@agentlayer.tech/wallet 0.1.58 → 0.1.65

package/agent-wallet/agent_wallet/keystore.py

@@ -0,0 +1,328 @@
+"""Cross-platform, dependency-free secret storage for the wallet boot key.
+
+Backends shell out to tools already present on each desktop OS:
+  - macOS:   /usr/bin/security (generic password in the login keychain)
+  - Windows: powershell DPAPI (ConvertFrom/ConvertTo-SecureString), per-user+machine
+  - Linux:   secret-tool (libsecret) iff a Secret Service is reachable
+  - fallback: a 0600 plaintext file (current behavior) — never chosen over a
+              working keystore.
+
+The store holds ONE install-level secret (the boot key). See
+BOOT_KEY_KEYCHAIN_ARCHITECTURE.md.
+"""
+
+from __future__ import annotations
+
+import os
+import platform
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Protocol, runtime_checkable
+
+from agent_wallet.config import resolve_openclaw_home
+from agent_wallet.file_ops import atomic_write_text, chmod_if_exists
+
+KEYSTORE_SERVICE = "ai.agentlayer.wallet"
+BOOT_KEY_ITEM = "boot_key"
+_PROBE_ITEM = "__probe__"
+_KEYSTORE_BACKEND_ENV = "AGENT_WALLET_KEYSTORE_BACKEND"
+
+_SECURITY_BIN = "/usr/bin/security"
+_SUBPROCESS_TIMEOUT = 10.0
+
+
+def _service() -> str:
+    """Keychain/Secret-Service service name. Overridable so tests never touch the
+    real shared slot (the OS keychain is global, not scoped to OPENCLAW_HOME)."""
+    return os.getenv("AGENT_WALLET_KEYSTORE_SERVICE", "").strip() or KEYSTORE_SERVICE
+
+
+def _backend_preference() -> str:
+    """Selected keystore backend.
+
+    auto (default) prefers the native OS keystore (macOS Keychain / Windows DPAPI /
+    Linux Secret Service) and falls back to a 0600 plaintext file. macOS Keychain
+    is prompt-free because set() writes with `-A` (open ACL, no partition-list).
+    Override with AGENT_WALLET_KEYSTORE_BACKEND=plaintext|macos-keychain|native|...
+    """
+    return os.getenv(_KEYSTORE_BACKEND_ENV, "auto").strip().lower()
+
+
+class KeyStoreError(Exception):
+    """Raised when a keystore backend operation fails unexpectedly."""
+
+
+@runtime_checkable
+class KeyStore(Protocol):
+    backend_id: str
+
+    def available(self) -> bool: ...
+    def get(self, name: str) -> str | None: ...
+    def set(self, name: str, value: str) -> None: ...
+    def delete(self, name: str) -> None: ...
+
+
+def _timeout_output(value: str | bytes | None) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, bytes):
+        return value.decode(errors="replace")
+    return value
+
+
+def _run(
+    argv: list[str],
+    *,
+    input_text: str | None = None,
+    timeout: float = _SUBPROCESS_TIMEOUT,
+) -> subprocess.CompletedProcess[str]:
+    kwargs: dict[str, object] = {
+        "capture_output": True,
+        "text": True,
+        "timeout": timeout,
+        "check": False,
+    }
+    if input_text is None:
+        kwargs["stdin"] = subprocess.DEVNULL
+    else:
+        kwargs["input"] = input_text
+    try:
+        return subprocess.run(argv, **kwargs)
+    except subprocess.TimeoutExpired as exc:
+        return subprocess.CompletedProcess(
+            argv,
+            124,
+            _timeout_output(exc.stdout),
+            _timeout_output(exc.stderr) or f"timed out after {timeout:g}s",
+        )
+
+
+class MacKeychainStore:
+    backend_id = "macos-keychain"
+
+    def available(self) -> bool:
+        return platform.system() == "Darwin" and Path(_SECURITY_BIN).exists()
+
+    def get(self, name: str) -> str | None:
+        proc = _run([_SECURITY_BIN, "find-generic-password", "-s", _service(), "-a", name, "-w"])
+        if proc.returncode != 0:
+            return None  # item not found (44) or other non-fatal lookup miss
+        value = proc.stdout.rstrip("\n")
+        return value or None
+
+    def set(self, name: str, value: str) -> None:
+        # Recreate the item fresh with an open ACL. This is the ONLY reliably
+        # prompt-free way to write a login-keychain item non-interactively:
+        #   -A          -> accessible to any application without a prompt, and it
