agent-nuvira 3.3.1 → 3.3.3

package/dist/agents/credential-store.d.ts

@@ -42,6 +42,32 @@ export interface PublishCredentials {
     git: GitCredentials;
     npm: NpmCredentials;
 }
+/**
+ * Release credentials may be STORED, not merely exported for one session.
+ *
+ * Why this exists: this store used to read only `process.env` and `.npmrc`,
+ * and `collectAll()` was the only way to mark credentials as collected. So an
+ * agent asked to release needed both tokens re-exported in its environment
+ * every session, and the `publish` TOOL — which may never prompt — could never
+ * set them up at all: it called `setupGitCredentials()` / `setupNpmAuth()`
+ * without `collectAll()`, both threw, and a single `try/catch` swallowed the
+ * pair. A tool-driven release therefore ran with NO credentials while
+ * reporting a clean pipeline.
+ *
+ * Tokens now persist in the nuvira env file (0600, resolved by
+ * `resolveNuviraEnvFile` — outside the repo, never in shell history), the SAME
+ * store the skill-secret path already writes. One place a credential lives.
+ */
+export declare const RELEASE_CREDENTIAL_KEYS: {
+    /** GitHub PAT / OAuth token used for HTTPS push. */
+    readonly gitToken: "GITHUB_TOKEN";
+    /** Git username paired with {@link RELEASE_CREDENTIAL_KEYS.gitToken}. */
+    readonly gitUsername: "GIT_USERNAME";
+    /** npm automation token used for `npm publish`. */
+    readonly npmToken: "NPM_TOKEN";
+    /** Optional non-default npm registry. */
+    readonly npmRegistry: "NPM_REGISTRY";
+};
 export declare class CredentialStore {
     private _git;
     private _npm;
@@ -61,6 +87,24 @@ export declare class CredentialStore {
      * Does NOT prompt — call collectAll() for interactive collection.
      */
     constructor();
+    /**
+     * Non-interactive initialisation.
+     *
+     * Adopts whatever was auto-detected — environment variables, the persisted
+     * store, and the project `.npmrc` — and marks the store collected, so
+     * {@link setupGitCredentials} / {@link setupNpmAuth} can run with NO TTY.
+     *
+     * This is the method the `publish` TOOL must call: a tool call may never
+     * block on a prompt, whereas `nuvira publish` on a terminal still uses
+     * `collectAll()` to ask for anything missing.
+     */
+    initialize(): PublishCredentials;
+    /**
+     * Validate the detected credentials against the live services.
+     * Best-effort and NON-FATAL: a network hiccup reports `unknown`, never a
+     * failure, so a preflight check can advise without blocking a release.
+     */
+    verify(): Promise<PublishVerification>;
     /**
      * Collect missing credentials interactively.
      * Skips prompts for already-detected values.
@@ -99,4 +143,80 @@ export declare function checkNpmCredentials(): boolean;
  * Get a human-readable summary of the current credential status.
  */
 export declare function getCredentialStatus(): string;
+/** Where a credential was found. */
+export type CredentialOrigin = 'env' | 'stored' | 'npmrc' | 'ssh' | 'none';
+/** One row of the release-credential status table. */
+export interface ReleaseCredentialRow {
+    /** Env var name the credential lives under. */
+    key: string;
+    /** What the credential is for. */
+    role: 'git' | 'npm';
+    /** Whether a usable value was found anywhere. */
+    set: boolean;
+    /** Masked value — enough to identify the key, never the key itself. */
+    masked?: string;
+    /** Where the value came from. */
+    origin: CredentialOrigin;
+}
+/** Result of a live credential probe against GitHub / the npm registry. */
+export interface CredentialProbe {
+    /** False when the check could not be completed (offline, timeout). */
+    checked: boolean;
+    /** True only when the service CONFIRMED the credential works. */
+    ok: boolean;
+    /** Human-readable outcome. */
+    detail: string;
+}
+/** Both probes from {@link CredentialStore.verify}. */
+export interface PublishVerification {
+    git: CredentialProbe;
+    npm: CredentialProbe;
+}
+/** The full release-credential picture, for the CLI and the tool. */
+export interface ReleaseCredentialStatus {
+    rows: ReleaseCredentialRow[];
+    git: {
+        canPush: boolean;
+        remoteUrl?: string;
+        repoSlug?: string;
+        origin: CredentialOrigin;
+    };
+    npm: {
+        canPublish: boolean;
+        registry: string;
+        origin: CredentialOrigin;
+    };
+    /** Path of the store the values are persisted to. */
+    storePath: string;
+}
+/**
+ * Describe every release credential, masked, and say whether a release could
+ * run right now. Never returns a raw secret — only {@link maskSecret} shapes.
