@phnx-labs/agents-cli 1.20.50 → 1.20.52

package/dist/lib/browser/refs.js

@@ -1,3 +1,4 @@
+import { truncate } from '../format.js';
 /** Snapshot the stable descriptor for every ref in a freshly-built node map. */
 export function describeRefs(nodeMap) {
     return Array.from(nodeMap.values()).map((n) => ({
@@ -175,11 +176,6 @@ export async function getRefs(cdp, sessionId, opts = {}) {
     }
     return { refs: lines.join('\n'), nodeMap, opts: { interactive, limit } };
 }
-function truncate(s, max) {
-    if (s.length <= max)
-        return s;
-    return s.slice(0, max - 1) + '…';
-}
 export async function resolveRefToCoords(cdp, sessionId, nodeMap, ref) {
     const node = nodeMap.get(ref);
     if (!node)

package/dist/lib/browser/secret-ref.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Parse a `<bundle>/<KEY>` reference (optionally `secret:<bundle>/<KEY>`) used by
+ * `agents browser type --secret` to feed a credential from an `agents secrets`
+ * bundle into a page WITHOUT the value ever crossing stdout or the transcript.
+ * Returns null on a malformed ref.
+ */
+export declare function parseSecretRef(ref: string): {
+    bundle: string;
+    key: string;
+} | null;

package/dist/lib/browser/secret-ref.js

@@ -0,0 +1,14 @@
+/**
+ * Parse a `<bundle>/<KEY>` reference (optionally `secret:<bundle>/<KEY>`) used by
+ * `agents browser type --secret` to feed a credential from an `agents secrets`
+ * bundle into a page WITHOUT the value ever crossing stdout or the transcript.
+ * Returns null on a malformed ref.
+ */
+export function parseSecretRef(ref) {
+    const body = ref.startsWith('secret:') ? ref.slice('secret:'.length) : ref;
+    const slash = body.indexOf('/');
+    // Need a non-empty bundle before the slash and a non-empty key after it.
+    if (slash <= 0 || slash >= body.length - 1)
+        return null;
+    return { bundle: body.slice(0, slash), key: body.slice(slash + 1) };
+}

package/dist/lib/browser/service.js

@@ -8,7 +8,7 @@ import { getProfile, getProfileRuntimeDir, getBrowserRuntimeDir, listProfiles, e
 import { killChrome, getRunningChromeInfo, launchBrowser, allocatePort } from './chrome.js';
 import { connectLocal } from './drivers/local.js';
 import { connectSSH, shellQuote } from './drivers/ssh.js';
-import { clearProfileRuntime } from './runtime-state.js';
+import { clearProfileRuntime, listProfileCacheDirs, readProfileRuntimeMeta, isProcessAlive } from './runtime-state.js';
 import { resolveDomainSkill } from './domain-skills.js';
 import { generateTaskId, generateShortId, generateTaskName, } from './types.js';
 import { getRefs, resolveRefToCoords, describeRefs, healRef } from './refs.js';
@@ -415,6 +415,7 @@ export class BrowserService {
                     killChrome(conn.pid);
                     conn.cleanup?.();
                     this.connections.delete(profileName);
+                    clearProfileRuntime(profileName);
                 }
                 return { ok: true, profile: profileName };
             }
@@ -442,17 +443,18 @@ export class BrowserService {
             killChrome(conn.pid);
             conn.cleanup?.();
             this.connections.delete(key);
-        }
-        const runtimeDir = getProfileRuntimeDir(profileName);
-        const pidFile = path.join(runtimeDir, 'pid');
-        const portFile = path.join(runtimeDir, 'port');
-        if (fs.existsSync(pidFile)) {
-            const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
-            killChrome(pid);
-            fs.unlinkSync(pidFile);
-        }
-        if (fs.existsSync(portFile)) {
-            fs.unlinkSync(portFile);
+            clearProfileRuntime(key);
+        }
+        // Kill stale processes and clean runtime dirs for every composite and
+        // fork entry belonging to this profile (including `.N` forks left by
+        // earlier daemon sessions that the connection loop above didn't cover).
+        for (const dir of listProfileCacheDirs(profileName)) {
+            const dirName = path.basename(dir);
+            const meta = readProfileRuntimeMeta(dirName);
+            if (meta?.pid && meta.pid !== 0 && isProcessAlive(meta.pid, meta.command)) {
+                killChrome(meta.pid);
+            }
+            clearProfileRuntime(dirName);
         }
     }
     async navigate(taskId, url, profileName) {

