carthagent 1.0.7 → 1.1.0-beta.1

package/tests/opencode-codegraph-plugin.test.mjs

@@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createJiti } from 'jiti';
+
+const jiti = createJiti(import.meta.url);
+const { registerCodegraph } = await jiti.import('../plugins/carthagent/src/server/codegraph.ts');
+
+test('native codegraph scan consumes the resolved per-session max-files setting', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ctg-native-codegraph-cap-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await mkdir(join(root, 'src'));
+  await writeFile(join(root, 'src/a.js'), 'export function alpha() {}\n');
+  await writeFile(join(root, 'src/b.js'), 'export function beta() {}\n');
+  await writeFile(join(root, 'src/c.js'), 'export function gamma() {}\n');
+  let registered;
+  const sessions = {
+    capped: { location: { directory: root }, metadata: { 'carthagent.options': { codegraphMaxFiles: 1 } } },
+    expanded: { location: { directory: root }, metadata: { 'carthagent.options': { codegraphMaxFiles: 3 } } },
+    default: { location: { directory: root } },
+  };
+  const ctx = {
+    options: {},
+    tool: { transform: async callback => {
+      callback({ namespace() {}, add(tool) { registered = tool; } });
+      return { dispose: async () => {} };
+    } },
+    session: { get: async ({ sessionID }) => sessions[sessionID] },
+  };
+  const dispose = await registerCodegraph(ctx, { maxFiles: 2 });
+  t.after(dispose);
+  const status = async sessionID => JSON.parse((await registered.execute({ op: 'status' }, { sessionID })).content).coverage;
+  assert.deepEqual(
+    (({ files, discovered, skipped, complete }) => ({ files, discovered, skipped, complete }))(await status('capped')),
+    { files: 1, discovered: 3, skipped: 2, complete: false },
+  );
+  assert.deepEqual(
+    (({ files, discovered, skipped, complete }) => ({ files, discovered, skipped, complete }))(await status('expanded')),
+    { files: 3, discovered: 3, skipped: 0, complete: true },
+  );
+  assert.deepEqual(
+    (({ files, discovered, skipped, complete }) => ({ files, discovered, skipped, complete }))(await status('default')),
+    { files: 2, discovered: 3, skipped: 1, complete: false },
+  );
+});

package/tests/opencode-delivery.test.mjs

@@ -40,6 +40,22 @@ function host(t) {
   return { ctx, tools, hooks, commands, stores, directory, session, sessions, interrupts }
 }
 
+test('delivery_review coverage schema accepts assertion aliases models emit', async t => {
+  const h = host(t)
+  await registerDelivery(h.ctx, { workflow: 'standard' })
+  const item = h.tools.get('delivery_review').input.properties.coverage.items
+  assert.deepEqual(item.required, ['requirement'])
+  assert.deepEqual(item.properties.assertions.anyOf.map(s => s.type), ['string', 'array'])
+  assert.equal(item.properties.assertion.type, 'string')
+})
+
+test('code-mode catalog always lists the delivery_plan entry point', async t => {
+  const h = host(t)
+  await registerDelivery(h.ctx, { workflow: 'standard' })
+  const pinned = [...h.tools.values()].filter(def => def.options?.pinned).map(def => def.name)
+  assert.deepEqual(pinned, ['delivery_plan'])
+})
+
 test('OpenCode V2 registration exposes domain tools and returns complete cleanup', async t => {
   const h = host(t)
   const cleanup = await registerDelivery(h.ctx, { workflow: 'standard' })

package/tests/opencode-providers.test.mjs

@@ -1,17 +1,164 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { readLegacyCarthagentCredential, refreshSingleFlight, refreshNativeCredential, credentialStorageKey, nativeCredentialFile } from '../lib/opencode/credentials.mjs';
+import { readLegacyCarthagentCredential, refreshSingleFlight, refreshNativeCredential, credentialStorageKey, nativeCredentialFile, nativeCredentialDatabaseFile, readNativeOAuthCredential } from '../lib/opencode/credentials.mjs';
 import { createSessionIdentity, managedRequestIdentity, shipTelemetryHeaders } from '../plugins/carthagent/src/server/telemetry.ts';
 import { registerProviders, providerConstants } from '../plugins/carthagent/src/server/providers.ts';
 import { createDeviceAuthController } from '../plugins/carthagent/src/server/device-auth.ts';
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import os from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
+import { DatabaseSync } from 'node:sqlite';
+import { acquireFileLock } from '../lib/opencode/file-lock.mjs';
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+test('provider shares actual legacy auth.json coordination lease and rejects old unbound receipt before HTTP', async t => {
+  const directory = await mkdtemp(join(os.tmpdir(), 'ctg-refresh-legacy-path-'));
+  let db;
+  t.after(async () => {
+    // after hooks run FIFO: close SQLite before Windows unlinks its files.
