@kolatts/pncli 5.3.0 → 5.4.0

package/dist/cli.js

@@ -1,16 +1,34 @@
 #!/usr/bin/env node
 import {
+  KeychainBatchError,
+  KeychainError,
+  accountForPath,
+  accountFromRef,
   assertValidCustomFields,
+  defaultRunner,
+  findKeychainRefs,
+  findPlaintextSecrets,
   getGlobalConfigPath,
+  getKeychainBackend,
+  getUnresolvedKeychainRefs,
+  isKeychainRef,
+  keychainRef,
   loadConfig,
   loadJsonFile,
   maskConfig,
   normalizeBaseUrl,
+  purgeEntries,
+  resetKeychainCache,
+  resolveKeychainRefs,
+  resolveSecretValue,
+  setAtPath,
   setConfigValue,
   setRepoConfigValue,
+  storeVerified,
+  windowsListCredentials,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-QHJ2HM5J.js";
+} from "./chunk-L6OY2546.js";
 import {
   createHttpClient,
   validateAlationAccessToken
@@ -447,34 +465,34 @@ function parseAdoRemote(remoteUrl, adoBaseUrl) {
   } catch {
     baseHostname = adoBaseUrl.replace(/\/$/, "").replace(/^https?:\/\//, "").split(/[:/]/)[0].toLowerCase();
   }
-  let path11 = remoteUrl;
+  let path14 = remoteUrl;
   let remoteHostname = "";
-  const sshProtoMatch = path11.match(/^ssh:\/\/[^@]*@?([^/:]+)(?::\d+)?(.*)/);
+  const sshProtoMatch = path14.match(/^ssh:\/\/[^@]*@?([^/:]+)(?::\d+)?(.*)/);
   if (sshProtoMatch) {
     remoteHostname = sshProtoMatch[1].toLowerCase();
-    path11 = sshProtoMatch[2];
+    path14 = sshProtoMatch[2];
   } else {
-    const gitAtMatch = path11.match(/^git@([^:]+)(?::\d+)?:(.*)/);
+    const gitAtMatch = path14.match(/^git@([^:]+)(?::\d+)?:(.*)/);
     if (gitAtMatch) {
       remoteHostname = gitAtMatch[1].toLowerCase();
-      path11 = "/" + gitAtMatch[2];
+      path14 = "/" + gitAtMatch[2];
     } else {
-      const httpsMatch = path11.match(/^https?:\/\/([^/:]+)(?::\d+)?(.*)/);
+      const httpsMatch = path14.match(/^https?:\/\/([^/:]+)(?::\d+)?(.*)/);
       if (httpsMatch) {
         remoteHostname = httpsMatch[1].toLowerCase();
-        path11 = httpsMatch[2];
+        path14 = httpsMatch[2];
       }
     }
   }
   if (!remoteHostname || remoteHostname !== baseHostname) return null;
-  path11 = path11.replace(/\.git$/, "");
-  const gitIdx = path11.indexOf("/_git/");
-  const sshIdx = path11.indexOf("/_ssh/");
+  path14 = path14.replace(/\.git$/, "");
+  const gitIdx = path14.indexOf("/_git/");
+  const sshIdx = path14.indexOf("/_ssh/");
   const markerIdx = gitIdx !== -1 ? gitIdx : sshIdx;
   if (markerIdx === -1) return null;
-  const repo = decodeURIComponent(path11.slice(markerIdx + 6));
+  const repo = decodeURIComponent(path14.slice(markerIdx + 6));
   if (!repo) return null;
-  const before = path11.slice(1, markerIdx);
+  const before = path14.slice(1, markerIdx);
   const parts = before.split("/").filter(Boolean);
   if (parts.length < 2) return null;
   const project = decodeURIComponent(parts[parts.length - 1]);
@@ -817,7 +835,936 @@ var BitbucketClient = class {
   }
 };
 