package/dist/lib/cli-resources.d.ts

@@ -133,5 +133,3 @@ export declare function listCliStatus(cwd?: string): {
     statuses: CliStatus[];
     errors: CliManifestError[];
 };
-/** Names of CLIs that are declared but not currently installed on the host. */
-export declare function getMissingClis(cwd?: string): CliManifest[];

package/dist/lib/cli-resources.js

@@ -21,6 +21,7 @@ import * as path from 'path';
 import { spawnSync } from 'child_process';
 import * as yaml from 'yaml';
 import { listResources, resolveResource } from './resources.js';
+import { composeWin32CommandLine } from './platform/index.js';
 // ─── Validation primitives ───────────────────────────────────────────────────
 /** Token allowed inside `check:` strings — letters, digits, underscore, dot, slash, dash. */
 const SAFE_CHECK_TOKEN = /^[a-zA-Z0-9_./-]+$/;
@@ -253,19 +254,27 @@ export function resolveCliManifest(name, cwd) {
 // ─── Host detection ──────────────────────────────────────────────────────────
 /**
  * Return true if a command resolves on the current PATH. Uses POSIX `command -v`
- * via spawn argv (no shell); results are cached for the lifetime of the process.
+ * (or `where` on Windows) via spawn argv (no shell); results are cached for the
+ * lifetime of the process.
  */
 const cmdExistsCache = new Map();
 export function hasCommand(cmd) {
     if (cmdExistsCache.has(cmd))
         return cmdExistsCache.get(cmd);
-    // `command` is a shell builtin on most POSIX shells; invoking `sh -c 'command -v X'`
-    // with X as an *argument* (not interpolated) is the safe path. `cmd` may be passed
-    // by callers that haven't validated it, so we route via argv to neutralize metas.
-    const result = spawnSync('sh', ['-c', 'command -v "$1" >/dev/null 2>&1', '_', cmd], {
-        stdio: 'ignore',
-    });
-    const ok = result.status === 0;
+    let ok;
+    if (process.platform === 'win32') {
+        // `sh` only exists when Git Bash is installed; `where` is the native PATH
+        // probe (resolves .exe/.cmd/.bat via PATHEXT). Argv keeps `cmd` uninterpolated.
+        ok = spawnSync('where', [cmd], { stdio: 'ignore' }).status === 0;
+    }
+    else {
+        // `command` is a shell builtin on most POSIX shells; invoking `sh -c 'command -v X'`
+        // with X as an *argument* (not interpolated) is the safe path. `cmd` may be passed
+        // by callers that haven't validated it, so we route via argv to neutralize metas.
+        ok = spawnSync('sh', ['-c', 'command -v "$1" >/dev/null 2>&1', '_', cmd], {
+            stdio: 'ignore',
+        }).status === 0;
+    }
     cmdExistsCache.set(cmd, ok);
     return ok;
 }
@@ -280,7 +289,19 @@ export function isCliInstalled(manifest) {
         return hasCommand(c.cmd);
     }
     const result = spawnSync(c.cmd, c.args, { stdio: 'ignore', timeout: 10_000 });
-    return result.status === 0;
+    if (result.status === 0)
+        return true;
+    // On Windows the PATH entry point is often a `.cmd`/`.bat` shim (npm installs,
+    // script installers), which Node refuses to spawn without a shell (ENOENT /
+    // EINVAL). A failed *spawn* — not a failed run — gets one retry through the
+    // shell, as a single pre-composed line (DEP0190-safe). Check tokens are
+    // SAFE_CHECK_TOKEN-validated at parse time, so the line cannot inject.
+    if (process.platform === 'win32' && result.error) {
+        const line = composeWin32CommandLine(c.cmd, c.args);
+        const retry = spawnSync(line, { stdio: 'ignore', timeout: 10_000, shell: true });
+        return retry.status === 0;
+    }
+    return false;
 }
 // ─── Method selection ────────────────────────────────────────────────────────
 /**
@@ -480,7 +501,3 @@ export function listCliStatus(cwd) {
     }));
     return { statuses, errors };
 }
-/** Names of CLIs that are declared but not currently installed on the host. */
-export function getMissingClis(cwd) {
-    return listCliStatus(cwd).statuses.filter((s) => !s.installed).map((s) => s.manifest);
-}

