relay-flow 0.2.0-alpha → 0.2.1-alpha

package/internal/runner/orca/orca_test.go

@@ -41,9 +41,14 @@ func TestSanitizeErr(t *testing.T) {
 type fakeCLI struct {
 	repos     []orcacli.Repo
 	worktrees []orcacli.Worktree
+	terminals map[string]orcacli.Terminal
 
 	createdBaseBranch string
 	createdParent     string
+	status            string
+	showHandles       []string
+	createCommands    []string
+	createN           int
 }
 
 func (f *fakeCLI) ListRepos(context.Context) ([]orcacli.Repo, error) { return f.repos, nil }
@@ -62,16 +67,32 @@ func (f *fakeCLI) CreateWorktree(_ context.Context, ticketKey, repoID, parentWor
 	})
 	return nil
 }
+func (f *fakeCLI) SetWorktreeStatus(_ context.Context, _, status string) error {
+	f.status = status
+	return nil
+}
 func (f *fakeCLI) DeleteWorktree(context.Context, string) error { return nil }
-func (f *fakeCLI) ShowTerminal(context.Context, string) (orcacli.Terminal, error) {
-	return orcacli.Terminal{}, orcacli.ErrTerminalUnavailable
+func (f *fakeCLI) ShowTerminal(_ context.Context, handle string) (orcacli.Terminal, error) {
+	f.showHandles = append(f.showHandles, handle)
+	t, ok := f.terminals[handle]
+	if !ok {
+		return orcacli.Terminal{}, orcacli.ErrTerminalUnavailable
+	}
+	return t, nil
 }
 func (f *fakeCLI) SendTerminal(context.Context, string, string) error { return nil }
 func (f *fakeCLI) ListTerminals(context.Context, string) ([]orcacli.Terminal, error) {
 	return nil, nil
 }
-func (f *fakeCLI) CreateTerminal(context.Context, string, string, string) (string, error) {
-	return "", nil
+func (f *fakeCLI) CreateTerminal(_ context.Context, _ string, title, command string) (string, error) {
+	f.createN++
+	f.createCommands = append(f.createCommands, command)
+	handle := "term-created-" + string(rune('0'+f.createN))
+	if f.terminals == nil {
+		f.terminals = map[string]orcacli.Terminal{}
+	}
+	f.terminals[handle] = orcacli.Terminal{Handle: handle, Title: title, Connected: true}
+	return handle, nil
 }
 func (f *fakeCLI) CloseTerminal(context.Context, string) error { return nil }
 
@@ -122,6 +143,124 @@ func TestEnsureEnvironment_BaseRefOverride(t *testing.T) {
 	}
 }
 