+    try { db?.close(); } finally { await rm(directory, { recursive: true, force: true }); }
+  });
+  const env = { XDG_DATA_HOME: directory, OPENCODE_DB: join(directory, 'native.sqlite') };
+  const vaultFile = nativeCredentialDatabaseFile(env, 'ctg.2.0.32');
+  const coordinationFile = nativeCredentialFile(env);
+  assert.notEqual(vaultFile, coordinationFile);
+  db = new DatabaseSync(vaultFile);
+  db.exec('CREATE TABLE credential (id TEXT PRIMARY KEY, integration_id TEXT, value TEXT)');
+  const credential = { type: 'oauth', methodID: 'carthagent-device', access: 'fixture-a', refresh: 'fixture-old', expires: 1 };
+  db.prepare('INSERT INTO credential VALUES (?, ?, ?)').run('A', 'experiential-labs', JSON.stringify(credential));
+  const digest = createHash('sha256').update(`${credential.methodID}\0${credential.refresh}`).digest('hex').slice(0, 32);
+  const lock = `${coordinationFile}.ctg-refresh-${digest}.lock`;
+  // This is exactly the legacy helper's path, acquired by its unchanged lock
+  // implementation. A new provider must wait on it, not a SQLite sibling.
+  const release = await acquireFileLock(lock);
+  t.after(release);
+  let httpCalls = 0;
+  const fake = fakeContext();
+  const cleanup = await registerProviders(fake.ctx, { env, fetchImpl: async () => { httpCalls++; throw Error('HTTP must not run'); } });
+  t.after(cleanup);
+  const result = fake.integrationTransforms[0][0].refresh(credential).then(() => 'unexpected success', error => error);
+  await new Promise(resolve => setTimeout(resolve, 100));
+  assert.equal(httpCalls, 0, 'new provider must honor the old process lease');
+  const receipt = JSON.stringify({ pid: process.pid, owner: 'legacy-owner', from: digest, to: 'legacy-rotation', stage: 'complete', createdAt: Date.now() });
+  await writeFile(`${lock}.pending`, receipt, { mode: 0o600 });
+  await release();
+  const error = await result;
+  assert.match(error.message, /Unbound or different native credential refresh receipt/);
+  assert.equal(httpCalls, 0, 'old receipt at actual legacy namespace must block rotation');
+  assert.equal(await readFile(`${lock}.pending`, 'utf8'), receipt, 'do not discard uncertain legacy receipt');
+  await assert.rejects(readFile(`${vaultFile}.ctg-refresh-${digest}.lock.pending`), { code: 'ENOENT' });
+  await assert.rejects(readFile(coordinationFile), { code: 'ENOENT' }, 'coordination must not create an alternate credential store');
+});
+
+test('native vault paths follow runtime channel, XDG data and explicit database overrides', () => {
+  assert.equal(nativeCredentialDatabaseFile({ XDG_DATA_HOME: '/data' }, 'ctg.2.0.32'), resolve('/data', 'opencode', 'opencode-ctg.2.0.32.db'));
+  assert.equal(nativeCredentialDatabaseFile({ XDG_DATA_HOME: '/data', OPENCODE_DB: '/private/vault.sqlite' }, 'dev'), resolve('/private/vault.sqlite'));
+  assert.equal(nativeCredentialDatabaseFile({ XDG_DATA_HOME: '/data', OPENCODE_DB: 'custom.sqlite' }, 'dev'), resolve('/data', 'opencode', 'custom.sqlite'));
+  assert.throws(() => nativeCredentialDatabaseFile({}, undefined), /channel is required/);
+  assert.throws(() => nativeCredentialDatabaseFile({ OPENCODE_DB: ':memory:' }, 'dev'), /file-backed/);
+});
+
+test('expired native resolution refreshes once without reentering resolve and preserves native persistence', { timeout: 5000 }, async t => {
+  const directory = await mkdtemp(join(os.tmpdir(), 'ctg-provider-reentry-'));
+  let db;
+  t.after(async () => {
+    try { db?.close(); } finally { await rm(directory, { recursive: true, force: true }); }
+  });
+  const credentialFile = join(directory, 'native.sqlite');
