Commit 4f63275ac7885281d245022e65f1e9e8816b1382 | the-knife

apps/server/src/serverSettings.test.ts+96-106

 @@ -26,6 +26,7 @@ import * as Stream from "effect/Stream";
 import * as TestClock from "effect/testing/TestClock";
 import * as SqlClient from "effect/sql/SqlClient";
 import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
+import { sourceControlHostSecretName } from "./sourceControl/sourceControlHostSecrets.ts";
 import * as ServerConfig from "./config.ts";
 import * as SqlitePersistence from "./persistence/Sqlite.ts";
 import { writeFileStringAtomically } from "@t3tools/shared/atomicWrite";
 @@ -1418,7 +1419,7 @@ it.layer(NodeServices.layer)("server settings", (it) => {
   );
   it.effect(
-    "keeps Bitbucket tokens in the secret store and tells clients only that one is set",
+    "keeps source control host secrets in the secret store and tells clients only that one is set",
     () =>
       Effect.gen(function* () {
         const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
 @@ -1427,139 +1428,134 @@ it.layer(NodeServices.layer)("server settings", (it) => {
         const fileSystem = yield* FileSystem.FileSystem;
         const saved = yield* serverSettings.updateSettings({
-          bitbucket: { email: "me@example.com", accessToken: "bb-access", apiToken: "bb-api" },
+          sourceControlHosts: {
+            bitbucket: { email: "me@example.com", accessToken: "bb-access" },
+            github: { tokens: { "github.com": "ghp_dotcom", "ghe.acme.test": "ghp_ghe" } },
+          },
         });
-        assert.deepEqual(saved.bitbucket, {
+        assert.deepEqual(saved.sourceControlHosts.bitbucket, {
           email: "me@example.com",
           accessToken: "bb-access",
-          apiToken: "bb-api",
         });
         const raw = yield* fileSystem.readFileString(serverConfig.settingsPath);
-        assert.notInclude(raw, "bb-access");
+        for (const secret of ["bb-access", "ghp_dotcom", "ghp_ghe"]) assert.notInclude(raw, secret);
-        assert.notInclude(raw, "bb-api");
         assert.include(raw, "me@example.com");
-        const forClient = ServerSettingsModule.redactServerSettingsForClient(saved).bitbucket;
+        const forClient =
-        assert.equal(forClient.email, "me@example.com");
+          ServerSettingsModule.redactServerSettingsForClient(saved).sourceControlHosts;
-        assert.notInclude(forClient.accessToken, "bb-access");
+        assert.equal(forClient.bitbucket?.email, "me@example.com");
-        assert.notInclude(forClient.apiToken, "bb-api");
+        assert.notInclude(String(forClient.bitbucket?.accessToken), "bb-access");
-        assert.isAbove(forClient.accessToken.length, 0);
+        assert.isAbove(String(forClient.bitbucket?.accessToken).length, 0);
-        assert.isAbove(forClient.apiToken.length, 0);
-        // A client echoing the redacted values back, or omitting them, keeps the saved tokens.
-        yield* serverSettings.updateSettings({ bitbucket: forClient });
-        yield* serverSettings.updateSettings({ bitbucket: { email: "other@example.com" } });
-        assert.deepEqual((yield* serverSettings.getSettings).bitbucket, {
-          email: "other@example.com",
-          accessToken: "bb-access",
-          apiToken: "bb-api",
-        });
-        const cleared = yield* serverSettings.updateSettings({ bitbucket: { accessToken: "" } });
-        assert.equal(cleared.bitbucket.accessToken, "");
-        assert.equal(cleared.bitbucket.apiToken, "bb-api");
-        assert.isTrue(Option.isNone(yield* secrets.get("bitbucket-access-token")));
-        assert.equal(
-          ServerSettingsModule.redactServerSettingsForClient(cleared).bitbucket.accessToken,
-          "",
-        );
-      }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
-  );
-  it.effect(
-    "keeps GitHub tokens per host in the secret store and tells clients only that one is set",
-    () =>
-      Effect.gen(function* () {
-        const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
-        const secrets = yield* ServerSecretStore.ServerSecretStore;
-        const serverConfig = yield* ServerConfig.ServerConfig;
-        const fileSystem = yield* FileSystem.FileSystem;
-        const saved = yield* serverSettings.updateSettings({
+        // Echoing the redacted values back keeps them; other fields change on their own.
-          github: { tokens: { "GitHub.com": "ghp_dotcom", "ghe.acme.test": "ghp_ghe" } },
+        yield* serverSettings.updateSettings({ sourceControlHosts: forClient });
-        });
-        assert.deepEqual(saved.github.tokens, {
-          "github.com": "ghp_dotcom",
-          "ghe.acme.test": "ghp_ghe",
-        });
-        const raw = yield* fileSystem.readFileString(serverConfig.settingsPath);
-        assert.notInclude(raw, "ghp_dotcom");
-        assert.notInclude(raw, "ghp_ghe");
-        const forClient = ServerSettingsModule.redactServerSettingsForClient(saved).github;
-        assert.notInclude(forClient.tokens["github.com"]!, "ghp_dotcom");
-        assert.isAbove(forClient.tokens["github.com"]!.length, 0);
-        // Echoing the redacted values back keeps them; host and account changes leave tokens alone.
-        yield* serverSettings.updateSettings({ github: { tokens: forClient.tokens } });
         yield* serverSettings.updateSettings({
-          github: { hosts: { "github.com": { enabled: true, account: "work" } } },
+          sourceControlHosts: { bitbucket: { email: "other@example.com" } },
         });
-        assert.deepEqual((yield* serverSettings.getSettings).github.tokens, {
+        const kept = (yield* serverSettings.getSettings).sourceControlHosts;
+        assert.deepEqual(kept.bitbucket, { email: "other@example.com", accessToken: "bb-access" });
+        assert.deepEqual(kept.github?.tokens, {
           "github.com": "ghp_dotcom",
           "ghe.acme.test": "ghp_ghe",
         });
-        // An empty token removes that host's token and nothing else.
+        // An empty value removes that secret, and one per server host leaves the others.
         const cleared = yield* serverSettings.updateSettings({
-          github: { tokens: { "github.com": "" } },
+          sourceControlHosts: {
+            bitbucket: { accessToken: "" },
+            github: {
+              tokens: {
+                "github.com": "",
+                "ghe.acme.test": (forClient.github!.tokens as Record<string, string>)[
+                  "ghe.acme.test"
+                ],
+              },
+            },
+          },
         });
-        assert.equal(cleared.github.tokens["github.com"] ?? "", "");
+        assert.equal(cleared.sourceControlHosts.bitbucket?.accessToken, "");
-        assert.equal(cleared.github.tokens["ghe.acme.test"], "ghp_ghe");
+        const stored = (kind: string, field: string, serverHost: string | null) =>
-        const remaining = yield* Effect.forEach(["github.com", "ghe.acme.test"], (host) =>
+          secrets.get(sourceControlHostSecretName({ kind, field, serverHost }));
-          secrets.get(`github-token-${Buffer.from(host, "utf8").toString("base64url")}`),
+        assert.isTrue(Option.isNone(yield* stored("bitbucket", "accessToken", null)));
-        );
+        assert.isTrue(Option.isNone(yield* stored("github", "tokens", "github.com")));
-        assert.isTrue(Option.isNone(remaining[0]!));
+        assert.isTrue(Option.isSome(yield* stored("github", "tokens", "ghe.acme.test")));
-        assert.isTrue(Option.isSome(remaining[1]!));
       }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
-  it.effect("removes a Bitbucket secret once its token is cleared by hand in settings.json", () =>
+  it.effect("keeps the retired keys for another load when a token cannot be copied", () => {
-    Effect.gen(function* () {
+    const cause = new ServerSecretStore.SecretStoreReadError({
+      resource: "bitbucket-access-token",
+      cause: PlatformError.systemError({
+        _tag: "PermissionDenied",
+        module: "FileSystem",
+        method: "readFile",
+        pathOrDescriptor: "bitbucket-access-token",
+        description: "Secret backend unavailable.",
+      }),
+    });
+    const layerSettings = ServerSettingsModule.layer.pipe(
+      Layer.provide(layerFailingSecretStore(cause)),
+      Layer.provideMerge(Layer.fresh(SqlitePersistence.layerMemory)),
+      Layer.provideMerge(
+        Layer.fresh(
+          ServerConfig.layerTest(process.cwd(), {
+            prefix: "t3code-server-settings-legacy-failure-test-",
+          }),
+        ),
+      ),
+    );
+    return Effect.gen(function* () {
       const serverConfig = yield* ServerConfig.ServerConfig;
       const fileSystem = yield* FileSystem.FileSystem;
-      const secrets = yield* ServerSecretStore.ServerSecretStore;
       const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
-      // A token was saved, then the user deleted it from settings.json directly.
+      const legacy = JSON.stringify({
-      yield* secrets.set("bitbucket-access-token", new TextEncoder().encode("stale-token"));
+        bitbucket: { email: "me@example.com", accessToken: "\u2022\u2022\u2022\u2022\u2022\u2022" },
-      yield* fileSystem.writeFileString(serverConfig.settingsPath, "{}");
+      });
+      yield* fileSystem.writeFileString(serverConfig.settingsPath, legacy);
-      yield* serverSettings.updateSettings({ cursorKeychainUsageEnabled: true });
+      yield* Effect.exit(serverSettings.getSettings);
-      assert.isTrue(Option.isNone(yield* secrets.get("bitbucket-access-token")));
+      assert.equal(yield* fileSystem.readFileString(serverConfig.settingsPath), legacy);
-    }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
+    }).pipe(Effect.provide(layerSettings));
-  );
+  });
-  it.effect("moves a hand-edited Bitbucket token into the secret store when settings load", () =>
+  it.effect("moves the retired bitbucket and github keys and their secrets on load", () =>
     Effect.gen(function* () {
       const serverConfig = yield* ServerConfig.ServerConfig;
       const fileSystem = yield* FileSystem.FileSystem;
       const secrets = yield* ServerSecretStore.ServerSecretStore;
       const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
+      const marker = "\u2022\u2022\u2022\u2022\u2022\u2022";
+      yield* secrets.set("bitbucket-access-token", new TextEncoder().encode("bb-saved"));
+      yield* secrets.set(
+        `github-token-${Buffer.from("github.com", "utf8").toString("base64url")}`,
+        new TextEncoder().encode("ghp_saved"),
+      );
       yield* fileSystem.writeFileString(
         serverConfig.settingsPath,
-        '{"bitbucket":{"accessToken":"hand-edited-token"}}',
+        JSON.stringify({
+          bitbucket: { email: "me@example.com", accessToken: marker },
+          github: {
+            hosts: { "github.com": { account: "work" } },
+            tokens: { "github.com": marker },
+          },
+        }),
       );
-      // Loading alone moves it: no settings update is needed.
+      const loaded = (yield* serverSettings.getSettings).sourceControlHosts;
-      const loaded = yield* serverSettings.getSettings;
-      assert.equal(loaded.bitbucket.accessToken, "hand-edited-token");
+      assert.deepEqual(loaded.bitbucket, { email: "me@example.com", accessToken: "bb-saved" });
-      assert.notInclude(
+      assert.deepEqual(loaded.github?.tokens, { "github.com": "ghp_saved" });
-        yield* fileSystem.readFileString(serverConfig.settingsPath),
+      assert.deepEqual(loaded.github?.hosts, { "github.com": { account: "work" } });
-        "hand-edited-token",
+      const raw = yield* fileSystem.readFileString(serverConfig.settingsPath);
-      );
+      assert.notInclude(raw, '"bitbucket":{"email"');
-      const stored = yield* secrets.get("bitbucket-access-token");
+      assert.include(raw, "sourceControlHosts");
-      assert.equal(
+      assert.isTrue(Option.isNone(yield* secrets.get("bitbucket-access-token")));
-        Option.isSome(stored) ? new TextDecoder().decode(stored.value) : null,
-        "hand-edited-token",
-      );
     }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
   it.effect(
-    "moves a hand-edited Bitbucket token into the secret store when a client echoes the marker",
+    "moves a hand-edited source control token into the secret store when settings load",
     () =>
       Effect.gen(function* () {
         const serverConfig = yield* ServerConfig.ServerConfig;
 @@ -1567,24 +1563,18 @@ it.layer(NodeServices.layer)("server settings", (it) => {
         const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
         yield* fileSystem.writeFileString(
           serverConfig.settingsPath,
-          '{"bitbucket":{"email":"me@example.com","apiToken":"hand-edited-token"}}',
+          '{"sourceControlHosts":{"bitbucket":{"accessToken":"hand-edited-token"}}}',
         );
-        // The form resends the redacted token when only the email changes.
+        // Loading alone moves it: no settings update is needed.
-        const forClient = ServerSettingsModule.redactServerSettingsForClient(
+        const loaded = yield* serverSettings.getSettings;
-          yield* serverSettings.getSettings,
-        ).bitbucket;
-        const updated = yield* serverSettings.updateSettings({
-          bitbucket: { email: "new@example.com", apiToken: forClient.apiToken },
-        });
-        assert.equal(updated.bitbucket.apiToken, "hand-edited-token");
+        assert.equal(loaded.sourceControlHosts.bitbucket?.accessToken, "hand-edited-token");
-        assert.equal((yield* serverSettings.getSettings).bitbucket.apiToken, "hand-edited-token");
         assert.notInclude(
           yield* fileSystem.readFileString(serverConfig.settingsPath),
           "hand-edited-token",
         );
-      }).pipe(Effect.provide(layerServerSettings())),
+      }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
   it.effect("materializes provider secrets for terminal environment resolution", () =>

