GeezerVison

Summary

Follow-ups from the final release audit of the saved-credential and keyless work. The new auth methods worked end to end, but a first-time user following the setup instructions literally would get stuck. This PR fixes those instructions and closes a gap in the registry contract.

Setup instructions fixed (each checked against the vendor's docs):

• AWS: the docs now have you enter the Role ARN before setting the trust policy. The policy shows <AWS_ACCOUNT_ID> until then, and IAM rejects that placeholder. The dialog says so too.
• Databricks: the federation-policy command needs an account-level CLI login (databricks auth login --host <account console URL> --account-id …), not a workspace profile or the web terminal.
• Google:
  • The pool placeholder was sim, which is not a valid pool ID; it is now sim-pool, and both ID fields have a format hint.
  • The docs note that only user-managed service accounts work.
  • They say to skip pool creation when the pool already exists.
  • The API list now includes Resource Manager.
• Snowflake: rename SIM_WORKFLOWS when it already exists, and run the statement as a role that can create users.
• Bitbucket: workspace and project access tokens need Premium; repository tokens do not.
• Microsoft: the keyless dialog now says where in Entra to paste the issuer, subject and audience.
• Self-hosting: the keyless section lists all five providers.

Other copy:

• Errors no longer assume the caller used "the dialog"; they also point to sim credentials keyless-subject.
• "Workspace user" is now "Google Workspace user", and "pinned account" is now "the Account ID set on the credential".
• The CLI example uses aws-service-account throughout.
• The AWS catalog hint mentions stsRegion.

The registry contract now covers every credential block.

• check-block-registry's saved-credential contract used to check only successor blocks, so a new native token+host block was never probed for host steering. It now runs for every block with a saved-credential picker. The per-block logic is in savedCredentialContractErrors, so it can be tested.
• Fixes for blocks the widened check caught:
  • Coda, Harmonic and Oracle DB tools now declare credentialKind: 'service-account'. These providers only have service-account credentials, so nothing changes for users.
  • NetSuite pins instanceUrl. The executor already overwrote it.
• The probe gained URL-shaped and ID-shaped placeholders so it can build Jama's and Higgsfield's URLs. It is not loosened.

Reconnects: reconnecting an AWS or Databricks access-key credential opens on access keys, not keyless. MIXED_MODE_PROVIDERS now covers all keyless providers.

Snowflake keyless: a host refused by egress policy is reported as host_not_allowed, the same as the other token checks.

Skills:

• add-integration covers new integrations using the native saved-credential pattern: hidden accessToken with oauth: { required: true, credentialKind: 'service-account' }, host params pinned with authoritativeParams, and the inline picker plus manualCredential twin.
• add-integration also gains a keyless row and the API/CLI two-step flow.
• add-block and add-integration now agree that credential-only successors keep the legacy block's name.
• validate-integration gains checks for native token blocks and keyless providers.

Fixtures: test tokens that looked like real vendor tokens (Bitbucket ATCTT…, GitLab glpat-…, AWS AKIA…, a JWT-shaped DocuSign token) are now neutral values, so secret scanners don't flag them.

Type of Change

• Bug fix
• Documentation

Testing

• New contract-script tests:

  • a native block with an unpinned host fails;
  • the same block with the host pinned passes;
  • a tool that accepts any credential kind fails;
  • a URL builder with mixed validation is probed.

  Reverting the loop change or the placeholders turns them red.

• prepare-workload-identity reports keyless only for each provider's keyless config. The old code fails the AWS and Databricks keyless cases.

• Snowflake egress refusal maps to host_not_allowed; reverting the guard turns it red.

• Commands run, all passing:

  • bun run lint; type-check for apps/sim and packages/sim-cli.
  • check-block-registry.ts origin/staging.
  • check:test-patterns, check:comment-hygiene, check:tool-metadata, check:skills, check:docs, check:cli-docs.
  • content:verify-compatibility.

• Targeted Vitest covered the contract script, prepare-workload-identity, the validators, minters and subject check, the AWS/Databricks/Microsoft/Google servers, token-resolution, provider-catalog, the Coda/Harmonic/Oracle/NetSuite tools, and the sim-cli commands.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)