@lamalibre/portlama-agent 1.0.20 → 1.0.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/portlama-agent",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "Tunnel agent for Portlama — manages Chisel tunnel client as a system service",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/commands/panel.js

@@ -24,9 +24,9 @@ const DEFAULT_PANEL_PORT = 9393;
 
 /**
  * @param {string[]} args
- * @param {{ label: string }} options
+ * @param {{ label: string, json?: boolean }} options
  */
-export async function runPanel(args, { label }) {
+export async function runPanel(args, { label, json: globalJson = false }) {
   assertSupportedPlatform();
 
   const config = await loadAgentConfig(label);
@@ -35,9 +35,10 @@ export async function runPanel(args, { label }) {
     process.exit(1);
   }
 
-  const isJson = args.includes('--json');
+  const isJson = globalJson || args.includes('--json');
   const isEnable = args.includes('--enable');
   const isDisable = args.includes('--disable');
+  const isLocalOnly = args.includes('--local-only');
   const isStatus = args.includes('--status') || (!isEnable && !isDisable);
 
   // Parse --port flag
@@ -51,24 +52,24 @@ export async function runPanel(args, { label }) {
   }
 
   if (isEnable) {
-    await enablePanel(label, config, port, isJson);
+    await enablePanel(label, config, port, isJson, isLocalOnly);
   } else if (isDisable) {
-    await disablePanel(label, config, isJson);
+    await disablePanel(label, config, isJson, isLocalOnly);
   } else if (isStatus) {
     await showStatus(label, config, isJson);
   }
 }
 
-async function enablePanel(label, config, port, isJson) {
+async function enablePanel(label, config, port, isJson, localOnly = false) {
   // 1. Check if already enabled
   const loaded = await isPanelLoaded(label);
   if (loaded) {
     if (isJson) {
-      console.log(JSON.stringify({ error: 'Panel service already running' }));
+      console.log(JSON.stringify({ ok: true, alreadyRunning: true, port: config.panelPort || port }));
     } else {
       console.log(chalk.yellow('Panel service is already running.'));
     }
-    process.exit(1);
+    return;
   }
 
   // 2. Generate and write service config
@@ -78,7 +79,24 @@ async function enablePanel(label, config, port, isJson) {
   // 3. Start the panel service
   await loadPanelService(label);
 
-  // 4. Create the tunnel on the panel server
+  // 4. Save panel config
+  config.panelPort = port;
+  config.panelEnabled = true;
+  config.updatedAt = new Date().toISOString();
+  await saveAgentConfig(label, config);
+
+  // 5. If local-only, skip tunnel exposure and chisel restart
+  if (localOnly) {
+    if (isJson) {
+      console.log(JSON.stringify({ ok: true, port }));
+    } else {
+      console.log(chalk.green('\nAgent panel started locally.'));
+      console.log(`  Port: ${chalk.cyan(port)}`);
+    }
+    return;
+  }
+
+  // 6. Create the tunnel on the panel server
   let tunnel;
   try {
     const result = await exposePanelTunnel(config, port);
@@ -87,6 +105,9 @@ async function enablePanel(label, config, port, isJson) {
     // Rollback: stop the panel service we just started
     await unloadPanelService(label);
     await removePanelServiceConfig(label);
+    config.panelEnabled = false;
+    delete config.panelPort;
+    await saveAgentConfig(label, config);
     const msg = err instanceof Error ? err.message : 'Unknown error';
     if (isJson) {
       console.log(JSON.stringify({ error: msg }));
@@ -96,13 +117,7 @@ async function enablePanel(label, config, port, isJson) {
     process.exit(1);
   }
 
-  // 5. Save panel config
-  config.panelPort = port;
-  config.panelEnabled = true;
-  config.updatedAt = new Date().toISOString();
-  await saveAgentConfig(label, config);
-
-  // 6. Update the agent's chisel service (needs new tunnel mapping)
+  // 7. Update the agent's chisel service (needs new tunnel mapping)
   try {
     const { fetchAgentConfig } = await import('../lib/panel-api.js');
     const { generateServiceConfig, writeServiceConfigFile } =
@@ -132,14 +147,16 @@ async function enablePanel(label, config, port, isJson) {
   }
 }
 