apps/server/src/serverSettings.ts+202-127

 @@ -64,6 +64,13 @@ import {
   isModelSelectionProviderEnabled,
 } from "@t3tools/shared/serverSettings";
 import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
+import {
+  readSecretFieldValues,
+  SOURCE_CONTROL_HOST_SECRET_FIELDS,
+  type SourceControlHostSecretSlot,
+  sourceControlHostSecretName,
+  writeSecretFieldValues,
+} from "./sourceControl/sourceControlHostSecrets.ts";
 export { resolveSourceControlWriterModelSelection } from "@t3tools/shared/serverSettings";
 @@ -157,18 +164,47 @@ function usageLimitSourceSecretName(sourceId: string): string {
   return `usage-limit-source-${Buffer.from(sourceId, "utf8").toString("base64url")}`;
 }
-const BITBUCKET_SECRET_NAMES = {
+const redactSecret = (value: string) => (value.length > 0 ? SECRET_REDACTED : "");
-  accessToken: "bitbucket-access-token",
-  apiToken: "bitbucket-api-token",
-} as const;
-const BITBUCKET_SECRET_FIELDS = ["accessToken", "apiToken"] as const;
-/** Hosts are case-insensitive; a patch can arrive before decoding lowercased its keys. */
+/** Each host's settings with every secret slot's value replaced by `map(slot, value)`. */
-function gitHubTokenSecretName(host: string): string {
+function mapSlotValues(
-  return `github-token-${Buffer.from(host.trim().toLowerCase(), "utf8").toString("base64url")}`;
+  hosts: ServerSettings["sourceControlHosts"],
+  map: (slot: SourceControlHostSecretSlot, value: string) => string,
+): ServerSettings["sourceControlHosts"] {
+  return Object.fromEntries(
+    Object.entries(hosts).map(([kind, fields]) => {
+      const secretFields = SOURCE_CONTROL_HOST_SECRET_FIELDS.get(kind) ?? [];
+      if (secretFields.length === 0) return [kind, fields];
+      const next = { ...fields };
+      for (const field of secretFields) {
+        if (!(field in next)) continue;
+        next[field] = writeSecretFieldValues(
+          next[field],
+          readSecretFieldValues(next[field]).map(
+            ([serverHost, value]) => [serverHost, map({ kind, field, serverHost }, value)] as const,
+          ),
+        );
+      }
+      return [kind, next];
+    }),
+  );
 }
-const redactSecret = (value: string) => (value.length > 0 ? SECRET_REDACTED : "");
+/** Every saved secret slot in `hosts`, with its current value. */
+function sourceControlHostSecretSlots(
+  hosts: ServerSettings["sourceControlHosts"],
+): ReadonlyArray<SourceControlHostSecretSlot & { readonly value: string }> {
+  return Object.entries(hosts).flatMap(([kind, fields]) =>
+    (SOURCE_CONTROL_HOST_SECRET_FIELDS.get(kind) ?? []).flatMap((field) =>
+      readSecretFieldValues(fields[field]).map(([serverHost, value]) => ({
+        kind,
+        field,
+        serverHost,
+        value,
+      })),
+    ),
+  );
+}
 function redactProviderEnvironmentVariable(
   variable: ProviderInstanceEnvironmentVariable,
 @@ -206,18 +242,10 @@ export function redactServerSettingsForClient(settings: ServerSettings): ServerS
       },
     ]),
   );
-  const bitbucket = {
+  const sourceControlHosts = mapSlotValues(settings.sourceControlHosts, (_slot, value) =>
-    ...settings.bitbucket,
+    redactSecret(value),
-    accessToken: redactSecret(settings.bitbucket.accessToken),
+  );
-    apiToken: redactSecret(settings.bitbucket.apiToken),
+  return { ...settings, providerInstances, usageLimitSources, sourceControlHosts };
-  };
-  const github = {
-    ...settings.github,
-    tokens: Object.fromEntries(
-      Object.entries(settings.github.tokens).map(([host, token]) => [host, redactSecret(token)]),
-    ),
-  };
-  return { ...settings, providerInstances, usageLimitSources, bitbucket, github };
 }
 export function applyProviderInstanceMutation(
 @@ -394,10 +422,60 @@ const decodeServerSettingsJsonExit = Schema.decodeUnknownExit(ServerSettingsJson
 const LegacyProviderSettingsJson = fromLenientJson(
   Schema.Struct({
     providers: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown)),
+    // Retired for `sourceControlHosts`; read only by `migrateLegacySourceControlSettings`.
+    bitbucket: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown)),
+    github: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown)),
   }),
 );
 const decodeLegacyProviderSettingsJsonExit = Schema.decodeUnknownExit(LegacyProviderSettingsJson);
+/** The secret store names the retired `bitbucket` and `github` keys kept their tokens under. */
+const LEGACY_BITBUCKET_SECRET_NAMES: Readonly<Record<string, string>> = {
+  accessToken: "bitbucket-access-token",
+  apiToken: "bitbucket-api-token",
+};
+const legacyGitHubTokenSecretName = (host: string) =>
+  `github-token-${Buffer.from(host.trim().toLowerCase(), "utf8").toString("base64url")}`;
+/**
+ * Folds the retired `bitbucket` and `github` keys into `sourceControlHosts`, unless the new key
+ * already holds that host. Returns the secret store entries to copy to their new names.
+ */
+function migrateLegacySourceControlSettings(
+  settings: ServerSettings,
+  legacy: {
+    readonly bitbucket?: Readonly<Record<string, unknown>> | undefined;
+    readonly github?: Readonly<Record<string, unknown>> | undefined;
+  },
+): {
+  readonly settings: ServerSettings;
+  readonly secretMoves: ReadonlyArray<{ readonly from: string; readonly to: string }>;
+} {
+  const sourceControlHosts = { ...settings.sourceControlHosts };
+  const secretMoves: Array<{ readonly from: string; readonly to: string }> = [];
+  if (legacy.bitbucket !== undefined && sourceControlHosts.bitbucket === undefined) {
+    sourceControlHosts.bitbucket = legacy.bitbucket;
+    for (const [field, from] of Object.entries(LEGACY_BITBUCKET_SECRET_NAMES)) {
+      if (legacy.bitbucket[field] !== SECRET_REDACTED) continue;
+      secretMoves.push({
+        from,
+        to: sourceControlHostSecretName({ kind: "bitbucket", field, serverHost: null }),
+      });
+    }
+  }
+  if (legacy.github !== undefined && sourceControlHosts.github === undefined) {
+    sourceControlHosts.github = legacy.github;
+    for (const [serverHost, value] of readSecretFieldValues(legacy.github.tokens)) {
+      if (serverHost === null || value !== SECRET_REDACTED) continue;
+      secretMoves.push({
+        from: legacyGitHubTokenSecretName(serverHost),
+        to: sourceControlHostSecretName({ kind: "github", field: "tokens", serverHost }),
+      });
+    }
+  }
+  return { settings: { ...settings, sourceControlHosts }, secretMoves };
+}
 // Drivers that start disabled, so a session in the history means the user
 // turned them on before the instance kept an explicit flag.
 const HISTORY_RESTORED_DRIVERS: ReadonlySet<ProviderDriverKind> = new Set(
 @@ -724,54 +802,41 @@ const make = Effect.gen(function* () {
   );
   /**
-   * Moves Bitbucket tokens hand-edited into settings.json into the secret store as they load,
+   * Moves source control host secrets hand-edited into settings.json into the secret store as
-   * so plaintext does not stay on disk. If the store is unavailable, the token keeps working
+   * they load, so plaintext does not stay on disk. If the store is unavailable, the secret keeps
-   * from the file and the move is retried on the next load.
+   * working from the file and the move is retried on the next load.
    */
-  const moveInlineBitbucketTokens = (settings: ServerSettings) =>
+  const moveInlineSourceControlHostSecrets = (settings: ServerSettings) =>
     Effect.gen(function* () {
-      const bitbucket = { ...settings.bitbucket };
+      const moved = new Set<string>();
-      let moved = false;
+      for (const slot of sourceControlHostSecretSlots(settings.sourceControlHosts)) {
-      for (const field of BITBUCKET_SECRET_FIELDS) {
+        if (slot.value.length === 0 || slot.value === SECRET_REDACTED) continue;
-        const value = bitbucket[field];
-        if (value.length === 0 || value === SECRET_REDACTED) continue;
         const stored = yield* secretStore
-          .set(BITBUCKET_SECRET_NAMES[field], textEncoder.encode(value))
+          .set(sourceControlHostSecretName(slot), textEncoder.encode(slot.value))
           .pipe(
             Effect.as(true),
             Effect.catch(() =>
-              Effect.logWarning("failed to move a Bitbucket token into the secret store", {
+              Effect.logWarning("failed to move a source control secret into the secret store", {
-                field,
+                kind: slot.kind,
+                field: slot.field,
               }).pipe(Effect.as(false)),
             ),
           );
-        if (!stored) continue;
+        if (stored) moved.add(sourceControlHostSecretName(slot));
-        bitbucket[field] = SECRET_REDACTED;
-        moved = true;
       }
-      const tokens = { ...settings.github.tokens };
+      if (moved.size === 0) return settings;
-      for (const [host, value] of Object.entries(tokens)) {
+      return {
-        if (value.length === 0 || value === SECRET_REDACTED) continue;
+        ...settings,
-        const stored = yield* secretStore
+        sourceControlHosts: mapSlotValues(settings.sourceControlHosts, (slot, value) =>
-          .set(gitHubTokenSecretName(host), textEncoder.encode(value))
+          moved.has(sourceControlHostSecretName(slot)) ? SECRET_REDACTED : value,
-          .pipe(
+        ),
-            Effect.as(true),
+      };
-            Effect.catch(() =>
-              Effect.logWarning("failed to move a GitHub token into the secret store", {
-                host,
-              }).pipe(Effect.as(false)),
-            ),
-          );
-        if (!stored) continue;
-        tokens[host] = SECRET_REDACTED;
-        moved = true;
-      }
-      return moved ? { ...settings, bitbucket, github: { ...settings.github, tokens } } : settings;
     });
   const loadSettingsFromDisk = Effect.gen(function* () {
     let settings = DEFAULT_SERVER_SETTINGS;
     let legacyProviders: Readonly<Record<string, unknown>> | undefined;
+    let legacySourceControl: Parameters<typeof migrateLegacySourceControlSettings>[1] = {};
     // A file that failed to decode must stay on disk for the user to repair;
     // the fold below only writes when it started from the file's real contents.
     let settingsFileTrusted = true;
 @@ -782,6 +847,10 @@ const make = Effect.gen(function* () {
       const legacySettings = decodeLegacyProviderSettingsJsonExit(raw);
       if (legacySettings._tag === "Success") {
         legacyProviders = legacySettings.value.providers;
+        legacySourceControl = {
+          bitbucket: legacySettings.value.bitbucket,
+          github: legacySettings.value.github,
+        };
       }
       if (decoded._tag === "Failure" || legacySettings._tag === "Failure") {
         const failure = decoded._tag === "Failure" ? decoded : legacySettings;
 @@ -855,12 +924,48 @@ const make = Effect.gen(function* () {
     const folded = settingsFileTrusted
       ? foldLegacyProjectSettings(loaded, legacyProjectRows)
       : loaded;
+    // Copied, not moved: the old entry is removed only after the new file is written. A token
+    // that cannot be read or copied leaves the retired keys in place, so the migration runs again
+    // on the next load instead of dropping it.
+    const legacySecretsCopied = yield* Effect.forEach(
+      settingsFileTrusted
+        ? migrateLegacySourceControlSettings(folded, legacySourceControl).secretMoves
+        : [],
+      (move) =>
+        secretStore.get(move.from).pipe(
+          Effect.flatMap((secret) =>
+            Option.isNone(secret) ? Effect.void : secretStore.set(move.to, secret.value),
+          ),
+          Effect.as(true),
+          Effect.catch(() =>
+            Effect.logWarning("failed to copy a source control secret to its new name", {
+              secretName: move.to,
+            }).pipe(Effect.as(false)),
+          ),
+        ),
+    ).pipe(Effect.map((copied) => copied.every(Boolean)));
+    const hasLegacySourceControl =
+      settingsFileTrusted &&
+      legacySecretsCopied &&
+      (legacySourceControl.bitbucket !== undefined || legacySourceControl.github !== undefined);
+    const sourceControlMigration = hasLegacySourceControl
+      ? migrateLegacySourceControlSettings(folded, legacySourceControl)
+      : { settings: folded, secretMoves: [] };
     // Only rewrite a file that decoded cleanly; an untrusted one stays for the user to repair.
-    const migrated = settingsFileTrusted ? yield* moveInlineBitbucketTokens(folded) : folded;
+    const migrated = settingsFileTrusted
-    // A file still carrying the retired `providers` map is rewritten once so
+      ? yield* moveInlineSourceControlHostSecrets(sourceControlMigration.settings)
-    // the migrated instances persist and the old key disappears.
+      : folded;
-    if (migrated !== loaded || (settingsFileTrusted && legacyProviders !== undefined)) {
+    // A file still carrying the retired `providers`, `bitbucket`, or `github` keys is rewritten
+    // once so the migrated values persist and the old keys disappear.
+    if (
+      migrated !== loaded ||
+      (settingsFileTrusted && legacyProviders !== undefined) ||
+      hasLegacySourceControl
+    ) {
       yield* writeSettingsAtomically(migrated);
+      for (const move of sourceControlMigration.secretMoves) {
+        yield* secretStore.remove(move.from).pipe(Effect.ignore);
+      }
     }
     return migrated;
   });
 @@ -933,39 +1038,30 @@ const make = Effect.gen(function* () {
           managementKey: Option.isSome(secret) ? textDecoder.decode(secret.value) : "",
         };
       }
-      const bitbucket = { ...settings.bitbucket };
+      const storedSecrets = new Map<string, string>();
-      for (const field of BITBUCKET_SECRET_FIELDS) {
+      for (const slot of sourceControlHostSecretSlots(settings.sourceControlHosts)) {
-        if (bitbucket[field] !== SECRET_REDACTED) continue;
+        if (slot.value !== SECRET_REDACTED) continue;
-        const secret = yield* secretStore
-          .get(BITBUCKET_SECRET_NAMES[field])
-          .pipe(
-            Effect.mapError(
-              (cause) => new ServerSettingsError({ settingsPath, operation: "read-secret", cause }),
-            ),
-          );
-        bitbucket[field] = Option.isSome(secret) ? textDecoder.decode(secret.value) : "";
-      }
-      const tokens: Record<string, string> = {};
-      for (const [host, value] of Object.entries(settings.github.tokens)) {
-        if (value !== SECRET_REDACTED) {
-          tokens[host] = value;
-          continue;
-        }
         const secret = yield* secretStore
-          .get(gitHubTokenSecretName(host))
+          .get(sourceControlHostSecretName(slot))
           .pipe(
             Effect.mapError(
               (cause) => new ServerSettingsError({ settingsPath, operation: "read-secret", cause }),
             ),
           );
-        tokens[host] = Option.isSome(secret) ? textDecoder.decode(secret.value) : "";
+        storedSecrets.set(
+          sourceControlHostSecretName(slot),
+          Option.isSome(secret) ? textDecoder.decode(secret.value) : "",
+        );
       }
       return {
         ...settings,
         providerInstances: providerInstances as ServerSettings["providerInstances"],
         usageLimitSources: usageLimitSources as ServerSettings["usageLimitSources"],
-        bitbucket,
+        sourceControlHosts: mapSlotValues(settings.sourceControlHosts, (slot, value) =>
-        github: { ...settings.github, tokens },
+          value === SECRET_REDACTED
+            ? (storedSecrets.get(sourceControlHostSecretName(slot)) ?? "")
+            : value,
+        ),
       };
     });
 @@ -1107,56 +1203,36 @@ const make = Effect.gen(function* () {
         });
       }
-      const bitbucket = { ...next.bitbucket };
+      // Hand-edited plaintext not yet in the store, so the redaction marker can move it there.
-      for (const field of BITBUCKET_SECRET_FIELDS) {
+      const inlineSecrets = new Map(
-        let value = bitbucket[field];
+        sourceControlHostSecretSlots(current.sourceControlHosts).flatMap((slot) =>
-        if (value === SECRET_REDACTED) {
+          slot.value.length > 0 && slot.value !== SECRET_REDACTED
-          // The marker keeps what is saved. A plaintext value hand-edited into settings.json
+            ? [[sourceControlHostSecretName(slot), slot.value] as const]
-          // is not in the secret store yet, so move it there instead of dropping it.
+            : [],
-          const inline = current.bitbucket[field];
+        ),
-          if (inline === SECRET_REDACTED || inline.length === 0) continue;
+      );
-          value = inline;
+      const nextSecretNames = new Set<string>();
-        }
+      const sourceControlHosts = mapSlotValues(next.sourceControlHosts, (slot, raw) => {
-        const secretName = BITBUCKET_SECRET_NAMES[field];
+        const secretName = sourceControlHostSecretName(slot);
-        if (value.length === 0) {
+        // The marker keeps what is saved; a hand-edited plaintext value moves into the store.
-          changes.push({ kind: "remove", secretName, operation: "remove-secret" });
+        const value = raw === SECRET_REDACTED ? inlineSecrets.get(secretName) : raw;
-          continue;
+        if (value === undefined) {
-        }
+          nextSecretNames.add(secretName);
-        changes.push({ kind: "write", secretName, value: textEncoder.encode(value) });
+          return SECRET_REDACTED;
-        bitbucket[field] = SECRET_REDACTED;
-      }
-      const tokens: Record<string, string> = {};
-      for (const [rawHost, raw] of Object.entries(next.github.tokens)) {
-        const host = rawHost.trim().toLowerCase();
-        let value = raw;
-        if (value === SECRET_REDACTED) {
-          // The marker keeps what is saved; a hand-edited plaintext token moves into the store.
-          const inline = current.github.tokens[host];
-          if (inline === undefined || inline === SECRET_REDACTED || inline.length === 0) {
-            tokens[host] = SECRET_REDACTED;
-            continue;
-          }
-          value = inline;
         }
-        const secretName = gitHubTokenSecretName(host);
         if (value.length === 0) {
           changes.push({ kind: "remove", secretName, operation: "remove-secret" });
-          continue;
+          return "";
         }
+        nextSecretNames.add(secretName);
         changes.push({ kind: "write", secretName, value: textEncoder.encode(value) });
-        tokens[host] = SECRET_REDACTED;
+        return SECRET_REDACTED;
-      }
+      });
-      const nextHosts = new Set(
+      for (const slot of sourceControlHostSecretSlots(current.sourceControlHosts)) {
-        Object.keys(next.github.tokens).map((host) => host.trim().toLowerCase()),
+        const secretName = sourceControlHostSecretName(slot);
-      );
+        if (nextSecretNames.has(secretName)) continue;
-      for (const host of Object.keys(current.github.tokens)) {
+        if (changes.some((change) => change.secretName === secretName)) continue;
-        if (nextHosts.has(host.trim().toLowerCase())) continue;
+        changes.push({ kind: "remove", secretName, operation: "remove-stale-secret" });
-        changes.push({
-          kind: "remove",
-          secretName: gitHubTokenSecretName(host),
-          operation: "remove-stale-secret",
-        });
       }
       return {
 @@ -1164,8 +1240,7 @@ const make = Effect.gen(function* () {
           ...next,
           providerInstances: providerInstances as ServerSettings["providerInstances"],
           usageLimitSources: usageLimitSources as ServerSettings["usageLimitSources"],
-          bitbucket,
+          sourceControlHosts,
-          github: { ...next.github, tokens },
         },
         changes,
       };