+ */
+export declare function releaseCredentialStatus(): ReleaseCredentialStatus;
+/**
+ * Persist a release credential so it survives the session.
+ *
+ * Writes to the nuvira env file (created 0600 by {@link saveEnvValue}), which
+ * lives OUTSIDE the repository — a token in a committed file is a leak, and a
+ * token in a shell export is gone at the next login.
+ */
+export declare function storeReleaseCredential(name: string, value: string): {
+    success: boolean;
+    path: string;
+    reason?: string;
+};
+/**
+ * Forget a stored release credential.
+ * A value that was never stored is a SUCCESS — the caller's intent already
+ * holds, and reporting failure would only surface a pointless error.
+ */
+export declare function forgetReleaseCredential(name: string): {
+    success: boolean;
+    path: string;
+    removed: boolean;
+    reason?: string;
+};
+/** Whether `name` is a credential this module is willing to store. */
+export declare function isReleaseCredentialKey(name: string): boolean;
 //# sourceMappingURL=credential-store.d.ts.map

package/dist/agents/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../src/agents/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAYH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,cAAc,CAAC;CACrB;AAwGD,qBAAa,eAAe;IAC1B,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,IAAI,CAAyC;IACrD,OAAO,CAAC,UAAU,CAAS;IAE3B,kCAAkC;IAClC,IAAI,GAAG,IAAI,cAAc,CAExB;IAED,kCAAkC;IAClC,IAAI,GAAG,IAAI,cAAc,CAExB;IAED,8CAA8C;IAC9C,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,wDAAwD;IACxD,IAAI,OAAO,IAAI,OAAO,CAIrB;IAED,2DAA2D;IAC3D,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;;IAcH;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA8H/C;;;;;;OAMG;IACH,mBAAmB,IAAI,IAAI;IA+G3B;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAyBpB;;;OAGG;IACH,OAAO,IAAI,IAAI;CAqBhB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAiB5C"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../src/agents/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAmBH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,cAAc,CAAC;CACrB;AAID;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB;IAClC,oDAAoD;;IAEpD,yEAAyE;;IAEzE,mDAAmD;;IAEnD,yCAAyC;;CAEjC,CAAC;AAsIX,qBAAa,eAAe;IAC1B,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,IAAI,CAAyC;IACrD,OAAO,CAAC,UAAU,CAAS;IAE3B,kCAAkC;IAClC,IAAI,GAAG,IAAI,cAAc,CAExB;IAED,kCAAkC;IAClC,IAAI,GAAG,IAAI,cAAc,CAExB;IAED,8CAA8C;IAC9C,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,wDAAwD;IACxD,IAAI,OAAO,IAAI,OAAO,CAIrB;IAED,2DAA2D;IAC3D,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;;IA0BH;;;;;;;;;;OAUG;IACH,UAAU,IAAI,kBAAkB;IAKhC;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAoB5C;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAmI/C;;;;;;OAMG;IACH,mBAAmB,IAAI,IAAI;IAsH3B;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAyBpB;;;OAGG;IACH,OAAO,IAAI,IAAI;CAqBhB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAe5C;AAID,oCAAoC;AACpC,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3E,sDAAsD;AACtD,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,iDAAiD;IACjD,GAAG,EAAE,OAAO,CAAC;IACb,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,eAAe,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAC7B,GAAG,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAC3F,GAAG,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACzE,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;CACnB;AAoDD;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,uBAAuB,CA8DjE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBrD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAIvE;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG5D"}

package/dist/agents/credential-store.js

@@ -16,13 +16,60 @@
  * creds.setupGitCredentials(); // Sets GIT_ASKPASS for HTTPS auth
  * ```
  */
-import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs';
+import { resolveNuviraEnvFile } from '../config/paths.js';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import inquirer from 'inquirer';
 import { execSync } from 'node:child_process';
 import { logger } from '../utils/logger.js';
-// ─── Auto-Detection Constants ───────────────────────────────────────────────
+import { maskSecret } from '../enterprise/secrets.js';
+import { deleteEnvValue, getEnvVarValue, loadEnvFile, saveEnvValue, } from '../skills/secret-capture.js';
+// ─── Persisted release credentials ──────────────────────────────────────────
+/**
+ * Release credentials may be STORED, not merely exported for one session.