-async function disablePanel(label, config, isJson) {
-  // 1. Retract the tunnel
-  try {
-    await retractPanelTunnel(config);
-  } catch (err) {
-    if (!isJson) {
-      const msg = err instanceof Error ? err.message : 'Unknown error';
-      console.log(chalk.yellow(`Warning: Could not retract panel tunnel: ${msg}`));
+async function disablePanel(label, config, isJson, localOnly = false) {
+  // 1. Retract the tunnel (skip in local-only mode)
+  if (!localOnly) {
+    try {
+      await retractPanelTunnel(config);
+    } catch (err) {
+      if (!isJson) {
+        const msg = err instanceof Error ? err.message : 'Unknown error';
+        console.log(chalk.yellow(`Warning: Could not retract panel tunnel: ${msg}`));
+      }
     }
   }
 
@@ -149,21 +166,23 @@ async function disablePanel(label, config, isJson) {
   // 3. Remove service config
   await removePanelServiceConfig(label);
 
-  // 4. Update chisel (remove the panel tunnel mapping)
-  try {
-    const { fetchAgentConfig } = await import('../lib/panel-api.js');
-    const { generateServiceConfig, writeServiceConfigFile } =
-      await import('../lib/service-config.js');
-    const { unloadAgent, loadAgent } = await import('../lib/service.js');
-    const agentConfig = await fetchAgentConfig(config);
-    const serviceContent = generateServiceConfig(agentConfig.chiselArgs, label);
-    await writeServiceConfigFile(serviceContent, label);
-    await unloadAgent(label);
-    await loadAgent(label);
-  } catch (err) {
-    if (!isJson) {
-      const msg = err instanceof Error ? err.message : 'Unknown error';
-      console.log(chalk.yellow(`Warning: Could not restart chisel: ${msg}`));
+  // 4. Update chisel (remove the panel tunnel mapping) — skip in local-only mode
+  if (!localOnly) {
+    try {
+      const { fetchAgentConfig } = await import('../lib/panel-api.js');
+      const { generateServiceConfig, writeServiceConfigFile } =
+        await import('../lib/service-config.js');
+      const { unloadAgent, loadAgent } = await import('../lib/service.js');
+      const agentConfig = await fetchAgentConfig(config);
+      const serviceContent = generateServiceConfig(agentConfig.chiselArgs, label);
+      await writeServiceConfigFile(serviceContent, label);
+      await unloadAgent(label);
+      await loadAgent(label);
+    } catch (err) {
+      if (!isJson) {
+        const msg = err instanceof Error ? err.message : 'Unknown error';
+        console.log(chalk.yellow(`Warning: Could not restart chisel: ${msg}`));
+      }
     }
   }
 
@@ -176,7 +195,7 @@ async function disablePanel(label, config, isJson) {
   if (isJson) {
     console.log(JSON.stringify({ ok: true }));
   } else {
-    console.log(chalk.green('Agent panel retracted.'));
+    console.log(chalk.green(localOnly ? 'Agent panel stopped.' : 'Agent panel retracted.'));
   }
 }
 

package/src/commands/plugin.js

@@ -1,46 +1,12 @@
 import chalk from 'chalk';
-import { execa } from 'execa';
-import { readFile, writeFile, rename, open, mkdir, rm } from 'node:fs/promises';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { assertSupportedPlatform, agentDataDir, agentPluginsFile, agentPluginsDir } from '../lib/platform.js';
+import { assertSupportedPlatform } from '../lib/platform.js';
 import { validateLabel } from '../lib/registry.js';
-
-/**
- * Read the local plugin registry.
- * @param {string} label - Agent label
- */
-async function readLocalPlugins(label) {
-  try {
-    const raw = await readFile(agentPluginsFile(label), 'utf-8');
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.plugins) ? parsed : { plugins: [] };
-  } catch (err) {
-    if (err.code === 'ENOENT') {
-      return { plugins: [] };
-    }
-    throw new Error(`Failed to read local plugin registry: ${err.message}`);
-  }
-}
-
-/**
- * Write the local plugin registry atomically.
- * @param {string} label - Agent label
- * @param {object} data
- */
-async function writeLocalPlugins(label, data) {
-  const pluginsFile = agentPluginsFile(label);
-  const tmpPath = `${pluginsFile}.tmp`;
-
-  const content = JSON.stringify(data, null, 2) + '\n';
-  await writeFile(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
-
-  const fd = await open(tmpPath, 'r');
-  await fd.sync();
-  await fd.close();
-
-  await rename(tmpPath, pluginsFile);
-}
+import {
+  readAgentPluginRegistry,
+  installAgentPlugin,
+  uninstallAgentPlugin,
+  updateAgentPlugin,
+} from '../lib/agent-plugins.js';
 