apps/server/src/sourceControl/BitbucketApi.test.ts+15-5

 @@ -632,16 +632,22 @@ it.effect("prefers credentials saved in settings over the environment, without a
     assert.strictEqual(lastAuthorization(), basic("user@example.com", "token"));
     yield* settings.updateSettings({
-      bitbucket: { email: "saved@example.com", apiToken: "saved-api-token" },
+      sourceControlHosts: {
+        bitbucket: { email: "saved@example.com", apiToken: "saved-api-token" },
+      },
     });
     yield* bitbucket.probeAuth;
     assert.strictEqual(lastAuthorization(), basic("saved@example.com", "saved-api-token"));
-    yield* settings.updateSettings({ bitbucket: { accessToken: "saved-access-token" } });
+    yield* settings.updateSettings({
+      sourceControlHosts: { bitbucket: { accessToken: "saved-access-token" } },
+    });
     yield* bitbucket.probeAuth;
     assert.strictEqual(lastAuthorization(), "Bearer saved-access-token");
-    yield* settings.updateSettings({ bitbucket: { accessToken: "", apiToken: "" } });
+    yield* settings.updateSettings({
+      sourceControlHosts: { bitbucket: { accessToken: "", apiToken: "" } },
+    });
     yield* bitbucket.probeAuth;
     assert.strictEqual(lastAuthorization(), basic("user@example.com", "token"));
   }).pipe(Effect.provide(layer));
 @@ -658,7 +664,9 @@ it.effect("never puts a saved token that is unsafe for an HTTP header on the wir
     // Fetch would reject this header with an error quoting the token, and that error reaches
     // clients. The unusable token is ignored, so the environment credential is used instead.
-    yield* settings.updateSettings({ bitbucket: { accessToken: "saved\ntoken" } });
+    yield* settings.updateSettings({
+      sourceControlHosts: { bitbucket: { accessToken: "saved\ntoken" } },
+    });
     yield* bitbucket.probeAuth;
     assert.strictEqual(
       execute.mock.calls.at(-1)?.[0].headers.authorization,
 @@ -679,7 +687,9 @@ it.effect("reports saved credentials as configured when Bitbucket cannot confirm
     assert.strictEqual((yield* bitbucket.probeAuth).status, "unauthenticated");
-    yield* settings.updateSettings({ bitbucket: { accessToken: "saved-access-token" } });
+    yield* settings.updateSettings({
+      sourceControlHosts: { bitbucket: { accessToken: "saved-access-token" } },
+    });
     assert.deepStrictEqual(yield* bitbucket.probeAuth, {
       status: "unknown",
       account: Option.none(),

apps/server/src/sourceControl/SourceControlDiscovery.test.ts+4

apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts+4

apps/server/src/sourceControl/sourceControlHostSecrets.ts created+76

...	@@ -0,0 +1,76 @@
1	/**
2	* Which source control host settings fields hold secrets, read from each built-in host's client
3	* definition. `serverSettings` keeps those values in the secret store and redacts them for
4	* clients, the same way for every host.
5	*
6	* A secret field holds a string, or a string per server host such as GitHub's `tokens`.
7	*
8	* @module sourceControl/sourceControlHostSecrets
9	*/
10	import * as AzureDevOps from "@t3tools/source-control-azure-devops/client/definition";
11	import * as Bitbucket from "@t3tools/source-control-bitbucket/client/definition";
12	import {
13	secretSourceControlHostSettingsFields,
14	type SourceControlClientDefinition,
15	} from "@t3tools/source-control-core/client/definition";
16	import * as Forgejo from "@t3tools/source-control-forgejo/client/definition";
17	import * as GitCafe from "@t3tools/source-control-gitcafe/client/definition";
18	import * as GitHub from "@t3tools/source-control-github/client/definition";
19	import * as GitLab from "@t3tools/source-control-gitlab/client/definition";
20
21	const definitions: ReadonlyArray<SourceControlClientDefinition> = [
22	GitHub.definition,
23	GitLab.definition,
24	AzureDevOps.definition,
25	Bitbucket.definition,
26	Forgejo.definition,
27	GitCafe.definition,
28	];
29
30	/** Secret field names per host kind; a host with none is absent. */
31	export const SOURCE_CONTROL_HOST_SECRET_FIELDS: ReadonlyMap<
32	string,
33	ReadonlyArray<string>
34	> = new Map(
35	definitions.flatMap((definition) => {
36	const fields = definition.settings
37	? secretSourceControlHostSettingsFields(definition.settings)
38	: [];
39	return fields.length > 0 ? [[definition.kind, fields] as const] : [];
40	}),
41	);
42
43	/** One stored secret: a host's field, and the server host it is for when the field is per host. */
44	export interface SourceControlHostSecretSlot {
45	readonly kind: string;
46	readonly field: string;
47	readonly serverHost: string \| null;
48	}
49
50	/** The secret store entry for one slot; names stay stable across releases. */
51	export function sourceControlHostSecretName(slot: SourceControlHostSecretSlot): string {
52	const encode = (value: string) => Buffer.from(value, "utf8").toString("base64url");
53	return slot.serverHost === null
54	? `source-control-${encode(slot.kind)}-${encode(slot.field)}`
55	: `source-control-${encode(slot.kind)}-${encode(slot.field)}-${encode(slot.serverHost.trim().toLowerCase())}`;
56	}
57
58	/** The string values a secret field holds, keyed by server host, or `null` for a plain string. */
59	export function readSecretFieldValues(
60	value: unknown,
61	): ReadonlyArray<readonly [serverHost: string \| null, value: string]> {
62	if (typeof value === "string") return [[null, value]];
63	if (value === null \|\| typeof value !== "object" \|\| Array.isArray(value)) return [];
64	return Object.entries(value).flatMap(([serverHost, entry]) =>
65	typeof entry === "string" ? [[serverHost.trim().toLowerCase(), entry] as const] : [],
66	);
67	}
68
69	/** A secret field's value rebuilt from per-slot values, in the shape it was read from. */
70	export function writeSecretFieldValues(
71	original: unknown,
72	values: ReadonlyArray<readonly [serverHost: string \| null, value: string]>,
73	): unknown {
74	if (typeof original === "string") return values[0]?.[1] ?? "";
75	return Object.fromEntries(values.map(([serverHost, value]) => [serverHost ?? "", value]));
76	}

apps/web/src/components/settings/BitbucketCredentialsSettings.tsx deleted-223

...	@@ -1,223 +0,0 @@
1	import type { BitbucketSettings, EnvironmentId } from "@t3tools/contracts";
2	import { ExternalLinkIcon } from "lucide-react";
3	import { useState } from "react";
4
5	import { useEnvironmentSettings } from "../../hooks/useSettings";
6	import { serverEnvironment } from "../../state/server";
7	import { useAtomCommand } from "../../state/use-atom-command";
8	import { Button, InlineButton } from "../ui/button";
9	import { Input } from "../ui/input";
10	import { Label } from "../ui/label";
11	import { Toggle, ToggleGroup } from "../ui/toggle-group";
12
13	type CredentialMethod = "access-token" \| "api-token";
14
15	const METHODS: Record<
16	CredentialMethod,
17	{
18	readonly label: string;
19	readonly description: string;
20	readonly link: string;
21	readonly linkLabel: string;
22	}
23	> = {
24	"access-token": {
25	label: "Access token",
26	description:
27	"Scoped to one repository, project, or workspace. Create it in that item's Bitbucket settings.",
28	link: "https://support.atlassian.com/bitbucket-cloud/docs/access-tokens/",
29	linkLabel: "Learn more",
30	},
31	"api-token": {
32	label: "API token",
33	description:
34	"Uses your Atlassian account, so it reaches every repository you can. Give it read and write access to repositories and pull requests, and read:user:bitbucket.",
35	link: "https://id.atlassian.com/manage-profile/security/api-tokens",
36	linkLabel: "Create an API token",
37	},
38	};
39
40	function savedMethod(saved: BitbucketSettings): CredentialMethod \| null {
41	if (saved.accessToken.length > 0) return "access-token";
42	if (saved.email.length > 0 && saved.apiToken.length > 0) return "api-token";
43	return null;
44	}
45
46	/** A write-only token field. It never shows the saved token; typing a new one replaces it. */
47	function TokenInput({
48	id,
49	isSaved,
50	draft,
51	onDraftChange,
52	}: {
53	readonly id: string;
54	readonly isSaved: boolean;
55	readonly draft: string;
56	readonly onDraftChange: (draft: string) => void;
57	}) {
58	return (
59	<Input
60	id={id}
61	type="password"
62	autoComplete="off"
63	size="sm"
64	placeholder={isSaved ? "Stored secret, enter a new value to replace" : "Not set"}
65	value={draft}
66	onChange={(event) => onDraftChange(event.target.value)}
67	/>
68	);
69	}
70
71	/**
72	* Bitbucket credentials for one environment: an access token or an Atlassian
73	* account email + API token, never both. Tokens are write-only: the server
74	* keeps them in its secret store and only reports whether each one is set.
75	*/
76	export function BitbucketCredentialsSettings({
77	environmentId,
78	onSaved,
79	}: {
80	readonly environmentId: EnvironmentId;
81	readonly onSaved: () => void;
82	}) {
83	const saved = useEnvironmentSettings(environmentId, (settings) => settings.bitbucket);
84	const updateSettings = useAtomCommand(serverEnvironment.updateSettings, {
85	label: "save Bitbucket credentials",
86	});
87	const [methodChoice, setMethodChoice] = useState<CredentialMethod \| null>(null);
88	const [accessToken, setAccessToken] = useState("");
89	const [emailDraft, setEmailDraft] = useState<string \| null>(null);
90	const [apiToken, setApiToken] = useState("");
91	const [saving, setSaving] = useState(false);
92	const current = savedMethod(saved);
93	const method = methodChoice ?? current ?? "access-token";
94	const methodIsSaved = current === method;
95	const email = (emailDraft ?? saved.email).trim();
96	const newAccessToken = accessToken.trim();
97	const newApiToken = apiToken.trim();
98	const info = METHODS[method];
99
100	// Saving one method clears the other, so a hidden credential never wins over the visible one.
101	const patch: BitbucketSettings \| null =
102	method === "access-token"
103	? newAccessToken
104	? { accessToken: newAccessToken, email: "", apiToken: "" }
105	: null
106	: email && (newApiToken \|\| saved.apiToken)
107	? // Resending the saved token's redacted value keeps it.
108	{ accessToken: "", email, apiToken: newApiToken \|\| saved.apiToken }
109	: null;
110	const canSave =
111	patch !== null &&
112	(method === "access-token" \|\| !methodIsSaved \|\| newApiToken !== "" \|\| email !== saved.email);
113
114	const save = async (next: BitbucketSettings) => {
115	setSaving(true);
116	try {
117	const result = await updateSettings({
118	environmentId,
119	input: { patch: { bitbucket: next } },
120	});
121	if (result._tag === "Success") {
122	setAccessToken("");
123	setApiToken("");
124	setEmailDraft(null);
125	onSaved();
126	}
127	} finally {
128	setSaving(false);
129	}
130	};
131
132	return (
133	<form
134	className="grid gap-4"
135	onSubmit={(event) => {
136	event.preventDefault();
137	if (canSave && patch) void save(patch);
138	}}
139	>
140	{/* Locked while saving: a successful save clears the drafts, which would drop edits made mid-request. */}
141	<fieldset disabled={saving} className="contents">
142	<ToggleGroup
143	aria-label="Bitbucket sign-in method"
144	variant="segmented"
145	value={[method]}
146	onValueChange={(next) => {
147	const value = next[0];
148	if (value === "access-token" \|\| value === "api-token") setMethodChoice(value);
149	}}
150	>
151	<Toggle value="access-token">{METHODS["access-token"].label}</Toggle>
152	<Toggle value="api-token">{METHODS["api-token"].label}</Toggle>
153	</ToggleGroup>
154	<p className="max-w-2xl text-xs leading-relaxed text-muted-foreground">
155	{info.description}{" "}
156	<InlineButton render={<a href={info.link} target="_blank" rel="noreferrer noopener" />}>
157	{info.linkLabel}
158	<ExternalLinkIcon aria-hidden className="size-3" />
159	</InlineButton>
160	</p>
161	{method === "access-token" ? (
162	<div className="grid gap-1.5">
163	<Label htmlFor={`bitbucket-access-token-${environmentId}`}>Access token</Label>
164	<TokenInput
165	id={`bitbucket-access-token-${environmentId}`}
166	isSaved={methodIsSaved}
167	draft={accessToken}
168	onDraftChange={setAccessToken}
169	/>
170	</div>
171	) : (
172	<>
173	<div className="grid gap-1.5">
174	<Label htmlFor={`bitbucket-email-${environmentId}`}>Atlassian account email</Label>
175	<Input
176	id={`bitbucket-email-${environmentId}`}
177	type="email"
178	autoComplete="off"
179	size="sm"
180	placeholder="you@example.com"
181	value={emailDraft ?? saved.email}
182	onChange={(event) => setEmailDraft(event.target.value)}
183	/>
184	</div>
185	<div className="grid gap-1.5">
186	<Label htmlFor={`bitbucket-api-token-${environmentId}`}>API token</Label>
187	<TokenInput
188	id={`bitbucket-api-token-${environmentId}`}
189	isSaved={methodIsSaved}
190	draft={apiToken}
191	onDraftChange={setApiToken}
192	/>
193	</div>
194	</>
195	)}
196	<div className="flex items-center justify-between gap-3">
197	<p className="text-xs text-muted-foreground">
198	{current === null
199	? "Without a saved token, the server falls back to its T3CODE_BITBUCKET_* environment variables."
200	: methodIsSaved
201	? null
202	: `Saving replaces your ${METHODS[current].label.toLowerCase()}.`}
203	</p>
204	<div className="flex shrink-0 gap-2">
205	{current !== null ? (
206	<Button
207	size="xs"
208	variant="outline"
209	disabled={saving}
210	onClick={() => void save({ accessToken: "", email: "", apiToken: "" })}
211	>
212	Remove
213	</Button>
214	) : null}
215	<Button type="submit" size="xs" disabled={!canSave \|\| saving}>
216	Save
217	</Button>
218	</div>
219	</div>
220	</fieldset>
221	</form>
222	);
223	}

apps/web/src/components/settings/GitHubAccountSettings.logic.ts+2-1

...	@@ -1,4 +1,5 @@	...	@@ -1,4 +1,5 @@
1	import type { GitHubSettings, SourceControlProviderAuth } from "@t3tools/contracts";	1	import type { SourceControlProviderAuth } from "@t3tools/contracts";
		2	import type { GitHubSettings } from "@t3tools/client-runtime/source-control-clients";
2		3
3	export type GitHubDiscoveredAccount = NonNullable<SourceControlProviderAuth["accounts"]>[number];	4	export type GitHubDiscoveredAccount = NonNullable<SourceControlProviderAuth["accounts"]>[number];
4		5

