@phnx-labs/agents-cli 1.20.28 → 1.20.30

package/dist/commands/computer-actions.js

@@ -170,11 +170,15 @@ function emit(result, json, human) {
         console.log(human());
     }
 }
-// Add the shared --pid/--bundle target options to a verb.
+// Add the shared --pid/--bundle/--host target options to a verb. `--host` routes
+// the verb at a remote Windows device: the `computer` preAction hook hydrates
+// COMPUTER_HELPER_TCP from the tunnel `start --host` recorded, so withClient's
+// openComputerClient() transparently selects the TCP transport.
 function addTargetOpts(cmd) {
     return cmd
         .option('--bundle <id>', 'Bundle id of the target app (default: frontmost allow-listed app)')
-        .option('--pid <n>', 'Target pid directly (overrides --bundle)', (v) => parseInt(v, 10));
+        .option('--pid <n>', 'Target pid directly (overrides --bundle)', (v) => parseInt(v, 10))
+        .option('--host <device>', 'Drive a remote Windows device (requires `agents computer start --host <device>` first)');
 }
 // Add the shared --id/--x/--y element-or-coords options to a verb.
 function addElementOrCoordOpts(cmd) {

package/dist/commands/computer.d.ts

@@ -1,5 +1,17 @@
 import { Command } from 'commander';
 import { resolveHelperExec, resolveSocketPath } from '../lib/computer-rpc.js';
+/**
+ * Pure platform gate. The computer subsystem is macOS-only for LOCAL driving
+ * (Accessibility / launchctl). It is NOT blocked off macOS when a remote daemon
+ * is reachable — either a configured TCP endpoint (COMPUTER_HELPER_TCP, e.g. a
+ * Windows daemon over a tunnel) or a `--host <device>` remote invocation. Kept
+ * pure so the gating rule is unit-testable without a live command tree.
+ */
+export declare function shouldBlockOffPlatform(opts: {
+    platform: NodeJS.Platform;
+    tcpConfigured: boolean;
+    host?: string;
+}): boolean;
 export declare function registerComputerCommand(program: Command): void;
 export declare function registerComputerSubcommands(program: Command): void;
 export { resolveHelperExec as resolveHelperPath };

