@desplega.ai/agent-swarm 1.119.3 → 1.119.4

package/dist/{lead-pshn5w58.js → lead-852gtrsa.js}

@@ -1,6 +1,6 @@
 import {
   runAgent
-} from "./cli-j2vpt4hd.js";
+} from "./cli-ttb3pty1.js";
 import"./cli-sznberje.js";
 import"./cli-tyfxrrdd.js";
 import"./cli-bc89my0z.js";
@@ -14,7 +14,7 @@ import"./cli-yv9dttkh.js";
 import"./cli-hx1dcevq.js";
 import {
   getEnabledCapabilities
-} from "./cli-eb3s7zwh.js";
+} from "./cli-4xtzqzv4.js";
 import"./cli-1z7048dy.js";
 import"./cli-gz9sbyk3.js";
 import"./cli-ftyf58xj.js";
@@ -25,36 +25,36 @@ import"./cli-psrqtw2m.js";
 import"./cli-zm7njwzd.js";
 import"./cli-tghre7g6.js";
 import"./cli-e61fs2hp.js";
-import"./cli-yzxg93ma.js";
-import"./cli-8y1kmyn7.js";
-import"./cli-e5hdn9nx.js";
-import"./cli-7yfmb4ne.js";
+import"./cli-67e8g7bj.js";
+import"./cli-chfh8r6f.js";
+import"./cli-h1bffz9b.js";
+import"./cli-pc276yqz.js";
 import"./cli-86fdnerz.js";
-import"./cli-z612d1nc.js";
-import"./cli-j5da6jb2.js";
+import"./cli-qfp17rw8.js";
+import"./cli-fhmhjjh4.js";
 import"./cli-f14fvzag.js";
-import"./cli-p4yn675m.js";
-import"./cli-gzng1fst.js";
+import"./cli-bzjncaf6.js";
+import"./cli-0y66mw72.js";
 import"./cli-jkhwmmgg.js";
-import"./cli-xgefj1nz.js";
-import"./cli-6expbmb3.js";
+import"./cli-kmtp1rg9.js";
+import"./cli-8jjrc3ww.js";
 import"./cli-q25ejbyn.js";
 import"./cli-0pygq9r1.js";
 import"./cli-fad8m16k.js";
-import"./cli-9y4z25ke.js";
-import"./cli-emgzr4ja.js";
+import"./cli-jfc1jm13.js";
+import"./cli-k0x0fvh5.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
-import"./cli-3sew4a9j.js";
-import"./cli-td2x0s9b.js";
+import"./cli-cs5g429e.js";
+import"./cli-758zm6xy.js";
 import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
 import"./cli-dh55d5fg.js";
-import"./cli-y82m27mq.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/dist/{maintenance-rbjav7ey.js → maintenance-fke93wqq.js}

@@ -1,13 +1,13 @@
 import {
   reembedAllScripts
-} from "./cli-xgefj1nz.js";
-import"./cli-6expbmb3.js";
+} from "./cli-kmtp1rg9.js";
+import"./cli-8jjrc3ww.js";
 import"./cli-q25ejbyn.js";
-import"./cli-y82m27mq.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{oauth-refresh-sweep-dfbd7yw0.js → oauth-refresh-sweep-a139pm5w.js}

@@ -2,13 +2,13 @@ import {
   forceRefreshTokenOrThrow,
   getOAuthTokens,
   listOAuthTokenSweepRows
-} from "./cli-p4yn675m.js";
+} from "./cli-bzjncaf6.js";
 import"./cli-0pygq9r1.js";
-import"./cli-y82m27mq.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{onboard-g8911158.js → onboard-vcd22m9e.js}

@@ -3,7 +3,7 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-get7n46a.js";
+} from "./cli-zrxpz200.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-cx30v78p.js";
+} from "./cli-zm2jjaq6.js";
 import {
   Box_default,
   Select,

package/dist/{otel-impl-qw4pakj6.js → otel-impl-88egk5hc.js}

@@ -6,7 +6,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-cx30v78p.js";
+} from "./cli-zm2jjaq6.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{pricing-refresh-7ra0g3az.js → pricing-refresh-bbg7s7qs.js}

@@ -2,13 +2,13 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-8y1kmyn7.js";
-import"./cli-e5hdn9nx.js";
-import"./cli-y82m27mq.js";
+} from "./cli-chfh8r6f.js";
+import"./cli-h1bffz9b.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{rbac-roles-ksnmkjzf.js → rbac-roles-e169ndy2.js}