apps/web/src/components/settings/GitHubAccountSettings.tsx+8-2

...	@@ -9,6 +9,7 @@ import { Button } from "../ui/button";	...	@@ -9,6 +9,7 @@ import { Button } from "../ui/button";
9	import { Select, SelectItem, SelectPopup, SelectTrigger, SelectValue } from "../ui/select";	9	import { Select, SelectItem, SelectPopup, SelectTrigger, SelectValue } from "../ui/select";
10	import { Switch } from "../ui/switch";	10	import { Switch } from "../ui/switch";
11	import { groupGitHubAccounts, nextGitHubHosts } from "./GitHubAccountSettings.logic";	11	import { groupGitHubAccounts, nextGitHubHosts } from "./GitHubAccountSettings.logic";
		12	import { readGitHubSettings } from "@t3tools/client-runtime/source-control-clients";
12	import { redactedPlaceholder } from "./RedactedSensitiveText";	13	import { redactedPlaceholder } from "./RedactedSensitiveText";
13		14
14	/** Sentinel select value for "follow gh's active login"; logins never contain spaces. */	15	/** Sentinel select value for "follow gh's active login"; logins never contain spaces. */
...	@@ -49,7 +50,8 @@ export function GitHubAccountSettings({	...	@@ -49,7 +50,8 @@ export function GitHubAccountSettings({
49	readonly auth: SourceControlProviderAuth;	50	readonly auth: SourceControlProviderAuth;
50	readonly onSaved: () => void;	51	readonly onSaved: () => void;
51	}) {	52	}) {
52	const hosts = useEnvironmentSettings(environmentId, (settings) => settings.github.hosts);	53	const github = useEnvironmentSettings(environmentId, readGitHubSettings);
		54	const hosts = github.hosts;
53	const updateSettings = useAtomCommand(serverEnvironment.updateSettings, {	55	const updateSettings = useAtomCommand(serverEnvironment.updateSettings, {
54	label: "save GitHub account settings",	56	label: "save GitHub account settings",
55	});	57	});
...	@@ -65,7 +67,11 @@ export function GitHubAccountSettings({	...	@@ -65,7 +67,11 @@ export function GitHubAccountSettings({
65	try {	67	try {
66	const result = await updateSettings({	68	const result = await updateSettings({
67	environmentId,	69	environmentId,
68	input: { patch: { github: { hosts: nextGitHubHosts(hosts, host, change) } } },	70	input: {
		71	patch: {
		72	sourceControlHosts: { github: { hosts: nextGitHubHosts(hosts, host, change) } },
		73	},
		74	},
69	});	75	});
70	if (result._tag === "Success") onSaved();	76	if (result._tag === "Success") onSaved();
71	} finally {	77	} finally {

apps/web/src/components/settings/GitHubTokenSettings.tsx+6-2

...	@@ -3,6 +3,7 @@ import { ExternalLinkIcon } from "lucide-react";	...	@@ -3,6 +3,7 @@ import { ExternalLinkIcon } from "lucide-react";
3	import { useState } from "react";	3	import { useState } from "react";
4		4
5	import { useEnvironmentSettings } from "../../hooks/useSettings";	5	import { useEnvironmentSettings } from "../../hooks/useSettings";
		6	import { readGitHubSettings } from "@t3tools/client-runtime/source-control-clients";
6	import { serverEnvironment } from "../../state/server";	7	import { serverEnvironment } from "../../state/server";
7	import { useAtomCommand } from "../../state/use-atom-command";	8	import { useAtomCommand } from "../../state/use-atom-command";
8	import { Button, InlineButton } from "../ui/button";	9	import { Button, InlineButton } from "../ui/button";
...	@@ -28,7 +29,7 @@ export function GitHubTokenSettings({	...	@@ -28,7 +29,7 @@ export function GitHubTokenSettings({
28	readonly environmentId: EnvironmentId;	29	readonly environmentId: EnvironmentId;
29	readonly onSaved: () => void;	30	readonly onSaved: () => void;
30	}) {	31	}) {
31	const tokens = useEnvironmentSettings(environmentId, (settings) => settings.github.tokens);	32	const { tokens } = useEnvironmentSettings(environmentId, readGitHubSettings);
32	const updateSettings = useAtomCommand(serverEnvironment.updateSettings, {	33	const updateSettings = useAtomCommand(serverEnvironment.updateSettings, {
33	label: "save GitHub token",	34	label: "save GitHub token",
34	});	35	});
...	@@ -46,7 +47,10 @@ export function GitHubTokenSettings({	...	@@ -46,7 +47,10 @@ export function GitHubTokenSettings({
46	try {	47	try {
47	const result = await updateSettings({	48	const result = await updateSettings({
48	environmentId,	49	environmentId,
49	input: { patch: { github: { tokens: { [target]: token } } } },	50	// The map travels whole: every other saved token as its redaction marker, which keeps it.
		51	input: {
		52	patch: { sourceControlHosts: { github: { tokens: { ...tokens, [target]: token } } } },
		53	},
50	});	54	});
51	if (result._tag === "Success") {	55	if (result._tag === "Success") {
52	setDraft("");	56	setDraft("");

apps/web/src/components/settings/ProviderSettingsForm.tsx+30-6

 @@ -19,6 +19,11 @@ import { Select, SelectItem, SelectPopup, SelectTrigger, SelectValue } from "../
 import { Switch } from "../ui/switch";
 import { Textarea } from "../ui/textarea";
 import type { ProviderClientDefinition } from "@t3tools/provider-core/client";
+/** What the form reads from a definition: an agent provider's, or a source control host's. */
+export type SettingsFormDefinition = Pick<ProviderClientDefinition, "settingsSchema"> & {
+  readonly driverKind?: ProviderClientDefinition["driverKind"];
+};
 import { SettingsRow } from "./settingsLayout";
 export interface ProviderSettingsFieldModel {
 @@ -28,6 +33,8 @@ export interface ProviderSettingsFieldModel {
   readonly description?: string | undefined;
   readonly placeholder?: string | undefined;
   readonly clearWhenEmpty: "omit" | "persist";
+  /** Kept in the server's secret store: a saved value arrives as `SECRET_REDACTED` and never shows. */
+  readonly secret?: boolean | undefined;
   readonly defaultBooleanValue?: boolean | undefined;
   /** Choices for a `select` control. The first entry is the default. */
   readonly options?: ReadonlyArray<ProviderSettingsFormOption> | undefined;
 @@ -63,7 +70,7 @@ function readProviderSettingsFormAnnotation(
 }
 function readProviderSettingsFormSchemaAnnotation(
-  definition: ProviderClientDefinition,
+  definition: SettingsFormDefinition,
 ): ProviderSettingsFormSchemaAnnotation {
   return Schema.resolveAnnotations(definition.settingsSchema)?.providerSettingsFormSchema ?? {};
 }
 @@ -77,7 +84,7 @@ function readFieldBooleanDefault(
 }
 export function deriveProviderSettingsFields(
-  definition: ProviderClientDefinition,
+  definition: SettingsFormDefinition,
   value?: unknown,
 ): ReadonlyArray<ProviderSettingsFieldModel> {
   const isLocalAcp =
 @@ -124,6 +131,7 @@ export function deriveProviderSettingsFields(
               ? { placeholder: formAnnotation.placeholder }
               : {}),
           clearWhenEmpty: formAnnotation.clearWhenEmpty ?? "omit",
+          ...(formAnnotation.secret ? { secret: true } : {}),
           ...(formAnnotation.control === "switch"
             ? { defaultBooleanValue: readFieldBooleanDefault(fieldSchema) }
             : {}),
 @@ -247,6 +255,19 @@ function readProviderConfigString(config: unknown, key: string): string {
   return typeof value === "string" ? value : "";
 }
+/**
+ * A secret field never shows its saved value: it starts empty, and its placeholder says whether
+ * one is saved. Saving one is typing a new value; clearing it is the host form's job.
+ */
+function secretFieldInputProps(field: ProviderSettingsFieldModel, config: unknown) {
+  const saved = readProviderConfigString(config, field.key);
+  if (!field.secret) return { value: saved, placeholder: field.placeholder };
+  return {
+    value: "",
+    placeholder: saved.length > 0 ? "Stored secret, enter a new value to replace" : "Not set",
+  };
+}
 function readProviderConfigBoolean(config: unknown, key: string, defaultValue = false): boolean {
   if (config === null || typeof config !== "object") return defaultValue;
   const value = (config as Record<string, unknown>)[key];
 @@ -281,7 +302,7 @@ export function nextProviderConfigWithFieldValue(
 }
 interface ProviderSettingsFormProps {
-  readonly definition: ProviderClientDefinition;
+  readonly definition: SettingsFormDefinition;
   readonly value: unknown;
   readonly idPrefix: string;
   /**
 @@ -410,9 +431,12 @@ function ProviderSettingsFieldRow({
           className="w-full max-w-full @min-[32rem]/settings-row:w-56"
           type={field.control === "password" ? "password" : undefined}
           autoComplete={field.control === "password" ? "off" : undefined}
-          value={readProviderConfigString(value, field.key)}
+          {...secretFieldInputProps(field, value)}
-          onCommit={(next) => onChange(nextProviderConfigWithFieldValue(value, field, next))}
+          onCommit={(next) => {
-          placeholder={field.placeholder}
+            // An untouched saved secret commits empty; only a typed value replaces it.
+            if (field.secret && next === "") return;
+            onChange(nextProviderConfigWithFieldValue(value, field, next));
+          }}
           spellCheck={false}
         />
       );

apps/web/src/components/settings/SourceControlHostSettings.tsx created+84

...	@@ -0,0 +1,84 @@
1	import type { EnvironmentId } from "@t3tools/contracts";
2	import type { SourceControlClientDefinition } from "@t3tools/client-runtime/source-control-clients";
3	import { useState } from "react";
4
5	import { useEnvironmentSettings } from "../../hooks/useSettings";
6	import { serverEnvironment } from "../../state/server";
7	import { useAtomCommand } from "../../state/use-atom-command";
8	import { Button } from "../ui/button";
9	import { ProviderSettingsForm } from "./ProviderSettingsForm";
10
11	/**
12	* One host's settings, drawn from its definition's settings schema and saved under
13	* `sourceControlHosts[kind]`. Secret fields are write-only: the server keeps them in its secret
14	* store and only reports whether each one is set.
15	*/
16	export function SourceControlHostSettings({
17	environmentId,
18	definition,
19	onSaved,
20	}: {
21	readonly environmentId: EnvironmentId;
22	readonly definition: SourceControlClientDefinition & {
23	readonly settings: NonNullable<SourceControlClientDefinition["settings"]>;
24	};
25	readonly onSaved: () => void;
26	}) {
27	const saved = useEnvironmentSettings(
28	environmentId,
29	(settings) => settings.sourceControlHosts[definition.kind],
30	);
31	const updateSettings = useAtomCommand(serverEnvironment.updateSettings, {
32	label: `save ${definition.label} settings`,
33	});
34	const [saving, setSaving] = useState(false);
35	const formDefinition = { settingsSchema: definition.settings };
36	const hasSaved = Object.values(saved ?? {}).some((value) => value !== "");
37
38	const save = async (fields: Record<string, unknown>) => {
39	setSaving(true);
40	try {
41	const result = await updateSettings({
42	environmentId,
43	input: { patch: { sourceControlHosts: { [definition.kind]: fields } } },
44	});
45	if (result._tag === "Success") onSaved();
46	} finally {
47	setSaving(false);
48	}
49	};
50
51	return (
52	// Locked while saving, so an edit made mid-request is not overwritten by the saved value.
53	<fieldset disabled={saving} className="contents">
54	<ProviderSettingsForm
55	definition={formDefinition}
56	value={saved ?? {}}
57	idPrefix={`source-control-${definition.kind}-${environmentId}`}
58	variant="settings"
59	onChange={(next) => {
60	const fields = next ?? {};
61	// Only what changed: each saved secret travels as its redaction marker anyway.
62	const changed = Object.fromEntries(
63	Object.entries(fields).filter(([key, value]) => saved?.[key] !== value),
64	);
65	const cleared = Object.keys(saved ?? {}).filter((key) => !(key in fields));
66	void save({ ...changed, ...Object.fromEntries(cleared.map((key) => [key, ""])) });
67	}}
68	/>
69	{hasSaved ? (
70	<div className="flex justify-end pt-2">
71	<Button
72	size="xs"
73	variant="outline"
74	onClick={() =>
75	void save(Object.fromEntries(Object.keys(saved ?? {}).map((key) => [key, ""])))
76	}
77	>
78	Remove
79	</Button>
80	</div>
81	) : null}
82	</fieldset>
83	);
84	}

apps/web/src/components/settings/SourceControlSettings.tsx+23-15

 @@ -46,7 +46,7 @@ import { Switch } from "../ui/switch";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
 import { GitIcon, JujutsuIcon, type Icon } from "../Icons";
-import { BitbucketCredentialsSettings } from "./BitbucketCredentialsSettings";
+import { SourceControlHostSettings } from "./SourceControlHostSettings";
 import { GitHubAccountSettings } from "./GitHubAccountSettings";
 import { GitHubTokenSettings } from "./GitHubTokenSettings";
 import { RedactedSensitiveText } from "./RedactedSensitiveText";
 @@ -59,7 +59,7 @@ import {
   SettingsSection,
   useSettingsSearchTargetId,
 } from "./settingsLayout";
-import { searchableSetting } from "./settingsSearch";
+import { searchableSetting, sourceControlHostSettingsSearchId } from "./settingsSearch";
 import { PullRequestGlyph } from "~/components/pullRequest/pullRequestIcons";
 import { sourceControlClients } from "@t3tools/client-runtime/source-control-clients";
 import { sourceControlIcon } from "~/sourceControlPresentation";
 @@ -278,8 +278,7 @@ function DiscoveryItemRow({
   useEffect(() => {
     if (
       (item.kind === "git" && searchTargetId === searchableSetting("git-fetch-interval").id) ||
-      (item.kind === "bitbucket" &&
+      searchTargetId === sourceControlHostSettingsSearchId(item.kind) ||
-        searchTargetId === searchableSetting("bitbucket-credentials").id) ||
       (item.kind === "github" && searchTargetId === searchableSetting("github-accounts").id)
     ) {
       setIsExpanded(true);
 @@ -527,6 +526,22 @@ export function SourceControlSettingsPanel() {
   const handleScan = () => {
     discovery.refresh();
   };
+  /** The host's own settings form, for a host whose definition declares settings. */
+  const hostSettingsPanel = (kind: string) => {
+    const definition = sourceControlClients.find(kind);
+    if (!definition?.settings || environmentId === null) return undefined;
+    return (
+      <SettingsSearchTarget id={sourceControlHostSettingsSearchId(kind)}>
+        <SourceControlHostSettings
+          // Drafts belong to one environment; switching must not carry them over.
+          key={environmentId}
+          environmentId={environmentId}
+          definition={{ ...definition, settings: definition.settings }}
+          onSaved={handleScan}
+        />
+      </SettingsSearchTarget>
+    );
+  };
   const scanButton = (
     <Tooltip>
       <TooltipTrigger
 @@ -591,16 +606,7 @@ export function SourceControlSettingsPanel() {
             >
               {result.sourceControlProviders.map((item) => (
                 <DiscoveryItemRow key={`provider:${item.kind}`} item={item}>
-                  {item.kind === "bitbucket" ? (
+                  {item.kind === "github" ? (
-                    <SettingsSearchTarget id={searchableSetting("bitbucket-credentials").id}>
-                      <BitbucketCredentialsSettings
-                        // Drafts belong to one environment; switching must not carry them over.
-                        key={environmentId}
-                        environmentId={environmentId}
-                        onSaved={handleScan}
-                      />
-                    </SettingsSearchTarget>
-                  ) : item.kind === "github" ? (
                     <SettingsSearchTarget id={searchableSetting("github-accounts").id}>
                       <div className="grid gap-6">
                         {/* Shown even without gh: a saved token is how GitHub works without the CLI. */}
 @@ -619,7 +625,9 @@ export function SourceControlSettingsPanel() {
                         ) : null}
                       </div>
                     </SettingsSearchTarget>
-                  ) : undefined}
+                  ) : (
+                    hostSettingsPanel(item.kind)
+                  )}
                 </DiscoveryItemRow>
               ))}
             </SettingsSection>