+ *
+ * Why this exists: this store used to read only `process.env` and `.npmrc`,
+ * and `collectAll()` was the only way to mark credentials as collected. So an
+ * agent asked to release needed both tokens re-exported in its environment
+ * every session, and the `publish` TOOL — which may never prompt — could never
+ * set them up at all: it called `setupGitCredentials()` / `setupNpmAuth()`
+ * without `collectAll()`, both threw, and a single `try/catch` swallowed the
+ * pair. A tool-driven release therefore ran with NO credentials while
+ * reporting a clean pipeline.
+ *
+ * Tokens now persist in the nuvira env file (0600, resolved by
+ * `resolveNuviraEnvFile` — outside the repo, never in shell history), the SAME
+ * store the skill-secret path already writes. One place a credential lives.
+ */
+export const RELEASE_CREDENTIAL_KEYS = {
+    /** GitHub PAT / OAuth token used for HTTPS push. */
+    gitToken: 'GITHUB_TOKEN',
+    /** Git username paired with {@link RELEASE_CREDENTIAL_KEYS.gitToken}. */
+    gitUsername: 'GIT_USERNAME',
+    /** npm automation token used for `npm publish`. */
+    npmToken: 'NPM_TOKEN',
+    /** Optional non-default npm registry. */
+    npmRegistry: 'NPM_REGISTRY',
+};
+/** Legacy/alternate GitHub token names accepted on read. */
+const GIT_TOKEN_ALIASES = ['GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_API_KEY'];
+/**
+ * Read a credential from the persisted store, falling back to `process.env`.
+ * Returns `undefined` when unset (never an empty string).
+ */
+function storedCredential(name) {
+    return getEnvVarValue(name) || undefined;
+}
+/** First set credential among `names`, in priority order. */
+function firstStoredCredential(names) {
+    for (const name of names) {
+        const value = storedCredential(name);
+        if (value)
+            return { name, value };
+    }
+    return undefined;
+}
 function detectGitRemote() {
     const creds = {};
     try {
@@ -94,6 +141,18 @@ function detectNpmConfig() {
             }
         }
     }
+    // Persisted store — the STORED path (nuvira env file), which is what makes a
+    // token survive across sessions without an env export.
+    if (!creds.token) {
+        const stored = getEnvVarValue(RELEASE_CREDENTIAL_KEYS.npmToken);
+        if (stored) {
+            creds.token = stored;
+            creds.configured = true;
+        }
+    }
+    const storedRegistry = getEnvVarValue(RELEASE_CREDENTIAL_KEYS.npmRegistry);
+    if (storedRegistry)
+        creds.registry = storedRegistry;
     creds.registry = creds.registry || 'https://registry.npmjs.org/';
     return creds;
 }
@@ -154,12 +213,59 @@ export class CredentialStore {
         if (process.env.GIT_USERNAME) {
             this._git.username = process.env.GIT_USERNAME;
         }
+        // …then the PERSISTED store (env file), for anything the environment did
+        // not already provide. `process.env` wins so a one-off override stays
+        // possible without editing the stored credential.