package/dist/commands/computer.js

@@ -3,7 +3,8 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { registerCommandGroups } from '../lib/help.js';
-import { openComputerClient, resolveHelperApp, resolveHelperExec, resolveSocketPath, resolveLogPath, resolvePolicyPath, resolvePeersPath, loadComputerAllowList, loadDefaultPeers, writeComputerPolicy, writeComputerPeers, } from '../lib/computer-rpc.js';
+import { openComputerClient, resolveHelperApp, resolveHelperExec, resolveSocketPath, resolveLogPath, resolvePolicyPath, resolvePeersPath, resolveTcpEndpoint, loadComputerAllowList, loadDefaultPeers, writeComputerPolicy, writeComputerPeers, } from '../lib/computer-rpc.js';
+import { setupRemoteHelper, startRemoteTunnel, stopRemoteHelper, hydrateRemoteEnvFromState, } from '../lib/ssh-tunnel.js';
 import { registerActionCommands, withClient, unwrap, pickTarget } from './computer-actions.js';
 // Help groups — mirror `agents browser` so the mental model carries over.
 const COMPUTER_HELP_GROUPS = [
@@ -12,15 +13,44 @@ const COMPUTER_HELP_GROUPS = [
     { title: 'Observe', names: ['apps', 'describe', 'screenshot', 'get-text'] },
     { title: 'Interact', names: ['launch', 'raise', 'click', 'right-click', 'type', 'type-text', 'key', 'drag', 'scroll', 'ax-action', 'focus', 'wait'] },
 ];
+// Subcommands that manage the `--host` remote path themselves (provisioning /
+// tunnel lifecycle). Every other `--host`-bearing subcommand is a plain verb
+// that just needs the TCP endpoint hydrated before it runs.
+const REMOTE_LIFECYCLE = new Set(['setup', 'start', 'stop']);
+/**
+ * Pure platform gate. The computer subsystem is macOS-only for LOCAL driving
+ * (Accessibility / launchctl). It is NOT blocked off macOS when a remote daemon
+ * is reachable — either a configured TCP endpoint (COMPUTER_HELPER_TCP, e.g. a
+ * Windows daemon over a tunnel) or a `--host <device>` remote invocation. Kept
+ * pure so the gating rule is unit-testable without a live command tree.
+ */
+export function shouldBlockOffPlatform(opts) {
+    if (opts.platform === 'darwin')
+        return false;
+    if (opts.tcpConfigured)
+        return false; // remote (Windows) daemon over a tunnel
+    if (opts.host)
+        return false; // remote path resolves its own endpoint
+    return true;
+}
 export function registerComputerCommand(program) {
     const computer = program
         .command('computer')
-        .description('Drive macOS apps via Accessibility — list, screenshot, click, type (macOS only)')
-        // The whole subsystem is macOS Accessibility / TCC. Fail fast with a clear
-        // message on other platforms instead of a downstream ENOENT / launchctl error.
-        .hook('preAction', () => {
-        if (process.platform !== 'darwin') {
-            console.error('agents computer: macOS only — it drives apps via the macOS Accessibility API.');
+        .description('Drive macOS apps via Accessibility, or a remote Windows host with --host — list, screenshot, click, type')
+        // The whole subsystem is macOS Accessibility / TCC for LOCAL driving. Off
+        // macOS it still works against a remote daemon (COMPUTER_HELPER_TCP set, or
+        // a `--host <device>` invocation). Fail fast with a clear message only when
+        // neither remote path is available, instead of a downstream launchctl error.
+        .hook('preAction', async (_thisCommand, actionCommand) => {
+        const host = actionCommand.opts().host;
+        // Verbs with --host reconnect to the tunnel `start --host` recorded; this
+        // sets COMPUTER_HELPER_TCP so the shared client picks the TCP transport.
+        if (host && !REMOTE_LIFECYCLE.has(actionCommand.name())) {
+            hydrateRemoteEnvFromState(host);
+        }
+        if (shouldBlockOffPlatform({ platform: process.platform, tcpConfigured: resolveTcpEndpoint() != null, host })) {
+            console.error('agents computer: macOS only for local driving — it uses the macOS Accessibility API.');
+            console.error('For a remote Windows host: register it with `agents devices`, then use --host (or set COMPUTER_HELPER_TCP).');
             process.exit(1);
         }
     });
@@ -94,6 +124,7 @@ function registerScreenshotCommand(program) {
         .description('Capture a window (default: largest), enumerate windows (--list), or the whole display (--display)')
         .option('--bundle <id>', 'Bundle id to capture (default: frontmost allow-listed app)')
