specweave 0.23.8 → 0.23.10

package/CLAUDE.md

@@ -1592,6 +1592,124 @@ vim .specweave/docs/internal/architecture/hld-system.md
 vim .specweave/docs/public/guides/user-guide.md
 ```
 
+### Configuration Management
+
+**CRITICAL**: SpecWeave separates secrets from configuration (v0.24.0+)
+
+**Architecture**:
+- **Secrets** (tokens, passwords) → `.env` (gitignored, NEVER commit)
+- **Configuration** (domains, strategies, settings) → `.specweave/config.json` (committed to git)
+
+**Why this matters**:
+- ✅ Team shares configuration via git
+- ✅ Secrets stay local (12-Factor App pattern)
+- ✅ Onboarding: `cp .env.example .env` (fill in your tokens)
+- ✅ Type-safe configuration with validation
+
+**Using ConfigManager**:
+
+```typescript
+import { getConfigManager } from '../core/config/index.js';
+
+// Read configuration
+const configManager = getConfigManager(projectRoot);
+const config = await configManager.read();
+
+// Get specific value
+const domain = await configManager.get('issueTracker.domain');
+
+// Update configuration
+await configManager.update({
+  issueTracker: {
+    provider: 'jira',
+    domain: 'example.atlassian.net',
+    strategy: 'project-per-team'
+  }
+});
+
+// Write entire config (validates before writing)
+await configManager.write(newConfig);
+
+// Set specific value
+await configManager.set('sync.enabled', true);
+```
+
+**Init flow separation** (Jira example):
+
+```typescript
+// Step 1: Save secrets to .env (gitignored)
+const secretEnvVars = getJiraEnvVars(credentials); // ONLY tokens/emails
+saveCredentialsToEnv(projectPath, 'jira', secretEnvVars);
+
+// Step 2: Save config to .specweave/config.json (committed)
+const configManager = getConfigManager(projectPath);
+const jiraConfig = getJiraConfig(credentials); // domain, strategy, projects
+await configManager.update(jiraConfig);
+
+// Step 3: Generate .env.example for team onboarding
+generateEnvExample(projectPath, 'jira');
+```
+
+**What goes where**:
+
+| Data Type | Location | Example | Committed? |
+|-----------|----------|---------|------------|
+| API Tokens | `.env` | `JIRA_API_TOKEN=xyz` | ❌ Never |
+| Emails | `.env` | `JIRA_EMAIL=user@example.com` | ❌ Never |
+| Domains | `config.json` | `"domain": "example.atlassian.net"` | ✅ Yes |
+| Strategies | `config.json` | `"strategy": "project-per-team"` | ✅ Yes |
+| Project Keys | `config.json` | `"projects": [{"key": "PROJ1"}]` | ✅ Yes |
+| Sync Settings | `config.json` | `"includeStatus": true` | ✅ Yes |
+
+**Validation**:
+
+ConfigManager validates configuration before writing:
+
+```typescript
+const result = configManager.validate(config);
+if (!result.valid) {
+  console.error('Validation errors:', result.errors);
+  // Example error:
+  // {
+  //   path: 'issueTracker.provider',
+  //   message: 'Invalid provider. Must be one of: none, jira, github, ado',
+  //   value: 'invalid-provider'
+  // }
+}
+```
+
+**Migration Tool** (for existing projects):
+
+If you have an existing project using the old .env-only format, use the migration tool:
+
+```bash
+# Preview what will be migrated (dry run)
+node -e "require('./dist/src/cli/commands/migrate-config.js').migrateConfig({ dryRun: true })"
+
+# Perform migration
+node -e "require('./dist/src/cli/commands/migrate-config.js').migrateConfig()"
+
+# Force migration even if not needed
+node -e "require('./dist/src/cli/commands/migrate-config.js').migrateConfig({ force: true })"
+```
+
+**What the migration tool does**:
+1. ✅ Analyzes `.env` file and classifies variables
+2. ✅ Creates backup: `.env.backup.TIMESTAMP`
+3. ✅ Updates `.env` (keeps only secrets)
+4. ✅ Creates/updates `.specweave/config.json` (adds config)
+5. ✅ Generates `.env.example` for team onboarding
+
+**Classification logic**:
+- **Secrets** (stay in .env): Variables containing `token`, `api_token`, `pat`, `secret`, `key`, `password`, `credential`, `auth`, or email addresses
+- **Config** (move to config.json): Everything else (domains, strategies, project keys, etc.)
