@geraldmaron/construct 1.4.1 → 1.5.0

package/lib/intake/queue-registry.mjs

@@ -0,0 +1,50 @@
+/**
+ * lib/intake/queue-registry.mjs — kind:'queue' provider resolution.
+ *
+ * Substrate owns the queue/run-store CONTRACT; git-queue is the zero-dependency
+ * DEFAULT provider and Postgres is an OPTIONAL provider. Selection is explicit:
+ * a concrete queue backend is chosen by resolving an installed kind:'queue'
+ * manifest through the extension registry (construct-9oi4.7.11, supersedes the
+ * ADR-0051 git-vs-postgres framing). No silent postgres->git alias exists — a
+ * caller that names a backend with no registered kind:'queue' provider gets a
+ * typed error, not a swallowed downgrade.
+ *
+ * Resolution surface:
+ *   listQueueProviders({ rootDir, env }) → manifest[] of kind:'queue', merged
+ *     across builtin/user/project tiers (project wins).
+ *   findQueueProvider(backend, { rootDir, env }) → manifest | null for a backend id.
+ */
+
+import { loadManifestsFromDir, mergeManifests, resolveManifestDirs } from '../extensions/loader.mjs';
+
+/**
+ * The queue backend ids that are always resolvable without a registered
+ * manifest. git is the default provider; filesystem is the solo-mode default
+ * provider. Both ship in-tree, so they never require an extension manifest.
+ */
+export const BUILTIN_QUEUE_BACKENDS = ['git', 'filesystem'];
+
+// Load every kind:'queue' manifest across the three tiers and merge by id so a
+// project- or user-level Postgres queue provider overrides a builtin of the
+// same id. Only manifests declaring kind:'queue' are returned.
+
+export function listQueueProviders({ rootDir = process.cwd(), env = process.env } = {}) {
+  const homeDir = env?.HOME || env?.USERPROFILE || undefined;
+  const dirs = resolveManifestDirs({ rootDir, homeDir });
+  const builtin = loadManifestsFromDir(dirs.builtin).manifests;
+  const user = loadManifestsFromDir(dirs.user).manifests;
+  const project = loadManifestsFromDir(dirs.project).manifests;
+  return mergeManifests(builtin, user, project).filter((m) => m.kind === 'queue');
+}
+
+/**
+ * findQueueProvider(backend, opts)
+ *
+ * Returns the kind:'queue' manifest whose id matches `backend`, or null when no
+ * such provider is registered. Callers use the null result to distinguish an
+ * unregistered backend (a hard, explicit error) from a resolvable one.
+ */
+export function findQueueProvider(backend, { rootDir = process.cwd(), env = process.env } = {}) {
+  if (!backend) return null;
+  return listQueueProviders({ rootDir, env }).find((m) => m.id === backend) || null;
+}

package/lib/intake/queue.mjs

@@ -3,14 +3,20 @@
  *
  * The IntakeQueue contract carries the R&D intake packets from the embed
  * daemon (writer) to the agent in the user's editor (reader/processor).
- * Solo mode is backed by the filesystem under `.cx/intake/`; team and
- * enterprise modes are backed by Postgres with row-locked worker claims.
- * Callers never branch on backend — they ask for a queue via
- * `createIntakeQueue(rootDir, env)` and use the same six methods.
+ * Substrate owns the queue CONTRACT; git-queue is the zero-dependency default
+ * kind:'queue' provider and Postgres is an optional kind:'queue' provider
+ * selected through the extension registry (construct-9oi4.7.11). Solo mode
+ * resolves to the filesystem provider under `.cx/intake/`; team and enterprise
+ * default to the Postgres provider. Callers never branch on backend — they ask for a
+ * queue via `createIntakeQueue(rootDir, env)` and use the same six methods.
+ * The returned instance also carries `.tenantId` (ADR-0057/A7: resolved once
+ * from CONSTRUCT_TENANT_ID/config, 'local' default outside enterprise mode)
+ * so a caller can stamp it onto entries without re-resolving it.
  *
  * Queue entry shape:
  *   {
  *     id, createdAt, status: 'pending'|'processed'|'skipped',
+ *     tenantId?,
  *     intake: { sourcePath, outputPath, characters, knowledgeSubdir },
  *     triage: { intakeType, rdStage, primaryOwner, recommendedChain,
  *               recommendedAction, risk, requiresApproval, confidence,
@@ -37,19 +43,60 @@ import path from 'node:path';
 
