@phnx-labs/agents-cli 1.20.34 → 1.20.36

package/dist/lib/secrets/index.js

@@ -264,8 +264,14 @@ export function getKeychainTokens(items) {
     }
     return result;
 }
-/** Store or update a secret value in the keychain/keyring. Device-local; biometry-gated on macOS. */
-export function setKeychainToken(item, value) {
+/** Store or update a secret value in the keychain/keyring. Device-local;
+ * biometry-gated on macOS. `opts.noAcl` (the `never` prompt-policy) writes our
+ * item WITHOUT the biometry access control so later reads are fully silent — it
+ * routes through the signed helper's `set-no-acl` path. A pinned helper that
+ * predates that path rejects the unknown command (exit 2) and this throws,
+ * rather than silently falling back to an ACL'd `set` (which would behave like
+ * `always`). Ignored by the Linux/Windows/test backends, which have no ACL. */
+export function setKeychainToken(item, value, opts) {
     if (backend) {
         backend.set(item, value);
         return;
@@ -303,12 +309,22 @@ export function setKeychainToken(item, value) {
         return;
     }
     const bin = getKeychainHelperPath();
-    const result = spawnSync(bin, ['set', item, os.userInfo().username], {
+    // `never` policy → no-ACL write. The `set-no-acl` subcommand exists only in a
+    // re-notarized helper; an older pinned helper dies with "Unknown command:
+    // set-no-acl" (exit 2), surfaced below — never a silent ACL'd downgrade.
+    const helperCmd = opts?.noAcl ? 'set-no-acl' : 'set';
+    const result = spawnSync(bin, [helperCmd, item, os.userInfo().username], {
         input: value,
         stdio: ['pipe', 'pipe', 'pipe'],
     });
     if (result.status !== 0) {
         const msg = result.stderr?.toString().trim();
+        if (opts?.noAcl && /unknown command/i.test(msg ?? '')) {
+            throw new Error(`The 'never' prompt-policy needs a Keychain helper with the no-ACL write path, ` +
+                `but the installed helper does not support it. Rebuild + re-notarize the signed ` +
+                `helper (scripts/build-keychain-helper.sh) and re-pin its sha, then retry. ` +
+                `(helper said: ${msg})`);
+        }
         throw new Error(msg || `Failed to write keychain item '${item}'.`);
     }
 }
@@ -419,6 +435,89 @@ export function migrateKeychainItem(item) {
     const msg = result.stderr?.toString().trim();
     throw new Error(msg || `Failed to migrate keychain item '${item}'.`);
 }
+/**
+ * Enumerate data-protection items whose service starts with `prefix` that live
+ * under a NON-concrete access group — pre-#279 "orphans" filed under the implicit
+ * default group (the literal `2HTP252L87.*`) that the pinned-group queries can't
+ * see. Attributes only: never decrypts, never prompts. macOS only — Linux/Windows
+ * and the test backend have no access-group concept, so this returns [].
+ */
+export function listOrphanedKeychainItems(prefix) {
+    if (backend)
+        return [];
+    assertSupportedPlatform();
+    if (isLinux() || isWindows())
+        return [];
+    const bin = getKeychainHelperPath();
+    const result = spawnSync(bin, ['list-orphans', prefix, os.userInfo().username], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.status !== 0) {
+        const msg = result.stderr?.toString().trim();
+        throw new Error(msg || `Failed to enumerate orphaned keychain items with prefix '${prefix}'.`);
+    }
+    const out = result.stdout?.toString() || '';
+    return out.split('\n').map((s) => s.trim()).filter(Boolean);
+}
+/**
+ * Parse the `migrate-orphans` helper summary (one record per line):
+ *   OK <service>               re-homed
+ *   WARN <service> <detail>    pinned copy written but orphan not removed
+ *   FAIL <service> <detail>    could not re-home (orphan left intact)
+ * Unknown lines are ignored. Exported for unit testing without a keychain.