@@ -4,11 +4,11 @@ import {
 import {
   getDb,
   init_db
-} from "./cli-y82m27mq.js";
+} from "./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{rbac-roles-s0esm5k6.js → rbac-roles-kc9t08gp.js}

@@ -7,13 +7,13 @@ import {
   getUserGrant,
   listUserRoles,
   runRbacCliCommand
-} from "./cli-7yfmb4ne.js";
+} from "./cli-pc276yqz.js";
 import"./cli-86fdnerz.js";
-import"./cli-y82m27mq.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{seed-pricing-jd8zj8k7.js → seed-pricing-3zhtw483.js}

@@ -1,12 +1,12 @@
 import {
   buildModelsDevSeedRows,
   seedPricingFromModelsDev
-} from "./cli-e5hdn9nx.js";
-import"./cli-y82m27mq.js";
+} from "./cli-h1bffz9b.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{setup-z2s4vqf3.js → setup-6m99ne8y.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-get7n46a.js";
+} from "./cli-zrxpz200.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-xse3rpzd.js → worker-pwg46aav.js}

@@ -1,6 +1,6 @@
 import {
   runAgent
-} from "./cli-j2vpt4hd.js";
+} from "./cli-ttb3pty1.js";
 import"./cli-sznberje.js";
 import"./cli-tyfxrrdd.js";
 import"./cli-bc89my0z.js";
@@ -14,7 +14,7 @@ import"./cli-yv9dttkh.js";
 import"./cli-hx1dcevq.js";
 import {
   getEnabledCapabilities
-} from "./cli-eb3s7zwh.js";
+} from "./cli-4xtzqzv4.js";
 import"./cli-1z7048dy.js";
 import"./cli-gz9sbyk3.js";
 import"./cli-ftyf58xj.js";
@@ -25,36 +25,36 @@ import"./cli-psrqtw2m.js";
 import"./cli-zm7njwzd.js";
 import"./cli-tghre7g6.js";
 import"./cli-e61fs2hp.js";
-import"./cli-yzxg93ma.js";
-import"./cli-8y1kmyn7.js";
-import"./cli-e5hdn9nx.js";
-import"./cli-7yfmb4ne.js";
+import"./cli-67e8g7bj.js";
+import"./cli-chfh8r6f.js";
+import"./cli-h1bffz9b.js";
+import"./cli-pc276yqz.js";
 import"./cli-86fdnerz.js";
-import"./cli-z612d1nc.js";
-import"./cli-j5da6jb2.js";
+import"./cli-qfp17rw8.js";
+import"./cli-fhmhjjh4.js";
 import"./cli-f14fvzag.js";
-import"./cli-p4yn675m.js";
-import"./cli-gzng1fst.js";
+import"./cli-bzjncaf6.js";
+import"./cli-0y66mw72.js";
 import"./cli-jkhwmmgg.js";
-import"./cli-xgefj1nz.js";
-import"./cli-6expbmb3.js";
+import"./cli-kmtp1rg9.js";
+import"./cli-8jjrc3ww.js";
 import"./cli-q25ejbyn.js";
 import"./cli-0pygq9r1.js";
 import"./cli-fad8m16k.js";
-import"./cli-9y4z25ke.js";
-import"./cli-emgzr4ja.js";
+import"./cli-jfc1jm13.js";
+import"./cli-k0x0fvh5.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
-import"./cli-3sew4a9j.js";
-import"./cli-td2x0s9b.js";
+import"./cli-cs5g429e.js";
+import"./cli-758zm6xy.js";
 import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
 import"./cli-dh55d5fg.js";
-import"./cli-y82m27mq.js";
+import"./cli-7mvmqemc.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-cx30v78p.js";
+import"./cli-zm2jjaq6.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.119.3",
+    "version": "1.119.4",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.119.3",
+  "version": "1.119.4",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",

