@salesforce/afv-skills 1.59.0 → 1.60.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/afv-skills",
-  "version": "1.59.0",
+  "version": "1.60.0",
   "description": "Salesforce skills for Agentforce Vibes",
   "license": "CC-BY-NC-4.0",
   "files": [

package/skills/agentforce-architecture-analyze/SKILL.md

@@ -22,9 +22,23 @@ Design-time metadata tree for one Agentforce agent: planner → topics → actio
 
 Runs **inline** — no subagent. Every phase is deterministic file processing.
 
-## If the user hasn't given enough to proceed
+## If the user hasn't named an agent
 
-When invoked with no `agent_api_name` AND no org alias, print the following block **verbatim** — do not paraphrase, do not pre-run any script. Trigger condition: `$ARGUMENTS` is empty OR names no agent (no `--agent` flag and no known agent API name in the prose) OR names no org (no `--org` flag and no known alias).
+Trigger condition: `$ARGUMENTS` names no agent (no `--agent` flag and no exact `BotDefinition` API name in the prose). Never invent an agent name. Instead, discover what the org actually contains — one read-only query, no pipeline yet. Use the `--org` alias if given, otherwise the default target org (omit `--target-org`):
+
+```bash
+sf data query --query "SELECT DeveloperName, MasterLabel FROM BotDefinition ORDER BY DeveloperName" \
+  [--target-org <alias>] --json
+```
+
+If the user gave no org alias, the pipeline block defaults `--org` to the CLI default target org itself (`sf config get target-org --json` → `.result[0].value`) — you don't need to resolve it.
+
+Then branch on the rows returned:
+
+- **Zero agents** — tell the user the org has no Agentforce agents and stop. Do not fabricate an agent or a tree.
+- **Exactly one agent, or exactly one whose `DeveloperName`/`MasterLabel` matches the user's description** (e.g. "support", "service", "sales") — use it, say explicitly which agent you picked and why, then run the pipeline block below with `ARG_AGENT=<DeveloperName>` (and `ARG_ORG=<alias>` if the user named one) set as its first lines, e.g. `ARG_AGENT=Customer_Support_Agent`. The block reads `ARG_*` from the environment; flags in `$ARGUMENTS` still override.
+- **Otherwise** — print the block below, with the discovered agents listed as a numbered `DeveloperName — MasterLabel` table under the first line, and wait for the user to pick.
+- **Query fails** (no default org, auth error) — print the block below without the list.
 
 > Which agent should I document, and in which org?
 >
@@ -41,7 +55,7 @@ When invoked with no `agent_api_name` AND no org alias, print the following bloc
 
 ## Pipeline invocation
 
-When the user has supplied `--org <alias>` + `--agent <api_name>` (plus any optional flags), run this block. One `python3` invocation drives the full pipeline. `main.py` writes `.emit_ctx.json`; `emit_result.py` reads it and prints the final `=== RESULT ===` block last to stdout.
+Run this block once the agent is known — from `--agent <api_name>` in `$ARGUMENTS`, or preset as `ARG_AGENT=<DeveloperName>` after discovery. `--org` (or `ARG_ORG`) is optional; without it the CLI default target org is used. One `python3` invocation drives the full pipeline. `main.py` writes `.emit_ctx.json`; `emit_result.py` reads it and prints the final `=== RESULT ===` block last to stdout.
 
 ```bash
 set -euo pipefail
@@ -53,20 +67,44 @@ set -euo pipefail
 # matching the bash shebang's expectation. No-op under bash.
 [ -n "${ZSH_VERSION:-}" ] && setopt KSH_ARRAYS
 
-SKILL_ROOT="${SKILL_ROOT:-${PLUGIN_ROOT:-$HOME/.vibe/skills}/agentforce-architecture-analyze}"
+# <SKILL_DIR> = absolute path of this skill's own directory (the folder holding
+# this SKILL.md); substitute it from the skill path in context. Runtimes install
+# skills in different places, so also probe the known install roots and use the
+# first that actually contains this skill's scripts. An exported SKILL_ROOT wins.