+ */
+export function parseOrphanMigrationOutput(stdout) {
+    const results = [];
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const sep = trimmed.indexOf(' ');
+        const tag = sep === -1 ? trimmed : trimmed.slice(0, sep);
+        const rest = sep === -1 ? '' : trimmed.slice(sep + 1);
+        if (tag === 'OK') {
+            // OK carries only the service name (no trailing detail).
+            results.push({ item: rest, status: 'ok' });
+        }
+        else if (tag === 'WARN' || tag === 'FAIL') {
+            // WARN/FAIL are 'TAG <service> <detail>'. Service names are space-free
+            // (validateBundleName / validateEnvKey), so the first token IS the exact
+            // service — this stays consistent with listOrphanedKeychainItems for the
+            // healed-set reconciliation in migrate-acl.
+            const item = rest.split(' ')[0] ?? rest;
+            results.push({ item, status: tag === 'WARN' ? 'warn' : 'fail', detail: rest });
+        }
+    }
+    return results;
+}
+/**
+ * Re-home every pre-#279 orphaned data-protection item under `prefix` into the
+ * concrete access group, behind a SINGLE Touch ID prompt for the whole batch.
+ * The helper reads each orphan by its exact persistent ref, adds the pinned copy
+ * (add-before-delete: a failed add leaves the orphan intact), then deletes the
+ * orphan by ref. Returns one result per item. macOS only — no-op elsewhere.
+ *
+ * Throws on Touch ID cancellation (exit 4) so callers can distinguish "user
+ * aborted" from "nothing to do" (empty array).
+ */
+export function migrateOrphanedKeychainItems(prefix) {
+    if (backend)
+        return [];
+    assertSupportedPlatform();
+    if (isLinux() || isWindows())
+        return [];
+    const bin = getKeychainHelperPath();
+    const result = spawnSync(bin, ['migrate-orphans', prefix, os.userInfo().username], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.status === 4)
+        throw new Error('Touch ID cancelled during orphan migration.');
+    if (result.status !== 0) {
+        const msg = result.stderr?.toString().trim();
+        throw new Error(msg || `Failed to migrate orphaned keychain items with prefix '${prefix}'.`);
+    }
+    return parseOrphanMigrationOutput(result.stdout?.toString() || '');
+}
 function expandHome(p) {
     if (p.startsWith('~/') || p === '~') {
         return path.join(os.homedir(), p.slice(1));

package/dist/lib/secrets/mcp.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Zero-knowledge / JIT secret delivery over MCP (issue #333).
+ *
+ * A stdio MCP server exposing a single `get_secret(bundle, key)` tool. Unlike
+ * `agents secrets exec`, which spawns the child process with EVERY resolved
+ * value baked into `process.env` (any subprocess can `printenv` the lot — see
+ * buildSecretsExecEnv in src/commands/secrets.ts), this server hands an
+ * MCP-speaking agent framework ONE credential at a time, by name, at call
+ * time. The raw value is returned only inside the tool result: it never enters
+ * the child's environment, is never logged, and never appears in `tools/list`
+ * metadata (names only).
+ *
+ * Resolution reuses the canonical bundle read path
+ * (readAndResolveBundleEnv -> getKeychainToken); no keychain access is
+ * re-implemented here. On Linux the libsecret backend (or its encrypted-file
+ * fallback for locked/headless collections) applies transparently through that
+ * abstraction, so the server stays backend-agnostic and works unchanged on
+ * macOS.
+ *
+ * Transport: the MCP stdio transport is newline-delimited JSON-RPC 2.0 (one
+ * message per line, UTF-8, no embedded newlines). That framing is trivial, so
+ * we implement it directly rather than pull in the @modelcontextprotocol/sdk
+ * server dependency — keeping the tree dependency-free and the handler pure and
+ * unit-testable in-process.
