lael-labs/executor

e2e/scenarios/google-disabled-api.test.tsrenamed from e2e/scenarios/google-disabled-api-expired.test.ts+45−21

-// Repro: a Google 403 for a DISABLED API reads as an expired credential.
+// A Google 403 for a DISABLED API must NOT read as an expired credential.
 //
 // Production case (2026-07-10): a user's "Personal Google" connection showed
 // the red Expired badge although its OAuth token was alive and refreshing.
 // The org's Google OAuth client lives in a GCP project without the Gmail /
 // Drive / Calendar APIs enabled, so the health probe gets Google's
 // SERVICE_DISABLED 403 ("Gmail API has not been used in project ... or it is
-// disabled"). `classifyHttpStatus` maps every 401/403 to "expired", so a
+// disabled"). The old status-only classifier mapped every 401/403 to
-// perfectly healthy credential renders as Expired and the UI tells the user
+// "expired", so a healthy credential rendered as Expired and the UI told the
-// to reconnect - which cannot fix a disabled upstream API.
+// user to reconnect - advice that cannot fix a disabled upstream API.
 //
 // The scenario replays that exact journey against the Google emulator: a real
 // OAuth grant probes healthy; then the upstream starts answering the probe
 // operation with Google's real SERVICE_DISABLED body (fault injection - the
-// token stays valid, exactly like prod); the connection now reads Expired on
+// token stays valid, exactly like prod). The fixed classifier reads the error
-// screen with the reconnect toast. The assertions pin today's (wrong)
+// body and reports "misconfigured": on screen that is the amber "API
-// classification on purpose: when the classifier learns to tell "API disabled
+// disabled" badge with Google's own remediation text (including the console
-// in the project" from "credential expired", this scenario is the one that
+// link that enables the API), and no reconnect prompt.
-// must change.
 import { randomBytes } from "node:crypto";
 import { expect } from "@effect/vitest";
   });
 scenario(
-  "Google · repro: a disabled upstream API reads as an expired connection (SERVICE_DISABLED 403)",
+  "Google · a disabled upstream API reads as API disabled with the enable link, not Expired",
   { timeout: 300_000 },
   Effect.gen(function* () {
     const target = yield* Target;
         );
         yield* Effect.promise(() => emulator.client.ledger.clear());
-        // THE BUG, pinned: a 403 that means "enable this API in your GCP
+        // The fix under test: a 403 that means "enable this API in your GCP
-        // project" classifies as an expired credential.
+        // project" classifies as misconfigured, not as a dead credential.
         const verdict = yield* client.connections.checkHealth({
           params: { owner: "org", integration: slug, name: CONNECTION },
           query: { ifStaleMs: 0 },
         });
         expect(
           verdict.status,
-          "BUG: the SERVICE_DISABLED 403 classifies as an expired credential",
+          `the SERVICE_DISABLED 403 classifies as misconfigured: ${JSON.stringify(verdict)}`,
-        ).toBe("expired");
+        ).toBe("misconfigured");
         expect(verdict.httpStatus, "the probe observed the 403").toBe(403);
         expect(
           verdict.detail,
           });
           await step(
-            "The healthy-yesterday connection now shows Expired, with no clicks",
+            "The connection shows the amber API disabled badge - not Expired - with no clicks",
             async () => {
               await page.goto(`/integrations/${slug}`, { waitUntil: "networkidle" });
-              await connections.getByText("Expired", { exact: true }).waitFor({ timeout: 30_000 });
+              await connections
-              await connections.getByLabel("Status: Expired").waitFor();
+                .getByText("API disabled", { exact: true })
+                .waitFor({ timeout: 30_000 });
+              await connections.getByLabel("Status: API disabled").waitFor();
+              // The dead-credential story must be gone entirely.
+              expect(
+                await connections.getByText("Expired", { exact: true }).count(),
+                "no Expired badge on a misconfigured connection",
+              ).toBe(0);
+            },
+          );
+          await step(
+            "The row carries Google's own instruction, console link included",
+            async () => {
+              await connections.getByText(/has not been used in project/).waitFor();
+              const consoleLink = connections.getByRole("link", {
+                name: /console\.developers\.google\.com/,
+              });
+              await consoleLink.waitFor();
+              expect(
+                await consoleLink.getAttribute("href"),
+                "the enable-API console link is clickable",
+              ).toContain("console.developers.google.com");
             },
           );
           await step(
-            "Check now tells the user to reconnect - advice that cannot fix a disabled API",
+            "Check now explains the disabled API instead of prescribing reconnect",
             async () => {
               await connections.locator('button[aria-haspopup="menu"]').click();
               await page.getByRole("menuitem", { name: "Check now" }).click();
-              // The misleading UX in one line: the toast prescribes reconnecting
-              // while the upstream error says "enable the API in your project".
               await page
-                .getByText("Connection expired, reconnect to restore access")
+                .getByText(/has not been used in project/)
+                .first()
                 .waitFor({ timeout: 30_000 });
+              expect(
+                await page.getByText("Connection expired, reconnect to restore access").count(),
+                "the reconnect toast never fires for a configuration 403",
+              ).toBe(0);
             },
           );
         });

