fix(tools): keep dropping falsy impersonation subjects and surface refresh-failure causes

Author: waleedlatif1

apps/sim/lib/oauth/credential-service.ts

@@ -856,6 +856,7 @@ async function performCoalescedRefresh({
             logger.error('Failed to refresh token', {
               ...logContext,
               errorCode: result.errorCode,
+              message: result.message,
             })
             if (result.errorCode && isTerminalRefreshError(result.errorCode)) {
               // A refresh that lost a race with a concurrent connect fails with

apps/sim/tools/index.test.ts

@@ -4519,6 +4519,33 @@ describe('Managed OAuth Credential Delegation', () => {
     expect(mockGenerateInternalDelegationToken).not.toHaveBeenCalled()
     expect(fetchMock).not.toHaveBeenCalled()
   })
+
+  it('drops an empty impersonation subject instead of asserting it', async () => {
+    mockResolveExecutorCredentialToken.mockResolvedValueOnce({ accessToken: 'token-1' })
+    const fetchMock = vi.fn().mockResolvedValueOnce(
+      new Response(JSON.stringify({ messages: [] }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    )
+    global.fetch = Object.assign(fetchMock, { preconnect: vi.fn() }) as typeof fetch
+
+    const context = createToolExecutionContext({
+      userId: 'current-user',
+      workflowId: 'current-workflow',
+      executionId: 'current-execution',
+    })
+
+    await executeTool(
+      'gmail_read',
+      { credential: 'cred-1', impersonateUserEmail: '' },
+      { executionContext: context }
+    )
+
+    expect(mockResolveExecutorCredentialToken).toHaveBeenCalledWith(
+      expect.objectContaining({ credentialId: 'cred-1', impersonateEmail: undefined })
+    )
+  })
 })
 
 describe('Copilot Env Variable Reference Resolution', () => {

apps/sim/tools/index.ts

@@ -1832,7 +1832,9 @@ async function executeToolImplementation(
         const userId = scope.userId
         const credentialId = contextParams.credential as string
         const toolLabel = tool?.name || toolId
-        const impersonateEmail = contextParams.impersonateUserEmail as string | undefined
+        const impersonateEmail = contextParams.impersonateUserEmail
+          ? (contextParams.impersonateUserEmail as string)
+          : undefined
 
         let providerScopes: string[] | undefined
         if (tool?.oauth?.provider) {