@phnx-labs/agents-cli 1.20.52 → 1.20.53

package/dist/lib/secrets/icloud-import.js

@@ -16,7 +16,7 @@
  * the bundle/key boundary even for dotted bundle names like `hetzner.com`.
  */
 import { deleteSyncedKeychainItem, getSyncedKeychainTokens, listSyncedKeychainItems, parseBundleValue, secretsKeychainItem, serializeRef, SECRETS_ITEM_PREFIX, } from './index.js';
-import { BUNDLE_META_PREFIX, BUNDLE_NAME_PATTERN, ENV_KEY_PATTERN, bundleExists, bundleItemStore, bundlePolicy, keychainRef, readBundle, writeBundle, } from './bundles.js';
+import { BUNDLE_META_PREFIX, BUNDLE_NAME_PATTERN, ENV_KEY_PATTERN, bundleExists, bundleItemStore, bundlePolicy, isLoaderOrInterpreterEnv, isReservedEnvName, keychainRef, readBundle, writeBundle, } from './bundles.js';
 /**
  * Group raw synced service names into per-bundle candidates. Pure — separated
  * from discovery so the parsing rules are unit-testable without a keychain.
@@ -72,9 +72,12 @@ export function discoverSyncedBundles() {
  * Values come from the synced secret items; the synced metadata item, when
  * present, contributes the description, literal vars, and non-keychain refs
  * (env:/file:/exec: refs carry no stored secret, so copying the ref preserves
- * them exactly). Existing local keys are skipped unless `force`. With `purge`,
- * only services whose value was successfully read are deleted from iCloud —
- * an unreadable item is never destroyed.
+ * them exactly). Existing local keys are skipped unless `force`. Keys the
+ * modern store refuses by policy (reserved / loader env names the pre-cutover
+ * store accepted) are reported as `unimportable` instead of aborting the whole
+ * bundle. With `purge`, only services whose value provably lives locally
+ * (imported now, or skipped-because-present) are deleted from iCloud — an
+ * unreadable or unimportable item is never destroyed.
  */
 export function importSyncedBundle(candidate, opts = {}) {
     const values = getSyncedKeychainTokens(candidate.services);
@@ -112,8 +115,21 @@ export function importSyncedBundle(candidate, opts = {}) {
     let added = 0;
     let skipped = 0;
     const missing = [];
+    const unimportable = [];
+    // Services whose value now provably lives in the local store — imported this
+    // run, or skipped because the local bundle already carries the key. Only
+    // these may be purged; a missing or unimportable key's iCloud item is its
+    // only copy and must survive.
+    const purgeable = new Set();
+    const rejectedByPolicy = (key) => isLoaderOrInterpreterEnv(key) || isReservedEnvName(key);
     // Keys with a synced secret item: re-store the value device-locally.
     for (const key of candidate.keys) {
+        // The pre-cutover store accepted keys the modern one refuses (writeBundle
+        // throws) — skip them instead of aborting the whole bundle.
+        if (rejectedByPolicy(key)) {
+            unimportable.push(key);
+            continue;
+        }
         const value = values.get(secretsKeychainItem(candidate.name, key));
         if (value === undefined) {
             missing.push(key);
@@ -121,6 +137,7 @@ export function importSyncedBundle(candidate, opts = {}) {
         }
         if (!opts.force && key in bundle.vars) {
             skipped++;
+            purgeable.add(secretsKeychainItem(candidate.name, key));
             continue;
         }
         if (opts.allPlaintext) {
@@ -130,6 +147,7 @@ export function importSyncedBundle(candidate, opts = {}) {
             store.set(secretsKeychainItem(candidate.name, key), value);
             bundle.vars[key] = keychainRef(key);
         }
+        purgeable.add(secretsKeychainItem(candidate.name, key));
         added++;
     }
     // Vars declared only in the synced metadata: literals and non-keychain refs
@@ -140,6 +158,11 @@ export function importSyncedBundle(candidate, opts = {}) {
             continue;
         if (candidate.keys.includes(key))
             continue; // the secret item already covered it
+        if (rejectedByPolicy(key)) {
+            if (!unimportable.includes(key))
+                unimportable.push(key);
+            continue;
+        }
         let parsed;
         try {
             parsed = parseBundleValue(raw);
@@ -160,14 +183,21 @@ export function importSyncedBundle(candidate, opts = {}) {
         added++;
     }
     writeBundle(bundle);
+    // The metadata item is only a projection of what was just written locally —
+    // safe to purge once writeBundle has succeeded, UNLESS it still names keys
+    // that never made it over (missing/unimportable): then it stays as the only
+    // record of them.