+        #                  bypasses the Sierra+ partition-list mechanism entirely.
+        #   delete+add  -> never -U-update an existing item; updating one created
+        #                  with a different ACL (or setting its partition list)
+        #                  pops a GUI keychain-password dialog in the background.
+        # Trade-off: any process running as this user can read the key without a
+        # prompt — the same runtime exposure as a 0600 file. At-rest protection
+        # (backups, synced home dirs, a stolen disk) is fully preserved.
+        _run([_SECURITY_BIN, "delete-generic-password", "-s", _service(), "-a", name])
+        proc = _run([
+            _SECURITY_BIN, "add-generic-password",
+            "-s", _service(), "-a", name,
+            "-w", value, "-A",
+        ])
+        if proc.returncode != 0:
+            raise KeyStoreError(f"security add-generic-password failed: {proc.stderr.strip()}")
+
+    def delete(self, name: str) -> None:
+        _run([_SECURITY_BIN, "delete-generic-password", "-s", _service(), "-a", name])
+
+
+class WindowsDpapiStore:
+    backend_id = "windows-dpapi"
+
+    def _blob_path(self, name: str) -> Path:
+        return resolve_openclaw_home() / "keystore" / f"{name}.dpapi"
+
+    def available(self) -> bool:
+        return platform.system() == "Windows" and shutil.which("powershell") is not None
+
+    def get(self, name: str) -> str | None:
+        path = self._blob_path(name)
+        if not path.exists():
+            return None
+        blob = path.read_text(encoding="utf-8").strip()
+        if not blob:
+            return None
+        script = (
+            "$ErrorActionPreference='Stop';"
+            "$b=[Console]::In.ReadToEnd().Trim();"
+            "$ss=ConvertTo-SecureString $b;"
+            "$p=[Runtime.InteropServices.Marshal]::PtrToStringUni("
+            "[Runtime.InteropServices.Marshal]::SecureStringToBSTR($ss));"
+            "[Console]::Out.Write($p)"
+        )
+        proc = _run(["powershell", "-NoProfile", "-NonInteractive", "-Command", script], input_text=blob)
+        if proc.returncode != 0:
+            return None
+        return proc.stdout or None
+
+    def set(self, name: str, value: str) -> None:
+        script = (
+            "$ErrorActionPreference='Stop';"
+            "$v=[Console]::In.ReadToEnd();"
+            "$ss=ConvertTo-SecureString $v -AsPlainText -Force;"
+            "[Console]::Out.Write((ConvertFrom-SecureString $ss))"
+        )
+        proc = _run(["powershell", "-NoProfile", "-NonInteractive", "-Command", script], input_text=value)
+        if proc.returncode != 0 or not proc.stdout.strip():
+            raise KeyStoreError(f"DPAPI ConvertFrom-SecureString failed: {proc.stderr.strip()}")
+        atomic_write_text(self._blob_path(name), proc.stdout.strip() + "\n", mode=0o600)
+
+    def delete(self, name: str) -> None:
+        path = self._blob_path(name)
+        try:
+            path.unlink()
+        except FileNotFoundError:
+            pass
+
+
+class LinuxSecretServiceStore:
+    backend_id = "linux-secretservice"
+
+    def available(self) -> bool:
+        if platform.system() != "Linux" or shutil.which("secret-tool") is None:
+            return False
+        # A probe lookup succeeds (rc 0/1) only when a Secret Service answers;
+        # a missing/unreachable service errors out (rc >1) or times out.
+        try:
+            proc = _run(["secret-tool", "lookup", "service", _service(), "account", "__probe__"])
+        except subprocess.TimeoutExpired:
+            return False
+        return proc.returncode in (0, 1)
+
+    def get(self, name: str) -> str | None:
+        proc = _run(["secret-tool", "lookup", "service", _service(), "account", name])
+        if proc.returncode != 0:
+            return None
+        value = proc.stdout.rstrip("\n")
+        return value or None
+
+    def set(self, name: str, value: str) -> None:
+        proc = _run(
+            ["secret-tool", "store", "--label", f"{_service()} {name}",
+             "service", _service(), "account", name],
+            input_text=value,
