@phnx-labs/agents-cli 1.20.72 → 1.20.74

package/dist/lib/secrets/bundles.js

@@ -13,9 +13,12 @@
  *    SSH). The item-name scheme is identical, so the only difference is where
  *    bytes land. A file-backed bundle is discovered by the presence of its
  *    metadata item in the file store.
+ *  - `vault`: a single age-encrypted ~/.agents/vault.age file unlocked by
+ *    `agents login`; intended for user-managed cross-machine file sync.
  *
- * Cross-machine sync is handled by src/lib/secrets/sync.ts via an explicit
- * encrypted export/import flow; the bundle layer is sync-agnostic.
+ * Server-backed cross-machine sync is handled by src/lib/secrets/sync.ts via
+ * an explicit encrypted export/import flow; the bundle layer also supports the
+ * local vault backend for user-managed file sync.
  */
 import * as fs from 'fs';
 import * as os from 'os';
@@ -23,8 +26,10 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { deleteKeychainToken, getKeychainToken, getKeychainTokens, hasKeychainToken, isKeychainBackendOverridden, keychainServiceAlias, keychainUsesFileFallback, listKeychainItems, parseBundleValue, resolveRef, secretsKeychainItem, setKeychainToken, } from './index.js';
 import { fileStore } from './filestore.js';
+import { getVaultSession, vaultDeleteItem, vaultExists, vaultGetItems, vaultGetItem, vaultHasItem, vaultListItems, vaultSetItems, vaultSetItem, } from './vault.js';
 import { emit } from '../events.js';
 import { readMeta } from '../state.js';
+import { assertNameActiveInResourceProfile, filterNamesForActiveResourceProfile } from '../resource-profiles.js';
 import { agentGetSync, agentAutoLoadSync, agentGetMetaSync, agentAutoLoadMetaSync, agentEvictSync, secretsAgentAutoEnabled, secretsHoldMs } from './agent.js';
 import { loadSession, deleteSession } from './session-store.js';
 import { createHash } from 'node:crypto';
@@ -33,6 +38,10 @@ const keychainStore = {
     get: getKeychainToken,
     getBatch: getKeychainTokens,
     set: setKeychainToken,
+    setBatch: (items, opts) => {
+        for (const [item, value] of items)
+            setKeychainToken(item, value, opts);
+    },
     delete: deleteKeychainToken,
     list: listKeychainItems,
 };
@@ -59,11 +68,29 @@ const fileItemStore = {
         return out;
     },
     set: (item, value) => fileStore.set(item, value, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }),
+    setBatch: (items) => {
+        for (const [item, value] of items) {
+            fileStore.set(item, value, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION });
+        }
+    },
     delete: (item) => fileStore.delete(item),
     list: (prefix) => fileStore.list(prefix),
 };
+const vaultStore = {
+    has: vaultHasItem,
+    get: vaultGetItem,
+    getBatch: vaultGetItems,
+    set: (item, value) => vaultSetItem(item, value),
+    setBatch: (items) => vaultSetItems(items),
+    delete: vaultDeleteItem,
+    list: vaultListItems,
+};
 function itemStore(backend) {
-    return backend === 'file' ? fileItemStore : keychainStore;
+    if (backend === 'file')
+        return fileItemStore;
+    if (backend === 'vault')
+        return vaultStore;
+    return keychainStore;
 }
 /**
  * Discover a bundle's backend by location: a file-backed bundle's metadata
@@ -72,7 +99,20 @@ function itemStore(backend) {
  * "read metadata to learn where metadata lives." Absent ⇒ keychain.
  */
 export function bundleBackend(name) {
-    return fileStore.has(BUNDLE_META_PREFIX + name) ? 'file' : 'keychain';
+    const item = BUNDLE_META_PREFIX + name;
+    if (fileStore.has(item))
+        return 'file';
+    if (vaultExists() && getVaultSession().loggedIn) {
+        try {
+            if (vaultHasItem(item))
+                return 'vault';
+        }
+        catch {
+            // A vault problem should not hide a keychain/file bundle that already
+            // resolved above; exact vault reads surface the decrypt/login error.