+_skill=agentforce-architecture-analyze
+for _c in "${SKILL_ROOT:-}" "<SKILL_DIR>" \
+          "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/skills/$_skill}" \
+          "${VIBES_SKILLS_DIR:+$VIBES_SKILLS_DIR/$_skill}" \
+          "$HOME/.claude/skills/$_skill" "$PWD/.claude/skills/$_skill" \
+          "${PLUGIN_ROOT:-$HOME/.vibe/skills}/$_skill"; do
+  [ -n "$_c" ] || continue
+  # Some stagers (ADK eval) nest the bundled files under <skill>/artifacts/.
+  for _r in "$_c" "$_c/artifacts"; do
+    [ -f "$_r/scripts/main.py" ] && { SKILL_ROOT="$_r"; break 2; }
+  done
+done
+[ -f "${SKILL_ROOT:-}/scripts/main.py" ] || { echo "$_skill: scripts not found — set SKILL_ROOT to this skill's directory" >&2; exit 1; }
 
 # Argument parser. Accepts both `--org foo` and `--org=foo`.
-# `$ARGUMENTS` is the raw user input Claude Code substitutes.
-ARG_ORG=""
-ARG_AGENT=""
-ARG_VERSION=""
-ARG_FORCE=""
-ARG_REPROBE=""
-ARG_PARALLELISM=""
-ARG_MAX_MERMAID=""
-
+# `$ARGUMENTS` is the raw user input Claude Code substitutes; it may be unset
+# or plain prose. Each ARG_* starts from the environment, so a value resolved
+# during discovery can be preset (e.g. `ARG_AGENT=MyAgent` on the first line);
+# flags in $ARGUMENTS still override.
+ARG_ORG="${ARG_ORG:-}"
+ARG_AGENT="${ARG_AGENT:-}"
+ARG_VERSION="${ARG_VERSION:-}"
+ARG_FORCE="${ARG_FORCE:-}"
+ARG_REPROBE="${ARG_REPROBE:-}"
+ARG_PARALLELISM="${ARG_PARALLELISM:-}"
+ARG_MAX_MERMAID="${ARG_MAX_MERMAID:-}"
+
+# Word-split $ARGUMENTS (zsh needs SH_WORD_SPLIT for that) with globbing off
+# so prose like `*` never expands to filenames.
+[ -n "${ZSH_VERSION:-}" ] && setopt SH_WORD_SPLIT
+set -f
 # shellcheck disable=SC2206
-_args=($ARGUMENTS)
+_args=(${ARGUMENTS:-})
+set +f
 i=0
 while [ $i -lt ${#_args[@]} ]; do
  tok="${_args[$i]}"
@@ -87,6 +125,16 @@ while [ $i -lt ${#_args[@]} ]; do
  i=$((i+1))
 done
 
+# No org named anywhere: fall back to the sf CLI default target org
+# (`sf config get target-org --json` -> .result[0].value). Extracted with sed
+# so the block needs neither jq nor an inline interpreter; any failure leaves
+# ARG_ORG empty and the usage block below fires.
+if [ -z "$ARG_ORG" ] && command -v sf >/dev/null 2>&1; then
+ _cfg="$(sf config get target-org --json 2>/dev/null || true)"
+ _cfg="$(printf '%s\n' "$_cfg" | sed -n 's/.*"value"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' || true)"
+ ARG_ORG="${_cfg%%$'\n'*}"
+fi
+
 # Usage block if required flags missing. Agent reads stderr,
 # prints verbatim, and stops — does NOT pre-run main.py.
 if [ -z "$ARG_ORG" ] || [ -z "$ARG_AGENT" ]; then
@@ -95,7 +143,8 @@ if [ -z "$ARG_ORG" ] || [ -z "$ARG_AGENT" ]; then
 >
 > I need:
 > - **Agent API name** — the BotDefinition.DeveloperName (e.g. `MyAgent`)
-> - **Org alias** — for `sf` CLI auth (the alias you configured with `sf org login`)
+> - **Org alias** — for `sf` CLI auth (the alias you configured with `sf org login`);
+>   only needed when no default target org is set (`sf config set target-org <alias>`)
 >
 > Optional flags:
 > - `--version v5` — pin a specific BotVersion (default: Active+highest)
@@ -152,7 +201,7 @@ exit "$_rc"
 
 | Input | Flag | Required | Default |
 |---|---|---|---|
-| `org_alias` | `--org` | yes | — |
+| `org_alias` | `--org` | no | sf CLI default target org (`sf config get target-org`) |
 | `agent_api_name` | `--agent` | yes | — |
 | `agent_version_api_name` | `--version` | no | active BotVersion |
 | `force_refresh` | `--force` | no | false (honor cache) |
@@ -219,7 +268,7 @@ The ID-prefix router in `resolve_invocation_target.py` distinguishes the two: NG
 
 | Tool | Required |
 |---|---|
-| `sf` CLI (authenticated against the target org) | yes — `sf org login web --alias <alias>` |
+| `sf` CLI (authenticated against the target org) | yes — `sf org login web --alias <alias>`, and the CLI must provide `sf org auth show-access-token` (startup preflight enforces this) |
 | Python 3.10+ | yes |
 
 ## Reference docs to load when needed

package/skills/agentforce-architecture-analyze/assets/cli/show_access_token.yaml

@@ -1,15 +1,12 @@
 name: show_access_token
-# Primary access-token retrieval path per forcedotcom/cli#3560 (effective
-# 2026-05-27). The `sf org display --json` field is now redacted to a
-# placeholder string by default; the dedicated `sf org auth show-access-token`
-# command is the long-term replacement.