+// src/services/git/credentials.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+// src/services/skills/git-auth.ts
+import { execFileSync as execFileSync2, spawnSync } from "child_process";
+var HELPER_COMMAND = "!pncli skills git-credential";
+var HELPER_NAME_PATTERN = /^[^'\r\n]+$/;
+function helperCommandFor(marketplaceName, configPath) {
+  let command = HELPER_COMMAND;
+  if (configPath !== void 0) {
+    if (!HELPER_NAME_PATTERN.test(configPath)) {
+      throw new Error(`Config path ${JSON.stringify(configPath)} cannot be used in a git credential helper (no quotes or newlines).`);
+    }
+    command += ` --config '${configPath}'`;
+  }
+  if (marketplaceName === void 0) return command;
+  if (!HELPER_NAME_PATTERN.test(marketplaceName)) {
+    throw new Error(`Marketplace name ${JSON.stringify(marketplaceName)} cannot be used in a git credential helper (no quotes or newlines). Re-add it with a simpler --name.`);
+  }
+  return `${command} --marketplace '${marketplaceName}'`;
+}
+function isPncliHelperValue(value) {
+  return value.trim().startsWith(HELPER_COMMAND);
+}
+function helperConfigKey(scope) {
+  return `credential.${scope}.helper`;
+}
+function useHttpPathKey(scope) {
+  return `credential.${scope}.useHttpPath`;
+}
+function gitUsernameForHost(host) {
+  return host === "github.com" ? "x-access-token" : "x-token-auth";
+}
+function gitHostFromApiBaseUrl(baseUrl) {
+  if (!baseUrl) return null;
+  try {
+    const host = new URL(baseUrl).host.toLowerCase();
+    return host === "api.github.com" ? "github.com" : host;
+  } catch {
+    return null;
+  }
+}
+function apiBaseForHost(host, githubBaseUrl) {
+  if (host === "github.com") return "https://api.github.com";
+  if (githubBaseUrl && gitHostFromApiBaseUrl(githubBaseUrl) === host) return githubBaseUrl.replace(/\/+$/, "");
+  return `https://${host}/api/v3`;
+}
+function hostOf(url) {
+  if (!url) return null;
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" ? u.host.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+function httpHostOf(url) {
+  if (!url) return null;
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" || u.protocol === "http:" ? u.host.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+function hostnameOf(url) {
+  if (!url) return null;
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function normalizeRepoPath(p) {
+  return p.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "").toLowerCase();
+}
+function classifyGitHubToken(token) {
+  if (token.startsWith("ghp_")) return "classic";
+  if (token.startsWith("github_pat_")) return "fine-grained";
+  if (token.startsWith("gho_")) return "oauth";
+  if (token.startsWith("ghu_") || token.startsWith("ghs_")) return "github-app";
+  if (/^[0-9a-f]{40}$/i.test(token)) return "legacy-hex";
+  return "unknown";
+}
+function allMarketplaces(globalConfig) {
+  return [...globalConfig.marketplaces ?? [], ...globalConfig.marketplace ? [globalConfig.marketplace] : []];
+}
+var PROVIDERS = ["github", "bitbucket", "ado", "git"];
+function detectProvider(repoUrl, cfg, explicit) {
+  if (explicit && PROVIDERS.includes(explicit)) return explicit;
+  const hostname = hostnameOf(repoUrl);
+  if (!hostname) return "git";
+  const path14 = (() => {
+    try {
+      return new URL(repoUrl).pathname;
+    } catch {
+      return "";
+    }
+  })();
+  const githubHost = hostnameOf(cfg.github?.baseUrl);
+  if (hostname === "github.com" || githubHost && (hostname === githubHost || githubHost === `api.${hostname}`)) return "github";
+  if (hostname === hostnameOf(cfg.ado?.baseUrl) || /\/_git\//.test(path14) || hostname === "dev.azure.com" || hostname.endsWith(".visualstudio.com")) return "ado";
+  if (hostname === hostnameOf(cfg.bitbucket?.baseUrl) || /(^|\/)scm\//.test(path14) || hostname === "bitbucket.org") return "bitbucket";
+  return "git";
+}
+function providerFallbackToken(provider, repoUrl, cfg) {
+  const hostname = hostnameOf(repoUrl);
+  if (!hostname) return null;
+  if (provider === "github") {
+    const githubHost = hostnameOf(cfg.github?.baseUrl);
+    const isGitHubHost2 = hostname === "github.com" || !!githubHost && githubHost === hostname;
+    return isGitHubHost2 && cfg.github?.token ? { token: cfg.github.token, source: "github.token" } : null;
+  }
+  if (provider === "bitbucket") {
+    return hostname === hostnameOf(cfg.bitbucket?.baseUrl) && cfg.bitbucket?.pat ? { token: cfg.bitbucket.pat, source: "bitbucket.pat" } : null;
+  }
+  if (provider === "ado") {
+    return hostname === hostnameOf(cfg.ado?.baseUrl) && cfg.ado?.pat ? { token: cfg.ado.pat, source: "ado.pat" } : null;
+  }
+  return null;
+}
+var UnresolvedMarketplaceTokenError = class extends Error {
+};
+function marketplaceLabelOf(m) {
+  return m.name ?? m.repoUrl ?? "(unnamed)";
+}
+function resolveMarketplaceAuth(m, cfg, resolveSecret = resolveSecretValue) {
+  const host = httpHostOf(m.repoUrl);
+  if (!host) return null;
+  const provider = detectProvider(m.repoUrl, cfg, m.provider);
+  const username = m.username || gitUsernameForHost(host);
+  if (m.token) {
+    const secret = resolveSecret(m.token);
+    if (!secret && isKeychainRef(m.token)) {
+      throw new UnresolvedMarketplaceTokenError(`The token for marketplace "${marketplaceLabelOf(m)}" is stored in the OS keychain as "${m.token}", but it could not be read. Check with: pncli config keychain status`);
+    }
+    if (secret) return { username, password: secret, source: `marketplace:${marketplaceLabelOf(m)}`, provider };
+  }
+  const fallback = providerFallbackToken(provider, m.repoUrl, cfg);
+  return fallback ? { username, password: fallback.token, source: fallback.source, provider } : null;
+}
+function parseCredentialRequest(input3) {
+  const out = {};
+  for (const line of input3.split(/\r?\n/)) {
+    if (line === "") break;
+    const eq = line.indexOf("=");
+    if (eq > 0) out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
+function resolveCredential(request, globalConfig, cfg, resolveSecret = resolveSecretValue, marketplaceName) {
+  if (request.protocol !== "https" || !request.host) return null;
+  const host = request.host.toLowerCase().replace(/:443$/, "");
+  const marketplaces = allMarketplaces(globalConfig).filter((m) => hostOf(m.repoUrl) === host);
+  if (marketplaceName !== void 0) {
+    const m = marketplaces.find((x) => x.name === marketplaceName || x.repoUrl === marketplaceName);
+    if (!m) return null;
+    const auth = resolveMarketplaceAuth(m, cfg, resolveSecret);
+    return auth ? { username: auth.username, password: auth.password, source: auth.source } : null;
+  }
+  if (request.path) {
+    const wanted = normalizeRepoPath(request.path);
+    const exact = marketplaces.find((m) => normalizeRepoPath(new URL(m.repoUrl).pathname) === wanted);
+    if (exact) {
+      const auth = resolveMarketplaceAuth(exact, cfg, resolveSecret);
+      if (auth) return { username: auth.username, password: auth.password, source: auth.source };
+    }
+  }
+  const url = `https://${host}/`;
+  for (const provider of ["github", "bitbucket", "ado"]) {
+    const fallback = providerFallbackToken(provider, url, cfg);
+    if (fallback) return { username: gitUsernameForHost(host), password: fallback.token, source: fallback.source };
+  }
+  return null;
+}
+function formatCredentialAnswer(answer) {
+  return `username=${answer.username}
+password=${answer.password}
+`;
+}
+function parseScope(scope) {
+  const u = new URL(scope);
+  const path14 = u.pathname.replace(/^\/+/, "");
+  return { scope, host: u.host.toLowerCase(), path: path14 || null };
+}
+function hostScope(host) {
+  return `https://${host}`;
+}
+function marketplaceScopes(repoUrl, provider) {
+  const u = new URL(repoUrl);
+  u.username = "";
+  u.password = "";
+  u.search = "";
+  u.hash = "";
+  const base = `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
+  if (provider === "ado") return [base];
+  const toggled = /\.git$/i.test(base) ? base.replace(/\.git$/i, "") : `${base}.git`;
+  return [base, toggled];
+}
+var defaultGitRunner = (args, opts) => {
+  const r = spawnSync("git", args, {
+    input: opts?.input,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: opts?.timeoutMs ?? 3e4,
+    env: { ...process.env, ...opts?.env }
+  });
+  if (r.error) throw r.error;
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+var NON_INTERACTIVE_ENV = {
+  GIT_TERMINAL_PROMPT: "0",
+  GCM_INTERACTIVE: "never",
+  GIT_ASKPASS: "",
+  SSH_ASKPASS: ""
+};
+function readHelperEntries(scope, git = defaultGitRunner) {
+  const r = git(["config", "--global", "--get-all", helperConfigKey(scope)]);
+  return r.status === 0 ? r.stdout.split(/\r?\n/).filter((l, i, a) => i < a.length - 1 || l !== "") : [];
+}
+function readGlobalHelpers(git = defaultGitRunner) {
+  const r = git(["config", "--get-all", "credential.helper"]);
+  return r.status === 0 ? r.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean) : [];
+}
+function readUseHttpPath(scope, git) {
+  const r = git(["config", "--global", "--get", useHttpPathKey(scope)]);
+  return r.status === 0 ? r.stdout.trim() : null;
+}
+function afterLastReset(entries) {
+  const own = entries.filter((e) => !isPncliHelperValue(e));
+  return own.slice(own.lastIndexOf("") + 1).filter((e) => e.trim() !== "");
+}
+function effectiveFallbackHelpers(scopeEntries, genericHelpers, hostEntries = []) {
+  for (const entries of [scopeEntries, hostEntries]) {
+    if (entries.some((e) => !isPncliHelperValue(e))) return afterLastReset(entries);
+  }
+  return genericHelpers.filter((h) => h.trim() !== "" && !isPncliHelperValue(h));
+}
+function enableHelper(scope, helperValue, git = defaultGitRunner) {
+  const { host, path: path14 } = parseScope(scope);
+  const previousHelpers = readHelperEntries(scope, git).filter((e) => !isPncliHelperValue(e));
+  const previousUseHttpPath = readUseHttpPath(scope, git);
+  const hostEntries = path14 ? readHelperEntries(hostScope(host), git) : [];
+  const fallbacks = effectiveFallbackHelpers(previousHelpers, readGlobalHelpers(git), hostEntries);
+  git(["config", "--global", "--unset-all", helperConfigKey(scope)]);
+  for (const value of ["", helperValue, ...fallbacks]) {
+    const r = git(["config", "--global", "--add", helperConfigKey(scope), value]);
+    if (r.status !== 0) throw new Error(`git config failed: ${r.stderr.trim()}`);
+  }
+  return { previousHelpers, previousUseHttpPath };
+}
+function restoreUseHttpPath(scope, previous, git) {
+  if (previous === null) git(["config", "--global", "--unset", useHttpPathKey(scope)]);
+  else git(["config", "--global", useHttpPathKey(scope), previous]);
+}
+function disableHelper(scope, backup, git = defaultGitRunner) {
+  const current = readHelperEntries(scope, git);
+  if (!current.some(isPncliHelperValue)) return false;
+  const restore = backup ? backup.previousHelpers : current.slice(current.findIndex(isPncliHelperValue) + 1);
+  git(["config", "--global", "--unset-all", helperConfigKey(scope)]);
+  for (const value of restore) git(["config", "--global", "--add", helperConfigKey(scope), value]);
+  if (backup) restoreUseHttpPath(scope, backup.previousUseHttpPath, git);
+  return true;
+}
+function inlineCredentialArgs(username, token) {
+  const helper = `credential.helper=!f() { test "$1" = get || exit 0; printf '%s\\n' "username=$PNCLI_GIT_USERNAME" "password=$PNCLI_GIT_PASSWORD"; }; f`;
+  return {
+    args: ["-c", "credential.helper=", "-c", helper],
+    env: { PNCLI_GIT_USERNAME: username, PNCLI_GIT_PASSWORD: token }
+  };
+}
+function credentialInput(host, fields = {}) {
+  return Object.entries({ protocol: "https", host, ...fields }).map(([k, v]) => `${k}=${v}`).join("\n") + "\n\n";
+}
+function keychainStore(scope, username, token, git = defaultGitRunner) {
+  const helpers = readGlobalHelpers(git);
+  if (helpers.length === 0) {
+    throw new Error(
+      "git has no credential.helper configured, so there is no OS keychain to store into. Configure one first \u2014 Windows: `git config --global credential.helper manager` (ships with Git for Windows); macOS: `git config --global credential.helper osxkeychain`; Linux: git-credential-libsecret. Or use --mode helper, which needs no keychain."
+    );
+  }
+  const { host, path: path14 } = parseScope(scope);
+  const backup = { previousHelpers: [], previousUseHttpPath: readUseHttpPath(scope, git) };
+  if (path14) git(["config", "--global", useHttpPathKey(scope), "true"]);
+  const r = git(["credential", "approve"], { input: credentialInput(host, { ...path14 ? { path: path14 } : {}, username, password: token }), env: NON_INTERACTIVE_ENV });
+  if (r.status !== 0) {
+    if (path14) restoreUseHttpPath(scope, backup.previousUseHttpPath, git);
+    throw new Error(`git credential approve failed: ${r.stderr.trim()}`);
+  }
+  return { helpers, plaintextStore: helpers.some((h) => /^store\b/.test(h)), backup };
+}
+function keychainErase(scope, username, git = defaultGitRunner) {
+  const { host, path: path14 } = parseScope(scope);
+  git(["credential", "reject"], { input: credentialInput(host, { ...path14 ? { path: path14 } : {}, username }), env: NON_INTERACTIVE_ENV });
+}
+function disableScope(scope, record, forgetKeychain, git = defaultGitRunner) {
+  const backup = record ? { previousHelpers: record.previousHelpers ?? [], previousUseHttpPath: record.previousUseHttpPath ?? null } : void 0;
+  const helperRemoved = disableHelper(scope, record?.mode === "helper" ? backup : void 0, git);
+  let keychainErased = false;
+  if (record?.mode === "keychain") {
+    if (forgetKeychain) {
+      keychainErase(scope, record.username ?? gitUsernameForHost(parseScope(scope).host), git);
+      keychainErased = true;
+    }
+    keychainRestoreScope(scope, backup, git);
+  }
+  return { helperRemoved, keychainErased };
+}
+function keychainRestoreScope(scope, backup, git = defaultGitRunner) {
+  if (parseScope(scope).path) restoreUseHttpPath(scope, backup.previousUseHttpPath, git);
+}
+function credentialFill(host, path14, git = defaultGitRunner) {
+  try {
+    const r = git(["credential", "fill"], { input: credentialInput(host, path14 ? { path: path14 } : {}), env: NON_INTERACTIVE_ENV });
+    if (r.status !== 0) return null;
+    const parsed = parseCredentialRequest(r.stdout);
+    return parsed.password ? { username: parsed.username ?? "", password: parsed.password } : null;
+  } catch {
+    return null;
+  }
+}
+function lsRemote(repoUrl, auth, git = defaultGitRunner, opts = {}) {
+  const inline = auth ? inlineCredentialArgs(auth.username, auth.password) : { args: opts.keepHelpers ? [] : ["-c", "credential.helper="], env: {} };
+  try {
+    const r = git([...inline.args, "ls-remote", "--heads", repoUrl], { env: { ...NON_INTERACTIVE_ENV, ...inline.env }, timeoutMs: 2e4 });
+    if (r.status === 0) return { ok: true, error: null };
+    const scrub2 = (s) => auth ? s.split(auth.password).join("***") : s;
+    return { ok: false, error: scrub2(r.stderr.trim().split(/\r?\n/).slice(-2).join(" ")) || `git exited with ${r.status}` };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function originHasCredentials(repoPath) {
+  try {
+    const url = execFileSync2("git", ["-C", repoPath, "remote", "get-url", "origin"], { encoding: "utf8", stdio: "pipe" }).trim();
+    const u = new URL(url);
+    return !!u.password;
+  } catch {
+    return false;
+  }
+}
+async function inspectGitHubToken(apiBase, token, fetchFn = fetch, now = /* @__PURE__ */ new Date()) {
+  const kind = classifyGitHubToken(token);
+  const base = {
+    kind,
+    status: null,
+    valid: false,
+    login: null,
+    scopes: null,
+    missingRepoScope: false,
+    expiresAt: null,
+    expiresInDays: null,
+    ssoAuthorizationRequired: false,
+    error: null
+  };
+  let res;
+  try {
+    res = await fetchFn(`${apiBase.replace(/\/+$/, "")}/user`, {
+      headers: { Authorization: `token ${token}`, Accept: "application/vnd.github+json", "User-Agent": "pncli" },
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (err) {
+    return { ...base, error: err instanceof Error ? err.message : String(err) };
+  }
+  const scopesHeader = res.headers.get("x-oauth-scopes");
+  const scopes = scopesHeader === null ? null : scopesHeader.split(",").map((s) => s.trim()).filter(Boolean);
+  const expiryHeader = res.headers.get("github-authentication-token-expiration");
+  let expiresAt = null;
+  let expiresInDays = null;
+  if (expiryHeader) {
+    const t = Date.parse(expiryHeader.replace(/ UTC$/, "Z").replace(" ", "T").replace(" ", ""));
+    if (!Number.isNaN(t)) {
+      expiresAt = new Date(t).toISOString();
+      expiresInDays = Math.floor((t - now.getTime()) / 864e5);
+    }
+  }
+  let login = null;
+  if (res.ok) {
+    try {
+      login = (await res.json()).login ?? null;
+    } catch {
+    }
+  }
+  const classicLike = kind === "classic" || kind === "legacy-hex";
+  return {
+    ...base,
+    status: res.status,
+    valid: res.ok,
+    login,
+    scopes,
+    missingRepoScope: res.ok && classicLike && scopes !== null && !scopes.includes("repo"),
+    expiresAt,
+    expiresInDays,
+    ssoAuthorizationRequired: res.status === 403 && res.headers.has("x-github-sso"),
+    error: res.ok ? null : `GET /user returned HTTP ${res.status}`
+  };
+}
+
+// src/services/git/credentials.ts
+function fingerprint(token) {
+  const prefix = /^(github_pat_|gh[pousr]_)/.exec(token)?.[1] ?? "";
+  return token.length <= 8 ? "\u2026" : `${prefix}\u2026${token.slice(-4)}`;
+}
+function looksLikeToken(value) {
+  return /^(github_pat_|gh[pousr]_)/.test(value) || /^[0-9a-f]{40}$/i.test(value) || value.length >= 30 && !/[@\s]/.test(value);
+}
+function tokenFromUrl(url) {
+  try {
+    const u = new URL(url);
+    const user = decodeURIComponent(u.username);
+    const pass = decodeURIComponent(u.password);
+    if (pass) return { username: user, token: pass };
+    if (user && looksLikeToken(user)) return { username: "", token: user };
+    return null;
+  } catch {
+    return null;
+  }
+}
+function redactUrl(url) {
+  try {
+    const u = new URL(url);
+    if (!u.username && !u.password) return url;
+    const found = tokenFromUrl(url);
+    const shown = found ? found.username ? `${found.username}:${fingerprint(found.token)}` : fingerprint(found.token) : "***";
+    return `${u.protocol}//${shown}@${u.host}${u.pathname}${u.search}`;
+  } catch {
+    return url.replace(/\/\/[^/@]+@/, "//***@");
+  }
+}
+function redactSecrets(text) {
+  return text.replace(/(github_pat_|gh[pousr]_)[A-Za-z0-9_]{8,}/g, (m) => fingerprint(m)).replace(/\b[0-9a-f]{40}\b/gi, (m) => fingerprint(m)).replace(/(password=)([^\s;'"]+)/gi, (m, k, v) => v.includes("\u2026") ? m : `${k}${fingerprint(v)}`).replace(/(\/\/)([^/@\s:]+):([^/@\s]+)@/g, (_m, s, u, p) => `${s}${u}:${fingerprint(p)}@`);
+}
+function scrub(text, secret) {
+  return secret ? text.split(secret).join(fingerprint(secret)) : text;
+}
+function parseInsteadOf(output) {
+  const mappings = [];
+  for (const line of output.split(/\r?\n/)) {
+    const m = /^url\.(.+)\.insteadof (.+)$/i.exec(line.trim());
+    if (m) mappings.push({ from: m[2], to: redactUrl(m[1]), rawTo: m[1] });
+  }
+  return mappings;
+}
+function matchMapping(url, mappings) {
+  let best = null;
+  for (const m of mappings) {
+    if (url.startsWith(m.from) && (!best || m.from.length > best.from.length)) best = m;
+  }
+  return best;
+}
+function parseScopedHelpers(output) {
+  const out = [];
+  for (const line of output.split(/\r?\n/)) {
+    const m = /^credential\.(.+)\.helper(?: (.*))?$/i.exec(line.trim());
+    if (m) out.push({ scope: m[1], helper: m[2] ?? "" });
+  }
+  return out;
+}
+function githubRepoSlug(url) {
+  try {
+    const parts = new URL(url).pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+    return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : null;
+  } catch {
+    return null;
+  }
+}
+async function checkGitHubRepoAccess(apiBase, slug, token, fetchFn = fetch) {
+  try {
+    const res = await fetchFn(`${apiBase.replace(/\/+$/, "")}/repos/${slug}`, {
+      headers: { Authorization: `token ${token}`, Accept: "application/vnd.github+json", "User-Agent": "pncli" },
+      signal: AbortSignal.timeout(1e4)
+    });
+    return {
+      status: res.status,
+      canRead: res.ok,
+      ssoAuthorizationRequired: res.status === 403 && res.headers.has("x-github-sso"),
+      error: res.ok ? null : `GET /repos/${slug} returned HTTP ${res.status}`
+    };
+  } catch (err) {
+    return { status: null, canRead: false, ssoAuthorizationRequired: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function gitIn(cwd, git) {
+  return cwd ? (args, opts) => git(["-C", cwd, ...args], opts) : git;
+}
+async function inspectRemoteAuth(remote, url, cwd, cfg, deps = {}) {
+  const baseGit = deps.git ?? defaultGitRunner;
+  const git = gitIn(cwd, baseGit);
+  const fetchFn = deps.fetchFn ?? fetch;
+  const effRaw = (() => {
+    const r = git(["ls-remote", "--get-url", url]);
+    return r.status === 0 && r.stdout.trim() ? r.stdout.trim() : url;
+  })();
+  const mappingRaw = matchMapping(url, parseInsteadOf(git(["config", "--get-regexp", "^url\\..*\\.insteadof$"]).stdout));
+  let host = null;
+  let repoPath = null;
+  try {
+    const u = new URL(effRaw);
+    if (u.protocol === "https:" || u.protocol === "http:") {
+      host = u.host.toLowerCase();
+      repoPath = u.pathname.replace(/^\/+/, "");
+    }
+  } catch {
+  }
+  const plainEffective = (() => {
+    try {
+      const u = new URL(effRaw);
+      u.username = "";
+      u.password = "";
+      return u.toString();
+    } catch {
+      return effRaw;
+    }
+  })();
+  const provider = detectProvider(plainEffective, cfg);
+  let source = "none";
+  let credential = null;
+  let helper = null;
+  const embedded = tokenFromUrl(effRaw);
+  if (embedded) {
+    credential = embedded;
+    source = mappingRaw && tokenFromUrl(mappingRaw.rawTo) ? "insteadOf" : "url";
+  } else if (host) {
+    const filled = credentialFill(host, repoPath ?? void 0, git);
+    if (filled) {
+      credential = { username: filled.username, token: filled.password };
+      source = "helper";
+      const h = git(["config", "--get-urlmatch", "credential.helper", plainEffective]);
+      helper = h.status === 0 ? redactSecrets(h.stdout.trim().split(/\r?\n/).pop() ?? "") || null : null;
+    }
+  }
+  const report = {
+    remote,
+    url: redactUrl(url),
+    effectiveUrl: redactUrl(effRaw),
+    host,
+    provider,
+    mapping: mappingRaw ? { from: mappingRaw.from, to: mappingRaw.to } : null,
+    credentialSource: source,
+    helper,
+    helperKind: helper ? classifyHelper(helper) : null,
+    credentialStore: helper && classifyHelper(helper) === "git-credential-manager" ? gcmCredentialStore(git) : null,
+    token: credential ? { kind: provider === "github" ? classifyGitHubToken(credential.token) : "unknown", fingerprint: fingerprint(credential.token), username: credential.username || null } : null,
+    access: null,
+    github: null,
+    problems: []
+  };
+  if (host && !deps.offline) {
+    const auth = source === "helper" && credential ? { username: credential.username, password: credential.token } : null;
+    const r = lsRemote(remote && cwd ? remote : source === "helper" ? plainEffective : url, auth, git);
+    report.access = { ok: r.ok, error: r.error ? scrub(r.error, credential?.token ?? null) : null };
+    if (provider === "github" && credential) {
+      const apiBase = apiBaseForHost(host, cfg.github?.baseUrl);
+      const key = `${apiBase}\0${credential.token}`;
+      if (!deps.cache?.has(key)) deps.cache?.set(key, await inspectGitHubToken(apiBase, credential.token, fetchFn));
+      const tokenInfo = deps.cache?.get(key) ?? await inspectGitHubToken(apiBase, credential.token, fetchFn);
+      const slug = githubRepoSlug(plainEffective);
+      const repo = slug && tokenInfo.valid ? await checkGitHubRepoAccess(apiBase, slug, credential.token, fetchFn) : null;
+      report.github = { token: tokenInfo, repo };
+    }
+  }
+  report.problems = buildRemoteProblems(report, url);
+  return report;
+}
+function buildRemoteProblems(r, originalUrl) {
+  const problems = [];
+  const where = r.credentialSource === "insteadOf" && r.mapping ? `the insteadOf mapping for ${r.mapping.from}` : r.credentialSource === "url" ? "the remote URL" : r.credentialSource === "helper" ? `the credential helper (${r.helper ?? "unknown"})` : "nothing";
+  const org = (() => {
+    try {
+      const u = new URL(originalUrl);
+      return `${u.protocol}//${u.host}/${u.pathname.split("/").filter(Boolean)[0] ?? ""}/`;
+    } catch {
+      return originalUrl;
+    }
+  })();
+  if (!r.host) return problems;
+  if (r.credentialSource === "url") {
+    problems.push({
+      message: "The token is embedded in the remote URL, so it sits in plaintext in this clone's .git/config",
+      fix: `Move it to a mapping or helper and reset the remote: git remote set-url ${r.remote ?? "origin"} ${r.url.replace(/\/\/[^@]+@/, "//")}`
+    });
+  }
+  if (r.access && !r.access.ok) {
+    if (r.credentialSource === "none") {
+      problems.push({
+        message: `No credential is mapped for ${r.effectiveUrl} \u2014 git reached it anonymously and was refused (${r.access.error})`,
+        fix: r.provider === "github" ? `Map a token for the org: git config --global url."https://<classic-PAT>@${r.host}/${org.split("/").slice(3).join("/")}".insteadOf "${org}"  \u2014 or let pncli answer with github.token: pncli skills git-auth enable --host ${r.host}` : `Give git a credential for ${r.host} (a credential helper, or pncli skills git-auth enable --host ${r.host})`
+      });
+    } else if (!r.github) {
+      problems.push({
+        message: `The credential from ${where} (${r.token?.fingerprint}) cannot read ${r.effectiveUrl}: ${r.access.error}`,
+        fix: "Check the token has not expired and its account can read this repo; replace it where it is mapped"
+      });
+    }
+  }
+  const g = r.github;
+  if (g) {
+    const t = g.token;
+    const who = `The token from ${where} (${r.token?.fingerprint}${t.login ? `, ${t.login}` : ""})`;
+    if (t.status === 401) problems.push({ message: `${who} was rejected \u2014 expired or revoked`, fix: "Generate a new token and replace it where it is mapped" });
+    if (t.ssoAuthorizationRequired || g.repo?.ssoAuthorizationRequired) {
+      problems.push({ message: `${who} is not authorized for the organization's SAML SSO`, fix: "GitHub \u2192 Settings \u2192 Developer settings \u2192 Personal access tokens \u2192 Configure SSO \u2192 Authorize for the org" });
+    }
+    if (t.missingRepoScope) problems.push({ message: `${who} is a classic token without the "repo" scope, so it cannot read private repositories`, fix: 'Edit the token (Settings \u2192 Developer settings \u2192 Tokens (classic)) and tick "repo"' });
+    if (g.repo && !g.repo.canRead && !g.repo.ssoAuthorizationRequired && t.valid) {
+      problems.push({
+        message: `${who} is valid but cannot see ${githubRepoSlug(r.effectiveUrl.replace(/\/\/[^@]+@/, "//"))} (HTTP ${g.repo.status})`,
+        fix: r.token?.kind === "fine-grained" ? "Add this repository to the fine-grained token's repository access, or map a different token for it" : "The token's account needs access to this repo (or the org may block classic tokens); map a token from an account that has access"
+      });
+    }
+    if (t.expiresInDays !== null && t.expiresInDays <= 14) {
+      problems.push({ message: t.expiresInDays < 0 ? `${who} expired on ${t.expiresAt}` : `${who} expires in ${t.expiresInDays} day(s)`, fix: "Regenerate it and replace it where it is mapped" });
+    }
+  }
+  return problems;
+}
+function listRemotes(cwd, git = defaultGitRunner) {
+  const r = git(["-C", cwd, "config", "--get-regexp", "^remote\\..*\\.url$"]);
+  if (r.status !== 0) return [];
+  return r.stdout.split(/\r?\n/).map((l) => /^remote\.(.+)\.url (.+)$/.exec(l.trim())).filter((m) => !!m).map((m) => [m[1], m[2]]);
+}
+function findClones(root, depth) {
+  const found = [];
+  const walk = (dir, level) => {
+    if (fs.existsSync(path.join(dir, ".git"))) {
+      found.push(dir);
+      return;
+    }
+    if (level >= depth) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules") walk(path.join(dir, e.name), level + 1);
+    }
+  };
+  walk(path.resolve(root), 0);
+  return found;
+}
+async function listMappings(cwd, cfg, deps = {}) {
+  const git = gitIn(cwd, deps.git ?? defaultGitRunner);
+  const fetchFn = deps.fetchFn ?? fetch;
+  const reports = [];
+  for (const m of parseInsteadOf(git(["config", "--get-regexp", "^url\\..*\\.insteadof$"]).stdout)) {
+    const embedded = tokenFromUrl(m.rawTo);
+    let host = null;
+    try {
+      host = new URL(m.rawTo).host.toLowerCase();
+    } catch {
+    }
+    const provider = detectProvider(m.rawTo.replace(/\/\/[^@]+@/, "//"), cfg);
+    let github = null;
+    if (embedded && host && provider === "github" && !deps.offline) {
+      github = await inspectGitHubToken(apiBaseForHost(host, cfg.github?.baseUrl), embedded.token, fetchFn);
+    }
+    reports.push({
+      kind: "insteadOf",
+      from: m.from,
+      to: m.to,
+      token: embedded ? { kind: provider === "github" ? classifyGitHubToken(embedded.token) : "unknown", fingerprint: fingerprint(embedded.token) } : null,
+      github
+    });
+  }
+  for (const h of parseScopedHelpers(git(["config", "--get-regexp", "^credential\\..*\\.helper$"]).stdout)) {
+    reports.push({ kind: "helper", from: h.scope, to: redactSecrets(h.helper), token: null, github: null });
+  }
+  return reports;
+}
+function classifyHelper(helper) {
+  const h = helper.trim().replace(/^!/, "").replace(/['"]/g, "").replace(/\\/g, "/");
+  const exe = h.split(/\s+(?=[a-z-]+(\s|$))/i)[0].split("/").pop().replace(/\.exe$/i, "").toLowerCase();
+  if (/^manager(-core)?(\s|$)/.test(h) || /git-credential-manager/i.test(h)) return "git-credential-manager";
+  if (/^wincred(\s|$)/.test(h) || exe === "git-credential-wincred") return "wincred";
+  if (/^osxkeychain(\s|$)/.test(h) || exe === "git-credential-osxkeychain") return "osxkeychain";
+  if (/libsecret/i.test(h)) return "libsecret";
+  if (/^store(\s|$)/.test(h)) return "store";
+  if (/^cache(\s|$)/.test(h)) return "cache";
+  if (/(^|\/)gh(\.exe)?\s+auth\s+git-credential/i.test(h)) return "gh";
+  if (/(^|\/)pncli(\.cmd)?\s+skills\s+git-credential/i.test(h)) return "pncli";
+  return "other";
+}
+function gcmCredentialStore(git, platform = process.platform, env = process.env) {
+  const r = git(["config", "--get", "credential.credentialStore"]);
+  if (r.status === 0 && r.stdout.trim()) return r.stdout.trim();
+  if (env.GCM_CREDENTIAL_STORE) return env.GCM_CREDENTIAL_STORE;
+  return platform === "win32" ? "wincredman" : platform === "darwin" ? "keychain" : "unset";
+}
+function parseGitTarget(target) {
+  const m = /^git:(https?:\/\/.+)$/i.exec(target);
+  if (!m) return null;
+  try {
+    const u = new URL(m[1]);
+    const p = u.pathname.replace(/^\/+|\/+$/g, "");
+    return { host: u.host.toLowerCase(), path: p || null, username: u.username ? decodeURIComponent(u.username) : null };
+  } catch {
+    return null;
+  }
+}
+function parseGitCredentialsFile(content) {
+  const out = [];
+  for (const line of content.split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+    try {
+      const u = new URL(t);
+      const found = tokenFromUrl(t);
+      if (!found) continue;
+      const p = u.pathname.replace(/^\/+|\/+$/g, "");
+      out.push({ host: u.host.toLowerCase(), path: p || null, username: found.username || null, secret: found.token });
+    } catch {
+    }
+  }
+  return out;
+}
+function parseMacKeychainDump(output) {
+  const out = [];
+  for (const block of output.split(/^keychain: /m)) {
+    if (!/^class: "inet"/m.test(block)) continue;
+    const attr = (name) => new RegExp(`"${name}"<[^>]+>="([^"]*)"`).exec(block)?.[1] ?? null;
+    const protocol = attr("ptcl");
+    if (protocol && protocol !== "htps" && protocol !== "http") continue;
+    const host = attr("srvr");
+    if (!host) continue;
+    const p = attr("path");
+    out.push({ host: host.toLowerCase(), path: p ? p.replace(/^\/+/, "") || null : null, username: attr("acct") });
+  }
+  return out;
+}
+function isGitHubHost(host, cfg) {
+  return detectProvider(`https://${host}/`, cfg) === "github";
+}
+async function listStoredCredentials(hosts, cfg, deps = {}) {
+  const git = deps.git ?? defaultGitRunner;
+  const platform = deps.platform ?? process.platform;
+  const env = deps.env ?? process.env;
+  const fetchFn = deps.fetchFn ?? fetch;
+  const run = deps.run ?? defaultRunner;
+  const cache = deps.cache ?? /* @__PURE__ */ new Map();
+  const readFile2 = deps.readFile ?? ((p) => {
+    try {
+      return fs.readFileSync(p, "utf8");
+    } catch {
+      return null;
+    }
+  });
+  const home = deps.homedir ?? os.homedir();
+  const helperOut = git(["config", "--get-all", "credential.helper"]);
+  const rawHelpers = helperOut.status === 0 ? helperOut.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean) : [];
+  const kinds = [...new Set(rawHelpers.map(classifyHelper))];
+  const configured = rawHelpers.map(redactSecrets);
+  const report = {
+    helpers: { configured, kinds, gcmCredentialStore: kinds.includes("git-credential-manager") ? gcmCredentialStore(git, platform, env) : null },
+    stores: [],
+    probes: [],
+    problems: []
+  };
+  const tokenInfo = (secret, host) => ({ kind: isGitHubHost(host, cfg) ? classifyGitHubToken(secret) : "unknown", fingerprint: fingerprint(secret) });
+  if (platform === "win32") {
+    try {
+      const entries = [];
+      for (const it of windowsListCredentials("git:*", run)) {
+        const t = parseGitTarget(it.target);
+        if (!t) continue;
+        entries.push({
+          store: "windows-credential-manager",
+          host: t.host,
+          path: t.path,
+          username: it.user || t.username,
+          token: it.secret ? tokenInfo(it.secret, t.host) : null,
+          location: it.target,
+          github: null,
+          secret: it.secret || void 0
+        });
+      }
+      report.stores.push({ store: "windows-credential-manager", available: true, error: null, entries });
+    } catch (err) {
+      report.stores.push({ store: "windows-credential-manager", available: false, error: err instanceof Error ? err.message : String(err), entries: [] });
+    }
+  }
+  for (const file of [path.join(home, ".git-credentials"), path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "git", "credentials")]) {
+    const content = readFile2(file);
+    if (content === null) continue;
+    const entries = parseGitCredentialsFile(content).map((e) => ({
+      store: "git-credentials-file",
+      host: e.host,
+      path: e.path,
+      username: e.username,
+      token: tokenInfo(e.secret, e.host),
+      location: file,
+      github: null,
+      secret: e.secret
+    }));
+    report.stores.push({ store: "git-credentials-file", available: true, error: null, entries });
+  }
+  if (platform === "darwin") {
+    const r = run("security", ["dump-keychain"]);
+    if (r.status === 0) {
+      const entries = parseMacKeychainDump(r.stdout).map((e) => ({
+        store: "macos-keychain",
+        host: e.host,
+        path: e.path,
+        username: e.username,
+        token: null,
+        location: `login keychain: ${e.host}`,
+        github: null
+      }));
+      report.stores.push({ store: "macos-keychain", available: true, error: null, entries });
+    } else {
+      report.stores.push({ store: "macos-keychain", available: false, error: r.stderr.trim() || `security exited ${r.status}`, entries: [] });
+    }
+  }
+  const scopes = /* @__PURE__ */ new Map();
+  for (const h of hosts) scopes.set(h.toLowerCase(), { host: h.toLowerCase(), path: null });
+  for (const e of report.stores.flatMap((st) => st.entries)) scopes.set(e.path ? `${e.host}/${e.path}` : e.host, { host: e.host, path: e.path });
+  const probeSecrets = /* @__PURE__ */ new Map();
+  for (const [key, { host, path: p }] of [...scopes].sort(([a], [b]) => a.localeCompare(b))) {
+    const filled = credentialFill(host, p ?? void 0, git);
+    const h = git(["config", "--get-urlmatch", "credential.helper", `https://${host}/${p ?? ""}`]);
+    const rawHelper = h.status === 0 ? h.stdout.trim().split(/\r?\n/).pop() ?? null : null;
+    const helper = rawHelper ? redactSecrets(rawHelper) : null;
+    if (filled) probeSecrets.set(key, filled.password);
+    report.probes.push({
+      host,
+      path: p,
+      username: filled?.username || null,
+      token: filled ? tokenInfo(filled.password, host) : null,
+      helper,
+      helperKind: rawHelper ? classifyHelper(rawHelper) : null
+    });
+  }
+  const shadowed = [];
+  for (const store of report.stores) {
+    for (const e of store.entries) {
+      const key = e.path ? `${e.host}/${e.path}` : e.host;
+      const sent = probeSecrets.get(key);
+      const probe = report.probes.find((pr) => pr.host === e.host && pr.path === e.path);
+      const siblings = store.entries.filter((x) => x.host === e.host && x.path === e.path).map((x) => x.secret);
+      if (e.secret && sent && probe && !siblings.includes(sent)) shadowed.push({ entry: e, store: store.store, probe });
+    }
+  }
+  if (!deps.offline) {
+    for (const store of report.stores) {
+      for (const e of store.entries) {
+        if (!e.secret || !isGitHubHost(e.host, cfg)) continue;
+        const apiBase = apiBaseForHost(e.host, cfg.github?.baseUrl);
+        const key = `${apiBase}\0${e.secret}`;
+        if (!cache.has(key)) cache.set(key, await inspectGitHubToken(apiBase, e.secret, fetchFn));
+        e.github = cache.get(key);
+      }
+    }
+  }
+  report.problems = [...buildStoredProblems(report), ...shadowed.map(({ entry: e, store, probe }) => ({
+    message: `git never sends the ${store} credential for ${e.path ? `${e.host}/${e.path}` : e.host} (${e.username ?? "no username"}, ${e.token?.fingerprint}): the ${probe.helperKind ?? "configured"} helper answers first with ${probe.username ?? "no username"}, ${probe.token?.fingerprint}`,
+    fix: store === "windows-credential-manager" ? `If the stored one is obsolete, delete it: cmdkey /delete:"${e.location}"  (git credential reject would go to the ${probe.helperKind ?? "other"} helper, not to this entry). If it should win instead, remove the helper entry from your gitconfig.` : `If the stored one is obsolete, remove it from ${e.location}; if it should win, remove the ${probe.helperKind ?? "other"} helper entry from your gitconfig.`
+  }))];
+  for (const store of report.stores) for (const e of store.entries) delete e.secret;
+  return report;
+}
+function buildStoredProblems(r) {
+  const problems = [];
+  const forget = (e) => `pncli git credentials forget --host ${e.host}${e.username ? ` --username ${e.username}` : ""}${e.path ? ` --path ${e.path}` : ""}`;
+  for (const store of r.stores) {
+    for (const e of store.entries) {
+      const who = `The ${store.store} credential for ${e.host}${e.path ? `/${e.path}` : ""} (${e.username ?? "no username"}, ${e.token?.fingerprint ?? "no secret"})`;
+      const g = e.github;
+      if (g?.status === 401) {
+        problems.push({ message: `${who} is rejected by GitHub \u2014 expired or revoked. git keeps sending it until it is removed`, fix: forget(e) });
+      } else if (g && g.expiresInDays !== null && g.expiresInDays <= 14) {
+        problems.push({ message: g.expiresInDays < 0 ? `${who} expired on ${g.expiresAt}` : `${who} expires in ${g.expiresInDays} day(s)`, fix: `Replace it: ${forget(e)}, then sign in again` });
+      }
+      if (g?.missingRepoScope) problems.push({ message: `${who} is a classic token without the "repo" scope \u2014 it cannot read private repositories`, fix: `${forget(e)}, then store a token with "repo"` });
+      if (g?.ssoAuthorizationRequired) problems.push({ message: `${who} is not authorized for the organization's SAML SSO`, fix: "GitHub \u2192 Settings \u2192 Developer settings \u2192 Personal access tokens \u2192 Configure SSO \u2192 Authorize" });
+      if (store.store === "git-credentials-file") {
+        problems.push({ message: `${who} is stored in plaintext in ${e.location}`, fix: "Switch to an OS-backed helper (Windows: git config --global credential.helper manager; macOS: osxkeychain) and delete that line" });
+      }
+    }
+    const byScope = /* @__PURE__ */ new Map();
+    for (const e of store.entries) {
+      const k = e.path ? `${e.host}/${e.path}` : e.host;
+      if (!byScope.has(k)) byScope.set(k, /* @__PURE__ */ new Set());
+      byScope.get(k).add(e.username ?? "");
+    }
+    for (const [k, users] of byScope) {
+      if (users.size < 2) continue;
+      problems.push({
+        message: `${store.store} holds ${users.size} accounts for ${k} (${[...users].filter(Boolean).join(", ")}) \u2014 git may send a different one than you expect`,
+        fix: `Pin the account: git config --global credential.https://${k}.username <account>  (or remove the extra one with pncli git credentials forget)`
+      });
+    }
+  }
+  return problems;
+}
+function forgetCredential(host, opts = {}, git = defaultGitRunner) {
+  if (opts.path) {
+    const r = git(["config", "--get-urlmatch", "credential.useHttpPath", `https://${host}/${opts.path}`]);
+    if (r.status !== 0 || r.stdout.trim().toLowerCase() !== "true") {
+      throw new Error(`git ignores --path for ${host}: credential.useHttpPath is not enabled for that URL, so this would forget the host-wide credential. Omit --path to forget that deliberately.`);
+    }
+  }
+  const before = credentialFill(host, opts.path, git);
+  if (!before) return { host, before: null, after: null, removed: false };
+  const username = opts.username ?? before?.username;
+  const sameAsFilled = before && (!opts.username || opts.username === before.username);
+  const fields = [
+    "protocol=https",
+    `host=${host}`,
+    ...opts.path ? [`path=${opts.path}`] : [],
+    ...username ? [`username=${username}`] : [],
+    ...sameAsFilled ? [`password=${before.password}`] : []
+  ];
+  git(["credential", "reject"], { input: `${fields.join("\n")}
+
+`, env: { GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never" } });
+  const after = credentialFill(host, opts.path, git);
+  return {
+    host,
+    before: before ? fingerprint(before.password) : null,
+    after: after ? fingerprint(after.password) : null,
+    removed: !!before && (!after || after.password !== before.password)
+  };
+}
+
 // src/services/git/commands.ts
+import fs2 from "fs";
+import path2 from "path";
 function requireRepoRoot() {
   const root = getRepoRoot();
   if (!root) throw new PncliError("Not a git repository", 1);
@@ -915,11 +1862,136 @@ function registerGitCommands(program2) {
       fail(err, "git", "current-pr", start);
     }
   });
+  const credentials = git.command("credentials").description("Inspect which credential git uses for the remotes of a clone (insteadOf mappings, embedded tokens, helpers) and whether it can read the repo");
+  credentials.addHelpText("after", `
+Read-only except forget. Tokens are never printed \u2014 only their type and a fingerprint (ghp_\u2026a1b2).
+
+Examples:
+  pncli git credentials inspect                       # every remote of the clone you are in
+  pncli git credentials inspect ~/src/tools --remote upstream
+  pncli git credentials inspect https://github.com/imagile/tools.git
+  pncli git credentials inspect --scan ~/src --problems-only   # clones mapped without a token, or without access
+  pncli git credentials mappings                      # every insteadOf rewrite and URL-scoped helper, tokens checked
+  pncli git credentials stored                        # Git Credential Manager / Windows Credential Manager /
+                                                      # Keychain / ~/.git-credentials: accounts, token health
+  pncli git credentials forget --host github.com --username octo   # drop a stale stored credential
+`);
+  credentials.command("inspect").description("Show the credential each remote uses after insteadOf rewriting, and (online) whether it can read the repo").argument("[target]", "A clone directory or a remote URL (default: the current clone)").option("--remote <name>", "Only this remote (default: all remotes)").option("--scan <dir>", "Inspect every clone under this directory instead").option("--depth <n>", "How many directory levels --scan descends", "2").option("--problems-only", "With --scan, only list remotes that have problems").option("--offline", "Skip network checks (ls-remote and the GitHub API)").action(async (target, cmdOpts) => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      const cfg = (() => {
+        try {
+          return loadConfig({ configPath: opts.config });
+        } catch {
+          return {};
+        }
+      })();
+      const cache = /* @__PURE__ */ new Map();
+      const deps = { offline: !!cmdOpts.offline, cache };
+      const inspectClone = async (dir2) => {
+        const remotes2 = listRemotes(dir2).filter(([name]) => !cmdOpts.remote || name === cmdOpts.remote);
+        const out = [];
+        for (const [name, url] of remotes2) out.push(await inspectRemoteAuth(name, url, dir2, cfg, deps));
+        return out;
+      };
+      if (cmdOpts.scan) {
+        const depth = Number.parseInt(cmdOpts.depth, 10);
+        if (!Number.isInteger(depth) || depth < 0) throw new PncliError("--depth must be a non-negative integer", 1);
+        const clones = findClones(cmdOpts.scan, depth);
+        const results = [];
+        for (const dir2 of clones) {
+          const remotes2 = await inspectClone(dir2);
+          const shown = cmdOpts.problemsOnly ? remotes2.filter((r) => r.problems.length > 0) : remotes2;
+          if (shown.length > 0) results.push({ path: dir2, remotes: shown });
+        }
+        const all = results.flatMap((r) => r.remotes);
+        success({
+          root: path2.resolve(cmdOpts.scan),
+          clonesScanned: clones.length,
+          summary: {
+            remotes: all.length,
+            withProblems: all.filter((r) => r.problems.length > 0).length,
+            noCredential: all.filter((r) => r.host && r.credentialSource === "none").length,
+            cannotRead: all.filter((r) => r.access && !r.access.ok).length
+          },
+          clones: results
+        }, "git", "credentials-inspect", start);
+        return;
+      }
+      if (target && /^(https?:\/\/|git@|ssh:\/\/)/i.test(target)) {
+        success({ remotes: [await inspectRemoteAuth(null, target, null, cfg, deps)] }, "git", "credentials-inspect", start);
+        return;
+      }
+      const dir = target ? path2.resolve(target) : requireRepoRoot();
+      if (!fs2.existsSync(path2.join(dir, ".git"))) throw new PncliError(`${dir} is not a git clone`, 1);
+      const remotes = await inspectClone(dir);
+      if (remotes.length === 0) throw new PncliError(cmdOpts.remote ? `No remote named "${cmdOpts.remote}" in ${dir}` : `${dir} has no remotes`, 1);
+      success({ path: dir, remotes }, "git", "credentials-inspect", start);
+    } catch (err) {
+      fail(err, "git", "credentials-inspect", start);
+    }
+  });
+  credentials.command("mappings").description("List every insteadOf URL rewrite and URL-scoped credential helper in your gitconfig, tokens redacted and (online) validated").option("--offline", "Skip validating embedded GitHub tokens").action(async (cmdOpts) => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      const cfg = (() => {
+        try {
+          return loadConfig({ configPath: opts.config });
+        } catch {
+          return {};
+        }
+      })();
+      const mappings = await listMappings(getRepoRoot(), cfg, { offline: !!cmdOpts.offline });
+      success({ mappings, total: mappings.length }, "git", "credentials-mappings", start);
+    } catch (err) {
+      fail(err, "git", "credentials-mappings", start);
+    }
+  });
+  credentials.command("stored").description("List credentials git keeps in Git Credential Manager, Windows Credential Manager, the macOS Keychain, or ~/.git-credentials, with what git would send per host and (online) token health").option("--host <host...>", "Also ask git what it would send for these hosts").option("--offline", "Skip validating GitHub tokens").action(async (cmdOpts) => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      const cfg = (() => {
+        try {
+          return loadConfig({ configPath: opts.config });
+        } catch {
+          return {};
+        }
+      })();
+      const hosts = new Set((cmdOpts.host ?? []).map((h) => h.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "")));
+      for (const h of [gitHostFromApiBaseUrl(cfg.github?.baseUrl), hostOf(cfg.bitbucket?.baseUrl), hostOf(cfg.ado?.baseUrl)]) if (h) hosts.add(h);
+      const root = getRepoRoot();
+      if (root) for (const [, url] of listRemotes(root)) {
+        const h = hostOf(url);
+        if (h) hosts.add(h);
+      }
+      const report = await listStoredCredentials([...hosts], cfg, { offline: !!cmdOpts.offline });
+      success(report, "git", "credentials-stored", start);
+    } catch (err) {
+      fail(err, "git", "credentials-stored", start);
+    }
+  });
+  credentials.command("forget").description("Remove a stored credential for a host through git credential reject (works for every helper: Git Credential Manager, wincred, osxkeychain, libsecret, store)").requiredOption("--host <host>", "Host to forget, e.g. github.com").option("--username <username>", "Only this account (when several are stored for the host)").option("--path <path>", "Repository path, for helpers that store per repository (e.g. Azure Repos in Git Credential Manager)").action((cmdOpts) => {
+    const start = Date.now();
+    try {
+      const host = cmdOpts.host.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+      const result = forgetCredential(host, { username: cmdOpts.username, path: cmdOpts.path });
+      if (!result.before) throw new PncliError(`git has no stored credential for ${host}${cmdOpts.path ? `/${cmdOpts.path}` : ""} \u2014 nothing to forget`, 1);
+      success({
+        ...result,
+        next: result.removed ? "git will ask for (or its helper will fetch) a fresh credential next time" : "git still supplies the same credential \u2014 it may come from an insteadOf mapping or a helper that ignores reject; see: pncli git credentials inspect"
+      }, "git", "credentials-forget", start);
+    } catch (err) {
+      fail(err, "git", "credentials-forget", start);
+    }
+  });
 }
 