 import { FilesystemIntakeQueue, queueRoot, pendingDir, processedDir, skippedDir } from './filesystem-queue.mjs';
 import { GitIntakeQueue } from './git-queue.mjs';
-import { getDeploymentMode } from '../deployment-mode.mjs';
+import {
+  getDeploymentMode,
+  requireTeamCapabilityOrDegrade,
+} from '../deployment-mode.mjs';
+import { createSqlClient } from '../storage/backend.mjs';
+import { findQueueProvider, BUILTIN_QUEUE_BACKENDS } from './queue-registry.mjs';
+import { resolveTenantContext, TENANT_ID_ENV_KEY, DEFAULT_TENANT_ID } from '../tenant/context.mjs';
+import { PostgresIntakeQueue } from '../queue/pg-queue.mjs';
 
 export { FilesystemIntakeQueue, GitIntakeQueue, queueRoot, pendingDir, processedDir, skippedDir };
 
 export const INTAKE_QUEUE_BACKEND_ENV_KEY = 'CONSTRUCT_INTAKE_QUEUE_BACKEND';
 export const INTAKE_PROJECT_ENV_KEY = 'CONSTRUCT_PROJECT_NAME';
 export const INTAKE_TENANT_ENV_KEY = 'CONSTRUCT_TENANT_ID';
+export const INTAKE_QUEUE_NAME_ENV_KEY = 'CONSTRUCT_INTAKE_QUEUE_NAME';
+export const INTAKE_QUEUE_LEASE_SECONDS_ENV_KEY = 'CONSTRUCT_QUEUE_LEASE_SECONDS';
 
-function resolveBackend(env) {
+// Re-exported so a caller can resolve the same tenant value the factory
+// stamps on the queue without importing lib/tenant/context.mjs directly.
+export { TENANT_ID_ENV_KEY, DEFAULT_TENANT_ID } from '../tenant/context.mjs';
+
+// Thrown when a caller names a queue backend that is neither a builtin provider
+// (git/filesystem) nor a registered kind:'queue' extension. The reframing
+// removed the silent postgres->git alias, so an unknown backend is a hard,
+// explicit error rather than a swallowed downgrade.
+
+export class UnregisteredQueueProviderError extends Error {
+  constructor(backend) {
+    super(
+      `Queue backend '${backend}' has no registered kind:'queue' provider. ` +
+      `Builtin providers: ${BUILTIN_QUEUE_BACKENDS.join(', ')}. ` +
+      `Install a kind:'queue' extension (e.g. a Postgres provider) to select it.`,
+    );
+    this.name = 'UnregisteredQueueProviderError';
+    this.backend = backend;
+  }
+}
+
+// Selection resolves through the registry by kind. An explicit backend override
+// wins; otherwise deployment mode picks the default provider (solo→filesystem,
+// team/enterprise→postgres). A non-builtin backend must resolve to a registered
+// kind:'queue' provider or the call fails explicitly.
+
+function resolveBackend(env, rootDir) {
   const override = env?.[INTAKE_QUEUE_BACKEND_ENV_KEY];
-  if (override === 'filesystem' || override === 'git') return override;
-  const mode = getDeploymentMode(env);
-  return mode === 'solo' ? 'filesystem' : 'git';
+  const requested = override && String(override).trim()
+    ? String(override).trim()
+    : (getDeploymentMode(env, { cwd: rootDir }) === 'solo' ? 'filesystem' : 'postgres');
+
+  if (BUILTIN_QUEUE_BACKENDS.includes(requested)) return { backend: requested, provider: null };
+
+  const provider = findQueueProvider(requested, { rootDir, env });
+  if (!provider) throw new UnregisteredQueueProviderError(requested);
+  return { backend: requested, provider };
 }
 
 function resolveProject(rootDir, env) {
@@ -58,20 +105,89 @@ function resolveProject(rootDir, env) {
   return path.basename(path.resolve(rootDir)).trim() || 'construct';
 }
 