+
+**See also**:
+- ADR-0050: Secrets vs Configuration Separation
+- `src/core/config/config-manager.ts` - ConfigManager implementation
+- `src/core/config/config-migrator.ts` - Migration tool implementation
+- `tests/unit/core/config/config-migrator.test.ts` - Usage examples
+
 ---
 
 ## Troubleshooting

package/dist/src/cli/commands/migrate-config.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Migrate Config Command
+ *
+ * Migrates old .env-only configuration to split secrets/config format
+ *
+ * @module cli/commands/migrate-config
+ */
+/**
+ * Command options
+ */
+export interface MigrateConfigOptions {
+    dryRun?: boolean;
+    force?: boolean;
+    yes?: boolean;
+}
+/**
+ * Migrate configuration from .env-only to split format
+ *
+ * @param options - Command options
+ */
+export declare function migrateConfig(options?: MigrateConfigOptions): Promise<void>;
+//# sourceMappingURL=migrate-config.d.ts.map

package/dist/src/cli/commands/migrate-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-config.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/migrate-config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2IrF"}

package/dist/src/cli/commands/migrate-config.js

@@ -0,0 +1,149 @@
+/**
+ * Migrate Config Command
+ *
+ * Migrates old .env-only configuration to split secrets/config format
+ *
+ * @module cli/commands/migrate-config
+ */
+import chalk from 'chalk';
+import inquirer from 'inquirer';
+import ora from 'ora';
+import { ConfigMigrator } from '../../core/config/config-migrator.js';
+/**
+ * Migrate configuration from .env-only to split format
+ *
+ * @param options - Command options
+ */
+export async function migrateConfig(options = {}) {
+    const { dryRun = false, force = false, yes = false } = options;
+    console.log(chalk.bold.cyan('\n🔄 SpecWeave Configuration Migration\n'));
+    console.log(chalk.gray('Migrating from .env-only to split secrets/config format\n'));
+    const migrator = new ConfigMigrator(process.cwd());
+    // Check if migration is needed
+    if (!force) {
+        const spinner = ora('Checking if migration is needed...').start();
+        const needed = await migrator.needsMigration();
+        if (!needed) {
+            spinner.succeed('Migration not needed');
+            console.log(chalk.green('\n✅ Your project already uses the split format!'));
+            console.log(chalk.gray('   Secrets are in .env, config is in .specweave/config.json\n'));
+            return;
+        }
+        spinner.succeed('Migration needed - old format detected');
+    }
+    // Preview migration
+    console.log(chalk.bold('\n📋 Migration Preview\n'));
+    const spinner = ora('Analyzing .env file...').start();
+    let preview;
+    try {
+        preview = await migrator.preview();
+        spinner.succeed('Analysis complete');
+    }
+    catch (error) {
+        spinner.fail('Analysis failed');
+        console.error(chalk.red(`\n❌ Error: ${error.message}\n`));
+        return;
+    }
+    // Display classification results
+    console.log(chalk.bold('\nClassification Results:'));
+    console.log(chalk.green(`  Secrets: ${preview.secretsCount} variables`));
+    console.log(chalk.blue(`  Config:  ${preview.configCount} variables`));
+    if (preview.warnings.length > 0) {
+        console.log(chalk.yellow('\n⚠️  Warnings:'));
+        preview.warnings.forEach(w => console.log(chalk.yellow(`  - ${w}`)));
+    }
+    // Show detailed breakdown
+    console.log(chalk.bold('\n📊 Detailed Breakdown:\n'));
+    const secretVars = preview.classified.filter(c => c.type === 'secret');
+    const configVars = preview.classified.filter(c => c.type === 'config');
+    if (secretVars.length > 0) {
+        console.log(chalk.green.bold('  Secrets (will stay in .env):'));
+        secretVars.forEach(v => {
+            const maskedValue = maskSecret(v.value);
+            console.log(chalk.gray(`    ${v.key}=${maskedValue}`));
+            console.log(chalk.gray(`    └─ ${v.reason}\n`));
+        });
+    }
+    if (configVars.length > 0) {
+        console.log(chalk.blue.bold('  Configuration (will move to config.json):'));
+        configVars.forEach(v => {
+            console.log(chalk.gray(`    ${v.key}=${v.value}`));
+            console.log(chalk.gray(`    └─ ${v.reason}\n`));
+        });
+    }
+    // Dry run mode - stop here
+    if (dryRun) {
+        console.log(chalk.yellow('\n🔍 Dry run mode - no changes made\n'));
