Merge remote-tracking branch 'origin/staging' into feat/workspace-metadata-versioning-patch

# Conflicts:
#	src/agent/heartbeat.rs
#	src/db/libsql_migrations.rs

tests/e2e/CLAUDE.md

@@ -53,6 +53,7 @@ HEADED=1 pytest scenarios/
 | `test_skills.py` | Skills tab UI visibility, ClawHub search (skipped if registry unreachable), install + remove lifecycle |
 | `test_sse_reconnect.py` | SSE reconnects after programmatic `eventSource.close()` + `connectSSE()`; history is reloaded after reconnect |
 | `test_tool_approval.py` | Approval card appears, buttons disable on approve/deny, parameters toggle via `page.evaluate("showApproval(...)")`; the waiting-approval regression uses a real HTTP tool call |
+| `test_extension_uninstall_cleanup.py` | Real install/setup/remove coverage for WASM tools, WASM channels, OAuth-backed shared Google tools, and MCP servers; verifies uninstall deletes stored secrets from the libSQL `secrets` table while preserving shared credentials until the last referencing extension is removed |
 | `test_oauth_refresh.py` | Hosted Gmail OAuth regression: complete setup via `/oauth/callback`, expire the stored access token in libSQL, trigger a real `gmail` tool call through `/api/chat/send`, and verify refresh goes through the mock `/oauth/refresh` proxy without forwarding `client_secret` |
 
 ## `helpers.py`
@@ -77,6 +78,7 @@ All fixtures are defined in `tests/e2e/conftest.py`. Running `pytest scenarios/`
 | `mock_llm_server` | Starts `mock_llm.py --port 0`, reads the assigned port from stdout, waits for `/v1/models` to return 200. Yields the base URL. |
 | `ironclaw_server` | Starts the ironclaw binary with a minimal env (see below), waits for `/api/health` (timeout 60s). Yields the base URL. On teardown sends **SIGINT** (not SIGTERM) so the tokio ctrl_c handler triggers a graceful shutdown and LLVM coverage data is flushed. |
 | `hosted_oauth_refresh_server` | Starts a second ironclaw instance with a dedicated libSQL DB and `GOOGLE_OAUTH_CLIENT_ID=hosted-google-client-id`, while still pointing `IRONCLAW_OAUTH_EXCHANGE_URL` at `mock_llm.py`. Yields a dict with `base_url`, `db_path`, `gateway_user_id`, and `mock_llm_url` for the hosted refresh regression scenario. |
+| `extension_cleanup_server` | Starts an isolated ironclaw instance with its own temp DB/home/WASM dirs, `SECRETS_MASTER_KEY`, and hosted-style OAuth env so uninstall-cleanup scenarios can inspect the `secrets` table without interfering with the shared E2E server state. |
 | `browser` | Launches a single Chromium instance (headless by default; set `HEADED=1` for headed). Shared across all tests. |
 
 ### Function-scoped fixtures

tests/e2e/conftest.py

@@ -271,7 +271,6 @@ async def ironclaw_server(
         "GATEWAY_HOST": "127.0.0.1",
         "GATEWAY_PORT": str(gateway_port),
         "GATEWAY_AUTH_TOKEN": AUTH_TOKEN,
-        "GATEWAY_USER_ID": "e2e-web-sender",
         "HTTP_HOST": "127.0.0.1",
         "HTTP_PORT": str(http_port),
         "HTTP_WEBHOOK_SECRET": HTTP_WEBHOOK_SECRET,
@@ -371,7 +370,6 @@ async def hosted_oauth_refresh_server(
             "GATEWAY_HOST": "127.0.0.1",
             "GATEWAY_PORT": str(gateway_port),
             "GATEWAY_AUTH_TOKEN": AUTH_TOKEN,
-            "GATEWAY_USER_ID": OWNER_SCOPE_ID,
             "HTTP_HOST": "127.0.0.1",
             "HTTP_PORT": str(http_port),
             "HTTP_WEBHOOK_SECRET": HTTP_WEBHOOK_SECRET,
@@ -411,7 +409,6 @@ async def hosted_oauth_refresh_server(
             yield {
                 "base_url": base_url,
                 "db_path": db_path,
-                "gateway_user_id": OWNER_SCOPE_ID,
                 "mock_llm_url": mock_llm_server,
             }
         except TimeoutError:
@@ -446,6 +443,115 @@ async def hosted_oauth_refresh_server(
         home_tmpdir.cleanup()
 
