| 1 | // Secrets never cross the agent boundary: a confidential OAuth app is registered |
| 2 | // through a BROWSER handoff, not by passing the client secret as a tool argument. |
| 3 | // |
| 4 | // This is the regression guard for the secret-leak fix. The agent-facing |
nothing calls this directly
no test coverage detected