+# Access-token retrieval per forcedotcom/cli#3560. The `sf org display --json`
+# accessToken field is redacted to a placeholder string; the dedicated
+# `sf org auth show-access-token` command is the replacement.
 #
 # `--no-prompt` skips the interactive confirmation banner so the command
 # behaves identically under `--json`.
 #
-# The legacy fallback (`sf org display` with `SF_TEMP_SHOW_SECRETS=true`)
-# stays wired for sf CLI versions that don't ship show-access-token; that
-# fallback is orchestrated in `main.py::_resolve_creds`, not here.
+# This command is the only supported runtime token-retrieval path.
 argv:
   - sf
   - org

package/skills/agentforce-architecture-analyze/references/contract.json

@@ -6,7 +6,7 @@
     "required": {
       "org_alias": {
         "type": "string",
-        "description": "sf CLI alias (e.g. 'my-org-alias'). Auth is always derived via `sf org display --target-org $ORG_ALIAS --json`."
+        "description": "sf CLI alias (e.g. 'my-org-alias'). Auth is always derived via `sf org display --target-org $ORG_ALIAS --json` (instance URL) and `sf org auth show-access-token --target-org $ORG_ALIAS --json --no-prompt` (access token)."
       },
       "agent_api_name": {
         "type": "string",

package/skills/agentforce-architecture-analyze/scripts/emit_env.py

@@ -24,9 +24,9 @@ Any path component is a dictionary key OR an integer array index
 is the empty string — caller decides whether that's OK.
 
 Usage:
-    # Parse `sf org display --json` output via stdin
+    # Parse `sf org display --json` output via stdin (org metadata only —
+    # access tokens come only from `sf org auth show-access-token --json --no-prompt`)
     eval "$(printf '%s' "$_SF_JSON" | python3 emit_env.py stdin \\
-            'ACCESS_TOKEN:result.accessToken' \\
             'INSTANCE_URL:result.instanceUrl' \\
             'ORG_ID_18:result.id' \\
             'ORG_ID_15:result.id[:15]')"

package/skills/agentforce-architecture-analyze/scripts/main.py

@@ -46,7 +46,12 @@ from config import (
     build_agent_data_dir,
 )
 from rest_client import RestClientError, redact_error
-from sf_cli import AuthRequired, SfCliError, run_sf
+from sf_cli import (
+    AuthRequired,
+    SfCliError,
+    assert_show_access_token_capability,
+    run_sf,
+)
 from soql_loader import SoqlParamError
 
 # Phase 2 Batch 1 imports — functional pipeline primitives.
@@ -180,9 +185,12 @@ def _build_creds_plumbing(
     on every call so a refresh actually lands in the NEXT SOQL attempt.
     `refresh_fn` is serialized by an internal `threading.Lock` + a
     `time.monotonic()` dedupe window — N concurrent 401s against the same
-    stale token collapse to ONE `resolve_creds()` spawn per window. That
-    caps real `sf org display` spawns at roughly 1/second regardless of
-    pool size.
+    stale token collapse to ONE `resolve_creds()` call per window. The
+    window is stamped when `resolve_creds()` RETURNS, so waiters queued
+    behind a slow refresh (several sf CLI spawns: `sf org display` +
+    `sf org auth show-access-token`) reuse its result instead of
+    re-refreshing. That caps full credential refreshes at roughly one per
+    window regardless of pool size.