+func TestSetEnvironmentStatus(t *testing.T) {
+	fx := &fakeCLI{}
+	a, err := New(fx, config.RawValues{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := a.SetEnvironmentStatus(context.Background(), runner.Environment{ID: "wt-PAY-1"}, runner.WorkspaceStatusInReview); err != nil {
+		t.Fatal(err)
+	}
+	if fx.status != runner.WorkspaceStatusInReview {
+		t.Fatalf("status = %q, want %q", fx.status, runner.WorkspaceStatusInReview)
+	}
+}
+
+func TestFindTerminalUsesPersistedID(t *testing.T) {
+	fx := &fakeCLI{terminals: map[string]orcacli.Terminal{
+		"term-stored": {Handle: "term-stored", Title: "PAY-1:implement", Connected: true},
+	}}
+	a, err := New(fx, config.RawValues{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, ok, err := a.FindTerminal(context.Background(), runner.Terminal{ID: "term-stored", Title: "PAY-1:implement"})
+	if err != nil || !ok || got.ID != "term-stored" {
+		t.Fatalf("FindTerminal = %+v, %v, %v", got, ok, err)
+	}
+	if len(fx.showHandles) != 1 || fx.showHandles[0] != "term-stored" {
+		t.Fatalf("ShowTerminal handles = %v, want [term-stored]", fx.showHandles)
+	}
+}
+
+func TestFindTerminalReturnsOnlyLiveUsable(t *testing.T) {
+	fx := &fakeCLI{terminals: map[string]orcacli.Terminal{
+		"term-dead": {Handle: "term-dead", Title: "PAY-1:implement", Connected: false},
+	}}
+	a, err := New(fx, config.RawValues{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, ok, err := a.FindTerminal(context.Background(), runner.Terminal{}); err != nil || ok {
+		t.Fatalf("FindTerminal(empty) ok=%v err=%v, want absent", ok, err)
+	}
+	if _, ok, err := a.FindTerminal(context.Background(), runner.Terminal{ID: "term-dead"}); err != nil || ok {
+		t.Fatalf("FindTerminal(dead) ok=%v err=%v, want absent", ok, err)
+	}
+	if len(fx.showHandles) != 1 || fx.showHandles[0] != "term-dead" {
+		t.Fatalf("ShowTerminal handles = %v, want [term-dead]", fx.showHandles)
+	}
+}
+
+func TestEnsureTerminalFindsBeforeCreate(t *testing.T) {
+	fx := &fakeCLI{terminals: map[string]orcacli.Terminal{
+		"term-stored": {Handle: "term-stored", Title: "PAY-1:implement", Connected: true},
+	}}
+	a, err := New(fx, config.RawValues{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	stored := runner.Terminal{ID: "term-stored", Title: "PAY-1:implement"}
+
+	got, err := a.EnsureTerminal(context.Background(), runner.Environment{ID: "wt-PAY-1"}, stored, "PAY-1:implement", runner.Command{Executable: "opencode"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ID != stored.ID || fx.createN != 0 {
+		t.Fatalf("EnsureTerminal = %+v, creates=%d; want stored terminal and no create", got, fx.createN)
+	}
+}
+
+func TestEnsureTerminalCreatesWhenStoredTerminalUnavailable(t *testing.T) {
+	fx := &fakeCLI{}
+	a, err := New(fx, config.RawValues{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	command := runner.Command{Executable: "custom-harness", Args: []string{"--session", "opaque", "--prompt", "work", "--agent", "review"}}
+
+	got, err := a.EnsureTerminal(context.Background(), runner.Environment{ID: "wt-PAY-1"}, runner.Terminal{ID: "term-stale"}, "PAY-1:implement", command)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ID != "term-created-1" || fx.createN != 1 {
+		t.Fatalf("EnsureTerminal = %+v, creates=%d", got, fx.createN)
+	}
+	if len(fx.showHandles) != 1 || fx.showHandles[0] != "term-stale" {
+		t.Fatalf("ShowTerminal handles = %v, want [term-stale]", fx.showHandles)
+	}
+	if len(fx.createCommands) != 1 || fx.createCommands[0] != shellCommand(command) {
+		t.Fatalf("CreateTerminal commands = %v, want opaque command unchanged", fx.createCommands)
+	}
+}
+
+func TestCreateTerminalAlwaysCreatesAndTreatsCommandAsOpaque(t *testing.T) {
+	fx := &fakeCLI{}
+	a, err := New(fx, config.RawValues{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	command := runner.Command{Executable: "custom-harness", Args: []string{"--session", "opaque"}}
+
+	first, err := a.CreateTerminal(context.Background(), runner.Environment{ID: "wt-PAY-1"}, "PAY-1:implement", command)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := a.CreateTerminal(context.Background(), runner.Environment{ID: "wt-PAY-1"}, "PAY-1:implement", command)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.ID == second.ID || fx.createN != 2 {
+		t.Fatalf("CreateTerminal IDs = %q, %q; creates=%d", first.ID, second.ID, fx.createN)
+	}
+	if len(fx.showHandles) != 0 {
+		t.Fatalf("CreateTerminal parsed resume syntax and inspected terminals: %v", fx.showHandles)
+	}
+}
+
 // An existing ticket branch must win even over a configured baseRef. Passing
 // any other base would make Orca hit its branch-name collision behavior.
 func TestEnsureEnvironment_ExistingTicketBranchAvoidsCollision(t *testing.T) {

package/internal/runner/orca/orcacli/orcacli.go

@@ -45,6 +45,7 @@ type Client interface {
 	ListRepos(ctx context.Context) ([]Repo, error)
 	ListWorktrees(ctx context.Context) ([]Worktree, error)
 	CreateWorktree(ctx context.Context, ticketKey, repoID, parentWorktreeID, baseBranch string) error
+	SetWorktreeStatus(ctx context.Context, worktreeID, status string) error
 	DeleteWorktree(ctx context.Context, worktreeID string) error
 	ShowTerminal(ctx context.Context, handle string) (Terminal, error)
 	SendTerminal(ctx context.Context, handle, text string) error
@@ -90,6 +91,10 @@ func (CLI) CreateWorktree(ctx context.Context, ticketKey, repoID, parentWorktree
 		"--parent-worktree", "worktree:"+parentWorktreeID, "--base-branch", baseBranch, "--json")
 }
 