 
+@pytest.fixture(scope="session")
+async def extension_cleanup_server(
+    ironclaw_binary,
+    mock_llm_server,
+):
+    """Start an isolated ironclaw instance for uninstall secret cleanup E2E tests."""
+    reserved = _reserve_loopback_sockets(2)
+    db_tmpdir = tempfile.TemporaryDirectory(prefix="ironclaw-e2e-cleanup-db-")
+    home_tmpdir = tempfile.TemporaryDirectory(prefix="ironclaw-e2e-cleanup-home-")
+    tools_tmpdir = tempfile.TemporaryDirectory(prefix="ironclaw-e2e-cleanup-tools-")
+    channels_tmpdir = tempfile.TemporaryDirectory(prefix="ironclaw-e2e-cleanup-channels-")
+
+    try:
+        gateway_port = reserved[0].getsockname()[1]
+        http_port = reserved[1].getsockname()[1]
+        for sock in reserved:
+            if sock.fileno() != -1:
+                sock.close()
+
+        db_path = os.path.join(db_tmpdir.name, "extension-cleanup.db")
+        home_dir = home_tmpdir.name
+        env = {
+            "PATH": os.environ.get("PATH", "/usr/bin:/bin"),
+            "HOME": home_dir,
+            "IRONCLAW_BASE_DIR": os.path.join(home_dir, ".ironclaw"),
+            "RUST_LOG": "ironclaw=info",
+            "RUST_BACKTRACE": "1",
+            "IRONCLAW_OWNER_ID": OWNER_SCOPE_ID,
+            "GATEWAY_ENABLED": "true",
+            "GATEWAY_HOST": "127.0.0.1",
+            "GATEWAY_PORT": str(gateway_port),
+            "GATEWAY_AUTH_TOKEN": AUTH_TOKEN,
+            "GATEWAY_USER_ID": OWNER_SCOPE_ID,
+            "HTTP_HOST": "127.0.0.1",
+            "HTTP_PORT": str(http_port),
+            "HTTP_WEBHOOK_SECRET": HTTP_WEBHOOK_SECRET,
+            "CLI_ENABLED": "false",
+            "LLM_BACKEND": "openai_compatible",
+            "LLM_BASE_URL": mock_llm_server,
+            "LLM_MODEL": "mock-model",
+            "DATABASE_BACKEND": "libsql",
+            "LIBSQL_PATH": db_path,
+            "SECRETS_MASTER_KEY": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+            "SANDBOX_ENABLED": "false",
+            "SKILLS_ENABLED": "true",
+            "ROUTINES_ENABLED": "true",
+            "HEARTBEAT_ENABLED": "false",
+            "EMBEDDING_ENABLED": "false",
+            "WASM_ENABLED": "true",
+            "WASM_TOOLS_DIR": tools_tmpdir.name,
+            "WASM_CHANNELS_DIR": channels_tmpdir.name,
+            "ONBOARD_COMPLETED": "true",
+            "IRONCLAW_OAUTH_CALLBACK_URL": "https://oauth.test.example/oauth/callback",
+            "IRONCLAW_OAUTH_EXCHANGE_URL": mock_llm_server,
+            "GOOGLE_OAUTH_CLIENT_ID": "hosted-google-client-id",
+        }
+        _forward_coverage_env(env)
+
+        proc = await asyncio.create_subprocess_exec(
+            ironclaw_binary, "--no-onboard",
+            stdin=asyncio.subprocess.DEVNULL,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            env=env,
+        )
+        startup_kill_attempted = False
+        base_url = f"http://127.0.0.1:{gateway_port}"
+        try:
+            await wait_for_ready(f"{base_url}/api/health", timeout=60)
+            yield {
+                "base_url": base_url,
+                "db_path": db_path,
+                "gateway_user_id": OWNER_SCOPE_ID,
+                "mock_llm_url": mock_llm_server,
+            }
+        except TimeoutError:
+            if proc.returncode is None:
+                startup_kill_attempted = True
+                await _stop_process(proc, timeout=2)
+            returncode = proc.returncode
+            stderr_bytes = b""
+            if proc.stderr:
+                try:
+                    stderr_bytes = await asyncio.wait_for(proc.stderr.read(8192), timeout=2)
+                except asyncio.TimeoutError:
+                    pass
+            stderr_text = stderr_bytes.decode("utf-8", errors="replace")
+            pytest.fail(
+                f"extension cleanup server failed to start on port {gateway_port} "
+                f"(returncode={returncode}).\nstderr:\n{stderr_text}"
+            )
+        finally:
+            if proc.returncode is None:
+                if startup_kill_attempted:
+                    await _stop_process(proc, timeout=2)
+                else:
+                    await _stop_process(proc, sig=signal.SIGINT, timeout=10)
+                    if proc.returncode is None:
+                        await _stop_process(proc, timeout=2)
+    finally:
+        for sock in reserved:
+            if sock.fileno() != -1:
+                sock.close()
+        db_tmpdir.cleanup()
+        home_tmpdir.cleanup()
+        tools_tmpdir.cleanup()
+        channels_tmpdir.cleanup()
+
+
 @pytest.fixture(scope="session")
 async def http_channel_server(ironclaw_server, server_ports):
     """HTTP webhook channel base URL."""
@@ -473,7 +579,6 @@ async def http_channel_server_without_secret(
         "GATEWAY_HOST": "127.0.0.1",
         "GATEWAY_PORT": str(gateway_port),
         "GATEWAY_AUTH_TOKEN": AUTH_TOKEN,
-        "GATEWAY_USER_ID": "e2e-tester",
         "HTTP_HOST": "127.0.0.1",
         "HTTP_PORT": str(http_port),
         "CLI_ENABLED": "false",