+// Resolves the tenant context (config + env, validated) for queue scoping.
+// Reads CONSTRUCT_TENANT_ID directly here — the factory is a plumbing
+// boundary, so it does not load construct.config.json itself and passes no
+// config, which mirrors solo/team's config-optional path. Enterprise callers
+// that need config-sourced tenantId should resolve it once at startup via
+// lib/deployment-mode.mjs#validateTenantAtStartup and pass the result through
+// opts.tenantId instead of relying on this fallback.
+
+export function resolveIntakeTenantId(env = process.env, mode = getDeploymentMode(env)) {
+  return resolveTenantContext({ env, mode }).tenantId;
+}
+
 /**
  * Create an IntakeQueue instance for the given project root.
  * Backend selection: CONSTRUCT_INTAKE_QUEUE_BACKEND override wins; otherwise
- * solo mode → filesystem, team/enterprise → git. The git
- * backend uses the filesystem and git for state synchronization.
+ * solo mode → filesystem, team/enterprise → postgres. A backend that is neither builtin nor a registered
+ * kind:'queue' provider throws UnregisteredQueueProviderError — there is no
+ * silent postgres->git alias.
+ *
+ * The returned instance carries a `.tenantId` (opts.tenantId wins, otherwise
+ * resolved from CONSTRUCT_TENANT_ID/config via resolveIntakeTenantId) so a
+ * caller building a queue entry can stamp tenantId without re-deriving it —
+ * the queue classes themselves stay tenant-agnostic (LMCP-H1; tenant-scoped
+ * storage is LMCP-H4, not this bead).
  */
 export function createIntakeQueue(rootDir, env = process.env, opts = {}) {
-  const backend = opts.backend || resolveBackend(env);
-  if (backend === 'filesystem') return new FilesystemIntakeQueue(rootDir);
-  if (backend === 'git' || backend === 'postgres') {
-    // 'postgres' aliases to 'git' so existing configs keep resolving
+  const resolved = opts.backend
+    ? (BUILTIN_QUEUE_BACKENDS.includes(opts.backend)
+        ? { backend: opts.backend, provider: null }
+        : (findQueueProvider(opts.backend, { rootDir, env })
+            ? { backend: opts.backend, provider: findQueueProvider(opts.backend, { rootDir, env }) }
+            : (() => { throw new UnregisteredQueueProviderError(opts.backend); })()))
+    : resolveBackend(env, rootDir);
 
+  const tenantId = opts.tenantId ?? resolveIntakeTenantId(env, getDeploymentMode(env, { cwd: rootDir }));
+
+  if (resolved.backend === 'filesystem') {
+    const queue = new FilesystemIntakeQueue(rootDir);
+    queue.tenantId = tenantId;
+    return queue;
+  }
+  if (resolved.backend === 'git') {
     const project = opts.project ?? resolveProject(rootDir, env);
-    return new GitIntakeQueue({ project, rootDir });
+    const queue = new GitIntakeQueue({ project, rootDir });
+    queue.tenantId = tenantId;
+    return queue;
   }
-  throw new Error(`Unknown intake queue backend: ${backend}`);
+
+  if (resolved.backend === 'postgres' || resolved.provider?.id === 'postgres') {
+    const sql = opts.sql ?? createSqlClient(env);
+    if (!sql) {
+      const mode = getDeploymentMode(env, { cwd: rootDir });
+      if (mode === 'solo') {
+        throw new Error(
+          `Queue backend '${resolved.backend}' requires DATABASE_URL or CONSTRUCT_DATABASE_URL; ` +
+          `no Postgres SQL client is configured.`,
+        );
+      }
+      requireTeamCapabilityOrDegrade('postgres-queue', false, env, { cwd: rootDir });
+      const queue = new GitIntakeQueue({ project: opts.project ?? resolveProject(rootDir, env), rootDir });
+      queue.tenantId = tenantId;
+      queue.backend = 'git';
+      queue.requestedBackend = resolved.backend;
+      queue.degraded = true;
+      queue.degradedReason = 'postgres-unavailable';
+      return queue;
+    }
+    requireTeamCapabilityOrDegrade('postgres-queue', true, env, { cwd: rootDir });
+    return new PostgresIntakeQueue({
+      sql,
+      project: opts.project ?? resolveProject(rootDir, env),
+      tenantId,
+      queueName: opts.queueName ?? env?.[INTAKE_QUEUE_NAME_ENV_KEY] ?? 'intake',
+      leaseSeconds: opts.leaseSeconds ?? env?.[INTAKE_QUEUE_LEASE_SECONDS_ENV_KEY],
+    });
+  }
+
+  // A registered kind:'queue' provider was selected but no in-tree instantiation
+  // path exists yet. The selection is honest — it names the resolved provider
+  // rather than silently downgrading to git.
+
+  throw new Error(
+    `Queue backend '${resolved.backend}' resolves to registered kind:'queue' provider ` +
+    `'${resolved.provider?.id}' but no in-tree instantiation path is wired yet.`,
+  );
 }