+        }
+    }
+    return 'keychain';
 }
 /**
  * Guard a file-backed bundle operation. On macOS the file store must be
@@ -92,6 +132,11 @@ function assertFileBackendUsable(name) {
         `(no biometry prompt is available headlessly). Set it for this run, e.g.\n` +
         `  AGENTS_SECRETS_PASSPHRASE=… agents secrets exec ${name} -- <command>`);
 }
+function assertVaultBackendUsable(name) {
+    if (getVaultSession().loggedIn)
+        return;
+    throw new Error(`Synced bundle '${name}' needs an active login. Run: agents login`);
+}
 /** Allowed values for a secret's `type` metadata field. */
 export const SECRET_TYPES = [
     'api-key',
@@ -108,6 +153,7 @@ export const SECRET_TYPES = [
 const LAST_USED_THROTTLE_MS = 60_000;
 export const BUNDLE_NAME_PATTERN = /^[a-z0-9][a-z0-9\-_.]{0,48}$/i;
 export const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const BUNDLE_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z0-9_-]+)?$/;
 export const BUNDLE_META_PREFIX = 'agents-cli.bundles.';
 const SECRETS_ITEM_PREFIX = 'agents-cli.secrets.';
 export const RESERVED_ENV_NAMES = new Set([
@@ -121,6 +167,10 @@ export function bundleToEnvPrefix(name) {
 export function isReservedEnvName(key) {
     return RESERVED_ENV_NAMES.has(key.toUpperCase());
 }
+export function bundleKeyToEnvKey(key) {
+    const dot = key.indexOf('.');
+    return dot === -1 ? key : key.slice(0, dot);
+}
 export function isLoaderOrInterpreterEnv(name) {
     const upper = name.toUpperCase();
     return upper.startsWith('LD_') ||
@@ -156,10 +206,11 @@ export function validateBundleName(name) {
     }
 }
 export function validateEnvKey(key) {
-    if (!ENV_KEY_PATTERN.test(key)) {
-        throw new Error(`Invalid environment variable name '${key}'. Must match [A-Za-z_][A-Za-z0-9_]*.`);
+    if (!BUNDLE_KEY_PATTERN.test(key)) {
+        throw new Error(`Invalid bundle key '${key}'. Must match [A-Za-z_][A-Za-z0-9_]* with optional .account suffix.`);
     }
-    if (isLoaderOrInterpreterEnv(key) || isReservedEnvName(key)) {
+    const envKey = bundleKeyToEnvKey(key);
+    if (isLoaderOrInterpreterEnv(envKey) || isReservedEnvName(envKey)) {
         throw new Error(`Env key "${key}" is reserved — cannot be used in a secrets bundle. Reserved keys include PATH, HOME, USER, and dynamic-loader/interpreter vars (LD_*, DYLD_*, NODE_OPTIONS, etc.).`);
     }
 }
@@ -197,6 +248,8 @@ export function readBundle(name) {
     const backend = bundleBackend(name);
     if (backend === 'file')
         assertFileBackendUsable(name);
+    if (backend === 'vault')
+        assertVaultBackendUsable(name);
     let json;
     try {
         json = itemStore(backend).get(bundleMetaItem(name));
@@ -207,6 +260,9 @@ export function readBundle(name) {
         if (backend === 'file' && fileStore.has(bundleMetaItem(name))) {
             throw new Error(`Bundle '${name}': failed to decrypt — wrong AGENTS_SECRETS_PASSPHRASE or tampered file store. (${err.message})`);
         }
+        if (vaultExists() && !getVaultSession().loggedIn) {
+            throw new Error(`Synced secrets are locked. Run: agents login`);
+        }
         throw new Error(`Secrets bundle '${name}' not found.`);
     }
     let parsed;
@@ -226,9 +282,9 @@ export function readBundle(name) {
         name,
         description: parsed.description,
         allow_exec: Boolean(parsed.allow_exec),
-        // Absent ⇒ keychain; only set when file-backed so a keychain bundle
+        // Absent ⇒ keychain; only set when non-keychain so a keychain bundle
         // round-trips byte-for-byte.