         .option('--pid <n>', 'Target pid directly (overrides --bundle)', (v) => parseInt(v, 10))
+        .option('--host <device>', 'Drive a remote Windows device (requires `agents computer start --host <device>` first)')
         .option('--list', 'List the app\'s windows (id/title/layer/bounds) instead of capturing — reveals modals/popups')
         .option('--window-id <n>', 'Capture a specific window by id (from --list)', (v) => parseInt(v, 10))
         .option('--display', 'Capture the whole display the app is on (composites stacked modals)')
@@ -181,8 +212,23 @@ function registerSetupCommand(program) {
     program
         .command('setup')
         .alias('install-helper')
-        .description('Install ComputerHelper.app to /Applications/ (does NOT activate the daemon — run `start` to enable)')
-        .action(async () => {
+        .description('Install the helper — locally to /Applications/ (macOS), or to a remote Windows host with --host')
+        .option('--host <device>', 'Provision a remote Windows device (push the exe + register a LOGON task) instead of installing locally')
+        .action(async (opts) => {
+        if (opts.host) {
+            try {
+                const { target, taskName } = await setupRemoteHelper(opts.host);
+                console.log(`pushed computer-helper-win.exe to ${target}`);
+                console.log(`registered LOGON scheduled task "${taskName}" (interactive session, started now)`);
+                console.log('');
+                console.log(`Next:  agents computer start --host ${opts.host}`);
+            }
+            catch (err) {
+                console.error(`error: ${err.message}`);
+                process.exit(1);
+            }
+            return;
+        }
         const srcApp = resolveHelperApp();
         if (!srcApp || !fs.existsSync(srcApp)) {
             console.error('helper not built. Run: ./packages/computer-helper/scripts/build.sh debug');
@@ -266,8 +312,24 @@ function registerSetupCommand(program) {
 function registerStartCommand(program) {
     program
         .command('start')
-        .description('Activate the helper daemon (loads launchd, opens socket)')
-        .action(async () => {
+        .description('Activate the helper daemon — local launchd (macOS) or a remote Windows tunnel with --host')
+        .option('--host <device>', 'Open a tunnel to the remote Windows daemon and record it for --host verbs')
+        .action(async (opts) => {
+        if (opts.host) {
+            try {
+                const state = await startRemoteTunnel(opts.host);
+                console.log(`tunnel: 127.0.0.1:${state.localPort} -> ${state.target} (127.0.0.1:${state.remotePort})`);
+                console.log(`daemon: answering (ssh pid ${state.tunnelPid})`);
+                console.log('');
+                console.log(`Drive it:  agents computer apps --host ${opts.host}`);
+                console.log(`Stop:      agents computer stop --host ${opts.host}`);
+            }
+            catch (err) {
+                console.error(`error: ${err.message}`);
+                process.exit(1);
+            }
+            return;
+        }
         const home = os.homedir();
         const plistPath = path.join(home, 'Library', 'LaunchAgents', `${HELPER_LABEL}.plist`);
         const socketPath = resolveSocketPath();
@@ -440,8 +502,21 @@ function registerReloadCommand(program) {
 function registerStopCommand(program) {
     program
         .command('stop')
-        .description('Deactivate the helper daemon (bootout, removes socket)')
-        .action(async () => {
+        .description('Deactivate the helper daemon — local launchd (macOS) or a remote Windows tunnel with --host')
+        .option('--host <device>', 'Tear down the remote tunnel and unregister the scheduled task')
+        .action(async (opts) => {
+        if (opts.host) {
+            try {
+                const { tunnelKilled, taskRemoved } = await stopRemoteHelper(opts.host);
+                console.log(`tunnel: ${tunnelKilled ? 'closed' : 'not running'}`);
+                console.log(`task:   ${taskRemoved ? 'unregistered' : 'not removed (device offline?)'}`);
+            }
+            catch (err) {
+                console.error(`error: ${err.message}`);
+                process.exit(1);
+            }
+            return;
+        }
         const home = os.homedir();
         const plistPath = path.join(home, 'Library', 'LaunchAgents', `${HELPER_LABEL}.plist`);
         const socketPath = resolveSocketPath();

