@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/src/modules/mcp/oauth/bevel-oauth-provider.ts

@@ -199,10 +199,16 @@ export class BevelOAuthProvider implements OAuthServerProvider {
    * Called by the Finish endpoint once an authenticated user completes the
    * /connect step: bind a one-time code to (user, client, redirect_uri, PKCE
    * challenge) and hand back the client redirect the browser should follow.
+   *
+   * @param agentPath The "Connect as" choice — an agent configuration the consent
+   *   route has already checked the person may choose — or null for
+   *   Everything. Carried on the code to the exchange, which records it on
+   *   the agent connection.
    */
   async issueAuthCode(
     userId: string,
     st: McpAuthRequestState,
+    agentPath: string | null = null,
   ): Promise<{ redirectTo: string }> {
     // A state without a PKCE challenge is a Claude-link request, which the
     // marketplace bridge finishes; it must never reach the SDK's code store.
@@ -217,6 +223,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
       scope: st.sc ?? null,
       resource: st.rs ?? null,
       expiresAt: new Date(Date.now() + CODE_TTL_MS),
+      ...(agentPath ? { agentPath } : {}),
     });
     const redirect = new URL(st.r);
     redirect.searchParams.set('code', code);
@@ -269,7 +276,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
     if (redirectUri && redirectUri !== row.redirectUri) {
       throw new InvalidGrantError('redirect_uri does not match the authorization request');
     }
-    return this.mintTokens(row.userId, row.clientId, row.scope, row.resource);
+    return this.mintTokens(row.userId, row.clientId, row.scope, row.resource, undefined, undefined, row.agentPath ?? null);
   }
 
   async exchangeRefreshToken(
@@ -463,6 +470,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
         id: oauthTokens.id,
         clientId: oauthTokens.clientId,
         connectionId: oauthTokens.connectionId,
+        agentPath: agentConnections.agentPath,
         scope: oauthTokens.scope,
         resource: oauthTokens.resource,
         expiresAt: oauthTokens.expiresAt,
@@ -507,6 +515,10 @@ export class BevelOAuthProvider implements OAuthServerProvider {
         // Null on a token minted before connections existed; the auth
         // middleware then binds no agent and the call goes unrecorded.
         connectionId: row.connectionId,
+        // The connection's "Connect as" choice, read off the row on every
+        // verification, so a re-consent with another choice reaches the
+        // agent's very next request. Null is Everything.
+        agentPath: row.agentPath ?? null,
       },
     };
   }
@@ -575,6 +587,9 @@ export class BevelOAuthProvider implements OAuthServerProvider {
    *   first mint, which finds or makes the live connection for (user, client).
    * @param tx The transaction the insert belongs to, when the mint must land
    *   with the statement that consumed the token it replaces (a refresh).
+   * @param agentPath The consent's "Connect as" choice, recorded on the
+   *   connection the pair is bound to (null: Everything). Only a first mint —
+   *   a consent — passes it; a refresh leaves the connection's choice alone.
    *   The prune is then the caller's, before the transaction opens: a
    *   best-effort statement that fails inside a transaction would abort the
    *   mint it is meant to spare, and one on the pool from inside it would
@@ -587,6 +602,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
     resource: string | null,
     connectionId?: string,
     tx?: Tx,
+    agentPath?: string | null,
   ): Promise<OAuthTokens> {
     const accessToken = this.deps.tokenPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
     const refreshToken = this.refreshPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
@@ -594,7 +610,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
     // A mint of its own (a sign-in) prunes here; a refresh pruned before its
     // transaction opened.
     if (!tx) await this.pruneTokenTables(now);
-    const boundTo = connectionId ?? (await this.ensureConnection(userId, clientId));
+    const boundTo = connectionId ?? (await this.ensureConnection(userId, clientId, agentPath));
     const sink: Tx | Database = tx ?? this.deps.db;
     await sink.insert(oauthTokens).values({
       accessTokenHash: hashToken(accessToken),
@@ -665,12 +681,23 @@ export class BevelOAuthProvider implements OAuthServerProvider {
    * revoke. A read, not a write: the use is stamped separately, throttled.
    */
   async isConnectionLive(connectionId: string): Promise<boolean> {
+    return (await this.liveConnectionChoice(connectionId)) !== null;
+  }
+
+  /**
+   * A live agent connection's current "Connect as" choice (`agentPath` null
+   * = Everything), or null when the connection is gone or revoked. Read on
+   * every request through the local server's exchanged grant: that token is
+   * stateless and outlives a re-consent, so the choice it was minted with is
+   * not the one it is served as — the row's is.
+   */
+  async liveConnectionChoice(connectionId: string): Promise<{ agentPath: string | null } | null> {
     const [row] = await this.deps.db
-      .select({ id: agentConnections.id })
+      .select({ agentPath: agentConnections.agentPath })
       .from(agentConnections)
       .where(and(eq(agentConnections.id, connectionId), isNull(agentConnections.revokedAt)))
       .limit(1);
-    return row !== undefined;
+    return row ? { agentPath: row.agentPath ?? null } : null;
   }
 