+func (CLI) SetWorktreeStatus(ctx context.Context, worktreeID, status string) error {
+	return run(ctx, "worktree", "set", "--worktree", "id:"+worktreeID, "--workspace-status", status, "--json")
+}
+
 // FindExistingBranch returns the first local or remote-tracking branch whose
 // short ref contains ticketKey. The returned ref is suitable for Orca's
 // --base-branch argument.

package/internal/runner/orca/orcacli/orcacli_test.go

@@ -33,6 +33,9 @@ func TestCLIContractsAgainstCapturedRealOutput(t *testing.T) {
 	if err := cli.CreateWorktree(ctx, "PAY-101", "repo-1", "wt-main", "origin/alice/PAY-101"); err != nil {
 		t.Fatal(err)
 	}
+	if err := cli.SetWorktreeStatus(ctx, "wt-PAY-101", "in-review"); err != nil {
+		t.Fatal(err)
+	}
 	if err := cli.DeleteWorktree(ctx, "wt-PAY-101"); err != nil {
 		t.Fatal(err)
 	}

package/internal/runner/orca/orcacli/testdata/strict-orca.sh

@@ -8,6 +8,8 @@ elif [ "$#" -eq 3 ] && [ "$1" = worktree ] && [ "$2" = list ] && [ "$3" = --json
   fixture=worktree-list.json
 elif [ "$#" -eq 11 ] && [ "$1" = worktree ] && [ "$2" = create ] && [ "$3" = --name ] && [ "$4" = PAY-101 ] && [ "$5" = --repo ] && [ "$6" = id:repo-1 ] && [ "$7" = --parent-worktree ] && [ "$8" = worktree:wt-main ] && [ "$9" = --base-branch ] && [ "${10}" = origin/alice/PAY-101 ] && [ "${11}" = --json ]; then
   fixture=worktree-create.json
+elif [ "$#" -eq 7 ] && [ "$1" = worktree ] && [ "$2" = set ] && [ "$3" = --worktree ] && [ "$4" = id:wt-PAY-101 ] && [ "$5" = --workspace-status ] && [ "$6" = in-review ] && [ "$7" = --json ]; then
+  fixture=worktree-create.json
 elif [ "$#" -eq 5 ] && [ "$1" = worktree ] && [ "$2" = rm ] && [ "$3" = --worktree ] && [ "$4" = id:wt-PAY-101 ] && [ "$5" = --json ]; then
   fixture=worktree-remove.json
 elif [ "$#" -eq 6 ] && [ "$1" = terminal ] && [ "$2" = list ] && [ "$3" = --worktree ] && [ "$4" = id:wt-PAY-101 ] && [ "$5" = --include-visual-layouts ] && [ "$6" = --json ]; then

package/internal/runner/runner.go

@@ -13,6 +13,12 @@ import (
 
 var ErrSessionUnavailable = errors.New("stored session unavailable")
 
+const (
+	WorkspaceStatusInProgress = "in-progress"
+	WorkspaceStatusInReview   = "in-review"
+	WorkspaceStatusCompleted  = "completed"
+)
+
 type RepoCandidate struct {
 	Name string `json:"name"`
 	Path string `json:"path"`
@@ -42,10 +48,11 @@ type RunSpec struct {
 }
 