 // src/services/jira/commands.ts
 import { readFileSync as readFileSync3, existsSync, writeFileSync, mkdirSync } from "fs";
-import path from "path";
+import path3 from "path";
 
 // src/services/jira/client.ts
 import { readFileSync } from "fs";
@@ -1026,6 +2098,16 @@ var JiraClient = class {
       return { ...result, values: result.comments };
     });
   }
+  async addWorklog(key, opts) {
+    return this.http.jira(`${API2}/issue/${key}/worklog`, {
+      method: "POST",
+      body: {
+        timeSpent: opts.timeSpent,
+        ...opts.comment ? { comment: opts.comment } : {},
+        ...opts.started ? { started: opts.started } : {}
+      }
+    });
+  }
   async search(jql, maxResults, customFields) {
     const standardFields = ["summary", "status", "priority", "assignee", "issuetype", "project", "created", "updated", "labels", "reporter"];
     const fields = customFields?.length ? [...standardFields, ...customFields.map((f) => f.id)] : standardFields;
@@ -1239,6 +2321,11 @@ function buildFieldMap(fields) {
   }
   return { byName, byId };
 }
+function resolveFieldKey(rawKey, fieldMap) {
+  const def = fieldMap.byName.get(rawKey.toLowerCase()) ?? fieldMap.byId.get(rawKey);
+  if (def) return def.id;
+  return /\s/.test(rawKey) ? void 0 : rawKey;
+}
 function translateJql(jql, fieldMap) {
   if (fieldMap.byName.size === 0) return jql;
   const sortedNames = Array.from(fieldMap.byName.keys()).sort((a, b) => b.length - a.length);
@@ -1383,17 +2470,14 @@ function splitFieldsDictionary(fields, fieldMap) {
       builtin[key] = value;
       continue;
     }
-    const def = fieldMap.byName.get(key) ?? fieldMap.byId.get(rawKey);
-    if (def) {
-      custom[def.id] = value;
-    } else if (!/\s/.test(rawKey)) {
-      custom[rawKey] = value;
-    } else {
+    const fieldId = resolveFieldKey(rawKey, fieldMap);
+    if (fieldId === void 0) {
       throw new PncliError(
         `Unknown custom field: "${rawKey}". Fields must be registered in config by friendly name or ID. Run: pncli jira fields`,
         1
       );
     }
+    custom[fieldId] = value;
   }
   return { builtin, custom };
 }
@@ -1574,6 +2658,16 @@ function registerJiraCommands(program2) {
       fail(err, "jira", "add-comment", start);
     }
   });
+  jira.command("log-work").description("Add a worklog (time spent) entry to a Jira issue").requiredOption("--key <issue-key>", "Issue key").requiredOption("--time-spent <duration>", 'Time spent in Jira duration format (e.g. "2h 30m", "1d")').option("--comment <text>", "Worklog comment").option("--started <datetime>", "When the work started, in Jira datetime format (e.g. 2024-01-15T09:00:00.000+0000); defaults to now").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient(program2);
+      const data = await client.addWorklog(opts.key, { timeSpent: opts.timeSpent, comment: opts.comment, started: opts.started });
+      success(data, "jira", "log-work", start);
+    } catch (err) {
+      fail(err, "jira", "log-work", start);
+    }
+  });
   jira.command("list-comments").description("List comments on a Jira issue").requiredOption("--key <issue-key>", "Issue key").action(async (opts) => {
     const start = Date.now();
     try {
@@ -1671,9 +2765,9 @@ function registerJiraCommands(program2) {
       const attachments = await client.listAttachments(opts.key);
       const attachment = attachments.find((a) => a.id === opts.attachmentId);
       if (!attachment) throw new PncliError(`Attachment not found: ${opts.attachmentId}`, 1);
-      const outDir = opts.dir ?? path.join(process.cwd(), ".pncli");
+      const outDir = opts.dir ?? path3.join(process.cwd(), ".pncli");
       mkdirSync(outDir, { recursive: true });
-      const outPath = path.join(outDir, path.basename(attachment.filename));
+      const outPath = path3.join(outDir, path3.basename(attachment.filename));
       const buffer = await client.downloadAttachment(attachment.content);
       writeFileSync(outPath, buffer);
       success({ saved: outPath, filename: attachment.filename, size: buffer.length }, "jira", "download-attachment", start);
@@ -1738,7 +2832,8 @@ function parseFieldArgs(fieldArgs, fieldMap) {
     const name = arg.slice(0, eq).trim();
     const value = arg.slice(eq + 1);
     const def = fieldMap.byName.get(name.toLowerCase()) ?? fieldMap.byId.get(name);
-    if (!def) throw new PncliError(
+    const fieldId = resolveFieldKey(name, fieldMap);
+    if (fieldId === void 0) throw new PncliError(
       `Unknown custom field: "${name}". Fields must be registered in config by friendly name or ID. Run: pncli jira fields`,
       1
     );
@@ -1751,12 +2846,12 @@ function parseFieldArgs(fieldArgs, fieldMap) {
         throw new PncliError(`Cannot read file "${filePath}": ${e.message}`, 1);
       }
       try {
-        result[def.id] = JSON.parse(raw);
+        result[fieldId] = JSON.parse(raw);
       } catch {
-        result[def.id] = raw;
+        result[fieldId] = raw;
       }
     } else {
-      result[def.id] = formatFieldValue(value, def.type);
+      result[fieldId] = def ? formatFieldValue(value, def.type) : value;
     }
   }
   return result;
@@ -1779,12 +2874,12 @@ function parseFieldsFile(filePath, fieldMap) {
   }
   const result = {};
   for (const [key, val] of Object.entries(data)) {
-    const def = fieldMap.byName.get(key.toLowerCase()) ?? fieldMap.byId.get(key);
-    if (!def) throw new PncliError(
+    const fieldId = resolveFieldKey(key, fieldMap);
+    if (fieldId === void 0) throw new PncliError(
       `Unknown field in "${filePath}": "${key}". Fields must be registered in config by friendly name or ID. Run: pncli jira fields`,
       1
     );
-    result[def.id] = val;
+    result[fieldId] = val;
   }
   return result;
 }
@@ -2306,8 +3401,8 @@ var GitHubClient = class {
     );
   }
   async createRepo(opts) {
-    const path11 = opts.org ? `/orgs/${opts.org}/repos` : "/user/repos";
-    return this.http.github(path11, {
+    const path14 = opts.org ? `/orgs/${opts.org}/repos` : "/user/repos";
+    return this.http.github(path14, {
       method: "POST",
       body: {
         name: opts.name,
@@ -3149,7 +4244,7 @@ function registerGitHubCommands(program2) {
 
 // src/services/confluence/commands.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import path2 from "path";
+import path4 from "path";
 
 // src/services/confluence/client.ts
 import { readFileSync as readFileSync4 } from "fs";
@@ -3346,7 +4441,7 @@ var ConfluenceClient = class {
 function resolveAttachmentPath(outDir, title) {
   const segments = title.split(/[\\/]/).filter((s) => s !== "" && s !== "." && s !== "..");
   const name = segments.pop() ?? "attachment";
-  return path2.join(outDir, name);
+  return path4.join(outDir, name);
 }
 function xmlParseHint(err, bodyContent, convertedFromMarkdown = false) {
   if (!(err instanceof Error)) return null;
@@ -3628,7 +4723,7 @@ ${hint}`, status, url), "confluence", "update-page", start);
     try {
       const client = getClient4(program2);
       const attachment = await client.getAttachment(opts.id);
-      const outDir = opts.dir ?? path2.join(process.cwd(), ".pncli");
+      const outDir = opts.dir ?? path4.join(process.cwd(), ".pncli");
       mkdirSync2(outDir, { recursive: true });
       const outPath = resolveAttachmentPath(outDir, attachment.title);
       const buffer = await client.downloadAttachment(attachment);
@@ -4200,24 +5295,24 @@ function registerSdeCommands(program2) {
 import { Option as Option2 } from "commander";
 
 // src/services/deps/parsers/index.ts
-import fs from "fs";
-import path6 from "path";
-import { execSync as execSync3, execFileSync as execFileSync2 } from "child_process";
+import fs3 from "fs";
+import path8 from "path";
+import { execSync as execSync3, execFileSync as execFileSync3 } from "child_process";
 
 // src/services/deps/parsers/npm.ts
-import path3 from "path";
+import path5 from "path";
 function findNpmManifests(files) {
   const lockFiles = new Set(
     files.filter((f) => {
-      const base = path3.basename(f);
+      const base = path5.basename(f);
       return base === "package-lock.json" || base === "yarn.lock" || base === "pnpm-lock.yaml";
     })
   );
   const manifests = [];
   for (const file of files) {
-    if (path3.basename(file) !== "package.json") continue;
+    if (path5.basename(file) !== "package.json") continue;
     if (file.split("/").includes("node_modules")) continue;
-    const dir = path3.dirname(file);
+    const dir = path5.dirname(file);
     let lockFile;
     for (const lf of ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]) {
       const candidate = dir === "." ? lf : `${dir}/${lf}`;
@@ -4232,7 +5327,7 @@ function findNpmManifests(files) {
 }
 function parseNpmPackages(content, manifest, opts, lockContent) {
   if (lockContent && manifest.lockFile) {
-    const base = path3.basename(manifest.lockFile);
+    const base = path5.basename(manifest.lockFile);
     if (base === "package-lock.json") {
       const pkgs = parsePackageLock(lockContent, manifest.lockFile, opts);
       if (pkgs.length > 0) return pkgs;
@@ -4380,26 +5475,26 @@ function parsePnpmLock(content, lockFilePath, opts, packageJsonContent) {
 }
 
 // src/services/deps/parsers/nuget.ts
-import path4 from "path";
+import path6 from "path";
 var PROJ_EXTENSIONS = /* @__PURE__ */ new Set([".csproj", ".fsproj", ".vbproj"]);
 function findNugetManifests(files) {
   const lockFiles = /* @__PURE__ */ new Map();
   for (const f of files) {
-    if (path4.basename(f) === "packages.lock.json") {
-      lockFiles.set(path4.dirname(f), f);
+    if (path6.basename(f) === "packages.lock.json") {
+      lockFiles.set(path6.dirname(f), f);
     }
   }
   const manifests = [];
   for (const file of files) {
-    const base = path4.basename(file);
-    const ext = path4.extname(file);
+    const base = path6.basename(file);
+    const ext = path6.extname(file);
     if (PROJ_EXTENSIONS.has(ext) || base === "packages.config") {
-      const dir = path4.dirname(file);
+      const dir = path6.dirname(file);
       const lockFile = lockFiles.get(dir);
       manifests.push({ file, ecosystem: "nuget", lockFile });
     }
     if (base === "Directory.Packages.props") {
-      const dir = path4.dirname(file);
+      const dir = path6.dirname(file);
       manifests.push({ file, ecosystem: "nuget", lockFile: lockFiles.get(dir) });
     }
   }
@@ -4418,7 +5513,7 @@ function findNugetManifests(files) {
   return deduped;
 }
 function parseNugetPackages(content, manifest, opts, lockContent, propsContent) {
-  const base = path4.basename(manifest.file);
+  const base = path6.basename(manifest.file);
   if (lockContent) {
     return parsePackagesLock(lockContent, manifest.lockFile ?? manifest.file, opts);
   }
@@ -4539,14 +5634,14 @@ function parsePackagesLock(content, filePath, opts) {
 }
 
 // src/services/deps/parsers/maven.ts
-import path5 from "path";
+import path7 from "path";
 function findMavenManifests(files) {
-  const lockFiles = new Set(files.filter((f) => path5.basename(f) === "gradle.lockfile"));
+  const lockFiles = new Set(files.filter((f) => path7.basename(f) === "gradle.lockfile"));
   const manifests = [];
   for (const file of files) {
-    const base = path5.basename(file);
+    const base = path7.basename(file);
     if (base === "pom.xml" || base === "build.gradle" || base === "build.gradle.kts") {
-      const dir = path5.dirname(file);
+      const dir = path7.dirname(file);
       const lockCandidate = dir === "." ? "gradle.lockfile" : `${dir}/gradle.lockfile`;
       const lockFile = lockFiles.has(lockCandidate) ? lockCandidate : void 0;
       manifests.push({ file, ecosystem: "maven", lockFile });
@@ -4555,7 +5650,7 @@ function findMavenManifests(files) {
   return manifests;
 }
 function parseMavenPackages(content, manifest, opts, lockContent) {
-  const base = path5.basename(manifest.file);
+  const base = path7.basename(manifest.file);
   if (lockContent && manifest.lockFile) {
     return parseGradleLock(lockContent, manifest.lockFile, opts);
   }
@@ -4716,14 +5811,14 @@ function getRepoFiles(repoRoot) {
 }
 function readFile(repoRoot, relPath) {
   try {
-    return fs.readFileSync(path6.join(repoRoot, relPath), "utf8");
+    return fs3.readFileSync(path8.join(repoRoot, relPath), "utf8");
   } catch {
     return null;
   }
 }
 function readFileAtRef(repoRoot, ref, relPath) {
   try {
-    return execFileSync2("git", ["show", `${ref}:${relPath}`], {
+    return execFileSync3("git", ["show", `${ref}:${relPath}`], {
       encoding: "utf8",
       cwd: repoRoot,
       stdio: ["pipe", "pipe", "pipe"],
@@ -4734,13 +5829,13 @@ function readFileAtRef(repoRoot, ref, relPath) {
   }
 }
 function findPropsContent(manifestFile, readFn) {
-  let dir = path6.dirname(manifestFile);
+  let dir = path8.dirname(manifestFile);
   for (let depth = 0; depth < 10; depth++) {
     const candidate = dir === "." ? "Directory.Packages.props" : `${dir}/Directory.Packages.props`;
     const content = readFn(candidate);
     if (content) return content;
     if (dir === ".") break;
-    dir = path6.dirname(dir);
+    dir = path8.dirname(dir);
   }
   return null;
 }
@@ -4784,7 +5879,7 @@ function scanRepoAtRef(repoRoot, ref, opts = {}) {
   const eco = opts.ecosystem ?? "all";
   let files = [];
   try {
-    const out = execFileSync2("git", ["ls-tree", "-r", "--name-only", ref], {
+    const out = execFileSync3("git", ["ls-tree", "-r", "--name-only", ref], {
       encoding: "utf8",
       cwd: repoRoot,
       stdio: ["pipe", "pipe", "pipe"],
@@ -5972,7 +7067,7 @@ function registerDepsCommands(program2) {
 
 // src/services/config/commands.ts
 import input2 from "@inquirer/input";
-import password from "@inquirer/password";
+import password2 from "@inquirer/password";
 import confirm from "@inquirer/confirm";
 
 // src/services/ado/client/work.ts
@@ -6272,8 +7367,8 @@ async function runCredentialChecks(cfg, http) {
   } else {
     try {
       const collection = cfg.defaults.ado?.collection;
-      const path11 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
-      await http.ado(path11, { timeoutMs: 1e4 });
+      const path14 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
+      await http.ado(path14, { timeoutMs: 1e4 });
       results.ado = { status: "valid", message: "ok" };
     } catch (err) {
       results.ado = categorize(err);
@@ -6478,44 +7573,304 @@ async function runCredentialChecks(cfg, http) {
       await http.splitio("/internal/api/v2/workspaces", { timeoutMs: 1e4 });
       results.splitio = { status: "valid", message: "ok" };
     } catch (err) {
-      results.splitio = categorize(err);
+      results.splitio = categorize(err);
+    }
+  }
+  if (!cfg.figma.token) {
+    results.figma = { status: "blank", message: "not configured" };
+  } else if (!cfg.figma.baseUrl) {
+    results.figma = { status: "error", message: "baseUrl not configured" };
+  } else {
+    try {
+      await http.figma("/v1/me", { timeoutMs: 1e4 });
+      results.figma = { status: "valid", message: "ok" };
+    } catch (err) {
+      results.figma = categorize(err);
+    }
+  }
+  if (!cfg.alation.refreshToken) {
+    results.alation = { status: "blank", message: "not configured" };
+  } else if (!cfg.alation.baseUrl) {
+    results.alation = { status: "error", message: "baseUrl not configured" };
+  } else if (cfg.alation.userId === void 0 || cfg.alation.userId === "") {
+    results.alation = { status: "error", message: "userId not configured" };
+  } else {
+    try {
+      await validateAlationAccessToken(cfg);
+      results.alation = { status: "valid", message: "ok" };
+    } catch (err) {
+      results.alation = categorize(err);
+    }
+  }
+  return results;
+}
+
+// src/services/config/keychain-commands.ts
+import fs4 from "fs";
+import password from "@inquirer/password";
+function resolveConfigKey(root, key) {
+  const parts = key.split(".").filter(Boolean);
+  if (parts.length === 0) throw new KeychainError("A config key is required, e.g. github.token");
+  const segments = [];
+  let node = root;
+  for (const [i, part] of parts.entries()) {
+    if (Array.isArray(node)) {
+      const idx = /^\d+$/.test(part) ? Number(part) : node.findIndex((e) => e && typeof e === "object" && e.name === part);
+      if (idx < 0 || idx >= node.length) {
+        throw new KeychainError(`No entry "${part}" in ${parts.slice(0, i).join(".")} \u2014 check the name with: pncli config show`);
+      }
+      segments.push(idx);
+      node = node[idx];
+    } else {
+      segments.push(part);
+      const obj = node;
+      if (i < parts.length - 1 && (typeof obj[part] !== "object" || obj[part] === null)) obj[part] = {};
+      node = obj[part];
+    }
+  }
+  return segments;
+}
+function getAtPath(root, segments) {
+  let node = root;
+  for (const seg of segments) node = node && typeof node === "object" ? node[seg] : void 0;
+  return node;
+}
+function deleteAtPath(root, segments) {
+  const parent = getAtPath(root, segments.slice(0, -1));
+  if (parent) delete parent[segments[segments.length - 1]];
+}
+async function readSecret(key, opts) {
+  if (opts.value !== void 0) {
+    warn("--value leaves the secret in your shell history. Prefer the interactive prompt or --stdin.");
+    return opts.value;
+  }
+  if (opts.stdin || !process.stdin.isTTY) {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8").trim();
+  }
+  return (await password({ message: `Secret for ${key}:`, mask: "*" })).trim();
+}
+function matchesFilter(config, segments, only) {
+  if (!only || only.size === 0) return true;
+  return only.has(segments.join(".")) || only.has(accountForPath(config, segments));
+}
+function unmigrateSecrets(config, backend, dryRun = false, only) {
+  const migrated = [];
+  const failed = [];
+  const refs = findKeychainRefs(config).filter((r) => matchesFilter(config, r.path, only));
+  let secrets = {};
+  if (!dryRun && refs.length > 0) {
+    const accounts = [...new Set(refs.flatMap((r) => {
+      try {
+        return [accountFromRef(r.value)];
+      } catch {
+        return [];
+      }
+    }))];
+    secrets = backend.getMany(accounts);
+  }
+  for (const ref of refs) {
+    let account;
+    try {
+      account = accountFromRef(ref.value);
+    } catch (err) {
+      failed.push({ path: ref.path.join("."), account: ref.value, reason: err.message });
+      continue;
+    }
+    const entry = { path: ref.path.join("."), account };
+    if (dryRun) {
+      migrated.push(entry);
+      continue;
+    }
+    const secret = secrets[account];
+    if (secret == null) {
+      failed.push({ ...entry, reason: "no entry in the keychain" });
+      continue;
+    }
+    setAtPath(config, ref.path, secret);
+    migrated.push(entry);
+  }
+  return { migrated, failed };
+}
+function migrateSecrets(config, backend, dryRun = false, only) {
+  const migrated = [];
+  const failed = [];
+  for (const secret of findPlaintextSecrets(config).filter((s) => matchesFilter(config, s.path, only))) {
+    const account = accountForPath(config, secret.path);
+    const entry = { path: secret.path.join("."), account };
+    if (dryRun) {
+      migrated.push(entry);
+      continue;
+    }
+    try {
+      storeVerified(backend, account, secret.value);
+      setAtPath(config, secret.path, keychainRef(account));
+      migrated.push(entry);
+    } catch (err) {
+      failed.push({ ...entry, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return { migrated, failed };
+}
+function registerKeychainCommands(config, program2) {
+  const keychain = config.command("keychain").description("Store credentials in the OS keychain (macOS Keychain, Windows Credential Manager, Secret Service) instead of plaintext config");
+  keychain.addHelpText("after", `
+How it works:
+  A config value of the form "keychain:<account>" is a reference. pncli looks the secret up in the
+  OS credential store at run time; ~/.pncli/config.json only ever holds the reference.
+  PNCLI_* environment variables still take precedence over anything stored here.
+
+Examples:
+  pncli config keychain migrate --dry-run   # which plaintext secrets would move
+  pncli config keychain migrate             # config -> keychain, every plaintext secret
+  pncli config keychain migrate github.token          # just one key
+  pncli config keychain migrate --to config           # keychain -> config (entries kept)
+  pncli config keychain migrate --to config --purge   # keychain -> config, then delete entries
+  pncli config keychain set github.token    # prompts for the secret (or pipe it: --stdin)
+  pncli config keychain set marketplaces.internal-ai.token
+  pncli config keychain status              # backend, every reference, and whether it resolves
+  pncli config keychain remove github.token --restore   # back to plaintext config
+
+Set PNCLI_KEYCHAIN_BACKEND=none to ignore references entirely (e.g. on a CI runner).
+`);
+  keychain.command("status").description("Show the keychain backend, every keychain reference in config, and plaintext secrets that could move").action(() => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      const raw = loadJsonFile(getGlobalConfigPath(opts.config)) ?? {};
+      const backend = getKeychainBackend();
+      const refs = findKeychainRefs(raw);
+      const available = backend.available();
+      let lookups = {};
+      let lookupError = null;
+      if (available && refs.length > 0) {
+        try {
+          lookups = backend.getMany([...new Set(refs.map((r) => accountFromRef(r.value)))]);
+        } catch (err) {
+          if (err instanceof KeychainBatchError) lookups = err.partial;
+          lookupError = err instanceof Error ? err.message : String(err);
+        }
+      }
+      const plaintext = findPlaintextSecrets(raw).map((s) => s.path.join("."));
+      success({
+        backend: backend.name,
+        store: backend.store,
+        available,
+        references: refs.map((r) => {
+          const account = r.value.slice("keychain:".length);
+          return { path: r.path.join("."), account, resolves: available ? lookups[account] != null : false };
+        }),
+        lookupError,
+        plaintextSecrets: plaintext,
+        hint: plaintext.length > 0 && available ? `Move ${plaintext.length} plaintext secret(s) into the keychain with: pncli config keychain migrate` : null
+      }, "config", "keychain-status", start);
+    } catch (err) {
+      fail(err, "config", "keychain-status", start);
+    }
+  });
+  keychain.command("set").description("Store a secret in the OS keychain and point a config key at it").argument("<key>", "Config key in dot notation, e.g. github.token or marketplaces.<name>.token").option("--stdin", "Read the secret from stdin instead of prompting").option("--value <secret>", "Pass the secret inline (ends up in shell history \u2014 prefer the prompt or --stdin)").option("--account <account>", "Keychain account name to store under (default: the config key)").action(async (key, cmdOpts) => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      const configPath = getGlobalConfigPath(opts.config);
+      const raw = loadJsonFile(configPath) ?? {};
+      const segments = resolveConfigKey(raw, key);
+      const account = cmdOpts.account ?? accountForPath(raw, segments);
+      const secret = await readSecret(key, cmdOpts);
+      const backend = getKeychainBackend();
+      storeVerified(backend, account, secret);
+      setAtPath(raw, segments, keychainRef(account));
+      writeGlobalConfig(raw, opts.config);
+      resetKeychainCache();
+      success({ key: segments.join("."), account, store: backend.store, reference: keychainRef(account) }, "config", "keychain-set", start);
+    } catch (err) {
+      fail(err, "config", "keychain-set", start);
     }
-  }
-  if (!cfg.figma.token) {
-    results.figma = { status: "blank", message: "not configured" };
-  } else if (!cfg.figma.baseUrl) {
-    results.figma = { status: "error", message: "baseUrl not configured" };
-  } else {
+  });
+  keychain.command("remove").description("Delete a secret from the OS keychain and clear its config reference").argument("<key>", "Config key holding a keychain reference, e.g. github.token").option("--restore", "Write the secret back into config as plaintext instead of clearing the key").action((key, cmdOpts) => {
+    const start = Date.now();
     try {
-      await http.figma("/v1/me", { timeoutMs: 1e4 });
-      results.figma = { status: "valid", message: "ok" };
+      const opts = program2.optsWithGlobals();
+      const raw = loadJsonFile(getGlobalConfigPath(opts.config)) ?? {};
+      const segments = resolveConfigKey(raw, key);
+      const current = getAtPath(raw, segments);
+      if (!isKeychainRef(current)) {
+        throw new KeychainError(`${key} is not a keychain reference (nothing to remove).`);
+      }
+      const account = accountFromRef(current);
+      const backend = getKeychainBackend();
+      let restored = false;
+      if (cmdOpts.restore) {
+        const secret = backend.getMany([account])[account];
+        if (secret == null) throw new KeychainError(`No keychain entry for "${account}" \u2014 nothing to restore. Re-run without --restore to clear the reference.`);
+        setAtPath(raw, segments, secret);
+        restored = true;
+      } else {
+        deleteAtPath(raw, segments);
+      }
+      writeGlobalConfig(raw, opts.config);
+      const deleted = purgeEntries(raw, backend, [account]).length > 0;
+      resetKeychainCache();
+      success({ key: segments.join("."), account, deleted, restoredToConfig: restored }, "config", "keychain-remove", start);
     } catch (err) {
-      results.figma = categorize(err);
+      fail(err, "config", "keychain-remove", start);
     }
-  }
-  if (!cfg.alation.refreshToken) {
-    results.alation = { status: "blank", message: "not configured" };
-  } else if (!cfg.alation.baseUrl) {
-    results.alation = { status: "error", message: "baseUrl not configured" };
-  } else if (cfg.alation.userId === void 0 || cfg.alation.userId === "") {
-    results.alation = { status: "error", message: "userId not configured" };
-  } else {
+  });
+  keychain.command("migrate").description("Move secrets between plaintext config and the OS keychain (--to keychain, the default, or --to config)").argument("[keys...]", "Limit to these config keys (e.g. github.token marketplaces.internal-ai.token); default: all").option("--to <destination>", "keychain (move plaintext secrets in) or config (move keychain secrets back out)", "keychain").option("--purge", "With --to config: also delete the keychain entries once config holds the secrets").option("--dry-run", "List what would move without touching the keychain or config").action((keys, cmdOpts) => {
+    const start = Date.now();
     try {
-      await validateAlationAccessToken(cfg);
-      results.alation = { status: "valid", message: "ok" };
+      const opts = program2.optsWithGlobals();
+      const dryRun = !!(cmdOpts.dryRun || opts.dryRun);
+      const configPath = getGlobalConfigPath(opts.config);
+      if (cmdOpts.to !== "keychain" && cmdOpts.to !== "config") {
+        throw new KeychainError(`--to must be "keychain" or "config", got "${cmdOpts.to}".`);
+      }
+      if (cmdOpts.purge && cmdOpts.to !== "config") {
+        throw new KeychainError("--purge only applies to --to config.");
+      }
+      if (!fs4.existsSync(configPath)) throw new KeychainError(`No global config at ${configPath} \u2014 nothing to migrate.`);
+      const raw = loadJsonFile(configPath) ?? {};
+      const backend = getKeychainBackend();
+      if (!dryRun && !backend.available()) {
+        throw new KeychainError(`The ${backend.store} backend is not available on this machine.`);
+      }
+      const only = new Set(keys);
+      const result = cmdOpts.to === "keychain" ? migrateSecrets(raw, backend, dryRun, only) : unmigrateSecrets(raw, backend, dryRun, only);
+      let purged = [];
+      if (!dryRun && result.migrated.length > 0) {
+        if (cmdOpts.to === "keychain") {
+          const backup = `${configPath}.pre-keychain.bak`;
+          fs4.copyFileSync(configPath, backup);
+          try {
+            fs4.chmodSync(backup, 384);
+          } catch {
+          }
+          warn(`Plaintext backup written to ${backup} \u2014 delete it once \`pncli config check\` passes.`);
+        }
+        writeGlobalConfig(raw, opts.config);
+        if (cmdOpts.purge) purged = purgeEntries(raw, backend, result.migrated.map((m) => m.account));
+      }
+      resetKeychainCache();
+      success({
+        to: cmdOpts.to,
+        dryRun,
+        store: backend.store,
+        ...result,
+        ...cmdOpts.to === "config" ? { purged } : {}
+      }, "config", "keychain-migrate", start);
     } catch (err) {
-      results.alation = categorize(err);
+      fail(err, "config", "keychain-migrate", start);
     }
-  }
-  return results;
+  });
 }
 