package/dist/commands/exec.js

@@ -324,11 +324,12 @@ export function registerRunCommand(program) {
             process.stderr.write(chalk.gray(`[loop] stopped: ${result.stoppedBy} after ${result.iterations} iteration(s), ${result.tokens} tokens\n`));
             process.exit(loopExitCode(result.stoppedBy));
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, defaultModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, defaultModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
             import('../lib/secrets/bundles.js'),
+            import('../lib/secrets/remote.js'),
             import('../lib/rotate.js'),
             import('../lib/versions.js'),
             import('../lib/plugins.js'),
@@ -776,17 +777,28 @@ export function registerRunCommand(program) {
         // ones. Any resolution failure (missing keychain item, blocked exec ref)
         // aborts before spawn so the agent never sees a partial env.
         let secretsEnv = {};
-        for (const bundleName of options.secrets) {
+        for (const bundleRef of options.secrets) {
             try {
-                const { bundle, env: bundleEnv } = readAndResolveBundleEnv(bundleName, { caller: `agent ${agent}` });
-                const entries = describeBundle(bundle);
-                const counts = {};
-                for (const e of entries) {
-                    counts[e.kind] = (counts[e.kind] || 0) + 1;
+                const { bundle: bundleName, host } = splitBundleRef(bundleRef);
+                if (host) {
+                    // Remote bundle (`bundle@host`): resolve over SSH and inject
+                    // ephemerally — values never touch this machine's keychain or disk.
+                    const target = await resolveSshTarget(host);
+                    const bundleEnv = await remoteResolveEnv(target, bundleName);
+                    console.log(chalk.gray(`[secrets] Resolved ${bundleName}@${host}: ${Object.keys(bundleEnv).length} keys (remote, ephemeral)`));
+                    secretsEnv = { ...secretsEnv, ...bundleEnv };
+                }
+                else {
+                    const { bundle, env: bundleEnv } = readAndResolveBundleEnv(bundleName, { caller: `agent ${agent}` });
+                    const entries = describeBundle(bundle);
+                    const counts = {};
+                    for (const e of entries) {
+                        counts[e.kind] = (counts[e.kind] || 0) + 1;
+                    }
+                    const breakdown = Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(', ');
+                    console.log(chalk.gray(`[secrets] Resolved ${bundleName}: ${entries.length} keys (${breakdown})`));
+                    secretsEnv = { ...secretsEnv, ...bundleEnv };
                 }
-                const breakdown = Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(', ');
-                console.log(chalk.gray(`[secrets] Resolved ${bundleName}: ${entries.length} keys (${breakdown})`));
-                secretsEnv = { ...secretsEnv, ...bundleEnv };
             }
             catch (err) {
                 console.error(chalk.red(err.message));

package/dist/commands/inspect.js

@@ -1217,7 +1217,7 @@ function safeStat(p) {
     }
 }
 const SESSION_AGENTS = new Set([
-    'claude', 'codex', 'gemini', 'opencode', 'openclaw', 'rush', 'hermes', 'grok', 'kimi',
+    'claude', 'codex', 'gemini', 'opencode', 'openclaw', 'rush', 'hermes', 'grok', 'kimi', 'droid',
 ]);
 function safeCountSessions(agent) {
     if (!SESSION_AGENTS.has(agent))

package/dist/commands/models.js

@@ -11,7 +11,7 @@ import { homeDir } from '../lib/platform/index.js';
 import { resolveAgentName, formatAgentError, agentLabel, } from '../lib/agents.js';
 import { listInstalledVersions, getGlobalDefault, resolveVersion, resolveVersionAlias } from '../lib/versions.js';
 import { getModelCatalog, locateModelSource } from '../lib/models.js';
-const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'gemini', 'opencode', 'cursor', 'openclaw'];
+const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'gemini', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi'];
 /**
  * Agents that don't necessarily install under ~/.agents/versions (cursor ships
  * via a curl script). For these, fall back to the PATH binary and synthesize
@@ -72,8 +72,14 @@ async function resolveTargets(agentSpec) {
             if (!version && PATH_ONLY_AGENTS.has(agent)) {
                 version = fallbackPathVersion(agent);
             }
-            if (version)
+            if (version) {
                 targets.push({ agent, version, isDefault: true });
+            }
+            else {
+                // Surface the gap instead of silently dropping the agent -- an
+                // uninstalled model-capable agent should tell the user how to add it.
+                console.error(chalk.gray(`${agentLabel(agent)}: not installed (run 'agents add ${agent}@latest')`));
+            }
         }
         if (targets.length === 0) {
             console.error(chalk.yellow('No installed agent versions found. Run `agents add claude@latest` to install one.'));