 
     Extracted from `main()` so the closure is testable without threading
     a whole pipeline run through argparse + mocks.
@@ -205,7 +213,9 @@ def _build_creds_plumbing(
                 # Another thread refreshed within the dedupe window — reuse.
                 return creds_cell[0]
             creds_cell[0] = resolve_creds()
-            last_refresh_mono[0] = now
+            # Stamp AFTER the (possibly slow) refresh so threads that queued
+            # on the lock during it fall inside the window and reuse it.
+            last_refresh_mono[0] = time.monotonic()
             return creds_cell[0]
 
     return creds_provider, refresh_fn, creds_cell
@@ -222,25 +232,25 @@ been stable since cli#3560 landed."""
 def _resolve_creds(org_alias: str) -> Tuple[str, str]:
     """Resolve (instance_url, access_token) for ``org_alias``.
 
-    Two-path strategy per forcedotcom/cli#3560 (effective 2026-05-27):
-
-      1. **Primary** — call ``sf org display`` for instanceUrl, then
-         ``sf org auth show-access-token`` for the access token. This is
-         the upstream long-term path; ``SF_TEMP_SHOW_SECRETS`` is
-         decommissioned in summer 2026.
-      2. **Fallback** — if the dedicated command isn't shipped in the
-         installed sf CLI version (older releases), fall back to the
-         legacy ``sf org display --verbose`` with the
-         ``SF_TEMP_SHOW_SECRETS=true`` env var that ``run_sf`` injects
-         unconditionally. The fallback is detected by the redaction
-         placeholder appearing in the ``accessToken`` field — exact match
-         on the substring ``show-access-token`` (see
-         ``_REDACTION_MARKER_FRAGMENT``).
+    Runtime token retrieval is fail-fast (forcedotcom/cli#3560): the
+    access token comes ONLY from ``sf org auth show-access-token``.
+    ``sf org display`` is still used for non-secret metadata
+    (instanceUrl). A missing command, an empty token, or the redaction
+    placeholder (see ``_REDACTION_MARKER_FRAGMENT``) all raise
+    ``AuthRequired``.
 
     sf_cli.run_sf already redacts stderr on failure paths. Any
     exception surfaces as `AuthRequired` / `SfCliError`; caller routes
     through `_emit_fail`.
     """
+    # Capability preflight first (cached once it passes, see sf_cli) so a
+    # missing sf binary / command surfaces the actionable preflight error
+    # rather than a generic spawn failure from `sf org display`.
+    try:
+        assert_show_access_token_capability()
+    except SfCliError as exc:
+        raise AuthRequired(str(exc)) from exc
+
     display_data = run_sf("org_display", ORG_ALIAS=org_alias)
     display_result = display_data.get("result") or {}
     instance_url = display_result.get("instanceUrl") or ""
@@ -249,37 +259,23 @@ def _resolve_creds(org_alias: str) -> Tuple[str, str]:
             "sf org display returned an incomplete payload (missing instanceUrl)"
         )
 
-    # Primary path: dedicated command. Catches both the unknown-command
-    # case (older sf CLI) and any AuthRequired surfaced from the recipe.
     try:
         token_data = run_sf("show_access_token", ORG_ALIAS=org_alias)
-    except SfCliError:
-        # Older sf CLI versions emit "is not a sf command" on stderr; the
-        # recipe surfaces that as SfCliError. Fall back to the
-        # SF_TEMP_SHOW_SECRETS path via the org_display payload we
-        # already have.
-        access_token = display_result.get("accessToken") or ""
-    else:
-        token_result = token_data.get("result") or {}
-        access_token = token_result.get("accessToken") or ""
-
-    # Defensive fallback: if the dedicated command silently returned an
-    # empty token OR sf CLI redacted the org_display token to the
-    # placeholder, try the org_display payload directly. SF_TEMP_SHOW_SECRETS
-    # is set unconditionally by run_sf so this works as long as the env
-    # var is still honoured by the installed sf CLI.