package/lib/intake/session-prelude.mjs

@@ -13,12 +13,14 @@
 import { createIntakeQueue } from './queue.mjs';
 import { formatTriageLine } from './classify.mjs';
 import { isBrokered } from '../mcp/broker.mjs';
+import { getDeploymentMode } from '../deployment-mode.mjs';
 import { getRebrand } from '../scopes/rebrand.mjs';
 import { homedir as osHomedir } from 'node:os';
 import { readLastTick } from '../oracle/index.mjs';
 import { listPending } from '../oracle/actions.mjs';
 import { readLatestVerdict } from '../oracle/verdicts.mjs';
 import { isVerdictOnlyGap } from '../oracle/policy.mjs';
+import { heartbeatFreshness, formatAge } from '../oracle/heartbeat.mjs';
 
 export function buildIntakePrelude({ cwd, env = process.env } = {}) {
   if (!cwd) return '';
@@ -41,9 +43,9 @@ export function buildIntakePrelude({ cwd, env = process.env } = {}) {
   }
 }
 
-export function buildBrokerStatusLine({ env = process.env } = {}) {
-  const active = isBrokered(env);
-  const mode = env?.CONSTRUCT_DEPLOYMENT_MODE || 'solo';
+export function buildBrokerStatusLine({ env = process.env, cwd } = {}) {
+  const active = isBrokered(env, { cwd });
+  const mode = getDeploymentMode(env, { cwd });
   if (!active) {
     return `MCP broker: off · deployment mode: ${mode} (set CONSTRUCT_MCP_BROKER=on to engage in solo mode).`;
   }
@@ -52,7 +54,7 @@ export function buildBrokerStatusLine({ env = process.env } = {}) {
 
 export function buildSessionPrelude({ cwd, env = process.env } = {}) {
   const intake = buildIntakePrelude({ cwd, env });
-  const broker = buildBrokerStatusLine({ env });
+  const broker = buildBrokerStatusLine({ env, cwd });
   const oracle = buildOraclePrelude({ cwd, env });
   if (!intake && !broker && !oracle) return '';
   const parts = [];
@@ -62,6 +64,26 @@ export function buildSessionPrelude({ cwd, env = process.env } = {}) {
   return parts.join('\n\n');
 }
 