 // Runner owns ticket-scoped environments, terminals, and liveness.
-// FindTerminal returns only a live usable terminal. CloseTerminals closes
-// agent terminals while preserving the environment/workspace; CleanupRun
-// removes all runner-owned run resources at end. Both reconstruct identity
-// from RunSpec without SQLite IDs.
+// FindTerminal checks a persisted terminal handle against the external runner
+// and returns only a live usable terminal. CloseTerminals closes agent terminals
+// while preserving the environment/workspace; CleanupRun removes all
+// runner-owned run resources at end. Both reconstruct identity from RunSpec
+// without SQLite IDs.
 //
 // Terminal titles are stable and minimal: only "<ticket>:<node>" — never
 // nodeVisitID, workflow name, agent name, or other changing metadata.
@@ -53,12 +60,12 @@ type Runner interface {
 	DiscoverRepos(ctx context.Context) ([]RepoCandidate, error)
 	ValidateRepo(ctx context.Context, name, path string) error
 	EnsureEnvironment(ctx context.Context, spec RunSpec) (Environment, error)
-	InspectTerminal(ctx context.Context, terminal Terminal) (Terminal, bool, error)
-	SendTerminal(ctx context.Context, terminal Terminal, text string) error
+	SetEnvironmentStatus(ctx context.Context, env Environment, status string) error
+	FindTerminal(ctx context.Context, terminal Terminal) (Terminal, bool, error)
 	CreateTerminal(ctx context.Context, env Environment, title string, command Command) (Terminal, error)
-	FindTerminal(ctx context.Context, env Environment, title string) (Terminal, bool, error)
+	EnsureTerminal(ctx context.Context, env Environment, terminal Terminal, title string, command Command) (Terminal, error)
+	SendTerminal(ctx context.Context, terminal Terminal, text string) error
 	CloseTerminal(ctx context.Context, terminal Terminal) error
-	EnsureTerminal(ctx context.Context, env Environment, title string, command Command) (Terminal, error)
 	CloseTerminals(ctx context.Context, spec RunSpec) error
 	CleanupRun(ctx context.Context, spec RunSpec) error
 }

package/internal/task/auth_test.go

@@ -0,0 +1,48 @@
+package task_test
+
+import (
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+)
+
+const alternateAuthPlugin = "alternate-auth-format-test"
+
+var registerAlternateAuth sync.Once
+
+func TestAlternativeTaskPluginOwnsCredentialsFormat(t *testing.T) {
+	registerAlternateAuth.Do(func() {
+		task.Register(alternateAuthPlugin, task.Factory{
+			RequiredRepoKeys: func() []string { return nil },
+			TaskScopeKey:     func(_, _ config.RawValues) (string, error) { return "alternate", nil },
+			Auth: func(_ context.Context, _ []string, stdin io.Reader) error {
+				key, err := io.ReadAll(stdin)
+				if err != nil {
+					return err
+				}
+				return os.WriteFile(filepath.Join(os.Getenv("RELAY_FLOW_HOME"), "credentials.yaml"),
+					[]byte("alternateApiKey: "+strings.TrimSpace(string(key))+"\n"), 0o600)
+			},
+			New: func(context.Context, task.RepoSpec) (task.System, error) { return nil, nil },
+		})
+	})
+	root := t.TempDir()
+	t.Setenv("RELAY_FLOW_HOME", root)
+	if err := task.Auth(context.Background(), alternateAuthPlugin, nil, strings.NewReader("different-secret")); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := os.ReadFile(filepath.Join(root, "credentials.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(raw) != "alternateApiKey: different-secret\n" {
+		t.Fatalf("alternate credentials = %q", raw)
+	}
+}

package/internal/task/contract_test.go

@@ -24,6 +24,8 @@ type fakeSystem struct {
 	resets    []string
 }
 
+var _ task.System = (*fakeSystem)(nil)
+
 type storedTicket struct {
 	ticket    task.Ticket
 	isMailbox bool

package/internal/task/factory.go

@@ -3,6 +3,7 @@ package task
 import (
 	"context"
 	"fmt"
+	"io"
 	"sort"
 	"strings"
 	"sync"
@@ -26,6 +27,7 @@ type RepoSpec struct {
 type Factory struct {
 	RequiredRepoKeys func() []string
 	TaskScopeKey     func(rootConfig, repoConfig config.RawValues) (string, error)
+	Auth             func(context.Context, []string, io.Reader) error
 	New              func(context.Context, RepoSpec) (System, error)
 }
 
@@ -63,6 +65,20 @@ func New(ctx context.Context, name string, spec RepoSpec) (System, error) {
 	return f.New(ctx, spec)
 }
 
+// Auth dispatches system-wide authentication to the selected task plugin.
+// The plugin owns its flags, prompts, validation, credential format, and
+// credential storage.
+func Auth(ctx context.Context, name string, args []string, stdin io.Reader) error {
+	f, err := lookup(name)
+	if err != nil {
+		return err
+	}
+	if f.Auth == nil {
+		return fmt.Errorf("task: plugin %q does not support authentication", name)
+	}
+	return f.Auth(ctx, args, stdin)
+}
+
 // RequiredRepoKeys returns the repo YAML keys the named plugin requires at
 // registration.
 func RequiredRepoKeys(name string) ([]string, error) {