tests/e2e/scenarios/test_extension_uninstall_cleanup.py

@@ -0,0 +1,266 @@
+"""Extension uninstall secret cleanup E2E tests.
+
+Exercises real install/setup/auth/remove flows and verifies the backing
+secrets table is cleaned up when extensions are uninstalled.
+"""
+
+import sqlite3
+from urllib.parse import parse_qs, urlparse
+
+import httpx
+
+from helpers import api_get, api_post
+
+
+def _extract_state(auth_url: str) -> str:
+    parsed = urlparse(auth_url)
+    state = parse_qs(parsed.query).get("state", [None])[0]
+    assert state, f"auth_url should include state: {auth_url}"
+    return state
+
+
+def _secret_exists(db_path: str, user_id: str, name: str) -> bool:
+    with sqlite3.connect(db_path) as conn:
+        row = conn.execute(
+            "SELECT 1 FROM secrets WHERE user_id = ?1 AND name = ?2 LIMIT 1",
+            (user_id, name),
+        ).fetchone()
+    return row is not None
+
+
+def _secret_names(db_path: str, user_id: str) -> set[str]:
+    with sqlite3.connect(db_path) as conn:
+        rows = conn.execute(
+            "SELECT name FROM secrets WHERE user_id = ?1",
+            (user_id,),
+        ).fetchall()
+    return {row[0] for row in rows}
+
+
+async def _get_extension(base_url: str, name: str) -> dict | None:
+    response = await api_get(base_url, "/api/extensions", timeout=15)
+    response.raise_for_status()
+    for extension in response.json().get("extensions", []):
+        if extension["name"] == name:
+            return extension
+    return None
+
+
+async def _ensure_removed(base_url: str, name: str) -> None:
+    extension = await _get_extension(base_url, name)
+    if extension is not None:
+        response = await api_post(base_url, f"/api/extensions/{name}/remove", timeout=30)
+        assert response.status_code == 200, response.text
+        assert response.json().get("success") is True, response.text
+
+
+async def _install_extension(
+    base_url: str,
+    name: str,
+    *,
+    kind: str | None = None,
+    url: str | None = None,
+) -> None:
+    payload = {"name": name}
+    if kind is not None:
+        payload["kind"] = kind
+    if url is not None:
+        payload["url"] = url
+
+    response = await api_post(
+        base_url,
+        "/api/extensions/install",
+        json=payload,
+        timeout=180,
+    )
+    assert response.status_code == 200, response.text
+    assert response.json().get("success") is True, response.text
+
+
+async def test_remove_wasm_tool_deletes_unique_secret(extension_cleanup_server):
+    server = extension_cleanup_server["base_url"]
+    db_path = extension_cleanup_server["db_path"]
+    user_id = extension_cleanup_server["gateway_user_id"]
+
+    await _ensure_removed(server, "web-search")
+
+    await _install_extension(server, "web-search")
+
+    setup_response = await api_post(
+        server,
+        "/api/extensions/web-search/setup",
+        json={"secrets": {"brave_api_key": "cleanup-test-key"}},
+        timeout=30,
+    )
+    assert setup_response.status_code == 200, setup_response.text
+    assert setup_response.json().get("success") is True, setup_response.text
+    assert _secret_exists(db_path, user_id, "brave_api_key")
+
+    remove_response = await api_post(
+        server,
+        "/api/extensions/web-search/remove",
+        timeout=30,
+    )
+    assert remove_response.status_code == 200, remove_response.text
+    assert remove_response.json().get("success") is True, remove_response.text
+    assert not _secret_exists(db_path, user_id, "brave_api_key")
+
+
+async def test_remove_wasm_channel_deletes_setup_secrets(extension_cleanup_server):
+    server = extension_cleanup_server["base_url"]
+    db_path = extension_cleanup_server["db_path"]
+    user_id = extension_cleanup_server["gateway_user_id"]
+
+    await _ensure_removed(server, "discord")
+
+    await _install_extension(server, "discord", kind="wasm_channel")
+
+    setup_response = await api_post(
+        server,
+        "/api/extensions/discord/setup",
+        json={
+            "secrets": {
+                "discord_bot_token": "cleanup-discord-bot-token",
+                "discord_public_key": "cleanup-discord-public-key",
+            }
+        },
+        timeout=30,
+    )
+    assert setup_response.status_code == 200, setup_response.text
+    assert setup_response.json().get("success") is True, setup_response.text
+    assert _secret_exists(db_path, user_id, "discord_bot_token")
+    assert _secret_exists(db_path, user_id, "discord_public_key")
+
+    remove_response = await api_post(
+        server,
+        "/api/extensions/discord/remove",
+        timeout=30,
+    )
+    assert remove_response.status_code == 200, remove_response.text
+    assert remove_response.json().get("success") is True, remove_response.text
+    assert not _secret_exists(db_path, user_id, "discord_bot_token")
+    assert not _secret_exists(db_path, user_id, "discord_public_key")
