fix(backend): hold every expert credential path to the grant list

[Pwuts]

Changes 🏗️

Makes #14415 correct and green on its own head. The stack merges bottom-up, so dev will hold this PR's state as a real commit; three of the fixes it needs currently live only on abhi/expert-grant-card at the top of the stack, and one test it needs to pass is fixed there too.

The approved continuation of a reviewed block resolved credentials against the whole account. continue_run_block called resolve_block_credentials without the expert, so a block held to one granted account at run_block time could execute with a different one after approval, and a grant revoked between the review and the approval had no effect. It now passes session.expert_id, like every other block path.

An unseeded expert could widen its own grants by installing a workflow. The allow-list is seeded from the expert's installed workflows the first time it is read; an expert whose list was not yet stamped could install a library workflow and have that workflow's credentials derived into its own grants on the next read. install_expert_workflow and the auto-install of an agent the expert just built now settle the seed first, and grant_expert_credential / revoke_expert_credential refuse an expert session outright rather than relying on the tool-group gate alone.

Three guards had no test that fails when they are removed — the point of the whole ownership boundary is that a prohibition is only real if something breaks when it goes:

• scope_credentials_to_expert, the single filter behind block runs, MCP tools and webhook setup. Removing it entirely left every suite green; the test that appeared to cover it patched the matcher out and asserted only that the expert id was forwarded. The new tests run two account credentials for the same host through resolve_block_credentials and assert the ungranted one is neither matched nor silently preferred.
• The MCP grant check. No test anywhere failed when an expert was allowed to use an ungranted MCP credential.
• handoff_to_expert_test::TestExpertToolGate::test_flag_off_disables_every_team_group asserts the old disabled-group list, so this PR is red on test (3.11), (3.12) and (3.13) on its own head. The one-line assertion fix is moved down from c0fc8ff82e.

Moved rather than rewritten. The continue_run_block fix, the settle-before-install fix and the test-assertion fix already exist on abhi/expert-grant-card (03168cca3e, f235c7757c, c0fc8ff82e); the code here is those hunks verbatim, so the version that lands is the one already written and reviewed rather than a third variant. The rest of 03168cca3e — picker credentials (_credentials_id) on acquire_auto_credentials, the MCP and validation-error card annotations — is left where it is: it is 460 lines across 17 files and moving it down would be a larger change than the gap it closes on this head.

Verified

I ran copilot/tools/ — expert_scope_test, expert_resources_test, utils_test, test_run_mcp_tool, run_mcp_tool_test, continue_run_block_test, handoff_to_expert_test, http_credentials_test, block_display_test, helpers_test, list_team_test — plus api/features/experts/credentials_test.py, util/architecture_test.py and blocks/test/test_block.py.

Every guard was mutated back out and the right test failed each time; the mutation table is in a comment below. credentials_test.py's DB-backed neighbours and the frontend suites were not run here.

Checklist 📋

For code changes:

• I have clearly listed my changes in the PR description
• I have made a test plan
• I have tested my changes according to the test plan

Agents and large language models used

• Claude Code — Claude Opus 5

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• dev

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ed00a5ad-3058-4f44-91df-4cba6437df03

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Pwuts]

🤖 Mutation evidence

Every guard in this PR was broken one at a time and the test that should catch it was run. Each mutation asserted exactly one textual match before applying, and the tree was restored from a saved copy afterwards.

mutation	suite run	result
continue_run_block.py drops session.expert_id from resolve_block_credentials	continue_run_block_test.py	1 failed, 5 passed — test_continuation_resolves_credentials_under_the_experts_grants
settle_expert_grants call removed from install_expert_workflow	expert_resources_test.py	1 failed, 18 passed — test_expert_install_settles_its_grants_before_the_workflow_lands
settle_expert_grants call removed from install_saved_agent	expert_scope_test.py	1 failed, 12 passed — test_agent_built_by_expert_settles_grants_before_install
the expert refusal removed from _change_grant	expert_resources_test.py	1 failed, 18 passed — test_expert_cannot_grant_itself
settle_credential_seed stops calling _stamp_seeded	credentials_test.py	1 failed, 11 passed — test_settling_the_seed_stamps_even_when_derivation_was_incomplete
scope_credentials_to_expert returns everything	utils_test.py + both MCP suites	2 failed, 49 passed — the two new utils_test cases. Before this PR the same mutation left all of them green.
the MCP grant check never fires (if False:)	test_run_mcp_tool.py + run_mcp_tool_test.py	1 failed, 47 passed — test_an_ungranted_mcp_credential_is_refused_for_an_expert. Before this PR: 11 passed, nothing failed.

Suites executed

expert_scope_test, expert_resources_test, utils_test, test_run_mcp_tool,
run_mcp_tool_test, continue_run_block_test, handoff_to_expert_test,
list_team_test, credentials_test, architecture_test    157 passed
helpers_test                                            59 passed
block_display_test                                      15 passed
http_credentials_test                                   run separately
blocks/test/test_block.py                             1647 passed, 84 skipped

Before this PR, handoff_to_expert_test::TestExpertToolGate::test_flag_off_disables_every_team_group failed on this branch's own head (1 failed, 44 passed); it now passes.

Not run here: the DB-backed neighbours of credentials_test.py, which need the app stack, and the frontend suites.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.28%. Comparing base (1069c81) to head (3086eed).

Additional details and impacted files

@@                           Coverage Diff                           @@
##           abhi/expert-workflow-credential-scope   #14443    +/-   ##
=======================================================================
  Coverage                                  81.28%   81.28%            
=======================================================================
  Files                                       3507     3507            
  Lines                                     262838   262942   +104     
  Branches                                   24370    24373     +3     
=======================================================================
+ Hits                                      213641   213744   +103     
- Misses                                     43783    43792     +9     
+ Partials                                    5414     5406     -8     

Flag	Coverage Δ
platform-backend	86.29% <100.00%> (+0.01%)	⬆️
platform-frontend-e2e	28.46% <ø> (-0.30%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Platform Backend	86.29% <100.00%> (+0.01%)	⬆️
Platform Frontend	62.63% <ø> (-0.03%)	⬇️
AutoGPT Libs	∅ <ø> (∅)
Classic AutoGPT	28.43% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.