@phnx-labs/agents-cli 1.20.23 → 1.20.24

package/dist/lib/secrets/agent.d.ts

@@ -25,6 +25,17 @@
 import type { SecretsBundle } from './bundles.js';
 /** Default lifetime of an unlocked bundle when `--ttl` is not given. */
 export declare const DEFAULT_TTL_MS: number;
+/**
+ * Decide whether a persistent broker should self-heal onto freshly-installed
+ * code (exit so launchd relaunches it). Only when the store is EMPTY: exiting
+ * with bundles still unlocked wipes them from memory, so the next reader falls
+ * back to a direct keychain read and re-prompts for Touch ID. Deferring the
+ * restart until the cache is idle (TTL-expired / screen-locked) means an
+ * in-place `npm i -g` never wipes a hot cache — the new code is adopted at the
+ * next quiet moment instead. See #435: rapid repeated upgrades wiped a hot
+ * cache on every bump and produced a recurring Touch ID storm.
+ */
+export declare function shouldSelfHealForUpgrade(persistent: boolean, storeSize: number, runningVersion: string, onDiskVersion: string): boolean;
 export interface StoredBundle {
     bundle: SecretsBundle;
     env: Record<string, string>;

package/dist/lib/secrets/agent.js

@@ -41,6 +41,25 @@ export const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000; // 24h
 const IDLE_EXIT_MS = 5 * 60 * 1000; // 5m
 /** How often the broker sweeps expired entries. */
 const SWEEP_INTERVAL_MS = 30 * 1000;
+/**
+ * Decide whether a persistent broker should self-heal onto freshly-installed
+ * code (exit so launchd relaunches it). Only when the store is EMPTY: exiting
+ * with bundles still unlocked wipes them from memory, so the next reader falls
+ * back to a direct keychain read and re-prompts for Touch ID. Deferring the
+ * restart until the cache is idle (TTL-expired / screen-locked) means an
+ * in-place `npm i -g` never wipes a hot cache — the new code is adopted at the
+ * next quiet moment instead. See #435: rapid repeated upgrades wiped a hot
+ * cache on every bump and produced a recurring Touch ID storm.
+ */
+export function shouldSelfHealForUpgrade(persistent, storeSize, runningVersion, onDiskVersion) {
+    if (!persistent)
+        return false;
+    if (storeSize > 0)
+        return false; // hot cache — defer rather than wipe unlocks
+    if (runningVersion === 'unknown' || onDiskVersion === 'unknown')
+        return false;
+    return onDiskVersion !== runningVersion;
+}
 function onDarwin() {
     return process.platform === 'darwin';
 }
@@ -307,15 +326,15 @@ export async function runSecretsAgent(opts = {}) {
         for (const [name, e] of store)
             if (now >= e.expiresAt)
                 store.delete(name);
-        // Self-heal: a newer version was installed in place — exit so launchd
-        // relaunches us on the new code. Only meaningful when launchd will restart
-        // us (persistent); a one-off broker just keeps serving until idle.
-        if (persistent) {
-            const onDisk = getCliVersionFresh();
-            if (onDisk !== 'unknown' && runningVersion !== 'unknown' && onDisk !== runningVersion) {
-                shutdown(0); // KeepAlive relaunches on the new code
-                return;
-            }
+        // Self-heal onto a newer in-place install — but ONLY while the store is
+        // empty, so we never wipe live unlocks and force a re-prompt (#435). The
+        // `store.size === 0` short-circuit also keeps getCliVersionFresh (a disk
+        // read) off the hot path. A pending upgrade is adopted at the next idle
+        // sweep instead of immediately.
+        if (store.size === 0 &&
+            shouldSelfHealForUpgrade(persistent, store.size, runningVersion, getCliVersionFresh())) {
+            shutdown(0); // KeepAlive relaunches on the new code
+            return;
         }
         if (store.size === 0) {
             if (!persistent && now - emptySince >= IDLE_EXIT_MS)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.23",
+  "version": "1.20.24",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",