packages/core/sdk/src/health-check.test.ts+72−0

@@ -5,6 +5,8 @@ import { describe, expect, it } from "@effect/vitest"; · 4 unmodified lines
5		5
6	import {	6	import {
7	candidateIdentityTier,	7	candidateIdentityTier,
		8	classifyHttpStatus,
		9	classifyProbeResponse,
8	rankResponseSample,	10	rankResponseSample,
9	sortHealthCheckCandidatesByIdentity,	11	sortHealthCheckCandidatesByIdentity,
10	} from "./health-check";	12	} from "./health-check";
@@ -66,3 +68,73 @@ describe("candidateIdentityTier", () => { · 55 unmodified lines
66	).toBe("user.getAuthUser");	68	).toBe("user.getAuthUser");
67	});	69	});
68	});	70	});
		71
		72	// Probe classification: 401/403 mean "credential dead" EXCEPT the
		73	// configuration 403 (Google accessNotConfigured / SERVICE_DISABLED), which
		74	// must read misconfigured: the token authenticated, the API is disabled in
		75	// the OAuth client's project, and reconnecting cannot fix it. This is the
		76	// production case behind the "Expired when it is not" report (2026-07-10).
		77	describe("classifyProbeResponse", () => {
		78	const disabledMessage =
		79	"Gmail API has not been used in project 000000000000 before or it is disabled. " +
		80	"Enable it by visiting https://console.developers.google.com/apis/api/gmail.googleapis.com/overview?project=000000000000 then retry.";
		81
		82	it("classifies Google's classic accessNotConfigured 403 as misconfigured", () => {
		83	const body = {
		84	error: {
		85	code: 403,
		86	message: disabledMessage,
		87	errors: [
		88	{ message: disabledMessage, domain: "usageLimits", reason: "accessNotConfigured" },
		89	],
		90	status: "PERMISSION_DENIED",
		91	},
		92	};
		93	expect(classifyProbeResponse(403, body)).toBe("misconfigured");
		94	});
		95
		96	it("classifies the newer SERVICE_DISABLED ErrorInfo detail as misconfigured", () => {
		97	const body = {
		98	error: {
		99	code: 403,
		100	message: disabledMessage,
		101	status: "PERMISSION_DENIED",
		102	details: [
		103	{
		104	"@type": "type.googleapis.com/google.rpc.ErrorInfo",
		105	reason: "SERVICE_DISABLED",
		106	domain: "googleapis.com",
		107	},
		108	],
		109	},
		110	};
		111	expect(classifyProbeResponse(403, body)).toBe("misconfigured");
		112	});
		113
		114	it("keeps a plain 403 (no recognized reason) as expired: false-expired is the safe default", () => {
		115	expect(classifyProbeResponse(403, { error: { code: 403, message: "Forbidden" } })).toBe(
		116	"expired",
		117	);
		118	expect(classifyProbeResponse(403, undefined)).toBe("expired");
		119	expect(classifyProbeResponse(403, "Forbidden")).toBe("expired");
		120	// A permission reason that is NOT a configuration marker stays expired.
		121	expect(
		122	classifyProbeResponse(403, {
		123	error: { errors: [{ reason: "insufficientPermissions" }] },
		124	}),
		125	).toBe("expired");
		126	});
		127
		128	it("never rewrites a 401: an authentication failure is a credential problem regardless of body", () => {
		129	const body = { error: { errors: [{ reason: "accessNotConfigured" }] } };
		130	expect(classifyProbeResponse(401, body)).toBe("expired");
		131	});
		132
		133	it("matches the status-only classifier everywhere else", () => {
		134	for (const status of [200, 204, 404, 429, 500, 503]) {
		135	expect(classifyProbeResponse(status, { error: {} }), `status ${status}`).toBe(
		136	classifyHttpStatus(status),
		137	);
		138	}
		139	});
		140	});

