      }
+      mockResolveBedrockCredentialSession.mockResolvedValueOnce(session)
+      mockExecuteProviderRequest
+        .mockRejectedValueOnce(new Error('overloaded'))
+        .mockResolvedValueOnce(providerResponse('bedrock/claude-fallback'))
+
+      await handler.execute(mockContext, mockBlock, {
+        ...baseInputs,
+        model: 'bedrock/claude',
+        bedrockAuthMode: 'credential',
+        bedrockCredential: 'aws-cred',
+        fallbackModels: [{ model: 'bedrock/claude-fallback' }],
+      })
+
+      expect(mockResolveBedrockCredentialSession).toHaveBeenCalledTimes(1)
+      expect(mockExecuteProviderRequest).toHaveBeenCalledTimes(2)
+      const [[primaryProvider, primaryRequest], [fallbackProvider, fallbackRequest]] =
+        mockExecuteProviderRequest.mock.calls
+      expect([primaryProvider, fallbackProvider]).toEqual(['bedrock', 'bedrock'])
+      expect(primaryRequest.bedrockSession).toEqual(session)
+      expect(fallbackRequest.bedrockSession).toEqual(session)
+    })
+
     it('re-resolves tuning for the fallback: row value wins, caps clamp, undeclared values drop', async () => {
       const fallbackCap = getModelCapabilities('gpt-5.4-mini')?.maxOutputTokens
       expect(fallbackCap).toEqual(expect.any(Number))

apps/sim/executor/handlers/agent/handler.ts

@@ -95,6 +95,7 @@ import { collectBlockData } from '@/executor/utils/block-data'
 import { stringifyJSON } from '@/executor/utils/json'
 import {
   BLOCK_MODEL_CREDENTIAL_FIELDS,
+  type BlockModelCredentials,
   resolveBlockModelCredentials,
 } from '@/executor/utils/model-credentials'
 import {
@@ -2610,6 +2611,11 @@ export class AgentBlockHandler implements BlockHandler {
    * blacklisted, not permitted, or cannot take the attachments is skipped
    * rather than counted as a failed try.
    *
+   * The block's saved Vertex or Bedrock credential resolves at most once per
+   * call and is shared by every candidate on the primary's provider; it is
+   * awaited inside the attempt, so a failure fails those attempts and other
+   * providers' fallbacks still run. It never reaches another provider.
+   *
    * A streaming candidate is accepted only once its first chunk has arrived
    * (`primeStreamingExecution`), so a startup failure inside the stream still
    * falls through; that wait is skipped when no candidate follows, which keeps
@@ -2635,6 +2641,7 @@ export class AgentBlockHandler implements BlockHandler {
     let resultRegistry = config.resultRegistry
     const failedModels: string[] = []
     let lastError: unknown
+    let savedCredentials: Promise<BlockModelCredentials> | undefined
     let lastErrorRegistries:
       | {
           error: ResolvedSecretTraceRegistry | undefined
@@ -2754,6 +2761,16 @@ export class AgentBlockHandler implements BlockHandler {
         streaming: config.streaming,
       })
 
+      const onPrimaryProvider = candidateProviderId === config.primaryProviderId
+      if (onPrimaryProvider) {
+        savedCredentials ??= resolveBlockModelCredentials(
+          ctx,
+          config.primaryProviderId,
+          config.modelInputs,
+          'vertex-agent'
+        )
+      }
+
       try {
         let result = await this.executeProviderRequest(
           ctx,
@@ -2762,6 +2779,7 @@ export class AgentBlockHandler implements BlockHandler {
           config.responseFormat,
           resultRegistry,
           config.providerErrorRegistry,
+          onPrimaryProvider ? savedCredentials : undefined,
           config.agentConversation
         )
         if ((hasNext || config.retryPrimaryOnStreamStart) && this.isStreamingExecution(result)) {
@@ -2983,18 +3001,14 @@ export class AgentBlockHandler implements BlockHandler {
     responseFormat: any,
     modelRuntimeRegistry: ResolvedSecretTraceRegistry | undefined,
     providerErrorRegistry: ResolvedSecretTraceRegistry | undefined,
+    savedCredentials: Promise<BlockModelCredentials> | undefined,
     agentConversation?: AgentTurnSession
   ): Promise<BlockOutput | StreamingExecution> {
     const providerId = providerRequest.provider
     const model = providerRequest.model
 
     try {
-      const credentials = await resolveBlockModelCredentials(
-        ctx,
-        providerId,
-        providerRequest,
-        'vertex-agent'
-      )
+      const credentials: BlockModelCredentials = (await savedCredentials) ?? {}
 
