[JacobStephens2]

Summary

 credentials.toml
 [resend]
 key = "..."
+[claude]
+setup_token = "..."

Setup offers hidden token input independently of email, preserves saved secrets and comments, and saves Credentials with mode 0600. Malformed TOML diagnostics hide file contents. Ordinary Runs keep their existing login; #1012 supplies the token to Trials.

Closes #1010

Test seams

• CLI setup on a real terminal: hidden input, persistence, permissions, retention and interruption.
• CLI email-test: strict shared Credentials parsing and secret-free diagnostics.
• CLI Run with fake Harness: saved token stays out of ordinary sessions, logs and Command records.

Evidence

• Before: cargo test --test email_test a_claude_setup_token_can_share_the_credentials_without_being_sent_or_printed failed with unknown section [claude]; the terminal token test failed because Setup never asked for it; malformed_credentials_never_echo_the_claude_setup_token reproduced a token leak in parse diagnostics.
  After: all three pass. Terminal coverage also checks retention/replacement alongside the Resend key, comments, mode 0600 and interruption. An ordinary Run test checks its Harness environment, output, logs and Command record for token isolation.
• cargo check --all-targets, cargo clippy --all-targets -- -D warnings and cargo fmt --check passed.
• /usr/bin/time -p scripts/affected-tests e6c92e19cfbe8352a1e8ca18eab8107dc49b870b: all 43 site tests passed; the initial Rust run stopped on three Setup fixtures missing the new prompt (909.08s total, including compilation and site checks). Those fixtures and the corresponding first-Run fixture are corrected. Focused reruns passed: Console Setup 10, Muse Setup 1, OpenCode Setup 2, first-Run Setup 8.
• Final-head CI passed for 92bb37d: 2,422 Rust tests passed, 57 ignored, plus site and Console browser checks. The Linux job took 13m 09s including setup and compilation. This successful exact-head CI supplies the final full-suite evidence.

Unaddressed findings

• Standards: none. The initial low-priority duplicated credential-selection finding was addressed with Answers::credential_edits and independently rechecked.
• Spec: none.

Review coverage

Both independent axes read all 14 changed files, including the generated manual and updated Setup fixtures. Unread changed files: none. Generated-output exclusions: none. Review fixed point: issue-977 at e6c92e1.

Merge Danger

Door: two-way

Blast Radius: Setup

The strict Credentials schema also serves email commands. Resend environment precedence remains covered; new sections are incompatible with older thirdshift versions that reject unknown keys.

Built with codex · gpt-6.1-sol · xhigh