@phnx-labs/agents-cli 1.20.69 → 1.20.71

package/dist/lib/secrets/bundles.js

@@ -26,6 +26,7 @@ import { fileStore } from './filestore.js';
 import { emit } from '../events.js';
 import { readMeta } from '../state.js';
 import { agentGetSync, agentAutoLoadSync, agentGetMetaSync, agentAutoLoadMetaSync, agentEvictSync, secretsAgentAutoEnabled, secretsHoldMs } from './agent.js';
+import { loadSession, deleteSession } from './session-store.js';
 import { createHash } from 'node:crypto';
 const keychainStore = {
     has: hasKeychainToken,
@@ -362,6 +363,9 @@ export function writeBundle(bundle, opts = {}) {
     // re-resolves from the keychain instead of serving stale values.
     if (shouldEvictAfterBundleWrite(Boolean(opts.skipBrokerEviction), process.env.AGENTS_SECRETS_NO_AGENT, isKeychainBackendOverridden())) {
         agentEvictSync(bundle.name);
+        // Also drop any durable session snapshot, or a broker restart would rehydrate
+        // the stale env after a rotate/rename (session-store.ts).
+        deleteSession(bundle.name);
     }
 }
 export function deleteBundle(name) {
@@ -371,6 +375,7 @@ export function deleteBundle(name) {
         emit('secrets.delete', { module: 'secrets', bundle: name });
         if (shouldEvictAfterBundleWrite(false, process.env.AGENTS_SECRETS_NO_AGENT, isKeychainBackendOverridden())) {
             agentEvictSync(name);
+            deleteSession(name); // a deleted bundle must not be rehydratable
         }
     }
     return deleted;
@@ -787,6 +792,29 @@ export function readAndResolveBundleEnv(name, opts = {}) {
             });
             return filtered;
         }
+        // Durable-session fallback (Correction B). After a daemon restart / agents-cli
+        // upgrade the broker RAM is empty, so the fast-path above misses — but the
+        // unlock persisted a no-ACL session item (session-store.ts) that reads with NO
+        // Touch ID. Serve from it and re-warm the broker, so a warm bundle stays warm
+        // across restart — this fixes BOTH the interactive re-prompt and the headless
+        // throw below (which now fires only when there is genuinely no session).
+        const session = loadSession(name);
+        if (session) {
+            const filtered = filterAgentHitBySubsetAndExpiry({ bundle: session.bundle, env: session.env }, opts);
+            stampLastUsed(filtered.bundle);
+            // Re-warm the broker with the remaining TTL so later reads hit RAM and
+            // `agents secrets status` is honest. Best-effort; no-ops off darwin.
+            agentAutoLoadSync(name, session.bundle, session.env, Math.max(1, session.expiresAt - Date.now()));
+            emit('secrets.get', {
+                module: 'secrets',
+                bundle: name,
+                operation: opts.caller,
+                status: 'success',
+                source: 'session',
+                keyCount: Object.keys(filtered.env).length,
+            });
+            return filtered;
+        }
     }
     // Only keychain-backed bundles can pop a Touch ID prompt and are the only ones
     // the broker ever holds. A file-backed bundle resolves via passphrase with no