+        console.log(chalk.gray('Run without --dry-run to perform migration\n'));
+        return;
+    }
+    // Confirm migration
+    if (!yes) {
+        console.log(chalk.bold('\n❓ Migration Actions:\n'));
+        console.log(chalk.gray('  1. Backup .env → .env.backup.TIMESTAMP'));
+        console.log(chalk.gray('  2. Update .env (keep only secrets)'));
+        console.log(chalk.gray('  3. Create/update .specweave/config.json (add config)'));
+        console.log(chalk.gray('  4. Generate .env.example (team template)\n'));
+        const { confirm } = await inquirer.prompt([
+            {
+                type: 'confirm',
+                name: 'confirm',
+                message: 'Proceed with migration?',
+                default: false
+            }
+        ]);
+        if (!confirm) {
+            console.log(chalk.yellow('\n⚠️  Migration cancelled\n'));
+            return;
+        }
+    }
+    // Perform migration
+    console.log(chalk.bold('\n🚀 Performing Migration...\n'));
+    const migrationSpinner = ora('Migrating configuration...').start();
+    let result;
+    try {
+        result = await migrator.migrate({ backup: true, force });
+        migrationSpinner.succeed('Migration complete');
+    }
+    catch (error) {
+        migrationSpinner.fail('Migration failed');
+        console.error(chalk.red(`\n❌ Error: ${error.message}\n`));
+        return;
+    }
+    // Display results
+    console.log(chalk.bold.green('\n✅ Migration Successful!\n'));
+    console.log(chalk.bold('Summary:'));
+    console.log(chalk.green(`  ✓ ${result.secretsCount} secrets kept in .env`));
+    console.log(chalk.blue(`  ✓ ${result.configCount} config items moved to config.json`));
+    if (result.backupPath) {
+        console.log(chalk.gray(`  ✓ Backup created: ${result.backupPath}`));
+    }
+    console.log(chalk.gray(`  ✓ .env.example generated\n`));
+    // Show next steps
+    console.log(chalk.bold('📝 Next Steps:\n'));
+    console.log(chalk.cyan('  1. Review .specweave/config.json (commit to git)'));
+    console.log(chalk.cyan('  2. Share .env.example with team (commit to git)'));
+    console.log(chalk.cyan('  3. Team members: cp .env.example .env (fill in tokens)'));
+    console.log(chalk.cyan('  4. Verify: specweave init . (should detect existing config)\n'));
+    console.log(chalk.bold('🎯 Benefits:\n'));
+    console.log(chalk.green('  ✓ Team shares configuration via git'));
+    console.log(chalk.green('  ✓ Secrets stay local (never committed)'));
+    console.log(chalk.green('  ✓ Type-safe configuration with validation'));
+    console.log(chalk.green('  ✓ Easy onboarding for new team members\n'));
+}
+/**
+ * Mask secret value for display
+ *
+ * @param value - Secret value
+ * @returns Masked value
+ */
+function maskSecret(value) {
+    if (value.length <= 8) {
+        return '***';
+    }
+    const visible = 4;
+    const start = value.substring(0, visible);
+    const end = value.substring(value.length - visible);
+    return `${start}${'*'.repeat(value.length - visible * 2)}${end}`;
+}
+//# sourceMappingURL=migrate-config.js.map

package/dist/src/cli/commands/migrate-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-config.js","sourceRoot":"","sources":["../../../../src/cli/commands/migrate-config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAYtE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAgC,EAAE;IACpE,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,GAAG,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEnD,+BAA+B;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,CAAC,oCAAoC,CAAC,CAAC,KAAK,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QAE/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEtD,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,YAAY,YAAY,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,WAAW,YAAY,CAAC,CAAC,CAAC;IAEvE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,0BAA0B;IAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAChE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACrB,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC;QAC5E,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAExE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAuB;YAC9D;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;IAEnE,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,kBAAkB;IAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,YAAY,uBAAuB,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,WAAW,oCAAoC,CAAC,CAAC,CAAC;IAEvF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAExD,kBAAkB;IAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAE3F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAEpD,OAAO,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;AACnE,CAAC"}