       const { blockData, blockNameMapping } = collectBlockData(ctx)
       const agentMemoryRetrieval = agentConversation?.memoryId

apps/sim/lib/credentials/application/provider-catalog-contract.test.ts

@@ -27,6 +27,7 @@ import { listCredentialProviders } from '@/lib/credentials/application/list-cred
 import { listCredentialProviderCatalog } from '@/lib/credentials/application/provider-catalog'
 import { DATABASE_CONNECTION_DESCRIPTORS } from '@/lib/credentials/database-connections/descriptors'
 import { getMissingServiceAccountFields } from '@/lib/credentials/service-account-fields'
+import { TOKEN_SERVICE_ACCOUNT_DESCRIPTORS } from '@/lib/credentials/token-service-accounts/descriptors'
 import {
   isWorkloadIdentityServiceAccountProviderId,
   WORKLOAD_IDENTITY_KEYLESS_CONFIGS,
@@ -217,6 +218,47 @@ describe('v2 credential provider catalog contract', () => {
     ).toBeUndefined()
   })
 
+  it('lists the client-credentials mode of every provider that offers one, as creation reads it', async () => {
+    const providers = await listProviders()
+    expect(responseSchema.safeParse({ data: providers, nextCursor: null }).success).toBe(true)
+    const offering = Object.values(TOKEN_SERVICE_ACCOUNT_DESCRIPTORS).filter(
+      (descriptor) => descriptor.clientCredentials
+    )
+    expect(offering.length).toBeGreaterThan(0)
+
+    for (const providerId of [
+      ...offering.map((descriptor) => descriptor.providerId),
+      'atlassian-service-account',
+    ]) {
+      const provider = providers.find(
+        (entry) => entry.type === 'service_account' && entry.providerId === providerId
+      )
+      const fields = provider?.fields ?? []
+      const requiredFor = (authMethod: string) =>
+        fields
+          .filter((field) =>
+            field.requiredForAuthMethods
+              ? field.requiredForAuthMethods.includes(authMethod)
+              : field.required
+          )
+          .map((field) => field.id)
+          .sort()
+
+      expect(fields.find((field) => field.id === 'authMethod')).toMatchObject({
+        required: false,
+        defaultValue: 'token',
+        options: [
+          { value: 'token', label: expect.any(String) },
+          { value: 'client_credentials', label: expect.any(String) },
+        ],
+      })
+      expect(requiredFor('client_credentials')).toEqual(
+        getMissingServiceAccountFields(providerId, { authMethod: 'client_credentials' }).sort()
+      )
+      expect(requiredFor('token')).toEqual(getMissingServiceAccountFields(providerId, {}).sort())
+    }
+  })
+
   it('lists the native Claude Platform provider when filtered', async () => {
     const providers = await listProviders('claude')
 

apps/sim/lib/credentials/application/provider-catalog.ts

@@ -7,8 +7,12 @@ import {
 } from '@/lib/credentials/client-credential-accounts/descriptors'
 import { getDatabaseConnectionDescriptor } from '@/lib/credentials/database-connections/descriptors'
 import {
+  CLIENT_CREDENTIALS_AUTH_METHOD,
+  isTokenServiceAccountFieldRequired,
   SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
+  TOKEN_AUTH_METHOD,
   TOKEN_SERVICE_ACCOUNT_DESCRIPTORS,
+  type TokenServiceAccountDescriptor,
   type TokenServiceAccountField,
 } from '@/lib/credentials/token-service-accounts/descriptors'
 import {
@@ -117,15 +121,14 @@ const ATLASSIAN_SERVICE_ACCOUNT_DOCS_URL =
   'https://docs.sim.ai/integrations/atlassian-service-account'
 
 function providerField(
-  field: TokenServiceAccountField | ClientCredentialAccountField
+  field: TokenServiceAccountField | ClientCredentialAccountField,
+  required: boolean
 ): CredentialProviderField {
   return {
     id: field.id,
     label: field.label,
     placeholder: field.placeholder,
-    required:
-      !('optional' in field && field.optional) &&
-      !('defaultValue' in field && field.defaultValue !== undefined),
+    required,
     secret: field.secret,
     multiline: 'multiline' in field && field.multiline === true,
     ...('requiredForAuthMethods' in field && field.requiredForAuthMethods
@@ -143,6 +146,74 @@ function providerField(
   }
 }
 