 // src/services/skills/commands.ts
-import fs3 from "fs";
-import path8 from "path";
-import os2 from "os";
+import fs6 from "fs";
+import path11 from "path";
+import os3 from "os";
 import { fileURLToPath } from "url";
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import select from "@inquirer/select";
 import checkbox, { Separator } from "@inquirer/checkbox";
 import input from "@inquirer/input";
@@ -6541,22 +7896,22 @@ function getPncliVersion() {
 }
 
 // src/services/skills/instructions.ts
-import fs2 from "fs";
-import path7 from "path";
-import os from "os";
+import fs5 from "fs";
+import path9 from "path";
+import os2 from "os";
 var INSTRUCTIONS_SUBDIR = "instructions";
 var INSTRUCTION_SOURCE_FILES = ["AGENTS.md", "CLAUDE.md"];
 var AGENT_INSTRUCTION_SPECS = {
   "codex": {
-    file: () => path7.join(process.env.CODEX_HOME || path7.join(os.homedir(), ".codex"), "AGENTS.md"),
+    file: () => path9.join(process.env.CODEX_HOME || path9.join(os2.homedir(), ".codex"), "AGENTS.md"),
     sources: ["AGENTS.md", "CLAUDE.md"]
   },
   "github-copilot": {
-    file: () => path7.join(process.env.COPILOT_HOME || path7.join(os.homedir(), ".copilot"), "copilot-instructions.md"),
+    file: () => path9.join(process.env.COPILOT_HOME || path9.join(os2.homedir(), ".copilot"), "copilot-instructions.md"),
     sources: ["AGENTS.md", "CLAUDE.md"]
   },
   "claude-code": {
-    file: () => path7.join(process.env.CLAUDE_CONFIG_DIR || path7.join(os.homedir(), ".claude"), "CLAUDE.md"),
+    file: () => path9.join(process.env.CLAUDE_CONFIG_DIR || path9.join(os2.homedir(), ".claude"), "CLAUDE.md"),
     sources: ["CLAUDE.md", "AGENTS.md"]
   }
 };
@@ -6564,13 +7919,13 @@ var INSTRUCTION_AGENTS = Object.keys(AGENT_INSTRUCTION_SPECS);
 function agentInstructionsFile(agent) {
   const spec = AGENT_INSTRUCTION_SPECS[agent];
   if (!spec) throw new Error(`Unknown agent: "${agent}". Use: ${INSTRUCTION_AGENTS.join(" | ")}`);
-  return path7.resolve(spec.file());
+  return path9.resolve(spec.file());
 }
 function findMarketplaceInstructions(marketplacePath) {
-  const dir = path7.join(marketplacePath, INSTRUCTIONS_SUBDIR);
-  return INSTRUCTION_SOURCE_FILES.map((file) => ({ file, path: path7.join(dir, file) })).filter((entry) => {
+  const dir = path9.join(marketplacePath, INSTRUCTIONS_SUBDIR);
+  return INSTRUCTION_SOURCE_FILES.map((file) => ({ file, path: path9.join(dir, file) })).filter((entry) => {
     try {
-      return fs2.statSync(entry.path).isFile();
+      return fs5.statSync(entry.path).isFile();
     } catch {
       return false;
     }
@@ -6648,7 +8003,7 @@ function listManagedBlocks(content) {
 }
 function readFileOrEmpty(file) {
   try {
-    return fs2.readFileSync(file, "utf8");
+    return fs5.readFileSync(file, "utf8");
   } catch {
     return "";
   }
@@ -6659,12 +8014,12 @@ function applyMarketplaceInstructions(marketplacePath, marketplaceName, agents)
     const file = agentInstructionsFile(agent);
     const source = pickInstructionSource(agent, shipped);
     if (!source) return { agent, file, source: null, action: "skipped" };
-    const body = fs2.readFileSync(source.path, "utf8");
+    const body = fs5.readFileSync(source.path, "utf8");
     const block = renderManagedBlock(marketplaceName, body, `${INSTRUCTIONS_SUBDIR}/${source.file}`);
     const { content, action } = upsertManagedBlock(readFileOrEmpty(file), marketplaceName, block);
     if (action !== "unchanged") {
-      fs2.mkdirSync(path7.dirname(file), { recursive: true });
-      fs2.writeFileSync(file, content, "utf8");
+      fs5.mkdirSync(path9.dirname(file), { recursive: true });
+      fs5.writeFileSync(file, content, "utf8");
     }
     return { agent, file, source: `${INSTRUCTIONS_SUBDIR}/${source.file}`, action };
   });
@@ -6674,21 +8029,21 @@ function removeMarketplaceInstructions(marketplaceName, agents) {
     const file = agentInstructionsFile(agent);
     const existing = readFileOrEmpty(file);
     const { content, removed } = removeManagedBlock(existing, marketplaceName);
-    if (removed) fs2.writeFileSync(file, content, "utf8");
+    if (removed) fs5.writeFileSync(file, content, "utf8");
     return { agent, file, removed };
   });
 }
 function marketplaceInstructionsStatus(marketplacePath, marketplaceName, agents) {
-  const shipped = marketplacePath && fs2.existsSync(marketplacePath) ? findMarketplaceInstructions(marketplacePath) : [];
+  const shipped = marketplacePath && fs5.existsSync(marketplacePath) ? findMarketplaceInstructions(marketplacePath) : [];
   return agents.map((agent) => {
     const file = agentInstructionsFile(agent);
-    const fileExists = fs2.existsSync(file);
+    const fileExists = fs5.existsSync(file);
     const existing = fileExists ? readFileOrEmpty(file) : "";
     const installed = listManagedBlocks(existing).includes(marketplaceName);
     const source = pickInstructionSource(agent, shipped);
     let upToDate = null;
     if (installed && source) {
-      const block = renderManagedBlock(marketplaceName, fs2.readFileSync(source.path, "utf8"), `${INSTRUCTIONS_SUBDIR}/${source.file}`);
+      const block = renderManagedBlock(marketplaceName, fs5.readFileSync(source.path, "utf8"), `${INSTRUCTIONS_SUBDIR}/${source.file}`);
       upToDate = upsertManagedBlock(existing, marketplaceName, block).action === "unchanged";
     } else if (installed) {
       upToDate = false;
@@ -6704,20 +8059,270 @@ function marketplaceInstructionsStatus(marketplacePath, marketplaceName, agents)
   });
 }
 
-// src/services/skills/commands.ts
-var BACK = "__back__";
-var ALL_MARKETPLACES = "__all_marketplaces__";
-function injectTokenIntoUrl(url, token) {
-  let parsed;
+// src/services/skills/git-auth-commands.ts
+import path10 from "path";
+function readRawConfig(configPath) {
+  return loadJsonFile(getGlobalConfigPath(configPath)) ?? {};
+}
+function saveScopeRecords(updates, configPath) {
+  const raw = readRawConfig(configPath);
+  const scopes = { ...raw.gitAuth?.scopes ?? {} };
+  for (const [scope, record] of Object.entries(updates)) {
+    if (record) scopes[scope] = record;
+    else delete scopes[scope];
+  }
+  writeGlobalConfig({ ...raw, gitAuth: { ...raw.gitAuth, scopes } }, configPath);
+}
+function normalizeHostArg(host) {
+  return host.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/:443$/, "");
+}
+function findMarketplace(globalConfig, name) {
+  const m = allMarketplaces(globalConfig).find((x) => x.name === name || x.repoUrl === name);
+  if (!m) throw new Error(`Marketplace "${name}" not found. Run: pncli skills marketplace list`);
+  return m;
+}
+function backupOf(record) {
+  return record ? { previousHelpers: record.previousHelpers ?? [], previousUseHttpPath: record.previousUseHttpPath ?? null } : void 0;
+}
+function scrubClones(marketplaces) {
+  const fixed = [];
+  for (const m of marketplaces) {
+    if (!m.localPath || !m.repoUrl) continue;
+    if (originHasCredentials(m.localPath) && stripOriginCredentials(m.localPath, m.repoUrl)) fixed.push(m.localPath);
+  }
+  return fixed;
+}
+function registerGitAuthCommands(skills) {
+  const gitAuth = skills.command("git-auth").description("Give git itself each marketplace's credential, so agent hosts and plain git clones of private marketplaces authenticate (GitHub, Bitbucket, Azure DevOps)");
+  const configPathOf = () => gitAuth.optsWithGlobals().config;
+  gitAuth.addHelpText("after", `
+Why:
+  pncli's own clone and pull are authenticated, but an agent host that clones a marketplace itself
+  (e.g. Claude Code's /plugin marketplace add) runs plain git, which has no credential for it.
+
+Scope:
+  Each marketplace gets an entry scoped to its own repository URL, answered with that marketplace's
+  own token (or the provider token pncli already has: github.token, bitbucket.pat, ado.pat).
+  Every other repo on the same host is untouched. --host opts into a whole-host entry instead.
+
+Modes:
+  --mode helper (default)  git asks pncli (${HELPER_COMMAND} --marketplace <name>). Nothing is copied
+                           into gitconfig; rotating the token in pncli is enough. If pncli cannot
+                           answer, git falls through to the helpers you already had.
+  --mode keychain          hands the token to git's own credential store (Git Credential Manager,
+                           macOS Keychain, libsecret), keyed to the repository. Works without pncli
+                           on PATH; re-run after rotating the token \u2014 pncli doctor flags a stale copy.
+
+disable restores exactly what enable replaced (e.g. an entry \`gh auth setup-git\` wrote).
+
+Examples:
+  pncli skills git-auth enable                              # every marketplace with a credential
+  pncli skills git-auth enable --marketplace internal-ai --mode keychain
+  pncli skills git-auth enable --host ghe.imagile.dev       # whole host, with github.token
+  pncli skills git-auth status
+  pncli skills git-auth disable --marketplace internal-ai
+`);
+  gitAuth.command("enable").description("Configure git to authenticate to marketplace repositories with pncli's credential (helper or OS keychain)").option("--marketplace <name>", "Only this marketplace (default: every marketplace that has a credential)").option("--host <host>", "A whole-host entry instead, answered with the provider token pncli has for that host").option("--mode <mode>", "helper (git asks pncli) or keychain (store in the OS credential store)", "helper").action((opts) => {
+    const start = Date.now();
+    try {
+      if (opts.mode !== "helper" && opts.mode !== "keychain") throw new Error(`--mode must be "helper" or "keychain", got "${opts.mode}".`);
+      if (opts.marketplace && opts.host) throw new Error("Pass --marketplace or --host, not both.");
+      const mode = opts.mode;
+      const configPath = configPathOf();
+      const cfg = loadConfig({ configPath });
+      const globalConfig = readRawConfig(configPath);
+      const overridePath = configPath ?? process.env.PNCLI_CONFIG_PATH;
+      const helperConfigPath = overridePath ? path10.resolve(overridePath) : void 0;
+      const targets = [];
+      const skipped = [];
+      if (opts.host) {
+        const host = normalizeHostArg(opts.host);
+        targets.push({
+          scope: hostScope(host),
+          marketplace: null,
+          provider: null,
+          helperValue: helperCommandFor(void 0, helperConfigPath),
+          auth: resolveCredential({ protocol: "https", host }, globalConfig, cfg)
+        });
+      } else {
+        const chosen = opts.marketplace ? [findMarketplace(globalConfig, opts.marketplace)] : allMarketplaces(globalConfig);
+        if (chosen.length === 0) throw new Error("No marketplaces are registered. Add one first: pncli skills marketplace add <git-url>");
+        for (const m of chosen) {
+          if (!hostOf(m.repoUrl)) {
+            skipped.push({ marketplace: marketplaceLabelOf(m), reason: "not an HTTPS URL (SSH marketplaces use your SSH keys)" });
+            continue;
+          }
+          const auth = resolveMarketplaceAuth(m, cfg);
+          if (!auth) {
+            skipped.push({ marketplace: marketplaceLabelOf(m), reason: "no credential \u2014 a public repo needs none; for a private one: pncli skills marketplace update <name> --token <token>" });
+            continue;
+          }
+          const helperValue = helperCommandFor(m.name ?? m.repoUrl, helperConfigPath);
+          for (const scope of marketplaceScopes(m.repoUrl, auth.provider)) {
+            targets.push({ scope, marketplace: m, provider: auth.provider, helperValue, auth });
+          }
+        }
+        if (opts.marketplace && targets.length === 0) throw new Error(`Nothing to enable for "${opts.marketplace}": ${skipped[0]?.reason}`);
+      }
+      if (mode === "keychain") {
+        const missing = targets.filter((t) => !t.auth).map((t) => t.scope);
+        if (missing.length > 0) throw new Error(`No token is configured for ${missing.join(", ")}, so there is nothing to store. Nothing was changed.`);
+      }
+      const records = {};
+      const results = targets.map((t) => {
+        const existing = globalConfig.gitAuth?.scopes?.[t.scope];
+        const marketplace = t.marketplace ? t.marketplace.name ?? t.marketplace.repoUrl : void 0;
+        if (mode === "helper") {
+          const backup = enableHelper(t.scope, t.helperValue);
+          records[t.scope] = {
+            mode: "helper",
+            ...marketplace ? { marketplace } : {},
+            previousHelpers: existing?.previousHelpers ?? backup.previousHelpers,
+            previousUseHttpPath: existing && "previousUseHttpPath" in existing ? existing.previousUseHttpPath ?? null : backup.previousUseHttpPath,
+            enabledAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          if (!t.auth) warn(`No token is configured for ${t.scope} yet \u2014 git keeps using your existing credentials there until you add one.`);
+        } else {
+          if (existing?.mode === "helper") disableHelper(t.scope, backupOf(existing));
+          const { plaintextStore, backup } = keychainStore(t.scope, t.auth.username, t.auth.password);
+          records[t.scope] = {
+            mode: "keychain",
+            ...marketplace ? { marketplace } : {},
+            username: t.auth.username,
+            previousHelpers: existing?.mode === "helper" ? existing.previousHelpers ?? [] : [],
+            previousUseHttpPath: existing && "previousUseHttpPath" in existing ? existing.previousUseHttpPath ?? null : backup.previousUseHttpPath,
+            enabledAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          if (plaintextStore) warn(`git's credential.helper includes "store", which writes ~/.git-credentials in plaintext. Consider "manager" (Windows) or "osxkeychain" (macOS).`);
+        }
+        return {
+          scope: t.scope,
+          marketplace: marketplace ?? null,
+          provider: t.provider,
+          mode,
+          tokenSource: t.auth?.source ?? null,
+          tokenKind: t.auth && t.provider === "github" ? classifyGitHubToken(t.auth.password) : null
+        };
+      });
+      saveScopeRecords(records, configPath);
+      const touched = opts.host ? allMarketplaces(globalConfig).filter((m) => hostOf(m.repoUrl) === normalizeHostArg(opts.host)) : [...new Set(targets.map((t) => t.marketplace).filter((m) => !!m))];
+      success({ scopes: results, skipped, scrubbedClones: scrubClones(touched), next: "Verify with: pncli doctor" }, "skills", "git-auth-enable", start);
+    } catch (err) {
+      fail(err, "skills", "git-auth-enable", start);
+    }
+  });
+  gitAuth.command("disable").description("Remove pncli's git credential entries and restore what they replaced (optionally also the OS keychain copy)").option("--marketplace <name>", "Only this marketplace's entries").option("--host <host>", "Only the whole-host entry for this host").option("--forget-keychain", "Also erase the credential git stored in the OS keychain").action((opts) => {
+    const start = Date.now();
+    try {
+      const configPath = configPathOf();
+      const globalConfig = readRawConfig(configPath);
+      const recorded = globalConfig.gitAuth?.scopes ?? {};
+      let scopes;
+      if (opts.host) scopes = [hostScope(normalizeHostArg(opts.host))];
+      else if (opts.marketplace) {
+        const m = findMarketplace(globalConfig, opts.marketplace);
+        const key = m.name ?? m.repoUrl;
+        scopes = Object.keys(recorded).filter((s) => recorded[s].marketplace === key);
+      } else scopes = Object.keys(recorded);
+      if (scopes.length === 0) throw new Error("pncli has not enabled git-auth for anything matching that. See: pncli skills git-auth status");
+      const updates = {};
+      const results = scopes.map((scope) => {
+        const record = recorded[scope];
+        const { helperRemoved, keychainErased } = disableScope(scope, record, !!opts.forgetKeychain);
+        updates[scope] = null;
+        return { scope, marketplace: record?.marketplace ?? null, mode: record?.mode ?? null, helperRemoved, keychainErased, restoredHelpers: record?.previousHelpers ?? [] };
+      });
+      if (opts.forgetKeychain && !results.some((r) => r.keychainErased)) {
+        warn("--forget-keychain had nothing to erase: helper mode never stores a credential in the keychain.");
+      }
+      saveScopeRecords(updates, configPath);
+      success({ scopes: results }, "skills", "git-auth-disable", start);
+    } catch (err) {
+      fail(err, "skills", "git-auth-disable", start);
+    }
+  });
+  gitAuth.command("status").description("Show, per marketplace (and whole-host entry), how git authenticates and whether it sends the token pncli uses").option("--marketplace <name>", "Only this marketplace").action((opts) => {
+    const start = Date.now();
+    try {
+      const configPath = configPathOf();
+      const cfg = loadConfig({ configPath });
+      const globalConfig = readRawConfig(configPath);
+      const reports = opts.marketplace ? [describeMarketplaceAuth(findMarketplace(globalConfig, opts.marketplace), globalConfig, cfg)] : describeAllGitAuth(globalConfig, cfg);
+      success({ entries: reports }, "skills", "git-auth-status", start);
+    } catch (err) {
+      fail(err, "skills", "git-auth-status", start);
+    }
+  });
+}
+var summarize = (e) => e === "" || isPncliHelperValue(e) ? e : "(other helper)";
+function describeMarketplaceAuth(m, globalConfig, cfg, git = defaultGitRunner, hasEmbeddedToken = originHasCredentials) {
+  const host = hostOf(m.repoUrl) ?? "";
+  let auth = null;
+  let credentialError = null;
   try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`--token requires an HTTPS clone URL; got: ${url}`);
+    auth = resolveMarketplaceAuth(m, cfg);
+  } catch (err) {
+    credentialError = err instanceof Error ? err.message : String(err);
+  }
+  const provider = auth?.provider ?? detectProvider(m.repoUrl, cfg, m.provider);
+  const scope = host ? marketplaceScopes(m.repoUrl, provider)[0] : m.repoUrl ?? "";
+  const scopeEntries = host ? readHelperEntries(scope, git) : [];
+  const hostEntries = host ? readHelperEntries(hostScope(host), git) : [];
+  const record = globalConfig.gitAuth?.scopes?.[scope];
+  const filled = host ? credentialFill(host, parseScope(scope).path ?? void 0, git) : null;
+  const pncliHelper = scopeEntries.some(isPncliHelperValue) || !scopeEntries.some((e) => e.trim() !== "") && hostEntries.some(isPncliHelperValue);
+  const mode = pncliHelper ? "helper" : record?.mode === "keychain" ? "keychain" : filled || [...scopeEntries, ...hostEntries].some((e) => e.trim() !== "") ? "other" : "none";
+  return {
+    scope,
+    host,
+    marketplace: m.name ?? m.repoUrl ?? null,
+    repoUrl: m.repoUrl ?? null,
+    provider,
+    mode,
+    helperEntries: scopeEntries.map(summarize),
+    pncliTokenSource: auth?.source ?? null,
+    username: auth?.username ?? null,
+    credentialError,
+    gitHasCredential: !!filled,
+    matchesPncliToken: (mode === "helper" || mode === "keychain") && filled && auth ? filled.password === auth.password : null,
+    clonesWithEmbeddedToken: m.localPath && hasEmbeddedToken(m.localPath) ? [m.localPath] : []
+  };
+}
+function describeHostScopeAuth(host, globalConfig, cfg, git = defaultGitRunner) {
+  const scope = hostScope(host);
+  const entries = readHelperEntries(scope, git);
+  const record = globalConfig.gitAuth?.scopes?.[scope];
+  const answer = resolveCredential({ protocol: "https", host }, globalConfig, cfg);
+  const filled = credentialFill(host, void 0, git);
+  const mode = entries.some(isPncliHelperValue) ? "helper" : record?.mode === "keychain" ? "keychain" : filled || entries.some((e) => e.trim() !== "") ? "other" : "none";
+  return {
+    scope,
+    host,
+    marketplace: null,
+    repoUrl: null,
+    provider: null,
+    mode,
+    helperEntries: entries.map(summarize),
+    pncliTokenSource: answer?.source ?? null,
+    username: answer?.username ?? null,
+    credentialError: null,
+    gitHasCredential: !!filled,
+    matchesPncliToken: (mode === "helper" || mode === "keychain") && filled && answer ? filled.password === answer.password : null,
+    clonesWithEmbeddedToken: []
+  };
+}
+function describeAllGitAuth(globalConfig, cfg, git = defaultGitRunner) {
+  const reports = allMarketplaces(globalConfig).filter((m) => hostOf(m.repoUrl)).map((m) => describeMarketplaceAuth(m, globalConfig, cfg, git));
+  for (const scope of Object.keys(globalConfig.gitAuth?.scopes ?? {})) {
+    const parsed = parseScope(scope);
+    if (!parsed.path) reports.push(describeHostScopeAuth(parsed.host, globalConfig, cfg, git));
   }
-  parsed.username = parsed.hostname === "github.com" ? "x-access-token" : "x-token-auth";
-  parsed.password = token;
-  return parsed.toString();
+  return reports;
 }
+
+// src/services/skills/commands.ts
+var BACK = "__back__";
+var ALL_MARKETPLACES = "__all_marketplaces__";
 function repoNameFromUrl(url) {
   try {
     const parsed = new URL(url);
@@ -6728,7 +8333,7 @@ function repoNameFromUrl(url) {
   }
 }
 function defaultMarketplacePath(url) {
-  return path8.join(os2.homedir(), ".agents", "marketplaces", repoNameFromUrl(url));
+  return path11.join(os3.homedir(), ".agents", "marketplaces", repoNameFromUrl(url));
 }
 function marketplaceLabel(m) {
   return m.name ?? repoNameFromUrl(m.repoUrl ?? "");
@@ -6736,22 +8341,19 @@ function marketplaceLabel(m) {
 function scrubToken(msg) {
   return msg.replace(/x-(?:token-auth|access-token):[^@]+@/g, "x-token-auth:***@");
 }
-function isConfiguredGitHubHost(repoUrl, githubBaseUrl) {
+function marketplaceGitAuth(m) {
+  if (m.token && m.repoUrl && !httpHostOf(m.repoUrl)) {
+    throw new Error(`--token requires an HTTPS clone URL; got: ${m.repoUrl}`);
+  }
+  let auth;
   try {
-    const host = new URL(repoUrl).hostname;
-    if (host === "github.com") return true;
-    if (!githubBaseUrl) return false;
-    return new URL(githubBaseUrl).hostname === host;
-  } catch {
-    return false;
+    auth = resolveMarketplaceAuth(m, loadConfig());
+  } catch (err) {
+    if (err instanceof UnresolvedMarketplaceTokenError) throw new Error(err.message);
+    throw err;
   }
-}
-function resolveMarketplaceToken(explicitToken, repoUrl) {
-  if (explicitToken) return explicitToken;
-  if (!repoUrl) return void 0;
-  const resolved = loadConfig();
-  if (!isConfiguredGitHubHost(repoUrl, resolved.github.baseUrl)) return void 0;
-  return resolved.github.token;
+  const tokenSource = !auth ? "none" : auth.source.startsWith("marketplace:") ? "explicit" : "fallback";
+  return { auth, tokenSource };
 }
 var GIT_AUTH_FAILURE_PATTERNS = [
   /invalid username or (password|token)/i,
@@ -6761,16 +8363,40 @@ var GIT_AUTH_FAILURE_PATTERNS = [
   /support for password authentication was removed/i
 ];
 var GIT_NOT_FOUND_PATTERNS = [/repository not found/i];
-function describeGitFailure(rawMessage, marketplaceName, tokenSource) {
+var FALLBACK_LABELS = {
+  "bitbucket.pat": "The Bitbucket token pncli is using (PNCLI_BITBUCKET_PAT / bitbucket.pat)",
+  "ado.pat": "The Azure DevOps token pncli is using (PNCLI_ADO_PAT / SYSTEM_ACCESSTOKEN / ado.pat)"
+};
+function providerAuthAdvice(marketplaceName, ctx) {
+  if (ctx.provider === "bitbucket" && !ctx.customUsername) {
+    return `
+
+Bitbucket Data Center personal access tokens are usually sent with your Bitbucket username. Set it with: pncli skills marketplace update ${marketplaceName} --username <your-bitbucket-username>`;
+  }
+  if (ctx.provider === "ado") {
+    return "\n\nAzure DevOps personal access tokens need the Code (Read) scope for the collection that hosts this repo.";
+  }
+  return "";
+}
+function describeGitFailure(rawMessage, marketplaceName, tokenSource, ctx = {}) {
   const msg = scrubToken(rawMessage);
-  if (GIT_AUTH_FAILURE_PATTERNS.some((p) => p.test(msg))) {
-    const hint = tokenSource === "explicit" ? `The token configured for marketplace "${marketplaceName}" was rejected \u2014 it may be expired, revoked, or missing required scopes. Update it with: pncli skills marketplace add <url> --token <new-token>` : tokenSource === "fallback" ? `The GitHub token pncli is using (PNCLI_GITHUB_TOKEN / GITHUB_TOKEN / github.token) was rejected for marketplace "${marketplaceName}" \u2014 it may be expired, revoked, or missing required scopes for this repo. Rotate that token, or set one specifically for this marketplace: pncli skills marketplace add <url> --token <new-token>` : `Marketplace "${marketplaceName}" requires authentication but no token is configured. Add one with: pncli skills marketplace add <url> --token <token>`;
+  if (ctx.userCredentialHost && (GIT_AUTH_FAILURE_PATTERNS.some((p) => p.test(msg)) || GIT_NOT_FOUND_PATTERNS.some((p) => p.test(msg)))) {
+    const host = ctx.userCredentialHost;
+    const hint = `git used your own stored credential for ${host} for marketplace "${marketplaceName}" (pncli's ${ctx.fallbackSource ?? "token"} was not sent), and it was refused. If that stored credential is stale, see which one git sends with: pncli git credentials inspect \u2014 and remove it with: pncli git credentials forget --host ${host}. The next sync then uses ${ctx.fallbackSource ?? "pncli's token"}.`;
     return new Error(`${hint}
 