package/dist/src/cli/helpers/issue-tracker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cli/helpers/issue-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EAAoC,YAAY,EAAE,MAAM,YAAY,CAAC;AAyCjF;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAmS/E;AAsdD,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cli/helpers/issue-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EAAoC,YAAY,EAAE,MAAM,YAAY,CAAC;AA2CjF;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CA+R/E;AAihBD,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/src/cli/helpers/issue-tracker/index.js

@@ -8,17 +8,17 @@
  */
 import chalk from 'chalk';
 import inquirer from 'inquirer';
-import ora from 'ora';
 import fs from 'fs';
 import path from 'path';
 import { execSync } from 'child_process';
-import { detectDefaultTracker, getTrackerDisplayName, installTrackerPlugin, isClaudeCliAvailable } from './utils.js';
+import { detectDefaultTracker, getTrackerDisplayName } from './utils.js';
 import { readEnvFile, writeEnvFile, createEnvFromTemplate, updateEnvVars, ensureEnvGitignored } from '../../../utils/env-file.js';
 import { getLocaleManager } from '../../../core/i18n/locale-manager.js';
+import { getConfigManager } from '../../../core/config/index.js';
 // GitHub
 import { checkExistingGitHubCredentials, promptGitHubCredentials, validateGitHubConnection, getGitHubEnvVars, showGitHubSetupComplete, showGitHubSetupSkipped } from './github.js';
 // Jira
-import { checkExistingJiraCredentials, promptJiraCredentials, validateJiraConnection, getJiraEnvVars, showJiraSetupComplete, showJiraSetupSkipped } from './jira.js';
+import { checkExistingJiraCredentials, promptJiraCredentials, validateJiraConnection, getJiraEnvVars, getJiraConfig, showJiraSetupComplete, showJiraSetupSkipped } from './jira.js';
 // Azure DevOps
 import { checkExistingAzureDevOpsCredentials, promptAzureDevOpsCredentials, validateAzureDevOpsConnection, getAzureDevOpsEnvVars, showAzureDevOpsSetupComplete, showAzureDevOpsSetupSkipped } from './ado.js';
 /**
@@ -183,8 +183,7 @@ export async function setupIssueTracker(options) {
                 if (tracker === 'jira') {
                     await validateResources(tracker, credentials, projectPath);
                 }
-                // Install plugin
-                await installPlugin(tracker, language);
+                // Show setup complete message (plugins managed via marketplace)
                 showSetupComplete(tracker, language);
                 return true;
             }
@@ -273,9 +272,7 @@ export async function setupIssueTracker(options) {
     if (tracker === 'jira' || tracker === 'ado') {
         await validateResources(tracker, credentials, projectPath);
     }
-    // Step 6: Install plugin
-    await installPlugin(tracker, language);
-    // Step 7: Show success message
+    // Step 6: Show success message (plugins managed via marketplace)
     showSetupComplete(tracker, language);
     return true;
 }
@@ -373,7 +370,85 @@ async function validateResources(tracker, credentials, projectPath) {
     }
 }
 /**
- * Save credentials to .env file
+ * Generate .env.example template for team onboarding
+ *
+ * Creates a template file showing required environment variables
+ * with placeholder values and setup instructions
+ */
+function generateEnvExample(projectPath, tracker) {
+    const examplePath = path.join(projectPath, '.env.example');
+    let content = `# SpecWeave Environment Variables
+#
+# IMPORTANT: Copy this file to .env and replace placeholder values with your actual credentials
+# NEVER commit .env to git! It's already in .gitignore
+#
+# Setup Instructions:
+# 1. Copy: cp .env.example .env
+# 2. Replace placeholder values below with your actual credentials
+# 3. Run: specweave init . (to validate credentials)
+
+`;
+    if (tracker === 'jira') {
+        content += `# ==========================================
+# Jira Credentials (REQUIRED)
+# ==========================================
+# Get your Jira API token from:
+# Cloud: https://id.atlassian.com/manage-profile/security/api-tokens
+# Server: Your Jira instance → Settings → Personal Access Tokens
+
+JIRA_API_TOKEN=your_jira_api_token_here
