@hanhnd/agent-kit 1.0.9 → 1.0.10

package/README.md

@@ -35,17 +35,24 @@ claude plugin install ak
 
 The plugin fetches from GitHub, registers the MCP server automatically, and makes all commands available immediately.
 
-**Add credentials** to your shell profile (`~/.zshrc` or `~/.bashrc`):
+**Add credentials** to `~/.claude/credentials` (like `~/.aws/credentials`):
 
 ```bash
-export ATLASSIAN_CLOUD_ID="your-atlassian-cloud-id"
-export ATLASSIAN_USER_EMAIL="you@yourcompany.com"
-export ATLASSIAN_API_TOKEN="your-atlassian-api-token"
-export BITBUCKET_USER_EMAIL="you@yourcompany.com"
-export BITBUCKET_API_TOKEN="your-atlassian-api-token"
-export BITBUCKET_DEFAULT_WORKSPACE="your-default-workspace-slug"
+touch ~/.claude/credentials && chmod 600 ~/.claude/credentials
 ```
 
+```ini
+[default]
+ATLASSIAN_CLOUD_ID = your-atlassian-cloud-id
+ATLASSIAN_USER_EMAIL = you@yourcompany.com
+ATLASSIAN_API_TOKEN = your-atlassian-api-token
+BITBUCKET_USER_EMAIL = you@yourcompany.com
+BITBUCKET_API_TOKEN = your-atlassian-api-token
+BITBUCKET_DEFAULT_WORKSPACE = your-default-workspace-slug
+```
+
+To use multiple profiles, add `[work]`, `[personal]`, etc. sections and set `KIT_PROFILE=work` in your environment.
+
 To update: `claude plugin update ak`
 To uninstall: `claude plugin uninstall ak`
 
@@ -73,15 +80,20 @@ claude plugin install ak
 
 This registers the MCP server automatically (pointing to your local build). Do **not** manually add a `kit-agents` entry to `settings.json` — the plugin handles that.
 
-**3. Add credentials** to your shell profile (`~/.zshrc` or `~/.bashrc`):
+**3. Add credentials** to `~/.claude/credentials`:
 
 ```bash
-export ATLASSIAN_CLOUD_ID="your-atlassian-cloud-id"
-export ATLASSIAN_USER_EMAIL="you@yourcompany.com"
-export ATLASSIAN_API_TOKEN="your-atlassian-api-token"
-export BITBUCKET_USER_EMAIL="you@yourcompany.com"
-export BITBUCKET_API_TOKEN="your-atlassian-api-token"
-export BITBUCKET_DEFAULT_WORKSPACE="your-default-workspace-slug"
+touch ~/.claude/credentials && chmod 600 ~/.claude/credentials
+```
+
+```ini
+[default]
+ATLASSIAN_CLOUD_ID = your-atlassian-cloud-id
+ATLASSIAN_USER_EMAIL = you@yourcompany.com
+ATLASSIAN_API_TOKEN = your-atlassian-api-token
+BITBUCKET_USER_EMAIL = you@yourcompany.com
+BITBUCKET_API_TOKEN = your-atlassian-api-token
+BITBUCKET_DEFAULT_WORKSPACE = your-default-workspace-slug
 ```
 
 **4. Verify**
@@ -125,11 +137,13 @@ The MCP server source is in `src/`. Agent personas are in `agents/`. Skill modul
 
 ## Integrations
 
+Credentials are stored in `~/.claude/credentials` (INI format). Keys can also be set as environment variables — env vars take priority (useful for CI/CD).
+
 ### Jira (via Atlassian REST API)
 
 Used by `/ak:ticket` and `/ak:review-pr`.
 
-| Variable               | Description                                                                                                                              |
+| Key                    | Description                                                                                                                              |
 | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
 | `ATLASSIAN_CLOUD_ID`   | Your Atlassian Cloud ID — find it at [admin.atlassian.com](https://admin.atlassian.com) under your site settings                         |
 | `ATLASSIAN_USER_EMAIL` | Your Atlassian account email                                                                                                             |
@@ -139,7 +153,7 @@ Used by `/ak:ticket` and `/ak:review-pr`.
 