+Git reported: ${msg}`);
+  }
+  if (GIT_AUTH_FAILURE_PATTERNS.some((p) => p.test(msg))) {
+    const fallbackLabel = ctx.fallbackSource ? FALLBACK_LABELS[ctx.fallbackSource] : void 0;
+    const hint = tokenSource === "fallback" && fallbackLabel ? `${fallbackLabel} was rejected for marketplace "${marketplaceName}" \u2014 it may be expired, revoked, or missing required scopes for this repo. Rotate that token, or set one specifically for this marketplace: pncli skills marketplace update ${marketplaceName} --token <new-token>` : tokenSource === "explicit" ? `The token configured for marketplace "${marketplaceName}" was rejected \u2014 it may be expired, revoked, or missing required scopes. Update it with: pncli skills marketplace add <url> --token <new-token>` : tokenSource === "fallback" ? `The GitHub token pncli is using (PNCLI_GITHUB_TOKEN / GITHUB_TOKEN / github.token) was rejected for marketplace "${marketplaceName}" \u2014 it may be expired, revoked, or missing required scopes for this repo. Rotate that token, or set one specifically for this marketplace: pncli skills marketplace add <url> --token <new-token>` : `Marketplace "${marketplaceName}" requires authentication but no token is configured. Add one with: pncli skills marketplace add <url> --token <token>`;
+    return new Error(`${hint}${tokenSource !== "none" ? providerAuthAdvice(marketplaceName, ctx) : ""}
+
 Git reported: ${msg}`);
   }
   if (GIT_NOT_FOUND_PATTERNS.some((p) => p.test(msg))) {
-    const hint = tokenSource === "explicit" ? `Repository for marketplace "${marketplaceName}" was not found \u2014 check the URL and that the configured token has access to it.` : tokenSource === "fallback" ? `Repository for marketplace "${marketplaceName}" was not found \u2014 check the URL and that pncli's configured GitHub token has access to it.` : `Repository for marketplace "${marketplaceName}" was not found \u2014 if it's private, add a token: pncli skills marketplace add <url> --token <token>`;
+    const fallbackLabel = ctx.fallbackSource ? FALLBACK_LABELS[ctx.fallbackSource] : void 0;
+    const hint = tokenSource === "fallback" && fallbackLabel ? `Repository for marketplace "${marketplaceName}" was not found \u2014 check the URL and that ${fallbackLabel.charAt(0).toLowerCase()}${fallbackLabel.slice(1)} has access to it.` : tokenSource === "explicit" ? `Repository for marketplace "${marketplaceName}" was not found \u2014 check the URL and that the configured token has access to it.` : tokenSource === "fallback" ? `Repository for marketplace "${marketplaceName}" was not found \u2014 check the URL and that pncli's configured GitHub token has access to it.` : `Repository for marketplace "${marketplaceName}" was not found \u2014 if it's private, add a token: pncli skills marketplace add <url> --token <token>`;
     return new Error(`${hint}
 
 Git reported: ${msg}`);
@@ -6783,9 +8409,9 @@ function assertInteractive(hint) {
   }
 }
 var AGENT_PATHS = {
-  "codex": { project: ".agents/skills", user: path8.join(os2.homedir(), ".agents/skills") },
-  "github-copilot": { project: ".github/skills", user: path8.join(os2.homedir(), ".copilot/skills") },
-  "claude-code": { project: ".claude/skills", user: path8.join(os2.homedir(), ".claude/skills") }
+  "codex": { project: ".agents/skills", user: path11.join(os3.homedir(), ".agents/skills") },
+  "github-copilot": { project: ".github/skills", user: path11.join(os3.homedir(), ".copilot/skills") },
+  "claude-code": { project: ".claude/skills", user: path11.join(os3.homedir(), ".claude/skills") }
 };
 var DEFAULT_AGENT = "codex";
 var AGENT_CHOICES = Object.keys(AGENT_PATHS).join(" | ");
@@ -6808,27 +8434,27 @@ function resolveAgentPaths(agentName) {
 }
 function findGitRoot(from = process.cwd()) {
   try {
-    const root = execFileSync3("git", ["-C", from, "rev-parse", "--show-toplevel"], {
+    const root = execFileSync4("git", ["-C", from, "rev-parse", "--show-toplevel"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    return root ? path8.resolve(root) : null;
+    return root ? path11.resolve(root) : null;
   } catch {
     return null;
   }
 }
 function resolveProjectPath(relativePath) {
   const root = findGitRoot();
-  return root ? path8.resolve(root, relativePath) : path8.resolve(relativePath);
+  return root ? path11.resolve(root, relativePath) : path11.resolve(relativePath);
 }
 function resolveScopedPath(agentPaths, scope) {
-  return scope === "project" ? resolveProjectPath(agentPaths.project) : path8.resolve(agentPaths.user);
+  return scope === "project" ? resolveProjectPath(agentPaths.project) : path11.resolve(agentPaths.user);
 }
 function hasInstalledPncliSkill() {
   try {
     for (const agentPaths of Object.values(AGENT_PATHS)) {
       for (const scope of ["project", "user"]) {
-        if (fs3.existsSync(path8.join(resolveScopedPath(agentPaths, scope), "pncli", "SKILL.md"))) {
+        if (fs6.existsSync(path11.join(resolveScopedPath(agentPaths, scope), "pncli", "SKILL.md"))) {
           return true;
         }
       }
@@ -6838,7 +8464,7 @@ function hasInstalledPncliSkill() {
   return false;
 }
 function resolveTargetDir(opts) {
-  if (opts.target) return path8.resolve(opts.target);
+  if (opts.target) return path11.resolve(opts.target);
   const agentConfig = resolveAgentPaths(resolveAgentName(opts));
   return resolveScopedPath(agentConfig, opts.scope ?? "user");
 }
@@ -6855,13 +8481,46 @@ function resolveInstallTargets(opts, scope = "user") {
 function getBundledSkillsDir() {
   try {
     const thisFile = fileURLToPath(import.meta.url);
-    return path8.resolve(path8.dirname(thisFile), "..", "skills");
+    return path11.resolve(path11.dirname(thisFile), "..", "skills");
   } catch {
     return "";
   }
 }
+var GUIDE_FILE = "skills-guide.md";
+function findGuidePath() {
+  const bundled = path11.join(getBundledSkillsDir(), "pncli", GUIDE_FILE);
+  if (fs6.existsSync(bundled)) return bundled;
+  try {
+    let dir = path11.dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 6; i++) {
+      const candidate = path11.join(dir, "skills", "pncli", GUIDE_FILE);
+      if (fs6.existsSync(candidate)) return candidate;
+      dir = path11.dirname(dir);
+    }
+  } catch {
+  }
+  return null;
+}
+function slugify(title) {
+  return title.toLowerCase().replace(/[`*_]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function listGuideSections(markdown) {
+  return markdown.split(/\r?\n/).filter((l) => /^## /.test(l)).map((l) => {
+    const title = l.slice(3).trim();
+    return { title, slug: slugify(title) };
+  });
+}
+function extractGuideSection(markdown, query) {
+  const lines = markdown.split(/\r?\n/);
+  const heads = lines.map((l, i) => ({ l, i })).filter((x) => /^## /.test(x.l));
+  const q = slugify(query);
+  const pick = heads.find((h) => slugify(h.l.slice(3)) === q) ?? heads.find((h) => slugify(h.l.slice(3)).includes(q));
+  if (!pick) return null;
+  const next = heads.find((h) => h.i > pick.i);
+  return lines.slice(pick.i, next ? next.i : lines.length).join("\n").trimEnd() + "\n";
+}
 function getInstalledMetaPath(targetDir) {
-  return path8.join(targetDir, ".pncli-installed.json");
+  return path11.join(targetDir, ".pncli-installed.json");
 }
 var SKILL_ORIGIN_FILENAME = "pncli-origin.json";
 var DISABLED_SUBDIR = ".pncli-disabled";
@@ -6872,13 +8531,13 @@ function readInstalledMeta(targetDir) {
   return { version: 1, skills: {} };
 }
 function getSkillOriginPath(skillDir) {
-  return path8.join(skillDir, SKILL_ORIGIN_FILENAME);
+  return path11.join(skillDir, SKILL_ORIGIN_FILENAME);
 }
 function readSkillOrigin(skillDir) {
   const originPath = getSkillOriginPath(skillDir);
-  if (!fs3.existsSync(originPath)) return null;
+  if (!fs6.existsSync(originPath)) return null;
   try {
-    const raw = JSON.parse(fs3.readFileSync(originPath, "utf8"));
+    const raw = JSON.parse(fs6.readFileSync(originPath, "utf8"));
     if (raw && raw.version === 1 && raw.source) return raw;
   } catch {
   }
@@ -6890,7 +8549,7 @@ function matchesMarketplaceFilter(record, filter) {
 function resolveSkillRecord(meta, targetDir, skillName) {
   const fromMeta = meta.skills[skillName];
   if (fromMeta) return fromMeta;
-  const perSkill = readSkillOrigin(path8.join(targetDir, skillName));
+  const perSkill = readSkillOrigin(path11.join(targetDir, skillName));
   if (!perSkill) return null;
   return {
     source: perSkill.source,
@@ -6903,28 +8562,28 @@ function resolveSkillRecord(meta, targetDir, skillName) {
   };
 }
 function listActiveSkillDirs(targetDir) {
-  if (!fs3.existsSync(targetDir)) return [];
-  return fs3.readdirSync(targetDir).filter((name) => {
+  if (!fs6.existsSync(targetDir)) return [];
+  return fs6.readdirSync(targetDir).filter((name) => {
     if (name.startsWith(".")) return false;
-    const dir = path8.join(targetDir, name);
+    const dir = path11.join(targetDir, name);
     try {
-      if (!fs3.statSync(dir).isDirectory()) return false;
+      if (!fs6.statSync(dir).isDirectory()) return false;
     } catch {
       return false;
     }
-    return fs3.existsSync(path8.join(dir, "SKILL.md"));
+    return fs6.existsSync(path11.join(dir, "SKILL.md"));
   });
 }
 function disablePluginSkills(targetDir, plugin, marketplaceFilter) {
-  const resolvedTarget = path8.resolve(targetDir);
-  const stashDir = path8.join(targetDir, DISABLED_SUBDIR);
+  const resolvedTarget = path11.resolve(targetDir);
+  const stashDir = path11.join(targetDir, DISABLED_SUBDIR);
   const meta = readInstalledMeta(targetDir);
   const disabled = [];
   const alreadyDisabled = [];
   const skipped = [];
   for (const skillName of listActiveSkillDirs(targetDir)) {
-    const skillDir = path8.resolve(targetDir, skillName);
-    if (!skillDir.startsWith(resolvedTarget + path8.sep)) continue;
+    const skillDir = path11.resolve(targetDir, skillName);
+    if (!skillDir.startsWith(resolvedTarget + path11.sep)) continue;
     const record = resolveSkillRecord(meta, targetDir, skillName);
     if (!record || record.source !== "marketplace") {
       skipped.push(skillName);
@@ -6934,10 +8593,10 @@ function disablePluginSkills(targetDir, plugin, marketplaceFilter) {
       skipped.push(skillName);
       continue;
     }
-    const stashDest = path8.join(stashDir, skillName);
-    fs3.mkdirSync(stashDir, { recursive: true });
-    if (fs3.existsSync(stashDest)) fs3.rmSync(stashDest, { recursive: true, force: true });
-    fs3.renameSync(skillDir, stashDest);
+    const stashDest = path11.join(stashDir, skillName);
+    fs6.mkdirSync(stashDir, { recursive: true });
+    if (fs6.existsSync(stashDest)) fs6.rmSync(stashDest, { recursive: true, force: true });
+    fs6.renameSync(skillDir, stashDest);
     delete meta.skills[skillName];
     meta.disabled = meta.disabled ?? {};
     meta.disabled[skillName] = record;
@@ -6949,13 +8608,13 @@ function disablePluginSkills(targetDir, plugin, marketplaceFilter) {
     }
   }
   if (disabled.length > 0) {
-    fs3.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
+    fs6.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
   }
   return { disabled, alreadyDisabled, skipped };
 }
 function enablePluginSkills(targetDir, plugin, marketplaceFilter) {
-  const resolvedTarget = path8.resolve(targetDir);
-  const stashDir = path8.join(targetDir, DISABLED_SUBDIR);
+  const resolvedTarget = path11.resolve(targetDir);
+  const stashDir = path11.join(targetDir, DISABLED_SUBDIR);
   const meta = readInstalledMeta(targetDir);
   const enabled = [];
   const stashMissing = [];
@@ -6966,27 +8625,27 @@ function enablePluginSkills(targetDir, plugin, marketplaceFilter) {
       skipped.push(skillName);
       continue;
     }
-    const dest = path8.resolve(targetDir, skillName);
-    if (!dest.startsWith(resolvedTarget + path8.sep)) {
+    const dest = path11.resolve(targetDir, skillName);
+    if (!dest.startsWith(resolvedTarget + path11.sep)) {
       skipped.push(skillName);
       continue;
     }
-    const stashSrc = path8.join(stashDir, skillName);
-    if (!fs3.existsSync(stashSrc)) {
+    const stashSrc = path11.join(stashDir, skillName);
+    if (!fs6.existsSync(stashSrc)) {
       stashMissing.push(skillName);
       continue;
     }
-    if (fs3.existsSync(dest)) fs3.rmSync(dest, { recursive: true, force: true });
-    fs3.renameSync(stashSrc, dest);
+    if (fs6.existsSync(dest)) fs6.rmSync(dest, { recursive: true, force: true });
+    fs6.renameSync(stashSrc, dest);
     meta.skills[skillName] = record;
     delete meta.disabled[skillName];
     enabled.push(skillName);
   }
-  if (fs3.existsSync(stashDir) && fs3.readdirSync(stashDir).length === 0) {
-    fs3.rmdirSync(stashDir);
+  if (fs6.existsSync(stashDir) && fs6.readdirSync(stashDir).length === 0) {
+    fs6.rmdirSync(stashDir);
   }
   if (enabled.length > 0) {
-    fs3.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
+    fs6.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
   }
   return { enabled, stashMissing, skipped, hadDisabled: disabledEntries.length > 0 };
 }
@@ -7015,7 +8674,7 @@ function listPluginStates(targetDir) {
 }
 function detectRepoBranch(repoPath) {
   try {
-    const result = execFileSync3("git", ["-C", repoPath, "rev-parse", "--abbrev-ref", "HEAD"], {
+    const result = execFileSync4("git", ["-C", repoPath, "rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -7026,7 +8685,7 @@ function detectRepoBranch(repoPath) {
 }
 function getRepoRemoteUrl(repoPath) {
   try {
-    const raw = execFileSync3("git", ["-C", repoPath, "remote", "get-url", "origin"], {
+    const raw = execFileSync4("git", ["-C", repoPath, "remote", "get-url", "origin"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -7052,11 +8711,11 @@ function getInstalledPluginsForMarketplace(targetDir, marketplaceName, repoUrl)
 function readCustomTargets(globalConfig) {
   const raw = globalConfig.skillsTargets;
   if (!Array.isArray(raw)) return [];
-  return [...new Set(raw.filter((t) => typeof t === "string" && t.length > 0).map((t) => path8.resolve(t)))];
+  return [...new Set(raw.filter((t) => typeof t === "string" && t.length > 0).map((t) => path11.resolve(t)))];
 }
 function rememberCustomTarget(configPath, targetDir) {
-  const resolved = path8.resolve(targetDir);
-  const builtIn = Object.values(AGENT_PATHS).flatMap((a) => [path8.resolve(a.user), resolveProjectPath(a.project)]);
+  const resolved = path11.resolve(targetDir);
+  const builtIn = Object.values(AGENT_PATHS).flatMap((a) => [path11.resolve(a.user), resolveProjectPath(a.project)]);
   if (builtIn.includes(resolved)) return false;
   const existing = loadJsonFile(configPath) ?? {};
   const targets = readCustomTargets(existing);
@@ -7065,7 +8724,7 @@ function rememberCustomTarget(configPath, targetDir) {
   return true;
 }
 function forgetCustomTarget(configPath, targetDir) {
-  const resolved = path8.resolve(targetDir);
+  const resolved = path11.resolve(targetDir);
   const existing = loadJsonFile(configPath) ?? {};
   const targets = readCustomTargets(existing);
   if (!targets.includes(resolved)) return false;
@@ -7073,12 +8732,12 @@ function forgetCustomTarget(configPath, targetDir) {
   return true;
 }
 function summarizeLocation(agent, scope, targetDir) {
-  const resolved = path8.resolve(targetDir);
+  const resolved = path11.resolve(targetDir);
   const base = {
     agent,
     scope,
     path: resolved,
-    exists: fs3.existsSync(resolved),
+    exists: fs6.existsSync(resolved),
     totalSkills: 0,
     marketplaceSkills: 0,
     bundledSkills: 0,
@@ -7097,8 +8756,8 @@ function summarizeLocation(agent, scope, targetDir) {
   }
   const disabledNames = Object.keys(meta.disabled ?? {});
   base.disabledSkills = disabledNames.length;
-  const stashDir = path8.join(resolved, DISABLED_SUBDIR);
-  base.disabledStashMissing = disabledNames.filter((name) => !fs3.existsSync(path8.join(stashDir, name)));
+  const stashDir = path11.join(resolved, DISABLED_SUBDIR);
+  base.disabledStashMissing = disabledNames.filter((name) => !fs6.existsSync(path11.join(stashDir, name)));
   return base;
 }
 function listKnownLocations(globalConfig) {
@@ -7123,7 +8782,7 @@ function collectSkillStatus(globalConfig, locations) {
   const { byName, byUrl } = buildMarketplaceIndex(getAllMarketplaces(globalConfig));
   const remoteCache = /* @__PURE__ */ new Map();
   const remoteFor = (localPath) => {
-    if (!localPath || !fs3.existsSync(localPath)) return null;
+    if (!localPath || !fs6.existsSync(localPath)) return null;
     if (!remoteCache.has(localPath)) remoteCache.set(localPath, getRepoRemoteUrl(localPath));
     return remoteCache.get(localPath) ?? null;
   };
@@ -7136,7 +8795,7 @@ function collectSkillStatus(globalConfig, locations) {
       const registered = (recordedName ? byName.get(recordedName) : void 0) ?? (record?.installedFrom ? byUrl.get(record.installedFrom) : void 0) ?? null;
       records.push({
         skill: skillName,
-        path: enabled ? path8.join(location.path, skillName) : path8.join(location.path, DISABLED_SUBDIR, skillName),
+        path: enabled ? path11.join(location.path, skillName) : path11.join(location.path, DISABLED_SUBDIR, skillName),
         agent: location.agent,
         scope: location.scope,
         location: location.path,
@@ -7169,16 +8828,16 @@ function recordInstalledSkills(targetDir, skillNames, record) {
   for (const skillName of skillNames) {
     const fullRecord = { pncliVersion: getPncliVersion(), ...record, installedAt: now };
     meta.skills[skillName] = fullRecord;
-    const skillDir = path8.join(targetDir, skillName);
-    if (fs3.existsSync(skillDir)) {
+    const skillDir = path11.join(targetDir, skillName);
+    if (fs6.existsSync(skillDir)) {
       const origin = { version: 1, ...fullRecord };
       try {
-        fs3.writeFileSync(getSkillOriginPath(skillDir), JSON.stringify(origin, null, 2), "utf8");
+        fs6.writeFileSync(getSkillOriginPath(skillDir), JSON.stringify(origin, null, 2), "utf8");
       } catch {
       }
     }
   }
-  fs3.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
+  fs6.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
 }
 function findStaleBundledSkills(targetDir) {
   const currentVersion = getPncliVersion();
@@ -7246,7 +8905,13 @@ function upsertMarketplace(all, entry) {
     if (idxByName !== -1 && idxByName !== idxByUrl) {
       throw new Error(`Marketplace name "${entry.name}" is already used by a different marketplace (${all[idxByName].repoUrl}). Choose a different --name.`);
     }
-    all[idxByUrl] = { ...entry, token: entry.token ?? all[idxByUrl].token };
+    const previous = all[idxByUrl];
+    all[idxByUrl] = {
+      ...entry,
+      token: entry.token ?? previous.token,
+      ...entry.username ?? previous.username ? { username: entry.username ?? previous.username } : {},
+      ...entry.provider ?? previous.provider ? { provider: entry.provider ?? previous.provider } : {}
+    };
   } else if (idxByName !== -1) {
     throw new Error(`Marketplace name "${entry.name}" is already registered for a different repo (${all[idxByName].repoUrl}). Choose a different --name, or remove the existing marketplace first.`);
   } else {
@@ -7254,52 +8919,69 @@ function upsertMarketplace(all, entry) {
   }
 }
 function cloneOrReuseMarketplace(url, resolvedPath, opts, marketplaceName) {
-  const hasGit = fs3.existsSync(path8.join(resolvedPath, ".git"));
-  if (fs3.existsSync(resolvedPath) && !hasGit && fs3.readdirSync(resolvedPath).length > 0) {
+  const hasGit = fs6.existsSync(path11.join(resolvedPath, ".git"));
+  if (fs6.existsSync(resolvedPath) && !hasGit && fs6.readdirSync(resolvedPath).length > 0) {
     throw new Error(`Directory already exists and is not a git repo: ${resolvedPath}`);
   }
   if (hasGit) {
     warn(`Directory already contains a git repo at ${resolvedPath} \u2014 skipping clone, updating config and re-installing plugins.`);
     return;
   }
-  const resolvedToken = resolveMarketplaceToken(opts.token, url);
+  const { auth: credential, tokenSource } = marketplaceGitAuth({ name: marketplaceName, repoUrl: url, token: opts.token, username: opts.username, provider: opts.provider });
   const branchLabel = opts.branch ?? "remote default";
   warn(`Cloning ${url} (branch: ${branchLabel}) \u2192 ${resolvedPath}...`);
-  const cloneUrl = resolvedToken ? injectTokenIntoUrl(url, resolvedToken) : url;
-  const cloneArgs = ["clone"];
+  const auth = gitAuthFor(url, credential);
+  const cloneArgs = [...auth.args, "clone"];
   if (opts.branch) cloneArgs.push("--branch", opts.branch);
-  cloneArgs.push(cloneUrl, resolvedPath);
+  cloneArgs.push(url, resolvedPath);
   try {
-    execFileSync3("git", cloneArgs, { stdio: ["inherit", "inherit", "pipe"] });
+    execFileSync4("git", cloneArgs, { stdio: ["inherit", "inherit", "pipe"], env: { ...process.env, ...auth.env } });
   } catch (e) {
     let cloneActuallySucceeded = false;
     try {
-      execFileSync3("git", ["-C", resolvedPath, "rev-parse", "HEAD"], { stdio: "pipe" });
+      execFileSync4("git", ["-C", resolvedPath, "rev-parse", "HEAD"], { stdio: "pipe" });
       cloneActuallySucceeded = true;
     } catch {
     }
     if (!cloneActuallySucceeded) {
       const msg = e instanceof Error ? e.message : String(e);
-      const tokenSource = opts.token ? "explicit" : resolvedToken ? "fallback" : "none";
-      throw describeGitFailure(msg, marketplaceName, tokenSource);
+      throw describeGitFailure(msg, marketplaceName, tokenSource, { provider: credential?.provider, fallbackSource: credential?.source, customUsername: !!opts.username, userCredentialHost: auth.deferredToUser ?? void 0 });
     }
   }
 }
-function pullMarketplace(marketplacePath, repoUrl, token, marketplaceName) {
-  const resolvedToken = resolveMarketplaceToken(token, repoUrl);
-  warn(`Pulling latest content for "${marketplaceName}"...`);
-  const gitArgs = ["-C", marketplacePath];
-  if (repoUrl && resolvedToken) {
-    gitArgs.push("-c", `remote.origin.url=${injectTokenIntoUrl(repoUrl, resolvedToken)}`);
+function gitAuthFor(url, credential, opts = {}) {
+  if (!credential || !httpHostOf(url)) return { args: [], env: {}, deferredToUser: null };
+  if (credential.source === "bitbucket.pat" || credential.source === "ado.pat") {
+    const host = httpHostOf(url);
+    const path14 = new URL(url).pathname.replace(/^\//, "");
+    const base = opts.git ?? defaultGitRunner;
+    const git = opts.cwd ? (args, o) => base(["-C", opts.cwd, ...args], o) : base;
+    const fill = opts.fill ?? credentialFill;
+    if (fill(host, path14 || void 0, git)) return { args: [], env: {}, deferredToUser: host };
+  }
+  return { ...inlineCredentialArgs(credential.username, credential.password), deferredToUser: null };
+}
+function stripOriginCredentials(repoPath, plainUrl) {
+  try {
+    execFileSync4("git", ["-C", repoPath, "remote", "set-url", "origin", plainUrl], { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
   }
-  gitArgs.push("pull");
+}
+function pullMarketplace(marketplacePath, m, marketplaceName) {
+  const repoUrl = m.repoUrl;
+  const { auth: credential, tokenSource } = marketplaceGitAuth(m);
+  warn(`Pulling latest content for "${marketplaceName}"...`);
+  if (repoUrl && originHasCredentials(marketplacePath)) stripOriginCredentials(marketplacePath, repoUrl);
+  const auth = gitAuthFor(repoUrl, credential, { cwd: marketplacePath });
+  const gitArgs = ["-C", marketplacePath, ...auth.args, "pull"];
   let pullOutput;
   try {
-    pullOutput = execFileSync3("git", gitArgs, { encoding: "utf8", stdio: ["inherit", "pipe", "pipe"], env: { ...process.env, LANG: "C", LC_ALL: "C" } });
+    pullOutput = execFileSync4("git", gitArgs, { encoding: "utf8", stdio: ["inherit", "pipe", "pipe"], env: { ...process.env, ...auth.env, LANG: "C", LC_ALL: "C" } });
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    const tokenSource = token ? "explicit" : resolvedToken ? "fallback" : "none";
-    throw describeGitFailure(msg, marketplaceName, tokenSource);
+    throw describeGitFailure(msg, marketplaceName, tokenSource, { provider: credential?.provider, fallbackSource: credential?.source, customUsername: !!m.username, userCredentialHost: auth.deferredToUser ?? void 0 });
   }
   const updated = !pullOutput.includes("Already up to date");
   if (pullOutput.trim() && updated) warn(pullOutput.trim());
@@ -7312,7 +8994,7 @@ function installPluginsForMarketplace(marketplacePath, marketplaceName, repoUrl,
   const branch = detectRepoBranch(marketplacePath);
   for (const pluginName of pluginNames) {
     const skillsSrc = resolveSkillsSrc(marketplacePath, pluginName);
-    if (!fs3.existsSync(skillsSrc)) {
+    if (!fs6.existsSync(skillsSrc)) {
       results[pluginName] = { installed: [], failed: [] };
       warn(`No skills directory found for plugin "${pluginName}" in "${marketplaceName}" \u2014 skipping.`);
       continue;
@@ -7326,7 +9008,7 @@ function installPluginsForMarketplace(marketplacePath, marketplaceName, repoUrl,
     results[pluginName] = { installed, failed };
     totalInstalled += installed.length;
     for (const skill of installed) {
-      log(`  ${skill}: ${path8.join(skillsSrc, skill)} \u2192 ${path8.join(targetDir, skill)}`);
+      log(`  ${skill}: ${path11.join(skillsSrc, skill)} \u2192 ${path11.join(targetDir, skill)}`);
     }
     if (failed.length > 0) {
       warn(`Skipped ${failed.length} skill(s) with invalid names in "${pluginName}": ${failed.join(", ")}`);
@@ -7411,11 +9093,11 @@ function syncMarketplacePlugins(m, targets, pluginFilter, opts) {
   const marketplaceName = marketplaceLabel(m);
   try {
     const marketplacePath = m.localPath;
-    if (!marketplacePath || !fs3.existsSync(marketplacePath)) {
+    if (!marketplacePath || !fs6.existsSync(marketplacePath)) {
       warn(`Marketplace "${marketplaceName}" local path not found \u2014 skipping.`);
       return { marketplace: marketplaceName, skipped: true, message: "Local path not found." };
     }
-    const { updated } = pullMarketplace(marketplacePath, m.repoUrl, m.token, marketplaceName);
+    const { updated } = pullMarketplace(marketplacePath, m, marketplaceName);
     const pluginChoices = resolvePluginChoices(marketplacePath);
     if (pluginChoices.length === 0) {
       warn(`No plugins found in marketplace "${marketplaceName}" \u2014 skipping.`);
@@ -7434,19 +9116,40 @@ function syncMarketplacePlugins(m, targets, pluginFilter, opts) {
     return { marketplace: marketplaceName, skipped: true, error: message };
   }
 }
+function parseProviderOption(value) {
+  if (value === void 0) return void 0;
+  if (!PROVIDERS.includes(value)) {
+    throw new Error(`--provider must be one of: ${PROVIDERS.join(", ")} (got "${value}").`);
+  }
+  return value;
+}
+function safeProviderConfig() {
+  try {
+    return loadConfig();
+  } catch {
+    return {};
+  }
+}
 function performMarketplaceAdd(url, localPath, opts) {
-  const resolvedPath = path8.resolve(localPath ?? defaultMarketplacePath(url));
+  const resolvedPath = path11.resolve(localPath ?? defaultMarketplacePath(url));
   const marketplaceName = opts.name ?? repoNameFromUrl(url);
-  cloneOrReuseMarketplace(url, resolvedPath, opts, marketplaceName);
+  const provider = parseProviderOption(opts.provider);
+  cloneOrReuseMarketplace(url, resolvedPath, { ...opts, provider }, marketplaceName);
   const configPath = getGlobalConfigPath();
   const { existing, all } = loadMarketplacesConfig(configPath);
+  if (opts.keychain && !opts.token) warn("--keychain has no effect without --token.");
+  const account = `marketplaces.${marketplaceName}.token`;
+  const storeInKeychain = !!(opts.token && opts.keychain);
   const entry = {
     name: marketplaceName,
     repoUrl: url,
     localPath: resolvedPath,
-    ...opts.token ? { token: opts.token } : {}
+    ...opts.token ? { token: storeInKeychain ? keychainRef(account) : opts.token } : {},
+    ...opts.username ? { username: opts.username } : {},
+    ...provider ? { provider } : {}
   };
   upsertMarketplace(all, entry);
+  if (storeInKeychain) getKeychainBackend().set(account, opts.token);
   saveMarketplaces(configPath, existing, all);
   const targets = resolveInstallTargets(opts);
   const targetResults = installAllPlugins(entry, resolvedPath, targets);
@@ -7457,6 +9160,8 @@ function performMarketplaceAdd(url, localPath, opts) {
     localPath: resolvedPath,
     branch: opts.branch ?? null,
     tokenConfigured: !!opts.token,
+    tokenStorage: !opts.token ? null : opts.keychain ? "keychain" : "config",
+    provider: detectProvider(url, safeProviderConfig(), provider),
     // One target keeps the flat shape earlier versions emitted; several nest under `targets`.
     ...targetResults.length === 1 ? { plugins: targetResults[0].plugins, total: targetResults[0].total, target: targetResults[0].target } : { targets: targetResults, total: targetResults.reduce((sum, r) => sum + r.total, 0) },
     ...instructions ? { instructions } : {}
@@ -7471,12 +9176,22 @@ function performMarketplaceRemove(name) {
   }
   const removed = all.splice(idx, 1)[0];
   saveMarketplaces(configPath, existing, all);
+  let keychainEntryDeleted = false;
+  if (isKeychainRef(removed.token)) {
+    try {
+      const account = removed.token.slice("keychain:".length);
+      keychainEntryDeleted = purgeEntries(loadJsonFile(configPath) ?? {}, getKeychainBackend(), [account]).length > 0;
+    } catch (err) {
+      warn(`Could not delete the marketplace's keychain entry: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   return {
     removed: {
       name: marketplaceLabel(removed),
       repoUrl: removed.repoUrl,
       localPath: removed.localPath
     },
+    keychainEntryDeleted,
     remaining: all.length
   };
 }
@@ -7493,8 +9208,8 @@ function listBundledSkillDirs() {
   let skillDirs = [];
   if (bundledDir !== "") {
     try {
-      skillDirs = fs3.readdirSync(bundledDir).filter(
-        (name) => fs3.existsSync(path8.join(bundledDir, name, "SKILL.md"))
+      skillDirs = fs6.readdirSync(bundledDir).filter(
+        (name) => fs6.existsSync(path11.join(bundledDir, name, "SKILL.md"))
       );
     } catch {
     }
@@ -7505,30 +9220,30 @@ function listBundledSkillDirs() {
   return skillDirs;
 }
 function installBundledSkillsTo(targetDir, skillDirs) {
-  const resolvedTarget = path8.resolve(targetDir);
+  const resolvedTarget = path11.resolve(targetDir);
   const bundledDir = getBundledSkillsDir();
   const installed = [];
   const failed = [];
   for (const skillName of skillDirs) {
-    const existingDir = path8.resolve(targetDir, skillName);
-    if (!existingDir.startsWith(resolvedTarget + path8.sep)) continue;
-    if (fs3.existsSync(existingDir)) {
-      fs3.rmSync(existingDir, { recursive: true, force: true });
+    const existingDir = path11.resolve(targetDir, skillName);
+    if (!existingDir.startsWith(resolvedTarget + path11.sep)) continue;
+    if (fs6.existsSync(existingDir)) {
+      fs6.rmSync(existingDir, { recursive: true, force: true });
     }
   }
   log(`Installing ${skillDirs.length} bundled skill(s) to ${targetDir}...`);
   for (const skillName of skillDirs) {
-    const skillDir = path8.resolve(targetDir, skillName);
-    if (!skillDir.startsWith(resolvedTarget + path8.sep)) {
+    const skillDir = path11.resolve(targetDir, skillName);
+    if (!skillDir.startsWith(resolvedTarget + path11.sep)) {
       failed.push(skillName);
       continue;
     }
     try {
-      const mdFiles = fs3.readdirSync(path8.join(bundledDir, skillName)).filter((f) => f.endsWith(".md"));
-      fs3.mkdirSync(skillDir, { recursive: true });
+      const mdFiles = fs6.readdirSync(path11.join(bundledDir, skillName)).filter((f) => f.endsWith(".md"));
+      fs6.mkdirSync(skillDir, { recursive: true });
       for (const mdFile of mdFiles) {
-        const content = fs3.readFileSync(path8.join(bundledDir, skillName, mdFile), "utf8");
-        fs3.writeFileSync(path8.join(skillDir, mdFile), content, "utf8");
+        const content = fs6.readFileSync(path11.join(bundledDir, skillName, mdFile), "utf8");
+        fs6.writeFileSync(path11.join(skillDir, mdFile), content, "utf8");
       }
       installed.push(skillName);
     } catch {
@@ -7563,6 +9278,12 @@ Org plugins (skills and AGENTS.md/CLAUDE.md from a git-hosted marketplace):
 