+JIRA_EMAIL=your_email@company.com
+
+# NOTE: Domain, strategy, and projects are now in .specweave/config.json
+# (This makes them shareable across the team via git)
+`;
+    }
+    else if (tracker === 'github') {
+        content += `# ==========================================
+# GitHub Credentials (REQUIRED)
+# ==========================================
+# Get your GitHub token from:
+# https://github.com/settings/tokens
+# Required scopes: repo, read:org
+
+GITHUB_TOKEN=your_github_token_here
+`;
+    }
+    else if (tracker === 'ado') {
+        content += `# ==========================================
+# Azure DevOps Credentials (REQUIRED)
+# ==========================================
+# Get your PAT from:
+# https://dev.azure.com/YOUR_ORG/_usersSettings/tokens
+
+ADO_PAT=your_ado_pat_here
+`;
+    }
+    content += `
+# ==========================================
+# Optional: Additional Integrations
+# ==========================================
+# Uncomment and configure if you use multiple tools:
+
+# GitHub (if using with Jira)
+# GITHUB_TOKEN=your_github_token_here
+
+# Bitbucket
+# BITBUCKET_TOKEN=your_bitbucket_token_here
+
+# GitLab
+# GITLAB_TOKEN=your_gitlab_token_here
+`;
+    fs.writeFileSync(examplePath, content, 'utf-8');
+    console.log(chalk.green('✓ Generated .env.example (commit this to git!)'));
+    console.log(chalk.gray('   Team members can copy it to .env and add their credentials'));
+}
+/**
+ * Save credentials to .env file AND configuration to config.json
+ *
+ * NEW (v0.23.0): Implements ADR-0050 secrets/config separation
+ * - Secrets (tokens, emails) → .env (gitignored)
+ * - Configuration (domains, strategies, projects) → config.json (committed)
  */
 async function saveCredentials(projectPath, tracker, credentials) {
     // Read existing .env or create from template
@@ -381,14 +456,14 @@ async function saveCredentials(projectPath, tracker, credentials) {
     if (!envContent) {
         envContent = createEnvFromTemplate(projectPath);
     }
-    // Get tracker-specific env vars
+    // Get tracker-specific env vars (ONLY secrets)
     let envVars = [];
     switch (tracker) {
         case 'github':
             envVars = getGitHubEnvVars(credentials);
             break;
         case 'jira':
-            envVars = getJiraEnvVars(credentials);
+            envVars = getJiraEnvVars(credentials); // NOW returns ONLY secrets
             break;
         case 'ado':
             envVars = getAzureDevOpsEnvVars(credentials);
@@ -401,6 +476,18 @@ async function saveCredentials(projectPath, tracker, credentials) {
     // Ensure .env is gitignored
     ensureEnvGitignored(projectPath);
     console.log(chalk.green('✓ Credentials saved to .env (gitignored)'));
+    // Save non-sensitive configuration to config.json
+    if (tracker === 'jira') {
+        const configManager = getConfigManager(projectPath);
+        const jiraConfig = getJiraConfig(credentials);
+        await configManager.update(jiraConfig);
+        console.log(chalk.green('✓ Configuration saved to .specweave/config.json'));
+        console.log(chalk.gray(`   Domain: ${jiraConfig.issueTracker.domain}`));
+        console.log(chalk.gray(`   Strategy: ${jiraConfig.issueTracker.strategy}`));
+        console.log(chalk.gray(`   Projects: ${jiraConfig.issueTracker.projects?.map(p => p.key).join(', ')}`));
+    }
+    // Generate .env.example for team onboarding
+    generateEnvExample(projectPath, tracker);
 }
 /**
  * Write sync config to .specweave/config.json
@@ -411,20 +498,9 @@ async function saveCredentials(projectPath, tracker, credentials) {
  * NEW (v0.21.0): Includes sync settings (status sync, task checkboxes, auto-labels)
  */
 async function writeSyncConfig(projectPath, tracker, credentials, syncSettings, syncPermissions, repositoryProfiles, monorepoProjects) {
-    const configPath = path.join(projectPath, '.specweave', 'config.json');
-    // Read existing config or create new one
-    let config = {
-        project: {
-            name: path.basename(projectPath),
-            version: '0.1.0'
-        },
-        adapters: {
-            default: 'claude'
-        }
-    };
-    if (fs.existsSync(configPath)) {
-        config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-    }
+    const configManager = getConfigManager(projectPath);
+    // Read existing config
+    const config = await configManager.read();
     // Add hooks configuration (enables auto-sync!)