package/dist/lib/secrets/index.d.ts

@@ -22,6 +22,7 @@
  * through the explicit export/import flow in src/lib/secrets/sync.ts
  * rather than the system's cloud-keychain path.
  */
+import { type SpawnSyncOptions } from 'child_process';
 import type { NativeImportReport } from './fallback.js';
 export type { NativeImportReport, NativeImportResult, NativeImportStatus } from './fallback.js';
 export declare const SECRETS_ITEM_PREFIX = "agents-cli.secrets.";
@@ -221,6 +222,19 @@ export declare function getKeychainTokens(items: string[]): Map<string, string>;
  * a `ps` snapshot. Exported so a test can assert the value is absent from argv.
  */
 export declare function buildAddGenericPasswordArgs(account: string, item: string): string[];
+/**
+ * spawnSync options for the bare `-w` keychain write. Pure so the two
+ * load-bearing properties are unit-testable without touching the real keychain:
+ *   - `input` pipes the value TWICE (bare `-w` prompts enter+confirm; one line
+ *     fails the confirm and stores an empty secret).
+ *   - `detached: true` runs `security` in a new session with no controlling
+ *     terminal, so readpassphrase(3) falls back to our piped stdin instead of
+ *     prompting the user's `/dev/tty` in an interactive shell (see setKeychainToken).
+ */
+export declare function buildAddGenericPasswordSpawnOptions(value: string): SpawnSyncOptions & {
+    input: string;
+    detached: boolean;
+};
 export declare function setKeychainToken(item: string, value: string, opts?: {
     noAcl?: boolean;
 }): void;

package/dist/lib/secrets/index.js

@@ -506,6 +506,11 @@ export function computeRekeyPlan(services, values, key) {
             if (dot > 0)
                 noAcl = bundleNoAcl(rest.slice(0, dot));
         }
+        // Durable "unlocked session" items (agents-cli.session.*, see session-store.ts)
+        // are always no-ACL — re-wrapping them in a biometry ACL on rekey would break
+        // their silent (no-Touch-ID) reads that the rehydrate/fallback paths depend on.
+        if (service.startsWith('agents-cli.session.'))
+            noAcl = true;
         items.push({ oldService: service, newService: hashedServiceName(service, key), noAcl });
     }
     return { items, unreadable };
@@ -853,6 +858,25 @@ function parseBatchRecords(out, record) {
 export function buildAddGenericPasswordArgs(account, item) {
     return ['add-generic-password', '-U', '-a', account, '-s', item, '-w'];
 }
+/**
+ * spawnSync options for the bare `-w` keychain write. Pure so the two
+ * load-bearing properties are unit-testable without touching the real keychain:
+ *   - `input` pipes the value TWICE (bare `-w` prompts enter+confirm; one line
+ *     fails the confirm and stores an empty secret).
+ *   - `detached: true` runs `security` in a new session with no controlling
+ *     terminal, so readpassphrase(3) falls back to our piped stdin instead of
+ *     prompting the user's `/dev/tty` in an interactive shell (see setKeychainToken).
+ */
+export function buildAddGenericPasswordSpawnOptions(value) {
+    // `detached` is honored by spawnSync at runtime (libuv setsid) but is not
+    // declared on Node's SpawnSyncOptions type, so widen the return explicitly.
+    return {
+        input: `${value}\n${value}\n`,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: 10_000,
+        detached: true,
+    };
+}
 export function setKeychainToken(item, value, opts) {
     // Validate the CLEARTEXT name (a hashed storage name is always clean), then
     // resolve the storage name.
@@ -893,11 +917,18 @@ export function setKeychainToken(item, value, opts) {
         // (assertValueStorable above), so each line carries the whole secret verbatim
         // (no shell/quoting layer). `timeout` bounds the call so a context that cannot
         // read the prompt fails loudly instead of hanging.
-        const sec = spawnSync('/usr/bin/security', buildAddGenericPasswordArgs(os.userInfo().username, item), {
-            input: `${value}\n${value}\n`,
-            stdio: ['pipe', 'pipe', 'pipe'],
-            timeout: 10_000,
-        });
+        //
+        // `detached: true` is load-bearing, not an afterthought: readpassphrase(3)
+        // reads from the *controlling terminal* (`/dev/tty`) when one exists, and only
+        // falls back to fd 0 when it cannot open one. So piping over stdin works in a
+        // headless/CI context (no controlling tty) but is IGNORED in an interactive
+        // shell — there `security` prompts the real user ("password data for new
+        // item:") and hangs to the timeout, and any keystroke would be stored AS the
+        // secret. `detached` runs the child in a new session (setsid) with no
+        // controlling terminal, so readpassphrase always falls back to our piped
+        // stdin. Without it, an interactive `agents view` (refreshing+saving a Claude
+        // OAuth token) or `agents secrets add` pops a keychain password sheet.
+        const sec = spawnSync('/usr/bin/security', buildAddGenericPasswordArgs(os.userInfo().username, item), buildAddGenericPasswordSpawnOptions(value));
         if (sec.status !== 0) {
             const msg = sec.stderr?.toString().trim();
             throw new Error(msg || `Failed to write keychain item '${item}'.`);

