@phnx-labs/agents-cli 1.20.77 → 1.20.78

package/dist/lib/devices/health-report.d.ts

@@ -1,6 +1,7 @@
 import { type DeviceStats } from './health.js';
 import { type HostAuthSummary } from '../auth-health.js';
 import type { OnlineState } from './reachability.js';
+import { type FleetInventory } from './fleet-divergence.js';
 export interface FleetCliStatus {
     installed: boolean;
     path: string | null;
@@ -40,9 +41,14 @@ export interface FleetHealthRow {
      *  an offline row. Sourced from the registry's tailscale snapshot / reachability
      *  verdict. Undefined when never recorded. */
     lastSeen?: string;
+    /** This host's self-reported harness inventory (resources / agent versions /
+     *  repo state) from its `doctor --json` `fleet` field, for cross-device
+     *  divergence detection (RUSH-2027). Undefined for an unreachable box or an
+     *  older CLI that doesn't emit it. */
+    inventory?: FleetInventory;
 }
 export interface FleetWarning {
-    kind: 'unreachable' | 'drift' | 'cli' | 'version-skew';
+    kind: 'unreachable' | 'drift' | 'cli' | 'version-skew' | 'divergence';
     devices: string[];
     message: string;
 }
@@ -53,7 +59,9 @@ export interface FleetHealthReport {
     hasWarnings: boolean;
     hasDrift: boolean;
 }
-export declare function buildFleetHealthReport(rows: FleetHealthRow[], now?: Date): FleetHealthReport;
+export declare function buildFleetHealthReport(rows: FleetHealthRow[], now?: Date, opts?: {
+    self?: string;
+}): FleetHealthReport;
 export declare function renderFleetWarnings(report: FleetHealthReport): string[];
 export declare function renderFleetMatrix(report: FleetHealthReport): string[];
 /**

package/dist/lib/devices/health-report.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { padToWidth, stringWidth, terminalWidth, truncateToWidth } from '../session/width.js';
 import { fmtBytes, headroom } from './health.js';
 import { formatCheckedAge } from '../auth-health.js';
+import { compareFleetInventories } from './fleet-divergence.js';
 function driftRows(row) {
     return row.sync.filter((s) => s.status !== 'fresh');
 }
@@ -12,7 +13,7 @@ function installedCliCount(row) {
         total: statuses.length,
     };
 }
-export function buildFleetHealthReport(rows, now = new Date()) {
+export function buildFleetHealthReport(rows, now = new Date(), opts = {}) {
     const warnings = [];
     const unreachable = rows
         .filter((r) => r.error || r.skipped)
@@ -60,6 +61,25 @@ export function buildFleetHealthReport(rows, now = new Date()) {
             message: `agents-cli version skew: ${Array.from(versions.keys()).sort().join(', ')}`,
         });
     }
+    // Cross-device harness divergence (RUSH-2027): compare every device's
+    // self-reported inventory against the local baseline and roll the findings up
+    // into one warning per affected device. Only runs when a baseline (`self`) is
+    // named and at least one device carries an inventory — an older-CLI fleet with
+    // no `fleet` field simply produces no divergence warning.
+    if (opts.self && rows.some((r) => r.inventory)) {
+        const divergence = compareFleetInventories(rows.map((r) => ({ name: r.name, inventory: r.inventory ?? null })), opts.self);
+        const byDevice = new Map();
+        for (const d of divergence.divergences)
+            byDevice.set(d.device, (byDevice.get(d.device) ?? 0) + 1);
+        for (const device of Array.from(byDevice.keys()).sort()) {
+            const n = byDevice.get(device);
+            warnings.push({
+                kind: 'divergence',
+                devices: [device],
+                message: `${device} diverges from ${opts.self} (${n} resource/version/repo gap${n === 1 ? '' : 's'})`,
+            });
+        }
+    }
     return {
         generatedAt: now.toISOString(),
         devices: rows,
@@ -326,6 +346,17 @@ export function buildFleetAttentionItems(report, now = Date.now()) {
             .join(' · ');
         items.push({ glyph: 'warn', subject: 'version skew', detail: summary, fix: 'agents upgrade --fleet' });
     }
+    // 4) Cross-device harness divergence — one item per diverged box (RUSH-2027).
+    for (const w of report.warnings) {
+        if (w.kind !== 'divergence')
+            continue;
+        items.push({
+            glyph: 'warn',
+            subject: w.devices[0] ?? 'fleet',
+            detail: w.message.replace(`${w.devices[0]} `, ''),
+            fix: `agents apply ${w.devices[0] ?? ''}`.trim(),
+        });
+    }
     return items;
 }
 /** Right-aligned `<content>` on the same line as `left`, clamped so it never