packages/core/sdk/src/health-check.ts+62−6

@@ -18,14 +18,24 @@ · 17 unmodified lines
18	import { Schema } from "effect";	18	import { Schema } from "effect";
19		19
20	// ---------------------------------------------------------------------------	20	// ---------------------------------------------------------------------------
21	// Status: the four states a connection can be in. `expired` is the one this	21	// Status: the five states a connection can be in. `expired` is the one this
22	// whole feature exists for (Google's 7-day dev-token revocation): the credential	22	// whole feature exists for (Google's 7-day dev-token revocation): the credential
23	// authenticated fine yesterday and now returns 401/403. `degraded` covers any	23	// authenticated fine yesterday and now returns 401/403. `misconfigured` is the
24	// other non-2xx (upstream 5xx, a 404 on a mis-picked operation); `unknown` is	24	// 403 that is NOT a credential problem: the token authenticated, but the
25	// "never checked / no health check configured".	25	// upstream rejects on configuration (a Google API not enabled in the OAuth
		26	// client's GCP project): the fix is in the provider console, so telling the
		27	// user to reconnect would mislead. `degraded` covers any other non-2xx
		28	// (upstream 5xx, a 404 on a mis-picked operation); `unknown` is "never checked
		29	// / no health check configured".
26	// ---------------------------------------------------------------------------	30	// ---------------------------------------------------------------------------
27		31
28	export const HealthStatus = Schema.Literals(["healthy", "expired", "degraded", "unknown"]);	32	export const HealthStatus = Schema.Literals([
		33	"healthy",
		34	"expired",
		35	"misconfigured",
		36	"degraded",
		37	"unknown",
		38	]);
29	export type HealthStatus = typeof HealthStatus.Type;	39	export type HealthStatus = typeof HealthStatus.Type;
30		40
31	// ---------------------------------------------------------------------------	41	// ---------------------------------------------------------------------------
@@ -139,13 +149,59 @@ export type HealthCheckCandidate = typeof HealthCheckCandidate.Type; · 107 unmodified lines
139	// ---------------------------------------------------------------------------	149	// ---------------------------------------------------------------------------
140		150
141	/** Map an HTTP status to a health state: 2xx healthy, 401/403 expired (the auth	151	/** Map an HTTP status to a health state: 2xx healthy, 401/403 expired (the auth
142	* wall), everything else degraded. */	152	* wall), everything else degraded. Status-only fallback: when the response
		153	* BODY is available, use `classifyProbeResponse` instead, which tells a
		154	* credential 403 apart from a configuration 403. */
143	export const classifyHttpStatus = (status: number): HealthStatus => {	155	export const classifyHttpStatus = (status: number): HealthStatus => {
144	if (status >= 200 && status < 300) return "healthy";	156	if (status >= 200 && status < 300) return "healthy";
145	if (status === 401 \|\| status === 403) return "expired";	157	if (status === 401 \|\| status === 403) return "expired";
146	return "degraded";	158	return "degraded";
147	};	159	};
148		160
		161	// Error `reason` / `status` markers that make a 403 a CONFIGURATION rejection
		162	// rather than a credential one. Deliberately narrow and provider-shaped:
		163	// Google's error envelope carries `errors[].reason: "accessNotConfigured"`
		164	// (message "<API> has not been used in project N before or it is disabled")
		165	// and newer surfaces use `status: "PERMISSION_DENIED"` with
		166	// `details[].reason: "SERVICE_DISABLED"`. Unrecognized 403s keep the expired
		167	// classification: a false "expired" prompts a harmless reconnect, but a false
		168	// "misconfigured" would hide a genuinely dead credential.
		169	const CONFIGURATION_403_REASONS = new Set(["accessnotconfigured", "service_disabled"]);
		170
		171	/** Collect candidate `reason` markers from a Google-shaped error envelope:
		172	* `error.errors[].reason` (classic) and `error.details[].reason` (newer
		173	* google.rpc.ErrorInfo). Tolerant of partial shapes; returns []. */
		174	const errorReasonMarkers = (body: unknown): string[] => {
		175	if (body == null \|\| typeof body !== "object") return [];
		176	const error = (body as Record<string, unknown>)["error"];
		177	if (error == null \|\| typeof error !== "object") return [];
		178	const markers: string[] = [];
		179	for (const key of ["errors", "details"] as const) {
		180	const entries = (error as Record<string, unknown>)[key];
		181	if (!Array.isArray(entries)) continue;
		182	for (const entry of entries) {
		183	if (entry == null \|\| typeof entry !== "object") continue;
		184	const reason = (entry as Record<string, unknown>)["reason"];
		185	if (typeof reason === "string") markers.push(reason.toLowerCase());
		186	}
		187	}
		188	return markers;
		189	};
		190
		191	/** Classify a probe response from its status AND body. Everything is
		192	* `classifyHttpStatus` except one carve-out: a 403 whose error body carries a
		193	* known configuration reason (Google `accessNotConfigured` /
		194	* `SERVICE_DISABLED`) is `misconfigured`, not `expired`: the credential
		195	* authenticated; the upstream API is disabled in the OAuth client's project,
		196	* and only enabling it there (not reconnecting) fixes it. */
		197	export const classifyProbeResponse = (status: number, body: unknown): HealthStatus => {
		198	const byStatus = classifyHttpStatus(status);
		199	if (status !== 403 \|\| byStatus !== "expired") return byStatus;
		200	return errorReasonMarkers(body).some((reason) => CONFIGURATION_403_REASONS.has(reason))
		201	? "misconfigured"
		202	: "expired";
		203	};
		204
149	/** Resolve a dot-path (`a.b.0.c`) against a JSON value and coerce the leaf to a	205	/** Resolve a dot-path (`a.b.0.c`) against a JSON value and coerce the leaf to a
150	* display string. Numeric segments index arrays. Returns undefined when the	206	* display string. Numeric segments index arrays. Returns undefined when the
151	* path is empty, missing, or lands on a non-scalar. */	207	* path is empty, missing, or lands on a non-scalar. */

