fix(salesforce): carry alternate provider ids through chat connect verification

The chip's live target was widened to match a sandbox credential, but the
post-connect verification leg re-reads the STORED attempt, which did not carry
the ids — so completing a sandbox connect from Chat was detected as a failure
and the chip was marked failed. The attempt now persists them; attempts written
before this simply match as they did, and they expire within 15 minutes.

Also marks the auth-method picker required while it is the field blocking
submit on a reconnect, so the greyed button has a visible cause.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/use-oauth-chip-connection.ts

@@ -479,6 +479,7 @@ export function useOAuthChipConnection({
         workspaceId,
         providerId,
         baseProviderId,
+        additionalProviderIds: credentialTarget.additionalProviderIds,
         displayName,
         controlId,
         credentialId: reconnectCredentialId,

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal.tsx

@@ -139,10 +139,12 @@ export function ClientCredentialAccountModal({
   const visibleFields = mustRestateAuthMethod
     ? visible.filter((field) => !field.requiredForAuthMethods)
     : visible
-  // Markers always reflect the descriptor's real requirements, so `clientId`
-  // and the host don't lose their asterisk while the method is unset. Submit is
-  // gated separately below — picking a method is what unblocks it.
+  // Markers reflect the descriptor's real requirements, so `clientId` and the
+  // host keep their asterisk while the method is unset — plus the picker itself
+  // while it is the thing blocking submit, so the greyed button has a visible
+  // cause.
   const requiredFieldIds = new Set(required.map((field) => field.id))
+  if (mustRestateAuthMethod) requiredFieldIds.add(AUTH_METHOD_FIELD_ID)
   /**
    * On a create the form already behaves as the descriptor's default grant, so
    * the picker shows it rather than an empty placeholder implying no choice.

apps/sim/lib/credentials/oauth-chat-attempt.test.ts

@@ -311,3 +311,32 @@ describe('credential matching for a chat chip', () => {
     ).toBe(false)
   })
 })
+
+describe('attempt carries the alternate provider ids through verification', () => {
+  it('lets hasOAuthCredentialChanged see a credential from an alternate server', () => {
+    // The post-connect leg re-reads the STORED attempt, not the live target, so
+    // the ids must survive the round trip or a sandbox connect reads as failed.
+    const attempt = createOAuthChatAttempt({
+      workspaceId: 'workspace-1',
+      providerId: 'salesforce',
+      baseProviderId: 'salesforce',
+      additionalProviderIds: ['salesforce-sandbox'],
+      displayName: 'Salesforce',
+      controlId: 'control-1',
+      baselineCredentialIds: [],
+    })
+
+    const stored = readOAuthChatAttempt(attempt.id)
+    expect(stored?.additionalProviderIds).toEqual(['salesforce-sandbox'])
+
+    expect(
+      hasOAuthCredentialChanged(stored as NonNullable<typeof stored>, [
+        {
+          id: 'cred-sandbox',
+          providerId: 'salesforce-sandbox',
+          updatedAt: '2026-08-11T00:00:00.000Z',
+        },
+      ])
+    ).toBe(true)
+  })
+})

apps/sim/lib/credentials/oauth-chat-attempt.ts

@@ -43,6 +43,15 @@ export interface OAuthChatAttempt {
   workspaceId: string
   providerId: string
   baseProviderId: string
+  /**
+   * See {@link OAuthCredentialTarget.additionalProviderIds}. Persisted on the
+   * attempt because the post-connect verification leg re-reads the stored
+   * attempt rather than the live target — without it, a credential from an
+   * alternate authorization server would not register as "connected".
+   * Absent on attempts written before this existed; those simply match as they
+   * did, and attempts expire after {@link OAUTH_CHAT_ATTEMPT_MAX_AGE_MS}.
+   */
+  additionalProviderIds?: readonly string[]
   displayName: string
   controlId: string
   credentialId?: string
@@ -56,6 +65,8 @@ interface CreateOAuthChatAttemptInput {
   workspaceId: string
   providerId: string
   baseProviderId: string
+  /** See {@link OAuthCredentialTarget.additionalProviderIds}. */
+  additionalProviderIds?: readonly string[]
   displayName: string
   controlId: string
   credentialId?: string