package/internal/task/jira/auth.go

@@ -0,0 +1,183 @@
+package jira
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/charmbracelet/huh"
+	"github.com/mattn/go-isatty"
+	"github.com/rajpopat27/relay-flow/internal/config"
+	jirarest "github.com/rajpopat27/relay-flow/internal/task/jira/rest"
+	"gopkg.in/yaml.v3"
+)
+
+type credentials struct {
+	Site  string `yaml:"site"`
+	Email string `yaml:"email"`
+	Token string `yaml:"token"`
+}
+
+func auth(ctx context.Context, args []string, stdin io.Reader) error {
+	fs := flag.NewFlagSet("task auth", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	site := fs.String("site", "", "Jira site URL")
+	email := fs.String("email", "", "Jira account email")
+	token := fs.String("token", "", "Jira API token")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 {
+		return errors.New("unexpected positional arguments")
+	}
+
+	values := credentials{Site: strings.TrimSpace(*site), Email: strings.TrimSpace(*email), Token: *token}
+	flagged := values.Site != "" || values.Email != "" || values.Token != ""
+	if flagged && (values.Site == "" || values.Email == "" || values.Token == "") {
+		return errors.New("--site, --email, and --token must be given together")
+	}
+	if !flagged {
+		if isTTY(stdin) {
+			var err error
+			values, err = promptCredentials(values)
+			if err != nil {
+				return err
+			}
+		} else {
+			var ok bool
+			values, ok = readCredentialLines(stdin)
+			if !ok {
+				return errors.New("expected Jira site, email, and API token on stdin (or pass --site, --email, and --token)")
+			}
+		}
+	}
+
+	client, err := jirarest.New(values.Site, values.Email, values.Token)
+	if err != nil {
+		return err
+	}
+	if err := client.ValidateCredentials(ctx); err != nil {
+		return err
+	}
+	values.Site = strings.TrimRight(clientSite(values.Site), "/")
+	path, err := credentialsPath()
+	if err != nil {
+		return err
+	}
+	return saveCredentials(path, values)
+}
+
+func isTTY(stdin io.Reader) bool {
+	f, ok := stdin.(*os.File)
+	return ok && isatty.IsTerminal(f.Fd())
+}
+
+func promptCredentials(values credentials) (credentials, error) {
+	required := func(name string) func(string) error {
+		return func(value string) error {
+			if strings.TrimSpace(value) == "" {
+				return fmt.Errorf("%s is required", name)
+			}
+			return nil
+		}
+	}
+	form := huh.NewForm(huh.NewGroup(
+		huh.NewInput().Title("Jira site").Description("Your Atlassian site URL.").Placeholder("https://company.atlassian.net").Validate(required("Jira site")).Value(&values.Site),
+		huh.NewInput().Title("Jira email").Description("Email for the Jira API token.").Placeholder("you@company.com").Validate(required("Jira email")).Value(&values.Email),
+		huh.NewInput().Title("Jira API token").Description("Stored locally and never displayed.").EchoMode(huh.EchoModePassword).Validate(required("Jira API token")).Value(&values.Token),
+	).Title("Configure Jira"))
+	if err := form.Run(); err != nil {
+		return credentials{}, err
+	}
+	values.Site = strings.TrimSpace(values.Site)
+	values.Email = strings.TrimSpace(values.Email)
+	return values, nil
+}
+
+func readCredentialLines(stdin io.Reader) (credentials, bool) {
+	values := make([]string, 0, 3)
+	scanner := bufio.NewScanner(stdin)
+	for len(values) < 3 && scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line != "" {
+			values = append(values, line)
+		}
+	}
+	if len(values) != 3 {
+		return credentials{}, false
+	}
+	return credentials{Site: values[0], Email: values[1], Token: values[2]}, true
+}
+
+func clientSite(site string) string {
+	if !strings.Contains(site, "://") {
+		return "https://" + site
+	}
+	return site
+}
+
+func credentialsPath() (string, error) {
+	if root := os.Getenv("RELAY_FLOW_HOME"); root != "" {
+		return filepath.Join(root, "credentials.yaml"), nil
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("resolve user home: %w", err)
+	}
+	return filepath.Join(home, ".relay-flow", "credentials.yaml"), nil
+}
+
+func loadCredentialsDefault() (credentials, error) {
+	path, err := credentialsPath()
+	if err != nil {
+		return credentials{}, err
+	}
+	return loadCredentials(path)
+}
+
+func loadCredentials(path string) (credentials, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		return credentials{}, fmt.Errorf("stat credentials %s: %w", path, err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		return credentials{}, fmt.Errorf("credentials %s must have mode 0600", path)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return credentials{}, fmt.Errorf("read credentials %s: %w", path, err)
+	}
+	var out credentials
+	decoder := yaml.NewDecoder(strings.NewReader(string(raw)))
+	decoder.KnownFields(true)
+	if err := decoder.Decode(&out); err != nil {
+		return credentials{}, fmt.Errorf("parse credentials %s: %w", path, err)
+	}
+	if out.Site == "" || out.Email == "" || out.Token == "" {
+		return credentials{}, errors.New("Jira site, email, and API token are required")
+	}
+	return out, nil
+}
+
+func saveCredentials(path string, value credentials) error {
+	if value.Site == "" || value.Email == "" || value.Token == "" {
+		return errors.New("Jira site, email, and API token are required")
+	}
+	raw, err := yaml.Marshal(value)
+	if err != nil {
+		return fmt.Errorf("marshal credentials: %w", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return fmt.Errorf("create credentials directory: %w", err)
+	}
+	if err := config.WriteAtomic(path, raw, 0o600); err != nil {
+		return fmt.Errorf("write credentials: %w", err)
+	}
+	return nil
+}