packages/core/sdk/src/index.ts+1−0

@@ -114,6 +114,7 @@ export { · 113 unmodified lines
114	HealthCheckCandidateParameter,	114	HealthCheckCandidateParameter,
115	HealthCheckResponseField,	115	HealthCheckResponseField,
116	classifyHttpStatus,	116	classifyHttpStatus,
		117	classifyProbeResponse,
117	extractIdentity,	118	extractIdentity,
118	compareHealthCheckCandidates,	119	compareHealthCheckCandidates,
119	candidateIdentityTier,	120	candidateIdentityTier,

packages/core/sdk/src/shared.ts+1−0

@@ -118,6 +118,7 @@ export { · 117 unmodified lines
118	HealthCheckCandidate,	118	HealthCheckCandidate,
119	HealthCheckCandidateParameter,	119	HealthCheckCandidateParameter,
120	classifyHttpStatus,	120	classifyHttpStatus,
		121	classifyProbeResponse,
121	extractIdentity,	122	extractIdentity,
122	compareHealthCheckCandidates,	123	compareHealthCheckCandidates,
123	candidateIdentityTier,	124	candidateIdentityTier,

packages/plugins/openapi/src/sdk/backing.ts+4−2

   ToolName,
   ToolResult,
   authToolFailure,
-  classifyHttpStatus,
+  classifyProbeResponse,
   detectInsufficientScope,
   sortHealthCheckCandidatesByIdentity,
   extractIdentity,
       } satisfies HealthCheckResult;
     }
-    const status = classifyHttpStatus(probe.result.status);
+    // Body-aware: a configuration 403 (Google accessNotConfigured /
+    // SERVICE_DISABLED) reads misconfigured, not expired.
+    const status = classifyProbeResponse(probe.result.status, probe.result.error);
     const identity =
       status === "healthy" ? extractIdentity(probe.result.data, spec.identityField) : undefined;
     // Sample the returned body ONLY on a healthy probe: the sample exists to