   /**
@@ -737,8 +764,13 @@ export class BevelOAuthProvider implements OAuthServerProvider {
    * the other's `ON CONFLICT DO NOTHING` returns no row, and it re-reads the
    * winner's. The client's display name is snapshotted from its registration
    * at that moment.
+   *
+   * `agentPath` is a consent's "Connect as" choice: written on the row made,
+   * and on the live row found — the person's latest consent is what the agent
+   * connects as. `undefined` (a refresh of a token from before connections
+   * existed) leaves a found row's choice as it is.
    */
-  private async ensureConnection(userId: string, clientId: string): Promise<string> {
+  private async ensureConnection(userId: string, clientId: string, agentPath?: string | null): Promise<string> {
     const [client] = await this.deps.db
       .select({ clientName: oauthClients.clientName })
       .from(oauthClients)
@@ -758,11 +790,17 @@ export class BevelOAuthProvider implements OAuthServerProvider {
           ),
         )
         .limit(1);
+    const choose = async (id: string): Promise<string> => {
+      if (agentPath !== undefined) {
+        await this.deps.db.update(agentConnections).set({ agentPath }).where(eq(agentConnections.id, id));
+      }
+      return id;
+    };
     const [existing] = await live();
-    if (existing) return existing.id;
+    if (existing) return choose(existing.id);
     const [inserted] = await this.deps.db
       .insert(agentConnections)
-      .values({ userId, clientId, clientName, agentKey })
+      .values({ userId, clientId, clientName, agentKey, ...(agentPath ? { agentPath } : {}) })
       .onConflictDoNothing({
         target: [agentConnections.userId, agentConnections.agentKey],
         where: sql`${agentConnections.revokedAt} is null`,
@@ -771,7 +809,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
     if (inserted) return inserted.id;
     const [winner] = await live();
     if (!winner) throw new Error('agent connection vanished between insert and re-read');
-    return winner.id;
+    return choose(winner.id);
   }
 }
 

package/src/modules/mcp/oauth/oauth-consent.routes.ts

@@ -4,6 +4,7 @@ import { logger } from '../../../shared/logging.js';
 const log = logger('mcp-oauth');
 import type { BevelOAuthProvider } from './bevel-oauth-provider.js';
 import { verifyAuthRequest, type McpAuthRequestState } from './oauth-state.js';
+import type { IAgentScopeResolver } from '../../agent-scope/index.js';
 import '../../auth/index.js'; // Express Request augmentation (req.userId / req.userEmail)
 
 export interface OAuthConsentRoutesDeps {
@@ -21,8 +22,17 @@ export interface OAuthConsentRoutesDeps {
     clientNameFor(st: McpAuthRequestState): string;
     completeConsent(userId: string, st: McpAuthRequestState): Promise<{ redirectTo: string }>;
   };
+  /**
+   * The "Connect as" choices: the agent configurations the person may connect an
+   * MCP client as, offered below Everything. Absent, the consent offers
+   * Everything alone and Finish refuses any other choice.
+   */
+  agents?: Pick<IAgentScopeResolver, 'listChoices' | 'choosable'>;
 }
 