-        backend: backend === 'file' ? 'file' : undefined,
+        backend: backend === 'keychain' ? undefined : backend,
         // Legacy wire key: the policy is persisted under `tier` (`session` == `daily`).
         policy: parsePolicy(parsed.tier),
         vars: parsed.vars && typeof parsed.vars === 'object' ? parsed.vars : {},
@@ -295,11 +351,13 @@ export function shouldEvictAfterBundleWrite(skipRequested, noAgentEnv, backendOv
         return false;
     return true;
 }
-export function writeBundle(bundle, opts = {}) {
+function prepareBundleWrite(bundle) {
     validateBundleName(bundle.name);
     const backend = bundle.backend ?? 'keychain';
     if (backend === 'file')
         assertFileBackendUsable(bundle.name);
+    if (backend === 'vault')
+        assertVaultBackendUsable(bundle.name);
     for (const key of Object.keys(bundle.vars)) {
         validateEnvKey(key);
     }
@@ -335,7 +393,7 @@ export function writeBundle(bundle, opts = {}) {
         name: bundle.name,
         description: bundle.description,
         allow_exec: bundle.allow_exec ? true : undefined,
-        backend: backend === 'file' ? 'file' : undefined,
+        backend: backend === 'keychain' ? undefined : backend,
         // Wire format: persist the policy under the legacy `tier` token so older CLI
         // versions on other synced machines keep reading it — `daily`⇒`session`,
         // explicit `always`⇒`biometry`, `never`⇒`none`. An absent policy omits the
@@ -352,12 +410,13 @@ export function writeBundle(bundle, opts = {}) {
         vars: bundle.vars,
         meta,
     };
-    const json = JSON.stringify(payload);
-    // A `never` bundle's metadata is stored without the biometry ACL too, so
-    // `view` and the metadata half of a read resolve silently — the whole point
-    // of the tier. On an un-updated pinned helper this write fails loudly (the
-    // no-ACL command is missing) rather than silently landing an ACL'd item.
-    itemStore(backend).set(bundleMetaItem(bundle.name), json, { noAcl: bundle.policy === 'never' });
+    return {
+        backend,
+        metadataItem: bundleMetaItem(bundle.name),
+        metadataJson: JSON.stringify(payload),
+    };
+}
+function finishBundleWrite(bundle, opts) {
     emit('secrets.set', { module: 'secrets', bundle: bundle.name });
     // A broker-held snapshot predates this write; evict it so the next read
     // re-resolves from the keychain instead of serving stale values.
@@ -368,6 +427,22 @@ export function writeBundle(bundle, opts = {}) {
         deleteSession(bundle.name);
     }
 }
+export function writeBundle(bundle, opts = {}) {
+    const prepared = prepareBundleWrite(bundle);
+    // A `never` bundle's metadata is stored without the biometry ACL too, so
+    // `view` and the metadata half of a read resolve silently — the whole point
+    // of the tier. On an un-updated pinned helper this write fails loudly (the
+    // no-ACL command is missing) rather than silently landing an ACL'd item.