 Check what is installed:
   pncli skills status | pncli skills locations | pncli doctor
+
+Private marketplaces and credentials:
+  pncli skills git-auth enable       # let git (and agent hosts) authenticate to marketplace hosts
+  pncli config keychain migrate      # move tokens out of plaintext config into the OS keychain
+
+New to this? pncli skills guide      # how skills management fits together (or: guide <section>)
 `);
   skills.command("install").description("Install the bundled pncli skills (project scope by default; --scope user for every repo)").option("--agent <agent>", `Target agent host: ${AGENT_CHOICES}`, DEFAULT_AGENT).option("--scope <scope>", "Installation scope: project | user", "project").option("--claude", "Shorthand for --agent claude-code").option("--all-agents", "Install to every supported agent host in one run").option("--target <dir>", "Override install directory (ignores --agent and --scope)").action((opts, cmd) => {
     const start = Date.now();
@@ -7587,7 +9308,7 @@ Check what is installed:
         return;
       }
       const agentName = resolveAgentName(opts);
-      const targetDir = opts.target ? path8.resolve(opts.target) : resolveScopedPath(resolveAgentPaths(agentName), scope);
+      const targetDir = opts.target ? path11.resolve(opts.target) : resolveScopedPath(resolveAgentPaths(agentName), scope);
       const { installed, failed } = installBundledSkillsTo(targetDir, skillDirs);
       let tracked = false;
       if (opts.target && installed.length > 0) {
@@ -7616,12 +9337,12 @@ Check what is installed:
     try {
       let targetDir;
       if (opts.target) {
-        targetDir = path8.resolve(opts.target);
+        targetDir = path11.resolve(opts.target);
       } else {
         const agentConfig = resolveAgentPaths(resolveAgentName(opts));
         targetDir = resolveScopedPath(agentConfig, opts.scope === "user" ? "user" : "project");
       }
-      if (!fs3.existsSync(targetDir)) {
+      if (!fs6.existsSync(targetDir)) {
         success({
           skills: [],
           total: 0,
@@ -7632,13 +9353,13 @@ Check what is installed:
         return;
       }
       const meta = readInstalledMeta(targetDir);
-      const skillDirs = fs3.readdirSync(targetDir).filter((name) => {
+      const skillDirs = fs6.readdirSync(targetDir).filter((name) => {
         if (name.startsWith(".")) return false;
-        const skillPath = path8.join(targetDir, name, "SKILL.md");
-        return fs3.existsSync(skillPath);
+        const skillPath = path11.join(targetDir, name, "SKILL.md");
+        return fs6.existsSync(skillPath);
       });
       const skillsList = skillDirs.map((name) => {
-        const content = fs3.readFileSync(path8.join(targetDir, name, "SKILL.md"), "utf8");
+        const content = fs6.readFileSync(path11.join(targetDir, name, "SKILL.md"), "utf8");
         const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
         const data = {};
         const metadata = {};
@@ -7691,24 +9412,24 @@ Check what is installed:
     try {
       let targetDir;
       if (opts.target) {
-        targetDir = path8.resolve(opts.target);
+        targetDir = path11.resolve(opts.target);
       } else {
         const agentConfig = resolveAgentPaths(resolveAgentName(opts));
         targetDir = resolveScopedPath(agentConfig, opts.scope === "project" ? "project" : "user");
       }
-      const resolvedTarget = path8.resolve(targetDir);
-      const skillDir = path8.resolve(targetDir, name);
-      if (!skillDir.startsWith(resolvedTarget + path8.sep)) {
+      const resolvedTarget = path11.resolve(targetDir);
+      const skillDir = path11.resolve(targetDir, name);
+      if (!skillDir.startsWith(resolvedTarget + path11.sep)) {
         throw new Error(`Invalid skill name: "${name}"`);
       }
-      if (!fs3.existsSync(skillDir)) {
+      if (!fs6.existsSync(skillDir)) {
         throw new Error(`Skill "${name}" not found at ${skillDir}`);
       }
       const meta = readInstalledMeta(targetDir);
       const record = meta.skills[name];
-      fs3.rmSync(skillDir, { recursive: true, force: true });
+      fs6.rmSync(skillDir, { recursive: true, force: true });
       delete meta.skills[name];
-      fs3.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
+      fs6.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
       success({
         uninstalled: name,
         target: targetDir,
@@ -7779,7 +9500,7 @@ Check what is installed:
     const start = Date.now();
     try {
       const configPath = getGlobalConfigPath();
-      const resolved = path8.resolve(dir);
+      const resolved = path11.resolve(dir);
       const forgotten = forgetCustomTarget(configPath, resolved);
       if (!forgotten) {
         warn(`${resolved} is not a tracked custom target \u2014 nothing to forget.`);
@@ -7793,6 +9514,44 @@ Check what is installed:
       fail(err, "skills", "forget-target", start);
     }
   });
+  skills.command("guide").description("Explain how skills management works: bundled skill vs marketplace plugins, agent hosts, scopes, sync, and auth").argument("[section]", "Print only one section (e.g. hosts, sync, auth, troubleshooting)").option("--sections", "List the section names as JSON instead of printing the guide").action((section, cmdOpts) => {
+    const start = Date.now();
+    try {
+      const guidePath = findGuidePath();
+      if (!guidePath) throw new Error(`${GUIDE_FILE} is missing from this pncli install \u2014 reinstall pncli, or read it online at https://kolatts.github.io/pncli/skills-guide/`);
+      const markdown = fs6.readFileSync(guidePath, "utf8").replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n/, "");
+      if (cmdOpts.sections) {
+        success({ sections: listGuideSections(markdown), path: guidePath }, "skills", "guide", start);
+        return;
+      }
+      if (section) {
+        const text = extractGuideSection(markdown, section);
+        if (!text) {
+          throw new Error(`No guide section matches "${section}". Sections: ${listGuideSections(markdown).map((s) => s.slug).join(", ")}`);
+        }
+        writeRawOutput(text);
+        return;
+      }
+      writeRawOutput(markdown);
+    } catch (err) {
+      fail(err, "skills", "guide", start);
+    }
+  });
+  registerGitAuthCommands(skills);
+  skills.command("git-credential", { hidden: true }).description("Git credential helper (used by git after `skills git-auth enable`; not for direct use)").option("--marketplace <name>", "Answer with this marketplace's credential (written by git-auth enable)").argument("<operation>", "get | store | erase (supplied by git)").action(async (operation, cmdOpts) => {
+    if (operation !== "get") return;
+    try {
+      const chunks = [];
+      for await (const chunk of process.stdin) chunks.push(chunk);
+      const request = parseCredentialRequest(Buffer.concat(chunks).toString("utf8"));
+      const configPath = skills.optsWithGlobals().config;
+      const globalConfig = loadJsonFile(getGlobalConfigPath(configPath)) ?? {};
+      const cfg = loadConfig({ configPath, keychainPaths: ["github.token", "bitbucket.pat", "ado.pat"] });
+      const answer = resolveCredential(request, globalConfig, cfg, void 0, cmdOpts.marketplace);
+      if (answer) process.stdout.write(formatCredentialAnswer(answer));
+    } catch {
+    }
+  });
   const marketplace = skills.command("marketplace").description("Org plugins from git-hosted marketplaces: add, sync, enable/disable, and shipped AGENTS.md/CLAUDE.md");
   marketplace.addHelpText("after", `
 Workflow:
@@ -7810,7 +9569,7 @@ Shipped instructions:
 