+        if (!this._git.token) {
+            const stored = firstStoredCredential(GIT_TOKEN_ALIASES);
+            if (stored)
+                this._git.token = stored.value;
+        }
+        if (!this._git.username) {
+            const storedUser = storedCredential(RELEASE_CREDENTIAL_KEYS.gitUsername);
+            if (storedUser)
+                this._git.username = storedUser;
+        }
+    }
+    /**
+     * Non-interactive initialisation.
+     *
+     * Adopts whatever was auto-detected — environment variables, the persisted
+     * store, and the project `.npmrc` — and marks the store collected, so
+     * {@link setupGitCredentials} / {@link setupNpmAuth} can run with NO TTY.
+     *
+     * This is the method the `publish` TOOL must call: a tool call may never
+     * block on a prompt, whereas `nuvira publish` on a terminal still uses
+     * `collectAll()` to ask for anything missing.
+     */
+    initialize() {
+        this._collected = true;
+        return { git: this._git, npm: this._npm };
+    }
+    /**
+     * Validate the detected credentials against the live services.
+     * Best-effort and NON-FATAL: a network hiccup reports `unknown`, never a
+     * failure, so a preflight check can advise without blocking a release.
+     */
+    async verify() {
+        const result = {
+            git: { checked: false, ok: false, detail: 'no git credentials' },
+            npm: { checked: false, ok: false, detail: 'no npm token' },
+        };
+        if (this._git.token) {
+            result.git = await probeGitHubToken(this._git.token);
+        }
+        if (this._npm.token) {
+            result.npm = await probeNpmToken(this._npm.token, this._npm.registry || 'https://registry.npmjs.org/');
+        }
+        return result;
     }
     /**
      * Collect missing credentials interactively.
      * Skips prompts for already-detected values.
      */
     async collectAll() {
+        // Already initialised non-interactively (tool path) — never re-prompt.
         if (this._collected) {
             return { git: this._git, npm: this._npm };
         }
@@ -269,7 +375,11 @@ export class CredentialStore {
         }
         this._collected = true;
         console.log('');
-        logger.success('  ✅ Credentials collected (session only — not stored to disk)');
+        // Report where they CAME from rather than claiming "session only": tokens
+        // are routinely read from the persisted store now, and a message that says
+        // otherwise makes an operator distrust the store they just populated.
+        logger.success('  ✅ Credentials ready for this run');
+        logger.info(`     Stored values are read from: ${resolveNuviraEnvFile()}`);
         console.log('');
         return { git: this._git, npm: this._npm };
     }
@@ -348,8 +458,15 @@ export class CredentialStore {
             // Platform-aware: `.cmd` on Windows, `.sh` on Unix. Username/token ride
             // in env (never inlined into the script file on disk), which removes the
             // biggest breakage vector (tokens with &, %, ^, quotes, spaces) and keeps
-            // secrets out of temp files. cmd.exe still expands %BUFF_GIT_TOKEN% at
+            // secrets out of temp files. cmd.exe still expands %NUVIRA_GIT_TOKEN% at
             // runtime, so values containing `%` remain best-effort on Windows.