+/** The refusal of a choice that is not one of the person's — one answer for missing and unreadable. */
+export const NOT_AN_AGENT_CHOICE = 'That agent is not one you can connect as. Choose Everything or one of the agents listed.';
+
 /**
  * The authenticated tail of the MCP OAuth flow. `/authorize` (SDK-owned)
  * validated the client's request, packed it into a signed state, and sent the
@@ -49,10 +59,25 @@ export function createOAuthConsentRoutes(deps: OAuthConsentRoutesDeps): express.
       return;
     }
     const client = await deps.provider.clientsStore.getClient(st.c);
+    // Everything is not in the list: it is the choice every consent has, and
+    // the one the page selects. A failure to read the agents costs the choice
+    // of an agent, never the consent itself — but it is SAID
+    // (`agentsUnavailable`), so the page does not pass an empty list off as
+    // "you have no agents" and approve Everything unasked.
+    let agentsUnavailable = false;
+    const agents = deps.agents && req.userEmail
+      ? await deps.agents.listChoices(req.userEmail).catch((err: unknown) => {
+          log.warn('listing the agents to connect as failed:', { detail: err instanceof Error ? err.message : String(err) });
+          agentsUnavailable = true;
+          return [];
+        })
+      : [];
     res.json({
       clientName: client?.client_name ?? null,
       scope: st.sc ?? null,
       resource: st.rs ?? null,
+      agents,
+      ...(agentsUnavailable ? { agentsUnavailable: true } : {}),
     });
   });
 
@@ -65,10 +90,25 @@ export function createOAuthConsentRoutes(deps: OAuthConsentRoutesDeps): express.
     const st = raw ? verifyAuthRequest(deps.stateSecret, raw) : null;
     if (!st) return void res.status(400).json({ error: 'Invalid or expired authorization request. Restart the connection from your agent.' });
     if (st.gh && !deps.facade) return void res.status(400).json({ error: NO_FACADE });
+    // "Connect as": absent, null or empty is Everything. Anything else must be
+    // an agent the person may choose right now — checked here, at the only
+    // place a choice is made, so the token exchange records it as given.
+    const asked: unknown = (req.body ?? {}).agentPath;
+    if (asked !== undefined && asked !== null && typeof asked !== 'string') {
+      return void res.status(400).json({ error: NOT_AN_AGENT_CHOICE });
+    }
+    const choosing = typeof asked === 'string' && asked.trim() !== '';
+    // An account linked through the GitHub facade has no agent connection to
+    // record a choice on.
+    if (choosing && (st.gh || !deps.agents || !req.userEmail)) {
+      return void res.status(400).json({ error: NOT_AN_AGENT_CHOICE });
+    }
     try {
+      const agentPath = choosing && deps.agents && req.userEmail ? await deps.agents.choosable(req.userEmail, asked as string) : null;
+      if (choosing && agentPath === null) return void res.status(400).json({ error: NOT_AN_AGENT_CHOICE });
       const { redirectTo } = st.gh && deps.facade
         ? await deps.facade.completeConsent(userId, st)
-        : await deps.provider.issueAuthCode(userId, st);
+        : await deps.provider.issueAuthCode(userId, st, agentPath);
       res.json({ redirectTo });
     } catch (err) {
       // Message only — the raw error object can carry sensitive context

package/src/modules/plugins/__tests__/plugins.tools.test.ts

@@ -13,6 +13,8 @@ import { GUIDE_FIRST_SENTENCE } from '../../tool-registry/guide-first.js';
 import { registerPluginsTools, CREATE_PLUGIN, myPluginDef, myPluginDescription } from '../plugins.tools.js';
 import { createPluginCreationRoutes } from '../plugins.routes.js';
 import { PluginProvisionError } from '../plugin-provision.service.js';
+import type { IAgentScopeResolver } from '../../agent-scope/index.js';
+import { agentFile, agentScopeOver, inMemoryKb } from '../../agent-scope/__tests__/in-memory-kb.js';
 