+
+
+async def test_remove_shared_google_oauth_secrets_after_last_tool(extension_cleanup_server):
+    server = extension_cleanup_server["base_url"]
+    db_path = extension_cleanup_server["db_path"]
+    user_id = extension_cleanup_server["gateway_user_id"]
+
+    await _ensure_removed(server, "gmail")
+    await _ensure_removed(server, "google-drive")
+
+    await _install_extension(server, "gmail")
+    await _install_extension(server, "google-drive")
+
+    setup_response = await api_post(
+        server,
+        "/api/extensions/gmail/setup",
+        json={"secrets": {}},
+        timeout=30,
+    )
+    assert setup_response.status_code == 200, setup_response.text
+    auth_url = setup_response.json().get("auth_url")
+    assert auth_url, setup_response.text
+
+    async with httpx.AsyncClient() as client:
+        callback_response = await client.get(
+            f"{server}/oauth/callback",
+            params={"code": "mock_auth_code", "state": _extract_state(auth_url)},
+            timeout=30,
+            follow_redirects=True,
+        )
+    assert callback_response.status_code == 200, callback_response.text[:400]
+
+    shared_secrets = [
+        "google_oauth_token",
+        "google_oauth_token_refresh_token",
+        "google_oauth_token_scopes",
+    ]
+    for secret_name in shared_secrets:
+        assert _secret_exists(db_path, user_id, secret_name), f"expected {secret_name} to exist"
+
+    gmail_remove_response = await api_post(
+        server,
+        "/api/extensions/gmail/remove",
+        timeout=30,
+    )
+    assert gmail_remove_response.status_code == 200, gmail_remove_response.text
+    assert gmail_remove_response.json().get("success") is True, gmail_remove_response.text
+    for secret_name in shared_secrets:
+        assert _secret_exists(db_path, user_id, secret_name), (
+            f"{secret_name} should remain while google-drive is still installed"
+        )
+
+    drive_remove_response = await api_post(
+        server,
+        "/api/extensions/google-drive/remove",
+        timeout=30,
+    )
+    assert drive_remove_response.status_code == 200, drive_remove_response.text
+    assert drive_remove_response.json().get("success") is True, drive_remove_response.text
+    for secret_name in shared_secrets:
+        assert not _secret_exists(db_path, user_id, secret_name), (
+            f"{secret_name} should be deleted after the last Google tool is removed"
+        )
+
+
+async def test_remove_mcp_server_deletes_stored_secrets(extension_cleanup_server):
+    server = extension_cleanup_server["base_url"]
+    db_path = extension_cleanup_server["db_path"]
+    user_id = extension_cleanup_server["gateway_user_id"]
+    mcp_url = f"{extension_cleanup_server['mock_llm_url']}/mcp"
+
+    await _ensure_removed(server, "mock-mcp")
+
+    await _install_extension(server, "mock-mcp", kind="mcp_server", url=mcp_url)
+
+    setup_response = await api_post(
+        server,
+        "/api/extensions/mock-mcp/setup",
+        json={"secrets": {}},
+        timeout=30,
+    )
+    assert setup_response.status_code == 200, setup_response.text
+    auth_url = setup_response.json().get("auth_url")
+    if auth_url is None:
+        activate_response = await api_post(
+            server,
+            "/api/extensions/mock-mcp/activate",
+            timeout=30,
+        )
+        assert activate_response.status_code == 200, activate_response.text
+        auth_url = activate_response.json().get("auth_url")
+    assert auth_url, "mock-mcp should require OAuth in E2E"
+
+    async with httpx.AsyncClient() as client:
+        callback_response = await client.get(
+            f"{server}/oauth/callback",
+            params={"code": "mock_mcp_code", "state": _extract_state(auth_url)},
+            timeout=30,
+            follow_redirects=True,
+        )
+    assert callback_response.status_code == 200, callback_response.text[:400]
+
+    expected_mcp_secrets = [
+        "mcp_mock-mcp_access_token",
+        "mcp_mock-mcp_client_id",
+    ]
+    stored_secret_names = _secret_names(db_path, user_id)
+    for secret_name in expected_mcp_secrets:
+        assert secret_name in stored_secret_names, (
+            f"expected {secret_name} to exist; stored secrets were {sorted(stored_secret_names)}"
+        )
+
+    remove_response = await api_post(
+        server,
+        "/api/extensions/mock-mcp/remove",
+        timeout=30,
+    )
+    assert remove_response.status_code == 200, remove_response.text
+    assert remove_response.json().get("success") is True, remove_response.text
+    remaining_secret_names = _secret_names(db_path, user_id)
+    assert not any(name.startswith("mcp_mock-mcp_") for name in remaining_secret_names), (
+        f"mock-mcp secrets should be deleted on remove; remaining secrets were "
+        f"{sorted(remaining_secret_names)}"
+    )