package/src/be/script-credential-broker.ts

@@ -25,38 +25,24 @@ export async function buildScriptCredentialBindings(input: {
 }): Promise<EgressSecretEntry[]> {
   const resolvedConfigs = getResolvedConfig(input.agentId, input.repoId);
   const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
-  const relationalBindings = listRelationalCredentialBindings(input);
-  for (const binding of relationalBindings) {
-    if (binding.authKind !== "oauth") continue;
-    configMap.set(binding.configKey, "");
-    if (!binding.oauthProvider) continue;
-
-    let accessToken: string | undefined;
-    try {
-      accessToken = await resolveOAuthBindingToken(binding.oauthProvider);
-    } catch (err) {
-      // A stale/broken provider must not take down unrelated script runs —
-      // skip just this binding (the "" shadow above keeps the placeholder
-      // unresolved instead of falling through to a same-named config value).
-      const message = err instanceof Error ? err.message : String(err);
-      console.warn(
-        `[script-credential-broker] skipping OAuth binding ${binding.configKey}: token refresh for provider ${binding.oauthProvider} failed: ${scrubSecrets(message)}`,
-      );
-      continue;
-    }
-    if (!accessToken) continue;
-
-    configMap.set(binding.configKey, accessToken);
-    registerVolatileSecret(accessToken, binding.configKey);
-  }
-
   const broker = new CredentialBroker(
     new RelationalCredentialBindingStore((filters) => getSwarmConfigs(filters)),
     (configKey) => configMap.get(configKey) ?? process.env[configKey],
     DEFAULT_CREDENTIAL_BINDINGS,
+    async (provider) => {
+      try {
+        return await resolveOAuthBindingToken(provider);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(
+          `[script-credential-broker] skipping OAuth provider ${provider}: ${scrubSecrets(message)}`,
+        );
+        return undefined;
+      }
+    },
   );
 
-  const bindings = broker.resolveBindings({ agentId: input.agentId, repoId: input.repoId });
+  const bindings = await broker.resolveBindings({ agentId: input.agentId, repoId: input.repoId });
   for (const binding of bindings) {
     registerVolatileSecret(binding.value, binding.configKey);
   }

package/src/scripts-runtime/credential-broker/broker.ts

@@ -1,4 +1,9 @@
-import type { CredentialBinding, CredentialBindingStore, CredentialResolver } from "./types";
+import type {
+  CredentialBinding,
+  CredentialBindingStore,
+  CredentialResolver,
+  OAuthCredentialResolver,
+} from "./types";
 import { placeholderForConfigKey, type ResolvedCredentialBinding } from "./types";
 
 function bindingHasPlaceholder(binding: CredentialBinding) {
@@ -12,11 +17,12 @@ function bindingHasPlaceholder(binding: CredentialBinding) {
 export class CredentialBroker {
   constructor(
     private readonly store: CredentialBindingStore,
-    private readonly resolveCredential: CredentialResolver,
+    private readonly resolveConfigCredential: CredentialResolver,
     private readonly defaults: CredentialBinding[] = [],
+    private readonly resolveOAuthCredential?: OAuthCredentialResolver,
   ) {}
 
-  resolveBindings(context: Parameters<CredentialBindingStore["listActiveBindings"]>[0]) {
+  async resolveBindings(context: Parameters<CredentialBindingStore["listActiveBindings"]>[0]) {
     const merged = [...this.defaults, ...this.store.listActiveBindings(context)];
     const resolved: ResolvedCredentialBinding[] = [];
     const seen = new Set<string>();
@@ -25,7 +31,12 @@ export class CredentialBroker {
       if (binding.active === false) continue;
       if (!bindingHasPlaceholder(binding)) continue;
 
-      const value = this.resolveCredential(binding.configKey);
+      const value =
+        binding.authKind === "oauth"
+          ? binding.oauthProvider
+            ? await this.resolveOAuthCredential?.(binding.oauthProvider)
+            : undefined
+          : this.resolveConfigCredential(binding.configKey);
       if (!value) continue;
 
       const dedupeKey = [

package/src/scripts-runtime/credential-broker/index.ts

@@ -12,6 +12,7 @@ export {
   CredentialBindingsDocumentSchema,
   type CredentialResolver,
   normalizeCredentialBindingsDocument,
+  type OAuthCredentialResolver,
   placeholderForConfigKey,
   type ResolvedCredentialBinding,
 } from "./types";

package/src/scripts-runtime/credential-broker/types.ts

@@ -51,6 +51,7 @@ export interface CredentialBindingStore {
 }
 
 export type CredentialResolver = (configKey: string) => string | undefined;
+export type OAuthCredentialResolver = (oauthProvider: string) => Promise<string | undefined>;
 
 export function placeholderForConfigKey(configKey: string): string {
   return `${REDACTED_PLACEHOLDER_PREFIX}${configKey}]`;

package/src/scripts-runtime/egress-secrets.ts

@@ -7,13 +7,13 @@ import {
 
 export type EgressSecretEntry = ResolvedCredentialBinding;
 