 /**
  * Install a plugin locally on the agent.
@@ -48,71 +14,14 @@ async function writeLocalPlugins(label, data) {
  * @param {string} packageName
  */
 async function installLocal(label, packageName) {
-  if (!packageName.startsWith('@lamalibre/')) {
-    console.error(chalk.red('  Only @lamalibre/ scoped packages are allowed'));
-    process.exit(1);
-  }
-
-  const registry = await readLocalPlugins(label);
-  const existing = registry.plugins.find((p) => p.packageName === packageName);
-  if (existing) {
-    console.log(chalk.yellow(`  Plugin "${packageName}" is already installed`));
-    return;
-  }
-
   console.log(chalk.cyan(`  Installing ${packageName}...`));
-
-  // Ensure agent dir has a package.json so npm installs locally
-  const agentDir = agentDataDir(label);
-  await mkdir(agentDir, { recursive: true, mode: 0o700 });
-  const agentPkgJson = path.join(agentDir, 'package.json');
-  try {
-    await readFile(agentPkgJson, 'utf-8');
-  } catch (err) {
-    if (err.code === 'ENOENT') {
-      await writeFile(agentPkgJson, '{"private":true}\n', { encoding: 'utf-8', mode: 0o600 });
-    }
-  }
-
   try {
-    await execa('npm', ['install', '--ignore-scripts', packageName], { cwd: agentDir, stdio: 'inherit' });
+    const entry = await installAgentPlugin(label, packageName);
+    console.log(chalk.green(`  Plugin "${entry.name}" installed`));
   } catch (err) {
-    console.error(chalk.red(`  Failed to install: ${err.message}`));
-    process.exit(1);
-  }
-
-  // Read the plugin manifest
-  let manifest;
-  try {
-    const require = createRequire(path.join(agentDir, '/'));
-    const manifestPath = require.resolve(`${packageName}/portlama-plugin.json`);
-    const manifestRaw = await readFile(manifestPath, 'utf-8');
-    manifest = JSON.parse(manifestRaw);
-  } catch {
-    console.log(chalk.yellow('  Warning: No portlama-plugin.json found — registering with package name only'));
-    manifest = { name: packageName.replace('@lamalibre/', ''), version: 'unknown' };
-  }
-
-  // Validate manifest name to prevent path traversal
-  if (!/^[a-z0-9-]+$/.test(manifest.name)) {
-    console.error(chalk.red(`  Invalid plugin name: "${manifest.name}"`));
+    console.error(chalk.red(`  ${err.message}`));
     process.exit(1);
   }
-
-  // Create local plugin directory
-  const pluginDir = path.join(agentPluginsDir(label), manifest.name);
-  await mkdir(pluginDir, { recursive: true, mode: 0o700 });
-
-  registry.plugins.push({
-    name: manifest.name,
-    packageName,
-    version: manifest.version,
-    installedAt: new Date().toISOString(),
-    status: 'installed',
-  });
-
-  await writeLocalPlugins(label, registry);
-  console.log(chalk.green(`  Plugin "${manifest.name}" installed`));
 }
 
 /**
@@ -121,38 +30,24 @@ async function installLocal(label, packageName) {
  * @param {string} nameOrPackage
  */
 async function uninstallLocal(label, nameOrPackage) {
-  const registry = await readLocalPlugins(label);
-  const index = registry.plugins.findIndex(
+  // Resolve name from registry if a package name was given
+  const registry = await readAgentPluginRegistry(label);
+  const plugin = registry.plugins.find(
     (p) => p.name === nameOrPackage || p.packageName === nameOrPackage,
   );
-
-  if (index === -1) {
+  if (!plugin) {
     console.error(chalk.red(`  Plugin "${nameOrPackage}" not found`));
     process.exit(1);
   }
 