+ */
+/** MCP protocol revision this server negotiates. */
+export declare const MCP_PROTOCOL_VERSION = "2024-11-05";
+/** The single tool this server exposes. */
+export declare const GET_SECRET_TOOL = "get_secret";
+/** serverInfo.name reported at `initialize`. */
+export declare const MCP_SERVER_NAME = "agents-secrets";
+export interface JsonRpcRequest {
+    jsonrpc?: string;
+    id?: string | number | null;
+    method?: string;
+    params?: unknown;
+}
+interface JsonRpcSuccess {
+    jsonrpc: '2.0';
+    id: string | number | null;
+    result: unknown;
+}
+interface JsonRpcErrorResponse {
+    jsonrpc: '2.0';
+    id: string | number | null;
+    error: {
+        code: number;
+        message: string;
+    };
+}
+export type JsonRpcResponse = JsonRpcSuccess | JsonRpcErrorResponse;
+/** Per-bundle metadata for `tools/list` — names only, NEVER values. */
+export interface BundleKeyMetadata {
+    bundle: string;
+    description?: string;
+    keys: string[];
+}
+/**
+ * Enumerate every bundle and its key names WITHOUT resolving or reading any
+ * value. Mirrors how `agents secrets list` surfaces bundle metadata: names are
+ * safe to expose, values are not. `listBundles()` reads only the bundle
+ * metadata items (var definitions), never the secret items behind them.
+ */
+export declare function listSecretMetadata(): BundleKeyMetadata[];
+/**
+ * Resolve a single secret value by bundle + key through the canonical read
+ * path. Throws a clear error when the bundle or the key is absent.
+ *
+ * The bundle metadata is read first (readBundle) so a missing key is reported
+ * without triggering resolution — and, on macOS, without prompting Touch ID —
+ * for the other keys in the bundle.
+ */
+export declare function resolveSecret(bundle: string, key: string): string;
+/**
+ * Handle one parsed JSON-RPC request. Returns the response object, or `null`
+ * for notifications (which take no reply). Pure — no I/O, no logging — so tests
+ * drive it directly.
+ */
+export declare function handleMcpRequest(req: JsonRpcRequest, ctx?: {
+    version?: string;
+}): JsonRpcResponse | null;
+/**
+ * Run the stdio MCP server: read newline-delimited JSON-RPC requests from
+ * `input`, write responses to `output`. Resolves when the input stream ends.
+ * Streams are injectable so tests can drive a full request/response loop
+ * without spawning a process.
+ */
+export declare function runSecretsMcpServer(opts?: {
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+    version?: string;
+}): Promise<void>;
+export {};

package/dist/lib/secrets/mcp.js

@@ -0,0 +1,205 @@
+/**
+ * Zero-knowledge / JIT secret delivery over MCP (issue #333).
+ *
+ * A stdio MCP server exposing a single `get_secret(bundle, key)` tool. Unlike
+ * `agents secrets exec`, which spawns the child process with EVERY resolved
+ * value baked into `process.env` (any subprocess can `printenv` the lot — see
+ * buildSecretsExecEnv in src/commands/secrets.ts), this server hands an
+ * MCP-speaking agent framework ONE credential at a time, by name, at call
+ * time. The raw value is returned only inside the tool result: it never enters
+ * the child's environment, is never logged, and never appears in `tools/list`
+ * metadata (names only).
+ *
+ * Resolution reuses the canonical bundle read path
+ * (readAndResolveBundleEnv -> getKeychainToken); no keychain access is
+ * re-implemented here. On Linux the libsecret backend (or its encrypted-file
+ * fallback for locked/headless collections) applies transparently through that
+ * abstraction, so the server stays backend-agnostic and works unchanged on
+ * macOS.
+ *
+ * Transport: the MCP stdio transport is newline-delimited JSON-RPC 2.0 (one
+ * message per line, UTF-8, no embedded newlines). That framing is trivial, so
+ * we implement it directly rather than pull in the @modelcontextprotocol/sdk
+ * server dependency — keeping the tree dependency-free and the handler pure and
+ * unit-testable in-process.
+ */
+import * as readline from 'readline';
+import { listBundles, readAndResolveBundleEnv, readBundle, validateBundleName, } from './bundles.js';
+/** MCP protocol revision this server negotiates. */
+export const MCP_PROTOCOL_VERSION = '2024-11-05';
+/** The single tool this server exposes. */
+export const GET_SECRET_TOOL = 'get_secret';
+/** serverInfo.name reported at `initialize`. */
+export const MCP_SERVER_NAME = 'agents-secrets';
+// JSON-RPC 2.0 error codes we use.