+  db = new DatabaseSync(credentialFile);
+  db.exec('CREATE TABLE credential (id TEXT PRIMARY KEY, integration_id TEXT, value TEXT)');
+  const expired = { type: 'oauth', methodID: 'carthagent-device', access: 'expired', refresh: 'old-refresh', expires: 1 };
+  db.prepare('INSERT INTO credential VALUES (?, ?, ?)').run('cred_fixture', 'experiential-labs', JSON.stringify(expired));
+  const connection = { type: 'credential', id: 'cred_fixture', method: 'oauth', label: 'fixture' };
+  const fake = fakeContext();
+  let resolves = 0;
+  let refreshes = 0;
+  const cleanup = await registerProviders(fake.ctx, { credentialFile, env: { CARTHAGENT_CLOUD_URL: 'https://cloud.test' },
+    fetchImpl: async (url, init) => {
+      assert.equal(String(url), 'https://cloud.test/v1/token/refresh');
+      assert.ok(init.signal, 'refresh fetch must have a bounded abort signal');
+      assert.equal(JSON.parse(init.body).refreshToken, 'old-refresh');
+      refreshes++;
+      return Response.json({ accessToken: 'rotated-access', refreshToken: 'rotated-refresh', expiresIn: 3600 });
+    } });
+  t.after(cleanup);
+  const method = fake.integrationTransforms[0][0];
+  fake.ctx.integration.connection.active = async id => id === 'experiential-labs' ? connection : undefined;
+  fake.ctx.integration.connection.resolve = async () => {
+    resolves++;
+    assert.ok(resolves <= 2, 'refresh reread must not call resolve recursively');
+    const stored = JSON.parse(db.prepare('SELECT value FROM credential WHERE id = ?').get(connection.id).value);
+    if (stored.expires > Date.now() + 300000) return stored;
+    const rotated = await method.refresh(stored);
+    db.prepare('UPDATE credential SET value = ? WHERE id = ?').run(JSON.stringify(rotated), connection.id);
+    return rotated;
+  };
+  const results = await Promise.all([fake.ctx.integration.connection.resolve(connection), fake.ctx.integration.connection.resolve(connection)]);
+  assert.equal(refreshes, 1);
+  assert.equal(resolves, 2);
+  assert.equal(results[0].access, 'rotated-access');
+  assert.deepEqual(results[0], results[1]);
+  assert.equal(JSON.parse(db.prepare('SELECT value FROM credential').get().value).refresh, 'rotated-refresh');
+  assert.equal(fake.storage.size, 0, 'plugin storage must not contain credentials');
+  db.prepare('UPDATE credential SET value = ?').run('{"type":"oauth","refresh":"secret-invalid"}');
+  await assert.rejects(readNativeOAuthCredential({ credentialFile, credentialID: connection.id, integrationID: 'experiential-labs', methodID: 'carthagent-device' }), error => {
+    assert.doesNotMatch(error.message, /secret-invalid/);
+    return /Unsupported native credential/.test(error.message);
+  });
+});
+
+test('refresh pins original A despite active B before lock and during receipt wait; legacy receipts fail closed', async t => {
+  const directory = await mkdtemp(join(os.tmpdir(), 'ctg-refresh-account-'));
+  let db;
+  t.after(async () => {
+    try { db?.close(); } finally { await rm(directory, { recursive: true, force: true }); }
+  });
+  const credentialFile = join(directory, 'native.sqlite');
+  db = new DatabaseSync(credentialFile);
+  db.exec('CREATE TABLE credential (id TEXT PRIMARY KEY, integration_id TEXT, value TEXT)');
+  const a = { type: 'oauth', methodID: 'carthagent-device', access: 'a', refresh: 'refresh-a', expires: 1 };
+  const b = { ...a, access: 'b', refresh: 'refresh-b' };
+  const insert = (id, value) => db.prepare('INSERT INTO credential VALUES (?, ?, ?)').run(id, 'experiential-labs', JSON.stringify(value));
+  insert('A', a); insert('B', b);