+    itemStore(prepared.backend).set(prepared.metadataItem, prepared.metadataJson, { noAcl: bundle.policy === 'never' });
+    finishBundleWrite(bundle, opts);
+}
+export function writeBundleWithItems(bundle, items, opts = {}) {
+    const prepared = prepareBundleWrite(bundle);
+    const batch = new Map(items);
+    batch.set(prepared.metadataItem, prepared.metadataJson);
+    itemStore(prepared.backend).setBatch(batch, { noAcl: bundle.policy === 'never' });
+    finishBundleWrite(bundle, opts);
+}
 export function deleteBundle(name) {
     validateBundleName(name);
     const deleted = itemStore(bundleBackend(name)).delete(bundleMetaItem(name));
@@ -409,7 +484,7 @@ function parseBundleMeta(nameHint, json, backend) {
         name,
         description: parsed.description,
         allow_exec: Boolean(parsed.allow_exec),
-        backend: backend === 'file' ? 'file' : undefined,
+        backend: backend === 'keychain' ? undefined : backend,
         // Legacy wire key: the policy is persisted under `tier` (`session` == `daily`).
         policy: parsePolicy(parsed.tier),
         vars: parsed.vars && typeof parsed.vars === 'object' ? parsed.vars : {},
@@ -423,7 +498,7 @@ function parseBundleMeta(nameHint, json, backend) {
     if (parsed.meta && typeof parsed.meta === 'object')
         bundle.meta = parsed.meta;
     for (const key of Object.keys(bundle.vars)) {
-        if (!ENV_KEY_PATTERN.test(key))
+        if (!BUNDLE_KEY_PATTERN.test(key))
             return null;
     }
     return bundle;
@@ -534,7 +609,33 @@ export function listBundles() {
         if (bundle)
             out.push(bundle);
     }
-    return out.sort((a, b) => a.name.localeCompare(b.name));
+    if (getVaultSession().loggedIn && vaultExists()) {
+        let vaultServices = [];
+        try {
+            vaultServices = vaultListItems(BUNDLE_META_PREFIX);
+        }
+        catch {
+            vaultServices = [];
+        }
+        for (const service of vaultServices) {
+            const name = service.slice(BUNDLE_META_PREFIX.length);
+            if (!BUNDLE_NAME_PATTERN.test(name))
+                continue;
+            let json;
+            try {
+                json = vaultStore.get(bundleMetaItem(name));
+            }
+            catch {
+                out.push({ name, backend: 'vault', vars: {} });
+                continue;
+            }
+            const bundle = parseBundleMeta(name, json, 'vault');
+            if (bundle)
+                out.push(bundle);
+        }
+    }
+    const activeNames = new Set(filterNamesForActiveResourceProfile('secrets', out.map((b) => b.name)));
+    return out.filter((bundle) => activeNames.has(bundle.name)).sort((a, b) => a.name.localeCompare(b.name));
 }
 export function describeBundle(bundle) {
     const out = [];
@@ -612,6 +713,67 @@ function selectRequestedKeys(bundle, requested) {
     }
     return new Set(req ?? Object.keys(bundle.vars));
 }
+function assignResolvedEnvValue(env, bundle, storageKey, value, keyMode, owners) {
+    const envKey = keyMode === 'storage' ? storageKey : bundleKeyToEnvKey(storageKey);
+    const previous = owners.get(envKey);
+    if (previous && previous !== storageKey) {
+        throw new Error(`Bundle '${bundle.name}' maps multiple keys to '${envKey}': ${previous}, ${storageKey}. ` +
+            `Select one account variant with --keys.`);
+    }
+    owners.set(envKey, storageKey);
+    env[envKey] = value;
+}
+function projectResolvedEnv(bundle, env, selectedKeys, keyMode) {
+    if (keyMode === 'storage') {
+        const out = {};
+        for (const key of selectedKeys) {
+            if (key in env)
+                out[key] = env[key];
+        }
+        return out;
+    }
+    let needsProjection = false;
+    const owners = new Map();
+    for (const key of selectedKeys) {
+        const envKey = bundleKeyToEnvKey(key);
+        if (envKey !== key)
+            needsProjection = true;
+        const previous = owners.get(envKey);
+        if (previous && previous !== key) {
+            throw new Error(`Bundle '${bundle.name}' maps multiple keys to '${envKey}': ${previous}, ${key}. ` +