-    if not access_token or _REDACTION_MARKER_FRAGMENT in access_token:
-        legacy_token = display_result.get("accessToken") or ""
-        if legacy_token and _REDACTION_MARKER_FRAGMENT not in legacy_token:
-            access_token = legacy_token
+    except (SfCliError, AuthRequired) as exc:
+        raise AuthRequired(
+            "could not retrieve access token via sf org auth "
+            "show-access-token; ensure sf CLI is logged in for this org "
+            f"and supports the dedicated command. Detail: {exc}"
+        ) from exc
+
+    token_result = token_data.get("result") or {}
+    access_token = token_result.get("accessToken") or ""
 
     if not access_token or _REDACTION_MARKER_FRAGMENT in access_token:
         raise AuthRequired(
             "could not retrieve a usable access token via sf org auth "
-            "show-access-token (primary) or sf org display (fallback); "
-            "ensure sf CLI is logged in for this org and either the "
-            "dedicated command is available or SF_TEMP_SHOW_SECRETS is "
-            "still honoured."
+            "show-access-token; ensure sf CLI is logged in for this org "
+            "and the command returned a real token."
         )
 
     return instance_url, access_token

package/skills/agentforce-architecture-analyze/scripts/rest_client.py

@@ -46,12 +46,14 @@ class RestClientError(RuntimeError):
 # -----------------------------------------------------------------------------
 # error redaction
 # -----------------------------------------------------------------------------
-# Three patterns cover the bulk of token-leakage surfaces:
+# Four patterns cover the bulk of token-leakage surfaces:
 # 1. `Authorization: Bearer <token>` in any string context (header echo,
 # exception repr, stringified HTTP error).
-# 2. `accessToken=<token>` / `access_token=<token>` in URL-encoded bodies
+# 2. A bare `Bearer <token>` with no `Authorization:` prefix (curl-style
+# traces, CLI stderr, hand-built header dicts).
+# 3. `accessToken=<token>` / `access_token=<token>` in URL-encoded bodies
 # or query strings (`sf org display` errors sometimes echo these).
-# 3. `"accessToken":"<token>"` or `"access_token":"<token>"` in JSON
+# 4. `"accessToken":"<token>"` or `"access_token":"<token>"` in JSON
 # payload echoes.
 #
 # Regexes are intentionally permissive on the token character class
@@ -62,6 +64,11 @@ _AUTH_HEADER_RE = re.compile(
     r"(Authorization\s*:\s*Bearer\s+)\S+",
     flags=re.IGNORECASE,
 )
+# Matches a bare `Bearer <value>`; stops at whitespace or a quote.
+_BEARER_RE = re.compile(
+    r"(\bBearer\s+)[^\s\"']+",
+    flags=re.IGNORECASE,
+)
 # Matches access[_]?Token=<value> in url-encoded form; stops at & or whitespace.
 _ACCESS_TOKEN_QS_RE = re.compile(
     r"(access[_]?token\s*=\s*)[^&\s\"']+",
@@ -91,6 +98,7 @@ def redact_text(text: str) -> str:
     if not text:
         return text
     text = _AUTH_HEADER_RE.sub(r"\1<redacted>", text)
+    text = _BEARER_RE.sub(r"\1<redacted>", text)
     text = _ACCESS_TOKEN_QS_RE.sub(r"\1<redacted>", text)
     text = _ACCESS_TOKEN_JSON_RE.sub(r'\1<redacted>', text)
     return text

package/skills/agentforce-architecture-analyze/scripts/sf_cli.py

@@ -18,7 +18,6 @@ into logs or RESULT blocks.
 from __future__ import annotations
 
 import json
-import os
 import re
 import subprocess
 from pathlib import Path
@@ -57,6 +56,83 @@ class SfCliError(RuntimeError):
     """
 
 
+_show_access_token_capability_ok = False
+"""Set once the preflight succeeds; the check then never reruns in this
+process (401-triggered creds refreshes skip it). Failures are NOT cached,
+so a fixed PATH/upgrade is picked up on the next call."""
+
+_SHOW_ACCESS_TOKEN_HELP_SIGNATURE_RE = re.compile(
+    r"\$\s*sf\s+org\s+auth\s+show-access-token\b"
+)
+"""USAGE-line form that real ``--help`` output always contains
+(``$ sf org auth show-access-token -o <value> ...``). The bare command name
+is not enough: unknown-command notices echo it too
+(``Command org:auth:show-access-token not found``,
+``show-access-token is not a sf command``). A zero-exit probe whose output
+lacks the USAGE form is treated as a failed check."""