-  const plugin = registry.plugins[index];
-
-  if (!plugin.packageName.startsWith('@lamalibre/')) {
-    console.error(chalk.red('  Registry corruption: invalid package scope'));
-    process.exit(1);
-  }
-
   console.log(chalk.cyan(`  Uninstalling ${plugin.packageName}...`));
-
   try {
-    await execa('npm', ['uninstall', plugin.packageName], { cwd: agentDataDir(label), stdio: 'inherit' });
+    await uninstallAgentPlugin(label, plugin.name);
+    console.log(chalk.green(`  Plugin "${plugin.name}" uninstalled`));
   } catch (err) {
-    console.log(chalk.yellow(`  npm uninstall warning: ${err.message}`));
+    console.error(chalk.red(`  ${err.message}`));
+    process.exit(1);
   }
-
-  // Remove local plugin directory
-  const pluginDir = path.join(agentPluginsDir(label), plugin.name);
-  await rm(pluginDir, { recursive: true, force: true }).catch(() => {});
-
-  registry.plugins.splice(index, 1);
-  await writeLocalPlugins(label, registry);
-  console.log(chalk.green(`  Plugin "${plugin.name}" uninstalled`));
 }
 
 /**
@@ -161,45 +56,14 @@ async function uninstallLocal(label, nameOrPackage) {
  * @param {string} nameOrPackage
  */
 async function updateLocal(label, nameOrPackage) {
-  const registry = await readLocalPlugins(label);
-  const plugin = registry.plugins.find(
-    (p) => p.name === nameOrPackage || p.packageName === nameOrPackage,
-  );
-
-  if (!plugin) {
-    console.error(chalk.red(`  Plugin "${nameOrPackage}" not found`));
-    process.exit(1);
-  }
-
-  if (!plugin.packageName.startsWith('@lamalibre/')) {
-    console.error(chalk.red('  Registry corruption: invalid package scope'));
-    process.exit(1);
-  }
-
-  console.log(chalk.cyan(`  Updating ${plugin.packageName}...`));
-
-  const agentDir = agentDataDir(label);
+  console.log(chalk.cyan(`  Updating ${nameOrPackage}...`));
   try {
-    await execa('npm', ['install', '--ignore-scripts', plugin.packageName], { cwd: agentDir, stdio: 'inherit' });
+    const plugin = await updateAgentPlugin(label, nameOrPackage);
+    console.log(chalk.green(`  Plugin "${plugin.name}" updated to v${plugin.version}`));
   } catch (err) {
-    console.error(chalk.red(`  Failed to update: ${err.message}`));
+    console.error(chalk.red(`  ${err.message}`));
     process.exit(1);
   }
-
-  // Re-read manifest to capture the updated version
-  try {
-    const require = createRequire(path.join(agentDir, '/'));
-    const manifestPath = require.resolve(`${plugin.packageName}/portlama-plugin.json`);
-    const manifestRaw = await readFile(manifestPath, 'utf-8');
-    const manifest = JSON.parse(manifestRaw);
-    plugin.version = manifest.version || plugin.version;
-  } catch {
-    // Manifest may not exist — keep existing version
-  }
-
-  plugin.updatedAt = new Date().toISOString();
-  await writeLocalPlugins(label, registry);
-  console.log(chalk.green(`  Plugin "${plugin.name}" updated`));
 }
 
 /**
@@ -207,7 +71,7 @@ async function updateLocal(label, nameOrPackage) {
  * @param {string} label - Agent label
  */
 async function showStatus(label) {
-  const registry = await readLocalPlugins(label);
+  const registry = await readAgentPluginRegistry(label);
   const b = chalk.bold;
   const c = chalk.cyan;
   const d = chalk.dim;

package/src/commands/setup.js

@@ -7,7 +7,6 @@ import { Listr } from 'listr2';
 import chalk from 'chalk';
 import {
   assertSupportedPlatform,
-  isDarwin,
   CHISEL_BIN_DIR,
   AGENT_DIR,
   agentDataDir,
@@ -161,9 +160,7 @@ async function runTokenSetup(flags) {
 
   console.log('');
   console.log(chalk.bold('  Portlama Agent Setup (Token-Based Enrollment)'));
-  console.log(chalk.dim(isDarwin()
-    ? '  Connect this Mac to your Portlama server using a Keychain-bound certificate.'
-    : '  Connect this machine to your Portlama server using a certificate.'));
+  console.log(chalk.dim('  Connect this machine to your Portlama server using a certificate.'));
   console.log('');
 