+        )
+        if proc.returncode != 0:
+            raise KeyStoreError(f"secret-tool store failed: {proc.stderr.strip()}")
+
+    def delete(self, name: str) -> None:
+        _run(["secret-tool", "clear", "service", _service(), "account", name])
+
+
+class PlaintextFileStore:
+    """Fallback: a 0600 file under OPENCLAW_HOME/keystore. Always available."""
+
+    backend_id = "plaintext-file"
+
+    def _path(self, name: str) -> Path:
+        return resolve_openclaw_home() / "keystore" / f"{name}.plaintext"
+
+    def available(self) -> bool:
+        return True
+
+    def get(self, name: str) -> str | None:
+        path = self._path(name)
+        if not path.exists():
+            return None
+        chmod_if_exists(path)
+        value = path.read_text(encoding="utf-8").strip()
+        return value or None
+
+    def set(self, name: str, value: str) -> None:
+        atomic_write_text(self._path(name), value.strip() + "\n", mode=0o600)
+
+    def delete(self, name: str) -> None:
+        try:
+            self._path(name).unlink()
+        except FileNotFoundError:
+            pass
+
+
+_keystore_cache: dict[tuple[str, str], KeyStore] = {}
+
+
+def clear_keystore_cache() -> None:
+    """Drop the memoized keystore backend (e.g. after env/service changes)."""
+    _keystore_cache.clear()
+
+
+def resolve_keystore() -> KeyStore:
+    """Memoized keystore resolution.
+
+    Resolving probes the OS keystore with subprocess calls (`security`,
+    `secret-tool`, powershell), so cache the winning backend per
+    (preference, service) for the process lifetime. Cleared by
+    ``agent_wallet.config.clear_secret_caches`` / ``reload_settings``.
+    """
+    cache_key = (_backend_preference(), _service())
+    cached = _keystore_cache.get(cache_key)
+    if cached is not None:
+        return cached
+    store = _resolve_keystore_uncached()
+    _keystore_cache[cache_key] = store
+    return store
+
+
+def _resolve_keystore_uncached() -> KeyStore:
+    """Return the first available OS-native backend, else the plaintext fallback."""
+    preference = _backend_preference()
+    if preference in {"plain", "plaintext", "plaintext-file", "file"}:
+        return PlaintextFileStore()
+
+    candidates: list[KeyStore]
+    if preference in {"macos", "macos-keychain", "keychain"}:
+        candidates = [MacKeychainStore()]
+    elif preference in {"windows", "windows-dpapi", "dpapi"}:
+        candidates = [WindowsDpapiStore()]
+    elif preference in {"linux", "linux-secretservice", "secretservice"}:
+        candidates = [LinuxSecretServiceStore()]
+    elif preference == "native":
+        candidates = [MacKeychainStore(), WindowsDpapiStore(), LinuxSecretServiceStore()]
+    else:
+        # Auto: native OS keystore first, plaintext fallback last. macOS Keychain
+        # is prompt-free now that set() uses `-A` (open ACL, no partition-list) and
+        # _backend_usable falls back gracefully if a session still can't authorize.
+        candidates = [MacKeychainStore(), WindowsDpapiStore(), LinuxSecretServiceStore()]
+
+    for candidate in candidates:
+        try:
+            if candidate.available() and _backend_usable(candidate):
+                return candidate
+        except Exception:
+            continue
+    return PlaintextFileStore()
+
+
+def _backend_usable(candidate: KeyStore) -> bool:
+    """Return true when a native backend can read the live key or write safely.
+
+    A desktop keystore binary can exist while the session cannot authorize
+    non-interactive writes. Treat that as unavailable so install/migration uses
+    the bounded fallback instead of hanging or repeatedly failing.
+    """
+    try:
+        if candidate.get(BOOT_KEY_ITEM):
+            return True
+    except Exception:
+        pass
+
+    probe_value = "ok"
+    try:
+        candidate.set(_PROBE_ITEM, probe_value)
+        return candidate.get(_PROBE_ITEM) == probe_value
+    except Exception:
+        return False
+    finally:
+        try:
+            candidate.delete(_PROBE_ITEM)
+        except Exception:
+            pass