+                `Select one account variant with --keys.`);
+        }
+        owners.set(envKey, key);
+    }
+    if (!needsProjection) {
+        const envKeys = Object.keys(env);
+        if (selectedKeys.size === envKeys.length && envKeys.every((key) => selectedKeys.has(key)))
+            return env;
+        const out = {};
+        for (const key of selectedKeys) {
+            if (key in env)
+                out[key] = env[key];
+        }
+        return out;
+    }
+    const out = {};
+    for (const key of selectedKeys) {
+        if (key in env)
+            out[bundleKeyToEnvKey(key)] = env[key];
+    }
+    return out;
+}
+export function canCacheResolvedEnv(bundle, selectedKeys, keyMode) {
+    if (selectedKeys.size !== Object.keys(bundle.vars).length)
+        return false;
+    if (keyMode === 'storage')
+        return true;
+    for (const key of selectedKeys) {
+        if (bundleKeyToEnvKey(key) !== key)
+            return false;
+    }
+    return true;
+}
 /**
  * Apply the --keys subset + expiry gate to an already-resolved snapshot from
  * the secrets-agent fast-path. The agent stores the FULL bundle env, so a
@@ -625,15 +787,11 @@ function selectRequestedKeys(bundle, requested) {
 export function filterAgentHitBySubsetAndExpiry(hit, opts) {
     const selectedKeys = selectRequestedKeys(hit.bundle, opts.keys);
     assertNotExpired(hit.bundle, [...selectedKeys], opts.allowExpired ?? false);
-    // When no subset was requested, return the cached env untouched — same
-    // reference the agent handed back, so no per-call allocation on the hot path.
-    if (!opts.keys?.length)
+    const env = projectResolvedEnv(hit.bundle, hit.env, selectedKeys, opts.keyMode);
+    // When no subset/projection was requested, return the cached env untouched —
+    // same reference the agent handed back, so no per-call allocation on the hot path.
+    if (env === hit.env)
         return hit;
-    const env = {};
-    for (const key of selectedKeys) {
-        if (key in hit.env)
-            env[key] = hit.env[key];
-    }
     return { bundle: hit.bundle, env };
 }
 /**
@@ -681,12 +839,13 @@ export function resolveBundleEnv(bundle, _opts = {}) {
         ? store.getBatch(keychainItemsToFetch)
         : new Map();
     const env = {};
+    const owners = new Map();
     for (const [key, raw] of Object.entries(bundle.vars)) {
         if (!selectedKeys.has(key))
             continue;
         const parsed = parsedByKey.get(key);
         if ('literal' in parsed) {
-            env[key] = parsed.literal;
+            assignResolvedEnvValue(env, bundle, key, parsed.literal, _opts.keyMode, owners);
             continue;
         }
         if (parsed.ref.provider === 'keychain') {
@@ -696,14 +855,15 @@ export function resolveBundleEnv(bundle, _opts = {}) {
                 throw new Error(`Bundle '${bundle.name}' key '${key}': stored item '${item}' not found. ` +
                     `Run: agents secrets add ${bundle.name} ${key}`);
             }
-            env[key] = value;
+            assignResolvedEnvValue(env, bundle, key, value, _opts.keyMode, owners);
             continue;
         }
         try {
-            env[key] = resolveRef(parsed.ref, {
+            const value = resolveRef(parsed.ref, {
                 allowExec: bundle.allow_exec,
                 keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
             });
+            assignResolvedEnvValue(env, bundle, key, value, _opts.keyMode, owners);
         }
         catch (err) {
             throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
@@ -766,6 +926,7 @@ export function isHeadlessSecretsContext(env = process.env, platform = process.p
  */
 export function readAndResolveBundleEnv(name, opts = {}) {
     validateBundleName(name);
+    assertNameActiveInResourceProfile('secrets', name);
     const backend = bundleBackend(name);
     // Fast-path: if the secrets-agent holds this bundle (user ran
     // `agents secrets unlock <name>`), return the cached snapshot with no Touch
@@ -828,6 +989,8 @@ export function readAndResolveBundleEnv(name, opts = {}) {
     }
     if (backend === 'file')
         assertFileBackendUsable(name);