package/dist/lib/cloud/rush.d.ts

@@ -29,6 +29,21 @@ export interface AccountTokenEntry {
     /** Stringified OAuth credentials JSON (Mac: keychain blob; Linux: .credentials.json). */
     credentials_json: string;
 }
+/**
+ * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
+ * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
+ * inside the version home (where the Linux Claude CLI stores its OAuth).
+ *
+ * Returns null when no credentials are findable — caller treats as "version
+ * is installed but not signed in" and skips it from the manifest.
+ *
+ * NOTE: the darwin branch returns the UNWRAPPED oauth sub-object (what the Rush
+ * server re-wraps). It is NOT the shape Claude Code reads back from
+ * `.credentials.json`. The lease exporter (crabbox/runtimes.ts) therefore only
+ * reuses the Linux `.credentials.json` branch here and reads the wrapped raw
+ * Keychain payload itself on darwin.
+ */
+export declare function readClaudeCredentialsBlob(home: string): Promise<string | null>;
 /**
  * Build a manifest of the user's local Claude installations to send on every
  * cloud dispatch. The manifest is the contract the server uses to detect when
@@ -75,30 +90,6 @@ export declare function buildDispatchBody(input: {
      */
     images?: ImageAttachment[] | null;
 }): Record<string, unknown>;
-/** A single account registered in Rush Cloud's multi-account rotation pool. */
-export interface RemoteAccount {
-    id: string;
-    provider: string;
-    email: string | null;
-    subscription_type: string | null;
-    five_hour_pct: number | null;
-    seven_day_pct: number | null;
-    usage_fetched_at: string | null;
-    created_at: string;
-}
-/** Fetch all Claude accounts in this user's Rush Cloud rotation pool (no tokens). */
-export declare function listRemoteAccounts(): Promise<RemoteAccount[]>;
-/**
- * Register a CLAUDE_CODE_OAUTH_TOKEN with Rush Cloud's rotation pool.
- * The server validates the token against the Anthropic usage API and stores it
- * encrypted in Vault. Returns the account metadata (no token).
- */
-export declare function addRemoteAccount(provider: string, pastedToken: string): Promise<RemoteAccount & {
-    five_hour_pct: number | null;
-    seven_day_pct: number | null;
-}>;
-/** Remove a Claude account from Rush Cloud's rotation pool by its ID. */
-export declare function removeRemoteAccount(id: string): Promise<void>;
 export declare class RushCloudProvider implements CloudProvider {
     id: "rush";
     name: string;