+/**
+ * lib/oracle/synthesize.mjs renders gap detail text against a 24h lookback
+ * window ("in the last 24h"); a verdict older than that window describes a
+ * period disjoint from the present, so the same threshold marks it stale.
+ * Missing/unparseable `at` resolves to Infinity (stale, not fresh) rather
+ * than defaulting to zero age.
+ */
+const VERDICT_STALE_MS = 24 * 60 * 60 * 1000;
+
+function verdictFreshness(verdict, now = Date.now()) {
+  const at = verdict?.at;
+  const parsed = at ? Date.parse(at) : NaN;
+  const ageMs = Number.isFinite(parsed) ? now - parsed : Infinity;
+  return {
+    ageMs,
+    stale: !Number.isFinite(ageMs) || ageMs > VERDICT_STALE_MS,
+    asOf: Number.isFinite(parsed) ? new Date(parsed).toISOString() : null,
+  };
+}
+
 /**
  * Oracle verdict + pending queue for session-start (mirror doctor warnings).
  */
@@ -75,7 +97,19 @@ export function buildOraclePrelude({ cwd, env = process.env, homeDir } = {}) {
     const pending = listPending(cwd).filter((p) => p.status === 'pending');
     const v = verdict?.verdict ?? last?.verdict ?? 'unknown';
     if (v === 'healthy' && pending.length === 0) return '';
-    const lines = [`\n## Oracle overseer · verdict: **${v}**`];
+    const source = verdict ?? last;
+    const { ageMs, stale, asOf } = verdictFreshness(source);
+    const verdictHead = v === 'unknown'
+      ? `\n## Oracle overseer · verdict: **${v}**`
+      : `\n## Oracle overseer · verdict: **${v}** (as of ${asOf ?? 'unknown'}, ${formatAge(ageMs)} ago)`;
+    const lines = [verdictHead];
+    if (v !== 'unknown' && stale) {
+      lines.push(`- STALE: verdict is older than ${formatAge(VERDICT_STALE_MS)}; gap details below describe the verdict date, not now.`);
+    }
+    const heartbeat = heartbeatFreshness(last);
+    if (heartbeat.stale && pending.length > 0) {
+      lines.push(`- [high] oracle-producer-stalled: no oracle tick in ${formatAge(heartbeat.ageMs)} while ${pending.length} approval(s) wait — the daemon looks stalled, not idle; run \`construct oracle status\` / \`construct oracle start\`.`);
+    }
     const gapSource = verdict?.gaps ?? last?.gaps ?? [];
     const top = gapSource.filter((g) => g.severity === 'high').slice(0, 3);
     for (const g of top) {
@@ -83,7 +117,7 @@ export function buildOraclePrelude({ cwd, env = process.env, homeDir } = {}) {
         const hint = g.id === 'beads-hygiene'
           ? 'run `construct beads drift`'
           : g.id === 'workflow-misaligned'
-            ? 'run `construct workflow init` or `construct init`'
+            ? 'run `construct workflow new` or `construct init`'
             : 'see `construct oracle gaps`';
         lines.push(`- [${g.severity}] ${g.id} (verdict-only): ${g.detail} — ${hint}`);
       } else {
@@ -102,7 +136,7 @@ export function buildOraclePrelude({ cwd, env = process.env, homeDir } = {}) {
 
 export function readOracleDockState({ cwd, env = process.env, homeDir } = {}) {
   if (!cwd || env.CONSTRUCT_ORACLE === 'off' || env.CONSTRUCT_ORACLE === '0') {
-    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '' };
+    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '', asOf: null, stale: false, producerStalled: false, producerAgeMs: null };
   }
   try {
     const home = homeDir ?? osHomedir();
@@ -113,23 +147,38 @@ export function readOracleDockState({ cwd, env = process.env, homeDir } = {}) {
     const gapSource = verdictDoc?.gaps ?? last?.gaps ?? [];
     const topGaps = gapSource.filter((g) => g.severity === 'high').slice(0, 3);
     const visible = verdict !== 'healthy' || pending.length > 0;
+    const { stale, asOf } = verdictFreshness(verdictDoc ?? last);
+    const heartbeat = heartbeatFreshness(last);
+    const producerStalled = heartbeat.stale && pending.length > 0;
     const parts = [`verdict ${verdict}`];
     if (pending.length) parts.push(`${pending.length} pending`);
+    if (verdict !== 'unknown' && stale) parts.push('STALE');
+    if (producerStalled) parts.push('PRODUCER STALLED');
     return {
       visible,
       verdict,
       pendingCount: pending.length,
       topGaps,
       summary: parts.join(' · '),
+      asOf,
+      stale: verdict !== 'unknown' && stale,
+      producerStalled,
+      producerAgeMs: heartbeat.ageMs,
     };
   } catch {
-    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '' };
+    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '', asOf: null, stale: false, producerStalled: false, producerAgeMs: null };
   }
 }
 
 export function formatOracleDockDetail(state) {
   if (!state?.visible) return 'Oracle: healthy — no pending approvals.';
   const lines = [`Oracle overseer · ${state.summary}`];
+  if (state.stale) {
+    lines.push(`  STALE: verdict as of ${state.asOf ?? 'unknown'}; gap details describe the verdict date, not now.`);
+  }
+  if (state.producerStalled) {
+    lines.push(`  PRODUCER STALLED: no oracle tick in ${formatAge(state.producerAgeMs)} while ${state.pendingCount} approval(s) wait — the daemon may be down.`);
+  }
   for (const g of state.topGaps || []) {
     if (isVerdictOnlyGap(g)) {
       lines.push(`  [${g.severity}] ${g.id} (verdict-only): ${g.detail}`);

package/lib/integrations/intake-integrations.mjs

@@ -19,7 +19,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { configDir } from '../config/xdg.mjs';
-import { resolveOpRef } from '../providers/secret-resolver.mjs';
+import { resolveOpRef, hasSecret, hasAnySecret, peekRawCredential } from '../providers/secret-resolver.mjs';
 
