merge: update PR branch with main

Author: apurvvkumaria

src/lib/onboard/messaging-prep.ts

@@ -102,7 +102,12 @@ export function prepareCreateSandboxMessaging(
         retainWhileDisabled: staticProviderType !== null,
       };
     })
-    .filter(({ envKey }) => !enabledEnvKeys || enabledEnvKeys.has(envKey));
+    .filter(
+      ({ envKey, retainWhileDisabled }) =>
+        !enabledEnvKeys ||
+        enabledEnvKeys.has(envKey) ||
+        (retainWhileDisabled && disabledEnvKeys.has(envKey)),
+    );
   const messagingTokenDefs: MessagingTokenDef[] = messagingCredentialDefs
     .filter(({ envKey }) => !disabledEnvKeys.has(envKey))
     .map(({ retainWhileDisabled: _retainWhileDisabled, ...definition }) => definition);
@@ -196,8 +201,11 @@ export function prepareCreateSandboxMessaging(
       retainWhileDisabled,
     } of messagingCredentialDefs) {
       const channel = input.getMessagingChannelForEnvKey(envKey);
-      if (!channel || !input.enabledChannels.includes(channel)) continue;
+      if (!channel) continue;
       const channelDisabled = disabledChannelNames.has(channel);
+      if (!input.enabledChannels.includes(channel) && !(channelDisabled && retainWhileDisabled)) {
+        continue;
+      }
       if (channelDisabled && !retainWhileDisabled) continue;
       // Disabled definitions are intentionally absent from messagingTokenDefs,
       // so even a still-readable source token cannot recreate their provider.

test/hermes-discord-credential-binding.test.ts

@@ -25,7 +25,7 @@ function prepareDiscord(
     sandboxName: SANDBOX_NAME,
     agentName: "hermes",
     channels: discord,
-    enabledChannels: ["discord"],
+    enabledChannels: disabled ? [] : ["discord"],
     disabledChannels: disabled ? ["discord"] : [],
     webSearchConfig: null,
     env: token ? { DISCORD_BOT_TOKEN: token } : {},
@@ -66,9 +66,12 @@ describe("Hermes Discord credential endpoint binding", () => {
     expect(profileYaml.endpoints).toEqual([]);
   });
 
-  it("does not reuse an untyped provider for the endpoint-bound credential", () => {
+  it.each([
+    { state: "active", disabled: false },
+    { state: "stopped", disabled: true },
+  ])("does not reuse an untyped provider for a $state channel", ({ disabled }) => {
     const providerMatches = vi.fn(() => false);
-    const result = prepareDiscord(null, providerMatches);
+    const result = prepareDiscord(null, providerMatches, disabled);
 
     expect(result.reusableMessagingProviders).toEqual([]);
     expect(result.reusableMessagingChannels).toEqual([]);