package/dist/lib/cloud/rush.js

@@ -170,8 +170,14 @@ function parsePromptCode(body) {
  *
  * Returns null when no credentials are findable — caller treats as "version
  * is installed but not signed in" and skips it from the manifest.
+ *
+ * NOTE: the darwin branch returns the UNWRAPPED oauth sub-object (what the Rush
+ * server re-wraps). It is NOT the shape Claude Code reads back from
+ * `.credentials.json`. The lease exporter (crabbox/runtimes.ts) therefore only
+ * reuses the Linux `.credentials.json` branch here and reads the wrapped raw
+ * Keychain payload itself on darwin.
  */
-async function readClaudeCredentialsBlob(home) {
+export async function readClaudeCredentialsBlob(home) {
     if (process.platform === 'darwin') {
         const oauth = await loadClaudeOauth(home);
         if (oauth && oauth.accessToken) {
@@ -294,37 +300,6 @@ export function buildDispatchBody(input) {
     }
     return body;
 }
-/** Fetch all Claude accounts in this user's Rush Cloud rotation pool (no tokens). */
-export async function listRemoteAccounts() {
-    const token = readToken();
-    const res = await api('GET', '/api/v1/cloud-accounts', token);
-    if (!res.ok) {
-        throw new Error(`Failed to list accounts (${res.status}): ${sanitizeErrorBody(await res.text())}`);
-    }
-    const data = await res.json();
-    return data.accounts ?? [];
-}
-/**
- * Register a CLAUDE_CODE_OAUTH_TOKEN with Rush Cloud's rotation pool.
- * The server validates the token against the Anthropic usage API and stores it
- * encrypted in Vault. Returns the account metadata (no token).
- */
-export async function addRemoteAccount(provider, pastedToken) {
-    const token = readToken();
-    const res = await api('POST', '/api/v1/cloud-accounts', token, { provider, token: pastedToken });
-    if (!res.ok) {
-        throw new Error(`Failed to add account (${res.status}): ${sanitizeErrorBody(await res.text())}`);
-    }
-    return await res.json();
-}
-/** Remove a Claude account from Rush Cloud's rotation pool by its ID. */
-export async function removeRemoteAccount(id) {
-    const token = readToken();
-    const res = await api('DELETE', `/api/v1/cloud-accounts/${encodeURIComponent(id)}`, token);
-    if (!res.ok) {
-        throw new Error(`Failed to remove account (${res.status}): ${sanitizeErrorBody(await res.text())}`);
-    }
-}
 export class RushCloudProvider {
     id = 'rush';
     name = 'Rush Cloud';

package/dist/lib/crabbox/cli.js

@@ -209,7 +209,10 @@ export function crabboxRunScript(slug, script, opts = {}) {
 /** Release the lease / delete the box. Best-effort; never throws. */
 export function crabboxStop(slug, opts = {}) {
     try {
-        const r = spawnSync('crabbox', ['stop', '--id', slug], { encoding: 'utf-8', env: crabboxEnv(opts) });
+        // Positional target: crabbox's stop subcommand has no --id flag (unlike
+        // status/run/ssh) — `stop --id <slug>` dies with "flag provided but not
+        // defined: -id" and the box leaks past the run it was leased for.
+        const r = spawnSync('crabbox', ['stop', slug], { encoding: 'utf-8', env: crabboxEnv(opts) });
         return r.status === 0;
     }
     catch {

package/dist/lib/crabbox/lease.d.ts

@@ -26,6 +26,12 @@ export interface LeaseRunOptions {
     onData?: (s: string) => void;
     /** Keep the box after the run instead of stopping it. */
     keep?: boolean;
+    /**
+     * Raw wrapped Claude OAuth payload (from `resolveClaudeCredentialsBlob`), written
+     * to `~/.claude/.credentials.json` on the box. The command layer resolves it
+     * (after consent) so this module stays free of Keychain I/O and unit-testable.
+     */
+    claudeCredentialsJson?: string | null;
 }
 export interface LeaseRunResult {
     box: CrabboxBox;