     config.hooks = {
         post_task_completion: {
@@ -516,6 +592,8 @@ async function writeSyncConfig(projectPath, tracker, credentials, syncSettings,
         const defaultProfile = repositoryProfiles.find(p => p.isDefault) || repositoryProfiles[0];
         config.sync = {
             enabled: true,
+            direction: 'bidirectional',
+            autoSync: false,
             provider: tracker, // NEW: Exclusive provider
             includeStatus: syncSettings.includeStatus, // NEW: Status sync toggle
             autoApplyLabels: syncSettings.autoApplyLabels, // NEW: Auto-labeling
@@ -548,6 +626,8 @@ async function writeSyncConfig(projectPath, tracker, credentials, syncSettings,
         };
         config.sync = {
             enabled: true,
+            direction: 'bidirectional',
+            autoSync: false,
             provider: tracker, // NEW: Exclusive provider
             includeStatus: syncSettings.includeStatus, // NEW: Status sync toggle
             autoApplyLabels: syncSettings.autoApplyLabels, // NEW: Auto-labeling
@@ -579,6 +659,8 @@ async function writeSyncConfig(projectPath, tracker, credentials, syncSettings,
         };
         config.sync = {
             enabled: true,
+            direction: 'bidirectional',
+            autoSync: false,
             provider: tracker, // NEW: Exclusive provider
             includeStatus: syncSettings.includeStatus, // NEW: Status sync toggle
             autoApplyLabels: syncSettings.autoApplyLabels, // NEW: Auto-labeling
@@ -606,6 +688,8 @@ async function writeSyncConfig(projectPath, tracker, credentials, syncSettings,
         };
         config.sync = {
             enabled: true,
+            direction: 'bidirectional',
+            autoSync: false,
             provider: tracker, // NEW: Exclusive provider
             includeStatus: syncSettings.includeStatus, // NEW: Status sync toggle
             autoApplyLabels: syncSettings.autoApplyLabels, // NEW: Auto-labeling
@@ -618,8 +702,8 @@ async function writeSyncConfig(projectPath, tracker, credentials, syncSettings,
             profiles
         };
     }
-    // Write config
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+    // Write config using ConfigManager
+    await configManager.write(config);
     console.log(chalk.green(`✓ Sync config written to .specweave/config.json`));
     console.log(chalk.gray(`   Provider: ${tracker}`));
     console.log(chalk.gray(`   Auto-sync: enabled`));
@@ -627,39 +711,7 @@ async function writeSyncConfig(projectPath, tracker, credentials, syncSettings,
     console.log(chalk.gray(`   Auto-labeling: ${syncSettings.autoApplyLabels ? 'enabled' : 'disabled'}`));
     console.log(chalk.gray(`   Hooks: post_task_completion, post_increment_planning`));
 }
-/**
- * Install tracker plugin
- */
-async function installPlugin(tracker, language) {
-    const spinner = ora(`Installing ${getTrackerDisplayName(tracker)} plugin...`).start();
-    // Check if Claude CLI is available
-    if (!isClaudeCliAvailable()) {
-        spinner.warn('Claude CLI not found');
-        console.log(chalk.yellow('\n📦 Manual plugin installation required:'));
-        console.log(chalk.white(`   /plugin install specweave-${tracker}\n`));
-        return;
-    }
-    // Install plugin
-    const result = installTrackerPlugin(tracker);
-    if (result.success) {
-        if (result.alreadyInstalled) {
-            spinner.succeed(`${getTrackerDisplayName(tracker)} plugin already installed`);
-        }
-        else {
-            spinner.succeed(`${getTrackerDisplayName(tracker)} plugin installed`);
-        }
-    }
-    else {
-        spinner.fail(`Could not auto-install plugin`);
-        console.log(chalk.yellow('\n📦 Manual plugin installation:'));
-        console.log(chalk.white(`   /plugin install specweave-${tracker}`));
-        // Show error details in DEBUG mode
-        if (process.env.DEBUG && result.error) {
-            console.log(chalk.gray(`   Error: ${result.error}`));
-        }
-        console.log('');
-    }
-}
+// Removed installPlugin() function - plugins are managed via marketplace, not during init
 /**
  * Show setup complete message
  */