+    if (backend === 'vault')
+        assertVaultBackendUsable(name);
     const store = itemStore(backend);
     const metaItem = bundleMetaItem(name);
     const bundleSecretPrefix = `${SECRETS_ITEM_PREFIX}${name}.`;
@@ -856,6 +1019,9 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         if (backend === 'file' && fileStore.has(metaItem)) {
             throw new Error(`Bundle '${name}': failed to decrypt — wrong AGENTS_SECRETS_PASSPHRASE or tampered file store.`);
         }
+        if (vaultExists() && !getVaultSession().loggedIn) {
+            throw new Error(`Synced secrets are locked. Run: agents login`);
+        }
         throw new Error(`Secrets bundle '${name}' not found.`);
     }
     let parsed;
@@ -872,7 +1038,7 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         name,
         description: parsed.description,
         allow_exec: Boolean(parsed.allow_exec),
-        backend: backend === 'file' ? 'file' : undefined,
+        backend: backend === 'keychain' ? undefined : backend,
         // Legacy wire key: the policy is persisted under `tier` (`session` == `daily`).
         policy: parsePolicy(parsed.tier),
         vars: parsed.vars && typeof parsed.vars === 'object' ? parsed.vars : {},
@@ -923,12 +1089,13 @@ export function readAndResolveBundleEnv(name, opts = {}) {
     };
     try {
         const env = {};
+        const owners = new Map();
         for (const [key] of Object.entries(bundle.vars)) {
             if (!selectedKeys.has(key))
                 continue;
             const p = parsedByKey.get(key);
             if ('literal' in p) {
-                env[key] = p.literal;
+                assignResolvedEnvValue(env, bundle, key, p.literal, opts.keyMode, owners);
                 continue;
             }
             if (p.ref.provider === 'keychain') {
@@ -941,14 +1108,15 @@ export function readAndResolveBundleEnv(name, opts = {}) {
                     throw new Error(`Bundle '${bundle.name}' key '${key}': stored item '${item}' not found. ` +
                         `Run: agents secrets add ${bundle.name} ${key}`);
                 }
-                env[key] = value;
+                assignResolvedEnvValue(env, bundle, key, value, opts.keyMode, owners);
                 continue;
             }
             try {
-                env[key] = resolveRef(p.ref, {
+                const value = resolveRef(p.ref, {
                     allowExec: bundle.allow_exec,
                     keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
                 });
+                assignResolvedEnvValue(env, bundle, key, value, opts.keyMode, owners);
             }
             catch (err) {
                 throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
@@ -967,7 +1135,8 @@ export function readAndResolveBundleEnv(name, opts = {}) {
             !opts.noAgent &&
             process.env.AGENTS_SECRETS_NO_AGENT !== '1' &&
             bundlePolicy(bundle) === 'daily' &&
-            secretsAgentAutoEnabled()) {
+            secretsAgentAutoEnabled() &&
+            canCacheResolvedEnv(bundle, selectedKeys, opts.keyMode)) {
             agentAutoLoadSync(name, bundle, env, secretsHoldMs());
         }
         return { bundle, env };
@@ -1127,7 +1296,7 @@ export function parseDotenv(content) {
             (value.startsWith("'") && value.endsWith("'"))) {
             value = value.slice(1, -1);
         }
-        if (ENV_KEY_PATTERN.test(key)) {
+        if (BUNDLE_KEY_PATTERN.test(key)) {
             out[key] = value;
         }
     }

package/dist/lib/secrets/icloud-import.d.ts

@@ -11,8 +11,8 @@
  *
  * The item-name scheme is the same one the modern store uses (see bundles.ts):
  * metadata under `agents-cli.bundles.<name>`, one value per key under
- * `agents-cli.secrets.<bundle>.<key>`. Env keys can never contain a dot
- * (ENV_KEY_PATTERN), so splitting a secret service at its LAST dot recovers
+ * `agents-cli.secrets.<bundle>.<key>`. Legacy env keys never contained a dot,
+ * so metadata-less synced secret services split at their LAST dot to recover
  * the bundle/key boundary even for dotted bundle names like `hetzner.com`.