apps/web/src/components/settings/settingsSearch.ts+25-8

...	@@ -4,6 +4,7 @@ import { isMacPlatform, isWindowsPlatform, normalizeSearchText } from "~/lib/uti	...	@@ -4,6 +4,7 @@ import { isMacPlatform, isWindowsPlatform, normalizeSearchText } from "~/lib/uti
4	import { STATIC_KEYBINDING_COMMANDS, type KeybindingCommand } from "@t3tools/contracts";	4	import { STATIC_KEYBINDING_COMMANDS, type KeybindingCommand } from "@t3tools/contracts";
5	import type { EnvironmentId } from "@t3tools/contracts";	5	import type { EnvironmentId } from "@t3tools/contracts";
6	import type { EnvironmentConnectionPhase } from "@t3tools/client-runtime/connection";	6	import type { EnvironmentConnectionPhase } from "@t3tools/client-runtime/connection";
		7	import { sourceControlClients } from "@t3tools/client-runtime/source-control-clients";
7	import { DEFAULT_KEYBINDINGS } from "@t3tools/shared/keybindings";	8	import { DEFAULT_KEYBINDINGS } from "@t3tools/shared/keybindings";
8	import { commandLabel } from "./KeybindingsSettings.logic";	9	import { commandLabel } from "./KeybindingsSettings.logic";
9	import {	10	import {
...	@@ -132,6 +133,29 @@ const KEYBINDING_SEARCH_ITEMS = STATIC_KEYBINDING_COMMANDS.toSorted((left, right	...	@@ -132,6 +133,29 @@ const KEYBINDING_SEARCH_ITEMS = STATIC_KEYBINDING_COMMANDS.toSorted((left, right
132	};	133	};
133	});	134	});
134		135
		136	/** Anchor id of a source control host's settings form on the Source Control page. */
		137	export function sourceControlHostSettingsSearchId(kind: string) {
		138	return `source-control-host-${kind}` as const;
		139	}
		140
		141	/** One result per host whose definition declares settings, searchable by its field titles. */
		142	const SOURCE_CONTROL_HOST_SEARCH_ITEMS = sourceControlClients.definitions.flatMap((definition) =>
		143	definition.settings && definition.kind !== "github"
		144	? [
		145	{
		146	id: sourceControlHostSettingsSearchId(definition.kind),
		147	title: `${definition.label} credentials`,
		148	to: "/settings/source-control" as const,
		149	searchTerms: [
		150	`${definition.label} ${Object.keys(definition.settings.fields).join(" ")} token credentials sign in`,
		151	],
		152	environmentOnly: true,
		153	scope: "environment-defaults" as const,
		154	},
		155	]
		156	: [],
		157	);
		158
135	/**	159	/**
136	* Searchable settings and stable destinations, in result order. Rows with a	160	* Searchable settings and stable destinations, in result order. Rows with a
137	* dedicated anchor render their id and title via `searchableSetting`; items	161	* dedicated anchor render their id and title via `searchableSetting`; items
...	@@ -808,14 +832,7 @@ export const SETTINGS_SEARCH_ITEMS = [	...	@@ -808,14 +832,7 @@ export const SETTINGS_SEARCH_ITEMS = [
808	environmentOnly: true,	832	environmentOnly: true,
809	scope: "environment-defaults",	833	scope: "environment-defaults",
810	},	834	},
811	{	835	...SOURCE_CONTROL_HOST_SEARCH_ITEMS,
812	id: "bitbucket-credentials",
813	title: "Bitbucket credentials",
814	to: "/settings/source-control",
815	searchTerms: ["bitbucket atlassian access token api token email credentials sign in"],
816	environmentOnly: true,
817	scope: "environment-defaults",
818	},
819	{	836	{
820	id: "source-control-writing-style",	837	id: "source-control-writing-style",
821	title: "Source control writing style",	838	title: "Source control writing style",