package/dist/commands/secrets.js

@@ -10,6 +10,7 @@ import chalk from 'chalk';
 import * as fs from 'fs';
 import { spawnSync } from 'child_process';
 import { SSH_TARGET_RE, assertValidSshTarget } from '../lib/ssh-exec.js';
+import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, resolveSshTarget, } from '../lib/secrets/remote.js';
 import { bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, renameBundle, rotateBundleSecret, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, } from '../lib/secrets/bundles.js';
 import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
 import { assertOpAvailable, createPasswordItem, deleteItemByTitle, extractSecrets, itemExistsByTitle, listItems, listVaults, } from '../lib/onepassword.js';
@@ -160,6 +161,47 @@ export function bundleEnvToDotenv(env) {
     }
     return lines.join('\n') + '\n';
 }
+/**
+ * Browse `agents secrets <args>` on one or more remote hosts over SSH and print
+ * each host's stdout verbatim (lossless — no parsing). With >1 host the output
+ * is grouped under a `── <host> ──` header. `tty` forces an interactive ssh
+ * session (run sequentially) so a remote Touch-ID / passphrase prompt can
+ * surface (e.g. `view --reveal`); otherwise hosts are queried in parallel.
+ * Exits non-zero if any host fails.
+ */
+async function browseRemote(targets, args, tty) {
+    const multi = targets.length > 1;
+    let failures = 0;
+    const render = (name, res) => {
+        if (multi)
+            console.log(chalk.bold.cyan(`\n── ${name} ──`));
+        if (res.code === 0) {
+            if (res.stdout)
+                process.stdout.write(res.stdout.endsWith('\n') ? res.stdout : `${res.stdout}\n`);
+            if (res.stderr.trim())
+                process.stderr.write(chalk.gray(res.stderr));
+        }
+        else {
+            failures++;
+            const msg = (res.stderr || res.stdout || '').trim();
+            const why = res.timedOut ? 'timed out' : res.code === null ? 'ssh failed' : `exit ${res.code}`;
+            console.error(chalk.red(`${name}: ${why}${msg ? `: ${msg}` : ''}`));
+        }
+    };
+    if (tty) {
+        for (const t of targets) {
+            const target = await resolveSshTarget(t);
+            render(t, remoteSecretsRaw(target, args, { tty: true }));
+        }
+    }
+    else {
+        const resolved = await Promise.all(targets.map((t) => resolveSshTarget(t)));
+        const results = resolved.map((target) => remoteSecretsRaw(target, args));
+        targets.forEach((t, i) => render(t, results[i]));
+    }
+    if (failures > 0)
+        process.exit(1);
+}
 /** Strip ANSI escape sequences so padding can be computed on visible width. */
 function visibleWidth(s) {
     // eslint-disable-next-line no-control-regex
@@ -450,8 +492,15 @@ export function registerSecretsCommands(program) {
     cmd
         .command('list')
         .alias('ls')
-        .description('List configured secrets bundles')
-        .action(async () => {
+        .description('List configured secrets bundles (use --host/--hosts to list bundles on other machines over SSH)')
+        .option('--host <target>', 'List bundles on a remote host over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
+        .option('--hosts <list>', 'Comma-separated hosts to list in one shot, e.g. yosemite-s0,yosemite-s1')
+        .action(async (opts) => {
+        const targets = parseHostsOption(opts);
+        if (targets.length > 0) {
+            await browseRemote(targets, ['list'], false);
+            return;
+        }
         const bundles = listBundles();
         if (bundles.length === 0) {
             console.log(chalk.gray('No secrets bundles configured.'));
@@ -481,8 +530,28 @@ export function registerSecretsCommands(program) {
         .description('Show a bundle. Keychain values are masked by default — pass --reveal to see them.')
         .option('--reveal', 'Print keychain-backed values in the clear (TTY only unless --plaintext)')
         .option('--plaintext', 'Allow --reveal in non-interactive shells (use with care)')
+        .option('--host <target>', 'Show a bundle on a remote host over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
+        .option('--hosts <list>', 'Comma-separated hosts to show in one shot, e.g. yosemite-s0,yosemite-s1')
         .action(async (name, opts) => {
         try {
+            const targets = parseHostsOption(opts);
+            if (targets.length > 0) {
+                if (!name) {
+                    console.error(chalk.red('A bundle name is required when viewing a remote host (interactive pick needs a local terminal).'));
+                    process.exit(1);