+
+_ANSI_ESCAPE_RE = re.compile(r"\x1b\[[0-9;?]*[ -/]*[@-~]")
+
+
+def assert_show_access_token_capability() -> None:
+    """Fail fast when the installed sf CLI lacks ``sf org auth show-access-token``.
+
+    That command is the only supported runtime token-retrieval path
+    (forcedotcom/cli#3560). Probing ``--help`` is cheap, needs no org auth,
+    and gives the operator an actionable upgrade message instead of a
+    confusing downstream auth failure. A successful probe is cached for
+    the process lifetime.
+
+    Exit status alone is not trusted: a CLI build that answers an unknown
+    command with exit 0 (e.g. printing top-level help or a "not found"
+    notice) would otherwise pass. The probe therefore also requires the
+    command's USAGE line (``$ sf org auth show-access-token``) in the
+    ANSI-stripped stdout+stderr; if it is absent the check fails and is not
+    cached.
+    """
+    global _show_access_token_capability_ok
+    if _show_access_token_capability_ok:
+        return
+    try:
+        proc = subprocess.run(
+            ["sf", "org", "auth", "show-access-token", "--help"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=True,
+        )
+    except FileNotFoundError as exc:
+        raise SfCliError(
+            "sf CLI not found on PATH — install Salesforce CLI first"
+        ) from exc
+    except subprocess.CalledProcessError as exc:
+        safe_detail = _redact_subprocess_stderr(exc.stderr or exc.stdout or "")
+        raise SfCliError(
+            "sf CLI is missing required command 'sf org auth show-access-token'. "
+            "Upgrade/reinstall Salesforce CLI to a version that provides this "
+            f"command. Preflight detail: {safe_detail or 'unknown error'}"
+        ) from exc
+    except subprocess.TimeoutExpired as exc:
+        raise SfCliError(
+            f"sf CLI capability preflight timed out: {redact_error(exc)}"
+        ) from exc
+    help_text = _ANSI_ESCAPE_RE.sub(
+        "", f"{proc.stdout or ''}\n{proc.stderr or ''}",
+    )
+    if not _SHOW_ACCESS_TOKEN_HELP_SIGNATURE_RE.search(help_text):
+        # Zero exit without the command's help signature — the CLI did not
+        # recognise the command. Fail (uncached) like a non-zero exit.
+        # Redact before truncating so a token can never be split past the regex.
+        safe_detail = _redact_subprocess_stderr(help_text.strip())[:500]
+        raise SfCliError(
+            "sf CLI is missing required command 'sf org auth show-access-token'. "
+            "Upgrade/reinstall Salesforce CLI to a version that provides this "
+            "command. Preflight detail: "
+            f"{safe_detail or 'help output lacked the command signature'}"
+        )
+    _show_access_token_capability_ok = True
+
+
 def _load_recipe(name: str) -> Dict[str, Any]:
     """Read and parse a CLI recipe file with yaml.safe_load.
 
@@ -175,14 +251,6 @@ def run_sf(name: str, **params: str) -> Dict[str, Any]:
     timeout = int(recipe.get("timeout_seconds", 60))
     auth_patterns = recipe.get("auth_required_stderr_patterns") or []
 
-    # SF_TEMP_SHOW_SECRETS=true is required for `sf org display --verbose
-    # --json` to emit `accessToken` instead of the literal redaction string
-    # `"[REDACTED] Use 'sf org auth show-access-token' to view"` introduced
-    # in sf CLI v2. Without it, downstream callers receive the redaction
-    # string as the bearer token and every Tooling/REST call returns
-    # INVALID_AUTH_HEADER 401. Set on every recipe — recipes that don't
-    # touch tokens are unaffected.
-    env = {**os.environ, "SF_TEMP_SHOW_SECRETS": "true"}
     try:
         cp = subprocess.run(
             argv,
@@ -190,7 +258,6 @@ def run_sf(name: str, **params: str) -> Dict[str, Any]:
             text=True,
             timeout=timeout,
             check=False,
-            env=env,
         )
     except subprocess.TimeoutExpired as e:
