fix(v2): tool naming, auth gates, schema flatten, WASM traps, workspace race

src/bridge/router.rs

@@ -51,7 +51,56 @@ fn gate_display_parameters(pending: &PendingGate) -> serde_json::Value {
         .unwrap_or_else(|| pending.parameters.clone())
 }
 
-async fn send_pending_gate_status(agent: &Agent, message: &IncomingMessage, pending: &PendingGate) {
+/// Resolve the owning extension name for a tool action, falling back to a
+/// credential name when the action isn't extension-backed. This is the
+/// shared core of the auth-gate display + submit routing logic — the same
+/// `provider_extension_for_tool + unwrap_or_else(credential_name)` pattern
+/// fired in three different sites in this file before, each one with the
+/// same fallback rationale: the engine's `ResumeKind::Authentication` only
+/// carries `credential_name` (e.g. `google_oauth_token`), which is opaque
+/// to users AND fails when fed back into `submit_auth_token` for
+/// WASM-tool-backed credentials, while the owning extension name (e.g.
+/// `google-drive-tool`) is what both the user-facing UI and
+/// `submit_auth_token` actually want. For built-in tools, HTTP, and skill
+/// credentials there's no owning extension and the fallback is the right
+/// thing.
+async fn resolve_extension_for_action(
+    tools: &crate::tools::ToolRegistry,
+    action_name: &str,
+    credential_fallback: &str,
+) -> String {
+    tools
+        .provider_extension_for_tool(action_name)
+        .await
+        .unwrap_or_else(|| credential_fallback.to_string())
+}
+
+/// Resolve the user-facing name to use when surfacing an authentication
+/// gate to a channel. Thin wrapper around `resolve_extension_for_action`
+/// that handles the non-Authentication ResumeKind variants by falling back
+/// to the action name (since they don't have a credential name to use).
+async fn resolve_auth_gate_display_name(
+    tools: &crate::tools::ToolRegistry,
+    pending: &PendingGate,
+) -> String {
+    if let ironclaw_engine::ResumeKind::Authentication {
+        credential_name, ..
+    } = &pending.resume_kind
+    {
+        resolve_extension_for_action(tools, &pending.action_name, credential_name).await
+    } else {
+        // Non-authentication gates don't use this string; return
+        // something innocuous.
+        pending.action_name.clone()
+    }
+}
+
+async fn send_pending_gate_status(
+    agent: &Agent,
+    message: &IncomingMessage,
+    pending: &PendingGate,
+    auth_display_name: &str,
+) {
     let display_parameters = gate_display_parameters(pending);
 
     match &pending.resume_kind {
@@ -72,16 +121,16 @@ async fn send_pending_gate_status(agent: &Agent, message: &IncomingMessage, pend
                 .await;
         }
         ironclaw_engine::ResumeKind::Authentication {
-            credential_name,
             instructions,
             auth_url,
+            ..
         } => {
             let _ = agent
                 .channels
                 .send_status(
                     &message.channel,
                     StatusUpdate::AuthRequired {
-                        extension_name: credential_name.clone(),
+                        extension_name: auth_display_name.to_string(),
                         instructions: Some(instructions.clone()),
                         auth_url: auth_url.clone(),
                         setup_url: None,
@@ -94,17 +143,15 @@ async fn send_pending_gate_status(agent: &Agent, message: &IncomingMessage, pend
     }
 }
 
-fn pending_gate_prompt_message(pending: &PendingGate) -> Option<String> {
+fn pending_gate_prompt_message(pending: &PendingGate, auth_display_name: &str) -> Option<String> {
     match &pending.resume_kind {
         ironclaw_engine::ResumeKind::Approval { .. } => Some(format!(
             "Tool '{}' requires approval. Reply 'yes' to approve, 'no' to deny.",
             pending.action_name
         )),
-        ironclaw_engine::ResumeKind::Authentication {
-            credential_name, ..
-        } => Some(format!(
+        ironclaw_engine::ResumeKind::Authentication { .. } => Some(format!(
             "Authentication required for '{}'. Paste your token below (or type 'cancel'):",
-            credential_name
+            auth_display_name
         )),
         ironclaw_engine::ResumeKind::External { .. } => Some(format!(
             "Waiting for external confirmation (gate: {})...",
@@ -244,10 +291,12 @@ fn parse_credential_name(text: &str) -> Option<String> {
 async fn notify_pending_gate(
     agent: &Agent,
     sse: Option<Arc<SseManager>>,
+    tools: &crate::tools::ToolRegistry,
     message: &IncomingMessage,
     pending: &PendingGate,
 ) -> Result<Option<String>, Error> {
     let display_parameters = gate_display_parameters(pending);
+    let auth_display_name = resolve_auth_gate_display_name(tools, pending).await;
 
     if let Some(sse) = sse {
         sse.broadcast_for_user(
@@ -276,8 +325,8 @@ async fn notify_pending_gate(
         );
     }
 