package/dist/lib/crabbox/lease.js

@@ -7,35 +7,65 @@
  * `--script-stdin` body so the token contents never touch argv.
  */
 import { crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
-import { buildCredentialScript } from './runtimes.js';
+import { buildCredentialScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
 /** POSIX single-quote for safe embedding in the generated bootstrap script. */
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
 }
+/**
+ * Bash snippet that guarantees `agents` is runnable on the box. Fresh crabbox
+ * images ship without node, and the box user may not own the global npm prefix,
+ * so everything installs user-level under ~/.local (node from the official
+ * latest-v22.x tarball to satisfy engines.node >=22.5.0). Exits 96 with a
+ * diagnostic when the CLI still isn't runnable — a silent `|| true` here used
+ * to surface only as `agents: command not found` deep in the script.
+ */
+const ENSURE_AGENTS_CLI = [
+    'export PATH="$HOME/.local/bin:$PATH"',
+    'if ! command -v node >/dev/null 2>&1; then',
+    '  case "$(uname -m)" in aarch64|arm64) narch=arm64;; *) narch=x64;; esac',
+    '  nver=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ | grep -oE "v22\\.[0-9]+\\.[0-9]+" | head -1)',
+    '  mkdir -p "$HOME/.local"',
+    '  curl -fsSL "https://nodejs.org/dist/latest-v22.x/node-$nver-linux-$narch.tar.xz" | tar -xJ -C "$HOME/.local" --strip-components=1',
+    'fi',
+    'if ! command -v agents >/dev/null 2>&1; then',
+    '  npm config set prefix "$HOME/.local" >/dev/null 2>&1 || true',
+    '  npm install -g @phnx-labs/agents-cli >/dev/null 2>&1',
+    'fi',
+    'if ! command -v agents >/dev/null 2>&1; then',
+    '  echo "lease bootstrap: agents-cli install failed (node: $(command -v node || echo missing))" >&2',
+    '  exit 96',
+    'fi',
+    // Same first-run guard the hosts bootstrap uses (hosts/ready.ts) — a fresh
+    // install refuses `agents run` with "agents-cli is not set up" until setup ran.
+    'if [ ! -d "$HOME/.agents/.system" ]; then agents setup >/dev/null 2>&1 || true; fi',
+].join('\n');
 /**
  * Build the single bootstrap script run on the box: ensure agents-cli, install
  * the picked runtime CLIs, write their credentials, run the agent, then shred
  * the credential files. Best-effort install steps never abort the run.
  */
 export function buildBootstrapScript(opts) {
-    const credScript = buildCredentialScript(opts.runtimes, opts.detected);
+    const credScript = buildCredentialScript(opts.runtimes, opts.detected, {
+        claudeCredentialsJson: opts.claudeCredentialsJson,
+    });
     const runParts = ['agents', 'run', q(opts.agent), q(opts.prompt), '--quiet'];
     if (opts.mode)
         runParts.push('--mode', q(opts.mode));
     if (opts.model)
         runParts.push('--model', q(opts.model));
     // Credential files to shred after the run (home-level paths written above).
-    const shred = opts.runtimes
-        .map((id) => {
-        const cred = { claude: '.claude.json', codex: '.codex/auth.json', gemini: '.gemini/google_accounts.json', grok: '.grok/auth.json' }[id];
-        return cred ? `rm -f "$HOME/${cred}" 2>/dev/null || true` : '';
-    })
-        .filter(Boolean)
-        .join('\n');
+    // Runs regardless of --keep-box (it's in the box body, not teardown), so a kept
+    // box still loses the token after the run — minimizing the credential window.
+    const shredPaths = opts.runtimes.flatMap((id) => {
+        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], gemini: ['.gemini/google_accounts.json'], grok: ['.grok/auth.json'] }[id];
+        return paths ?? [];
+    });
+    const shred = shredPaths.map((p) => `rm -f "$HOME/${p}" 2>/dev/null || true`).join('\n');
     const installRuntimes = opts.runtimes.map((id) => `agents add ${q(id)} >/dev/null 2>&1 || true`).join('\n');
     return [
         'set -uo pipefail',
-        'if ! command -v agents >/dev/null 2>&1; then npm install -g @phnx-labs/agents-cli >/dev/null 2>&1 || true; fi',
+        ENSURE_AGENTS_CLI,
         installRuntimes,
         credScript,
         `${runParts.join(' ')}`,

