fix(tools): resolve credentials over HTTP again so token refresh keeps the app's OAuth config

[waleedlatif1]

Summary

Reverts one change from #6660: tool credential resolution goes back to the HTTP call to POST /api/auth/oauth/token instead of resolving in-process.

Why. An OAuth refresh needs the provider's client id and secret, read through requireOAuthClientCapability, which throws when they are absent. Only the app container loads those. Tool calls execute inside Trigger.dev workers, whose environment does not carry them — so resolving in-process there turns every credential whose access token has expired into Failed to refresh access token.

A still-valid token hides the bug completely: refreshTokenIfNeeded returns early and never reads the provider config. So it surfaces late and partially, only once a token lapses, and looks like a generic auth failure rather than pointing at the cause.

Scope of the fix. Only this one hop is reverted. The rest of #6660 stands:

• Router and evaluator provider calls stay in-process — the agent block has always called executeProviderRequest in-process from the worker, so that runtime is proven, and there is no require*Capability throw anywhere in the provider path.
• Checkpoint revert and the server prefetches never crossed runtimes; both caller and callee are the app.

The shared lib/oauth/token-resolution.ts module stays — the route still uses it, and it remains the single authorization path.

Also adds a rules section on the app/worker runtime boundary, since this trap is not visible from the code: trigger.config.ts syncs only DB_APP_NAME, so the worker's environment is whatever the Trigger.dev dashboard holds, and the repo cannot see it.

Type of Change

• Bug fix

Testing

1,037 tests pass across the credential and executor paths. The restored branch is behavior-identical to the pre-#6660 code: same URL and query params, same internal-JWT header with its swallowed mint error, same body, same error parsing, same thrown message.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 13, 2026 5:53pm

[cursor]

PR Summary

Medium Risk
Touches the credential path for every OAuth-backed tool in workflow runs, but the change restores the pre-#6660 behavior rather than introducing new logic; main risk is regression if HTTP token minting or routing differs from expectations.

Overview
Reverts in-process OAuth credential resolution for tool runs so server-side tool execution again calls POST /api/auth/oauth/token (internal JWT on the worker, session cookie in the browser) instead of resolveCredentialToken in the Trigger.dev worker.

Why: OAuth refresh needs provider client id/secret via requireOAuthClientCapability, which only the app container gets from SIM_ENV_SECRET_ID. Workers do not carry that config, so in-process refresh fails once an access token expires (Failed to refresh access token); valid tokens hide the bug until the first refresh.

Docs: Adds an app/worker runtime boundary section in sim-architecture.md describing when in-process replacement of self-API calls is safe vs when worker env must be updated first.

Other #6660 in-process wins (e.g. provider calls in the agent block) are unchanged; lib/oauth/token-resolution.ts remains for the route.

^{Reviewed by Cursor Bugbot for commit 292a7ce. Configure here.}

[greptile-apps]

Greptile Summary

This PR restores HTTP-based OAuth credential resolution so refreshes execute in the app container, where provider client configuration is available.

• Routes server-side tool credential requests through POST /api/auth/oauth/token using an internal JWT.
• Retains browser authentication through the session-backed token route.
• Documents the environment boundary between the app container and Trigger.dev workers.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the restored credential-resolution path.

The HTTP request preserves the credential, workflow, scope, impersonation, caller identity, authentication, error handling, and token response fields required by the existing token route.

Important Files Changed

Filename	Overview
apps/sim/tools/index.ts	Restores authenticated HTTP credential resolution for worker and browser tool executions without an accepted regression.
.claude/rules/sim-architecture.md	Documents the app/worker environment boundary and the conditions required for safe in-process conversions.

Sequence Diagram

sequenceDiagram
  participant Worker as Trigger.dev Worker
  participant App as App Token Route
  participant Resolver as Credential Resolver
  participant Provider as OAuth Provider
  Worker->>Worker: Mint internal JWT
  Worker->>App: POST /api/auth/oauth/token
  App->>App: Verify internal JWT
  App->>Resolver: Resolve credential token
  alt Access token expired
    Resolver->>Provider: Refresh using app OAuth client config
    Provider-->>Resolver: Refreshed token
  end
  Resolver-->>App: Credential token payload
  App-->>Worker: Access token

Loading

_{Reviews (1): Last reviewed commit: "fix(tools): resolve credentials over HTT..." | Re-trigger Greptile}