package/dist/lib/secrets/session-store.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Durable "unlocked session" store (macOS).
+ *
+ * The secrets broker (agent.ts) holds unlocked bundles only in RAM, so an
+ * `agents secrets unlock` grant is lost whenever that process dies: on an
+ * agents-cli upgrade (the postinstall bounces the daemon) and on system SLEEP.
+ * This module persists the resolved bundle+env of an unlocked bundle as a
+ * NO-ACL keychain item — the `set-no-acl` write path, `kSecAttrAccessibleAfter-
+ * FirstUnlockThisDeviceOnly`, whose reads never pop Touch ID — so the broker can
+ * REHYDRATE it on start and reads can FALL BACK to it when the broker RAM misses.
+ *
+ * Split-default posture: `sleepPersist` is false by default — the item is deleted
+ * on SLEEP so the bundle re-locks on sleep but survives restart/upgrade; the
+ * `--durable` flag sets it true so it survives sleep too. Both expire at the TTL.
+ *
+ * Cross-platform: a NO-OP off macOS. Linux (secret-service) and Windows
+ * (Credential Manager) have no broker and resolve secrets durably from the OS
+ * store on every read with no prompt (see agent.ts:onDarwin gates) — there is no
+ * ephemeral unlock to persist.
+ *
+ * NEVER enumerate session items: once keychain-name hashing (#316) is active a
+ * `list('agents-cli.session.')` matches nothing. All I/O is by KNOWN name — one
+ * fixed-name index item lists the held bundles + their metadata, and one blob per
+ * bundle holds the env. Every adapter call is best-effort and never throws;
+ * persistence is an optimization, not a correctness dependency.
+ */
+import type { SecretsBundle } from './bundles.js';
+/** Prefix for all durable session items (device-local, no-ACL). */
+export declare const SESSION_ITEM_PREFIX = "agents-cli.session.";
+/** Fixed-name index item — the ONLY thing we ever need to find without a known
+ * bundle name, so it is read/written by this exact name (never enumerated). */
+export declare const SESSION_INDEX_ITEM = "agents-cli.session.index";
+/** One persisted unlocked bundle (mirrors the broker's StoredBundle + posture). */
+export interface SessionEntry {
+    bundle: SecretsBundle;
+    env: Record<string, string>;
+    /** epoch ms; the entry is dead once Date.now() passes this. */
+    expiresAt: number;
+    /** true only for `--durable` unlocks — survives SLEEP. */
+    sleepPersist: boolean;
+}
+/** Metadata for one held bundle, kept in the index so we can rehydrate / prune
+ * without reading every blob. */
+export interface SessionIndexMeta {
+    expiresAt: number;
+    sleepPersist: boolean;
+}
+export interface SessionIndex {
+    bundles: Record<string, SessionIndexMeta>;
+}
+/** The bundle names in the index that are still within their TTL at `now`. */
+export declare function selectRehydratable(index: SessionIndex, now: number): string[];
+/** Split an index on a SLEEP event: keep `sleepPersist` entries, report the rest
+ * (which the caller deletes from the keychain). Default entries re-lock on sleep. */
+export declare function pruneOnSleep(index: SessionIndex): {
+    survivors: SessionIndex;
+    deletedNames: string[];
+};
+/** Drop entries past their TTL; report which were dropped so the caller can
+ * delete their blobs. */
+export declare function pruneExpired(index: SessionIndex, now: number): {
+    survivors: SessionIndex;
+    expiredNames: string[];
+};
+/** Insert/replace one bundle in the index (pure). */
+export declare function upsertEntry(index: SessionIndex, name: string, meta: SessionIndexMeta): SessionIndex;
+/** Remove one bundle from the index (pure). */
+export declare function removeEntry(index: SessionIndex, name: string): SessionIndex;
+/** Read the session index by its fixed name. `{bundles:{}}` when absent/unreadable. */
+export declare function readIndex(): SessionIndex;
+/** Persist the index as a no-ACL item. Deletes the item when empty (tidy). */
+export declare function writeIndex(index: SessionIndex): void;
+/** Persist one unlocked bundle: write its blob no-ACL and record it in the index. */
+export declare function saveSession(name: string, entry: SessionEntry): void;
+/** Read one session blob by known name. Null when absent/expired/malformed. */
+export declare function loadSession(name: string, now?: number): SessionEntry | null;
+/** Delete one bundle's session blob and prune it from the index. */
+export declare function deleteSession(name: string): void;
+/** Delete every session blob + the index (for `secrets lock --all`). */
+export declare function deleteAllSessions(): void;
+/** Rehydrate every unexpired session into `[name, entry]` pairs for the broker to
+ * load on start; prunes expired index entries + blobs as a side effect. Survives
+ * upgrade/restart. Empty off darwin or when nothing is held. */
+export declare function rehydrateSessions(now?: number): Array<{
+    name: string;
+    entry: SessionEntry;
+}>;
+/** On a SLEEP event: delete every non-`--durable` session (blob + index entry),
+ * keep the durable ones. Default bundles thus re-lock on sleep. */
+export declare function pruneSessionsOnSleep(): void;