 Used by `/ak:review-pr`.
 
-| Variable                      | Description                                                                                                                              |
+| Key                           | Description                                                                                                                              |
 | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
 | `BITBUCKET_USER_EMAIL`        | Your Atlassian account email (same as Jira)                                                                                              |
 | `BITBUCKET_API_TOKEN`         | API token — create at [id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens) |

package/dist/credentials.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Credential loader — reads ~/.claude/credentials (INI format, like ~/.aws/credentials)
+ *
+ * Resolution order per key:
+ *   1. process.env.KEY  (explicit override / CI)
+ *   2. ~/.claude/credentials [profile] section
+ *   3. undefined
+ *
+ * File format:
+ *   [default]
+ *   ATLASSIAN_USER_EMAIL = user@example.com
+ *   ATLASSIAN_API_TOKEN  = your_token_here
+ *
+ * Active profile: KIT_PROFILE env var (defaults to "default")
+ */
+/**
+ * Resolve a credential key using the priority chain:
+ *   process.env.KEY → ~/.claude/credentials [profile] → undefined
+ */
+export declare function getCredential(key: string): string | undefined;

package/dist/credentials.js

@@ -0,0 +1,87 @@
+/**
+ * Credential loader — reads ~/.claude/credentials (INI format, like ~/.aws/credentials)
+ *
+ * Resolution order per key:
+ *   1. process.env.KEY  (explicit override / CI)
+ *   2. ~/.claude/credentials [profile] section
+ *   3. undefined
+ *
+ * File format:
+ *   [default]
+ *   ATLASSIAN_USER_EMAIL = user@example.com
+ *   ATLASSIAN_API_TOKEN  = your_token_here
+ *
+ * Active profile: KIT_PROFILE env var (defaults to "default")
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+const CREDENTIALS_FILE = path.join(os.homedir(), '.claude', 'credentials');
+let cachedCredentials = null;
+/**
+ * Parse a simple INI file into a map of profiles.
+ * Ignores comment lines (# or ;) and blank lines.
+ */
+function parseIni(content) {
+    const result = {};
+    let currentSection = 'default';
+    for (const raw of content.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+        if (sectionMatch) {
+            currentSection = sectionMatch[1].trim();
+            continue;
+        }
+        const eqIdx = line.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const key = line.slice(0, eqIdx).trim();
+        const value = line.slice(eqIdx + 1).trim();
+        if (!result[currentSection])
+            result[currentSection] = {};
+        result[currentSection][key] = value;
+    }
+    return result;
+}
+/**
+ * Load credentials from ~/.claude/credentials for the active profile.
+ * Result is cached for the lifetime of the MCP server process.
+ */
+function loadCredentials() {
+    if (cachedCredentials !== null)
+        return cachedCredentials;
+    if (!fs.existsSync(CREDENTIALS_FILE)) {
+        cachedCredentials = {};
+        return cachedCredentials;
+    }
+    // Warn if the file is world-readable (not chmod 600)
+    try {
+        const stat = fs.statSync(CREDENTIALS_FILE);
+        const mode = stat.mode & 0o777;
+        if (mode !== 0o600) {
+            process.stderr.write(`[credentials] ⚠️  Warning: ${CREDENTIALS_FILE} has permissions ${mode.toString(8)} — expected 600. Run: chmod 600 ${CREDENTIALS_FILE}\n`);
+        }
+    }
+    catch {
+        // Non-fatal
+    }
+    const content = fs.readFileSync(CREDENTIALS_FILE, 'utf-8');
+    const ini = parseIni(content);
+    const profile = process.env.KIT_PROFILE ?? 'default';
+    cachedCredentials = ini[profile] ?? {};
+    if (Object.keys(cachedCredentials).length === 0 && profile !== 'default') {
+        process.stderr.write(`[credentials] ⚠️  Profile "${profile}" not found in ${CREDENTIALS_FILE}. Falling back to empty.\n`);
+    }
+    return cachedCredentials;
+}
+/**
+ * Resolve a credential key using the priority chain:
+ *   process.env.KEY → ~/.claude/credentials [profile] → undefined
+ */
+export function getCredential(key) {
+    if (process.env[key] !== undefined)
+        return process.env[key];
+    return loadCredentials()[key];
+}