 // ── Multi-method auth helpers ────────────────────────────────────────────
 
@@ -588,8 +588,13 @@ export function tagIntakeWithExternalRef(rootDir, intakeId, system, externalUrl,
 }
 
 /**
- * Synchronous credential resolver for use in constructors and sync contexts.
- * Mirrors the async resolveCredential above. Checks env → .env → config.env → shell rc.
+ * Credential resolver for the actual publish paths (createGitHubIssue,
+ * createJiraTicket, publishArtifactToConfluence) that need a real, materialized
+ * value to make an API call. Checks env → .env → config.env → shell rc,
+ * resolving a 1Password op:// reference through resolveOpRef when the rc tier
+ * carries one. Not for status/detection — detectIntegrationConfig below uses
+ * hasSecret/hasAnySecret/peekRawCredential instead, which never resolve op:// or
+ * source a shell rc file (ADR-0049 §2: presence-first in short-lived paths).
  */
 function resolveCredentialSync(varName, homeDir) {
   if (process.env[varName]) return process.env[varName];
@@ -640,126 +645,71 @@ function resolveCredentialSync(varName, homeDir) {
 // ── Configuration detection ──────────────────────────────────────────────
 
 /**
- * Check which integrations are configured.
- * Scopes environment, .env files, ~/.construct/config.env, and shell rc
- * files (including 1Password op:// refs).
+ * Check which integrations are configured. A status/detection surface must
+ * never materialize a credential (ADR-0049 §2: "never to merely list or
+ * check") — this reports presence by shape only: env var set, a project/config/
+ * home .env entry exists, or a shell rc `export VAR=...` line matches. It never
+ * calls resolveOpRef and never sources a shell rc file (contrast
+ * resolveCredentialSync above, used only when an actual API call needs the
+ * real value). `gh auth status` / `gh repo view` are read-only CLI queries,
+ * not secret materialization — gh manages its own token internally and never
+ * hands Construct a plaintext value here.
  *
  * @param {object} [opts]
  * @param {string} [opts.homeDir]
- * @returns {{ github: boolean, jira: boolean, confluence: boolean, githubToken: boolean, jiraToken: boolean, confluenceToken: boolean }}
+ * @returns {{ github: boolean, jira: boolean, confluence: boolean, githubMethod: string|null, githubRepo: string|null, jiraHost: string|null, confluenceSpace: string|null }}
  */
 export function detectIntegrationConfig({ homeDir } = {}) {
   const hd = homeDir || homedir();
 
-  // GitHub — try gh CLI first, then env vars
-  const ghAuth = resolveGitHubAuth(hd);
-
-  // Jira
-  const jiraHost = resolveCredentialSync('JIRA_HOST', hd);
-  const jiraUser = resolveCredentialSync('JIRA_USER', hd);
-  const jiraToken = resolveCredentialSync('JIRA_API_TOKEN', hd);
-  const jiraProject = resolveCredentialSync('JIRA_PROJECT', hd);
-
-  // Confluence
-  const confHost = resolveCredentialSync('CONFLUENCE_HOST', hd);
-  const confUser = resolveCredentialSync('CONFLUENCE_USER', hd);
-  const confToken = resolveCredentialSync('CONFLUENCE_API_TOKEN', hd);
-  const confSpace = resolveCredentialSync('CONFLUENCE_SPACE', hd);
-
-  return {
-    github: ghAuth.method === 'gh' || Boolean(ghAuth.token && ghAuth.repo),
-    githubMethod: ghAuth.method || null,
-    githubRepo: ghAuth.repo || null,
-    jira: Boolean(jiraHost && jiraUser && jiraToken && jiraProject),
-    jiraHost: jiraHost || null,
-    confluence: Boolean(confHost && confUser && confToken && confSpace),
-    confluenceSpace: confSpace || null,
-  };
-}
-
-/**
- * Resolve a credential from env, .env files, config.env, or shell rc files.
- * Mirrors the approach in lib/health-check.mjs.
- */
-function resolveCredential(varName, homeDir) {
-  if (process.env[varName]) return process.env[varName];
-
-  // Project .env
+  // GitHub
+  let ghCliAuthenticated = false;
   try {
-    const projectEnv = join(process.cwd(), '.env');
-    if (existsSync(projectEnv)) {
-      const content = readFileSync(projectEnv, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
-      if (m) return m[1].trim();
-    }
-  } catch { /* skip */ }
+    const status = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8', timeout: 5000 });
+    ghCliAuthenticated = status.status === 0;
+  } catch { /* gh not available */ }
 