package/dist/lib/secrets/session-store.js

@@ -0,0 +1,221 @@
+/**
+ * Durable "unlocked session" store (macOS).
+ *
+ * The secrets broker (agent.ts) holds unlocked bundles only in RAM, so an
+ * `agents secrets unlock` grant is lost whenever that process dies: on an
+ * agents-cli upgrade (the postinstall bounces the daemon) and on system SLEEP.
+ * This module persists the resolved bundle+env of an unlocked bundle as a
+ * NO-ACL keychain item — the `set-no-acl` write path, `kSecAttrAccessibleAfter-
+ * FirstUnlockThisDeviceOnly`, whose reads never pop Touch ID — so the broker can
+ * REHYDRATE it on start and reads can FALL BACK to it when the broker RAM misses.
+ *
+ * Split-default posture: `sleepPersist` is false by default — the item is deleted
+ * on SLEEP so the bundle re-locks on sleep but survives restart/upgrade; the
+ * `--durable` flag sets it true so it survives sleep too. Both expire at the TTL.
+ *
+ * Cross-platform: a NO-OP off macOS. Linux (secret-service) and Windows
+ * (Credential Manager) have no broker and resolve secrets durably from the OS
+ * store on every read with no prompt (see agent.ts:onDarwin gates) — there is no
+ * ephemeral unlock to persist.
+ *
+ * NEVER enumerate session items: once keychain-name hashing (#316) is active a
+ * `list('agents-cli.session.')` matches nothing. All I/O is by KNOWN name — one
+ * fixed-name index item lists the held bundles + their metadata, and one blob per
+ * bundle holds the env. Every adapter call is best-effort and never throws;
+ * persistence is an optimization, not a correctness dependency.
+ */
+import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden } from './index.js';
+/** Prefix for all durable session items (device-local, no-ACL). */
+export const SESSION_ITEM_PREFIX = 'agents-cli.session.';
+/** Fixed-name index item — the ONLY thing we ever need to find without a known
+ * bundle name, so it is read/written by this exact name (never enumerated). */
+export const SESSION_INDEX_ITEM = 'agents-cli.session.index';
+// ─── Pure core (no I/O — unit-testable on any platform) ─────────────────────
+/** The bundle names in the index that are still within their TTL at `now`. */
+export function selectRehydratable(index, now) {
+    return Object.entries(index.bundles)
+        .filter(([, m]) => now < m.expiresAt)
+        .map(([name]) => name);
+}
+/** Split an index on a SLEEP event: keep `sleepPersist` entries, report the rest
+ * (which the caller deletes from the keychain). Default entries re-lock on sleep. */
+export function pruneOnSleep(index) {
+    const survivors = { bundles: {} };
+    const deletedNames = [];
+    for (const [name, m] of Object.entries(index.bundles)) {
+        if (m.sleepPersist)
+            survivors.bundles[name] = m;
+        else
+            deletedNames.push(name);
+    }
+    return { survivors, deletedNames };
+}
+/** Drop entries past their TTL; report which were dropped so the caller can
+ * delete their blobs. */
+export function pruneExpired(index, now) {
+    const survivors = { bundles: {} };
+    const expiredNames = [];
+    for (const [name, m] of Object.entries(index.bundles)) {
+        if (now < m.expiresAt)
+            survivors.bundles[name] = m;
+        else
+            expiredNames.push(name);
+    }
+    return { survivors, expiredNames };
+}
+/** Insert/replace one bundle in the index (pure). */
+export function upsertEntry(index, name, meta) {
+    return { bundles: { ...index.bundles, [name]: meta } };
+}
+/** Remove one bundle from the index (pure). */
+export function removeEntry(index, name) {
+    const { [name]: _drop, ...rest } = index.bundles;
+    void _drop;
+    return { bundles: rest };
+}
+// ─── Keychain adapter (macOS only; best-effort, never throws) ────────────────
+/** Whether to actually persist. macOS in production; also whenever a test
+ * keychain backend is installed, so the adapter is exercisable on Linux CI
+ * against an in-memory store (mirrors the broker's hermetic-test gating). In real
+ * Linux/Windows production this is false — secrets already persist in the OS store
+ * with no broker, so there is nothing to mirror. */
+function shouldPersist() {
+    return process.platform === 'darwin' || isKeychainBackendOverridden();
+}
+function sessionBlobItem(name) {
+    return `${SESSION_ITEM_PREFIX}${name}`;