package/dist/kit-server.js

@@ -3223,8 +3223,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path4) {
-      let input = path4;
+    function removeDotSegments(path5) {
+      let input = path5;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3423,8 +3423,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path4, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path4 && path4 !== "/" ? path4 : void 0;
+        const [path5, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path5 && path5 !== "/" ? path5 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -6786,12 +6786,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs3, exportName) {
+    function addFormats(ajv, list, fs4, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs3[f]);
+        ajv.addFormat(f, fs4[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -7277,8 +7277,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path4, errorMaps, issueData } = params;
-  const fullPath = [...path4, ...issueData.path || []];
+  const { data, path: path5, errorMaps, issueData } = params;
+  const fullPath = [...path5, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7394,11 +7394,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path4, key) {
+  constructor(parent, value, path5, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path4;
+    this._path = path5;
     this._key = key;
   }
   get path() {
@@ -11036,10 +11036,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path4) {
-  if (!path4)
+function getElementAtPath(obj, path5) {
+  if (!path5)
     return obj;
-  return path4.reduce((acc, key) => acc?.[key], obj);
+  return path5.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11359,11 +11359,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path4, issues) {
+function prefixIssues(path5, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path4);
+    iss.path.unshift(path5);
     return iss;
   });
 }
@@ -21011,7 +21011,9 @@ var FORBIDDEN_FILES = [
   ".npmrc",
   ".yarnrc",
   ".netrc",
-  ".gitconfig"
+  ".gitconfig",
+  "credentials"
+  // ~/.claude/credentials file
 ];
 var FORBIDDEN_PATTERNS = [
   /^\.env$/i,
@@ -21036,23 +21038,6 @@ var FORBIDDEN_DIRS = [
   ".gnupg",
   ".docker"
 ];
-var SAFE_ENV_VARS = [
-  "PATH",
-  "HOME",
-  "USER",
-  "SHELL",
-  "TERM",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TMPDIR",
-  "TMP",
-  "TEMP",
-  "NODE_ENV",
-  "GEMINI_WORKSPACE",
-  "KIT_AGENT_TIMEOUT",
-  "GEMINI_KIT_GIT_TIMEOUT"
-];
 
 // src/tools/core.ts
 function registerCoreTools(server2) {
@@ -21234,16 +21219,9 @@ function registerAgentTools(server2) {
         const slug = taskSlug(task);
         const { logPath, logStream } = initAgentLog(workspaceRoot, slug, usedAgent);
         const jobId = randomUUID();
-        const sanitizedEnv = {};
-        for (const key of SAFE_ENV_VARS) {
-          if (process.env[key] !== void 0) {
-            sanitizedEnv[key] = process.env[key];
-          }
-        }
-        sanitizedEnv.GEMINI_WORKSPACE = workspaceRoot;
         const child = spawn(usedAgent, agentArgs, {
           cwd: workspaceRoot,
-          env: sanitizedEnv
+          env: { ...process.env, GEMINI_WORKSPACE: workspaceRoot }
         });
         const job = {
           id: jobId,
@@ -21326,6 +21304,68 @@ function registerAgentTools(server2) {
 