   let panelUrl = flags.panelUrl;
@@ -185,7 +182,6 @@ async function runTokenSetup(flags) {
     explicitLabel: flags.label,
     agentLabel: null,
     resolvedLabel: null,
-    keychainIdentity: null,
     p12Path: null,
     p12Password: null,
     chiselVersion: null,
@@ -247,20 +243,7 @@ async function runTokenSetup(flags) {
         },
       },
       {
-        title: 'Requesting macOS login password',
-        skip: () => !isDarwin() && 'Not macOS',
-        task: async (_ctx, task) => {
-          task.output = chalk.dim('Required to authorize curl access to the Keychain certificate');
-          ctx._keychainPassword = await prompt('macOS login password (for Keychain access)');
-          if (!ctx._keychainPassword) {
-            throw new Error('Keychain password is required on macOS to grant curl access to the certificate.');
-          }
-          task.output = 'Password received';
-        },
-        rendererOptions: { persistentOutput: true },
-      },
-      {
-        title: isDarwin() ? 'Importing certificate into Keychain' : 'Storing certificate',
+        title: 'Storing certificate',
         task: async (_ctx, task) => {
           const result = await storeEnrolledCert(
             ctx._keyData.keyPath,
@@ -268,16 +251,10 @@ async function runTokenSetup(flags) {
             ctx._caCertPem,
             ctx.resolvedLabel,
             console,
-            { keychainPassword: ctx._keychainPassword },
           );
-          if (result.identity) {
-            ctx.keychainIdentity = result.identity;
-            task.output = `Identity "${result.identity}" imported (non-extractable)`;
-          } else {
-            ctx.p12Path = result.p12Path;
-            ctx.p12Password = result.p12Password;
-            task.output = `Certificate stored at ${result.p12Path}`;
-          }
+          ctx.p12Path = result.p12Path;
+          ctx.p12Password = result.p12Password;
+          task.output = `Certificate stored at ${result.p12Path}`;
         },
         rendererOptions: { persistentOutput: true },
       },
@@ -291,9 +268,7 @@ async function runTokenSetup(flags) {
       {
         title: 'Verifying panel connectivity',
         task: async (_ctx, task) => {
-          const authConfig = ctx.keychainIdentity
-            ? { panelUrl: ctx.panelUrl, authMethod: 'keychain', keychainIdentity: ctx.keychainIdentity }
-            : { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
+          const authConfig = { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
           const health = await fetchHealth(authConfig);
           task.output = `Panel is reachable (status: ${health.status || 'ok'})`;
         },
@@ -315,9 +290,7 @@ async function runTokenSetup(flags) {
       {
         title: 'Fetching tunnel configuration',
         task: async (_ctx, task) => {
-          const authConfig = ctx.keychainIdentity
-            ? { panelUrl: ctx.panelUrl, authMethod: 'keychain', keychainIdentity: ctx.keychainIdentity }
-            : { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
+          const authConfig = { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
 
           const agentConfig = await fetchAgentConfig(authConfig);
           ctx.domain = agentConfig.domain;
@@ -376,30 +349,24 @@ async function runTokenSetup(flags) {
         task: async () => {
           const configData = {
             panelUrl: ctx.panelUrl,
+            authMethod: 'p12',
+            p12Path: ctx.p12Path,
+            p12Password: ctx.p12Password,
             agentLabel: ctx.agentLabel,
             domain: ctx.domain,
             chiselVersion: ctx.chiselVersion,
             setupAt: new Date().toISOString(),
           };
 
-          if (ctx.keychainIdentity) {
-            configData.authMethod = 'keychain';
-            configData.keychainIdentity = ctx.keychainIdentity;
-          } else {
-            configData.authMethod = 'p12';
-            configData.p12Path = ctx.p12Path;
-            configData.p12Password = ctx.p12Password;
-          }
-
           await saveAgentConfig(ctx.resolvedLabel, configData);
 