packages/react/src/components/accounts-section.tsx+50−0

@@ -60,6 +60,35 @@ import { · 59 unmodified lines
60		60
61	const OWNERS: readonly Owner[] = ["org", "user"];	61	const OWNERS: readonly Owner[] = ["org", "user"];
62		62
		63	/** Render a health-check detail with any bare https URL as a clickable link.
		64	* Exists for the misconfigured verdict, whose detail is the provider's own
		65	* remediation text (Google's includes the console URL that enables the
		66	* disabled API); the rest of the string stays plain text. */
		67	function DetailWithLinks(props: { readonly text: string }) {
		68	const parts = props.text.split(/(https:\/\/[^\s,;)]+)/g);
		69	return (
		70	<>
		71	{parts.map((part, index) =>
		72	part.startsWith("https://") ? (
		73	<a
		74	// Stable for a given detail string: parts are positional.
		75	// oxlint-disable-next-line react/no-array-index-key
		76	key={index}
		77	href={part}
		78	target="_blank"
		79	rel="noreferrer"
		80	className="underline underline-offset-2 hover:text-foreground"
		81	>
		82	{part}
		83	</a>
		84	) : (
		85	part
		86	),
		87	)}
		88	</>
		89	);
		90	}
		91
63	function AccountRow(props: {	92	function AccountRow(props: {
64	readonly connection: Connection;	93	readonly connection: Connection;
65	/** The integration declares scopes this connection was not granted — it must	94	/** The integration declares scopes this connection was not granted — it must
@@ -95,6 +124,7 @@ function AccountRow(props: { · 29 unmodified lines
95	const displayLabel = identity ?? String(connection.name);	124	const displayLabel = identity ?? String(connection.name);
96		125
97	const expired = status === "expired";	126	const expired = status === "expired";
		127	const misconfigured = status === "misconfigured";
98	const missingOAuthScopes = connection.missingOAuthScopes ?? [];	128	const missingOAuthScopes = connection.missingOAuthScopes ?? [];
99		129
100	const handleCheck = async () => {	130	const handleCheck = async () => {
@@ -113,6 +143,13 @@ function AccountRow(props: { · 12 unmodified lines
113	);	143	);
114	} else if (exit.value.status === "expired") {	144	} else if (exit.value.status === "expired") {
115	toast.error("Connection expired, reconnect to restore access");	145	toast.error("Connection expired, reconnect to restore access");
		146	} else if (exit.value.status === "misconfigured") {
		147	// NOT a reconnect prompt: the credential is fine; the upstream API is
		148	// disabled where the OAuth client lives. The detail carries the
		149	// provider's own instruction (with a console link for Google).
		150	toast.warning(
		151	exit.value.detail ?? "An upstream API is disabled for this connection's OAuth client",
		152	);
116	} else if (exit.value.status === "degraded") {	153	} else if (exit.value.status === "degraded") {
117	toast.warning(exit.value.detail ?? "Connection check returned an error");	154	toast.warning(exit.value.detail ?? "Connection check returned an error");
118	} else {	155	} else {
@@ -135,6 +172,14 @@ function AccountRow(props: { · 16 unmodified lines
135	Expired	172	Expired
136	</Badge>	173	</Badge>
137	) : null}	174	) : null}
		175	{misconfigured ? (
		176	<Badge
		177	variant="outline"
		178	className="shrink-0 border-amber-600/40 text-amber-600 dark:text-amber-500"
		179	>
		180	API disabled
		181	</Badge>
		182	) : null}
138	{needsReconsent ? (	183	{needsReconsent ? (
139	<Badge variant="outline" className="shrink-0 border-border text-muted-foreground">	184	<Badge variant="outline" className="shrink-0 border-border text-muted-foreground">
140	Reconnect to grant access	185	Reconnect to grant access
@@ -146,6 +191,11 @@ function AccountRow(props: { · 5 unmodified lines
146	{connection.description}	191	{connection.description}
147	</CardStackEntryDescription>	192	</CardStackEntryDescription>
148	) : null}	193	) : null}
		194	{misconfigured && probe?.detail ? (
		195	<CardStackEntryDescription className="mt-1 text-xs text-muted-foreground">
		196	<DetailWithLinks text={probe.detail} />
		197	</CardStackEntryDescription>
		198	) : null}
149	{needsReconsent ? (	199	{needsReconsent ? (
150	<CardStackEntryDescription className="mt-1 text-xs text-muted-foreground">	200	<CardStackEntryDescription className="mt-1 text-xs text-muted-foreground">
151	This connection wasn't granted all the access this integration now needs.	201	This connection wasn't granted all the access this integration now needs.