 Plugin skills always install at user scope. --agent picks the host (default: ${DEFAULT_AGENT}); --all-agents covers all of them.
 `);
-  marketplace.command("add").alias("setup").description("Register a new marketplace, clone it, install all its plugins, and apply its shipped AGENTS.md / CLAUDE.md (`setup` is an alias)").argument("<url>", "Git clone URL of the marketplace repository").argument("[localPath]", "Local directory to clone into (default: ~/.agents/marketplaces/<repo-name>)").option("--name <name>", "Human-readable name for this marketplace (default: derived from URL)").option("--branch <branch>", "Branch to clone (default: remote HEAD)").option("--token <token>", "HTTP access token for authenticated clone and pull (GitHub PAT or Bitbucket token)").option("--agent <agent>", `Target agent host for plugin install: ${AGENT_CHOICES} (default: ${DEFAULT_AGENT})`).option("--claude", "Shorthand for --agent claude-code").option("--all-agents", "Install to every supported agent host in one run").option("--no-instructions", "Do not apply the shipped AGENTS.md / CLAUDE.md to user-level instructions files").action((url, localPath, opts) => {
+  marketplace.command("add").alias("setup").description("Register a new marketplace, clone it, install all its plugins, and apply its shipped AGENTS.md / CLAUDE.md (`setup` is an alias)").argument("<url>", "Git clone URL of the marketplace repository").argument("[localPath]", "Local directory to clone into (default: ~/.agents/marketplaces/<repo-name>)").option("--name <name>", "Human-readable name for this marketplace (default: derived from URL)").option("--branch <branch>", "Branch to clone (default: remote HEAD)").option("--token <token>", "HTTP access token for authenticated clone and pull (GitHub PAT or Bitbucket token)").option("--keychain", "Store --token in the OS keychain instead of plaintext config (see: pncli config keychain --help)").option("--username <username>", "Username sent with the token (default: x-access-token on github.com, x-token-auth elsewhere; Bitbucket Data Center personal tokens usually need your username)").option("--provider <provider>", "Git host type, when detection guesses wrong: github | bitbucket | ado | git").option("--agent <agent>", `Target agent host for plugin install: ${AGENT_CHOICES} (default: ${DEFAULT_AGENT})`).option("--claude", "Shorthand for --agent claude-code").option("--all-agents", "Install to every supported agent host in one run").option("--no-instructions", "Do not apply the shipped AGENTS.md / CLAUDE.md to user-level instructions files").action((url, localPath, opts) => {
     const marketplaceIdx = process.argv.indexOf("marketplace");
     const invokedAs = marketplaceIdx !== -1 && process.argv[marketplaceIdx + 1] === "setup" ? "marketplace-setup" : "marketplace-add";
     return marketplaceAddAction(url, localPath, opts, invokedAs);
@@ -7820,13 +9579,17 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
     try {
       const configPath = getGlobalConfigPath();
       const all = loadMarketplaces(configPath);
+      const providerCfg = safeProviderConfig();
       success({
         marketplaces: all.map((m) => ({
           name: marketplaceLabel(m),
           repoUrl: m.repoUrl,
           localPath: m.localPath,
           tokenConfigured: !!m.token,
-          upstreamRemote: m.localPath && fs3.existsSync(m.localPath) ? getRepoRemoteUrl(m.localPath) : null
+          tokenStorage: !m.token ? null : isKeychainRef(m.token) ? "keychain" : "config",
+          provider: detectProvider(m.repoUrl, providerCfg, m.provider),
+          username: m.username ?? null,
+          upstreamRemote: m.localPath && fs6.existsSync(m.localPath) ? getRepoRemoteUrl(m.localPath) : null
         })),
         total: all.length
       }, "skills", "marketplace-list", start);
@@ -7834,6 +9597,54 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
       fail(err, "skills", "marketplace-list", start);
     }
   });
+  marketplace.command("update").description("Change a registered marketplace's token, username, or provider without re-adding it (rotate a token here)").argument("<name>", "Marketplace name (or repo URL)").option("--token <token>", "New access token for clone and pull").option("--keychain", "Store --token in the OS keychain instead of plaintext config").option("--username <username>", "Username sent with the token (Bitbucket Data Center personal tokens usually need your username)").option("--provider <provider>", "Git host type: github | bitbucket | ado | git").option("--clear-token", "Remove the marketplace's own token (falls back to the provider token pncli has, if any)").option("--clear-username", "Go back to the default username").option("--clear-provider", "Go back to automatic provider detection").action((name, opts) => {
+    const start = Date.now();
+    try {
+      if (opts.token && opts.clearToken) throw new Error("Pass --token or --clear-token, not both.");
+      if (opts.keychain && !opts.token) throw new Error("--keychain needs --token.");
+      const provider = parseProviderOption(opts.provider);
+      const configPath = getGlobalConfigPath();
+      const { existing, all } = loadMarketplacesConfig(configPath);
+      const idx = all.findIndex((m) => m.name === name || m.repoUrl === name);
+      if (idx === -1) throw new Error(`Marketplace "${name}" not found. Run: pncli skills marketplace list`);
+      const entry = { ...all[idx] };
+      const oldToken = entry.token;
+      const account = `marketplaces.${marketplaceLabel(entry)}.token`;
+      if (opts.token) {
+        if (opts.keychain) {
+          getKeychainBackend().set(account, opts.token);
+          entry.token = keychainRef(account);
+        } else {
+          entry.token = opts.token;
+        }
+      }
+      if (opts.clearToken) delete entry.token;
+      if (opts.username) entry.username = opts.username;
+      if (opts.clearUsername) delete entry.username;
+      if (provider) entry.provider = provider;
+      if (opts.clearProvider) delete entry.provider;
+      all[idx] = entry;
+      saveMarketplaces(configPath, existing, all);
+      if (isKeychainRef(oldToken) && oldToken !== entry.token) {
+        try {
+          purgeEntries(loadJsonFile(configPath) ?? {}, getKeychainBackend(), [oldToken.slice("keychain:".length)]);
+        } catch (err) {
+          warn(`Could not delete the old keychain entry: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      success({
+        name: marketplaceLabel(entry),
+        repoUrl: entry.repoUrl,
+        tokenConfigured: !!entry.token,
+        tokenStorage: !entry.token ? null : isKeychainRef(entry.token) ? "keychain" : "config",
+        username: entry.username ?? null,
+        provider: detectProvider(entry.repoUrl, safeProviderConfig(), entry.provider),
+        next: opts.username || opts.provider || opts.clearUsername || opts.clearProvider ? `If git-auth is enabled for it, refresh that too: pncli skills git-auth enable --marketplace ${marketplaceLabel(entry)}. Then verify with: pncli doctor` : "Verify with: pncli doctor"
+      }, "skills", "marketplace-update", start);
+    } catch (err) {
+      fail(err, "skills", "marketplace-update", start);
+    }
+  });
   marketplace.command("plugins").description("List the plugins available in a registered marketplace").argument("<name>", "Marketplace name (or repo URL) to inspect").action((name) => {
     const start = Date.now();
     try {
@@ -7843,7 +9654,7 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
       if (!found) {
         throw new Error(`Marketplace "${name}" not found. Run: pncli skills marketplace list`);
       }
-      if (!found.localPath || !fs3.existsSync(found.localPath)) {
+      if (!found.localPath || !fs6.existsSync(found.localPath)) {
         throw new Error(`Marketplace "${marketplaceLabel(found)}" local path not found at ${found.localPath ?? "(not set)"}. Run: pncli skills marketplace add <url>`);
       }
       const plugins = resolvePluginChoices(found.localPath);
@@ -7868,8 +9679,8 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
     const start = Date.now();
     try {
       const configPath = getGlobalConfigPath();
-      const allMarketplaces = loadMarketplaces(configPath);
-      if (allMarketplaces.length === 0) {
+      const allMarketplaces2 = loadMarketplaces(configPath);
+      if (allMarketplaces2.length === 0) {
         throw new Error("No marketplaces configured. Run: pncli skills marketplace add <url>");
       }
       const bareSync = isBareMarketplaceSync(plugin, opts);
@@ -7877,49 +9688,49 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
       const syncOpts = { force: opts.force ?? false, installedOnly: bareSync ? true : opts.installedOnly ?? false, instructions: opts.instructions !== false };
       const targetSummary = targets.length === 1 ? { target: targets[0].target } : { targets: targets.map((t) => t.target) };
       if (opts.marketplace === "all" || bareSync) {
-        const results = allMarketplaces.map((m) => syncMarketplacePlugins(m, targets, plugin ?? "all", syncOpts));
+        const results = allMarketplaces2.map((m) => syncMarketplacePlugins(m, targets, plugin ?? "all", syncOpts));
         success({ allMarketplaces: true, marketplaces: results, ...targetSummary }, "skills", "marketplace-sync", start);
         return;
       }
       let selectedMarketplace;
       let selectedPlugin = plugin;
-      const canGoBack = !opts.marketplace && allMarketplaces.length > 1;
+      const canGoBack = !opts.marketplace && allMarketplaces2.length > 1;
       if (opts.marketplace) {
-        const found = allMarketplaces.find((m) => m.name === opts.marketplace || m.repoUrl === opts.marketplace);
+        const found = allMarketplaces2.find((m) => m.name === opts.marketplace || m.repoUrl === opts.marketplace);
         if (!found) {
           throw new Error(`Marketplace "${opts.marketplace}" not found. Run: pncli skills marketplace list`);
         }
         selectedMarketplace = found;
-      } else if (allMarketplaces.length === 1) {
-        selectedMarketplace = allMarketplaces[0];
+      } else if (allMarketplaces2.length === 1) {
+        selectedMarketplace = allMarketplaces2[0];
       }
       for (; ; ) {
         if (!selectedMarketplace) {
-          assertInteractive(`Multiple marketplaces are registered (${allMarketplaces.map(marketplaceLabel).join(", ")}). Pass --marketplace <name> (or --marketplace all) to run this non-interactively.`);
+          assertInteractive(`Multiple marketplaces are registered (${allMarketplaces2.map(marketplaceLabel).join(", ")}). Pass --marketplace <name> (or --marketplace all) to run this non-interactively.`);
           const chosen = await select({
             message: "Select a marketplace to sync:",
             choices: [
               { value: ALL_MARKETPLACES, name: "All marketplaces \u2014 sync every plugin from every marketplace" },
               // Index-based values: labels alone aren't guaranteed unique (two marketplaces can share a derived name).
-              ...allMarketplaces.map((m2, i) => ({ value: String(i), name: `${marketplaceLabel(m2)} \u2014 ${m2.repoUrl ?? ""}` }))
+              ...allMarketplaces2.map((m2, i) => ({ value: String(i), name: `${marketplaceLabel(m2)} \u2014 ${m2.repoUrl ?? ""}` }))
             ]
           });
           if (chosen === ALL_MARKETPLACES) {
-            const results = allMarketplaces.map((m2) => syncMarketplacePlugins(m2, targets, selectedPlugin ?? "all", syncOpts));
+            const results = allMarketplaces2.map((m2) => syncMarketplacePlugins(m2, targets, selectedPlugin ?? "all", syncOpts));
             success({ allMarketplaces: true, marketplaces: results, ...targetSummary }, "skills", "marketplace-sync", start);
             return;
           }
-          selectedMarketplace = allMarketplaces[Number(chosen)];
+          selectedMarketplace = allMarketplaces2[Number(chosen)];
           if (!selectedMarketplace) {
             throw new Error(`Marketplace "${chosen}" not found.`);
           }
         }
         const marketplaceName = marketplaceLabel(selectedMarketplace);
         const marketplacePath = selectedMarketplace.localPath;
-        if (!marketplacePath || !fs3.existsSync(marketplacePath)) {
+        if (!marketplacePath || !fs6.existsSync(marketplacePath)) {
           throw new Error(`Marketplace "${marketplaceName}" local path not found at ${marketplacePath ?? "(not set)"}. Run: pncli skills marketplace add <url>`);
         }
-        const { updated } = pullMarketplace(marketplacePath, selectedMarketplace.repoUrl, selectedMarketplace.token, marketplaceName);
+        const { updated } = pullMarketplace(marketplacePath, selectedMarketplace, marketplaceName);
         const pluginChoices = resolvePluginChoices(marketplacePath);
         if (pluginChoices.length === 0) {
           throw new Error(`No plugins found in marketplace "${marketplaceName}". Check the marketplace repository structure.`);
@@ -7973,7 +9784,7 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
       const selected = opts.marketplace ? [findMarketplaceOrThrow(all, opts.marketplace)] : all;
       const agents = Object.keys(AGENT_PATHS);
       const marketplaces = selected.map((m) => {
-        const shipped = m.localPath && fs3.existsSync(m.localPath) ? findMarketplaceInstructions(m.localPath).map((s) => s.file) : [];
+        const shipped = m.localPath && fs6.existsSync(m.localPath) ? findMarketplaceInstructions(m.localPath).map((s) => s.file) : [];
         return {
           marketplace: marketplaceLabel(m),
           localPath: m.localPath ?? null,
@@ -7999,7 +9810,7 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
       const selected = opts.marketplace ? [findMarketplaceOrThrow(all, opts.marketplace)] : all;
       const results = selected.map((m) => {
         const name = marketplaceLabel(m);
-        if (!m.localPath || !fs3.existsSync(m.localPath)) {
+        if (!m.localPath || !fs6.existsSync(m.localPath)) {
           return { marketplace: name, skipped: true, message: "Local path not found. Run: pncli skills marketplace add <url>" };
         }
         if (findMarketplaceInstructions(m.localPath).length === 0) {
@@ -8037,31 +9848,31 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
     try {
       let targetDir;
       if (opts.target) {
-        targetDir = path8.resolve(opts.target);
+        targetDir = path11.resolve(opts.target);
       } else {
         const agentConfig = resolveAgentPaths(resolveAgentName(opts));
         targetDir = resolveScopedPath(agentConfig, opts.scope ?? "user");
       }
-      const resolvedTarget = path8.resolve(targetDir);
-      if (!fs3.existsSync(targetDir)) {
+      const resolvedTarget = path11.resolve(targetDir);
+      if (!fs6.existsSync(targetDir)) {
         success({ removed: [], total: 0, target: targetDir, message: "No skills directory found." }, "skills", "marketplace-purge-plugin", start);
         return;
       }
       const meta = readInstalledMeta(targetDir);
       const removed = [];
       const skipped = [];
-      const skillDirs = fs3.readdirSync(targetDir).filter((name) => {
+      const skillDirs = fs6.readdirSync(targetDir).filter((name) => {
         if (name.startsWith(".")) return false;
-        const p = path8.join(targetDir, name);
+        const p = path11.join(targetDir, name);
         try {
-          return fs3.statSync(p).isDirectory();
+          return fs6.statSync(p).isDirectory();
         } catch {
           return false;
         }
       });
       for (const skillName of skillDirs) {
-        const skillDir = path8.resolve(targetDir, skillName);
-        if (!skillDir.startsWith(resolvedTarget + path8.sep)) continue;
+        const skillDir = path11.resolve(targetDir, skillName);
+        if (!skillDir.startsWith(resolvedTarget + path11.sep)) continue;
         let record = meta.skills[skillName] ?? null;
         if (!record) {
           const perSkill = readSkillOrigin(skillDir);
@@ -8086,12 +9897,12 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
           skipped.push(skillName);
           continue;
         }
-        fs3.rmSync(skillDir, { recursive: true, force: true });
+        fs6.rmSync(skillDir, { recursive: true, force: true });
         delete meta.skills[skillName];
         removed.push(skillName);
       }
       if (removed.length > 0) {
-        fs3.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
+        fs6.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
       }
       success({
         removed,
@@ -8109,7 +9920,7 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
     const start = Date.now();
     try {
       const targetDir = resolveTargetDir(opts);
-      if (!fs3.existsSync(targetDir)) {
+      if (!fs6.existsSync(targetDir)) {
         success({ disabled: [], total: 0, target: targetDir, message: "No skills directory found." }, "skills", "marketplace-disable", start);
         return;
       }
@@ -8121,7 +9932,7 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
         total: result.disabled.length,
         target: targetDir,
         plugin,
-        stash: path8.join(targetDir, DISABLED_SUBDIR),
+        stash: path11.join(targetDir, DISABLED_SUBDIR),
         ...opts.marketplace ? { marketplace: opts.marketplace } : {}
       }, "skills", "marketplace-disable", start);
     } catch (err) {
@@ -8132,7 +9943,7 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
     const start = Date.now();
     try {
       const targetDir = resolveTargetDir(opts);
-      if (!fs3.existsSync(targetDir)) {
+      if (!fs6.existsSync(targetDir)) {
         success({ enabled: [], total: 0, target: targetDir, message: "No skills directory found." }, "skills", "marketplace-enable", start);
         return;
       }
@@ -8171,9 +9982,9 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
       const appliedInstructions = /* @__PURE__ */ new Map();
       const instructionAgents = opts.target ? [] : [resolveAgentName(opts)];
       for (; ; ) {
-        const states = fs3.existsSync(targetDir) ? listPluginStates(targetDir) : [];
+        const states = fs6.existsSync(targetDir) ? listPluginStates(targetDir) : [];
         const registered = loadMarketplaces(getGlobalConfigPath());
-        const shipping = registered.filter((m) => m.localPath && fs3.existsSync(m.localPath) && findMarketplaceInstructions(m.localPath).length > 0);
+        const shipping = registered.filter((m) => m.localPath && fs6.existsSync(m.localPath) && findMarketplaceInstructions(m.localPath).length > 0);
         const action = await select({
           message: `Manage skills marketplaces (target: ${targetDir}):`,
           choices: [
@@ -8287,15 +10098,15 @@ Plugin skills always install at user scope. --agent picks the host (default: ${D
     const start = Date.now();
     try {
       const userDir = resolveAgentPaths(resolveAgentName(opts)).user;
-      if (!fs3.existsSync(userDir)) {
+      if (!fs6.existsSync(userDir)) {
         success({ removed: 0, target: userDir, message: "No user-level skills directory found \u2014 nothing to purge." }, "skills", "purge-user", start);
         return;
       }
-      const skillDirs = fs3.readdirSync(userDir).filter((name) => {
+      const skillDirs = fs6.readdirSync(userDir).filter((name) => {
         if (name.startsWith(".")) return false;
-        const p = path8.join(userDir, name);
+        const p = path11.join(userDir, name);
         try {
-          return fs3.statSync(p).isDirectory();
+          return fs6.statSync(p).isDirectory();
         } catch {
           return false;
         }
@@ -8311,13 +10122,13 @@ Re-run with --force to confirm, or use \`pncli skills marketplace purge-plugin\`
         );
       }
       for (const name of skillDirs) {
-        const skillDir = path8.resolve(userDir, name);
-        if (!skillDir.startsWith(path8.resolve(userDir) + path8.sep)) continue;
-        fs3.rmSync(skillDir, { recursive: true, force: true });
+        const skillDir = path11.resolve(userDir, name);
+        if (!skillDir.startsWith(path11.resolve(userDir) + path11.sep)) continue;
+        fs6.rmSync(skillDir, { recursive: true, force: true });
       }
       const metaPath = getInstalledMetaPath(userDir);
-      if (fs3.existsSync(metaPath)) {
-        fs3.writeFileSync(metaPath, JSON.stringify({ version: 1, skills: {} }, null, 2), "utf8");
+      if (fs6.existsSync(metaPath)) {
+        fs6.writeFileSync(metaPath, JSON.stringify({ version: 1, skills: {} }, null, 2), "utf8");
       }
       success({ removed: skillDirs.length, skills: skillDirs, target: userDir }, "skills", "purge-user", start);
     } catch (err) {
@@ -8326,46 +10137,46 @@ Re-run with --force to confirm, or use \`pncli skills marketplace purge-plugin\`
   });
 }
 function resolvePluginChoices(marketplacePath) {
-  const marketplaceJsonPath = path8.join(marketplacePath, ".claude-plugin", "marketplace.json");
-  if (fs3.existsSync(marketplaceJsonPath)) {
+  const marketplaceJsonPath = path11.join(marketplacePath, ".claude-plugin", "marketplace.json");
+  if (fs6.existsSync(marketplaceJsonPath)) {
     try {
-      const meta = JSON.parse(fs3.readFileSync(marketplaceJsonPath, "utf8"));
+      const meta = JSON.parse(fs6.readFileSync(marketplaceJsonPath, "utf8"));
       if (Array.isArray(meta.plugins) && meta.plugins.length > 0) {
         return meta.plugins.map((p) => ({ name: p.name, description: p.description ?? "" }));
       }
     } catch {
     }
   }
-  const pluginsDir = path8.join(marketplacePath, "plugins");
-  if (fs3.existsSync(pluginsDir)) {
-    return fs3.readdirSync(pluginsDir).filter((name) => fs3.statSync(path8.join(pluginsDir, name)).isDirectory()).map((name) => ({ name, description: "" }));
+  const pluginsDir = path11.join(marketplacePath, "plugins");
+  if (fs6.existsSync(pluginsDir)) {
+    return fs6.readdirSync(pluginsDir).filter((name) => fs6.statSync(path11.join(pluginsDir, name)).isDirectory()).map((name) => ({ name, description: "" }));
   }
   return [];
 }
 function resolveSkillsSrc(marketplacePath, selectedPlugin) {
-  const pluginsBase = path8.resolve(marketplacePath, "plugins");
-  const skillsSrc = path8.resolve(pluginsBase, selectedPlugin, "skills");
-  if (!skillsSrc.startsWith(pluginsBase + path8.sep)) {
+  const pluginsBase = path11.resolve(marketplacePath, "plugins");
+  const skillsSrc = path11.resolve(pluginsBase, selectedPlugin, "skills");
+  if (!skillsSrc.startsWith(pluginsBase + path11.sep)) {
     throw new Error(`Invalid plugin name: "${selectedPlugin}"`);
   }
   return skillsSrc;
 }
 function copyPluginSkills(skillsSrc, targetDir, meta) {
-  fs3.mkdirSync(targetDir, { recursive: true });
-  const resolvedTarget = path8.resolve(targetDir);
-  const skillNames = fs3.readdirSync(skillsSrc).filter(
-    (name) => fs3.statSync(path8.join(skillsSrc, name)).isDirectory()
+  fs6.mkdirSync(targetDir, { recursive: true });
+  const resolvedTarget = path11.resolve(targetDir);
+  const skillNames = fs6.readdirSync(skillsSrc).filter(
+    (name) => fs6.statSync(path11.join(skillsSrc, name)).isDirectory()
   );
   const installed = [];
   const failed = [];
   for (const skillName of skillNames) {
-    const dest = path8.resolve(targetDir, skillName);
-    if (!dest.startsWith(resolvedTarget + path8.sep)) {
+    const dest = path11.resolve(targetDir, skillName);
+    if (!dest.startsWith(resolvedTarget + path11.sep)) {
       failed.push(skillName);
       continue;
     }
-    fs3.rmSync(dest, { recursive: true, force: true });
-    fs3.cpSync(path8.join(skillsSrc, skillName), dest, { recursive: true });
+    fs6.rmSync(dest, { recursive: true, force: true });
+    fs6.cpSync(path11.join(skillsSrc, skillName), dest, { recursive: true });
     installed.push(skillName);
   }
   if (meta) {
@@ -8382,9 +10193,10 @@ function copyPluginSkills(skillsSrc, targetDir, meta) {
 
 // src/services/config/commands.ts
 import chalk from "chalk";
-import fs4 from "fs";
+import fs7 from "fs";
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage pncli configuration");
+  registerKeychainCommands(config, program2);
   config.command("init").description("Setup wizard for service credentials (interactive)").option("--repo", "Write repo config (.pncli.json) instead of global config").action(async (opts) => {
     const start = Date.now();
     try {
@@ -8496,8 +10308,8 @@ function registerConfigCommands(program2) {
       if (cfg.ado.baseUrl) {
         try {
           const collection = cfg.defaults.ado?.collection;
-          const path11 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
-          await http.ado(path11);
+          const path14 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
+          await http.ado(path14);
           results.ado = { ok: true, message: "connected" };
         } catch (err) {
           results.ado = { ok: false, message: err instanceof Error ? err.message : String(err) };
@@ -8790,7 +10602,7 @@ async function initGlobalConfig(start) {
     message: "Jira base URL (e.g. jira.imagile.dev):",
     default: ""
   });
-  const jiraApiToken = await password({
+  const jiraApiToken = await password2({
     message: "Jira personal access token:"
   });
   process.stderr.write("\n\u2500\u2500 Bitbucket \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
@@ -8798,7 +10610,7 @@ async function initGlobalConfig(start) {
     message: "Bitbucket Server base URL (e.g. bitbucket.imagile.dev):",
     default: ""
   });
-  const bitbucketPat = await password({
+  const bitbucketPat = await password2({
     message: "Bitbucket personal access token:"
   });
   process.stderr.write("\n\u2500\u2500 GitHub \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
@@ -8813,7 +10625,7 @@ async function initGlobalConfig(start) {
       message: "GitHub API base URL\n  GitHub.com: api.github.com\n  GitHub Enterprise: <host>/api/v3\n  URL: ",
       default: ""
     });
-    githubToken = await password({
+    githubToken = await password2({
       message: "GitHub personal access token (classic or fine-grained):"
     });
     if (githubBaseUrl && githubToken) {
@@ -8840,7 +10652,7 @@ async function initGlobalConfig(start) {
     message: "Confluence base URL (e.g. confluence.imagile.dev):",
     default: ""
   });
-  const confluenceApiToken = await password({
+  const confluenceApiToken = await password2({
     message: "Confluence personal access token:"
   });
   process.stderr.write("\n\u2500\u2500 Artifactory \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
@@ -8858,7 +10670,7 @@ async function initGlobalConfig(start) {
       message: "Artifactory base URL (e.g. artifactory.imagile.dev):",
       default: ""
     });
-    artifactoryToken = await password({
+    artifactoryToken = await password2({
       message: "Artifactory API token:"
     });
     process.stderr.write("\nConfigure which ecosystems you use (skip any that don't apply):\n");
@@ -8887,7 +10699,7 @@ async function initGlobalConfig(start) {
       message: "SonarQube Server base URL (e.g. sonar.imagile.dev):",
       default: ""
     });
-    sonarToken = await password({
+    sonarToken = await password2({
       message: "SonarQube personal access token:"
     });
   }
@@ -8905,7 +10717,7 @@ async function initGlobalConfig(start) {
       default: false
     });
     if (useSdeConnectionString) {
-      const sdeConnection = await password({
+      const sdeConnection = await password2({
         message: "SDElements connection string (api-token@hostname, e.g. mytoken@myorg.sdelements.com):"
       });
       const atIdx = sdeConnection.indexOf("@");
@@ -8918,7 +10730,7 @@ async function initGlobalConfig(start) {
         message: "SDElements hostname\n  Cloud-hosted: imagile.sdelements.com\n  On-premise:   sde.imagile.dev\n  Host: ",
         default: ""
       });
-      sdeToken = await password({
+      sdeToken = await password2({
         message: "SDElements API token:"
       });
     }
@@ -8940,7 +10752,7 @@ async function initGlobalConfig(start) {
       message: "Azure DevOps Server base URL (e.g. tfs.imagile.dev or devops.imagile.dev/tfs):",
       default: ""
     });
-    adoPat = await password({
+    adoPat = await password2({
       message: "Azure DevOps personal access token:"
     });
     adoCollection = await input2({
@@ -9016,7 +10828,7 @@ async function initGlobalConfig(start) {
       message: "Jenkins username:",
       default: ""
     });
-    jenkinsApiToken = await password({
+    jenkinsApiToken = await password2({
       message: "Jenkins API token:"
     });
   }
@@ -9039,7 +10851,7 @@ async function initGlobalConfig(start) {
       message: "Checkmarx One tenant name (IAM realm, e.g. imagile):",
       default: ""
     });
-    checkmarxApiKey = await password({
+    checkmarxApiKey = await password2({
       message: "Checkmarx One API key (leave blank to use an OAuth client):"
     });
     if (!checkmarxApiKey) {
@@ -9047,7 +10859,7 @@ async function initGlobalConfig(start) {
         message: "Checkmarx One OAuth client ID:",
         default: ""
       });
-      checkmarxClientSecret = await password({
+      checkmarxClientSecret = await password2({
         message: "Checkmarx One OAuth client secret:",
         validate: (v) => v.length > 0 || "Client secret cannot be blank"
       });
@@ -9092,7 +10904,7 @@ async function initGlobalConfig(start) {
       message: "User Code (from User Token):",
       default: ""
     });
-    sonatypeIqPasscode = await password({
+    sonatypeIqPasscode = await password2({
       message: "Passcode (from User Token):"
     });
     if (sonatypeIqBaseUrl && sonatypeIqUserCode && sonatypeIqPasscode) {
@@ -9140,10 +10952,10 @@ async function initGlobalConfig(start) {
       message: "Username (email):",
       default: ""
     });
-    contrastApiKey = await password({
+    contrastApiKey = await password2({
       message: "API key:"
     });
-    contrastServiceKey = await password({
+    contrastServiceKey = await password2({
       message: "Service key:"
     });
     const contrastHasCreds = contrastOrgUuid && contrastUsername && contrastApiKey && contrastServiceKey;
@@ -9182,7 +10994,7 @@ async function initGlobalConfig(start) {
       message: "OpenShift API server URL (e.g. https://api.cluster.imagile.dev:6443):",
       default: ""
     });
-    openShiftToken = await password({
+    openShiftToken = await password2({
       message: "Service account token:"
     });
     if (openShiftBaseUrl && openShiftToken) {
@@ -9218,7 +11030,7 @@ async function initGlobalConfig(start) {
       message: "Dynatrace environment URL (e.g. https://abc12345.live.dynatrace.com):",
       default: ""
     });
-    dynatraceApiToken = await password({
+    dynatraceApiToken = await password2({
       message: "Environment API token (entities.read and problems.read):"
     });
     const configureTraces = await confirm({
@@ -9230,7 +11042,7 @@ async function initGlobalConfig(start) {
         message: "Dynatrace platform URL (e.g. https://abc12345.apps.dynatrace.com):",
         default: ""
       });
-      dynatracePlatformToken = await password({
+      dynatracePlatformToken = await password2({
         message: "Platform token with Grail span read permissions:"
       });
     }
@@ -9269,7 +11081,7 @@ async function initGlobalConfig(start) {
       message: "LogScale base URL (e.g. https://logscale.imagile.dev):",
       default: ""
     });
-    logscaleToken = await password({
+    logscaleToken = await password2({
       message: "LogScale personal access token:"
     });
     if (logscaleBaseUrl && logscaleToken) {
@@ -9303,7 +11115,7 @@ async function initGlobalConfig(start) {
       message: "Split.IO Admin API base URL (e.g. https://api.split.io):",
       default: ""
     });
-    splitioAdminApiKey = await password({
+    splitioAdminApiKey = await password2({
       message: "Split.IO Admin API key:"
     });
     if (splitioBaseUrl && splitioAdminApiKey) {
@@ -9333,7 +11145,7 @@ async function initGlobalConfig(start) {
   let figmaToken = "";
   if (useFigma) {
     process.stderr.write("  Generate a personal access token in Figma under Account Settings \u2192 Personal access tokens.\n");
-    figmaToken = await password({
+    figmaToken = await password2({
       message: "Figma personal access token:"
     });
     if (figmaToken) {
@@ -9370,7 +11182,7 @@ async function initGlobalConfig(start) {
       message: "Alation base URL (e.g. https://alation.imagile.dev):",
       validate: (v) => v.trim().length > 0 || "Required"
     });
-    alationRefreshToken = await password({
+    alationRefreshToken = await password2({
       message: "Alation refresh token:"
     });
     alationUserId = await input2({
@@ -9426,6 +11238,11 @@ async function initGlobalConfig(start) {
   const existingOpenshift = existingGlobal?.openshift;
   writeGlobalConfig({
     jenkinsInstances: existingInstances,
+    // Not prompted for here, so carry them over: dropping gitAuth strands `git-auth disable`
+    // (it restores from the recorded backups), and marketplaces/skillsTargets hold tokens and paths.
+    ...existingGlobal?.marketplaces ? { marketplaces: existingGlobal.marketplaces } : {},
+    ...existingGlobal?.skillsTargets ? { skillsTargets: existingGlobal.skillsTargets } : {},
+    ...existingGlobal?.gitAuth ? { gitAuth: existingGlobal.gitAuth } : {},
     user: {
       email: userEmail || void 0,
       userId: userId || void 0
@@ -9628,7 +11445,7 @@ async function initRepoConfig(start) {
     process.exitCode = ExitCode.SUCCESS;
     return;
   }
-  if (fs4.existsSync(".pncli.json")) {
+  if (fs7.existsSync(".pncli.json")) {
     const overwrite = await confirm({
       message: ".pncli.json already exists. Overwrite?",
       default: false
@@ -9662,14 +11479,172 @@ async function initRepoConfig(start) {
 }
 