 // src/tools/integration.ts
 import { writeFileSync as writeFileSync3 } from "fs";
+
+// src/credentials.ts
+import * as fs3 from "fs";
+import * as os from "os";
+import * as path4 from "path";
+var CREDENTIALS_FILE = path4.join(os.homedir(), ".claude", "credentials");
+var cachedCredentials = null;
+function parseIni(content) {
+  const result = {};
+  let currentSection = "default";
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+    const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      currentSection = sectionMatch[1].trim();
+      continue;
+    }
+    const eqIdx = line.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = line.slice(0, eqIdx).trim();
+    const value = line.slice(eqIdx + 1).trim();
+    if (!result[currentSection]) result[currentSection] = {};
+    result[currentSection][key] = value;
+  }
+  return result;
+}
+function loadCredentials() {
+  if (cachedCredentials !== null) return cachedCredentials;
+  if (!fs3.existsSync(CREDENTIALS_FILE)) {
+    cachedCredentials = {};
+    return cachedCredentials;
+  }
+  try {
+    const stat = fs3.statSync(CREDENTIALS_FILE);
+    const mode = stat.mode & 511;
+    if (mode !== 384) {
+      process.stderr.write(
+        `[credentials] \u26A0\uFE0F  Warning: ${CREDENTIALS_FILE} has permissions ${mode.toString(8)} \u2014 expected 600. Run: chmod 600 ${CREDENTIALS_FILE}
+`
+      );
+    }
+  } catch {
+  }
+  const content = fs3.readFileSync(CREDENTIALS_FILE, "utf-8");
+  const ini = parseIni(content);
+  const profile = process.env.KIT_PROFILE ?? "default";
+  cachedCredentials = ini[profile] ?? {};
+  if (Object.keys(cachedCredentials).length === 0 && profile !== "default") {
+    process.stderr.write(
+      `[credentials] \u26A0\uFE0F  Profile "${profile}" not found in ${CREDENTIALS_FILE}. Falling back to empty.
+`
+    );
+  }
+  return cachedCredentials;
+}
+function getCredential(key) {
+  if (process.env[key] !== void 0) return process.env[key];
+  return loadCredentials()[key];
+}
+
+// src/tools/integration.ts
 var BitbucketPrSchema = external_exports.object({
   id: external_exports.number(),
   title: external_exports.string(),
@@ -21382,16 +21422,16 @@ function extractAdfText(adf) {
   return textParts.join(" ") || "No description";
 }
 function buildJiraBasicAuth() {
-  const email2 = process.env.ATLASSIAN_USER_EMAIL;
-  const token = process.env.ATLASSIAN_API_TOKEN;
+  const email2 = getCredential("ATLASSIAN_USER_EMAIL");
+  const token = getCredential("ATLASSIAN_API_TOKEN");
   if (!email2 || !token) {
     throw new Error("Missing ATLASSIAN_USER_EMAIL or ATLASSIAN_API_TOKEN");
   }
   return "Basic " + Buffer.from(`${email2}:${token}`).toString("base64");
 }
 function buildBitbucketBasicAuth() {
-  const email2 = process.env.BITBUCKET_USER_EMAIL;
-  const token = process.env.BITBUCKET_API_TOKEN;
+  const email2 = getCredential("BITBUCKET_USER_EMAIL");
+  const token = getCredential("BITBUCKET_API_TOKEN");
   if (!email2 || !token) {
     throw new Error("Missing BITBUCKET_USER_EMAIL or BITBUCKET_API_TOKEN");
   }
@@ -21453,14 +21493,14 @@ function registerIntegrationTools(server2) {
     },
     async ({ input, workspace, repoSlug, includeDiff }) => {
       try {
-        const bbEmail = process.env.BITBUCKET_USER_EMAIL;
-        const bbToken = process.env.BITBUCKET_API_TOKEN;
+        const bbEmail = getCredential("BITBUCKET_USER_EMAIL");
+        const bbToken = getCredential("BITBUCKET_API_TOKEN");
         if (!bbEmail || !bbToken) {
           return {
             content: [
               {
                 type: "text",
-                text: `\u274C Missing BITBUCKET_USER_EMAIL or BITBUCKET_API_TOKEN. Create an API token at id.atlassian.com/manage-profile/security/api-tokens.`
+                text: `\u274C Missing BITBUCKET_USER_EMAIL or BITBUCKET_API_TOKEN. Set them in ~/.claude/agent-kit or as environment variables.`
               }
             ]
           };
@@ -21475,7 +21515,7 @@ function registerIntegrationTools(server2) {
           prId = parseInt(urlMatch[3], 10);
         } else if (input.match(/^\d+$/)) {
           prId = parseInt(input, 10);
-          ws = workspace || process.env.BITBUCKET_DEFAULT_WORKSPACE;
+          ws = workspace || getCredential("BITBUCKET_DEFAULT_WORKSPACE");
           repo = repoSlug;
         }
         if (!ws) {
@@ -21558,9 +21598,9 @@ ${diff}
     },
     async ({ ticketId }) => {
       try {
-        const cloudId = process.env.ATLASSIAN_CLOUD_ID;
-        const userEmail = process.env.ATLASSIAN_USER_EMAIL;
-        const apiToken = process.env.ATLASSIAN_API_TOKEN;
+        const cloudId = getCredential("ATLASSIAN_CLOUD_ID");
+        const userEmail = getCredential("ATLASSIAN_USER_EMAIL");
+        const apiToken = getCredential("ATLASSIAN_API_TOKEN");
         if (!cloudId || !userEmail || !apiToken) {
           const missing = [
             !cloudId && "ATLASSIAN_CLOUD_ID",