-    send_pending_gate_status(agent, message, pending).await;
-    Ok(pending_gate_prompt_message(pending))
+    send_pending_gate_status(agent, message, pending, &auth_display_name).await;
+    Ok(pending_gate_prompt_message(pending, &auth_display_name))
 }
 
 async fn insert_and_notify_pending_gate(
@@ -292,7 +341,14 @@ async fn insert_and_notify_pending_gate(
         .await
         .map_err(|e| engine_err("pending gate insert", e))?;
 
-    notify_pending_gate(agent, state.sse.clone(), message, &pending).await
+    notify_pending_gate(
+        agent,
+        state.sse.clone(),
+        state.effect_adapter.tools(),
+        message,
+        &pending,
+    )
+    .await
 }
 
 async fn execute_pending_gate_action(
@@ -1566,6 +1622,21 @@ pub async fn resolve_gate(
                 ..
             } = pending.resume_kind
             {
+                // `submit_auth_token` expects an *extension name* as
+                // its first argument and uses `configure_token` to walk
+                // the extension's capabilities file for the actual
+                // secret name. The engine's `ResumeKind::Authentication`
+                // only carries `credential_name`, which fails closed
+                // when fed there for WASM-tool-backed credentials. See
+                // `resolve_extension_for_action` for the full rationale.
+                let submit_target = resolve_extension_for_action(
+                    state.effect_adapter.tools(),
+                    &pending.action_name,
+                    credential_name,
+                )
+                .await;
+                let display_name = submit_target.clone();
+
                 if let Some(ref sse) = state.sse {
                     sse.broadcast_for_user(
                         &message.user_id,
@@ -1584,7 +1655,7 @@ pub async fn resolve_gate(
                 }
                 if let Some(ref auth_manager) = state.auth_manager {
                     match auth_manager
-                        .submit_auth_token(credential_name, &token, &message.user_id)
+                        .submit_auth_token(&submit_target, &token, &message.user_id)
                         .await
                     {
                         Ok(result) if result.activated => {
@@ -1593,7 +1664,7 @@ pub async fn resolve_gate(
                                 .send_status(
                                     &message.channel,
                                     StatusUpdate::AuthCompleted {
-                                        extension_name: credential_name.clone(),
+                                        extension_name: display_name.clone(),
                                         success: true,
                                         message: format!("{}. Resuming...", result.message),
                                     },
@@ -1607,7 +1678,7 @@ pub async fn resolve_gate(
                                 .send_status(
                                     &message.channel,
                                     StatusUpdate::AuthRequired {
-                                        extension_name: credential_name.clone(),
+                                        extension_name: display_name.clone(),
                                         instructions: Some(result.message.clone()),
                                         auth_url: result.auth_url.clone(),
                                         setup_url: None,
@@ -1623,7 +1694,7 @@ pub async fn resolve_gate(
                                 .send_status(
                                     &message.channel,
                                     StatusUpdate::AuthRequired {
-                                        extension_name: credential_name.clone(),
+                                        extension_name: display_name.clone(),
                                         instructions: Some(msg.clone()),
                                         auth_url: None,
                                         setup_url: None,
@@ -1640,7 +1711,7 @@ pub async fn resolve_gate(
                                 .send_status(
                                     &message.channel,
                                     StatusUpdate::AuthCompleted {
-                                        extension_name: credential_name.clone(),
+                                        extension_name: display_name.clone(),
                                         success: false,
                                         message: msg.clone(),
                                     },
@@ -2226,14 +2297,19 @@ async fn handle_with_engine_inner(
             ) =>
         {
             let pending = gate.clone();
-            // Clone the SSE arc out of state, then drop the engine read
-            // guard before awaiting on broadcast + channel I/O. The auth
-            // branch above does the same, and `notify_pending_gate` is
-            // signed to accept an owned Option<Arc<SseManager>> precisely
-            // so this terminal-return branch can release the lock.
+            // Clone the SSE arc and the tools registry out of state,
+            // then drop the engine read guard before awaiting on
+            // broadcast + channel I/O. The auth branch above does the
+            // same, and `notify_pending_gate` is signed to accept an
+            // owned Option<Arc<SseManager>> precisely so this
+            // terminal-return branch can release the lock. The tools
+            // registry handle is needed by `notify_pending_gate` to
+            // resolve the auth-gate display name without holding the
+            // engine state lock.
             let sse = state.sse.clone();
+            let tools = Arc::clone(state.effect_adapter.tools());
             drop(guard);
-            return notify_pending_gate(agent, sse, message, &pending).await;
+            return notify_pending_gate(agent, sse, tools.as_ref(), message, &pending).await;
         }
         PendingGateResolution::Ambiguous => {
             return Ok(Some(
@@ -2715,12 +2791,26 @@ async fn await_thread_outcome(
                     instructions,
                     auth_url,
                 } => {
+                    // Channel UIs render `extension_name` as "Authentication
+                    // required for 'X'", and `credential_name` (e.g.
+                    // `google_oauth_token`) is opaque to users, while the
+                    // owning extension name (e.g. `google-drive-tool`) is
+                    // the integration they recognise. See
+                    // `resolve_extension_for_action` for the full rationale
+                    // and the fallback semantics for non-WASM credentials.
+                    let extension_for_display = resolve_extension_for_action(
+                        state.effect_adapter.tools(),
+                        &action_name,
+                        credential_name,
+                    )
+                    .await;
+
                     let _ = agent
                         .channels
                         .send_status(
                             &message.channel,
                             StatusUpdate::AuthRequired {
-                                extension_name: credential_name.clone(),
+                                extension_name: extension_for_display.clone(),
                                 instructions: Some(instructions.clone()),
                                 auth_url: auth_url.clone(),
                                 setup_url: None,
@@ -2731,7 +2821,7 @@ async fn await_thread_outcome(
 