 /**
  * The plugin tools are DESCRIPTIONS of the app's own creation endpoints.
@@ -200,7 +202,12 @@ describe('the creation endpoints behind the key-or-session gate', () => {
 
   const externalApiKeyService = {
     looksLikeExternalApiKey: (t: string) => typeof t === 'string' && t.startsWith('bevel_'),
-    verifyAndLoadToken: async (t: string) => (t === 'bevel_alice' ? { user: ALICE, tokenId: 'tok-a' } : null),
+    verifyAndLoadToken: async (t: string) =>
+      t === 'bevel_alice'
+        ? { user: ALICE, tokenId: 'tok-a' }
+        : t === 'bevel_alice_agent'
+          ? { user: ALICE, tokenId: 'tok-b', agentPath: 'Agents/plugin-maker.agent' }
+          : null,
   } as never;
   const authService = {
     getUserById: async (id: string) => (id === ALICE.id ? ALICE : null),
@@ -211,7 +218,7 @@ describe('the creation endpoints behind the key-or-session gate', () => {
     },
   } as never;
 
-  async function start(): Promise<string> {
+  async function start(agentScope?: Pick<IAgentScopeResolver, 'resolve'>): Promise<string> {
     const internalToken = new InternalTokenService({ secret: 'test-secret' });
     const app = express();
     app.use(express.json());
@@ -224,6 +231,7 @@ describe('the creation endpoints behind the key-or-session gate', () => {
       }),
       createPluginCreationRoutes({ ensurePersonalPlugin, createPlugin } as never, async (req) =>
         req.userId ? ((await (authService as { getUserById(id: string): Promise<unknown> }).getUserById(req.userId)) as never) : null,
+        agentScope,
       ),
     );
     httpServer = await new Promise<HttpServer>((r) => {
@@ -302,4 +310,32 @@ describe('the creation endpoints behind the key-or-session gate', () => {
     );
     expect(createPlugin).not.toHaveBeenCalled();
   });
+
+  it("refuses a connection made as an .agent that does not list the tool, by name, before anything is provisioned", async () => {
+    // The agent lists `my_plugin` only. These routes are not hosted by
+    // `toolHandler`, so they make its connection-scope check themselves.
+    const kb = inMemoryKb(
+      { 'Agents/plugin-maker.agent': agentFile('name: Plugin maker\nplatformTools: [my_plugin]') },
+      { reader: ALICE.email },
+    );
+    const base = await start(agentScopeOver(kb));
+    const refused = await post(base, '/api/plugins', { name: 'GTM' }, 'bevel_alice_agent');
+    expect(refused.status).toBe(403);
+    expect(await refused.json()).toEqual({
+      error: expect.stringContaining('The tool "create_plugin" is not available to this connection'),
+      code: 'not_available_to_connection',
+    });
+    expect(createPlugin).not.toHaveBeenCalled();
+
+    // The tool it lists is served; a key made as Everything and a session are untouched.
+    expect((await post(base, '/api/plugins/personal', {}, 'bevel_alice_agent')).status).toBe(200);
+    expect((await post(base, '/api/plugins', { name: 'Ops' }, 'bevel_alice')).status).toBe(201);
+    expect((await post(base, '/api/plugins', { name: 'Fin' }, 'session-alice')).status).toBe(201);
+  });
+
+  it('a narrowed connection with no scope resolver wired loads nothing, never Everything', async () => {
+    const base = await start();
+    expect((await post(base, '/api/plugins/personal', {}, 'bevel_alice_agent')).status).toBe(403);
+    expect(ensurePersonalPlugin).not.toHaveBeenCalled();
+  });
 });