tests/multi_tenant_integration.rs

@@ -42,8 +42,6 @@ const ALICE_USER_ID: &str = "alice";
 const BOB_USER_ID: &str = "bob";
 const OWNER_TOKEN: &str = "tok-owner-secret";
 const OWNER_SCOPE_ID: &str = "owner-scope";
-const GATEWAY_SENDER_ID: &str = "gateway-sender";
-
 /// Build a MultiAuthState with two users.
 fn two_user_auth() -> MultiAuthState {
     let mut tokens = HashMap::new();
@@ -51,6 +49,7 @@ fn two_user_auth() -> MultiAuthState {
         ALICE_TOKEN.to_string(),
         UserIdentity {
             user_id: ALICE_USER_ID.to_string(),
+            role: "admin".to_string(),
             workspace_read_scopes: Vec::new(),
         },
     );
@@ -58,6 +57,7 @@ fn two_user_auth() -> MultiAuthState {
         BOB_TOKEN.to_string(),
         UserIdentity {
             user_id: BOB_USER_ID.to_string(),
+            role: "admin".to_string(),
             workspace_read_scopes: vec!["shared".to_string()],
         },
     );
@@ -79,7 +79,10 @@ fn user_echo_app(auth: MultiAuthState) -> Router {
         .route("/api/whoami/scopes", get(echo_user_with_scopes))
         .route("/api/action", post(echo_user))
         .route("/api/chat/events", get(echo_user)) // SSE endpoint (allows query token)
-        .layer(middleware::from_fn_with_state(auth, auth_middleware))
+        .layer(middleware::from_fn_with_state(
+            ironclaw::channels::web::auth::CombinedAuthState::from(auth),
+            auth_middleware,
+        ))
 }
 