+const JSONRPC_PARSE_ERROR = -32700;
+const JSONRPC_INVALID_REQUEST = -32600;
+const JSONRPC_METHOD_NOT_FOUND = -32601;
+const JSONRPC_INVALID_PARAMS = -32602;
+/**
+ * Enumerate every bundle and its key names WITHOUT resolving or reading any
+ * value. Mirrors how `agents secrets list` surfaces bundle metadata: names are
+ * safe to expose, values are not. `listBundles()` reads only the bundle
+ * metadata items (var definitions), never the secret items behind them.
+ */
+export function listSecretMetadata() {
+    return listBundles()
+        .map((b) => ({
+        bundle: b.name,
+        description: b.description,
+        keys: Object.keys(b.vars).sort(),
+    }))
+        .sort((a, b) => a.bundle.localeCompare(b.bundle));
+}
+/**
+ * Resolve a single secret value by bundle + key through the canonical read
+ * path. Throws a clear error when the bundle or the key is absent.
+ *
+ * The bundle metadata is read first (readBundle) so a missing key is reported
+ * without triggering resolution — and, on macOS, without prompting Touch ID —
+ * for the other keys in the bundle.
+ */
+export function resolveSecret(bundle, key) {
+    validateBundleName(bundle);
+    // readBundle throws `Secrets bundle '<name>' not found.` for a missing bundle.
+    const meta = readBundle(bundle);
+    if (!Object.prototype.hasOwnProperty.call(meta.vars, key)) {
+        const available = Object.keys(meta.vars).sort();
+        throw new Error(`Key '${key}' not found in bundle '${bundle}'.` +
+            (available.length ? ` Available keys: ${available.join(', ')}.` : ' Bundle has no keys.'));
+    }
+    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp' });
+    const value = env[key];
+    if (value === undefined) {
+        throw new Error(`Key '${key}' in bundle '${bundle}' could not be resolved.`);
+    }
+    return value;
+}
+/** Build the `get_secret` tool definition, advertising available names only. */
+function getSecretToolDefinition() {
+    let catalog = '(no bundles configured)';
+    try {
+        const meta = listSecretMetadata();
+        if (meta.length > 0) {
+            catalog = meta
+                .map((b) => `${b.bundle}: ${b.keys.length ? b.keys.join(', ') : '(no keys)'}`)
+                .join(' | ');
+        }
+    }
+    catch {
+        // Listing is best-effort decoration; never fail tools/list because the
+        // keychain enumeration hiccuped.
+        catalog = '(unavailable)';
+    }
+    return {
+        name: GET_SECRET_TOOL,
+        description: 'Fetch a single secret value by bundle + key, resolved at call time. The value ' +
+            'is returned only in this tool result and never enters the process environment. ' +
+            `Available bundles and keys (names only): ${catalog}`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                bundle: { type: 'string', description: 'Secrets bundle name' },
+                key: { type: 'string', description: 'Key / env-var name within the bundle' },
+            },
+            required: ['bundle', 'key'],
+            additionalProperties: false,
+        },
+    };
+}
+function success(id, result) {
+    return { jsonrpc: '2.0', id, result };
+}
+function rpcError(id, code, message) {
+    return { jsonrpc: '2.0', id, error: { code, message } };
+}
+/**
+ * A tool-execution failure. Per the MCP spec, tool errors are reported IN the
+ * result (`isError: true`) — not as a JSON-RPC error — so the model sees and
+ * can react to the message. The value channel (`content`) still carries no
+ * secret here.