packages/react/src/components/add-account-modal.tsx+7−1

 }) {
   const { status, identity, detail, httpStatus } = props.result;
   const healthy = status === "healthy";
-  const tone = healthy ? "text-muted-foreground" : "text-destructive";
+  // Misconfigured is amber everywhere (see health-display.ts): the credential
+  // being validated is fine, so the verdict must not read as a key failure.
+  const tone = healthy
+    ? "text-muted-foreground"
+    : status === "misconfigured"
+      ? "text-amber-600 dark:text-amber-500"
+      : "text-destructive";
   const font = props.variant === "response" ? "font-mono" : "";
   return (
     <div className={`flex min-w-0 items-center gap-2 text-xs ${tone} ${font}`}>

packages/react/src/lib/health-display.ts+20−7

 import type { HealthStatus } from "@executor-js/sdk/shared";
-/** State form: badge text, indicator tooltips, "what is the current state". */
+/** State form: badge text, indicator tooltips, "what is the current state".
+ *  `misconfigured` reads "API disabled": the one concrete cause it detects
+ *  today (an upstream API not enabled in the OAuth client's project), named
+ *  plainly so the user looks at the provider console, not the credential. */
 export const HEALTH_STATUS_LABEL: Record<HealthStatus, string> = {
   healthy: "Healthy",
   expired: "Expired",
+  misconfigured: "API disabled",
   degraded: "Degraded",
   unknown: "Unchecked",
 };
 /** Text tone per status, for verdict lines and previews. Same per-status color
- *  decision as the indicator dots below; change them together. */
+ *  decision as the indicator dots below; change them together. `misconfigured`
+ *  shares degraded's amber: it needs attention, but the credential is fine, so
+ *  it must not carry expired's destructive red. */
 export const HEALTH_TEXT_CLASS: Record<HealthStatus, string> = {
   healthy: "text-emerald-600 dark:text-emerald-400",
   expired: "text-destructive",
+  misconfigured: "text-amber-600 dark:text-amber-500",
   degraded: "text-amber-600 dark:text-amber-500",
   unknown: "text-muted-foreground",
 };
 > = {
   healthy: { dot: "bg-emerald-500", ring: "ring-emerald-500/70" },
   expired: { dot: "bg-destructive", ring: "ring-destructive/70" },
+  misconfigured: { dot: "bg-amber-500", ring: "ring-amber-500/70" },
   degraded: { dot: "bg-amber-500", ring: "ring-amber-500/70" },
   unknown: { dot: "bg-muted-foreground/40", ring: "ring-muted-foreground/40" },
 };
 /** Severity for worst-of aggregation. `unknown` is excluded on purpose: a
  *  never-probed connection carries no signal, so it must not drag a group
- *  verdict in either direction. */
+ *  verdict in either direction. `misconfigured` outranks `degraded` (a named
+ *  configuration break beats a generic error) but not `expired` (a dead
+ *  credential blocks everything). */
 const HEALTH_SEVERITY: Record<Exclude<HealthStatus, "unknown">, number> = {
   healthy: 1,
   degraded: 2,
-  expired: 3,
+  misconfigured: 3,
+  expired: 4,
 };
-/** Collapse many connection statuses to the group's worst: expired > degraded
+/** Collapse many connection statuses to the group's worst: expired >
- *  > healthy. `unknown` entries are ignored; when nothing else remains (empty
+ *  misconfigured > degraded > healthy. `unknown` entries are ignored; when
- *  input or all unknown) there is no verdict and the caller renders nothing. */
+ *  nothing else remains (empty input or all unknown) there is no verdict and
+ *  the caller renders nothing. */
 export const worstHealthStatus = (statuses: readonly HealthStatus[]): HealthStatus | null => {
   let worst: Exclude<HealthStatus, "unknown"> | null = null;
   for (const status of statuses) {
 > = {
   healthy: "secondary",
   expired: "destructive",
+  misconfigured: "outline",
   degraded: "outline",
   unknown: "outline",
 };