+    if (metaJson !== undefined && missing.length === 0 && unimportable.length === 0) {
+        purgeable.add(metaService);
+    }
     let purged = 0;
     if (opts.purge) {
         for (const svc of candidate.services) {
-            if (!values.has(svc))
-                continue; // never destroy an item we couldn't read
+            if (!purgeable.has(svc))
+                continue;
             if (deleteSyncedKeychainItem(svc))
                 purged++;
         }
     }
-    return { name: candidate.name, added, skipped, missing, purged };
+    return { name: candidate.name, added, skipped, missing, unimportable, purged };
 }

package/dist/lib/secrets/index.d.ts

@@ -74,7 +74,11 @@ export declare function secretsKeychainItem(bundle: string, key: string): string
 export interface KeychainBackend {
     has(item: string): boolean;
     get(item: string): string;
-    set(item: string, value: string): void;
+    /** `opts.noAcl` mirrors setKeychainToken's no-ACL write path so tests can
+     * assert which path a write took; in-memory backends may ignore it. */
+    set(item: string, value: string, opts?: {
+        noAcl?: boolean;
+    }): void;
     delete(item: string): boolean;
     list(prefix: string): string[];
 }
@@ -85,6 +89,103 @@ export declare function setKeychainBackendForTest(b: KeychainBackend | null): Ke
  * with an in-memory backend there is no real keychain to dedup, so the broker
  * fast-path must not engage. Always false in production (`backend` is null). */
 export declare function isKeychainBackendOverridden(): boolean;
+export declare const HMAC_KEY_ITEM = "agents-cli.hmackey";
+/** Force hashed service names on with a fixed key (test only). Pass null to
+ * restore lazy production resolution. Composes with setKeychainBackendForTest
+ * so unit tests exercise the exact transform production uses. */
+export declare function setKeychainServiceHashingForTest(key: Buffer | null): void;
+/**
+ * Run `fn` with service-name hashing suspended: every primitive uses the
+ * literal names it is given. For migration flows ONLY — they enumerate raw
+ * names from the helper (which may be pre-re-key cleartext leftovers) and must
+ * read/delete those exact items, not their hashed transforms.
+ */
+export declare function withRawKeychainServiceNames<T>(fn: () => T): T;
+/** The hashed (storage) service name for a cleartext item name. Exported for
+ * the re-key migration and tests; runtime callers go through the primitives,
+ * which apply this transparently. */
+export declare function hashedServiceName(item: string, key: Buffer): string;
+/**
+ * The storage-layer service name for `item`: hashed when hashing is active,
+ * the item itself otherwise. For callers that mix helper-enumerated
+ * (already-hashed) names with computed cleartext names in one lookup map —
+ * see readAndResolveBundleEnv.