-export function buildEgressSecrets(): EgressSecretEntry[] {
+export async function buildEgressSecrets(): Promise<EgressSecretEntry[]> {
   const broker = new CredentialBroker(
     { listActiveBindings: () => [] },
     (configKey) => process.env[configKey],
     DEFAULT_CREDENTIAL_BINDINGS,
   );
-  return broker.resolveBindings({});
+  return await broker.resolveBindings({});
 }
 
 export function patchFetchWithEgressSubstitution(secrets: EgressSecretEntry[]): void {

package/src/scripts-runtime/loader.ts

@@ -36,7 +36,7 @@ export type RunScriptOutput = Omit<ExecutorOutput, "result" | "stdout" | "stderr
 
 export type { ScriptRuntimeError, ScriptStackFrame } from "./executors/types";
 
-function buildConfigPayload(input: RunScriptInput): SwarmConfigPayload {
+async function buildConfigPayload(input: RunScriptInput): Promise<SwarmConfigPayload> {
   const apiKey = getApiKey();
   if (!apiKey) throw new Error("Swarm API key is required to run scripts");
 
@@ -50,7 +50,7 @@ function buildConfigPayload(input: RunScriptInput): SwarmConfigPayload {
       },
     },
     user: input.userConfig ?? {},
-    egressSecrets: input.egressSecrets ?? buildEgressSecrets(),
+    egressSecrets: input.egressSecrets ?? (await buildEgressSecrets()),
     apiConnections: input.apiConnections ?? [],
     mcpConnections: input.mcpConnections ?? [],
   };
@@ -91,7 +91,7 @@ export async function runScript(input: RunScriptInput): Promise<RunScriptOutput>
   const output = await getScriptExecutor().run({
     source: input.source,
     args: input.args ?? null,
-    configPayload: buildConfigPayload(input),
+    configPayload: await buildConfigPayload(input),
     resources,
     fsMode: input.fsMode ?? "none",
     network: "open",

package/src/tests/credential-broker.test.ts

@@ -1,6 +1,7 @@
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, mock, test } from "bun:test";
 import { deleteSwarmConfig, upsertSwarmConfig } from "../be/db";
 import { buildScriptCredentialBindings } from "../be/script-credential-broker";
+import { createApiRegistryClient } from "../scripts-runtime/api-client";
 import {
   CREDENTIAL_BINDINGS_CONFIG_KEY,
   type CredentialBindingStore,
@@ -119,7 +120,7 @@ describe("credential broker", () => {
     );
   });
 
-  test("resolves seeded GITHUB_TOKEN binding", () => {
+  test("resolves seeded GITHUB_TOKEN binding", async () => {
     const emptyStore: CredentialBindingStore = { listActiveBindings: () => [] };
     const broker = new CredentialBroker(
       emptyStore,
@@ -127,7 +128,7 @@ describe("credential broker", () => {
       DEFAULT_CREDENTIAL_BINDINGS,
     );
 
-    expect(broker.resolveBindings({})).toEqual([
+    expect(await broker.resolveBindings({})).toEqual([
       {
         configKey: "GITHUB_TOKEN",
         allowedHosts: ["api.github.com"],
@@ -142,6 +143,132 @@ describe("credential broker", () => {
     ]);
   });
 