package/dist/tools/agent.js

@@ -9,7 +9,6 @@ import * as path from 'path';
 import { z } from 'zod';
 import { getWorkspaceRoot } from '../utils.js';
 import { commandExists, validatePath, sanitizeOutput } from './security.js';
-import { SAFE_ENV_VARS } from './config.js';
 // Configurable timeout via environment variable (default: 5 minutes)
 const AGENT_TIMEOUT = parseInt(process.env.KIT_AGENT_TIMEOUT || '300000', 10);
 const jobRegistry = new Map();
@@ -110,17 +109,9 @@ export function registerAgentTools(server) {
             const slug = taskSlug(task);
             const { logPath, logStream } = initAgentLog(workspaceRoot, slug, usedAgent);
             const jobId = randomUUID();
-            // Build sanitized environment: only SAFE_ENV_VARS + GEMINI_WORKSPACE
-            const sanitizedEnv = {};
-            for (const key of SAFE_ENV_VARS) {
-                if (process.env[key] !== undefined) {
-                    sanitizedEnv[key] = process.env[key];
-                }
-            }
-            sanitizedEnv.GEMINI_WORKSPACE = workspaceRoot;
             const child = spawn(usedAgent, agentArgs, {
                 cwd: workspaceRoot,
-                env: sanitizedEnv,
+                env: { ...process.env, GEMINI_WORKSPACE: workspaceRoot },
             });
             const job = {
                 id: jobId,

package/dist/tools/config.d.ts

@@ -35,7 +35,3 @@ export declare const FORBIDDEN_PATTERNS: RegExp[];
  * Directory name segments that are always blocked.
  */
 export declare const FORBIDDEN_DIRS: string[];
-/**
- * Environment variables safe to pass to child processes.
- */
-export declare const SAFE_ENV_VARS: string[];

package/dist/tools/config.js

@@ -74,6 +74,7 @@ export const FORBIDDEN_FILES = [
     '.yarnrc',
     '.netrc',
     '.gitconfig',
+    'credentials', // ~/.claude/credentials file
 ];
 /**
  * Regex patterns (case-insensitive) matched against path.basename.
@@ -100,23 +101,3 @@ export const FORBIDDEN_DIRS = [
     '.gnupg',
     '.docker',
 ];
-/**
- * Environment variables safe to pass to child processes.
- */
-export const SAFE_ENV_VARS = [
-    'PATH',
-    'HOME',
-    'USER',
-    'SHELL',
-    'TERM',
-    'LANG',
-    'LC_ALL',
-    'LC_CTYPE',
-    'TMPDIR',
-    'TMP',
-    'TEMP',
-    'NODE_ENV',
-    'GEMINI_WORKSPACE',
-    'KIT_AGENT_TIMEOUT',
-    'GEMINI_KIT_GIT_TIMEOUT',
-];