+ */
+function toolError(id, message) {
+    return success(id, { content: [{ type: 'text', text: message }], isError: true });
+}
+function handleToolCall(id, params) {
+    const p = (params ?? {});
+    if (p.name !== GET_SECRET_TOOL) {
+        return rpcError(id, JSONRPC_INVALID_PARAMS, `Unknown tool: ${String(p.name)}`);
+    }
+    const args = (p.arguments ?? {});
+    if (typeof args.bundle !== 'string' || !args.bundle || typeof args.key !== 'string' || !args.key) {
+        return toolError(id, `${GET_SECRET_TOOL} requires non-empty string 'bundle' and 'key' arguments.`);
+    }
+    try {
+        const value = resolveSecret(args.bundle, args.key);
+        return success(id, { content: [{ type: 'text', text: value }] });
+    }
+    catch (err) {
+        return toolError(id, err.message);
+    }
+}
+/**
+ * Handle one parsed JSON-RPC request. Returns the response object, or `null`
+ * for notifications (which take no reply). Pure — no I/O, no logging — so tests
+ * drive it directly.
+ */
+export function handleMcpRequest(req, ctx = {}) {
+    const id = req.id ?? null;
+    const isNotification = req.id === undefined || req.id === null;
+    switch (req.method) {
+        case 'initialize':
+            return success(id, {
+                protocolVersion: MCP_PROTOCOL_VERSION,
+                capabilities: { tools: {} },
+                serverInfo: { name: MCP_SERVER_NAME, version: ctx.version ?? '0.0.0' },
+            });
+        case 'notifications/initialized':
+        case 'initialized':
+            return null; // notification — no response
+        case 'ping':
+            return success(id, {});
+        case 'tools/list':
+            return success(id, { tools: [getSecretToolDefinition()] });
+        case 'tools/call':
+            return handleToolCall(id, req.params);
+        default:
+            if (isNotification)
+                return null; // unknown notification — stay silent
+            return rpcError(id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${String(req.method)}`);
+    }
+}
+function writeMessage(output, msg) {
+    output.write(JSON.stringify(msg) + '\n');
+}
+/**
+ * Run the stdio MCP server: read newline-delimited JSON-RPC requests from
+ * `input`, write responses to `output`. Resolves when the input stream ends.
+ * Streams are injectable so tests can drive a full request/response loop
+ * without spawning a process.
+ */
+export async function runSecretsMcpServer(opts = {}) {
+    const input = opts.input ?? process.stdin;
+    const output = opts.output ?? process.stdout;
+    const rl = readline.createInterface({ input, crlfDelay: Infinity });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let req;
+        try {
+            req = JSON.parse(trimmed);
+        }
+        catch {
+            writeMessage(output, rpcError(null, JSONRPC_PARSE_ERROR, 'Parse error'));
+            continue;
+        }
+        if (!req || typeof req !== 'object' || typeof req.method !== 'string') {
+            writeMessage(output, rpcError((req && req.id) ?? null, JSONRPC_INVALID_REQUEST, 'Invalid Request'));
+            continue;
+        }
+        const res = handleMcpRequest(req, { version: opts.version });
+        if (res)
+            writeMessage(output, res);
+    }
+}

package/dist/lib/secrets/remote.js

@@ -15,10 +15,18 @@
  * file-backend passphrase travels over ssh stdin (first line) so it never lands
  * in argv / `ps` / remote shell history. Nothing is persisted locally.
  */
-import { sshExec, assertValidSshTarget, shellQuote } from '../ssh-exec.js';
+import { sshExec, assertValidSshTarget } from '../ssh-exec.js';
 import { resolveHost } from '../hosts/registry.js';
 import { sshTargetFor } from '../hosts/types.js';
+import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
+import { resolveRemoteOsSync } from '../hosts/remote-os.js';
 const REMOTE_TIMEOUT_MS = 30_000;
+/** Remote OS for a target string (bare alias matches a device entry; a raw
+ * `user@host` falls back to POSIX). Threaded into the command builder so a
+ * Windows host gets PowerShell instead of `bash -lc`. */
+function osForTarget(target) {
+    return resolveRemoteOsSync(target.split('@').pop() ?? target);
+}
 /**
  * Resolve a `--host` value to an ssh target string. Tries the `agents hosts`
  * registry first (enrolled name → ssh-config alias / `user@host`); on a miss,
@@ -77,8 +85,7 @@ export function splitBundleRef(ref) {
  * remote Touch-ID / passphrase prompt can surface (e.g. `view --reveal`).