docs/user/source-control.md+10-8

 @@ -64,18 +64,18 @@ glab auth login
 ### Bitbucket
-Open **Settings → Source Control**, expand **Bitbucket**, and choose how to sign in:
+Open **Settings → Source Control**, expand **Bitbucket**, and enter one of:
 - **Access token**: a token created for one repository, project, or workspace. It can only reach
   what it was created for.
-- **API token**: an Atlassian API token for your account, used with your account email. It can
+- **Atlassian account email** and **API token**: an Atlassian API token for your account. It can
   reach every repository you can. Give it read/write access to repositories and pull requests, plus
   user read access (`read:user:bitbucket`).
-Choose **Save**; the change applies right away, and replaces any credential saved with the other
+A field saves when you leave it, and applies right away. The access token wins when both are saved.
-method. Credentials are saved on the environment's server, so select a remote environment to
+Credentials are saved on the environment's server, so select a remote environment to configure
-configure it. Saved tokens can't be viewed again; enter a new one to replace it, or choose
+it. Saved tokens can't be viewed again; enter a new one to replace it, or choose **Remove** to clear
-**Remove**.
+everything saved for Bitbucket.
 If no credentials are saved, T3 Code falls back to these variables in the server's environment.
 Restart the server after changing them:
 @@ -105,8 +105,10 @@ bun install -g @gitcafe/cli
 cafe auth login --host https://git.cafe/api
 ```
-Alternatively, set `CAFE_TOKEN` in the server's environment and restart it. The token is only
+Alternatively, open **Settings → Source Control**, expand **GitCafe**, and enter a token. It is
-sent to the host `CAFE_HOST` names, which is `git.cafe` unless you set it. Repositories on
+kept in the server's secret store, applies right away, and is used before `CAFE_TOKEN` and the
+`cafe` login. Or set `CAFE_TOKEN` in the server's environment and restart it. Both tokens are only
+sent to `git.cafe`; `CAFE_TOKEN` follows `CAFE_HOST` if you set it. Repositories on
 `staging.git.cafe` need their own login with `--host https://staging.git.cafe/api`.
 Line comments, reviewer requests, and labels are not available for GitCafe pull requests yet.

packages/client-runtime/src/sourceControlClients.ts+15-1

...	@@ -9,7 +9,11 @@	...	@@ -9,7 +9,11 @@
9	*/	9	*/
10	import * as AzureDevOps from "@t3tools/source-control-azure-devops/client/definition";	10	import * as AzureDevOps from "@t3tools/source-control-azure-devops/client/definition";
11	import * as Bitbucket from "@t3tools/source-control-bitbucket/client/definition";	11	import * as Bitbucket from "@t3tools/source-control-bitbucket/client/definition";
12	import { makeSourceControlClientRegistry } from "@t3tools/source-control-core/client/definition";	12	import {
		13	makeSourceControlClientRegistry,
		14	readSourceControlHostSettings,
		15	} from "@t3tools/source-control-core/client/definition";
		16	import type { ServerSettings } from "@t3tools/contracts";
13		17
14	export {	18	export {
15	UNKNOWN_SOURCE_CONTROL_CLIENT,	19	UNKNOWN_SOURCE_CONTROL_CLIENT,
...	@@ -40,3 +44,13 @@ const BUILT_IN_SOURCE_CONTROL_CLIENTS = [	...	@@ -40,3 +44,13 @@ const BUILT_IN_SOURCE_CONTROL_CLIENTS = [
40	export const sourceControlClients = makeSourceControlClientRegistry(	44	export const sourceControlClients = makeSourceControlClientRegistry(
41	BUILT_IN_SOURCE_CONTROL_CLIENTS,	45	BUILT_IN_SOURCE_CONTROL_CLIENTS,
42	);	46	);
		47
		48	export type { GitHubSettings } from "@t3tools/source-control-github/client/definition";
		49
		50	/**
		51	* An environment's GitHub host choices and tokens, decoded with GitHub's settings schema. GitHub's
		52	* settings panels are its own, since its logins come from `gh` at runtime.
		53	*/
		54	export function readGitHubSettings(settings: Pick<ServerSettings, "sourceControlHosts">) {
		55	return readSourceControlHostSettings(GitHub.settings, settings.sourceControlHosts.github);
		56	}

packages/contracts/src/settings.test.ts-7

...	@@ -949,13 +949,6 @@ describe("ServerSettingsPatch.providerInstances", () => {	...	@@ -949,13 +949,6 @@ describe("ServerSettingsPatch.providerInstances", () => {
949	});	949	});
950		950
951	describe("ServerSettingsPatch string normalization", () => {	951	describe("ServerSettingsPatch string normalization", () => {
952	it("lowercases GitHub hosts and defaults them to enabled", () => {
953	const patch = decodeServerSettingsPatch({
954	github: { hosts: { " GitHub.com ": { account: " work " } } },
955	});
956	expect(patch.github?.hosts).toEqual({ "github.com": { account: "work", enabled: true } });
957	});
958
959	it("trims string settings while decoding patches", () => {	952	it("trims string settings while decoding patches", () => {
960	const patch = decodeServerSettingsPatch({	953	const patch = decodeServerSettingsPatch({
961	addProjectBaseDirectory: " ~/Development ",	954	addProjectBaseDirectory: " ~/Development ",

packages/contracts/src/settings.ts+22-56

...	@@ -552,6 +552,11 @@ export interface ProviderSettingsFormAnnotation {	...	@@ -552,6 +552,11 @@ export interface ProviderSettingsFormAnnotation {
552	readonly placeholder?: string \| undefined;	552	readonly placeholder?: string \| undefined;
553	readonly hidden?: boolean \| undefined;	553	readonly hidden?: boolean \| undefined;
554	readonly clearWhenEmpty?: "omit" \| "persist" \| undefined;	554	readonly clearWhenEmpty?: "omit" \| "persist" \| undefined;
		555	/**
		556	* The value is a credential: the server keeps it in its secret store and clients only learn
		557	* whether one is saved. Source control host settings honor it; provider settings do not yet.
		558	*/
		559	readonly secret?: boolean \| undefined;
555	/** Choices for a `select` control. The first entry is the default. */	560	/** Choices for a `select` control. The first entry is the default. */
556	readonly options?: ReadonlyArray<ProviderSettingsFormOption> \| undefined;	561	readonly options?: ReadonlyArray<ProviderSettingsFormOption> \| undefined;
557	}	562	}
...	@@ -805,49 +810,20 @@ export const UsageLimitSourceConfig = Schema.Struct({	...	@@ -805,49 +810,20 @@ export const UsageLimitSourceConfig = Schema.Struct({
805	});	810	});
806	export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;	811	export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;
807		812
808	/**
809	* Bitbucket API credentials for this environment, used before the
810	* `T3CODE_BITBUCKET_*` environment variables. The tokens live in the server's
811	* secret store; settings and clients only see a redaction marker when one is
812	* set. The access token wins when both kinds are configured.
813	*/
814	export const BitbucketSettings = Schema.Struct({
815	email: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed(""))),
816	accessToken: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed(""))),
817	apiToken: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed(""))),
818	});
819	export type BitbucketSettings = typeof BitbucketSettings.Type;
820
821	/**
822	* Per-host choices for the GitHub CLI's logins. `account` pins one of the logins
823	* `gh` holds for the host instead of its active one; a disabled host gets no
824	* credential at all. A token saved here wins over `GH_TOKEN` and friends, which win over `gh`.
825	*/
826	/** A GitHub host name, lowercased on decode so `GitHub.com` and `github.com` are one entry. */	813	/** A GitHub host name, lowercased on decode so `GitHub.com` and `github.com` are one entry. */
827	export const GitHubHost = TrimmedNonEmptyString.pipe(	814	export const GitHubHost = TrimmedNonEmptyString.pipe(
828	Schema.decodeTo(Schema.String, SchemaTransformation.toLowerCase()),	815	Schema.decodeTo(Schema.String, SchemaTransformation.toLowerCase()),
829	);	816	);
830		817
831	export const GitHubHostSettings = Schema.Struct({	818	/**
832	account: Schema.optionalKey(TrimmedNonEmptyString),	819	* One source control host's saved settings. Each host package declares the fields it reads in
833	enabled: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(true))),	820	* its client definition's settings schema and decodes this blob with it; the environment stores
834	});	821	* it whole, so a host this build does not ship keeps its settings. A field annotated as a secret
835	export type GitHubHostSettings = typeof GitHubHostSettings.Type;	822	* holds a string, or a string per server host, whose value lives in the server's secret store:
836		823	* settings and clients only see a redaction marker for a saved one.
837	export const GitHubSettings = Schema.Struct({	824	*/
838	/** Keyed by lowercased host, for example `github.com`. */	825	export const SourceControlHostSettings = Schema.Record(Schema.String, Schema.Unknown);
839	hosts: Schema.Record(GitHubHost, GitHubHostSettings).pipe(	826	export type SourceControlHostSettings = typeof SourceControlHostSettings.Type;
840	Schema.withDecodingDefault(Effect.succeed({})),
841	),
842	/**
843	* A token per host, used before `GH_TOKEN` and `gh`. The server keeps each one in its secret
844	* store; settings and clients only ever see a redaction marker for a saved token.
845	*/
846	tokens: Schema.Record(GitHubHost, TrimmedString).pipe(
847	Schema.withDecodingDefault(Effect.succeed({})),
848	),
849	});
850	export type GitHubSettings = typeof GitHubSettings.Type;
851		827
852	export const ObservabilitySettings = Schema.Struct({	828	export const ObservabilitySettings = Schema.Struct({
853	otlpTracesUrl: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed(""))),	829	otlpTracesUrl: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed(""))),
...	@@ -1278,8 +1254,10 @@ export const ServerSettings = Schema.Struct({	...	@@ -1278,8 +1254,10 @@ export const ServerSettings = Schema.Struct({
1278	Schema.withDecodingDefault(Effect.succeed({})),	1254	Schema.withDecodingDefault(Effect.succeed({})),
1279	),	1255	),
1280	observability: ObservabilitySettings.pipe(Schema.withDecodingDefault(Effect.succeed({}))),	1256	observability: ObservabilitySettings.pipe(Schema.withDecodingDefault(Effect.succeed({}))),
1281	bitbucket: BitbucketSettings.pipe(Schema.withDecodingDefault(Effect.succeed({}))),	1257	/** Keyed by source control host kind, such as `gitcafe`; see `SourceControlHostSettings`. */
1282	github: GitHubSettings.pipe(Schema.withDecodingDefault(Effect.succeed({}))),	1258	sourceControlHosts: Schema.Record(Schema.String, SourceControlHostSettings).pipe(
		1259	Schema.withDecodingDefault(Effect.succeed({})),
		1260	),
1283	// Keyed by a user-chosen id so a source keeps its rows across edits. Entries	1261	// Keyed by a user-chosen id so a source keeps its rows across edits. Entries
1284	// this build cannot decode round-trip untouched, as provider instances do.	1262	// this build cannot decode round-trip untouched, as provider instances do.
1285	usageLimitSources: Schema.Record(UsageLimitSourceId, UsageLimitSourceConfig).pipe(	1263	usageLimitSources: Schema.Record(UsageLimitSourceId, UsageLimitSourceConfig).pipe(
...	@@ -1523,24 +1501,12 @@ export const ServerSettingsPatch = Schema.Struct({	...	@@ -1523,24 +1501,12 @@ export const ServerSettingsPatch = Schema.Struct({
1523	otlpLogsUrl: Schema.optionalKey(TrimmedString),	1501	otlpLogsUrl: Schema.optionalKey(TrimmedString),
1524	}),	1502	}),
1525	),	1503	),
1526	/** An empty token clears it; an omitted one keeps what the server has. */
1527	bitbucket: Schema.optionalKey(
1528	Schema.Struct({
1529	email: Schema.optionalKey(TrimmedString),
1530	accessToken: Schema.optionalKey(TrimmedString),
1531	apiToken: Schema.optionalKey(TrimmedString),
1532	}),
1533	),
1534	/**	1504	/**
1535	* `hosts` replaces the whole map, so an omitted host or account clears it. `tokens` merges per	1505	* Merges per host: a patched field replaces the saved one, so a client sends a per-server-host
1536	* host: an empty token removes that host's token, the redaction marker keeps it.	1506	* map whole, with the redaction marker for each saved secret it keeps. An empty or omitted
		1507	* secret is removed from the secret store.
1537	*/	1508	*/
1538	github: Schema.optionalKey(	1509	sourceControlHosts: Schema.optionalKey(Schema.Record(Schema.String, SourceControlHostSettings)),
1539	Schema.Struct({
1540	hosts: Schema.optionalKey(Schema.Record(GitHubHost, GitHubHostSettings)),
1541	tokens: Schema.optionalKey(Schema.Record(GitHubHost, TrimmedString)),
1542	}),
1543	),
1544	// Whole-map replacement for the new instance config. Patching individual	1510	// Whole-map replacement for the new instance config. Patching individual
1545	// entries is intentionally out of scope: the map is small, and partial	1511	// entries is intentionally out of scope: the map is small, and partial
1546	// patches risk leaving driver-specific config in a half-merged state.	1512	// patches risk leaving driver-specific config in a half-merged state.

packages/shared/src/serverSettings.test.ts+11-8

 @@ -42,16 +42,19 @@ describe("serverSettings helpers", () => {
       logsAfterDays: 30,
     });
   });
-  it("replaces GitHub host choices so a cleared account pin does not survive", () => {
+  it("replaces a source control host's patched field so a cleared account pin does not survive", () => {
     const pinned = applyServerSettingsPatch(DEFAULT_SERVER_SETTINGS, {
-      github: { hosts: { "github.com": { account: "work", enabled: true } } },
+      sourceControlHosts: {
+        github: { hosts: { "github.com": { account: "work", enabled: true } }, tokens: {} },
+      },
+    });
+    const unpinned = applyServerSettingsPatch(pinned, {
+      sourceControlHosts: { github: { hosts: { "github.com": { enabled: false } } } },
+    });
+    expect(unpinned.sourceControlHosts.github).toEqual({
+      hosts: { "github.com": { enabled: false } },
+      tokens: {},
     });
-    expect(pinned.github.hosts).toEqual({ "github.com": { account: "work", enabled: true } });
-    expect(
-      applyServerSettingsPatch(pinned, {
-        github: { hosts: { "github.com": { enabled: false } } },
-      }).github.hosts,
-    ).toEqual({ "github.com": { enabled: false } });
   });
   it("replaces SSH host lists when saving, editing, and removing hosts", () => {
     const host = { id: "mini", label: "Mac mini", target: "mini" };

packages/shared/src/serverSettings.ts+14-3

 @@ -267,6 +267,7 @@ export function applyServerSettingsPatch(
     worktreeCleanup: worktreeCleanupPatch,
     // Merged per entry below; its `null` removals must not reach deepMerge.
     usageLimitSources: usageLimitSourcesPatch,
+    sourceControlHosts: sourceControlHostsPatch,
     usagePriceOverrides: usagePriceOverridesPatch,
     usageModelAliases: usageModelAliasesPatch,
     // Entry replacement: deepMerge would keep keys the client meant to clear.
 @@ -367,9 +368,19 @@ export function applyServerSettingsPatch(
           ],
         }
       : {}),
-    // Host replacement: deepMerge would keep a cleared account pin.
+    // Per host, a patched field replaces the saved one: deepMerge would keep a cleared account pin.
-    ...(patch.github?.hosts !== undefined
+    ...(sourceControlHostsPatch !== undefined
-      ? { github: { ...next.github, hosts: patch.github.hosts } }
+      ? {
+          sourceControlHosts: {
+            ...current.sourceControlHosts,
+            ...Object.fromEntries(
+              Object.entries(sourceControlHostsPatch).map(([kind, fields]) => [
+                kind,
+                { ...current.sourceControlHosts[kind], ...fields },
+              ]),
+            ),
+          },
+        }
       : {}),
     ...(projectSettingsOverridesPatch !== undefined
       ? {

packages/source-control-bitbucket/src/client/definition.ts+43-1

...	@@ -3,7 +3,13 @@	...	@@ -3,7 +3,13 @@
3	*	3	*
4	* @module source-control-bitbucket/client/definition	4	* @module source-control-bitbucket/client/definition
5	*/	5	*/
6	import { SourceControlProviderKind } from "@t3tools/contracts";	6	import {
		7	makeProviderSettingsSchema,
		8	SourceControlProviderKind,
		9	TrimmedString,
		10	} from "@t3tools/contracts";
		11	import * as Effect from "effect/Effect";
		12	import * as Schema from "effect/Schema";
7	import {	13	import {
8	defineSourceControlClient,	14	defineSourceControlClient,
9	isChangeRequestInProjectRepository,	15	isChangeRequestInProjectRepository,
...	@@ -16,6 +22,41 @@ const repositoryName = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;	...	@@ -16,6 +22,41 @@ const repositoryName = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
16		22
17	const KIND = SourceControlProviderKind.make("bitbucket");	23	const KIND = SourceControlProviderKind.make("bitbucket");
18		24
		25	const text = (annotations: Schema.Annotations.Key<string>) =>
		26	TrimmedString.pipe(
		27	Schema.withDecodingDefault(Effect.succeed("")),
		28	Schema.annotateKey(annotations),
		29	);
		30
		31	/**
		32	* Bitbucket API credentials, used before the `T3CODE_BITBUCKET_*` environment variables: an
		33	* access token, or an Atlassian account email with an API token. The access token wins when both
		34	* are saved.
		35	*/
		36	export const settings = makeProviderSettingsSchema(
		37	{
		38	accessToken: text({
		39	title: "Access token",
		40	description:
		41	"Scoped to one repository, project, or workspace. Create it in that item's Bitbucket settings.",
		42	providerSettingsForm: { control: "password", secret: true },
		43	}),
		44	email: text({
		45	title: "Atlassian account email",
		46	description: "With an API token instead of an access token.",
		47	providerSettingsForm: { placeholder: "you@example.com" },
		48	}),
		49	apiToken: text({
		50	title: "API token",
		51	description:
		52	"Reaches every repository your Atlassian account can. Give it read and write access to repositories and pull requests, and read:user:bitbucket.",
		53	providerSettingsForm: { control: "password", secret: true },
		54	}),
		55	},
		56	{ order: ["accessToken", "email", "apiToken"] },
		57	);
		58	export type BitbucketSettings = typeof settings.Type;
		59
19	export const definition = defineSourceControlClient({	60	export const definition = defineSourceControlClient({
20	kind: KIND,	61	kind: KIND,
21	label: "Bitbucket",	62	label: "Bitbucket",
...	@@ -54,4 +95,5 @@ export const definition = defineSourceControlClient({	...	@@ -54,4 +95,5 @@ export const definition = defineSourceControlClient({
54	canReadChangeRequestOnHost: (identity, link) =>	95	canReadChangeRequestOnHost: (identity, link) =>
55	isChangeRequestOnProjectHost(KIND, identity, link),	96	isChangeRequestOnProjectHost(KIND, identity, link),
56	isChangeRequestUrl: (url) => isChangeRequestPath(url, "/pull-requests/"),	97	isChangeRequestUrl: (url) => isChangeRequestPath(url, "/pull-requests/"),
		98	settings,
57	});	99	});

packages/source-control-bitbucket/src/server/BitbucketApi.ts+18-5