package/internal/task/jira/auth_test.go

@@ -0,0 +1,107 @@
+package jira
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+)
+
+func authServer(t *testing.T, valid bool) *httptest.Server {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user, token, ok := r.BasicAuth()
+		if !ok || user != "bot@example.com" || token != "secret" || !valid {
+			http.Error(w, "invalid bot@example.com secret", http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/rest/api/3/myself":
+			fmt.Fprint(w, `{"accountId":"bot"}`)
+		case "/rest/api/3/project/PAY/statuses":
+			fmt.Fprint(w, `[{"id":"1","subtask":true,"statuses":[{"name":"To Do"},{"name":"In Progress"},{"name":"Done"}]}]`)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(server.Close)
+	return server
+}
+
+func TestAuthWritesLoadsAndNewUsesJiraOwnedCredentials(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("RELAY_FLOW_HOME", root)
+	server := authServer(t, true)
+	if err := task.Auth(context.Background(), "jira", []string{
+		"--site", server.URL, "--email", "bot@example.com", "--token", "secret",
+	}, strings.NewReader("")); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "credentials.yaml")
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Fatalf("credentials mode = %o, want 600", info.Mode().Perm())
+	}
+	got, err := loadCredentials(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Site != server.URL || got.Email != "bot@example.com" || got.Token != "secret" {
+		t.Fatalf("credentials = %+v", got)
+	}
+	if _, err := task.New(context.Background(), "jira", task.RepoSpec{
+		Name: "payments", RepoConfig: config.RawValues{"project": "PAY", "component": "api"},
+	}); err != nil {
+		t.Fatalf("task.New did not load Jira-owned credentials: %v", err)
+	}
+}
+
+func TestAuthRejectsInvalidCredentialsWithoutWriting(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("RELAY_FLOW_HOME", root)
+	server := authServer(t, false)
+	err := auth(context.Background(), []string{
+		"--site", server.URL, "--email", "bot@example.com", "--token", "secret",
+	}, strings.NewReader(""))
+	if err == nil {
+		t.Fatal("invalid credentials accepted")
+	}
+	if strings.Contains(err.Error(), "secret") || strings.Contains(err.Error(), "bot@example.com") {
+		t.Fatalf("credential error exposed a secret: %v", err)
+	}
+	if _, statErr := os.Stat(filepath.Join(root, "credentials.yaml")); !os.IsNotExist(statErr) {
+		t.Fatalf("invalid auth wrote credentials: %v", statErr)
+	}
+}
+
+func TestLoadCredentialsRejectsPermissionsAndMalformedSecrets(t *testing.T) {
+	t.Run("permissions", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "credentials.yaml")
+		if err := os.WriteFile(path, []byte("site: https://jira.example.com\nemail: bot@example.com\ntoken: secret\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := loadCredentials(path); err == nil || !strings.Contains(err.Error(), "0600") {
+			t.Fatalf("permission error = %v", err)
+		}
+	})
+	t.Run("redaction", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "credentials.yaml")
+		if err := os.WriteFile(path, []byte("token: [super-secret"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := loadCredentials(path); err == nil || strings.Contains(err.Error(), "super-secret") {
+			t.Fatalf("malformed credential error = %v", err)
+		}
+	})
+}