+            //
+            // The variable names here MUST match the ones exported below: the script
+            // and the env were written on different days (one read BUFF_GIT_TOKEN
+            // while the other set NUVIRA_GIT_TOKEN), so a stored `GITHUB_TOKEN`
+            // produced an askpass helper that echoed an EMPTY string — HTTPS auth
+            // silently fell back to whatever credential helper the machine had, and
+            // a machine with none simply could not push.
             const isWindows = process.platform === 'win32';
             const askPassPath = join(tmpdir(), isWindows ? 'buff-git-askpass.cmd' : 'buff-git-askpass.sh');
             const username = this._git.username || process.env.USER || process.env.USERNAME || 'git';
@@ -358,16 +475,16 @@ export class CredentialStore {
                 ? '@echo off\r\n' +
                     'echo %1 | findstr /i "Username" >nul\r\n' +
                     'if not errorlevel 1 (\r\n' +
-                    '  echo %BUFF_GIT_USERNAME%\r\n' +
+                    '  echo %NUVIRA_GIT_USERNAME%\r\n' +
                     ') else (\r\n' +
-                    '  echo %BUFF_GIT_TOKEN%\r\n' +
+                    '  echo %NUVIRA_GIT_TOKEN%\r\n' +
                     ')\r\n'
                 // Unix variant reads the values from env too — never inlines secrets
                 // into the script file on disk.
                 : '#!/bin/sh\n' +
                     'case "$1" in\n' +
-                    '  *Username*) echo "$BUFF_GIT_USERNAME" ;;\n' +
-                    '  *)          echo "$BUFF_GIT_TOKEN" ;;\n' +
+                    '  *Username*) echo "$NUVIRA_GIT_USERNAME" ;;\n' +
+                    '  *)          echo "$NUVIRA_GIT_TOKEN" ;;\n' +
                     'esac\n';
             writeFileSync(askPassPath, askPassContent, 'utf-8');
             // Values ride in env so the script text stays literal and safe.
@@ -452,18 +569,240 @@ export function checkNpmCredentials() {
  * Get a human-readable summary of the current credential status.
  */
 export function getCredentialStatus() {
+    const status = releaseCredentialStatus();
     const lines = [];
-    // Git status
-    const gitToken = process.env.GITHUB_TOKEN || process.env.GH_TOKEN || '';
-    const gitRemote = detectGitRemote();
-    lines.push(`  📡 Remote: ${gitRemote.remoteUrl || 'Not configured'}`);
-    lines.push(`  🔑 Git token: ${gitToken ? '✅ Detected' : '❌ Missing'}`);
-    lines.push(`  🔐 SSH key: ${gitRemote.sshKeyPath ? `✅ ${gitRemote.sshKeyPath}` : '❌ Not detected'}`);
-    // npm status
-    const npmToken = process.env.NPM_TOKEN || '';
-    const npmConfig = detectNpmConfig();
-    lines.push(`  📦 npm token: ${npmToken || npmConfig.token ? '✅ Detected' : '❌ Missing'}`);
-    lines.push(`  📦 npm registry: ${npmConfig.registry || 'Not configured'}`);
+    lines.push(`  📡 Remote: ${status.git.remoteUrl || 'Not configured'}`);
+    const gitRow = status.rows.find((r) => r.role === 'git');
+    lines.push(`  🔑 Git token: ${gitRow?.set ? `✅ Detected (${gitRow.origin})` : '❌ Missing'}`);
+    const ssh = status.rows.find((r) => r.role === 'git' && r.origin === 'ssh');
+    lines.push(`  🔐 SSH key: ${ssh ? `✅ ${ssh.key}` : '❌ Not detected'}`);
+    const npmRow = status.rows.find((r) => r.role === 'npm');
+    lines.push(`  📦 npm token: ${npmRow?.set ? `✅ Detected (${npmRow.origin})` : '❌ Missing'}`);
+    lines.push(`  📦 npm registry: ${status.npm.registry || 'Not configured'}`);
     return lines.join('\n');
 }
+/**
+ * Resolve one credential and report WHERE it came from.
+ *
+ * The env FILE is consulted first, by reading it directly. It cannot be found
+ * through `process.env` order alone: nuvira loads that file into `process.env`
+ * at startup, so an environment-first check labelled every STORED token as
+ * `env` — the status output claimed the store was empty while it was in fact
+ * the thing supplying the value.