 @@ -7,10 +7,8 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import {
-  DEFAULT_SERVER_SETTINGS,
   NonNegativeInt,
   TrimmedNonEmptyString,
-  type BitbucketSettings,
   type SourceControlProviderAuth,
   type SourceControlRepositoryCloneUrls,
   type SourceControlRepositoryVisibility,
 @@ -31,6 +29,9 @@ import {
 import { collectUint8StreamText } from "@t3tools/provider-core/server/collectStreamText";
 import * as SourceControlProvider from "@t3tools/source-control-core/server/SourceControlProvider";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
+import { readSourceControlHostSettings } from "@t3tools/source-control-core/client/definition";
+import * as BitbucketClient from "../client/definition.ts";
 import { retryAtFromHeader } from "@t3tools/source-control-core/server/SourceControlRateLimit";
 const DEFAULT_API_BASE_URL = "https://api.bitbucket.org/2.0";
 @@ -569,7 +570,7 @@ function credentialFrom(input: {
  * stay as a fallback. Within each source the access token wins.
  */
 function resolveCredential(
-  settings: BitbucketSettings,
+  settings: BitbucketClient.BitbucketSettings,
   env: Config.Success<typeof BitbucketApiEnvConfig>,
 ): BitbucketCredential | null {
   return (
 @@ -664,12 +665,24 @@ export const make = Effect.gen(function* () {
   // Read on every request so credentials saved in settings apply without a restart.
   const currentCredential = host.settings.get.pipe(
-    Effect.map((settings) => resolveCredential(settings.bitbucket, config)),
+    Effect.map((settings) =>
+      resolveCredential(
+        readSourceControlHostSettings(
+          BitbucketClient.settings,
+          settings.sourceControlHosts[BitbucketClient.definition.kind],
+        ),
+        config,
+      ),
+    ),
     Effect.catch((error) =>
       // No cause: a settings decode error can quote a hand-edited token.
       Effect.logWarning("failed to read Bitbucket credentials from settings", {
         operation: error.operation,
-      }).pipe(Effect.as(resolveCredential(DEFAULT_SERVER_SETTINGS.bitbucket, config))),
+      }).pipe(
+        Effect.as(
+          resolveCredential(readSourceControlHostSettings(BitbucketClient.settings, {}), config),
+        ),
+      ),
     ),
   );

packages/source-control-core/src/client/definition.ts+43

...	@@ -19,6 +19,7 @@ import {	...	@@ -19,6 +19,7 @@ import {
19	SourceControlProviderKind,	19	SourceControlProviderKind,
20	} from "@t3tools/contracts";	20	} from "@t3tools/contracts";
21	import type { ChangeRequestLink } from "@t3tools/shared/changeRequestUrl";	21	import type { ChangeRequestLink } from "@t3tools/shared/changeRequestUrl";
		22	import * as Schema from "effect/Schema";
22		23
23	/** What a host calls a change request, e.g. `MR` and `merge request` on GitLab. */	24	/** What a host calls a change request, e.g. `MR` and `merge request` on GitLab. */
24	export interface ChangeRequestTerminology {	25	export interface ChangeRequestTerminology {
...	@@ -140,8 +141,20 @@ export interface SourceControlClientDefinition {	...	@@ -140,8 +141,20 @@ export interface SourceControlClientDefinition {
140	readonly checkoutChangeRequestHost: (identity: ChangeRequestProjectIdentity) => string \| null;	141	readonly checkoutChangeRequestHost: (identity: ChangeRequestProjectIdentity) => string \| null;
141	/** Whether a change request URL has this host's path shape, e.g. GitLab's `/-/merge_requests/`. */	142	/** Whether a change request URL has this host's path shape, e.g. GitLab's `/-/merge_requests/`. */
142	readonly isChangeRequestUrl: (url: string) => boolean;	143	readonly isChangeRequestUrl: (url: string) => boolean;
		144	/**
		145	* What the environment saves for this host under `settings.sourceControlHosts[kind]`, rendered
		146	* as a form in Source Control settings and read by the host's server package. Fields carry
		147	* `providerSettingsForm` annotations, as agent provider settings do; one marked `secret` is
		148	* kept in the server's secret store. Omitted for a host with nothing to configure.
		149	*/
		150	readonly settings?: SourceControlHostSettingsSchema;
143	}	151	}
144		152
		153	/** A host's settings struct. Its fields are strings, or a secret string per server host. */
		154	export type SourceControlHostSettingsSchema = {
		155	readonly fields: Readonly<Record<string, Schema.Top>>;
		156	} & Schema.Decoder<object>;
		157
145	/**	158	/**
146	* Whether a URL's path is a change request at `route`, such as `/pull/`, followed by its number.	159	* Whether a URL's path is a change request at `route`, such as `/pull/`, followed by its number.
147	* Matching the parsed path keeps a query or fragment that mentions another host's route out.	160	* Matching the parsed path keeps a query or fragment that mentions another host's route out.
...	@@ -293,3 +306,33 @@ export function makeSourceControlClientRegistry(	...	@@ -293,3 +306,33 @@ export function makeSourceControlClientRegistry(
293	definitions.find((definition) => definition.isChangeRequestUrl(url))?.label ?? "the host",	306	definitions.find((definition) => definition.isChangeRequestUrl(url))?.label ?? "the host",
294	};	307	};
295	}	308	}
		309
		310	/**
		311	* A host's saved settings decoded with its schema. A blob that no longer decodes, such as one a
		312	* newer build wrote, reads as the schema's defaults rather than failing the host.
		313	*/
		314	export function readSourceControlHostSettings<S extends SourceControlHostSettingsSchema>(
		315	schema: S,
		316	saved: unknown,
		317	): S["Type"] {
		318	const decode = Schema.decodeUnknownOption(schema as Schema.Decoder<S["Type"]>);
		319	const decoded = decode(saved ?? {});
		320	if (decoded._tag === "Some") return decoded.value;
		321	const fallback = decode({});
		322	if (fallback._tag === "Some") return fallback.value;
		323	throw new Error("A source control host settings schema must decode an empty object.");
		324	}
		325
		326	/**
		327	* The settings fields a host keeps in the server's secret store: those annotated
		328	* `providerSettingsForm.secret`. A secret field holds a string, or a string per server host.
		329	*/
		330	export function secretSourceControlHostSettingsFields(
		331	schema: SourceControlHostSettingsSchema,
		332	): ReadonlyArray<string> {
		333	return Object.entries(schema.fields).flatMap(([field, fieldSchema]) => {
		334	const annotations =
		335	Schema.resolveAnnotationsKey(fieldSchema) ?? Schema.resolveAnnotations(fieldSchema);
		336	return annotations?.providerSettingsForm?.secret ? [field] : [];
		337	});
		338	}

packages/source-control-gitcafe/src/client/definition.ts+22-1

...	@@ -3,7 +3,13 @@	...	@@ -3,7 +3,13 @@
3	*	3	*
4	* @module source-control-gitcafe/client/definition	4	* @module source-control-gitcafe/client/definition
5	*/	5	*/
6	import { SourceControlProviderKind } from "@t3tools/contracts";	6	import {
		7	makeProviderSettingsSchema,
		8	SourceControlProviderKind,
		9	TrimmedString,
		10	} from "@t3tools/contracts";
		11	import * as Effect from "effect/Effect";
		12	import * as Schema from "effect/Schema";
7	import {	13	import {
8	defineSourceControlClient,	14	defineSourceControlClient,
9	isChangeRequestInProjectRepository,	15	isChangeRequestInProjectRepository,
...	@@ -16,6 +22,20 @@ const GITCAFE_HOSTS = new Set(["git.cafe", "staging.git.cafe"]);	...	@@ -16,6 +22,20 @@ const GITCAFE_HOSTS = new Set(["git.cafe", "staging.git.cafe"]);
16		22
17	const KIND = SourceControlProviderKind.make("gitcafe");	23	const KIND = SourceControlProviderKind.make("gitcafe");
18		24
		25	/** A git.cafe token, used before `CAFE_TOKEN` and the `cafe` login. */
		26	export const settings = makeProviderSettingsSchema({
		27	token: TrimmedString.pipe(
		28	Schema.withDecodingDefault(Effect.succeed("")),
		29	Schema.annotateKey({
		30	title: "Token",
		31	description:
		32	"A git.cafe token, used before CAFE_TOKEN and the cafe login, so GitCafe works without the CLI signed in.",
		33	providerSettingsForm: { control: "password", secret: true },
		34	}),
		35	),
		36	});
		37	export type GitCafeSettings = typeof settings.Type;
		38
19	export const definition = defineSourceControlClient({	39	export const definition = defineSourceControlClient({
20	kind: KIND,	40	kind: KIND,
21	label: "GitCafe",	41	label: "GitCafe",
...	@@ -64,4 +84,5 @@ export const definition = defineSourceControlClient({	...	@@ -64,4 +84,5 @@ export const definition = defineSourceControlClient({
64	return false;	84	return false;
65	}	85	}
66	},	86	},
		87	settings,
67	});	88	});

packages/source-control-gitcafe/src/server/GitCafeCredentials.test.ts+38

...	@@ -78,6 +78,44 @@ describe("GitCafeCredentials", () => {	...	@@ -78,6 +78,44 @@ describe("GitCafeCredentials", () => {
78	}).pipe(Effect.provide(layer));	78	}).pipe(Effect.provide(layer));
79	});	79	});
80		80
		81	it.effect("uses a token saved in Settings for git.cafe only, ahead of CAFE_TOKEN", () => {
		82	const calls: Array<SourceControlHost.SourceControlProcessInput> = [];
		83	const layer = GitCafeCredentials.layer.pipe(
		84	Layer.provideMerge(
		85	TestSourceControlHost.layer({
		86	process: {
		87	run: (input) => {
		88	calls.push(input);
		89	return Effect.succeed(processOutput("password=gct_staging\n"));
		90	},
		91	},
		92	}),
		93	),
		94	Layer.provide(Layer.succeed(HostProcess.Environment, { CAFE_TOKEN: "env-token" })),
		95	Layer.provide(Layer.succeed(HostProcess.WorkingDirectory, "/server")),
		96	);
		97	return Effect.gen(function* () {
		98	const credentials = yield* GitCafeCredentials.GitCafeCredentials;
		99	const settings = yield* TestSourceControlHost.TestSourceControlHostSettings;
		100	yield* settings.update({ sourceControlHosts: { gitcafe: { token: "saved-token" } } });
		101
		102	const saved = yield* credentials.get("git.cafe");
		103	assert.strictEqual(Redacted.value(saved.token), "saved-token");
		104	assert.strictEqual(saved.source, "settings");
		105	assert.deepStrictEqual(yield* credentials.cliEnv("git.cafe"), { CAFE_TOKEN: "saved-token" });
		106	// Staging never receives the production token saved in Settings.
		107	assert.deepStrictEqual(yield* credentials.cliEnv("staging.git.cafe"), {});
		108	assert.strictEqual(
		109	Redacted.value((yield* credentials.get("staging.git.cafe")).token),
		110	"gct_staging",
		111	);
		112
		113	// Removing it applies at once: the environment token takes over again.
		114	yield* settings.update({ sourceControlHosts: { gitcafe: { token: "" } } });
		115	assert.strictEqual((yield* credentials.get("git.cafe")).source, "env");
		116	}).pipe(Effect.provide(layer));
		117	});
		118
81	it.effect("asks cafe's Git credential helper over stdin and reuses the token", () => {	119	it.effect("asks cafe's Git credential helper over stdin and reuses the token", () => {
82	const { layer, calls } = harness(() =>	120	const { layer, calls } = harness(() =>
83	Effect.succeed(	121	Effect.succeed(

packages/source-control-gitcafe/src/server/GitCafeCredentials.ts+50-10

 @@ -10,6 +10,9 @@ import * as Redacted from "effect/Redacted";
 import * as Schema from "effect/Schema";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
+import { readSourceControlHostSettings } from "@t3tools/source-control-core/client/definition";
+import * as GitCafeClient from "../client/definition.ts";
 /** How long a token is reused before `cafe` is asked again, so a re-login applies soon. */
 const TOKEN_TTL = Duration.minutes(5);
 @@ -19,7 +22,7 @@ const MISSING_TTL = Duration.seconds(10);
 export interface GitCafeCredential {
   readonly host: string;
   readonly token: Redacted.Redacted<string>;
-  readonly source: "env" | "cafe";
+  readonly source: "settings" | "env" | "cafe";
 }
 /** No `CAFE_TOKEN` for the host, and no `cafe` on PATH to ask. */
 @@ -66,10 +69,17 @@ export class GitCafeCredentials extends Context.Service<
     ) => Effect.Effect<GitCafeCredential, GitCafeCredentialUnavailableError>;
     /** Drops the held token after GitCafe refused it, so the next read asks its source again. */
     readonly invalidate: (host: string) => Effect.Effect<void>;
+    /**
+     * Environment for a `cafe` run against the host: the token saved in Settings as `CAFE_TOKEN`,
+     * which `cafe` uses before its own login, or nothing when none is saved.
+     */
+    readonly cliEnv: (host: string) => Effect.Effect<Readonly<Record<string, string>>>;
   }
 >()("@t3tools/source-control-gitcafe/server/GitCafeCredentials") {}
 const normalizeHost = (host: string) => host.trim().toLowerCase();
+/** The host `cafe` and a token saved in Settings target unless told otherwise. */
+const DEFAULT_HOST = "git.cafe";
 /**
  * `CAFE_TOKEN`, but only for the host `cafe` itself would send it to (`CAFE_HOST`, git.cafe by
 @@ -82,7 +92,7 @@ export function environmentToken(
   const configured = env.CAFE_HOST?.trim();
   const configuredHost = configured
     ? URL.parse(configured.includes("://") ? configured : `https://${configured}`)?.host
-    : "git.cafe";
+    : DEFAULT_HOST;
   if (configuredHost?.toLowerCase() !== normalizeHost(host)) return null;
   return env.CAFE_TOKEN?.trim() || null;
 }
 @@ -97,7 +107,8 @@ function credentialPassword(output: string): string | null {
 /** @public Service construction is part of the canonical Effect module API. */
 export const make = Effect.gen(function* () {
-  const { process } = yield* SourceControlHost.SourceControlHost;
+  const sourceControlHost = yield* SourceControlHost.SourceControlHost;
+  const { process } = sourceControlHost;
   const environment = yield* HostProcess.Environment;
   const workingDirectory = yield* HostProcess.WorkingDirectory;
 @@ -134,14 +145,27 @@ export const make = Effect.gen(function* () {
         ),
       );
-  const lookup = Effect.fn("GitCafeCredentials.lookup")(function* (host: string) {
+  /** A token saved in Settings, for production git.cafe only; read fresh on every lookup. */
+  const fromSettings = (host: string) =>
+    normalizeHost(host) !== DEFAULT_HOST
+      ? Effect.succeed(null)
+      : sourceControlHost.settings.get.pipe(
+          Effect.map(
+            (settings) =>
+              readSourceControlHostSettings(
+                GitCafeClient.settings,
+                settings.sourceControlHosts[GitCafeClient.definition.kind],
+              ).token || null,
+          ),
+          Effect.orElseSucceed(() => null),
+        );
+  const lookup = Effect.fn("GitCafeCredentials.lookup")(function* (
+    host: string,
+  ): Effect.fn.Return<GitCafeCredential, GitCafeCredentialUnavailableError> {
     const fromEnv = environmentToken(host, environment);
     const token = fromEnv ?? (yield* fromCafe(host));
-    return {
+    return { host, token: Redacted.make(token), source: fromEnv !== null ? "env" : "cafe" };
-      host,
-      token: Redacted.make(token),
-      source: fromEnv !== null ? "env" : "cafe",
-    } satisfies GitCafeCredential;
   });
   const cache = yield* Cache.makeWith(lookup, {
 @@ -158,8 +182,24 @@ export const make = Effect.gen(function* () {
   });
   return GitCafeCredentials.of({
-    get: (host) => Cache.get(cache, normalizeHost(host)),
+    // A saved token is read fresh, so saving or removing one applies at once; the cache only
+    // spares asking `cafe` again.
+    get: (host) =>
+      fromSettings(host).pipe(
+        Effect.flatMap(
+          (saved): Effect.Effect<GitCafeCredential, GitCafeCredentialUnavailableError> =>
+            saved === null
+              ? Cache.get(cache, normalizeHost(host))
+              : Effect.succeed({
+                  host: normalizeHost(host),
+                  token: Redacted.make(saved),
+                  source: "settings",
+                }),
+        ),
+      ),
     invalidate: (host) => Cache.invalidate(cache, normalizeHost(host)),
+    cliEnv: (host) =>
+      fromSettings(host).pipe(Effect.map((saved) => (saved === null ? {} : { CAFE_TOKEN: saved }))),
   });
 });

packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.test.ts+5-13

...	@@ -42,16 +42,8 @@ const failure = (code: string, status: number \| null) => ({	...	@@ -42,16 +42,8 @@ const failure = (code: string, status: number \| null) => ({
42	});	42	});
43		43
44	describe("GitCafeSourceControlProvider", () => {	44	describe("GitCafeSourceControlProvider", () => {
45	it("probes the cafe CLI against production", () => {
46	const { discovery } = GitCafeSourceControlProvider;
47	assert.strictEqual(discovery.kind, "gitcafe");
48	assert.strictEqual(discovery.executable, "cafe");
49	assert.deepStrictEqual(discovery.authArgs.slice(0, 2), ["--host", "https://git.cafe/api"]);
50	assert.deepStrictEqual(discovery.authArgs.slice(-3), ["auth", "status", "--json"]);
51	});
52
53	it("reads a signed-in account and keeps transient failures apart from sign-out", () => {	45	it("reads a signed-in account and keeps transient failures apart from sign-out", () => {
54	const { parseAuth } = GitCafeSourceControlProvider.discovery;	46	const { parseAuth } = GitCafeSourceControlProvider;
55	const signedIn = parseAuth(	47	const signedIn = parseAuth(
56	authAnswer({ stdout: { schemaVersion: 1, data: { host: "git.cafe", username: "alice" } } }),	48	authAnswer({ stdout: { schemaVersion: 1, data: { host: "git.cafe", username: "alice" } } }),
57	);	49	);
...	@@ -115,7 +107,7 @@ describe("GitCafeSourceControlProvider", () => {	...	@@ -115,7 +107,7 @@ describe("GitCafeSourceControlProvider", () => {
115	}).pipe(	107	}).pipe(
116	Effect.provide(	108	Effect.provide(
117	GitCafeApi.layer.pipe(	109	GitCafeApi.layer.pipe(
118	Layer.provide(GitCafeCredentials.layer),	110	Layer.provideMerge(GitCafeCredentials.layer),
119	Layer.provideMerge(TestSourceControlHost.layer()),	111	Layer.provideMerge(TestSourceControlHost.layer()),
120	Layer.provide(	112	Layer.provide(
121	Layer.succeed(HostProcess.Environment, { CAFE_TOKEN: "env-token", CAFE_HOST: host }),	113	Layer.succeed(HostProcess.Environment, { CAFE_TOKEN: "env-token", CAFE_HOST: host }),
...	@@ -162,7 +154,7 @@ describe("GitCafeSourceControlProvider", () => {	...	@@ -162,7 +154,7 @@ describe("GitCafeSourceControlProvider", () => {
162	}).pipe(	154	}).pipe(
163	Effect.provide(	155	Effect.provide(
164	GitCafeApi.layer.pipe(	156	GitCafeApi.layer.pipe(
165	Layer.provide(GitCafeCredentials.layer),	157	Layer.provideMerge(GitCafeCredentials.layer),
166	Layer.provideMerge(	158	Layer.provideMerge(
167	TestSourceControlHost.layer({	159	TestSourceControlHost.layer({
168	git: {	160	git: {
...	@@ -244,7 +236,7 @@ describe("GitCafeSourceControlProvider", () => {	...	@@ -244,7 +236,7 @@ describe("GitCafeSourceControlProvider", () => {
244	}).pipe(	236	}).pipe(
245	Effect.provide(	237	Effect.provide(
246	GitCafeApi.layer.pipe(	238	GitCafeApi.layer.pipe(
247	Layer.provide(GitCafeCredentials.layer),	239	Layer.provideMerge(GitCafeCredentials.layer),
248	Layer.provideMerge(	240	Layer.provideMerge(
249	TestSourceControlHost.layer({	241	TestSourceControlHost.layer({
250	git: {	242	git: {