  */
 export function remoteSecretsRaw(target, args, opts = {}) {
-    const inner = ['agents', 'secrets', ...args].map(shellQuote).join(' ');
-    const remoteCmd = `bash -lc ${shellQuote(inner)}`;
+    const remoteCmd = buildRemoteAgentsInvocation(['secrets', ...args], undefined, osForTarget(target));
     return sshExec(target, remoteCmd, {
         timeoutMs: REMOTE_TIMEOUT_MS,
         input: opts.input,
@@ -100,8 +107,8 @@ export function remoteSecretsRaw(target, args, opts = {}) {
  */
 export async function remoteResolveEnv(target, bundle) {
     assertValidSshTarget(target);
-    const exportCmd = `agents secrets export ${shellQuote(bundle)} --plaintext --format json`;
-    const res = sshExec(target, `bash -lc ${shellQuote(exportCmd)}`, {
+    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target));
+    const res = sshExec(target, remoteCmd, {
         timeoutMs: REMOTE_TIMEOUT_MS,
     });
     if (res.code !== 0) {

package/dist/lib/secrets/sync.js

@@ -11,7 +11,7 @@
  * never leaves this module; the backend only ever sees ciphertext + KDF params.
  */
 import * as crypto from 'crypto';
-import { getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from './index.js';
+import { deleteKeychainToken, getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from './index.js';
 import { readBundle, writeBundle, keychainItemsForBundle, validateBundleName, } from './bundles.js';
 import { rushSyncBackend } from './drivers/rush.js';
 // PBKDF2 cost. 600k SHA-256 iters matches OWASP 2023+ guidance and keeps a
@@ -93,14 +93,93 @@ function snapshotBundle(name) {
     }
     return { bundle, secrets };
 }
+/**
+ * Materialize a decrypted snapshot locally, atomically.
+ *
+ * A naive "set each secret, then write metadata" is not crash-safe: if one
+ * `setKeychainToken` throws midway, the keychain is left with a half-applied
+ * set — some items carry the pulled values, others the old ones — and the
+ * bundle metadata may never be written, leaving orphaned/wrong items readable.
+ *
+ * So we snapshot the PRIOR value of every item we're about to touch, apply all
+ * writes, and on ANY failure roll back to exactly the pre-restore state
+ * (restore previously-existing items, delete items that didn't exist) before
+ * rethrowing. Metadata is committed only after every secret write succeeds; if
+ * that final write fails, the secret writes are rolled back too. Either the
+ * whole pull lands or the keychain is untouched.
+ */
 function restoreSnapshot(snap) {
     const bundle = snap.bundle;
     validateBundleName(bundle.name);
-    for (const [shortId, value] of Object.entries(snap.secrets)) {
+    // Capture the pre-restore state of every item so a partial failure can be
+    // undone. hasKeychainToken never prompts; getKeychainToken reads the existing
+    // value via the same path the rest of the module uses.
+    const priors = [];
+    for (const shortId of Object.keys(snap.secrets)) {
         const item = secretsKeychainItem(bundle.name, shortId);
-        setKeychainToken(item, value);
+        if (hasKeychainToken(item)) {
+            priors.push({ item, existed: true, value: getKeychainToken(item) });
+        }
+        else {
+            priors.push({ item, existed: false });
+        }
+    }
+    // Best-effort reversal to the captured pre-restore state. Each item is
+    // reverted independently so one failure doesn't abort the rest of the
+    // rollback. Reversal writes hit the SAME backend that just failed the restore
+    // (a locked/erroring keyring is the realistic trigger), so a reversal can
+    // itself throw — those items are collected and returned so the caller can
+    // report an INCOMPLETE rollback instead of falsely claiming a clean one.