package/src/modules/plugins/index.ts

@@ -19,7 +19,7 @@ export {
   type JoinRequestStatus,
   type JoinRequestStore,
 } from './join-request-records.store.js';
-export { PluginLinkIndex, type LinkMembership, type PluginLinks } from './plugin-links.js';
+export { PluginLinkIndex, type IPluginLinkIndex, type LinkMembership, type PluginLinks } from './plugin-links.js';
 export { PluginLinksService, PluginLinkError } from './plugin-links.service.js';
 export { PluginRenameService, PluginRenameError, renamePluginPrincipalInText } from './plugin-rename.service.js';
 export { compileMarketplace, type VirtualTree, type CompileInput, type MarketplaceOptions } from './compile/compile-marketplace.js';

package/src/modules/plugins/plugin-links.ts

@@ -58,10 +58,27 @@ export const LINK_GRANT_VERBS = ['read', 'write'] as const;
 export interface LinkMembership {
   /** skill path → every plugin that holds it, inline or by link. */
   bySkill: Map<string, PluginMembership[]>;
-  /** plugin folder → its links. Every plugin folder appears, linked or not. */
+  /**
+   * plugin identity (`PluginLinks.name`) → its links. Every plugin appears,
+   * linked or not. A name and a folder may differ, so a repository path is
+   * read from the value's `folder`, never from the key.
+   */
   byPlugin: Map<string, PluginLinks>;
 }
 
+/**
+ * What a reader of the link index asks it — the contract a consumer outside
+ * this module (a distribution's agent-scope resolver, through
+ * `CorePorts.agentScope`) is written against. Dropping the cache is the
+ * index owner's affair, not a reader's, so it is not here.
+ */
+export interface IPluginLinkIndex {
+  /** Every plugin's links and every skill's memberships, from the released catalog. */
+  membership(): Promise<LinkMembership>;
+  /** The memberships of one skill (empty when it is in no plugin). */
+  pluginsOf(skillPath: string): Promise<PluginMembership[]>;
+}
+
 /**
  * The link index: which shared skills each plugin links, and — the other way
  * round — which plugins each skill belongs to, whether by sitting inside the
@@ -88,7 +105,7 @@ export interface LinkMembership {
  * subscriber that drops the plugin index, so a link committed on the default
  * branch shows within one round-trip.
  */
-export class PluginLinkIndex {
+export class PluginLinkIndex implements IPluginLinkIndex {
   private readonly cache: TtlCache<LinkMembership>;
 
   constructor(

package/src/modules/plugins/plugins.routes.ts

@@ -17,6 +17,8 @@ import { pluginFolderBelowRoot } from './plugins.service.js';
 import type { KbContext } from '../../shared/kb-context.js';
 import { PluginProvisionError, type PluginProvisionService } from './plugin-provision.service.js';
 import { argumentsRefusal } from '../tool-helpers/index.js';
+import { resolveConnectionScope, type IAgentScopeResolver } from '../agent-scope/index.js';
+import '../tool-auth/index.js'; // Express Request.toolAuth augmentation
 import { PluginLinkError, type PluginLinksService } from './plugin-links.service.js';
 import { PluginRenameError, type PluginRenameService } from './plugin-rename.service.js';
 import type { JoinRequestsService } from './join-requests.service.js';
@@ -83,6 +85,29 @@ function refuseMismatchedArguments(req: express.Request, res: express.Response):
   return true;
 }
 