package/agent-wallet/agent_wallet/openclaw_cli.py

@@ -33,6 +33,8 @@ def _parse_csv(value: Any) -> str:
 
 
 SECRET_CONFIG_KEYS = {"privateKey", "masterKey", "approvalSecret"}
+# Always-allowed floor kept for compatibility; the live gate is the dynamic
+# set of adapter-declared read-only tools (_read_only_tool_names).
 READ_ONLY_WORKER_TOOLS = frozenset(
     {
         "get_wallet_balance",
@@ -41,6 +43,20 @@ READ_ONLY_WORKER_TOOLS = frozenset(
 )
 
 
+def _read_only_tool_names(context: Any) -> frozenset[str]:
+    """All tools the resident read worker may serve: the adapter's read-only
+    specs for this backend, plus the legacy floor."""
+    names = set(READ_ONLY_WORKER_TOOLS)
+    try:
+        for tool in context.adapter.list_tools():
+            spec = tool.model_dump() if hasattr(tool, "model_dump") else dict(tool)
+            if spec.get("read_only") is True and str(spec.get("name") or "").strip():
+                names.add(str(spec["name"]))
+    except Exception:
+        pass
+    return frozenset(names)
+
+
 def _reject_secret_config_json(config: dict[str, Any]) -> None:
     present = sorted(key for key in SECRET_CONFIG_KEYS if str(config.get(key) or "").strip())
     if present:
@@ -180,8 +196,27 @@ async def _run_invoke(
     tool_name: str,
     arguments: dict[str, Any],
     config: dict[str, Any],
+    *,
+    approval_summary: dict[str, Any] | None = None,
+    approval_mainnet_confirmed: bool = False,
+    approval_ttl_seconds: int | None = None,
 ) -> dict[str, Any]:
     context = _build_runtime_context(user_id, config)
+    # Mint the approval token in-process when the host passed the confirmation
+    # summary along with the execute call: this replaces a second cold
+    # `issue-approval` subprocess (full interpreter boot + onboarding) with a
+    # local HMAC signature. A caller-provided token always wins.
+    if (
+        isinstance(approval_summary, dict)
+        and not str(arguments.get("approval_token") or "").strip()
+    ):
+        arguments = dict(arguments)
+        arguments["approval_token"] = context.issue_execute_approval(
+            tool_name=tool_name,
+            confirmation_summary=approval_summary,
+            mainnet_confirmed=approval_mainnet_confirmed,
+            ttl_seconds=approval_ttl_seconds,
+        )
     result = await context.adapter.invoke(tool_name, arguments)
     return result.model_dump()
 
@@ -253,11 +288,16 @@ def _error_payload_for_exception(exc: Exception) -> dict[str, Any]:
     return payload
 
 
-async def _run_read_worker_tool(context: Any, request: dict[str, Any]) -> dict[str, Any]:
+async def _run_read_worker_tool(
+    context: Any,
+    request: dict[str, Any],
+    allowed_tools: frozenset[str] | None = None,
+) -> dict[str, Any]:
     tool_name = str(request.get("tool") or "").strip()
-    if tool_name not in READ_ONLY_WORKER_TOOLS:
+    effective_allowed = allowed_tools if allowed_tools is not None else READ_ONLY_WORKER_TOOLS
+    if tool_name not in effective_allowed:
         raise WalletBackendError(
-            f"read-worker only allows read-only tools: {', '.join(sorted(READ_ONLY_WORKER_TOOLS))}."
+            f"read-worker only allows read-only tools for this backend; '{tool_name}' is not one."
         )
     arguments = request.get("arguments") or {}
     if not isinstance(arguments, dict):
@@ -268,6 +308,7 @@ async def _run_read_worker_tool(context: Any, request: dict[str, Any]) -> dict[s
 
 async def _serve_read_worker(user_id: str, config: dict[str, Any]) -> int:
     context = _build_runtime_context(user_id, config, read_only=True)
+    allowed_tools = _read_only_tool_names(context)
     while True:
         line = sys.stdin.readline()
         if not line:
@@ -282,7 +323,7 @@ async def _serve_read_worker(user_id: str, config: dict[str, Any]) -> int:
             if request.get("op") == "shutdown":
                 print(json.dumps({"id": request_id, "ok": True, "stopped": True}), flush=True)
                 break
-            payload = await _run_read_worker_tool(context, request)
+            payload = await _run_read_worker_tool(context, request, allowed_tools)
             print(
                 json.dumps(
                     {
@@ -510,6 +551,15 @@ def main() -> int:
     invoke_parser.add_argument("--tool", required=True)
     invoke_parser.add_argument("--arguments-json", default="{}")
     invoke_parser.add_argument("--config-json", default="{}")
+    invoke_parser.add_argument(
+        "--approval-summary-json",
+        help=(
+            "Confirmation summary for execute calls; when provided, the approval "
+            "token is minted in this process instead of a separate issue-approval run."
+        ),
+    )
+    invoke_parser.add_argument("--approval-mainnet-confirmed", action="store_true")
+    invoke_parser.add_argument("--approval-ttl-seconds", type=int)
 
