fix: return recovery action descriptors (#174)

Co-authored-by: AgentRun Codex <agentrun-codex@users.noreply.github.com>

src/mgr/tool-credentials.ts

@@ -92,10 +92,21 @@ export async function setGithubSshToolCredential(body: unknown, options: ToolCre
     updatedAt: stringPath(applied, ["metadata", "annotations", `${annotationPrefix}-updated-at`]) ?? updatedAt,
     credentialValuesPrinted: false,
     valuesPrinted: false,
-    pollCommands: {
-      show: "./scripts/agentrun tool-credentials show github-ssh",
-      list: "./scripts/agentrun tool-credentials list",
-    },
+    pollActions: [
+      toolCredentialActionDescriptor({ action: "inspect-tool-credential", operation: "describe", resourceKind: "tool-credential", resourceName: spec.name, tool: spec.tool }),
+      toolCredentialActionDescriptor({ action: "list-tool-credentials", operation: "list", resourceKind: "tool-credential", resourceName: "*", tool: spec.tool }),
+    ],
+  };
+}
+
+function toolCredentialActionDescriptor(input: { action: string; operation: string; resourceKind: string; resourceName: string; tool?: string | null }): JsonRecord {
+  return {
+    action: input.action,
+    operation: input.operation,
+    resourceKind: input.resourceKind,
+    resourceName: input.resourceName,
+    tool: input.tool ?? null,
+    valuesPrinted: false,
   };
 }