  */
 import { type SecretsBackend } from './bundles.js';

package/dist/lib/secrets/icloud-import.js

@@ -11,12 +11,12 @@
  *
  * The item-name scheme is the same one the modern store uses (see bundles.ts):
  * metadata under `agents-cli.bundles.<name>`, one value per key under
- * `agents-cli.secrets.<bundle>.<key>`. Env keys can never contain a dot
- * (ENV_KEY_PATTERN), so splitting a secret service at its LAST dot recovers
+ * `agents-cli.secrets.<bundle>.<key>`. Legacy env keys never contained a dot,
+ * so metadata-less synced secret services split at their LAST dot to recover
  * the bundle/key boundary even for dotted bundle names like `hetzner.com`.
  */
 import { deleteSyncedKeychainItem, getSyncedKeychainTokens, listSyncedKeychainItems, parseBundleValue, secretsKeychainItem, serializeRef, SECRETS_ITEM_PREFIX, } from './index.js';
-import { BUNDLE_META_PREFIX, BUNDLE_NAME_PATTERN, ENV_KEY_PATTERN, bundleExists, bundleItemStore, bundlePolicy, isLoaderOrInterpreterEnv, isReservedEnvName, keychainRef, readBundle, writeBundle, } from './bundles.js';
+import { BUNDLE_META_PREFIX, BUNDLE_NAME_PATTERN, BUNDLE_KEY_PATTERN, ENV_KEY_PATTERN, bundleKeyToEnvKey, bundleExists, bundleItemStore, bundlePolicy, isLoaderOrInterpreterEnv, isReservedEnvName, keychainRef, readBundle, writeBundle, } from './bundles.js';
 /**
  * Group raw synced service names into per-bundle candidates. Pure — separated
  * from discovery so the parsing rules are unit-testable without a keychain.
@@ -88,7 +88,7 @@ export function importSyncedBundle(candidate, opts = {}) {
     else {
         bundle = {
             name: candidate.name,
-            backend: opts.backend === 'file' ? 'file' : undefined,
+            backend: opts.backend === 'keychain' ? undefined : opts.backend,
             vars: {},
         };
     }
@@ -121,7 +121,10 @@ export function importSyncedBundle(candidate, opts = {}) {
     // these may be purged; a missing or unimportable key's iCloud item is its
     // only copy and must survive.
     const purgeable = new Set();
-    const rejectedByPolicy = (key) => isLoaderOrInterpreterEnv(key) || isReservedEnvName(key);
+    const rejectedByPolicy = (key) => {
+        const envKey = bundleKeyToEnvKey(key);
+        return isLoaderOrInterpreterEnv(envKey) || isReservedEnvName(envKey);
+    };
     // Keys with a synced secret item: re-store the value device-locally.
     for (const key of candidate.keys) {
         // The pre-cutover store accepted keys the modern one refuses (writeBundle
@@ -154,7 +157,7 @@ export function importSyncedBundle(candidate, opts = {}) {
     // carry everything they need; a keychain ref without its synced item is
     // unrecoverable.
     for (const [key, raw] of Object.entries(metaVars)) {
-        if (!ENV_KEY_PATTERN.test(key))
+        if (!BUNDLE_KEY_PATTERN.test(key))
             continue;
         if (candidate.keys.includes(key))
             continue; // the secret item already covered it

package/dist/lib/secrets/mcp.js

@@ -70,7 +70,7 @@ export function resolveSecret(bundle, key) {
     }
     // The MCP get_secret tool is typically served by a background/headless agent
     // process; resolve broker-only there so it never raises an unwatched prompt.