     approval_parser = subparsers.add_parser("issue-approval")
     approval_parser.add_argument("--user-id", required=True)
@@ -582,6 +632,15 @@ def main() -> int:
     read_worker_parser.add_argument("--user-id", required=True)
     read_worker_parser.add_argument("--config-json", default="{}")
 
+    subparsers.add_parser("boot-key-export")
+
+    boot_key_import_parser = subparsers.add_parser("boot-key-import")
+    boot_key_import_parser.add_argument(
+        "--key-stdin",
+        action="store_true",
+        help="Read the boot key to import from stdin.",
+    )
+
     args = parser.parse_args()
 
     try:
@@ -705,13 +764,33 @@ def main() -> int:
             payload = asyncio.run(_run_evm_wallet_lock(args.user_id, config))
         elif args.command == "read-worker":
             return asyncio.run(_serve_read_worker(args.user_id, config))
+        elif args.command == "boot-key-export":
+            from agent_wallet.boot_key_recovery import export_boot_key, export_warning
+
+            print(export_warning(), file=sys.stderr)
+            payload = {"boot_key": export_boot_key()}
+        elif args.command == "boot-key-import":
+            if not args.key_stdin:
+                raise WalletBackendError("boot-key-import requires --key-stdin.")
+            from agent_wallet.boot_key_recovery import import_boot_key
+
+            payload = import_boot_key(_read_stdin_secret("boot key"))
         else:
+            approval_summary = None
+            raw_summary = getattr(args, "approval_summary_json", None)
+            if raw_summary:
+                approval_summary = _load_json(raw_summary)
             payload = asyncio.run(
                 _run_invoke(
                     args.user_id,
                     args.tool,
                     _load_json(args.arguments_json),
                     config,
+                    approval_summary=approval_summary,
+                    approval_mainnet_confirmed=bool(
+                        getattr(args, "approval_mainnet_confirmed", False)
+                    ),
+                    approval_ttl_seconds=getattr(args, "approval_ttl_seconds", None),
                 )
             )
     except Exception as exc:

package/agent-wallet/agent_wallet/openclaw_runtime.py

@@ -6,6 +6,7 @@ from dataclasses import dataclass
 from typing import Any
 
 from agent_wallet.approval import issue_approval_token
+from agent_wallet.boot_key_migration import migrate_boot_key_to_keystore
 from agent_wallet.btc_user_wallets import get_user_btc_wallet_binding
 from agent_wallet.config import normalize_btc_network, normalize_evm_network, settings
 from agent_wallet.evm_user_wallets import ensure_user_evm_wallet_ready
@@ -19,6 +20,24 @@ from agent_wallet.wallet_layer.base import AgentWalletBackend, WalletBackendErro
 from agent_wallet.wallet_layer.wdk_evm import WdkEvmLocalWalletBackend
 from agent_wallet.wallet_layer.wdk_btc import WdkBtcLocalWalletBackend
 
+_boot_key_migration_done = False
+
+
+def ensure_boot_key_migrated_once() -> None:
+    """Run the boot-key keystore migration at most once per process. Never raises.
+
+    Best-effort: a failure here must never block wallet onboarding — the legacy
+    plaintext sources still resolve via ``resolve_boot_key``.
+    """
+    global _boot_key_migration_done
+    if _boot_key_migration_done:
+        return
+    _boot_key_migration_done = True
+    try:
+        migrate_boot_key_to_keystore()
+    except Exception:
+        pass
+
 