+ */
+export declare function keychainServiceAlias(item: string): string;
+/** One re-keyed (or failed) item, by its old cleartext service name. */
+export interface RekeyPlanItem {
+    oldService: string;
+    newService: string;
+    /** Preserve the no-ACL write path for `never`-policy bundle items. */
+    noAcl: boolean;
+    /** Replacement payload (bundle metadata gets `name` injected); absent = copy verbatim. */
+    payload?: string;
+}
+/**
+ * Build the old→new mapping for a set of cleartext services. Bundle metadata
+ * is parsed first to (a) recover each bundle's prompt policy — the persisted
+ * `tier` token, where `none`/`never` means the item must be re-written through
+ * the no-ACL path — and (b) inject the cleartext `name` into the JSON, because
+ * after hashing the service name can no longer carry it (listBundles reads it
+ * back from the payload). A value item's tier is resolved from its bundle's
+ * metadata PAYLOAD in `values` — under the cleartext metadata name or its
+ * hashed transform — never from the metadata item being part of the same
+ * `services` batch: a --prefix run can scope a bundle's value items alone, and
+ * rekeyServiceNames supplies the out-of-scope metadata reads (see the
+ * supplemental batch there). Exported for unit tests.
+ */
+export declare function computeRekeyPlan(services: string[], values: Map<string, string>, key: Buffer): {
+    items: RekeyPlanItem[];
+    unreadable: string[];
+};
+/** Outcome of one rekeyServiceNames run. */
+export interface RekeyReport {
+    /** Old cleartext services whose items now live under hashed names. */
+    migrated: string[];
+    failed: Array<{
+        item: string;
+        detail: string;
+    }>;
+    /** True when hashed naming is on after this run. */
+    activated: boolean;
+    nothingToDo: boolean;
+}
+/**
+ * The one-time re-key: move every cleartext-named `agents-cli.*` item to its
+ * hashed service name. Composed entirely from the existing helper primitives —
+ * no new Swift command:
+ *
+ *   1. Enumerate cleartext services (silent) and batch-read every value behind
+ *      ONE Touch ID (`get-batch`; readItem also sweeps legacy/orphaned copies).
+ *   2. Write each hashed copy (`set`/`set-no-acl` never prompt), preserving
+ *      the no-ACL tier for `never`-policy bundles.
+ *   3. Batch-verify every copy round-trips (second Touch ID).
+ *   4. Only then activate hashing (sentinel + pendingDeletes) and delete the
+ *      old items (silent).
+ *
+ * Add-before-delete throughout: a cancel/crash/failure anywhere before step 4
+ * leaves every old item intact and hashing OFF — same rationale as the
+ * helper's migrate-orphans, which is also why no pre-write backup is taken.
+ * On ANY per-item failure nothing is deleted and the sentinel stays off
+ * (all-or-nothing activation); the report names every failed item. A crash
+ * between the sentinel write and the deletes is resumed silently by the next
+ * process (pendingDeletes). Idempotent: re-running converges.
+ */
+export declare function rekeyServiceNames(opts?: {
+    prefixes?: string[];
+    announce?: boolean;
+    log?: (line: string) => void;
+}): RekeyReport;
+/** Re-key state snapshot for `agents secrets rekey --status`. */
+export declare function rekeyStatus(): {
+    migrated: boolean;
+    hasKey: boolean;
+    pendingDeletes: number;
+    cleartext: string[];
+    /** False when the enumeration probe fails (locked keybag) — the cleartext
+     * count is then meaningless. Only probeable once the key record exists. */
+    enumerationOk: boolean;
+};
 /** Check if a keychain/keyring item exists. Never prompts for biometry. */
 export declare function hasKeychainToken(item: string): boolean;
 /**
@@ -129,7 +230,10 @@ export declare function deleteKeychainToken(item: string): boolean;
  * and the direct file enumeration return the same items.
  */
 export declare function keychainUsesFileFallback(): boolean;
-/** Enumerate keychain/keyring item names starting with the given prefix. */
+/** Enumerate keychain/keyring item names starting with the given prefix.
+ * With hashed service names active, the two sub-namespace prefixes callers
+ * use (bundle metadata; one bundle's value items) are mapped to their hashed
+ * shapes — the returned names are then storage (opaque) names. */
 export declare function listKeychainItems(prefix: string): string[];
 /**
  * Enumerate ONLY legacy file-based-keychain item names with the given prefix —