diff --git a/src/vs/platform/agentHost/test/node/agentService.test.ts b/src/vs/platform/agentHost/test/node/agentService.test.ts
index 71408589a3c..5799bfeb413 100644
--- a/src/vs/platform/agentHost/test/node/agentService.test.ts
+++ b/src/vs/platform/agentHost/test/node/agentService.test.ts
@@ -155,6 +155,54 @@ suite('AgentService (node dispatcher)', () => {
 		});
 	});
 
+	// ---- getResourceMetadata --------------------------------------------
+
+	suite('getResourceMetadata', () => {
+
+		test('aggregates protected resources from all providers', async () => {
+			service.registerProvider(copilotAgent);
+
+			const mockAgent = new MockAgent('other');
+			disposables.add(toDisposable(() => mockAgent.dispose()));
+			service.registerProvider(mockAgent);
+
+			const metadata = await service.getResourceMetadata();
+			// copilot agent returns one resource (https://api.github.com),
+			// generic MockAgent('other') returns empty
+			assert.deepStrictEqual(metadata, {
+				resources: [{ resource: 'https://api.github.com', authorization_servers: ['https://github.com/login/oauth'] }],
+			});
+		});
+
+		test('returns empty resources when no providers registered', async () => {
+			const metadata = await service.getResourceMetadata();
+			assert.deepStrictEqual(metadata, { resources: [] });
+		});
+	});
+
+	// ---- authenticate ---------------------------------------------------
+
+	suite('authenticate', () => {
+
+		test('routes token to provider matching the resource', async () => {
+			service.registerProvider(copilotAgent);
+
+			const result = await service.authenticate({ resource: 'https://api.github.com', token: 'ghp_test123' });
+
+			assert.deepStrictEqual(result, { authenticated: true });
+			assert.deepStrictEqual(copilotAgent.authenticateCalls, [{ resource: 'https://api.github.com', token: 'ghp_test123' }]);
+		});
+
+		test('returns not authenticated for unknown resource', async () => {
+			service.registerProvider(copilotAgent);
+
+			const result = await service.authenticate({ resource: 'https://unknown.example.com', token: 'tok' });
+
+			assert.deepStrictEqual(result, { authenticated: false });
+			assert.strictEqual(copilotAgent.authenticateCalls.length, 0);
+		});
+	});
+
 	// ---- shutdown -------------------------------------------------------
 
 	suite('shutdown', () => {
diff --git a/src/vs/platform/agentHost/test/node/agentSideEffects.test.ts b/src/vs/platform/agentHost/test/node/agentSideEffects.test.ts
index fc1772e5d37..cb1176e7811 100644
--- a/src/vs/platform/agentHost/test/node/agentSideEffects.test.ts
+++ b/src/vs/platform/agentHost/test/node/agentSideEffects.test.ts
@@ -322,4 +322,43 @@ suite('AgentSideEffects', () => {
 			assert.ok(action, 'should dispatch root/agentsChanged');
 		});
 	});
+
+	// ---- handleGetResourceMetadata / handleAuthenticate -----------------
+
+	suite('auth', () => {
+
+		test('handleGetResourceMetadata aggregates resources from agents', () => {
+			agentList.set([agent], undefined);
+
+			const metadata = sideEffects.handleGetResourceMetadata();
+			assert.strictEqual(metadata.resources.length, 0, 'mock agent has no protected resources');
+		});
+
+		test('handleGetResourceMetadata returns resources when agent declares them', () => {
+			const copilotAgent = new MockAgent('copilot');
+			disposables.add(toDisposable(() => copilotAgent.dispose()));
+			agentList.set([copilotAgent], undefined);
+
+			const metadata = sideEffects.handleGetResourceMetadata();
+			assert.strictEqual(metadata.resources.length, 1);
+			assert.strictEqual(metadata.resources[0].resource, 'https://api.github.com');
+		});
+
+		test('handleAuthenticate returns authenticated for matching resource', async () => {
+			const copilotAgent = new MockAgent('copilot');
+			disposables.add(toDisposable(() => copilotAgent.dispose()));
+			agentList.set([copilotAgent], undefined);
+
+			const result = await sideEffects.handleAuthenticate({ resource: 'https://api.github.com', token: 'test-token' });
+			assert.deepStrictEqual(result, { authenticated: true });
+			assert.deepStrictEqual(copilotAgent.authenticateCalls, [{ resource: 'https://api.github.com', token: 'test-token' }]);
+		});
+
+		test('handleAuthenticate returns not authenticated for non-matching resource', async () => {
+			agentList.set([agent], undefined);
+
+			const result = await sideEffects.handleAuthenticate({ resource: 'https://unknown.example.com', token: 'test-token' });
+			assert.deepStrictEqual(result, { authenticated: false });
+		});
+	});
 });