package/dist/lib/crabbox/runtimes.d.ts

@@ -47,11 +47,48 @@ export declare function pickRuntimes(detected: DetectedRuntime[], prompt?: (choi
     checked: boolean;
     disabled: boolean | string;
 }[]) => Promise<AgentId[]>): Promise<AgentId[]>;
+/**
+ * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
+ * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
+ * lives here, so without it the box boots "Not logged in".
+ */
+export declare const CLAUDE_TOKEN_REMOTE = ".claude/.credentials.json";
+/**
+ * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
+ * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
+ *
+ * On macOS the token is in the login Keychain, read SILENTLY via
+ * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
+ * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * service; an agents-cli managed install (where `~/.claude` symlinks into a
+ * versioned home) uses a hash-suffixed service, so we try the bare service first,
+ * then enumerate installed version homes (preferring the account whose email
+ * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
+ * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
+ * reuse the rush.ts Linux branch verbatim.
+ *
+ * The reader/service/version helpers are injected so unit tests never touch the
+ * real Keychain.
+ */
+export declare function resolveClaudeCredentialsBlob(opts?: {
+    preferEmail?: string | null;
+    readItem?: (service: string) => string;
+    service?: (home?: string) => string;
+    listVersions?: () => string[];
+    versionHome?: (version: string) => string;
+    accountEmail?: (home: string) => Promise<string | null>;
+}): Promise<string | null>;
 /**
  * Build a bash snippet that writes each picked runtime's token file to the box's
  * home-level config path (0600), from the token contents read locally. Returns
  * `''` when no runtimes were selected. The snippet is meant to be embedded in
  * the `--script-stdin` body (never argv).
+ *
+ * `extras.claudeCredentialsJson` (the raw wrapped payload from
+ * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
+ * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
  */
-export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[]): string;
+export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): string;
 export {};

package/dist/lib/crabbox/runtimes.js

@@ -16,6 +16,10 @@ import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
 import { getAccountInfo } from '../agents.js';
+import { getKeychainToken } from '../secrets/index.js';
+import { getClaudeKeychainService } from '../usage.js';
+import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { readClaudeCredentialsBlob } from '../cloud/rush.js';
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
     { id: 'codex', label: 'Codex CLI', localCandidates: ['.codex/auth.json'], remote: '.codex/auth.json' },
@@ -79,15 +83,102 @@ export async function pickRuntimes(detected, prompt) {
 // token's contents effectively impossible, so the quoted heredoc can never be
 // closed early by the credential body.
 const CRED_EOF = 'AGENTS_LEASE_CRED_EOF_9f3c1a7b5e2d4068';
+/**
+ * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
+ * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
+ * lives here, so without it the box boots "Not logged in".
+ */
+export const CLAUDE_TOKEN_REMOTE = '.claude/.credentials.json';
+/** True when `s` parses to a Claude keychain payload with an OAuth access token. */
+function isClaudeCredentialsBlob(s) {
+    try {
+        const p = JSON.parse(s);
+        return typeof p?.claudeAiOauth?.accessToken === 'string';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
+ * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
+ *
+ * On macOS the token is in the login Keychain, read SILENTLY via
+ * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
+ * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * service; an agents-cli managed install (where `~/.claude` symlinks into a
+ * versioned home) uses a hash-suffixed service, so we try the bare service first,
+ * then enumerate installed version homes (preferring the account whose email
+ * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
+ * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
+ * reuse the rush.ts Linux branch verbatim.
+ *
+ * The reader/service/version helpers are injected so unit tests never touch the
+ * real Keychain.
+ */
+export async function resolveClaudeCredentialsBlob(opts) {
+    const readItem = opts?.readItem ?? getKeychainToken;
+    const service = opts?.service ?? getClaudeKeychainService;
+    const listVersions = opts?.listVersions ?? (() => listInstalledVersions('claude'));
+    const versionHome = opts?.versionHome ?? ((v) => getVersionHomePath('claude', v));
+    const accountEmail = opts?.accountEmail ?? (async (home) => (await getAccountInfo('claude', home)).email);
+    const tryRead = (svc) => {
+        try {
+            const raw = readItem(svc).trim();
+            return isClaudeCredentialsBlob(raw) ? raw : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    if (process.platform === 'darwin') {
+        // 1) Bare service — the default native (non-managed) install.
+        const bare = tryRead(service(undefined));
+        if (bare)
+            return bare;
+        // 2) Managed installs — hash-suffixed service keyed to each version home.
+        //    Prefer the version whose account email matches the copied config.
+        let homes;
+        try {
+            homes = listVersions().map(versionHome);
+        }
+        catch {
+            homes = [];
+        }
+        if (opts?.preferEmail) {
+            const scored = await Promise.all(homes.map(async (home) => ({ home, match: (await accountEmail(home).catch(() => null)) === opts.preferEmail })));
+            homes = [...scored.filter((s) => s.match), ...scored.filter((s) => !s.match)].map((s) => s.home);
+        }
+        for (const home of homes) {
+            const hit = tryRead(service(home));
+            if (hit)
+                return hit;
+        }
+        return null;
+    }
+    // Off darwin: the local Claude CLI already stores the wrapped blob on disk.
+    const home = process.env.AGENTS_REAL_HOME || os.homedir();
+    return readClaudeCredentialsBlob(home);
+}
 /**
  * Build a bash snippet that writes each picked runtime's token file to the box's
  * home-level config path (0600), from the token contents read locally. Returns
  * `''` when no runtimes were selected. The snippet is meant to be embedded in
  * the `--script-stdin` body (never argv).
+ *
+ * `extras.claudeCredentialsJson` (the raw wrapped payload from
+ * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
+ * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
  */
-export function buildCredentialScript(picked, detected) {
+export function buildCredentialScript(picked, detected, extras) {
     const byId = new Map(detected.map((d) => [d.id, d]));
     const parts = [];
+    const writeFile = (remote, contents) => {
+        const dir = path.posix.dirname(remote);
+        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
+        return (`${mkdir}cat > "$HOME/${remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
+            `chmod 600 "$HOME/${remote}"`);
+    };
     for (const id of picked) {
         const d = byId.get(id);
         const cred = LEASE_RUNTIMES.find((c) => c.id === id);
@@ -100,10 +191,12 @@ export function buildCredentialScript(picked, detected) {
         catch {
             continue;
         }
-        const dir = path.posix.dirname(cred.remote);
-        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
-        parts.push(`${mkdir}cat > "$HOME/${cred.remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
-            `chmod 600 "$HOME/${cred.remote}"`);
+        parts.push(writeFile(cred.remote, contents));
+        // For claude the file above is config/state only; the OAuth token is a
+        // second artifact — without it the box comes up "Not logged in".
+        if (id === 'claude' && extras?.claudeCredentialsJson) {
+            parts.push(writeFile(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
+        }
     }
     return parts.join('\n');
 }

