fix(tools): normalize credential selectors before validation

[BillLeoutsakosvl346]

Summary

• Normalize credential aliases into the selector declared by the tool before required-input validation, for raw and Copilot execution.
• Keep an explicitly supplied declared selector authoritative; reject blank/non-string selections instead of silently choosing another credential.
• Use the canonical selector after environment-reference resolution so stale compatibility aliases cannot replace the resolved value.
• Publish one credentialId field in Copilot schemas, including selector-only stored-credential tools. Remove redundant normalization from the Copilot wrapper.
• Keep existing credential authorization, hidden token injection, default schemas, and public direct-execution nested-alias rejection unchanged.

Validation

• 358 tests pass across seven affected suites, including raw/Copilot alias execution, explicit precedence, malformed values, authorization rejection, environment references, schema consumers, and public direct-execution contracts (maxWorkers=2).
• App type-check, changed-file Biome, API validation, and git diff --check pass.
• Six existing files changed; no generators, service registrations, or auth-enum changes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 8, 2026 11:32pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; credential aliases converge on the declared selector before validation and continue through existing authorization controls.

Summary

• Maps supported aliases to each tool’s declared selector before required-input validation.
• Preserves explicit-selector precedence and rejects blank or non-string selections.
• Keeps environment-reference resolution and credential authorization in the established execution path.
• Removes redundant alias injection from the Copilot fallback wrapper.
• Adds focused coverage for raw and Copilot execution, precedence, malformed values, authorization, environment references, and schema projection.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Raw or Copilot tool arguments] --> B[Select explicit declared selector or compatibility alias]
    B --> C[Validate nonempty string]
    C --> D[Write canonical declared selector]
    D --> E[Validate required parameters]
    E --> F[Resolve permitted environment references]
    F --> G[Copy canonical selector to credential lookup input]
    G --> H[Authorize and resolve credential token]
    H --> I[Inject protected token fields]
    I --> J[Execute tool operation]

Loading