+  const fake = fakeContext();
+  const cleanup = await registerProviders(fake.ctx, { credentialFile, env: {}, fetchImpl: async () => Response.json({ accessToken: 'new-a', refreshToken: 'new-refresh-a', expiresIn: 3600 }) });
+  t.after(cleanup);
+  // Any refresh-time active lookup would select the wrong account.
+  fake.ctx.integration.connection.active = async () => ({ type: 'credential', id: 'B' });
+  const method = fake.integrationTransforms[0][0];
+  const result = await method.refresh(a);
+  assert.equal(result.access, 'new-a');
+  db.prepare('UPDATE credential SET value = ? WHERE id = ?').run(JSON.stringify(result), 'A');
+  assert.deepEqual(JSON.parse(db.prepare('SELECT value FROM credential WHERE id = ?').get('B').value), b);
+  const digest = createHash('sha256').update(`${a.methodID}\0${a.refresh}`).digest('hex').slice(0, 32);
+  const pending = `${credentialFile}.ctg-refresh-${digest}.lock.pending`;
+  await rm(pending);
+  db.prepare('UPDATE credential SET value = ? WHERE id = ?').run(JSON.stringify(a), 'A');
+  const capture = await readNativeOAuthCredential({ credentialFile, integrationID: 'experiential-labs', methodID: a.methodID, refreshToken: a.refresh });
+  assert.equal(capture, 'A');
+  await writeFile(pending, JSON.stringify({ pid: process.pid, owner: 'fixture', from: digest, stage: 'complete', createdAt: Date.now(), credentialID: capture }));
+  let reads = 0;
+  const waited = await refreshNativeCredential({ credential: a, credentialFile, credentialID: capture, timeout: 500,
+    reread: async () => {
+      if (++reads === 3) db.prepare('UPDATE credential SET value = ? WHERE id = ?').run(JSON.stringify(result), 'A');
+      return readNativeOAuthCredential({ credentialFile, credentialID: capture, integrationID: 'experiential-labs', methodID: a.methodID });
+    }, refresh: () => { throw Error('must not rotate twice'); } });
+  assert.equal(waited.access, 'new-a');
+  assert.ok(reads >= 3);
+  await writeFile(pending, JSON.stringify({ pid: process.pid, owner: 'old-host', from: digest, stage: 'complete', createdAt: Date.now() }));
+  await assert.rejects(refreshNativeCredential({ credential: a, credentialFile, credentialID: capture,
+    reread: async () => result, refresh: () => { throw Error('must not refresh'); } }), /Unbound or different/);
+  await rm(pending);
+  db.prepare('UPDATE credential SET value = ? WHERE id = ?').run(JSON.stringify(a), 'A');
+  insert('duplicate-A', a);
+  await assert.rejects(method.refresh(a), /Ambiguous native OAuth credential identity/);
+  db.prepare('DELETE FROM credential WHERE id IN (?, ?)').run('A', 'duplicate-A');
+  await assert.rejects(method.refresh(a), /no longer stored/);
+});
+
 function fakeContext({ integrations = ['experiential-labs', 'anthropic', 'openai-codex'], connections = {}, failAt, disposeFailure } = {}) {
   const hooks = [];
   const events = [];
@@ -35,10 +182,13 @@ function fakeContext({ integrations = ['experiential-labs', 'anthropic', 'openai
     } };
   };
   const ctx = {
+    app: { name: 'fixture', version: '2.0.32', channel: 'ctg.2.0.32' },
     provider: {
       async transform(callback) {
         const models = new Map();
         const editor = {
+          list: () => [],
+          remove() {},
           add(record) { providerTransforms.push(record); },
           get(id) { return integrations.includes(id) ? { provider: { id }, models: new Map() } : undefined; },
           models: { set(id, value) { models.set(id, value); } },
@@ -120,46 +270,66 @@ test('parallel token refresh callers share one rotation result and failures can