 // ===========================================================================
@@ -544,7 +547,6 @@ fn gateway_state_has_multi_tenant_fields() {
         prompt_queue: None,
         scheduler: None,
         owner_id: "fallback".to_string(),
-        default_sender_id: "fallback".to_string(),
         shutdown_tx: tokio::sync::RwLock::new(None),
         ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
         llm_provider: None,
@@ -558,10 +560,11 @@ fn gateway_state_has_multi_tenant_fields() {
         startup_time: std::time::Instant::now(),
         webhook_rate_limiter: RateLimiter::new(10, 60),
         active_config: Default::default(),
+        secrets_store: None,
+        db_auth: None,
     };
 
     assert_eq!(state.owner_id, "fallback");
-    assert_eq!(state.default_sender_id, "fallback");
     assert!(state.workspace_pool.is_none());
 }
 
@@ -592,6 +595,7 @@ async fn start_owner_scoped_sender_server() -> (
         OWNER_TOKEN.to_string(),
         UserIdentity {
             user_id: OWNER_SCOPE_ID.to_string(),
+            role: "admin".to_string(),
             workspace_read_scopes: Vec::new(),
         },
     );
@@ -599,6 +603,7 @@ async fn start_owner_scoped_sender_server() -> (
         BOB_TOKEN.to_string(),
         UserIdentity {
             user_id: BOB_USER_ID.to_string(),
+            role: "member".to_string(),
             workspace_read_scopes: Vec::new(),
         },
     );
@@ -618,7 +623,6 @@ async fn start_owner_scoped_sender_server() -> (
         prompt_queue: None,
         scheduler: None,
         owner_id: OWNER_SCOPE_ID.to_string(),
-        default_sender_id: GATEWAY_SENDER_ID.to_string(),
         shutdown_tx: tokio::sync::RwLock::new(None),
         ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
         llm_provider: None,
@@ -632,9 +636,11 @@ async fn start_owner_scoped_sender_server() -> (
         routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
         startup_time: std::time::Instant::now(),
         active_config: Default::default(),
+        secrets_store: None,
+        db_auth: None,
     });
 
-    let auth = MultiAuthState::multi(tokens);
+    let auth = MultiAuthState::multi(tokens).into();
     let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
     let bound = start_server(addr, state.clone(), auth)
         .await
@@ -769,7 +775,7 @@ async fn full_server_chat_send_rewrites_sender_only_for_owner_scope_rebind() {
         .expect("Timed out waiting for owner message")
         .expect("Agent channel closed");
     assert_eq!(owner_msg.user_id, OWNER_SCOPE_ID);
-    assert_eq!(owner_msg.sender_id, GATEWAY_SENDER_ID);
+    assert_eq!(owner_msg.sender_id, OWNER_SCOPE_ID);
     assert_eq!(owner_msg.content, "hello from owner");
 
     let other_resp = client
@@ -1003,7 +1009,6 @@ async fn start_multi_user_server_with_db() -> (
         prompt_queue: None,
         scheduler: None,
         owner_id: ALICE_USER_ID.to_string(),
-        default_sender_id: ALICE_USER_ID.to_string(),
         shutdown_tx: tokio::sync::RwLock::new(None),
         ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
         llm_provider: None,
@@ -1017,10 +1022,12 @@ async fn start_multi_user_server_with_db() -> (
         startup_time: std::time::Instant::now(),
         webhook_rate_limiter: RateLimiter::new(10, 60),
         active_config: Default::default(),
+        secrets_store: None,
+        db_auth: None,
     });
 
     let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
-    let bound = ironclaw::channels::web::server::start_server(addr, state.clone(), auth)
+    let bound = ironclaw::channels::web::server::start_server(addr, state.clone(), auth.into())
         .await
         .expect("Failed to start server with DB");
 

tests/openai_compat_integration.rs

@@ -205,7 +205,6 @@ async fn start_test_server_with_provider(
         prompt_queue: None,
         scheduler: None,
         owner_id: "test-user".to_string(),
-        default_sender_id: "test-user".to_string(),
         shutdown_tx: tokio::sync::RwLock::new(None),
         ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
         llm_provider: Some(llm_provider),
@@ -219,6 +218,8 @@ async fn start_test_server_with_provider(
         routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
         startup_time: std::time::Instant::now(),
         active_config: ironclaw::channels::web::server::ActiveConfigSnapshot::default(),
+        secrets_store: None,
+        db_auth: None,
     });
 
     let auth = ironclaw::channels::web::auth::MultiAuthState::single(
@@ -226,7 +227,7 @@ async fn start_test_server_with_provider(
         "test-user".to_string(),
     );
     let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
-    let bound_addr = start_server(addr, state.clone(), auth)
+    let bound_addr = start_server(addr, state.clone(), auth.into())
         .await
         .expect("Failed to start test server");
 
