The GPUI app needs Engine-owned credential inspect/set/clear over the runtime API; today credentials are only reachable through the TUI's credential store paths. APPS-48.
Scope: serve the existing credential store (crates/tui/src/credentials) through app-server routes with the same authority checks the TUI applies — list provider/entry state (never secret material), set/update, clear. The app must not read the credential store directly and must never receive raw secrets; return typed presence/metadata only.
Related: #6139 (app-server as runtime-API client), Hmbown/codewhale-apps APPS-48.
The GPUI app needs Engine-owned credential inspect/set/clear over the runtime API; today credentials are only reachable through the TUI's credential store paths. APPS-48.
Scope: serve the existing credential store (crates/tui/src/credentials) through app-server routes with the same authority checks the TUI applies — list provider/entry state (never secret material), set/update, clear. The app must not read the credential store directly and must never receive raw secrets; return typed presence/metadata only.
Related: #6139 (app-server as runtime-API client), Hmbown/codewhale-apps APPS-48.