   assert.equal(await refreshSingleFlight('credential-2', async () => 'recovered'), 'recovered');
 });
 
-test('native-vault refresh rereads after cross-process lease acquisition and rotates once', async t => {
+test('native SQLite vault rereads after cross-process lease acquisition and rotates once', async t => {
   const directory = await mkdtemp(join(os.tmpdir(), 'ctg-refresh-vault-'));
-  t.after(() => rm(directory, { recursive: true, force: true }));
-  const vault = join(directory, 'auth.json');
-  const profile = join(directory, 'profile');
-  await writeFile(vault, JSON.stringify({ refresh: 'issued-old-token', access: 'old-access' }), { mode: 0o600 });
+  let db;
+  const children = [];
+  const childClosures = [];
+  t.after(async () => {
+    // Stop and reap workers even when an assertion fails before outputsPromise.
+    for (const child of children) {
+      if (child.exitCode === null && child.signalCode === null) child.kill();
+    }
+    await Promise.all(childClosures);
+    try { db?.close(); } finally { await rm(directory, { recursive: true, force: true }); }
+  });
+  const vault = join(directory, 'native.sqlite');
+  const profile = vault;
+  db = new DatabaseSync(vault);
+  db.exec('PRAGMA journal_mode=WAL; CREATE TABLE credential (id TEXT PRIMARY KEY, integration_id TEXT, value TEXT)');
+  db.prepare('INSERT INTO credential VALUES (?, ?, ?)').run('cred_fixture', 'experiential-labs', JSON.stringify({ type: 'oauth', methodID: 'carthagent-device', refresh: 'issued-old-token', access: 'old-access', expires: 1 }));
   const moduleUrl = new URL('../lib/opencode/credentials.mjs', import.meta.url).href;
   const worker = join(directory, 'worker.mjs');
   await writeFile(worker, `
-    import { readFile, rename, writeFile } from 'node:fs/promises';
-    import { refreshNativeCredential } from ${JSON.stringify(moduleUrl)};
+    import { readFile, writeFile } from 'node:fs/promises';
+    import { DatabaseSync } from 'node:sqlite';
+    import { refreshNativeCredential, readNativeOAuthCredential } from ${JSON.stringify(moduleUrl)};
     const [vault, profile, name, gate, rotating, resultFile] = process.argv.slice(2);
     while (true) { try { await readFile(gate); break; } catch { await new Promise(resolve => setTimeout(resolve, 5)); } }
     let rotatedByThisWorker = false;
     const result = await refreshNativeCredential({
       credential: { type: 'oauth', methodID: 'carthagent-device', refresh: 'issued-old-token', access: 'old-access' },
       credentialFile: profile,
-      reread: async () => ({ type: 'oauth', methodID: 'carthagent-device', ...JSON.parse(await readFile(vault, 'utf8')) }),
+      credentialID: 'cred_fixture',
+      reread: () => readNativeOAuthCredential({ credentialFile: vault, credentialID: 'cred_fixture', integrationID: 'experiential-labs', methodID: 'carthagent-device' }),
       refresh: async current => {
         if (current.refresh !== 'issued-old-token') throw new Error('unexpected stale vault read');
         await writeFile(rotating, name, { flag: 'wx' });
         const rotated = { refresh: 'rotated-token', access: 'new-access' };
         rotatedByThisWorker = true;
-        return { type: 'oauth', methodID: 'carthagent-device', ...rotated };
+        return { type: 'oauth', methodID: 'carthagent-device', expires: Date.now() + 3600000, ...rotated };
       },
     });
     // Model the native host: the same process that owns the refresh callback
     // persists its result atomically before exiting. Do not let the parent
     // mutate the vault after observing this worker's exit.