-  // ~/.env
-  try {
-    const homeEnv = join(homeDir, '.env');
-    if (existsSync(homeEnv)) {
-      const content = readFileSync(homeEnv, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
-      if (m) return m[1].trim();
-    }
-  } catch { /* skip */ }
+  const githubTokenPresent = hasAnySecret(['GITHUB_TOKEN', 'GH_TOKEN'], { home: hd });
+  let githubRepo = process.env.GITHUB_REPO || peekRawCredential('GITHUB_REPO', { home: hd })?.raw || null;
+  let githubMethod = null;
 
-  // config.env in the XDG config dir
-  try {
-    const cfgPath = join(configDir(homeDir), 'config.env');
-    if (existsSync(cfgPath)) {
-      const content = readFileSync(cfgPath, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=(.+)$`, 'm'));
-      if (m) return m[1].trim();
+  if (ghCliAuthenticated) {
+    githubMethod = 'gh';
+    if (!githubRepo) {
+      try {
+        const remote = spawnSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '--jq', '.nameWithOwner'], { encoding: 'utf8', timeout: 5000 });
+        if (remote.status === 0 && remote.stdout?.trim()) githubRepo = remote.stdout.trim();
+      } catch { /* gh not available */ }
     }
-  } catch { /* skip */ }
+  } else if (githubTokenPresent) {
+    githubMethod = 'env';
+  }
 
-  // Shell rc files (including 1Password op:// refs and command substitutions)
-  try {
-    const shellFiles = [join(homeDir, '.zshrc'), join(homeDir, '.bashrc'), join(homeDir, '.bash_profile'), join(homeDir, '.profile')];
-    for (const rcPath of shellFiles) {
-      if (!existsSync(rcPath)) continue;
-      try {
-        const content = readFileSync(rcPath, 'utf8');
-        // Direct export (simple values only, not command substitutions)
-        const directRe = new RegExp(`^\\s*export\\s+${varName}="?([^"'\\$\\(]+)"?$`, 'm');
-        const directMatch = content.match(directRe);
-        if (directMatch) return directMatch[1].trim();
-
-        // op:// ref — try 1Password CLI
-        const opRe = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
-        const opMatch = content.match(opRe);
-        if (opMatch) {
-          // op read failures often mean the rc-file field name doesn't match the
-          // actual 1Password item field; surface them under the debug flag.
-          try {
-            return resolveOpRef(opMatch[1]);
-          } catch (err) {
-            if (process.env.CONSTRUCT_DEBUG_CREDENTIALS === '1') {
-              process.stderr.write(`[credentials] op read failed for ${varName}: ${String(err.message).slice(0, 200)}\n`);
-            }
-          }
-        }
+  // Jira
+  const jiraConfigured = Boolean(
+    hasSecret('JIRA_HOST', { home: hd })
+    && hasSecret('JIRA_USER', { home: hd })
+    && hasSecret('JIRA_API_TOKEN', { home: hd })
+    && hasSecret('JIRA_PROJECT', { home: hd }),
+  );
+  const jiraHost = peekRawCredential('JIRA_HOST', { home: hd })?.raw || null;
 