package/dist/lib/daemon.d.ts

@@ -54,13 +54,15 @@ export declare function runDaemon(): Promise<void>;
 /**
  * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
  * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does, so the token is found whether it was stored
- * keychain-backed or as a literal. Returns null when the bundle/key isn't
- * configured, the Keychain read is cancelled, or the platform has no keychain —
- * the daemon then behaves exactly as before (relying on the interactive OAuth
- * session). Never throws: a misconfigured token must not block daemon startup.
+ * way `agents run --secrets` does. Interactive starts may prompt Keychain;
+ * headless auto-starts are broker-only and return null unless the user already
+ * unlocked the bundle in the secrets agent. That keeps a background browser
+ * command from hanging on an unseen biometric prompt. Never throws: an absent
+ * token leaves the daemon on its existing interactive OAuth session.
  */
-export declare function readDaemonClaudeOAuthToken(): string | null;
+export declare function readDaemonClaudeOAuthToken(opts?: {
+    allowPrompt?: boolean;
+}): string | null;
 /**
  * Write a launchd plist or systemd unit with owner-only permissions atomically.
  *
@@ -72,9 +74,10 @@ export declare function readDaemonClaudeOAuthToken(): string | null;
  */
 export declare function writeOwnerOnlyServiceManifest(filePath: string, content: string): void;
 /** Generate a macOS launchd plist for auto-starting the daemon. */
-export declare function generateLaunchdPlist(): string;
+export declare function generateLaunchdPlist(oauthToken?: string | null): string;
 /** Generate a Linux systemd user unit for auto-starting the daemon. */
-export declare function generateSystemdUnit(): string;
+export declare function generateSystemdUnit(oauthToken?: string | null): string;
+export declare function getAgentsBinPath(): string;
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(): {
     pid: number | null;
@@ -102,7 +105,7 @@ export declare function ensureDaemonStarted(): {
  * the daemon then passes it to every routine run it spawns. An already-set
  * value (e.g. inherited from launchd) is left untouched.
  */
-export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv, oauthToken?: string | null): NodeJS.ProcessEnv;
 /**
  * Resolve how to launch the daemon: `node <entry> daemon _run`, matching the
  * exact form that works under a direct `daemon _run`.