     if (rotatedByThisWorker) {
-      const temporary = vault + '.' + name + '.tmp';
-      await writeFile(temporary, JSON.stringify({ refresh: result.refresh, access: result.access }), { mode: 0o600 });
-      await rename(temporary, vault);
+      // Deliberately expose the callback-return/native-write gap to contender.
+      await new Promise(resolve => setTimeout(resolve, 150));
+      const db = new DatabaseSync(vault);
+      db.prepare('UPDATE credential SET value = ? WHERE id = ?').run(JSON.stringify(result), 'cred_fixture');
+      db.close();
     }
     await writeFile(resultFile, JSON.stringify({ refresh: result.refresh, access: result.access }));
     console.log(JSON.stringify({ name, refreshed: true }));
   `);
   const rotating = join(directory, 'rotating');
   const resultFiles = ['one', 'two'].map(name => join(directory, `${name}.result`));
-  const children = ['one', 'two'].map((name, index) => spawn(process.execPath, [worker, vault, profile, name, join(directory, 'go'), rotating, resultFiles[index]], { stdio: ['ignore', 'pipe', 'pipe'] }));
+  for (const [index, name] of ['one', 'two'].entries()) {
+    const child = spawn(process.execPath, [worker, vault, profile, name, join(directory, 'go'), rotating, resultFiles[index]], { stdio: ['ignore', 'pipe', 'pipe'] });
+    children.push(child);
+    childClosures.push(new Promise(resolve => child.once('close', resolve)));
+  }
   const outputsPromise = Promise.all(children.map(child => new Promise((resolve, reject) => {
     let stdout = '';
     let stderr = '';
@@ -182,9 +352,11 @@ test('native-vault refresh rereads after cross-process lease acquisition and rot
   for (const resultFile of resultFiles) {
     assert.deepEqual(JSON.parse(await readFile(resultFile, 'utf8')), { refresh: 'rotated-token', access: 'new-access' });
   }
-  assert.deepEqual(JSON.parse(await readFile(vault, 'utf8')), { refresh: 'rotated-token', access: 'new-access' });
+  const persisted = await readNativeOAuthCredential({ credentialFile: vault, credentialID: 'cred_fixture', integrationID: 'experiential-labs', methodID: 'carthagent-device' });
+  assert.equal(persisted.refresh, 'rotated-token');
+  assert.equal(persisted.access, 'new-access');
   const lockFiles = await (await import('node:fs/promises')).readdir(directory);
-  assert.equal(lockFiles.some(entry => entry.startsWith('profile.ctg-refresh-') && entry.endsWith('.lock')), false, 'completed lease should be released');
+  assert.equal(lockFiles.some(entry => entry.includes('.ctg-refresh-') && entry.endsWith('.lock')), false, 'completed lease should be released');
   assert.equal(lockFiles.filter(entry => entry.endsWith('.lock.pending')).length, 0, 'the pending receipt is removed after the native vault shows the matching rotation');
   for (const entry of lockFiles) {
     if (!entry.includes('ctg-refresh-')) continue;
@@ -209,7 +381,7 @@ test('native refresh waits are bounded and never retry an uncertain rotation', a
     timeout: 80,
     reread: async () => credential,
     refresh: async () => { refreshCalls++; return credential; },
-  }), /Timed out waiting for OpenCode to persist/);
+  }), /Timed out waiting for Carthagent runtime to persist/);
   assert.equal(refreshCalls, 0, 'a contender must not submit the old single-use token again');
   const receipt = await readFile(pending, 'utf8');
   assert.doesNotMatch(receipt, /issued-old-token|old-access/);
@@ -351,6 +523,61 @@ test('legacy credential migration reads Ship OAuth and BYOK without writing Pi s
   assert.throws(() => credentialStorageKey('../auth'), /Invalid/);
 });
 
+test('native sign-in starts fresh device authorization after opt-in legacy migration and on reconnect', async t => {