+/**
+ * A token provider's fields. One that also offers a client-credentials grant adds `authMethod`,
+ * `clientId`, and `clientSecret`, read the way its create builder reads them: `authMethod:
+ * 'client_credentials'` sends the client ID and secret in place of the token (and of any field
+ * that belongs to the pasted-token sign-in only), and an omitted `authMethod` keeps the token.
+ */
+function tokenProviderFields(descriptor: TokenServiceAccountDescriptor): CredentialProviderField[] {
+  const { clientCredentials } = descriptor
+  const fields = descriptor.fields.map((field) => {
+    const catalogField = providerField(
+      field,
+      isTokenServiceAccountFieldRequired(field, TOKEN_AUTH_METHOD)
+    )
+    return clientCredentials && field.id === 'apiToken'
+      ? { ...catalogField, requiredForAuthMethods: [TOKEN_AUTH_METHOD] }
+      : catalogField
+  })
+  if (!clientCredentials) return fields
+  return [...fields, ...clientCredentialModeFields(clientCredentials)]
+}
+
+/**
+ * The fields a headless caller sends to pick and fill a provider's OAuth client-credentials mode
+ * instead of its pasted token: the mode selector, and the client ID and secret that mode requires.
+ */
+function clientCredentialModeFields(mode: {
+  label: string
+  tokenLabel: string
+  helpText?: string
+}): CredentialProviderField[] {
+  const clientCredentialMethods = [CLIENT_CREDENTIALS_AUTH_METHOD]
+  return [
+    {
+      id: 'authMethod',
+      label: 'Authentication method',
+      placeholder: TOKEN_AUTH_METHOD,
+      required: false,
+      secret: false,
+      multiline: false,
+      options: [
+        { value: TOKEN_AUTH_METHOD, label: mode.tokenLabel },
+        { value: CLIENT_CREDENTIALS_AUTH_METHOD, label: mode.label },
+      ],
+      defaultValue: TOKEN_AUTH_METHOD,
+      hint: `Send ${CLIENT_CREDENTIALS_AUTH_METHOD} with clientId and clientSecret instead of the fields required only for ${TOKEN_AUTH_METHOD}.`,
+    },
+    {
+      id: 'clientId',
+      label: 'Client ID',
+      placeholder: 'Paste the client ID',
+      required: false,
+      secret: false,
+      multiline: false,
+      requiredForAuthMethods: clientCredentialMethods,
+      ...(mode.helpText ? { hint: mode.helpText } : {}),
+    },
+    {
+      id: 'clientSecret',
+      label: 'Client secret',
+      placeholder: 'Paste the client secret',
+      required: false,
+      secret: true,
+      multiline: false,
+      requiredForAuthMethods: clientCredentialMethods,
+    },
+  ]
+}
+
 interface KeylessCatalogMode {
   keyless: CredentialProviderKeylessMode
   /** Where keyless works, when narrower than the provider. */
@@ -351,7 +422,8 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
   if (providerId === ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID) {
     return {
       name: 'Atlassian service account',
-      description: 'Connect Jira and Confluence with an Atlassian API token.',
+      description:
+        'Connect Jira and Confluence with an Atlassian API token or a service account OAuth 2.0 credential.',
       docsUrl: ATLASSIAN_SERVICE_ACCOUNT_DOCS_URL,
       fields: [
         {
@@ -361,6 +433,7 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
           required: true,
           secret: true,
           multiline: false,
+          requiredForAuthMethods: [TOKEN_AUTH_METHOD],
         },
         {
           id: 'domain',
@@ -383,6 +456,11 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
           ],
           hint: 'Select the product this token can access. Defaults to Jira.',
         },
+        ...clientCredentialModeFields({
+          label: 'Service account OAuth 2.0',
+          tokenLabel: 'API token',
+          helpText: "The client ID of the service account's OAuth 2.0 credential.",
+        }),
       ],
     }
   }
@@ -484,7 +562,7 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
       docsUrl: tokenDescriptor.docsUrl,
       helpText: tokenDescriptor.helpText,
       fields: [
-        ...tokenDescriptor.fields.map(providerField),
+        ...tokenProviderFields(tokenDescriptor),
         {
           id: 'serviceAccountJson',
           label: 'Connection configuration',
@@ -510,7 +588,7 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
       description: `Connect ${tokenDescriptor.serviceLabel} with a ${tokenDescriptor.tokenNoun}.`,
       docsUrl: tokenDescriptor.docsUrl,
       helpText: tokenDescriptor.helpText,
-      fields: tokenDescriptor.fields.map(providerField),
+      fields: tokenProviderFields(tokenDescriptor),
     }
   }
 
@@ -525,7 +603,7 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
       description: `Connect ${clientDescriptor.serviceLabel} with a ${clientDescriptor.connectNoun}.`,
       docsUrl: clientDescriptor.docsUrl,
       helpText: clientDescriptor.helpText,
-      fields: clientDescriptor.fields.map(providerField),
+      fields: clientDescriptor.fields.map((field) => providerField(field, !field.optional)),
     }
   }