 // src/services/doctor/commands.ts
-import fs5 from "fs";
-import path9 from "path";
+import fs9 from "fs";
+import path12 from "path";
+
+// src/services/doctor/git-auth-checks.ts
+import fs8 from "fs";
+var TOKEN_EXPIRY_WARNING_DAYS = 14;
+function checkKeychain(rawGlobalConfig, backend = getKeychainBackend(), configPath) {
+  const refs = findKeychainRefs(rawGlobalConfig);
+  const plaintext = findPlaintextSecrets(rawGlobalConfig).map((s) => s.path.join("."));
+  let unresolved = [];
+  if (refs.length > 0) {
+    resolveKeychainRefs(rawGlobalConfig, backend);
+    unresolved = getUnresolvedKeychainRefs();
+  }
+  const available = refs.length > 0 ? backend.available() : null;
+  const backupPath = configPath ? `${configPath}.pre-keychain.bak` : null;
+  return {
+    backend: backend.name,
+    store: backend.store,
+    available,
+    references: refs.length,
+    unresolved,
+    plaintextSecrets: plaintext,
+    plaintextBackup: backupPath && fs8.existsSync(backupPath) ? backupPath : null,
+    hint: plaintext.length > 0 && backend.name !== "none" ? `${plaintext.length} secret(s) are stored in plaintext config. Move them into the ${backend.store} with: pncli config keychain migrate` : null
+  };
+}
+async function checkGitAuth(rawGlobalConfig, cfg, offline, fetchFn = fetch, git = defaultGitRunner) {
+  const reports = [];
+  const inspected = /* @__PURE__ */ new Map();
+  const byName = new Map(allMarketplaces(rawGlobalConfig).map((m) => [m.name ?? m.repoUrl, m]));
+  for (const local of describeAllGitAuth(rawGlobalConfig, cfg, git)) {
+    let access = null;
+    let token = null;
+    const m = local.marketplace ? byName.get(local.marketplace) : void 0;
+    if (!offline && m?.repoUrl && !local.credentialError) {
+      let auth = null;
+      try {
+        auth = resolveMarketplaceAuth(m, cfg);
+      } catch {
+      }
+      access = lsRemote(m.repoUrl, auth, git, { keepHelpers: !auth });
+      if (auth && auth.provider === "github") {
+        const apiBase = apiBaseForHost(local.host, cfg.github?.baseUrl);
+        const key = `${apiBase}\0${auth.password}`;
+        if (!inspected.has(key)) inspected.set(key, await inspectGitHubToken(apiBase, auth.password, fetchFn));
+        token = inspected.get(key);
+      }
+    }
+    reports.push({ ...local, access, token });
+  }
+  return reports;
+}
+function buildKeychainProblems(report) {
+  const problems = report.unresolved.map((u) => ({
+    area: "keychain",
+    message: `${u.path} points at keychain entry "${u.account}", which could not be read (${u.reason})`,
+    fix: `Store it again with: pncli config keychain set ${u.path}  (or move it back to plaintext: pncli config keychain migrate --to config ${u.path})`
+  }));
+  if (report.plaintextBackup) {
+    problems.push({
+      area: "keychain",
+      message: `A plaintext copy of your pre-migration config (every secret in it) is still on disk: ${report.plaintextBackup}`,
+      fix: "Once `pncli config check` passes, delete that file."
+    });
+  }
+  return problems;
+}
+function rotateFix(source) {
+  if (source?.startsWith("marketplace:")) {
+    const name = source.slice("marketplace:".length);
+    return `Regenerate it, then: pncli skills marketplace update ${name} --token <new-token> [--keychain]`;
+  }
+  const key = source === "bitbucket.pat" || source === "ado.pat" ? source : "github.token";
+  return `Regenerate it, then: pncli config keychain set ${key}  (or: pncli config set ${key} <new-token>)`;
+}
+function subject(r) {
+  return r.marketplace ? `marketplace "${r.marketplace}"` : r.scope;
+}
+function enableFix(r) {
+  return r.marketplace ? `pncli skills git-auth enable --marketplace ${r.marketplace}` : `pncli skills git-auth enable --host ${r.host}`;
+}
+function accessFix(r) {
+  if (!r.pncliTokenSource) return `If the repo is private, give it a token: pncli skills marketplace update ${r.marketplace} --token <token>`;
+  if (r.provider === "bitbucket" && r.username === "x-token-auth") {
+    return `Bitbucket Data Center personal access tokens are usually sent with your username: pncli skills marketplace update ${r.marketplace} --username <your-bitbucket-username>. If that is not it, the token itself: ${rotateFix(r.pncliTokenSource)}`;
+  }
+  if (r.provider === "ado") return `Check the PAT has Code (Read) for this collection and has not expired. ${rotateFix(r.pncliTokenSource)}`;
+  return `Check the token can read this repo and has not expired. ${rotateFix(r.pncliTokenSource)}`;
+}
+function buildGitAuthProblems(reports) {
+  const problems = [];
+  for (const r of reports) {
+    const t = r.token;
+    if (r.credentialError) {
+      problems.push({ area: "git-auth", message: r.credentialError, fix: `Re-store it: pncli config keychain set marketplaces.${r.marketplace}.token` });
+      continue;
+    }
+    if (r.access && !r.access.ok) {
+      problems.push({
+        area: "git-auth",
+        message: `git cannot read ${subject(r)} (${r.repoUrl}) with the credential pncli has (${r.pncliTokenSource ?? "none"}): ${r.access.error}`,
+        fix: accessFix(r)
+      });
+    }
+    if (r.clonesWithEmbeddedToken.length > 0) {
+      problems.push({
+        area: "git-auth",
+        message: `The clone of ${subject(r)} stores a token in plaintext in .git/config (${r.clonesWithEmbeddedToken.join(", ")})`,
+        fix: `Run: ${enableFix(r)}  (it rewrites the remote without the token; the next sync does too)`
+      });
+    }
+    if (r.pncliTokenSource && r.mode === "none") {
+      problems.push({
+        area: "git-auth",
+        message: `git itself has no credential for ${subject(r)}: agent hosts that clone marketplaces themselves (e.g. Claude Code's /plugin marketplace add) will fail if it is private`,
+        fix: `Run: ${enableFix(r)}`
+      });
+    }
+    if (r.mode === "keychain" && r.matchesPncliToken === false) {
+      problems.push({
+        area: "git-auth",
+        message: `The token git has in the OS keychain for ${subject(r)} differs from the one pncli uses \u2014 usually a rotation that was not re-stored`,
+        fix: `Re-store it: ${enableFix(r)} --mode keychain  (or switch to helper mode, which never goes stale)`
+      });
+    }
+    if (!t) continue;
+    const who = `The GitHub token for ${subject(r)}`;
+    if (t.ssoAuthorizationRequired) {
+      problems.push({
+        area: "git-auth",
+        message: `${who} is not authorized for the organization's SAML SSO`,
+        fix: "GitHub \u2192 Settings \u2192 Developer settings \u2192 Personal access tokens \u2192 Configure SSO \u2192 Authorize for the org"
+      });
+    } else if (t.status === 401) {
+      problems.push({
+        area: "git-auth",
+        message: `${who} was rejected (HTTP 401) \u2014 expired or revoked (source: ${r.pncliTokenSource})`,
+        fix: rotateFix(r.pncliTokenSource)
+      });
+    }
+    if (t.missingRepoScope) {
+      problems.push({
+        area: "git-auth",
+        message: `${who} is a classic token without the "repo" scope (has: ${t.scopes?.join(", ") || "none"}), so a private marketplace will not clone`,
+        fix: 'Edit the token in GitHub \u2192 Settings \u2192 Developer settings \u2192 Tokens (classic) and tick "repo"'
+      });
+    }
+    if (t.expiresInDays !== null && t.expiresInDays <= TOKEN_EXPIRY_WARNING_DAYS) {
+      problems.push({
+        area: "git-auth",
+        message: t.expiresInDays < 0 ? `${who} expired on ${t.expiresAt}` : `${who} expires in ${t.expiresInDays} day(s) (${t.expiresAt})`,
+        fix: `${rotateFix(r.pncliTokenSource)} \u2014 helper mode picks up the new token automatically`
+      });
+    }
+  }
+  return problems;
+}
+
+// src/services/doctor/commands.ts
 function checkConfigFile(filePath) {
-  if (!fs5.existsSync(filePath)) {
+  if (!fs9.existsSync(filePath)) {
     return { path: filePath, exists: false, valid: false, message: "not present" };
   }
   try {
-    JSON.parse(fs5.readFileSync(filePath, "utf8"));
+    JSON.parse(fs9.readFileSync(filePath, "utf8"));
     return { path: filePath, exists: true, valid: true, message: "ok" };
   } catch (err) {
     return {
@@ -9750,13 +11725,13 @@ function buildProblems(globalFile, repoFile, credentials, skillLocations, market
   return problems;
 }
 function registerDoctorCommands(program2) {
-  program2.command("doctor").description("Diagnose pncli setup: config files, credentials, agent skills, and skills marketplaces").option("--offline", "Skip credential checks (no network calls)").action(async (cmdOpts) => {
+  program2.command("doctor").description("Diagnose pncli setup: config files, credentials, keychain references, git auth for marketplace hosts, agent skills, and marketplaces").option("--offline", "Skip credential checks (no network calls)").action(async (cmdOpts) => {
     const start = Date.now();
     try {
       const opts = program2.optsWithGlobals();
       const globalFile = checkConfigFile(opts.config ?? getGlobalConfigPath());
       const repoRoot = findGitRoot() ?? process.cwd();
-      const repoFile = checkConfigFile(path9.join(repoRoot, ".pncli.json"));
+      const repoFile = checkConfigFile(path12.join(repoRoot, ".pncli.json"));
       let credentials = null;
       let credentialsSkipped = cmdOpts.offline ? "--offline" : null;
       if (!cmdOpts.offline) {
@@ -9781,9 +11756,33 @@ function registerDoctorCommands(program2) {
         name: m.name ?? m.repoUrl ?? "(unnamed)",
         repoUrl: m.repoUrl ?? null,
         localPath: m.localPath ?? null,
-        cloneExists: !!m.localPath && fs5.existsSync(m.localPath)
+        cloneExists: !!m.localPath && fs9.existsSync(m.localPath)
       }));
-      const problems = buildProblems(globalFile, repoFile, credentials, skillLocations, marketplaces);
+      const keychain = (() => {
+        try {
+          return checkKeychain(globalConfig, void 0, opts.config ?? getGlobalConfigPath());
+        } catch (err) {
+          return { error: err instanceof Error ? err.message : String(err) };
+        }
+      })();
+      let gitAuth = [];
+      try {
+        const providerCfg = (() => {
+          try {
+            return loadConfig({ configPath: opts.config });
+          } catch {
+            return {};
+          }
+        })();
+        gitAuth = await checkGitAuth(globalConfig, providerCfg, !!cmdOpts.offline);
+      } catch (err) {
+        gitAuth = { error: err instanceof Error ? err.message : String(err) };
+      }
+      const problems = [
+        ...buildProblems(globalFile, repoFile, credentials, skillLocations, marketplaces),
+        ..."error" in keychain ? [] : buildKeychainProblems(keychain),
+        ...Array.isArray(gitAuth) ? buildGitAuthProblems(gitAuth) : []
+      ];
       if (credentials) {
         const statuses = Object.values(credentials).map((r) => r.status);
         if (statuses.includes("invalid")) process.exitCode = ExitCode.AUTH_ERROR;
@@ -9806,7 +11805,10 @@ function registerDoctorCommands(program2) {
           registered: marketplaces,
           hint: marketplaces.length === 0 ? "No org marketplaces registered. Add one with: pncli skills marketplace add <git-url> --all-agents" : "Refresh with: pncli skills marketplace sync --marketplace all --all-agents"
         },
-        problems
+        keychain,
+        gitAuth,
+        problems,
+        hint: problems.length === 0 ? null : "New to skills and marketplaces? pncli skills guide troubleshooting"
       }, "doctor", "check", start);
     } catch (err) {
       fail(err, "doctor", "check", start);
@@ -10195,8 +12197,8 @@ function registerAdoProjectCommands(ado) {
 }
 
 // src/services/ado/commands/work.ts
-import fs6 from "fs";
-import path10 from "path";
+import fs10 from "fs";
+import path13 from "path";
 
 // src/services/ado/input-schema.ts
 var ADO_WORK_INPUT_FILE_SCHEMA = {
@@ -10437,11 +12439,11 @@ function registerAdoWorkCommands(ado) {
       const attachments = await workClient.listAttachments(collection, parseInt(opts.id, 10));
       const attachment = attachments.find((a) => a.id === opts.attachmentId);
       if (!attachment) throw new PncliError(`Attachment not found: ${opts.attachmentId}`, 1);
-      const outDir = opts.dir ?? path10.join(process.cwd(), ".pncli");
-      fs6.mkdirSync(outDir, { recursive: true });
-      const outPath = path10.join(outDir, path10.basename(attachment.name));
+      const outDir = opts.dir ?? path13.join(process.cwd(), ".pncli");
+      fs10.mkdirSync(outDir, { recursive: true });
+      const outPath = path13.join(outDir, path13.basename(attachment.name));
       const buffer = await workClient.downloadAttachment(attachment.url);
-      fs6.writeFileSync(outPath, buffer);
+      fs10.writeFileSync(outPath, buffer);
       success({ saved: outPath, name: attachment.name, size: buffer.length }, "ado", "work-download-attachment", start);
     } catch (err) {
       fail(err, "ado", "work-download-attachment", start);
@@ -10475,10 +12477,10 @@ function registerAdoWorkCommands(ado) {
       const types = await discoverTypes(workClient, collection, project);
       if (opts.save) {
         const globalConfigPath = getGlobalConfigPath(globalOpts.config);
-        const fs9 = await import("fs");
-        const existing = JSON.parse(fs9.readFileSync(globalConfigPath, "utf8") || "{}");
+        const fs13 = await import("fs");
+        const existing = JSON.parse(fs13.readFileSync(globalConfigPath, "utf8") || "{}");
         existing.ado = { ...existing.ado ?? {}, discoveredTypes: types };
-        fs9.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+        fs13.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
         warn(`Saved ${types.length} types to ${globalConfigPath}`);
       }
       success(types, "ado", "work-types", start);
@@ -10507,11 +12509,11 @@ function registerAdoWorkCommands(ado) {
       ) : allFields;
       if (opts.save) {
         const globalConfigPath = getGlobalConfigPath(globalOpts.config);
-        const fs9 = await import("fs");
-        const existing = JSON.parse(fs9.readFileSync(globalConfigPath, "utf8") || "{}");
+        const fs13 = await import("fs");
+        const existing = JSON.parse(fs13.readFileSync(globalConfigPath, "utf8") || "{}");
         const aliases = buildDefaultAliases(allFields);
         existing.ado = { ...existing.ado ?? {}, discoveredFields: allFields, fieldAliases: aliases };
-        fs9.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+        fs13.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
         warn(`Saved ${allFields.length} fields and ${Object.keys(aliases).length} aliases to ${globalConfigPath}`);
       }
       success(fields, "ado", "work-fields", start);
@@ -10808,7 +12810,7 @@ function registerAdoRepoCommands(ado) {
       const start = Date.now();
       try {
         const globalOpts = ado.optsWithGlobals();
-        const { loadConfig: lc } = await import("./config-Y6IE6GY7.js");
+        const { loadConfig: lc } = await import("./config-OH2O5E3P.js");
         const config = lc({ configPath: globalOpts.config });
         const { collection, project, repo: repo2, gitClient } = getAdoContext(ado, true);
         const { AdoCoreClient: AdoCoreClient2 } = await import("./core-SWYVXOQ4.js");
@@ -11109,6 +13111,10 @@ async function pollBuildComplete(client, jobName, buildNumber, pollMs, timeoutMs
   }
   throw new PncliError(`Timed out waiting for build #${buildNumber} to complete after ${timeoutMs / 1e3}s`, 1);
 }
+function rawJenkinsInstances(configPath) {
+  const stored = loadJsonFile(getGlobalConfigPath(configPath))?.jenkinsInstances;
+  return Array.isArray(stored) ? stored : [];
+}
 function registerJenkinsCommands(program2) {
   const jenkins = program2.command("jenkins").description("Jenkins operations").option("--instance <name>", "Named Jenkins instance from global config (overrides default jenkins config)");
   const pipeline = jenkins.command("pipeline").description("Pipeline (job/build) operations");
@@ -11132,15 +13138,15 @@ function registerJenkinsCommands(program2) {
     try {
       const opts = jenkins.optsWithGlobals();
       const configPath = opts.config;
-      const existing = loadConfig({ configPath }).jenkinsInstances;
+      const existing = rawJenkinsInstances(configPath);
       const idx = existing.findIndex((i) => i.name === o.name);
       if (idx >= 0 && !o.force) {
         throw new PncliError(`Jenkins instance "${o.name}" already exists. Pass --force to overwrite it, or run: pncli jenkins instance remove --name ${o.name}`, 1);
       }
       let apiToken = o.apiToken;
       if (!apiToken && process.stdin.isTTY) {
-        const { default: password2 } = await import("@inquirer/password");
-        apiToken = await password2({ message: `API token for "${o.name}" (leave blank to skip):` });
+        const { default: password3 } = await import("@inquirer/password");
+        apiToken = await password3({ message: `API token for "${o.name}" (leave blank to skip):` });
       }
       const entry = {
         name: o.name,
@@ -11160,7 +13166,7 @@ function registerJenkinsCommands(program2) {
     try {
       const opts = jenkins.optsWithGlobals();
       const configPath = opts.config;
-      const existing = loadConfig({ configPath }).jenkinsInstances;
+      const existing = rawJenkinsInstances(configPath);
       if (!existing.some((i) => i.name === o.name)) {
         throw new PncliError(`Jenkins instance "${o.name}" not found. Run: pncli jenkins instance list`, 1);
       }
@@ -11282,18 +13288,18 @@ var ArtifactoryClient = class {
       }
     });
   }
-  async getStorageInfo(repo, path11) {
-    const cleanPath = path11.startsWith("/") ? path11.slice(1) : path11;
+  async getStorageInfo(repo, path14) {
+    const cleanPath = path14.startsWith("/") ? path14.slice(1) : path14;
     return this.http.artifactory(`${API9}/storage/${repo}/${cleanPath}`);
   }
-  async getProperties(repo, path11) {
-    const cleanPath = path11.startsWith("/") ? path11.slice(1) : path11;
+  async getProperties(repo, path14) {
+    const cleanPath = path14.startsWith("/") ? path14.slice(1) : path14;
     return this.http.artifactory(`${API9}/storage/${repo}/${cleanPath}`, {
       params: { properties: "" }
     });
   }
-  async setProperties(repo, path11, properties, opts = {}) {
-    const cleanPath = path11.startsWith("/") ? path11.slice(1) : path11;
+  async setProperties(repo, path14, properties, opts = {}) {
+    const cleanPath = path14.startsWith("/") ? path14.slice(1) : path14;
     const propString = Object.entries(properties).map(([k, v]) => `${k}=${v}`).join(";");
     await this.http.artifactory(`${API9}/storage/${repo}/${cleanPath}`, {
       method: "PUT",
@@ -11375,27 +13381,27 @@ function registerArtifactoryCommands(program2) {
       fail(err, "artifactory", "repos", start);
     }
   });
-  art.command("artifact-info <repo> <path>").description("Get metadata for an artifact or folder (checksums, size, timestamps)").action(async (repo, path11) => {
+  art.command("artifact-info <repo> <path>").description("Get metadata for an artifact or folder (checksums, size, timestamps)").action(async (repo, path14) => {
     const start = Date.now();
     try {
       const client = getClient8(program2);
-      const data = await client.getStorageInfo(repo, path11);
+      const data = await client.getStorageInfo(repo, path14);
       success(data, "artifactory", "artifact-info", start);
     } catch (err) {
       fail(err, "artifactory", "artifact-info", start);
     }
   });
-  art.command("properties-get <repo> <path>").description("Read custom properties on an artifact").action(async (repo, path11) => {
+  art.command("properties-get <repo> <path>").description("Read custom properties on an artifact").action(async (repo, path14) => {
     const start = Date.now();
     try {
       const client = getClient8(program2);
-      const data = await client.getProperties(repo, path11);
+      const data = await client.getProperties(repo, path14);
       success(data, "artifactory", "properties-get", start);
     } catch (err) {
       fail(err, "artifactory", "properties-get", start);
     }
   });
-  art.command("properties-set <repo> <path> [keyvals...]").description("Set custom properties on an artifact (format: key=value key=value...)").option("--recursive", "Apply recursively to folder contents", false).action(async (repo, path11, keyvals, opts) => {
+  art.command("properties-set <repo> <path> [keyvals...]").description("Set custom properties on an artifact (format: key=value key=value...)").option("--recursive", "Apply recursively to folder contents", false).action(async (repo, path14, keyvals, opts) => {
     const start = Date.now();
     try {
       if (!keyvals.length) throw new PncliError("Provide at least one key=value pair");
@@ -11406,8 +13412,8 @@ function registerArtifactoryCommands(program2) {
         properties[kv.slice(0, eq)] = kv.slice(eq + 1);
       }
       const client = getClient8(program2);
-      await client.setProperties(repo, path11, properties, { recursive: opts.recursive });
-      success({ repo, path: path11, properties }, "artifactory", "properties-set", start);
+      await client.setProperties(repo, path14, properties, { recursive: opts.recursive });
+      success({ repo, path: path14, properties }, "artifactory", "properties-set", start);
     } catch (err) {
       fail(err, "artifactory", "properties-set", start);
     }
@@ -11725,8 +13731,8 @@ function registerSonatypeIqCommands(program2) {
     const startTime = Date.now();
     try {
       const http = getHttpClient(program2);
-      const path11 = opts.organizationId ? `/api/v2/policies/organization/${encodeURIComponent(opts.organizationId)}` : "/api/v2/policies";
-      const data = await http.sonatypeiq(path11);
+      const path14 = opts.organizationId ? `/api/v2/policies/organization/${encodeURIComponent(opts.organizationId)}` : "/api/v2/policies";
+      const data = await http.sonatypeiq(path14);
       success(data, "sonatypeiq", "policies list", startTime);
     } catch (err) {
       fail(err, "sonatypeiq", "policies list", startTime);
@@ -12421,7 +14427,7 @@ function registerLogscaleCommands(program2) {
 }
 
 // src/services/splitio/commands.ts
-import fs7 from "fs";
+import fs11 from "fs";
 import confirm2 from "@inquirer/confirm";
 function getHttp4(program2) {
   const opts = program2.optsWithGlobals();
@@ -12433,9 +14439,9 @@ function getHttp4(program2) {
 function loadInputFile(filePath) {
   let raw;
   if (filePath === "-") {
-    raw = fs7.readFileSync(process.stdin.fd, "utf8");
+    raw = fs11.readFileSync(process.stdin.fd, "utf8");
   } else {
-    raw = fs7.readFileSync(filePath, "utf8");
+    raw = fs11.readFileSync(filePath, "utf8");
   }
   try {
     return JSON.parse(raw);
@@ -12967,7 +14973,7 @@ function registerFigmaCommands(program2) {
 }
 
 // src/services/alation/commands.ts
-import fs8 from "fs";
+import fs12 from "fs";
 var MAX_PAGE = 1e3;
 function parseIntOption(value, flag) {
   if (value === void 0) return void 0;
@@ -13080,8 +15086,8 @@ function getHttp6(program2) {
     Boolean(opts.dryRun)
   );
 }
-async function getOne(http, path11, id, what) {
-  const rows = await http.alation(path11, { params: { id, limit: 1 } });
+async function getOne(http, path14, id, what) {
+  const rows = await http.alation(path14, { params: { id, limit: 1 } });
   const row = Array.isArray(rows) ? rows.find((r) => r.id === id) ?? rows[0] : void 0;
   if (!row) throw new PncliError(`${what} ${id} not found`, 404);
   return row;
@@ -13131,7 +15137,7 @@ function registerAlationCommands(program2) {
       const opts = program2.optsWithGlobals();
       const config = loadConfig({ configPath: opts.config });
       if (opts.dryRun) {
-        fs8.writeSync(process.stderr.fd, `DRY RUN: POST ${config.alation.baseUrl ?? "<alation.baseUrl>"}/integration/v1/createAPIAccessToken/ (token exchange skipped)
+        fs12.writeSync(process.stderr.fd, `DRY RUN: POST ${config.alation.baseUrl ?? "<alation.baseUrl>"}/integration/v1/createAPIAccessToken/ (token exchange skipped)
 `);
         process.exitCode = ExitCode.SUCCESS;
         throw new PncliError("dry-run", 0);
@@ -13438,8 +15444,8 @@ Services:
   splitio      Split.IO (feature flags, Change Requests)
   figma        Figma (files, comments, version history)
   alation      Alation (data sources, schemas, tables, columns, search, Document Hubs)
-  config       Manage pncli configuration
-  doctor       Diagnose pncli setup (config files, credentials, agent skills, marketplaces)
+  config       Manage pncli configuration (and OS keychain storage for credentials)
+  doctor       Diagnose pncli setup (config, credentials, keychain, git auth, agent skills, marketplaces)
   skills       Install and manage agent skills (Codex, GitHub Copilot, Claude Code)
   jwt          JWT token utilities (decode header and payload)
 
@@ -13448,7 +15454,12 @@ Agent skills and org plugins:
   pncli skills marketplace add <git-url> --all-agents   Org plugins (skills + AGENTS.md/CLAUDE.md) from a git marketplace
   pncli skills marketplace sync                         Pull and refresh everything installed from marketplaces
   pncli skills marketplace manage                       Interactive: toggle plugins, add/remove marketplaces
+  pncli skills git-auth enable                          Let git and agent hosts authenticate to private marketplace hosts
+  pncli skills guide                                    How skills management fits together
   pncli skills --help                                   Every install location and command
+
+Credentials:
+  pncli config keychain migrate                         Move plaintext tokens into the OS keychain (--to config reverses it)
 `);
 program.parseAsync(process.argv).catch((err) => {
   if (process.exitCode !== void 0) return;