+/**
+ * Answer the connection-scope refusal when the caller's connection was made
+ * as an agent configuration that does not list `toolName`; `true` when it answered.
+ * These routes ARE the `create_plugin` and `my_plugin` tools but are not
+ * hosted by `toolHandler`, so they ask the one policy it asks —
+ * `ConnectionScope.platformToolRefusal` — and answer what it answers. A
+ * session, or a key made as Everything, carries no `agentPath` and is never
+ * refused.
+ */
+async function refuseOutsideConnectionScope(
+  req: express.Request,
+  res: express.Response,
+  user: AuthUser,
+  toolName: string,
+  agentScope: Pick<IAgentScopeResolver, 'resolve'> | undefined,
+): Promise<boolean> {
+  const scope = await resolveConnectionScope(agentScope, user.email, req.toolAuth?.agentPath);
+  const refusal = scope.platformToolRefusal(toolName);
+  if (!refusal) return false;
+  res.status(403).json(refusal);
+  return true;
+}
+
 /**
  * The two doors through which plugin folders come to exist — ONE
  * implementation each, for the app and for agents alike:
@@ -106,6 +131,8 @@ function refuseMismatchedArguments(req: express.Request, res: express.Response):
 export function createPluginCreationRoutes(
   provision: Pick<PluginProvisionService, 'createPlugin' | 'ensurePersonalPlugin'>,
   resolveUser: (req: express.Request) => Promise<AuthUser | null>,
+  /** Resolves a connection's agent choice to its scope; absent, a narrowed connection loads nothing. */
+  agentScope?: Pick<IAgentScopeResolver, 'resolve'>,
 ): express.Router {
   const router = express.Router();
 
@@ -117,8 +144,10 @@ export function createPluginCreationRoutes(
     }
     // These two routes ARE the `create_plugin` and `my_plugin` tools, so an
     // agent's call is checked against what those tools declare, exactly as a
-    // route-hosted tool's is in `toolHandler`: a call that does not match is
-    // refused before anything is provisioned.
+    // route-hosted tool's is in `toolHandler`: a call that does not match, or
+    // a connection whose agent does not list the tool, is refused before
+    // anything is provisioned.
+    if (await refuseOutsideConnectionScope(req, res, user, 'create_plugin', agentScope)) return;
     if (refuseMismatchedArguments(req, res)) return;
     // `req.body` is undefined when no JSON body was sent at all — that is a
     // 400, not a destructuring crash.
@@ -155,8 +184,10 @@ export function createPluginCreationRoutes(
     }
     // These two routes ARE the `create_plugin` and `my_plugin` tools, so an
     // agent's call is checked against what those tools declare, exactly as a
-    // route-hosted tool's is in `toolHandler`: a call that does not match is
-    // refused before anything is provisioned.
+    // route-hosted tool's is in `toolHandler`: a call that does not match, or
+    // a connection whose agent does not list the tool, is refused before
+    // anything is provisioned.
+    if (await refuseOutsideConnectionScope(req, res, user, 'my_plugin', agentScope)) return;
     if (refuseMismatchedArguments(req, res)) return;
     try {
       res.json(await provision.ensurePersonalPlugin(user));

package/src/modules/secrets-vault/__tests__/connect-pending.route.test.ts

@@ -3,6 +3,7 @@ import express from 'express';
 import { afterEach, describe, expect, it } from 'vitest';
 import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
 import { testKbContext } from '../../../__tests__/kb-context.js';
+import { ConnectionScope } from '../../agent-scope/index.js';
 
 /**
  * The aggregated `/connect/pending` surface: everything standing between the
@@ -336,6 +337,118 @@ describe('GET /api/connect/pending — readability', () => {
   });
 });
 