+  const directory = await mkdtemp(join(os.tmpdir(), 'ctg-signin-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const legacyFile = join(directory, 'auth.json');
+  const source = JSON.stringify({ 'experiential-labs': { type: 'oauth', access: 'legacy-access', refresh: 'legacy-refresh', expires: 123 } });
+  await writeFile(legacyFile, source, { mode: 0o600 });
+  const connections = {};
+  const fake = fakeContext({ connections });
+  const requests = [];
+  const browserUrls = [];
+  let generation = 0;
+  const cleanup = await registerProviders(fake.ctx, {
+    env: { CARTHAGENT_CLOUD_URL: 'https://cloud.test' }, agentDir: directory, now: () => 1000,
+    openBrowser: url => { browserUrls.push(url); return false; },
+    fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), body: JSON.parse(init.body) });
+      if (String(url).endsWith('/v1/device/authorizations')) {
+        generation++;
+        return Response.json({ deviceCode: `device-${generation}`, userCode: `CODE-${generation}`,
+          verificationUri: 'https://verify.test', verificationUriComplete: `https://verify.test/${generation}`, expiresIn: 60, interval: 1 });
+      }
+      assert.equal(String(url), 'https://cloud.test/v1/device/token');
+      const device = JSON.parse(init.body).deviceCode;
+      return Response.json({ accessToken: `access-${device}`, refreshToken: `refresh-${device}`, expiresIn: 3600 });
+    },
+  });
+  t.after(cleanup);
+  const method = fake.integrationTransforms[0][0];
+  assert.equal(method.method.form[0].default, false);
+  const imported = await method.authorize({ importLegacy: true });
+  assert.deepEqual(await imported.callback, { type: 'oauth', methodID: 'carthagent-device', access: 'legacy-access', refresh: 'legacy-refresh', expires: 123 });
+  assert.equal(requests.length, 0, 'one-way compatibility import remains available without browser authorization');
+
+  // Model the native host committing callback results to its active connection.
+  // The plugin must not create a second credential store or modify legacy auth.
+  connections['experiential-labs'] = { connection: { id: 'native-ship', credential: await imported.callback } };
+  for (const expected of [1, 2]) {
+    const authorization = await method.authorize({});
+    assert.equal(authorization.mode, 'auto');
+    assert.equal(authorization.url, `https://verify.test/${expected}`);
+    assert.equal(authorization.expiresAt, 61_000);
+    assert.match(authorization.instructions, new RegExp(`CODE-${expected}`));
+    const credential = await authorization.callback;
+    assert.deepEqual(credential, { type: 'oauth', methodID: 'carthagent-device',
+      access: `access-device-${expected}`, refresh: `refresh-device-${expected}`, expires: 3_601_000 });
+    connections['experiential-labs'].connection.credential = credential;
+    assert.deepEqual(await fake.ctx.integration.connection.resolve(await fake.ctx.integration.connection.active('experiential-labs')), credential);
+  }
+  assert.deepEqual(browserUrls, ['https://verify.test/1', 'https://verify.test/2']);
+  assert.equal(requests.filter(request => request.url.endsWith('/v1/device/authorizations')).length, 2);
+  assert.equal(requests.filter(request => request.url.endsWith('/v1/device/token')).length, 2);
+  assert.equal(fake.storage.size, 0, 'credentials are returned to native storage, not plugin storage');
+  assert.equal(await readFile(legacyFile, 'utf8'), source, 'migration and reconnect leave legacy credentials untouched');
+});
+
 test('provider registration uses native provider transforms and cleanup; refresh discovers subscriptions through injected APIs', async () => {
   const token = `x.${Buffer.from(JSON.stringify({ sub: 'acct', sid: 'sid', scope: 'gateway:invoke' })).toString('base64url')}.x`;
   const connections = {