fix(cli): surface invalid env credential upstreams

[BYK]

Summary

Reports an invalid configured upstream URL without silently discarding a valid shell credential or crashing lore import. Follow-up to Seer reviews on #1632 and this PR:

• fix(gateway): harden Responses terminal lifecycle #1632 (comment)
• fix(cli): surface invalid env credential upstreams #1640 (comment)

Changes

• throw a typed, credential-safe error for invalid paired upstream environment variables
• catch that error during initial auth resolution and fallback-chain construction
• emit actionable output, set a nonzero exit code, skip the affected agent, and preserve gateway shutdown
• preserve token-only credentials that intentionally use the provider default upstream
• add load-bearing helper and command-level regressions for both import paths

Verification

• focused CLI/import suites: 123 tests passed
• full suite: 9,333 tests passed; 227 skipped
• repeated command regressions: 10/10 passed
• pnpm run typecheck
• pnpm run format:check
• targeted type-aware lint (baseline warnings only)
• independent focused review: MERGE

[github-actions]

Codecov Results 📊

✅ Patch coverage is 90.00%. Project has 8179 uncovered lines.
✅ Project coverage is 80.33%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
packages/gateway/src/cli/import.ts	85.71%	⚠️ 2 Missing and 3 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    80.33%    80.33%        —%
==========================================
  Files          218       218         —
  Lines        41573     41590       +17
  Branches     32929     32935        +6
==========================================
+ Hits         33396     33411       +15
- Misses        8177      8179        +2
- Partials      3643      3645        +2

---

Generated by Codecov Action

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-17 19:45 UTC