         # timeout exceptions carry stderr via e.stderr — redact.

package/skills/agentforce-architecture-analyze/scripts/tests/test_end_to_end_fixture.py

@@ -87,6 +87,7 @@ def _mock_auth_probe(probe_result=None):
     }
     return [
         mock.patch.object(main, "run_sf", return_value=org_display_payload),
+        mock.patch.object(main, "assert_show_access_token_capability"),
         mock.patch.object(main, "probe_channels", return_value=probe_result),
     ]
 

package/skills/agentforce-architecture-analyze/scripts/tests/test_flow_children_inflation.py

@@ -244,6 +244,7 @@ def _mock_auth_probe():
     }
     return [
         mock.patch.object(main, "run_sf", return_value=org_display_payload),
+        mock.patch.object(main, "assert_show_access_token_capability"),
         mock.patch.object(main, "probe_channels", return_value=fx.probe_ok_payload()),
     ]
 

package/skills/agentforce-architecture-analyze/scripts/tests/test_main_pipeline.py

@@ -131,6 +131,7 @@ def _mock_auth_probe(probe_result=None):
     org_display_payload["result"]["id"] = "00Dxx0000000000AAA"
     return [
         mock.patch.object(main, "run_sf", return_value=org_display_payload),
+        mock.patch.object(main, "assert_show_access_token_capability"),
         mock.patch.object(main, "probe_channels", return_value=probe_result),
     ]
 
@@ -852,11 +853,13 @@ class RenderFailureIntegrationTests(unittest.TestCase):
 
             # Drive emit_result against this ctx and confirm the RESULT
             # block reflects the render failure.
-            tools_dir = Path(__file__).resolve().parent.parent.parent / "tools"
+            # emit_result.py ships under scripts/ (SKILL.md invokes
+            # "$SKILL_ROOT/scripts/emit_result.py"), not the hub-era tools/.
+            scripts_dir = Path(__file__).resolve().parent.parent
             import subprocess, sys as _sys
             env = {**os.environ, "WORK_DIR": str(work_dir)}
             r = subprocess.run(
-                [_sys.executable, str(tools_dir / "emit_result.py")],
+                [_sys.executable, str(scripts_dir / "emit_result.py")],
                 env=env, capture_output=True, text=True, timeout=30,
             )
             self.assertEqual(r.returncode, 0, msg=r.stderr)
@@ -1012,6 +1015,53 @@ class ThreadSafeRefreshTests(unittest.TestCase):
 
         self.assertEqual(call_count["n"], 2)
 
+    def test_slow_refresh_waiters_do_not_re_refresh(self):
+        """A refresh that takes LONGER than the dedupe window must still
+        satisfy threads that queued on the lock while it ran. The window
+        is stamped when `resolve_creds()` returns, not when it starts —
+        otherwise every queued waiter re-refreshes after a slow
+        multi-command resolve.
+        """
+        import threading as _t
+        import time as _time
+
+        calls = {"n": 0}
+        entered = _t.Event()
+
+        def slow_resolve():
+            calls["n"] += 1
+            entered.set()
+            _time.sleep(0.3)  # longer than the 0.1s window below
+            return ("url", f"tok_{calls['n']}")
+
+        _provider, refresh, _cell = main._build_creds_plumbing(
+            ("url", "tok_0"),
+            resolve_creds=slow_resolve,
+            dedupe_window_s=0.1,
+        )
+
+        results: list = []
+        results_lock = _t.Lock()
+
+        def _worker():
+            r = refresh()
+            with results_lock:
+                results.append(r)
+
+        first = _t.Thread(target=_worker)
+        first.start()
+        self.assertTrue(entered.wait(timeout=5))
+        # These all block on the refresh lock while slow_resolve runs.
+        waiters = [_t.Thread(target=_worker) for _ in range(4)]
+        for t in waiters:
+            t.start()
+        first.join()
+        for t in waiters:
+            t.join()
+
+        self.assertEqual(calls["n"], 1)
+        self.assertEqual(results, [("url", "tok_1")] * 5)
+
     def test_provider_reads_cell_after_refresh(self):
         """After refresh mutates the cell, the NEXT `creds_provider()`
         call returns the fresh tuple (the  contract).
@@ -1512,6 +1562,7 @@ class ApiVersionEndToEndTests(unittest.TestCase):
             ]
             patches = [
                 mock.patch.object(main, "run_sf", return_value=org_display_payload),
+                mock.patch.object(main, "assert_show_access_token_capability"),
                 mock.patch.object(main, "probe_channels",
                                   return_value=fx.probe_ok_payload()),
                 *_mock_bot_resolution(),