                     Ok(Some(format!(
                         "Authentication required for '{}'. Paste your token below (or type 'cancel'):",
-                        credential_name
+                        extension_for_display
                     )))
                 }
                 ironclaw_engine::ResumeKind::External { callback_id } => {

src/channels/wasm/loader.rs

@@ -223,7 +223,7 @@ impl WasmChannelLoader {
             }
 
             let name = match path.file_stem().and_then(|s| s.to_str()) {
-                Some(n) => n.to_string(),
+                Some(n) => n.replace('-', "_"),
                 None => {
                     results.errors.push((
                         path.clone(),
@@ -233,6 +233,8 @@ impl WasmChannelLoader {
                 }
             };
 
+            // Look up capabilities using the original filename (before
+            // hyphen normalization) so existing sidecar files are found.
             let cap_path = path.with_extension("capabilities.json");
             let has_cap = cap_path.exists();
             channel_entries.push((name, path, if has_cap { Some(cap_path) } else { None }));
@@ -382,7 +384,7 @@ pub async fn discover_channels(
         }
 
         let name = match path.file_stem().and_then(|s| s.to_str()) {
-            Some(n) => n.to_string(),
+            Some(n) => n.replace('-', "_"),
             None => continue,
         };
 

src/config/mod.rs

@@ -128,6 +128,27 @@ pub struct Config {
     pub relay: Option<RelayConfig>,
 }
 
+/// Generate a fresh random AES-256-GCM master key for `Config::for_testing`.
+///
+/// Returns a hex-encoded 32-byte key (64 hex chars), satisfying the length
+/// check in `SecretsConfig::resolve`. Each call returns a different value —
+/// tests don't need cross-process determinism (each test builds a fresh
+/// secrets store on top of a fresh temp DB), and committing a constant
+/// master key into the source tree would mean every developer who built
+/// with `--features libsql` had a publicly-known key in their process.
+#[cfg(feature = "libsql")]
+fn generate_test_master_key() -> secrecy::SecretString {
+    use rand::RngCore;
+    let mut bytes = [0u8; 32];
+    rand::thread_rng().fill_bytes(&mut bytes);
+    let mut hex = String::with_capacity(64);
+    for b in bytes {
+        use std::fmt::Write;
+        let _ = write!(hex, "{:02x}", b);
+    }
+    secrecy::SecretString::from(hex)
+}
+
 impl Config {
     /// Create a full Config for integration tests without reading env vars.
     ///
@@ -176,7 +197,24 @@ impl Config {
                 enabled: false,
                 ..WasmConfig::default()
             },
-            secrets: SecretsConfig::default(),
+            // Test config gets a freshly-generated random master key so
+            // the secrets store is wired up out of the box. Without this,
+            // every replay-mode test that touches credentials would have
+            // to either build its own SecretsStore or skip the secrets
+            // path entirely. The key is generated per call (NOT a
+            // hardcoded constant) — `Config::for_testing` is `pub` so
+            // anything in the crate or downstream tests can call it, and
+            // committing a known master key into the source tree would
+            // mean every developer who built with `--features libsql`
+            // had a publicly-known AES-256-GCM key sitting in their
+            // process. Tests don't need cross-process determinism here:
+            // each test creates its own temp DB, so the secrets store
+            // is born fresh on every call anyway.
+            secrets: SecretsConfig {
+                master_key: Some(generate_test_master_key()),
+                enabled: true,
+                source: crate::settings::KeySource::Env,
+            },
             builder: BuilderModeConfig {
                 enabled: false,
                 ..BuilderModeConfig::default()