           // Add or update registry entry
           await upsertAgent({
             label: ctx.resolvedLabel,
             panelUrl: ctx.panelUrl,
-            authMethod: configData.authMethod,
-            p12Path: configData.p12Path || null,
-            keychainIdentity: configData.keychainIdentity || null,
+            authMethod: 'p12',
+            p12Path: ctx.p12Path,
+            keychainIdentity: null,
             agentLabel: ctx.agentLabel,
             domain: ctx.domain,
             chiselVersion: ctx.chiselVersion,
@@ -454,7 +421,6 @@ async function runTokenSetupJson(flags) {
     explicitLabel: flags.label,
     agentLabel: null,
     resolvedLabel: null,
-    keychainIdentity: null,
     p12Path: null,
     p12Password: null,
     chiselVersion: null,
@@ -513,7 +479,7 @@ async function runTokenSetupJson(flags) {
     },
     {
       key: 'import_cert',
-      title: isDarwin() ? 'Importing certificate into Keychain' : 'Storing certificate',
+      title: 'Storing certificate',
       fn: async () => {
         const result = await storeEnrolledCert(
           ctx._keyData.keyPath,
@@ -522,12 +488,8 @@ async function runTokenSetupJson(flags) {
           ctx.resolvedLabel,
           { log: () => {}, warn: () => {}, error: () => {} },
         );
-        if (result.identity) {
-          ctx.keychainIdentity = result.identity;
-        } else {
-          ctx.p12Path = result.p12Path;
-          ctx.p12Password = result.p12Password;
-        }
+        ctx.p12Path = result.p12Path;
+        ctx.p12Password = result.p12Password;
       },
     },
     {
@@ -542,9 +504,7 @@ async function runTokenSetupJson(flags) {
       key: 'verify_connectivity',
       title: 'Verifying panel connectivity',
       fn: async () => {
-        const authConfig = ctx.keychainIdentity
-          ? { panelUrl: ctx.panelUrl, authMethod: 'keychain', keychainIdentity: ctx.keychainIdentity }
-          : { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
+        const authConfig = { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
         await fetchHealth(authConfig);
       },
     },
@@ -560,9 +520,7 @@ async function runTokenSetupJson(flags) {
       key: 'fetch_config',
       title: 'Fetching tunnel configuration',
       fn: async () => {
-        const authConfig = ctx.keychainIdentity
-          ? { panelUrl: ctx.panelUrl, authMethod: 'keychain', keychainIdentity: ctx.keychainIdentity }
-          : { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
+        const authConfig = { panelUrl: ctx.panelUrl, authMethod: 'p12', p12Path: ctx.p12Path, p12Password: ctx.p12Password };
 
         const agentConfig = await fetchAgentConfig(authConfig);
         ctx.domain = agentConfig.domain;
@@ -619,29 +577,23 @@ async function runTokenSetupJson(flags) {
       fn: async () => {
         const configData = {
           panelUrl: ctx.panelUrl,
+          authMethod: 'p12',
+          p12Path: ctx.p12Path,
+          p12Password: ctx.p12Password,
           agentLabel: ctx.agentLabel,
           domain: ctx.domain,
           chiselVersion: ctx.chiselVersion,
           setupAt: new Date().toISOString(),
         };
 
-        if (ctx.keychainIdentity) {
-          configData.authMethod = 'keychain';
-          configData.keychainIdentity = ctx.keychainIdentity;
-        } else {
-          configData.authMethod = 'p12';
-          configData.p12Path = ctx.p12Path;
-          configData.p12Password = ctx.p12Password;
-        }
-
         await saveAgentConfig(ctx.resolvedLabel, configData);
 
         await upsertAgent({
           label: ctx.resolvedLabel,
           panelUrl: ctx.panelUrl,
-          authMethod: configData.authMethod,
-          p12Path: configData.p12Path || null,
-          keychainIdentity: configData.keychainIdentity || null,
+          authMethod: 'p12',
+          p12Path: ctx.p12Path,
+          keychainIdentity: null,
           agentLabel: ctx.agentLabel,
           domain: ctx.domain,
           chiselVersion: ctx.chiselVersion,
@@ -664,12 +616,17 @@ async function runTokenSetupJson(flags) {
     process.exit(1);
   }
 
+  // The p12Password transits via stdout pipe to the parent process (Tauri desktop app),
+  // which stores it in the OS credential store. Pipes are not visible in process listings.
+  // This is the same trust boundary as the server provisioner's SCP-based P12 transfer.
   emitJson({
     event: 'complete',
     agent: {
       label: ctx.resolvedLabel,
       panelUrl: ctx.panelUrl,
-      authMethod: ctx.keychainIdentity ? 'keychain' : 'p12',
+      authMethod: 'p12',
+      p12Path: ctx.p12Path,
+      p12Password: ctx.p12Password,
       domain: ctx.domain,
       chiselVersion: ctx.chiselVersion,
     },
@@ -690,9 +647,7 @@ async function runP12Setup(options = {}) {
 
   console.log('');
   console.log(chalk.bold('  Portlama Agent Setup'));
-  console.log(chalk.dim(isDarwin()
-    ? '  Connect this Mac to your Portlama server.'
-    : '  Connect this machine to your Portlama server.'));
+  console.log(chalk.dim('  Connect this machine to your Portlama server.'));
   console.log('');
   console.log(chalk.dim('  The admin must generate an agent certificate from the panel first:'));
   console.log(chalk.dim('    Panel → Certificates → Agent Certificates → Generate'));