-    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp', agentOnly: isHeadlessSecretsContext() });
+    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp', keys: [key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
     const value = env[key];
     if (value === undefined) {
         throw new Error(`Key '${key}' in bundle '${bundle}' could not be resolved.`);

package/dist/lib/secrets/vault-age-helper.d.ts

@@ -0,0 +1 @@
+export declare function runVaultAgeHelperCli(): Promise<void>;

package/dist/lib/secrets/vault-age-helper.js

@@ -0,0 +1,34 @@
+import { Decrypter, Encrypter, armor } from 'age-encryption';
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+async function runAge(input) {
+    if (input.action === 'encrypt') {
+        const encrypter = new Encrypter();
+        if (input.scryptWorkFactor !== undefined) {
+            encrypter.setScryptWorkFactor(input.scryptWorkFactor);
+        }
+        encrypter.setPassphrase(input.passphrase);
+        return armor.encode(await encrypter.encrypt(input.plaintext ?? ''));
+    }
+    if (input.action === 'decrypt') {
+        const decrypter = new Decrypter();
+        decrypter.addPassphrase(input.passphrase);
+        return await decrypter.decrypt(armor.decode(input.blob ?? ''), 'text');
+    }
+    throw new Error('unknown action');
+}
+export async function runVaultAgeHelperCli() {
+    try {
+        const input = JSON.parse(await readStdin());
+        process.stdout.write(await runAge(input));
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+    }
+}

package/dist/lib/secrets/vault.d.ts

@@ -0,0 +1,49 @@
+export interface VaultKey {
+    passphrase: string;
+}
+export interface VaultBundleRecord {
+    metadata?: string;
+    keys: Record<string, string>;
+}
+export interface VaultData {
+    v: 1;
+    bundles: Record<string, VaultBundleRecord>;
+}
+export declare const VAULT_SESSION_TTL_MS: number;
+export declare const VAULT_SCRYPT_WORK_FACTOR = 18;
+export declare function vaultPath(): string;
+export declare function vaultExists(): boolean;
+export declare function _setVaultPathForTest(filePath: string | null): void;
+export declare function _clearVaultDataCacheForTest(): void;
+export declare function _resetVaultAgeOperationCountForTest(): void;
+export declare function _getVaultAgeOperationCountForTest(): number;
+export declare function _setVaultAgeHelperLaunchForTest(launch: {
+    command: string;
+    args: string[];
+} | null): void;
+export declare function encrypt(key: VaultKey, json: VaultData): string;
+export declare function decrypt(key: VaultKey, blob: string): VaultData;
+export declare function createVault(password: string, opts?: {
+    overwrite?: boolean;
+}): VaultKey;
+export declare function joinVault(password: string, sourcePath: string, opts?: {
+    overwrite?: boolean;
+}): VaultKey;
+export declare function unlock(password: string): VaultKey;
+export declare function cacheVaultKey(key: VaultKey, ttlMs?: number): void;
+export declare function clearVaultKey(): void;
+export declare function getVaultSession(): {
+    loggedIn: true;
+    key: VaultKey;
+    expiresAt: number;
+} | {
+    loggedIn: false;
+    expiresAt?: number;
+};
+export declare function vaultHasItem(item: string): boolean;
+export declare function vaultGetItem(item: string): string;
+export declare function vaultGetItems(items: string[]): Map<string, string>;
+export declare function vaultSetItem(item: string, value: string): void;
+export declare function vaultSetItems(items: Map<string, string>): void;
+export declare function vaultDeleteItem(item: string): boolean;
+export declare function vaultListItems(prefix: string): string[];