feat: prioritize clouds with detected credentials in interactive mode

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team

[la14-1]

Summary

• When running spawn interactively, clouds with detected auth credentials are now prioritized (moved to the top) in the cloud selection picker
• Clouds with credentials show a "credentials detected" hint alongside their description
• A count of detected clouds is shown before the picker (e.g. "2 clouds with credentials detected")
• Added hasCloudCredentials() helper that checks if all required auth env vars for a cloud are set
• Bumped CLI version to 0.2.65

Fixes#685

How it works

The parseAuthEnvVars() function (already existing) extracts env var names from a cloud's auth field. The new hasCloudCredentials() checks if all extracted vars are present and non-empty in process.env. In cmdInteractive(), clouds are partitioned into "with credentials" and "without", then concatenated so credentialed clouds appear first.

Test plan

• 12 new tests for hasCloudCredentials() covering single vars, multiple vars, missing vars, CLI-based auth, empty strings
• Full test suite passes (6062 pass, 12 pre-existing failures unrelated to this change)
• Manual test: set HCLOUD_TOKEN=x and run spawn interactively -- Hetzner should appear first with "credentials detected" hint

Agent: ux-engineer

[la14-1]

Self-review (Agent: ux-engineer):

Changes look good. The implementation is minimal and focused:

1. hasCloudCredentials(auth) - New 5-line helper that reuses the existing parseAuthEnvVars() to check if all required env vars are set. Returns false for CLI-based auth (sprite login, gcloud auth login, etc.) since those don't use env vars, which is the correct behavior.

2. cmdInteractive() changes - Partitions clouds into "with credentials" and "without", concatenates them so credentialed clouds appear first. Adds a "credentials detected" prefix to the hint. Shows a count message before the picker. No changes to the agent selection flow.

3. mapToSelectOptions() enhancement - Added an optional hintOverrides parameter. Uses nullish coalescing (??) so existing callers are unaffected.

4. Tests - 12 tests covering single vars, multiple vars, partial vars, CLI auth, empty strings, and edge cases. Proper env cleanup in afterEach.

5. Version bump - 0.2.64 -> 0.2.65 (patch for minor feature).

No concerns with this diff.

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found.

The hasCloudCredentials() function safely reads env vars using names validated by the existing parseAuthEnvVars() regex (/^[A-Z][A-Z0-9_]{3,}$/). Credential values are never logged or exposed — only their presence is checked via !!process.env[v]. The hint text displays "credentials detected" without revealing actual values. The hintOverrides dictionary is populated from manifest data and rendered in a terminal UI picker, not executed.

Tests

• bash -n: N/A (no .sh files changed)
• bun test: PASS (12/12 new tests pass)
• curl|bash pattern: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

---

Automated security review by spawn security team