@@ -704,7 +705,6 @@ async fn test_no_llm_provider_returns_503() {
         prompt_queue: None,
         scheduler: None,
         owner_id: "test-user".to_string(),
-        default_sender_id: "test-user".to_string(),
         shutdown_tx: tokio::sync::RwLock::new(None),
         ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
         llm_provider: None, // No LLM!
@@ -718,6 +718,8 @@ async fn test_no_llm_provider_returns_503() {
         routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
         startup_time: std::time::Instant::now(),
         active_config: ironclaw::channels::web::server::ActiveConfigSnapshot::default(),
+        secrets_store: None,
+        db_auth: None,
     });
 
     let auth = ironclaw::channels::web::auth::MultiAuthState::single(
@@ -725,7 +727,7 @@ async fn test_no_llm_provider_returns_503() {
         "test-user".to_string(),
     );
     let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
-    let bound_addr = start_server(addr, state, auth).await.unwrap();
+    let bound_addr = start_server(addr, state, auth.into()).await.unwrap();
 
     let url = format!("http://{}/v1/chat/completions", bound_addr);
     let resp = client()
@@ -763,7 +765,7 @@ async fn test_chat_completions_body_too_large() {
             post(ironclaw::channels::web::openai_compat::chat_completions_handler),
         )
         .route_layer(middleware::from_fn_with_state(
-            auth_state,
+            ironclaw::channels::web::auth::CombinedAuthState::from(auth_state),
             ironclaw::channels::web::auth::auth_middleware,
         ))
         .layer(DefaultBodyLimit::max(10 * 1024 * 1024))

tests/support/gateway_workflow_harness.rs

@@ -227,7 +227,6 @@ impl GatewayWorkflowHarness {
             prompt_queue: None,
             scheduler: Some(scheduler_slot.clone()),
             owner_id: user_id.clone(),
-            default_sender_id: user_id.clone(),
             shutdown_tx: tokio::sync::RwLock::new(None),
             ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
             llm_provider: Some(Arc::clone(&components.llm)),
@@ -241,6 +240,8 @@ impl GatewayWorkflowHarness {
             routine_engine: Arc::clone(&routine_slot),
             startup_time: Instant::now(),
             active_config: ironclaw::channels::web::server::ActiveConfigSnapshot::default(),
+            secrets_store: None,
+            db_auth: None,
         });
 
         let mut agent = Agent::new(
@@ -299,7 +300,7 @@ impl GatewayWorkflowHarness {
         let addr = start_server(
             "127.0.0.1:0".parse().expect("valid localhost addr"),
             Arc::clone(&gateway_state),
-            auth,
+            auth.into(),
         )
         .await
         .expect("failed to start gateway server");

tests/ws_gateway_integration.rs

@@ -52,7 +52,6 @@ async fn start_test_server() -> (
         prompt_queue: None,
         scheduler: None,
         owner_id: "test-user".to_string(),
-        default_sender_id: "test-user".to_string(),
         shutdown_tx: tokio::sync::RwLock::new(None),
         ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
         llm_provider: None,
@@ -66,6 +65,8 @@ async fn start_test_server() -> (
         routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
         startup_time: std::time::Instant::now(),
         active_config: ironclaw::channels::web::server::ActiveConfigSnapshot::default(),
+        secrets_store: None,
+        db_auth: None,
     });
 
     let auth = ironclaw::channels::web::auth::MultiAuthState::single(
@@ -73,7 +74,7 @@ async fn start_test_server() -> (
         "test-user".to_string(),
     );
     let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
-    let bound_addr = start_server(addr, state.clone(), auth)
+    let bound_addr = start_server(addr, state.clone(), auth.into())
         .await
         .expect("Failed to start test server");