...	@@ -304,7 +296,7 @@ describe("GitCafeSourceControlProvider", () => {	...	@@ -304,7 +296,7 @@ describe("GitCafeSourceControlProvider", () => {
304	}).pipe(	296	}).pipe(
305	Effect.provide(	297	Effect.provide(
306	GitCafeApi.layer.pipe(	298	GitCafeApi.layer.pipe(
307	Layer.provide(GitCafeCredentials.layer),	299	Layer.provideMerge(GitCafeCredentials.layer),
308	Layer.provideMerge(	300	Layer.provideMerge(
309	TestSourceControlHost.layer({	301	TestSourceControlHost.layer({
310	process: {	302	process: {

packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts+46-11

 @@ -11,13 +11,16 @@ import {
   type ChangeRequest,
 } from "@t3tools/contracts";
 import {
+  probeSourceControlProvider,
   providerAuth,
   type SourceControlCliDiscoverySpec,
+  type SourceControlManagedCliDiscoverySpec,
 } from "@t3tools/source-control-core/server/discovery";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
 import * as SourceControlProvider from "@t3tools/source-control-core/server/SourceControlProvider";
 import * as GitCafeApi from "./GitCafeApi.ts";
+import * as GitCafeCredentials from "./GitCafeCredentials.ts";
 import * as GitCafeHosts from "./gitCafeHosts.ts";
 /** Discovery reports the production account; repository operations pick their own host. */
 @@ -58,7 +61,7 @@ const cliFailure = (output: string) =>
     .map((line) => decodeFailure(line.trim()))
     .find(Result.isSuccess)?.success.error;
-export const discovery = {
+const cliDiscovery = {
   type: "cli",
   kind: SourceControlProviderKind.make("gitcafe"),
   label: "GitCafe",
 @@ -90,9 +93,35 @@ export const discovery = {
       detail: `GitCafe authentication status could not be read. Run \`cafe auth login --host https://${AUTH_HOST}/api\`.`,
     });
   },
-  installHint: `Install the GitCafe CLI with \`bun install -g @gitcafe/cli\`, then run \`cafe auth login --host https://${AUTH_HOST}/api\`, or set CAFE_TOKEN on the server.`,
+  installHint: `Install the GitCafe CLI with \`bun install -g @gitcafe/cli\`, then run \`cafe auth login --host https://${AUTH_HOST}/api\`, save a token in Settings, or set CAFE_TOKEN on the server.`,
 } satisfies SourceControlCliDiscoverySpec;
+/** `cafe auth status`'s reading, exposed for tests. */
+export const parseAuth = cliDiscovery.parseAuth;
+/** Probes `cafe` as the CLI spec does, with a token saved in Settings handed to it. */
+export const makeDiscovery = Effect.gen(function* () {
+  const { process } = yield* SourceControlHost.SourceControlHost;
+  const credentials = yield* GitCafeCredentials.GitCafeCredentials;
+  return {
+    type: "managed-cli",
+    kind: cliDiscovery.kind,
+    label: cliDiscovery.label,
+    installHint: cliDiscovery.installHint,
+    probe: (cwd: string) =>
+      credentials.cliEnv(AUTH_HOST).pipe(
+        Effect.flatMap((env) =>
+          probeSourceControlProvider({
+            cwd,
+            spec: cliDiscovery,
+            process: { run: (input) => process.run({ ...input, env: { ...input.env, ...env } }) },
+          }),
+        ),
+      ),
+    refineUnknownRemote: () => Effect.succeed(null),
+  } satisfies SourceControlManagedCliDiscoverySpec;
+});
 const Repository = Schema.Struct({
   name: TrimmedNonEmptyString,
   defaultBranch: Schema.NullOr(TrimmedNonEmptyString),
 @@ -148,6 +177,7 @@ const pullUrlPattern = /^https:\/\/([^/]+)\/([^/]+\/[^/]+)\/pulls\/(\d+)\/?(?:[?
 export const make = Effect.gen(function* () {
   const api = yield* GitCafeApi.GitCafeApi;
   const host = yield* SourceControlHost.SourceControlHost;
+  const credentials = yield* GitCafeCredentials.GitCafeCredentials;
   const error = (operation: string, cwd: string, detail: string, cause?: unknown) =>
     new SourceControlProviderError({
 @@ -174,15 +204,20 @@ export const make = Effect.gen(function* () {
       ),
     );
   const cafe = (operation: string, cwd: string, target: Target, args: ReadonlyArray<string>) =>
-    host.process
+    credentials
-      .run({
+      .cliEnv(target.host)
-        operation: `GitCafeSourceControlProvider.${operation}`,
+      .pipe(
-        command: "cafe",
+        Effect.flatMap((env) =>
-        cwd,
+          host.process.run({
-        args: [...cliArgs(target.host), ...args],
+            operation: `GitCafeSourceControlProvider.${operation}`,
-        env: { CAFE_OUTPUT: "json" },
+            command: "cafe",
-        timeoutMs: 30_000,
+            cwd,
-      })
+            args: [...cliArgs(target.host), ...args],
+            env: { CAFE_OUTPUT: "json", ...env },
+            timeoutMs: 30_000,
+          }),
+        ),
+      )
       .pipe(
         Effect.mapError((cause) =>
           error(

packages/source-control-gitcafe/src/server/driver.ts+1-1

...	@@ -15,7 +15,7 @@ export const driver = defineSourceControlDriver({	...	@@ -15,7 +15,7 @@ export const driver = defineSourceControlDriver({
15	kind: SourceControlProviderKind.make("gitcafe"),	15	kind: SourceControlProviderKind.make("gitcafe"),
16	make: Effect.all({	16	make: Effect.all({
17	sourceControl: GitCafeSourceControlProvider.make,	17	sourceControl: GitCafeSourceControlProvider.make,
18	discovery: Effect.succeed(GitCafeSourceControlProvider.discovery),	18	discovery: GitCafeSourceControlProvider.makeDiscovery,
19	pullRequests: GitCafePullRequestProvider.make,	19	pullRequests: GitCafePullRequestProvider.make,
20	}),	20	}),
21	});	21	});

packages/source-control-github/src/client/definition.ts+35-1

...	@@ -3,7 +3,16 @@	...	@@ -3,7 +3,16 @@
3	*	3	*
4	* @module source-control-github/client/definition	4	* @module source-control-github/client/definition
5	*/	5	*/
6	import { pullRequestHostOf, SourceControlProviderKind } from "@t3tools/contracts";	6	import {
		7	GitHubHost,
		8	makeProviderSettingsSchema,
		9	pullRequestHostOf,
		10	SourceControlProviderKind,
		11	TrimmedNonEmptyString,
		12	TrimmedString,
		13	} from "@t3tools/contracts";
		14	import * as Effect from "effect/Effect";
		15	import * as Schema from "effect/Schema";
7	import {	16	import {
8	defineSourceControlClient,	17	defineSourceControlClient,
9	isChangeRequestInProjectRepository,	18	isChangeRequestInProjectRepository,
...	@@ -17,6 +26,30 @@ const CHANGE_REQUEST_REFERENCE =	...	@@ -17,6 +26,30 @@ const CHANGE_REQUEST_REFERENCE =
17		26
18	const KIND = SourceControlProviderKind.make("github");	27	const KIND = SourceControlProviderKind.make("github");
19		28
		29	export const GitHubHostChoice = Schema.Struct({
		30	account: Schema.optionalKey(TrimmedNonEmptyString),
		31	enabled: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(true))),
		32	});
		33	export type GitHubHostChoice = typeof GitHubHostChoice.Type;
		34
		35	/**
		36	* Per-host choices, keyed by lowercased host such as `github.com`. `hosts` pins one of the logins
		37	* `gh` holds for a host instead of its active one, or turns the host off; `tokens` holds a token
		38	* per host, used before `GH_TOKEN` and friends, which win over `gh`. Source Control settings draws
		39	* both with GitHub's own panels, since the logins come from `gh` at runtime.
		40	*/
		41	export const settings = makeProviderSettingsSchema({
		42	hosts: Schema.Record(GitHubHost, GitHubHostChoice).pipe(
		43	Schema.withDecodingDefault(Effect.succeed({})),
		44	Schema.annotateKey({ providerSettingsForm: { hidden: true } }),
		45	),
		46	tokens: Schema.Record(GitHubHost, TrimmedString).pipe(
		47	Schema.withDecodingDefault(Effect.succeed({})),
		48	Schema.annotateKey({ providerSettingsForm: { hidden: true, secret: true } }),
		49	),
		50	});
		51	export type GitHubSettings = typeof settings.Type;
		52
20	export const definition = defineSourceControlClient({	53	export const definition = defineSourceControlClient({
21	kind: KIND,	54	kind: KIND,
22	label: "GitHub",	55	label: "GitHub",
...	@@ -60,4 +93,5 @@ export const definition = defineSourceControlClient({	...	@@ -60,4 +93,5 @@ export const definition = defineSourceControlClient({
60	canReadChangeRequestOnHost: (identity, link) =>	93	canReadChangeRequestOnHost: (identity, link) =>
61	isChangeRequestOnProjectHost(KIND, identity, link),	94	isChangeRequestOnProjectHost(KIND, identity, link),
62	isChangeRequestUrl: (url) => isChangeRequestPath(url, "/pull/"),	95	isChangeRequestUrl: (url) => isChangeRequestPath(url, "/pull/"),
		96	settings,
63	});	97	});

packages/source-control-github/src/server/GitHubCredentials.test.ts+8-4

 @@ -57,7 +57,7 @@ function harness(
     Layer.provideMerge(
       TestSourceControlHost.layer({
         settings: applyServerSettingsPatch(DEFAULT_SERVER_SETTINGS, {
-          github: { hosts: hostSettings(hosts), tokens },
+          sourceControlHosts: { github: { hosts: hostSettings(hosts), tokens } },
         }),
         process: { run },
       }),
 @@ -128,16 +128,20 @@ describe("GitHubCredentials", () => {
       expect(Redacted.value((yield* credentials.get("github.com")).token)).toBe("active-token");
       yield* settings.update({
-        github: { hosts: { "github.com": { account: "work", enabled: true } } },
+        sourceControlHosts: {
+          github: { hosts: { "github.com": { account: "work", enabled: true } } },
+        },
       });
       expect(Redacted.value((yield* credentials.get("github.com")).token)).toBe("token-for-work");
-      yield* settings.update({ github: { hosts: { "github.com": { enabled: false } } } });
+      yield* settings.update({
+        sourceControlHosts: { github: { hosts: { "github.com": { enabled: false } } } },
+      });
       expect((yield* Effect.flip(credentials.get("github.com")))._tag).toBe(
         "GitHubHostDisabledError",
       );
-      yield* settings.update({ github: { hosts: {} } });
+      yield* settings.update({ sourceControlHosts: { github: { hosts: {} } } });
       expect(Redacted.value((yield* credentials.get("github.com")).token)).toBe("active-token");
       // The unpinned token stayed cached; only the newly pinned account cost a gh call.
       expect(calls).toHaveLength(2);

packages/source-control-github/src/server/GitHubCredentials.ts+12-2

 @@ -14,6 +14,10 @@ import * as Schema from "effect/Schema";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
+import { readSourceControlHostSettings } from "@t3tools/source-control-core/client/definition";
+import type { ServerSettings } from "@t3tools/contracts";
+import * as GitHubClient from "../client/definition.ts";
 /** How long a token is reused before `gh` is asked again, so a `gh auth switch` applies soon. */
 const TOKEN_TTL = Duration.minutes(5);
 @@ -176,17 +180,23 @@ export const make = Effect.gen(function* () {
         ),
       );
+  const readSettings = (settings: ServerSettings) =>
+    readSourceControlHostSettings(
+      GitHubClient.settings,
+      settings.sourceControlHosts[GitHubClient.definition.kind],
+    );
   /** The Settings choice for a host; unreadable settings fall back to gh's own choice. */
   const hostChoice = (host: string) =>
     sourceControlHost.settings.get.pipe(
-      Effect.map((settings) => settings.github.hosts[host]),
+      Effect.map((settings) => readSettings(settings).hosts[host]),
       Effect.orElseSucceed(() => undefined),
     );
   /** A token saved in Settings for the host, read fresh so a saved or removed one applies at once. */
   const savedToken = (host: string) =>
     sourceControlHost.settings.get.pipe(
-      Effect.map((settings) => settings.github.tokens[host]?.trim() || null),
+      Effect.map((settings) => readSettings(settings).tokens[host]?.trim() || null),
       Effect.orElseSucceed(() => null),
     );

packages/source-control-github/src/server/GitHubSourceControlProvider.ts+10-6

 @@ -10,11 +10,9 @@ import * as RequestResolver from "effect/RequestResolver";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
 import {
-  DEFAULT_SERVER_SETTINGS,
   SourceControlProviderError,
   TrimmedNonEmptyString,
   type ChangeRequest,
-  type GitHubSettings,
   type SourceControlProviderDiscoveryItem,
   type SourceControlRepositoryCloneUrls,
 } from "@t3tools/contracts";
 @@ -55,6 +53,9 @@ import {
   type SourceControlManagedCliDiscoverySpec,
 } from "@t3tools/source-control-core/server/discovery";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
+import { readSourceControlHostSettings } from "@t3tools/source-control-core/client/definition";
+import * as GitHubClient from "../client/definition.ts";
 const decodeLinkSubject = Schema.decodeUnknownEffect(
   Schema.fromJsonString(
 @@ -85,7 +86,7 @@ function authAccounts(accounts: ReadonlyArray<GitHubAuthStatusAccount>) {
  */
 export function parseGitHubAuth(
   input: SourceControlAuthProbeInput,
-  settings: GitHubSettings = DEFAULT_SERVER_SETTINGS.github,
+  settings: GitHubClient.GitHubSettings = readSourceControlHostSettings(GitHubClient.settings, {}),
 ) {
   const output = combinedAuthOutput(input);
   const authStatus = parseGitHubAuthStatus(input.stdout);
 @@ -202,9 +203,12 @@ export const makeDiscovery = Effect.gen(function* () {
     label: discovery.label,
     installHint: discovery.installHint,
     probe: Effect.fn("GitHubSourceControlProvider.discovery")(function* (cwd: string) {
-      const settings = yield* sourceControlHost.settings.get.pipe(
+      const settings = readSourceControlHostSettings(
-        Effect.map((current) => current.github),
+        GitHubClient.settings,
-        Effect.orElseSucceed(() => DEFAULT_SERVER_SETTINGS.github),
+        yield* sourceControlHost.settings.get.pipe(
+          Effect.map((current) => current.sourceControlHosts[GitHubClient.definition.kind]),
+          Effect.orElseSucceed(() => undefined),
+        ),
       );
       const cli = yield* probeSourceControlProvider({
         cwd,

packages/source-control-github/src/server/gitHubAuthStatus.ts+1-1

...	@@ -1,4 +1,4 @@	...	@@ -1,4 +1,4 @@
1	import type { GitHubSettings } from "@t3tools/contracts";	1	import type { GitHubSettings } from "../client/definition.ts";
2	import * as Option from "effect/Option";	2	import * as Option from "effect/Option";
3	import * as Schema from "effect/Schema";	3	import * as Schema from "effect/Schema";
4		4

author	Julius Marminge <julius0216@outlook.com> 2026-10-10 13:23:20-07:00
committer	GitHub <noreply@github.com> 2026-10-10 13:23:20-07:00
log	4f63275ac7885281d245022e65f1e9e8816b1382
tree	807380f1b61906a4a3acc3a177837c397d3ba091
parent	2a4ee339827e480da6ad0139585cf634a46ff73e
signature	Signed by PGP key B5690EEEBB952194

...	@@ -27,6 +27,7 @@ import * as GitLabCli from "@t3tools/source-control-gitlab/server/GitLabCli";	...	@@ -27,6 +27,7 @@ import * as GitLabCli from "@t3tools/source-control-gitlab/server/GitLabCli";
27	import * as GitLabPullRequestCli from "@t3tools/source-control-gitlab/server/GitLabPullRequestCli";	27	import * as GitLabPullRequestCli from "@t3tools/source-control-gitlab/server/GitLabPullRequestCli";
28	import * as ForgejoCli from "@t3tools/source-control-forgejo/server/ForgejoCli";	28	import * as ForgejoCli from "@t3tools/source-control-forgejo/server/ForgejoCli";
29	import * as GitCafeApi from "@t3tools/source-control-gitcafe/server/GitCafeApi";	29	import * as GitCafeApi from "@t3tools/source-control-gitcafe/server/GitCafeApi";
		30	import * as GitCafeCredentials from "@t3tools/source-control-gitcafe/server/GitCafeCredentials";
30	import * as ForgejoSourceControlProvider from "@t3tools/source-control-forgejo/server/ForgejoSourceControlProvider";	31	import * as ForgejoSourceControlProvider from "@t3tools/source-control-forgejo/server/ForgejoSourceControlProvider";
31	import * as ForgejoPullRequestProvider from "@t3tools/source-control-forgejo/server/ForgejoPullRequestProvider";	32	import * as ForgejoPullRequestProvider from "@t3tools/source-control-forgejo/server/ForgejoPullRequestProvider";
32	import * as SourceControlDiscovery from "./SourceControlDiscovery.ts";	33	import * as SourceControlDiscovery from "./SourceControlDiscovery.ts";
...	@@ -56,6 +57,9 @@ const layerSourceControlProviderRegistryTest = (input: {	...	@@ -56,6 +57,9 @@ const layerSourceControlProviderRegistryTest = (input: {
56	Layer.mock(GitLabPullRequestCli.GitLabPullRequestCli)({}),	57	Layer.mock(GitLabPullRequestCli.GitLabPullRequestCli)({}),
57	Layer.mock(ForgejoCli.ForgejoCli)({ listLogins: () => Effect.succeed([]) }),	58	Layer.mock(ForgejoCli.ForgejoCli)({ listLogins: () => Effect.succeed([]) }),
58	Layer.mock(GitCafeApi.GitCafeApi)({}),	59	Layer.mock(GitCafeApi.GitCafeApi)({}),
		60	Layer.mock(GitCafeCredentials.GitCafeCredentials)({
		61	cliEnv: () => Effect.succeed({}),
		62	}),
59	Layer.mock(VcsDriverRegistry.VcsDriverRegistry)({}),	63	Layer.mock(VcsDriverRegistry.VcsDriverRegistry)({}),
60	Layer.mock(VcsProcess.VcsProcess)(input.process),	64	Layer.mock(VcsProcess.VcsProcess)(input.process),
61	ServerSourceControlHost.layer.pipe(	65	ServerSourceControlHost.layer.pipe(

...	@@ -26,6 +26,7 @@ import * as GitLabCli from "@t3tools/source-control-gitlab/server/GitLabCli";	...	@@ -26,6 +26,7 @@ import * as GitLabCli from "@t3tools/source-control-gitlab/server/GitLabCli";
26	import * as GitLabPullRequestCli from "@t3tools/source-control-gitlab/server/GitLabPullRequestCli";	26	import * as GitLabPullRequestCli from "@t3tools/source-control-gitlab/server/GitLabPullRequestCli";
27	import * as ForgejoCli from "@t3tools/source-control-forgejo/server/ForgejoCli";	27	import * as ForgejoCli from "@t3tools/source-control-forgejo/server/ForgejoCli";
28	import * as GitCafeApi from "@t3tools/source-control-gitcafe/server/GitCafeApi";	28	import * as GitCafeApi from "@t3tools/source-control-gitcafe/server/GitCafeApi";
		29	import * as GitCafeCredentials from "@t3tools/source-control-gitcafe/server/GitCafeCredentials";
29	import * as SourceControlProviderRegistry from "./SourceControlProviderRegistry.ts";	30	import * as SourceControlProviderRegistry from "./SourceControlProviderRegistry.ts";
30	import * as ServerSourceControlHost from "./ServerSourceControlHost.ts";	31	import * as ServerSourceControlHost from "./ServerSourceControlHost.ts";
31		32
...	@@ -129,6 +130,9 @@ function makeRegistry(input: {	...	@@ -129,6 +130,9 @@ function makeRegistry(input: {
129	Layer.mock(GitLabPullRequestCli.GitLabPullRequestCli)({}),	130	Layer.mock(GitLabPullRequestCli.GitLabPullRequestCli)({}),
130	Layer.mock(ForgejoCli.ForgejoCli)({ listLogins: () => Effect.succeed([]) }),	131	Layer.mock(ForgejoCli.ForgejoCli)({ listLogins: () => Effect.succeed([]) }),
131	Layer.mock(GitCafeApi.GitCafeApi)({}),	132	Layer.mock(GitCafeApi.GitCafeApi)({}),
		133	Layer.mock(GitCafeCredentials.GitCafeCredentials)({
		134	cliEnv: () => Effect.succeed({}),
		135	}),
132	ServerConfig.layerTest(process.cwd(), {	136	ServerConfig.layerTest(process.cwd(), {
133	prefix: "t3-source-control-registry-test-",	137	prefix: "t3-source-control-registry-test-",
134	}).pipe(Layer.provide(NodeServices.layer)),	138	}).pipe(Layer.provide(NodeServices.layer)),

feat(source-control): host settings live on each host's definition, with a GitCafe token (#17901)