+    const rollback = () => {
+        const stillDirty = [];
+        for (const prior of priors) {
+            try {
+                if (prior.existed)
+                    setKeychainToken(prior.item, prior.value);
+                else
+                    deleteKeychainToken(prior.item);
+            }
+            catch {
+                // Keep undoing the remaining items, but remember this one couldn't be
+                // reverted — it may now hold an orphaned or wrong value.
+                stillDirty.push(prior.item);
+            }
+        }
+        return stillDirty;
+    };
+    try {
+        for (const [shortId, value] of Object.entries(snap.secrets)) {
+            const item = secretsKeychainItem(bundle.name, shortId);
+            setKeychainToken(item, value);
+        }
+    }
+    catch (err) {
+        throw new Error(rollbackFailureMessage(bundle.name, 'writing secrets', err, rollback()));
+    }
+    // Commit metadata last. If it fails, undo the secret writes so nothing
+    // partial lingers.
+    try {
+        writeBundle(bundle);
+    }
+    catch (err) {
+        throw new Error(rollbackFailureMessage(bundle.name, 'writing metadata', err, rollback()));
+    }
+}
+/**
+ * Build the error thrown when a restore fails. When the rollback reverted every
+ * touched item (`dirty` empty) we truthfully say the keychain is back to the
+ * pre-restore state. When some reversal writes ALSO failed we must NOT claim a
+ * clean rollback — the message names the still-dirty items so the user knows the
+ * keychain is half-restored and which secrets to check.
+ */
+function rollbackFailureMessage(name, phase, err, dirty) {
+    if (dirty.length === 0) {
+        return `Restore of bundle '${name}' failed while ${phase}; ` +
+            `rolled back to the pre-restore state. (${err.message})`;
     }
-    writeBundle(bundle);
+    return `Restore of bundle '${name}' failed while ${phase}, and the rollback was INCOMPLETE — ` +
+        `these keychain items could not be reverted and may hold orphaned or wrong values: ${dirty.join(', ')}. ` +
+        `(original error: ${err.message})`;
 }
 /** Push a local bundle to the remote. Encrypts client-side; the backend only sees ciphertext. */
 export async function pushBundle(name, opts) {

package/dist/lib/secrets/windows.js

@@ -53,6 +53,10 @@ export const CRED_MAX_CREDENTIAL_BLOB_SIZE = 2560;
  */
 const PS_SCRIPT = `
 $ErrorActionPreference = 'Stop'
+# Output must not depend on the console codepage: a windowsHide child owns a
+# fresh hidden console whose codepage is the OEM default (cp437), not the
+# terminal's UTF-8 — the Node side always decodes stdout/stderr as UTF-8.
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 Add-Type -TypeDefinition @'
 using System;
 using System.Runtime.InteropServices;
@@ -178,9 +182,12 @@ try {
             exit 0
         }
         'set' {
-            $value = [Console]::In.ReadToEnd()
-            $bytes = [System.Text.Encoding]::UTF8.GetBytes($value)
-            [AgentsCred]::Set($target, $bytes)
+            # Raw bytes, not [Console]::In text — text decoding runs through the
+            # console codepage and corrupts non-ASCII UTF-8 from the Node side.
+            $stdin = [Console]::OpenStandardInput()
+            $ms = New-Object System.IO.MemoryStream
+            $stdin.CopyTo($ms)
+            [AgentsCred]::Set($target, $ms.ToArray())
             exit 0
         }
         'delete' {
@@ -219,6 +226,9 @@ function runCred(op, opts) {
         input: opts.input,
         stdio: ['pipe', 'pipe', 'pipe'],
         maxBuffer: 16 * 1024 * 1024,
+        // Never flash a console window when the caller has no console of its own
+        // (the scheduler daemon resolves bundles through here every sync cycle).
+        windowsHide: true,
     });
     return {
         status: result.status,
@@ -231,6 +241,7 @@ function runCred(op, opts) {
 function powershellAvailable() {
     const result = spawnSync(POWERSHELL, ['-NoProfile', '-NonInteractive', '-Command', 'exit 0'], {
         stdio: ['ignore', 'ignore', 'ignore'],
+        windowsHide: true,
     });
     return !result.error && result.status === 0;
 }