+describe('GET /api/connect/pending — narrowed to the agent the connection is made as', () => {
+  /**
+   * The consent step's "Connect as" choice: a connection made as an `.agent`
+   * file loads only the connectors the file lists, so the page that asks for
+   * sign-ins and keys lists only those. Two readable tools, one of which the
+   * agent loads; the agent is answered by a stub resolver over the REAL
+   * `ConnectionScope`, the one answer every agent surface asks.
+   */
+  const AGENT = { path: 'Agents/ops.agent', name: 'ops' };
+  const resolver = {
+    resolve: async (_email: string | undefined, agentPath: string | null | undefined) => {
+      if (!agentPath) return ConnectionScope.everything();
+      if (agentPath === AGENT.path) {
+        return ConnectionScope.narrowed(AGENT, { skills: [], connectors: ['Tools/weather.tool'], platformTools: null }, 'fp');
+      }
+      return ConnectionScope.gone(agentPath);
+    },
+  };
+  const twoTools = {
+    listAccessible: async () => [
+      {
+        slug: 'weather',
+        name: 'weather',
+        path: 'Tools/weather.tool',
+        type: 'http' as const,
+        variables: [{ name: 'API_KEY', scope: 'user' as const, label: null }],
+      },
+      {
+        slug: 'notion',
+        name: 'notion',
+        path: 'Tools/notion.tool',
+        type: 'mcp' as const,
+        variables: [
+          {
+            name: 'MCP_OAUTH',
+            scope: 'user' as const,
+            label: 'notion sign-in',
+            oauth: { authorizationUrl: 'https://a.example/auth', tokenUrl: 'https://a.example/token', clientId: 'cid' },
+          },
+        ],
+      },
+    ],
+  } as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['toolManualService'];
+  const vault = {
+    statusFor: async (_u: string, keys: string[]) =>
+      keys.map((key) => ({
+        key,
+        adminConfigured: key === 'notion_MCP_OAUTH',
+        adminKind: key === 'notion_MCP_OAUTH' ? ('oauth' as const) : null,
+        userConfigured: false,
+        userKind: null,
+      })),
+    // A sign-in registered directly on the Secrets page: nobody's connector.
+    list: async () => [
+      { id: 's-own', key: 'MY_TOKEN', kind: 'oauth' as const, label: 'Mine', authorized: false, createdAt: new Date(), updatedAt: new Date() },
+    ],
+  } as unknown as Parameters<typeof createSecretsVaultRoutes>[0]['secretsVault'];
+
+  async function pendingAs(agent: string | null, withResolver = true) {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+      req.userId = 'u1';
+      req.userEmail = 'a@x.com';
+      next();
+    });
+    app.use(
+      '/api',
+      createSecretsVaultRoutes({
+        kb: testKbContext(),
+        secretsVault: vault,
+        toolManualService: twoTools,
+        accessControl,
+        ...(withResolver ? { agents: resolver } : {}),
+        connectionProbe: {
+          probe: async () => ({ status: 'unverifiable' as const, detail: null, checkedAt: new Date() }),
+        },
+        stateSecret: 'test-secret',
+        publicBackendUrl: 'http://localhost:3000',
+        publicFrontendUrl: 'http://localhost:5173',
+      }),
+    );
+    httpServer = await new Promise<HttpServer>((resolve) => {
+      const s = app.listen(0, () => resolve(s));
+    });
+    const port = (httpServer.address() as { port: number }).port;
+    const query = agent === null ? '' : `?agent=${encodeURIComponent(agent)}`;
+    const res = await fetch(`http://127.0.0.1:${port}/api/connect/pending${query}`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as PendingBody & { toolOAuth: { slug: string }[] };
+    return { tools: body.tools.map((t) => t.slug), signIns: body.toolOAuth.map((o) => o.slug), standalone: body.oauth.map((o) => o.id) };
+  }
+
+  it('lists everything without a choice, as before', async () => {
+    expect(await pendingAs(null)).toEqual({ tools: ['weather'], signIns: ['notion'], standalone: ['s-own'] });
+  });
+
+  it('lists only the connectors the agent loads, and no standalone sign-in', async () => {
+    expect(await pendingAs(AGENT.path)).toEqual({ tools: ['weather'], signIns: [], standalone: [] });
+  });
+
+  it('lists nothing for an agent the person cannot use: a narrowing that cannot be read is never Everything', async () => {
+    expect(await pendingAs('Agents/gone.agent')).toEqual({ tools: [], signIns: [], standalone: [] });
+    // …and the same with no resolver wired at all.
+    expect(await pendingAs(AGENT.path, false)).toEqual({ tools: [], signIns: [], standalone: [] });
+  });
+
+  it('reads an empty or blank choice as Everything', async () => {
+    expect(await pendingAs('  ')).toEqual({ tools: ['weather'], signIns: ['notion'], standalone: ['s-own'] });
+  });
+});
+
 describe('GET /api/connect/pending — OAuth scope coverage', () => {
   // A tool with an OAuth-backed var that now requires two scopes.
   const oauthTool = {