+ */
+function resolveCredential(names, fileVars) {
+    for (const name of names) {
+        const fromFile = fileVars[name]?.trim();
+        if (fromFile)
+            return { value: fromFile, origin: 'stored', key: name };
+    }
+    for (const name of names) {
+        const fromEnv = process.env[name]?.trim();
+        if (fromEnv)
+            return { value: fromEnv, origin: 'env', key: name };
+    }
+    return { origin: 'none', key: names[0] ?? '' };
+}
+/** The npm token as written by `npm login` into a `.npmrc`, if any. */
+function projectNpmrcToken() {
+    for (const candidate of [join(process.cwd(), '.npmrc'), join(homedir(), '.npmrc')]) {
+        if (!existsSync(candidate))
+            continue;
+        try {
+            const m = readFileSync(candidate, 'utf-8').match(/\/\/registry\.npmjs\.org\/:_authToken=([^\s]+)/);
+            // A `${VAR}` placeholder is not a token — resolve it (setupNpmAuth writes
+            // the placeholder form, with the real value in the environment).
+            const raw = m?.[1];
+            if (!raw)
+                continue;
+            const indirection = raw.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/);
+            if (indirection) {
+                const resolved = process.env[indirection[1]]?.trim();
+                if (resolved)
+                    return resolved;
+                continue;
+            }
+            return raw;
+        }
+        catch {
+            // Unreadable .npmrc — try the next one.
+        }
+    }
+    return '';
+}
+/**
+ * Describe every release credential, masked, and say whether a release could
+ * run right now. Never returns a raw secret — only {@link maskSecret} shapes.
+ */
+export function releaseCredentialStatus() {
+    // Read the store ONCE — the file is re-read per call otherwise.
+    const fileVars = loadEnvFile();
+    const git = resolveCredential(GIT_TOKEN_ALIASES, fileVars);
+    const gitUser = resolveCredential([RELEASE_CREDENTIAL_KEYS.gitUsername], fileVars);
+    const npm = resolveCredential([RELEASE_CREDENTIAL_KEYS.npmToken], fileVars);
+    const npmRegistry = resolveCredential([RELEASE_CREDENTIAL_KEYS.npmRegistry], fileVars);
+    const remote = detectGitRemote();
+    // npm's own `.npmrc` is a legitimate source — `npm login` writes it, and a
+    // release that ignored it would report "no npm token" on a machine that can
+    // publish perfectly well.
+    let npmValue = npm.value;
+    let npmOrigin = npm.origin;
+    if (!npmValue) {
+        const fromNpmrc = projectNpmrcToken();
+        if (fromNpmrc) {
+            npmValue = fromNpmrc;
+            npmOrigin = 'npmrc';
+        }
+    }
+    const rows = [
+        {
+            key: git.key || RELEASE_CREDENTIAL_KEYS.gitToken,
+            role: 'git',
+            set: Boolean(git.value) || Boolean(remote.sshKeyPath),
+            masked: git.value ? maskSecret(git.value) : undefined,
+            origin: git.value ? git.origin : remote.sshKeyPath ? 'ssh' : 'none',
+        },
+        {
+            key: gitUser.key || RELEASE_CREDENTIAL_KEYS.gitUsername,
+            role: 'git',
+            set: Boolean(gitUser.value),
+            masked: gitUser.value ? maskSecret(gitUser.value) : undefined,
+            origin: gitUser.origin,
+        },
+        {
+            key: npm.key || RELEASE_CREDENTIAL_KEYS.npmToken,
+            role: 'npm',
+            set: Boolean(npmValue),
+            masked: npmValue ? maskSecret(npmValue) : undefined,
+            origin: npmOrigin,
+        },
+    ];
+    return {
+        rows,
+        git: {
+            canPush: Boolean(git.value) || Boolean(remote.sshKeyPath),
+            remoteUrl: remote.remoteUrl,
+            repoSlug: remote.repoSlug,
+            origin: rows[0].origin,
+        },
+        npm: {
+            canPublish: Boolean(npmValue),
+            registry: npmRegistry.value || 'https://registry.npmjs.org/',
+            origin: npmOrigin,
+        },
+        storePath: resolveNuviraEnvFile(),
+    };
+}
+/**
+ * Persist a release credential so it survives the session.