+  test("resolves OAuth bindings with the OAuth resolver and substitutes their header", async () => {
+    const oauthResolver = mock(async (provider: string) =>
+      provider === "gmailSupport" ? "gmail-access-token" : undefined,
+    );
+    const broker = new CredentialBroker(
+      {
+        listActiveBindings: () => [
+          {
+            configKey: "GMAIL_SUPPORT_OAUTH_BINDING",
+            allowedHosts: ["gmail.googleapis.com"],
+            headerTemplate: "Authorization: Bearer [REDACTED:GMAIL_SUPPORT_OAUTH_BINDING]",
+            scope: "global",
+            scopeId: null,
+            active: true,
+            authKind: "oauth",
+            oauthProvider: "gmailSupport",
+          },
+        ],
+      },
+      () => {
+        throw new Error("config resolver must not be used for OAuth bindings");
+      },
+      [],
+      oauthResolver,
+    );
+    const bindings = await broker.resolveBindings({});
+
+    expect(oauthResolver).toHaveBeenCalledWith("gmailSupport");
+    let authorization: string | null = null;
+    globalThis.fetch = (async (_input: string | URL | Request, init?: RequestInit) => {
+      authorization = new Headers(init?.headers).get("authorization");
+      return Response.json({ ok: true });
+    }) as typeof fetch;
+    patchFetchWithCredentialBroker(bindings);
+
+    await fetch("https://gmail.googleapis.com/gmail/v1/users/me/profile", {
+      headers: { Authorization: "Bearer [REDACTED:GMAIL_SUPPORT_OAUTH_BINDING]" },
+    });
+
+    expect(authorization).toBe("Bearer gmail-access-token");
+  });
+
+  test("resolved OAuth bindings also authenticate ctx.api clients", async () => {
+    let authorization: string | null = null;
+    globalThis.fetch = (async (_input: string | URL | Request, init?: RequestInit) => {
+      authorization = new Headers(init?.headers).get("authorization");
+      return Response.json({ data: { ok: true } });
+    }) as typeof fetch;
+    const broker = new CredentialBroker(
+      {
+        listActiveBindings: () => [
+          {
+            configKey: "GMAIL_SUPPORT_OAUTH_BINDING",
+            allowedHosts: ["gmail.googleapis.com"],
+            headerTemplate: "Authorization: Bearer [REDACTED:GMAIL_SUPPORT_OAUTH_BINDING]",
+            scope: "global",
+            scopeId: null,
+            active: true,
+            authKind: "oauth",
+            oauthProvider: "gmailSupport",
+          },
+        ],
+      },
+      () => undefined,
+      [],
+      async () => "gmail-access-token",
+    );
+    patchFetchWithCredentialBroker(await broker.resolveBindings({}));
+    const api = createApiRegistryClient([
+      {
+        slug: "gmailSupport",
+        kind: "graphql",
+        baseUrl: "https://gmail.googleapis.com/gmail/v1/users/me/profile",
+        credential: {
+          configKey: "GMAIL_SUPPORT_OAUTH_BINDING",
+          headerTemplate: "Authorization: Bearer [REDACTED:GMAIL_SUPPORT_OAUTH_BINDING]",
+        },
+      },
+    ]);
+
+    await api.gmailSupport.graphql("query { me { id } }");
+
+    expect(authorization).toBe("Bearer gmail-access-token");
+  });
+
+  test("resolves config bindings via the config resolver even when oauthProvider metadata is present", async () => {
+    const oauthResolver = mock(async () => "should-not-be-used");
+    const broker = new CredentialBroker(
+      {
+        listActiveBindings: () => [
+          {
+            configKey: "VENDOR_CONFIG_KEY",
+            allowedHosts: ["api.vendor.test"],
+            headerTemplate: "Authorization: Bearer [REDACTED:VENDOR_CONFIG_KEY]",
+            scope: "global",
+            scopeId: null,
+            active: true,
+            authKind: "config",
+            oauthProvider: "vendorProvider",
+          },
+        ],
+      },
+      (key) => (key === "VENDOR_CONFIG_KEY" ? "vendor-config-value" : undefined),
+      [],
+      oauthResolver,
+    );
+
+    const bindings = await broker.resolveBindings({});
+
+    expect(oauthResolver).not.toHaveBeenCalled();
+    expect(bindings).toEqual([
+      {
+        configKey: "VENDOR_CONFIG_KEY",
+        allowedHosts: ["api.vendor.test"],
+        headerTemplate: "Authorization: Bearer [REDACTED:VENDOR_CONFIG_KEY]",
+        scope: "global",
+        scopeId: null,
+        active: true,
+        authKind: "config",
+        oauthProvider: "vendorProvider",
+        placeholder: "[REDACTED:VENDOR_CONFIG_KEY]",
+        value: "vendor-config-value",
+      },
+    ]);
+  });
+
   test("registers resolved broker config values with the scrubber", async () => {
     const bindingsConfig = upsertSwarmConfig({
       scope: "global",

package/src/tests/scripts-runtime-secret-egress.test.ts

@@ -49,9 +49,9 @@ describe("runtime secret egress", () => {
 
 describe("egress-substitution", () => {
   describe("buildEgressSecrets", () => {
-    test("includes GITHUB_TOKEN when set in env", () => {
+    test("includes GITHUB_TOKEN when set in env", async () => {
       process.env.GITHUB_TOKEN = "ghp_test1234567890abcdef";
-      const secrets = buildEgressSecrets();
+      const secrets = await buildEgressSecrets();
       expect(secrets).toEqual([
         {
           configKey: "GITHUB_TOKEN",
@@ -67,9 +67,9 @@ describe("egress-substitution", () => {
       ]);
     });
 
-    test("returns empty array when GITHUB_TOKEN not set", () => {
+    test("returns empty array when GITHUB_TOKEN not set", async () => {
       delete process.env.GITHUB_TOKEN;
-      const secrets = buildEgressSecrets();
+      const secrets = await buildEgressSecrets();
       expect(secrets).toEqual([]);
     });
   });