+                }
+                const args = ['view', name];
+                if (opts.reveal)
+                    args.push('--reveal');
+                if (opts.plaintext)
+                    args.push('--plaintext');
+                // With --reveal, force a TTY so the remote keychain prompt can surface
+                // (and the remote's "--reveal in a non-TTY needs --plaintext" gate is
+                // satisfied) — only when this side is itself interactive.
+                const tty = Boolean(opts.reveal) && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+                await browseRemote(targets, args, tty);
+                return;
+            }
             const resolvedName = name ?? (await pickBundleName('view'));
             const bundle = readBundle(resolvedName);
             const entries = describeBundle(bundle);
@@ -1094,6 +1163,7 @@ Examples:
         .option('--host <target...>', 'Push the bundle over SSH to this target (host alias or user@host); repeatable for multiple machines')
         .option('--remote-backend <backend>', 'Backend for the bundle on the remote (with --host): keychain (default) or file (passphrase-encrypted, headless-readable). file forwards AGENTS_SECRETS_PASSPHRASE over stdin.', 'keychain')
         .option('--force', 'Overwrite existing keys/items on the target (used with --to-1password and --host)')
+        .option('--format <shell|json>', 'Output for --plaintext export: shell (default) or json (lossless, machine-readable; used by remote resolve)', 'shell')
         .action(async (bundleName, opts) => {
         try {
             const { readAndResolveBundleEnv, bundleToEnvPrefix, isReservedEnvName } = await import('../lib/secrets/bundles.js');
@@ -1204,11 +1274,21 @@ Examples:
                 console.log(chalk.green(`Exported to 1Password vault '${vault}': ${parts.join(', ')}.`));
                 return;
             }
+            if (opts.format && opts.format !== 'shell' && opts.format !== 'json') {
+                console.error(chalk.red(`Invalid --format ${JSON.stringify(opts.format)}. Expected 'shell' or 'json'.`));
+                process.exit(1);
+            }
             if (!opts.plaintext) {
                 console.error(chalk.red('export prints secrets in the clear and requires --plaintext (works for TTY and pipes alike).'));
                 process.exit(1);
             }
             const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: `export to shell` });
+            if (opts.format === 'json') {
+                // Lossless, machine-readable form consumed by `remoteResolveEnv` over
+                // SSH. Single object of KEY -> value; values verbatim (newlines, quotes).
+                process.stdout.write(JSON.stringify(env));
+                return;
+            }
             const prefix = bundleToEnvPrefix(resolvedBundleName);
             for (const [k, v] of Object.entries(env)) {
                 const exportKey = isReservedEnvName(k) ? `${prefix}_${k}` : k;
@@ -1226,17 +1306,24 @@ Examples:
     });
     cmd
         .command('exec <bundle> [command...]')
-        .description('Run a command with the bundle\'s secrets injected into the environment')
+        .description('Run a command with the bundle\'s secrets injected into the environment (use --host to resolve the bundle from a remote machine, ephemerally)')
+        .option('--host <target>', 'Resolve <bundle> on a remote host over SSH and inject it (ephemeral — never stored on this machine)')
         .allowUnknownOption()
-        .action(async (bundleName, commandParts) => {
+        .action(async (bundleName, commandParts, execOpts) => {
         try {
             if (commandParts.length === 0) {
                 console.error(chalk.red('Usage: agents secrets exec <bundle> -- <command...>'));
                 process.exit(1);
             }
-            const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
             const [cmd, ...args] = commandParts;
-            const { env: secretEnv } = readAndResolveBundleEnv(bundleName, { caller: `command ${cmd}` });
+            let secretEnv;
+            if (execOpts.host) {
+                secretEnv = await remoteResolveEnv(await resolveSshTarget(execOpts.host), bundleName);
+            }
+            else {
+                const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
+                secretEnv = readAndResolveBundleEnv(bundleName, { caller: `command ${cmd}` }).env;
+            }
             const { spawn } = await import('child_process');
             const proc = spawn(cmd, args, {
                 stdio: 'inherit',