+}
+/** Read the session index by its fixed name. `{bundles:{}}` when absent/unreadable. */
+export function readIndex() {
+    try {
+        const raw = getKeychainToken(SESSION_INDEX_ITEM);
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && parsed.bundles)
+            return parsed;
+    }
+    catch {
+        /* absent or malformed → empty */
+    }
+    return { bundles: {} };
+}
+/** Persist the index as a no-ACL item. Deletes the item when empty (tidy). */
+export function writeIndex(index) {
+    try {
+        if (Object.keys(index.bundles).length === 0) {
+            deleteKeychainToken(SESSION_INDEX_ITEM);
+            return;
+        }
+        setKeychainToken(SESSION_INDEX_ITEM, JSON.stringify(index), { noAcl: true });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Persist one unlocked bundle: write its blob no-ACL and record it in the index. */
+export function saveSession(name, entry) {
+    if (!shouldPersist())
+        return;
+    try {
+        setKeychainToken(sessionBlobItem(name), JSON.stringify(entry), { noAcl: true });
+        writeIndex(upsertEntry(readIndex(), name, { expiresAt: entry.expiresAt, sleepPersist: entry.sleepPersist }));
+    }
+    catch {
+        /* best-effort — persistence is an optimization */
+    }
+}
+/** Read one session blob by known name. Null when absent/expired/malformed. */
+export function loadSession(name, now = Date.now()) {
+    if (!shouldPersist())
+        return null;
+    try {
+        const raw = getKeychainToken(sessionBlobItem(name));
+        const entry = JSON.parse(raw);
+        if (!entry || typeof entry !== 'object' || !entry.bundle || !entry.env)
+            return null;
+        if (now >= entry.expiresAt) {
+            deleteSession(name); // drop expired on read, mirroring the broker's get handler
+            return null;
+        }
+        return entry;
+    }
+    catch {
+        return null;
+    }
+}
+/** Delete one bundle's session blob and prune it from the index. */
+export function deleteSession(name) {
+    if (!shouldPersist())
+        return;
+    try {
+        deleteKeychainToken(sessionBlobItem(name));
+        writeIndex(removeEntry(readIndex(), name));
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Delete every session blob + the index (for `secrets lock --all`). */
+export function deleteAllSessions() {
+    if (!shouldPersist())
+        return;
+    try {
+        for (const name of Object.keys(readIndex().bundles)) {
+            try {
+                deleteKeychainToken(sessionBlobItem(name));
+            }
+            catch { /* keep going */ }
+        }
+        deleteKeychainToken(SESSION_INDEX_ITEM);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Rehydrate every unexpired session into `[name, entry]` pairs for the broker to
+ * load on start; prunes expired index entries + blobs as a side effect. Survives
+ * upgrade/restart. Empty off darwin or when nothing is held. */
+export function rehydrateSessions(now = Date.now()) {
+    if (!shouldPersist())
+        return [];
+    const out = [];
+    try {
+        const index = readIndex();
+        const { survivors, expiredNames } = pruneExpired(index, now);
+        for (const name of expiredNames) {
+            try {
+                deleteKeychainToken(sessionBlobItem(name));
+            }
+            catch { /* keep going */ }
+        }
+        if (expiredNames.length)
+            writeIndex(survivors);
+        for (const name of selectRehydratable(survivors, now)) {
+            const entry = loadSession(name, now);
+            if (entry)
+                out.push({ name, entry });
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    return out;
+}
+/** On a SLEEP event: delete every non-`--durable` session (blob + index entry),
+ * keep the durable ones. Default bundles thus re-lock on sleep. */
+export function pruneSessionsOnSleep() {
+    if (!shouldPersist())
+        return;
+    try {
+        const { survivors, deletedNames } = pruneOnSleep(readIndex());
+        for (const name of deletedNames) {
+            try {
+                deleteKeychainToken(sessionBlobItem(name));
+            }
+            catch { /* keep going */ }
+        }
+        writeIndex(survivors);
+    }
+    catch {
+        /* best-effort */
+    }
+}

