fix(credentials): declare service-account oauth policy on Snowflake, NetSuite, and Managed Agent tools

[waleedlatif1]

Summary

• Snowflake, NetSuite, and Managed Agent tools declared no oauth policy, so the fail-closed credential binding check in resolveCredentialToken rejected every saved credential with "The selected credential does not belong to this tool provider" (70 tools)
• Declare oauth: { required: true, provider, credentialKind: 'service-account' } on each via a shared constant, matching the Fivetran pattern; add snowflake, netsuite, claude-platform to OAuthService
• check:tool-param-reachability now fails when a tool with a credential/oauthCredential param has no required oauth policy or its provider matches no service — zero-tolerance invariant rather than a ratchet, since there are no remaining violations
• add-tools template no longer implies the oauth block is OAuth-only; validate-integration checks it

Type of Change

• Bug fix

Testing

• Verified the binding predicate against generated metadata: each tool accepts its own service-account provider and still rejects a foreign one
• Removed one tool's policy and confirmed check:tool-param-reachability fails, passes with it
• vitest: lib/oauth/token-resolution.test.ts, tools/{snowflake,netsuite,managed_agent}, tools/metadata.test.ts (183 passing)
• bun run lint, check:tool-metadata, check:tool-param-reachability, check:comment-hygiene, check:skills, block registry check; full audits/type-check/test via CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 20, 2026 2:48am UTC

[cubic-dev-ai]

No issues found across 78 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issues were found.

Summary

Adds service-account credential policies to 70 Snowflake, NetSuite, and Managed Agent tools.

• Snowflake, NetSuite, and Managed Agent tools match credentials to their own providers.
• The tool reachability check requires credential tools to name a known provider.

No actionable new issues were found in the changes since the last review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Tools[Tool credential policies] --> Metadata[Generated metadata]
  Metadata --> Binding[Runtime credential checks]
  Tools --> Audit[Tool parameter audit]
  Audit --> CI[Required CI audits]

Loading

_{Reviews (2) · Last reviewed commit: "improvement(credentials): enforce creden..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 78 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}