+ *
+ * Writes to the nuvira env file (created 0600 by {@link saveEnvValue}), which
+ * lives OUTSIDE the repository — a token in a committed file is a leak, and a
+ * token in a shell export is gone at the next login.
+ */
+export function storeReleaseCredential(name, value) {
+    const cleaned = String(value ?? '').replace(/[\r\n]/g, '').trim();
+    if (!cleaned) {
+        return { success: false, path: resolveNuviraEnvFile(), reason: 'empty-value' };
+    }
+    const result = saveEnvValue(name, cleaned);
+    if (result.success) {
+        // Owner-only. `saveEnvValue` writes with the process umask, which on a
+        // default (022) install produced a WORLD-READABLE file holding a token.
+        // Best-effort: a filesystem without POSIX permissions still stores fine.
+        try {
+            chmodSync(result.path, 0o600);
+        }
+        catch { /* best-effort — non-POSIX filesystems */ }
+        // Make it usable in THIS process too, so a release started right after the
+        // token is stored does not need a restart to pick it up.
+        process.env[name] = cleaned;
+    }
+    return { success: result.success, path: result.path, reason: result.reason };
+}
+/**
+ * Forget a stored release credential.
+ * A value that was never stored is a SUCCESS — the caller's intent already
+ * holds, and reporting failure would only surface a pointless error.
+ */
+export function forgetReleaseCredential(name) {
+    const result = deleteEnvValue(name);
+    if (result.success)
+        delete process.env[name];
+    return result;
+}
+/** Whether `name` is a credential this module is willing to store. */
+export function isReleaseCredentialKey(name) {
+    return Object.values(RELEASE_CREDENTIAL_KEYS).includes(name)
+        || GIT_TOKEN_ALIASES.includes(name);
+}
+/**
+ * Confirm a GitHub token is live. A 401 is a DEFINITIVE failure (the token was
+ * revoked or lacks scopes); anything else inconclusive — offline, timeout,
+ * rate-limit — reports `checked: false` so a preflight can warn without
+ * blocking a release on a flaky network.
+ */
+async function probeGitHubToken(token) {
+    try {
+        const res = await fetch('https://api.github.com/user', {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/vnd.github+json',
+                'User-Agent': 'agent-nuvira',
+            },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            return {
+                checked: true,
+                ok: true,
+                detail: body.login ? `authenticated as ${body.login}` : 'token accepted',
+            };
+        }
+        if (res.status === 401) {
+            return { checked: true, ok: false, detail: 'token rejected (401) — revoked or wrong scopes' };
+        }
+        return { checked: true, ok: true, detail: `GitHub returned ${res.status} (token accepted)` };
+    }
+    catch (err) {
+        return {
+            checked: false,
+            ok: false,
+            detail: `could not reach GitHub: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+/**
+ * Confirm an npm token is live, by asking the registry who we are. Same
+ * conservatism as {@link probeGitHubToken}: only a definitive rejection counts.
+ */
+async function probeNpmToken(token, registry) {
+    const base = registry.replace(/\/+$/, '');
+    try {
+        const res = await fetch(`${base}/-/whoami`, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            return {
+                checked: true,
+                ok: true,
+                detail: body.username ? `authenticated as ${body.username}` : 'token accepted',
+            };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { checked: true, ok: false, detail: `token rejected (${res.status})` };
+        }
+        return { checked: true, ok: true, detail: `registry returned ${res.status} (token accepted)` };
+    }
+    catch (err) {
+        return {
+            checked: false,
+            ok: false,
+            detail: `could not reach ${base}: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
 //# sourceMappingURL=credential-store.js.map