package/dist/lib/session/render.d.ts

@@ -108,6 +108,14 @@ export declare function renderConversationMarkdown(events: SessionEvent[], opts?
  * `{ session, events }` wrapper so top-level fields (`plan`, `prUrl`, …) that
  * live on `SessionMeta` are visible without re-parsing events. Legacy
  * callers that pass no meta still get a bare `SessionEvent[]` array.
+ *
+ * Secrets are redacted by default (`opts.redact !== false`), matching
+ * `renderConversationMarkdown` — the JSON path must not be the one output
+ * format that leaks credentials. Redaction covers both events AND the session
+ * meta (e.g. `topic`, a verbatim first-message excerpt). Pass `{ redact: false }`
+ * for `--no-redact`.
  */
-export declare function renderJson(events: SessionEvent[], meta?: SessionMeta): string;
+export declare function renderJson(events: SessionEvent[], meta?: SessionMeta, opts?: {
+    redact?: boolean;
+}): string;
 export {};

package/dist/lib/session/render.js

@@ -913,19 +913,50 @@ export function renderConversationMarkdown(events, opts = {}) {
     }
     return parts.join('\n\n');
 }
+/**
+ * Deep-redact every string reachable from a JSON value, preserving structure.
+ * `redactSecrets` only rewrites secret-shaped substrings, so non-secret strings
+ * (paths, URLs, ids) and non-strings (numbers, booleans) pass through unchanged.
+ * Applied to the whole `--json` payload so every free-text field — event
+ * `content`/`command`/`output`/`args`, and meta `topic`/`label`/`plan`/`todos`
+ * — is covered, including fields added later.
+ */
+function redactDeep(value, sanitize) {
+    if (typeof value === 'string')
+        return sanitize(value);
+    if (Array.isArray(value))
+        return value.map((item) => redactDeep(item, sanitize));
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, val] of Object.entries(value))
+            out[key] = redactDeep(val, sanitize);
+        return out;
+    }
+    return value;
+}
 /**
  * Render one session's JSON output — the shape `agents sessions <id> --json`
  * emits. When `meta` is provided (the standard path), returns a
  * `{ session, events }` wrapper so top-level fields (`plan`, `prUrl`, …) that
  * live on `SessionMeta` are visible without re-parsing events. Legacy
  * callers that pass no meta still get a bare `SessionEvent[]` array.
+ *
+ * Secrets are redacted by default (`opts.redact !== false`), matching
+ * `renderConversationMarkdown` — the JSON path must not be the one output
+ * format that leaks credentials. Redaction covers both events AND the session
+ * meta (e.g. `topic`, a verbatim first-message excerpt). Pass `{ redact: false }`
+ * for `--no-redact`.
  */
-export function renderJson(events, meta) {
+export function renderJson(events, meta, opts = {}) {
+    const redact = opts.redact !== false;
+    const sanitize = (text) => redactSecrets(text);
+    const safeEvents = redact ? events.map((event) => redactDeep(event, sanitize)) : events;
