feat(integrationRoles): add self-registration support for credential roles

[aaight]

Summary

• Adds registerCredentialRoles(provider, category, roles) function to src/config/integrationRoles.ts so new providers can self-register at bootstrap time without hardcoded changes
• Adds getCredentialRoles(provider) accessor that returns roles for any registered provider (including dynamically registered ones), returning [] for unknown providers
• Converts PROVIDER_CREDENTIAL_ROLES and PROVIDER_CATEGORY from plain const objects to Proxy-backed accessors that read from an internal mutable Map — all existing call sites continue working unchanged
• Fixes hasPmIntegration in src/pm/integration.ts to guard against the empty-array case (previously guarded against undefined; now the Proxy returns [] for unknown providers)
• Updates tests/unit/config/integrationRoles.test.ts with 8 new tests covering registration, retrieval, backward-compat proxy access, and overwrite behavior

Test plan

• All existing PROVIDER_CREDENTIAL_ROLES and PROVIDER_CATEGORY tests pass (backward compat)
• New tests: registerCredentialRoles adds a new provider, getCredentialRoles retrieves it
• New tests: existing providers remain accessible after registering new ones
• New tests: Proxy reflects newly registered provider in both PROVIDER_CREDENTIAL_ROLES and PROVIDER_CATEGORY
• New test: overwrite behavior when same provider is registered twice
• hasPmIntegration returns false for unknown provider (empty-array guard fix)
• Full unit suite: 6764/6764 tests pass
• Lint and typecheck: zero errors

Card: https://trello.com/c/69c1b04df4b4bc3b4baf28e2

🤖 Generated with Claude Code

🕵️ claude-code · claude-sonnet-4-6 · run details

[nhopeatall]

👀 Reviewing the changes in PR #1025 now

[codecov]

Codecov Report

❌ Patch coverage is 92.30769% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/config/integrationRoles.ts	92.23%	8 Missing ⚠️

📢 Thoughts on this report? Let us know!

[nhopeatall]

Summary

LGTM — Clean implementation of a self-registration pattern for integration credential roles. The Proxy-backed backward compatibility layer correctly preserves all existing PROVIDER_CREDENTIAL_ROLES[provider] and PROVIDER_CATEGORY[provider] access patterns, Object.entries() / Object.keys() / Object.values() enumeration, and in operator behavior. The fix to hasPmIntegration correctly handles the semantic change from undefined to [] for unknown providers.

All 7 CI checks pass. The code is well-structured, properly documented, and the test coverage is solid.

Minor observations (not blocking):

• Test cleanup registers rather than removes: The afterEach in the new test block calls registerCredentialRoles('test-provider-linear', 'pm', []) — this doesn't remove the provider from the registry, it keeps it registered with an empty role array. This is fine for the current test file since the concurrent PROVIDER_CREDENTIAL_ROLES tests run before the sequential registration tests, but if future tests in this file iterate Object.entries(PROVIDER_CREDENTIAL_ROLES), they'd see these ghost entries. Consider exposing an unregisterCredentialRoles function or a test-only _resetRegistry() helper if more tests are added later.

• Proxy get trap type annotation: The get(_target, prop: string) signature narrows prop to string, but the actual Proxy handler spec passes string | symbol. This is harmless at runtime (Map lookup on a Symbol returns undefined, and ?? [] handles it), but the type annotation is technically imprecise.

🕵️ claude-code · claude-opus-4-6 · run details