-        // If the value uses command substitution ($(...)), try evaluating via
-        // a shell that sources the rc file. This catches any $(...) pattern
-        // including op read with different field names or other secret managers.
-        const cmdSubRe = new RegExp(`^export\\s+${varName}="?\\$\\((.+)\\)"?`, 'm');
-        const cmdMatch = content.match(cmdSubRe);
-        if (cmdMatch) {
-          try {
-            const shellResult = spawnSync('zsh', ['-c', `source "${rcPath}" 2>/dev/null; echo "\${${varName}}"`], {
-              encoding: 'utf8', timeout: 5000,
-            });
-            if (shellResult.status === 0 && shellResult.stdout?.trim()) {
-              const val = shellResult.stdout.trim().split('\n').pop()?.trim();
-              if (val && !val.includes('ERROR') && !val.includes('could not read')) return val;
-            }
-          } catch { /* shell eval failed */ }
-        }
-      } catch { /* skip unreadable */ }
-    }
-  } catch { /* skip */ }
+  // Confluence
+  const confluenceConfigured = Boolean(
+    hasSecret('CONFLUENCE_HOST', { home: hd })
+    && hasSecret('CONFLUENCE_USER', { home: hd })
+    && hasSecret('CONFLUENCE_API_TOKEN', { home: hd })
+    && hasSecret('CONFLUENCE_SPACE', { home: hd }),
+  );
+  const confluenceSpace = peekRawCredential('CONFLUENCE_SPACE', { home: hd })?.raw || null;
 
-  return null;
+  return {
+    github: ghCliAuthenticated || Boolean(githubTokenPresent && githubRepo),
+    githubMethod,
+    githubRepo,
+    jira: jiraConfigured,
+    jiraHost,
+    confluence: confluenceConfigured,
+    confluenceSpace,
+  };
 }

package/lib/intent-classifier.mjs

@@ -27,6 +27,7 @@
 import crypto from 'node:crypto';
 import { readCurrentModels, readOpenRouterApiKeyFromOpenCodeConfig } from './model-router.mjs';
 import { getUserEnvPath } from './env-config.mjs';
+import { extractOpRef, hasSecret, resolveOpRefAsync, resolveSecretAsync } from './providers/secret-resolver.mjs';
 import { logIntentVerification } from './telemetry/intent-verifications.mjs';
 
 export const INTENT_VERIFY_TIMEOUT_MS = 3000;
@@ -66,12 +67,49 @@ export function resetCache() {
   CACHE.clear();
 }
 
+async function resolveSecretOrNull(varName, { env = process.env, allowAmbient = true } = {}) {
+  try {
+    return await resolveSecretAsync(varName, { env, allowAmbient });
+  } catch {
+    return null;
+  }
+}
+
+async function materializeConfiguredKey(rawValue) {
+  if (typeof rawValue !== 'string' || rawValue.length === 0) return null;
+  const ref = extractOpRef(rawValue);
+  try {
+    return ref ? await resolveOpRefAsync(ref) : rawValue;
+  } catch {
+    return null;
+  }
+}
+
+async function resolveOpenRouterApiKey() {
+  const envKey = await resolveSecretOrNull('OPENROUTER_API_KEY');
+  if (envKey) return envKey;
+  try {
+    return await materializeConfiguredKey(readOpenRouterApiKeyFromOpenCodeConfig());
+  } catch {
+    return null;
+  }
+}
+
+async function resolveAnthropicApiKey() {
+  return resolveSecretOrNull('ANTHROPIC_API_KEY');
+}
+
 function isApiKeyConfigured() {
-  if (process.env.ANTHROPIC_API_KEY) return true;
-  if (process.env.OPENROUTER_API_KEY) return true;
+  // Presence gate only — hasSecret detects a configured key (including an op://
+  // reference) without materializing it, so deciding whether to run the background
+  // intent verifier never spawns `op read` or a 1Password biometric prompt on the
+  // routing hot path. Materialization happens lazily in defaultModelCaller when a
+  // verification call is actually made.
+  if (hasSecret('ANTHROPIC_API_KEY')) return true;
+  if (hasSecret('OPENROUTER_API_KEY')) return true;
   try {
     if (readOpenRouterApiKeyFromOpenCodeConfig()) return true;
-  } catch { /* ignore */ }
+  } catch { /* OpenCode provider config is optional */ }
   return false;
 }
 
@@ -115,8 +153,8 @@ async function fetchWithTimeout(url, options, timeoutMs = INTENT_VERIFY_TIMEOUT_
 }
 
 async function defaultModelCaller({ system, user }) {
-  const orKey = process.env.OPENROUTER_API_KEY || readOpenRouterApiKeyFromOpenCodeConfig();
-  const anthropicKey = process.env.ANTHROPIC_API_KEY;
+  const orKey = await resolveOpenRouterApiKey();
+  const anthropicKey = await resolveAnthropicApiKey();
   if (!orKey && !anthropicKey) throw new Error('no model api key configured');
 
   const envPath = getUserEnvPath();