     if (!meta)
-        return JSON.stringify(events, null, 2);
+        return JSON.stringify(safeEvents, null, 2);
     // Strip internal-only bookkeeping fields the listing --json path also strips.
-    const { _matchedTerms, _bm25Score, _remote, ...session } = meta;
-    return JSON.stringify({ session, events }, null, 2);
+    const { _matchedTerms, _bm25Score, _remote, ...rest } = meta;
+    const session = redact ? redactDeep(rest, sanitize) : rest;
+    return JSON.stringify({ session, events: safeEvents }, null, 2);
 }
 /** Replace the home directory prefix with ~ for trace display. */
 function shortenPathTrace(p) {

package/dist/lib/share/capture.d.ts

@@ -21,6 +21,8 @@ export declare const OG_HEIGHT = 630;
 export declare const OG_SCALE = 2;
 /** Ordered list of candidate Chromium-family binaries to try for headless capture. */
 export declare function candidateBrowsers(): string[];
+/** Newest-first Chromium binaries under the Playwright / Puppeteer download caches. */
+export declare function scanCaches(home?: string, platform?: NodeJS.Platform): string[];
 /**
  * Screenshot `htmlPath`'s top 1200×630 (its hero) to a PNG buffer, or null if no
  * headless-capable browser is available or every candidate fails. Never throws —

package/dist/lib/share/capture.js

@@ -55,22 +55,29 @@ export function candidateBrowsers() {
     return out;
 }
 /** Newest-first Chromium binaries under the Playwright / Puppeteer download caches. */
-function scanCaches() {
-    const home = os.homedir();
-    const roots = os.platform() === 'darwin'
+export function scanCaches(home = os.homedir(), platform = os.platform()) {
+    const roots = platform === 'darwin'
         ? [
             path.join(home, 'Library/Caches/ms-playwright'),
             path.join(home, '.cache/ms-playwright'),
             path.join(home, '.cache/puppeteer/chrome'),
         ]
         : [path.join(home, '.cache/ms-playwright'), path.join(home, '.cache/puppeteer/chrome')];
-    const rel = os.platform() === 'darwin'
+    const rel = platform === 'darwin'
         ? [
             'chrome-mac/Chromium.app/Contents/MacOS/Chromium',
             'chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
             'chrome-mac-x64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
+            // Playwright's newer headless-shell packages (chromium_headless_shell-*) —
+            // a raw binary, not an .app bundle.
+            'chrome-headless-shell-mac-arm64/chrome-headless-shell',
+            'chrome-headless-shell-mac-x64/chrome-headless-shell',
         ]
-        : ['chrome-linux/chrome', 'chrome-linux64/chrome'];
+        : [
+            'chrome-linux/chrome',
+            'chrome-linux64/chrome',
+            'chrome-headless-shell-linux64/chrome-headless-shell',
+        ];
     const found = [];
     for (const root of roots) {
         let entries;