 @dataclass(slots=True)
 class OpenClawWalletRuntimeContext:
@@ -98,6 +117,7 @@ def onboard_openclaw_user_wallet(
     wdk_evm_account_index: int | None = None,
 ) -> OpenClawWalletRuntimeContext:
     """Provision and assemble a runtime-ready wallet context for one OpenClaw user."""
+    ensure_boot_key_migrated_once()
     backend_name = str(backend or settings.agent_wallet_backend).strip().lower()
     effective_sign_only = True if read_only else (
         settings.agent_wallet_sign_only if sign_only is None else sign_only

package/agent-wallet/agent_wallet/sealed_keys.py

@@ -11,6 +11,16 @@ from agent_wallet.wallet_layer.base import WalletBackendError
 
 SEALED_KEYS_FILENAME = "sealed_keys.json"
 
+# Single-entry cache: (boot_key, path, mtime_ns, size) -> secrets. Unsealing
+# runs a KDF, so repeated resolutions in one process must pay it only once.
+# File identity in the key makes rotation (re-seal) self-invalidating.
+_unseal_cache: dict[tuple[str, str, int, int], dict[str, str]] = {}
+
+
+def clear_unseal_cache() -> None:
+    """Drop cached unsealed secrets (wired into config.clear_secret_caches)."""
+    _unseal_cache.clear()
+
 
 def resolve_sealed_keys_path() -> Path:
     """Resolve the encrypted secret bundle path under the OpenClaw home directory."""
@@ -35,11 +45,12 @@ def seal_keys(boot_key: str, secrets: dict[str, str]) -> Path:
     encrypted = encrypt_secret_material(payload, master_key=boot_key)
     path = resolve_sealed_keys_path()
     atomic_write_text(path, encrypted, mode=0o600)
+    clear_unseal_cache()
     return path
 
 
 def unseal_keys(boot_key: str) -> dict[str, str]:
-    """Decrypt all secrets from the sealed file."""
+    """Decrypt all secrets from the sealed file. Memoized by file identity."""
     if not boot_key.strip():
         return {}
 
@@ -47,7 +58,17 @@ def unseal_keys(boot_key: str) -> dict[str, str]:
     if not path.exists():
         return {}
 
-    plaintext = decrypt_secret_material(path.read_text(encoding="utf-8"), master_key=boot_key)
+    try:
+        stat = path.stat()
+    except OSError:
+        return {}
+    cache_key = (boot_key, str(path), stat.st_mtime_ns, stat.st_size)
+    cached = _unseal_cache.get(cache_key)
+    if cached is not None:
+        return dict(cached)
+
+    raw_text = path.read_text(encoding="utf-8")
+    plaintext = decrypt_secret_material(raw_text, master_key=boot_key)
     try:
         payload = json.loads(plaintext)
     except json.JSONDecodeError as exc:
@@ -58,4 +79,39 @@ def unseal_keys(boot_key: str) -> dict[str, str]:
     for key, value in payload.items():
         if isinstance(key, str) and isinstance(value, str):
             secrets[key] = value
+    _maybe_migrate_envelope_kdf(boot_key, secrets, raw_text)
+    _unseal_cache.clear()
+    _unseal_cache[cache_key] = dict(secrets)
     return secrets
+
+
+def _maybe_migrate_envelope_kdf(boot_key: str, secrets: dict[str, str], raw_text: str) -> None:
+    """Lazily re-seal an argon2id file as hkdf-sha256 after a successful unseal.
+
+    Best-effort: any failure leaves the (still readable) argon2id file in
+    place. The boot key is machine-generated high entropy, so hkdf loses no
+    security while dropping ~1s of KDF per cold process. Rollback caveat:
+    pre-hkdf runtimes cannot read the rewritten file — kill switch is
+    AGENT_WALLET_ENVELOPE_KDF_MIGRATION=0.
+    """
+    from agent_wallet.config import envelope_kdf_migration_enabled
+    from agent_wallet.encrypted_storage import (
+        KDF_ARGON2ID,
+        KDF_HKDF_SHA256,
+        _default_write_kdf,
+        envelope_kdf,
+    )
+
+    try:
+        if not envelope_kdf_migration_enabled():
+            return
+        if _default_write_kdf() == KDF_ARGON2ID:
+            return  # forced-argon2id installs must not rewrite in place forever
+        if envelope_kdf(raw_text) != KDF_ARGON2ID:
+            return
+        payload = json.dumps(secrets, indent=2)
+        encrypted = encrypt_secret_material(payload, master_key=boot_key, kdf=KDF_HKDF_SHA256)
+        atomic_write_text(resolve_sealed_keys_path(), encrypted, mode=0o600)
+        clear_unseal_cache()
+    except Exception:
+        pass