package/dist/tools/integration.js

@@ -4,6 +4,7 @@
  */
 import { writeFileSync } from 'fs';
 import { z } from 'zod';
+import { getCredential } from '../credentials.js';
 import { sanitize } from './security.js';
 // Zod schema for Bitbucket PR REST API response
 const BitbucketPrSchema = z.object({
@@ -77,16 +78,16 @@ function extractAdfText(adf) {
     return textParts.join(' ') || 'No description';
 }
 function buildJiraBasicAuth() {
-    const email = process.env.ATLASSIAN_USER_EMAIL;
-    const token = process.env.ATLASSIAN_API_TOKEN;
+    const email = getCredential('ATLASSIAN_USER_EMAIL');
+    const token = getCredential('ATLASSIAN_API_TOKEN');
     if (!email || !token) {
         throw new Error('Missing ATLASSIAN_USER_EMAIL or ATLASSIAN_API_TOKEN');
     }
     return 'Basic ' + Buffer.from(`${email}:${token}`).toString('base64');
 }
 function buildBitbucketBasicAuth() {
-    const email = process.env.BITBUCKET_USER_EMAIL;
-    const token = process.env.BITBUCKET_API_TOKEN;
+    const email = getCredential('BITBUCKET_USER_EMAIL');
+    const token = getCredential('BITBUCKET_API_TOKEN');
     if (!email || !token) {
         throw new Error('Missing BITBUCKET_USER_EMAIL or BITBUCKET_API_TOKEN');
     }
@@ -150,14 +151,14 @@ export function registerIntegrationTools(server) {
             .describe('Include unified diff in response'),
     }, async ({ input, workspace, repoSlug, includeDiff }) => {
         try {
-            const bbEmail = process.env.BITBUCKET_USER_EMAIL;
-            const bbToken = process.env.BITBUCKET_API_TOKEN;
+            const bbEmail = getCredential('BITBUCKET_USER_EMAIL');
+            const bbToken = getCredential('BITBUCKET_API_TOKEN');
             if (!bbEmail || !bbToken) {
                 return {
                     content: [
                         {
                             type: 'text',
-                            text: `❌ Missing BITBUCKET_USER_EMAIL or BITBUCKET_API_TOKEN. Create an API token at id.atlassian.com/manage-profile/security/api-tokens.`,
+                            text: `❌ Missing BITBUCKET_USER_EMAIL or BITBUCKET_API_TOKEN. Set them in ~/.claude/agent-kit or as environment variables.`,
                         },
                     ],
                 };
@@ -174,7 +175,7 @@ export function registerIntegrationTools(server) {
             }
             else if (input.match(/^\d+$/)) {
                 prId = parseInt(input, 10);
-                ws = workspace || process.env.BITBUCKET_DEFAULT_WORKSPACE;
+                ws = workspace || getCredential('BITBUCKET_DEFAULT_WORKSPACE');
                 repo = repoSlug;
             }
             if (!ws) {
@@ -242,9 +243,9 @@ ${pr.description || 'No description'}`;
         ticketId: z.string().describe('Jira ticket ID (e.g., PROJ-123)'),
     }, async ({ ticketId }) => {
         try {
-            const cloudId = process.env.ATLASSIAN_CLOUD_ID;
-            const userEmail = process.env.ATLASSIAN_USER_EMAIL;
-            const apiToken = process.env.ATLASSIAN_API_TOKEN;
+            const cloudId = getCredential('ATLASSIAN_CLOUD_ID');
+            const userEmail = getCredential('ATLASSIAN_USER_EMAIL');
+            const apiToken = getCredential('ATLASSIAN_API_TOKEN');
             if (!cloudId || !userEmail || !apiToken) {
                 const missing = [
                     !cloudId && 'ATLASSIAN_CLOUD_ID',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanhnd/agent-kit",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "Super Engineer - Team of AI Agents for software development (Claude Code Plugin)",
   "type": "module",
   "main": "dist/kit-server.js",