package/dist/lib/skills.d.ts

@@ -92,7 +92,14 @@ export declare function listAllSkills(): string[];
  */
 export declare function getVersionSkillsDir(agent: AgentId, version: string): string;
 /**
- * List skill names installed in a specific version home.
+ * List real skill names installed in a specific version home.
+ *
+ * Command-as-skill WRAPPERS (a `skills/<name>/SKILL.md` carrying the
+ * `agents_command` marker — how command-runtime agents like Codex/Kimi install
+ * commands) are excluded: they are commands, reconciled by the commands diff
+ * against the command source, not skills. Counting them here made the skill
+ * orphan/extra detectors flag every command wrapper (tickets, prune, swarm-plan,
+ * …) as an unmanaged skill — a false positive that `prune cleanup` would delete.
  */
 export declare function listSkillsInVersionHome(agent: AgentId, version: string): string[];
 export interface VersionSkillDiff {

package/dist/lib/skills.js

@@ -14,6 +14,7 @@ import { AGENTS, ensureSkillsDir, agentConfigDirName } from './agents.js';
 import { capableAgents, isCapable } from './capabilities.js';
 import { getUserSkillsDir, getSkillsDir as getSystemSkillsDir, getProjectAgentsDir, getEnabledExtraRepos, getTrashSkillsDir } from './state.js';
 import { getEffectiveHome, getVersionHomePath, listInstalledVersions } from './versions.js';
+import { listCommandSkillsInVersion } from './command-skills.js';
 import { emit } from './events.js';
 const HOME = os.homedir();
 /** User-scoped skills dir (~/.agents/skills/). Used for installs. */
@@ -392,16 +393,25 @@ export function getVersionSkillsDir(agent, version) {
     return path.join(home, agentConfigDirName(agent), 'skills');
 }
 /**
- * List skill names installed in a specific version home.
+ * List real skill names installed in a specific version home.
+ *
+ * Command-as-skill WRAPPERS (a `skills/<name>/SKILL.md` carrying the
+ * `agents_command` marker — how command-runtime agents like Codex/Kimi install
+ * commands) are excluded: they are commands, reconciled by the commands diff
+ * against the command source, not skills. Counting them here made the skill
+ * orphan/extra detectors flag every command wrapper (tickets, prune, swarm-plan,
+ * …) as an unmanaged skill — a false positive that `prune cleanup` would delete.
  */
 export function listSkillsInVersionHome(agent, version) {
     const dir = getVersionSkillsDir(agent, version);
     if (!fs.existsSync(dir))
         return [];
+    const commandWrappers = new Set(listCommandSkillsInVersion(path.join(getVersionHomePath(agent, version), agentConfigDirName(agent))));
     return fs.readdirSync(dir, { withFileTypes: true })
         .filter((e) => e.isDirectory() && !e.name.startsWith('.'))
         .filter((e) => fs.existsSync(path.join(dir, e.name, 'SKILL.md')))
         .map((e) => e.name)
+        .filter((name) => !commandWrappers.has(name))
         .sort();
 }
 /**

package/dist/lib/types.d.ts

@@ -664,12 +664,16 @@ export interface Meta {
      * concurrent runs read silently — set it `false` to force a prompt on every read.
      * `holdMs` caps how long an unlocked/auto-cached bundle is held before the next
      * read re-prompts (default 7 days; e.g. 86400000 for a 24h cap). Clamped to
-     * [1 minute, 30 days]. */
+     * [1 minute, 30 days]. `durable` (default off) makes every `agents secrets
+     * unlock` survive sleep + reboot as well as upgrade/restart — the same effect as
+     * passing `--durable` per unlock; off means the secure split default (survive
+     * upgrade/restart, re-lock on sleep). */
     secrets?: {
         policy?: 'always' | 'daily';
         agent?: {
             auto?: boolean;
             holdMs?: number;
+            durable?: boolean;
         };
     };
     /** Spend guardrails (issue #346). User-global caps; project agents.yaml overrides. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.69",
+  "version": "1.20.71",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",