package/dist/lib/git.d.ts

@@ -86,6 +86,19 @@ export declare function clonePackage(source: string): Promise<{
 }>;
 /** Get the short commit hash (8 chars) of the latest commit in a repo. */
 export declare function getRepoCommit(repoPath: string): Promise<string>;
+/** Compact, self-contained state of a git repo — branch, short HEAD, and a
+ *  dirty flag — for cross-device comparison (RUSH-2027). Synchronous and
+ *  best-effort: a non-repo or unreadable path yields `null` fields, never a
+ *  throw, so a device's `doctor --json` payload always serializes. */
+export interface RepoStateSnapshot {
+    branch: string | null;
+    head: string | null;
+    dirty: boolean;
+}
+/** Read {@link RepoStateSnapshot} for `repoPath` using plumbing commands so the
+ *  result is stable across git versions and never mutates the tree. Returns null
+ *  when the path is not a git worktree. */
+export declare function readRepoState(repoPath: string): RepoStateSnapshot | null;
 /**
  * Get the current GitHub username using gh CLI.
  * Returns null if gh is not installed or user is not authenticated.

package/dist/lib/git.js

@@ -334,6 +334,34 @@ export async function getRepoCommit(repoPath) {
         return 'unknown';
     }
 }
+/** Read {@link RepoStateSnapshot} for `repoPath` using plumbing commands so the
+ *  result is stable across git versions and never mutates the tree. Returns null
+ *  when the path is not a git worktree. */
+export function readRepoState(repoPath) {
+    const runGit = (args) => {
+        try {
+            return execFileSync('git', ['-C', repoPath, ...args], {
+                stdio: ['ignore', 'pipe', 'ignore'],
+            })
+                .toString()
+                .trim();
+        }
+        catch {
+            return null;
+        }
+    };
+    // Gate on a real worktree first; `rev-parse --is-inside-work-tree` prints
+    // `true` only inside one, and returns non-zero (→ null) otherwise.
+    if (runGit(['rev-parse', '--is-inside-work-tree']) !== 'true')
+        return null;
+    const branchRaw = runGit(['rev-parse', '--abbrev-ref', 'HEAD']);
+    const branch = branchRaw && branchRaw !== 'HEAD' ? branchRaw : null; // detached → null
+    const headRaw = runGit(['rev-parse', 'HEAD']);
+    const head = headRaw ? headRaw.slice(0, 8) : null;
+    const porcelain = runGit(['status', '--porcelain']);
+    const dirty = porcelain != null && porcelain.length > 0;
+    return { branch, head, dirty };
+}
 /**
  * Get the current GitHub username using gh CLI.
  * Returns null if gh is not installed or user is not authenticated.
@@ -813,6 +841,39 @@ export async function commitOwnDeviceMeta(dir, metaAbs = getDeviceMetaPath()) {
 export async function pullRepo(dir) {
     try {
         const git = simpleGit(dir);
+        // A rebase left in progress by an earlier run must be reported as itself.
+        // Without this the dirty-tree guard below claims "Blocked by local changes",
+        // which is both wrong and actively harmful advice mid-rebase on a detached
+        // HEAD. Checked BEFORE commitOwnDeviceMeta so we never commit into one.
+        // Ask git where the state dirs live rather than assuming `<dir>/.git/` is a
+        // directory. In a worktree `.git` is a FILE containing `gitdir: <path>`, so
+        // path.join(dir, '.git', 'rebase-merge') can never exist and the check would
+        // silently never fire. `rev-parse --git-path` resolves both layouts.
+        const gitPath = async (name) => {
+            try {
+                const raw = (await git.raw(['rev-parse', '--git-path', name])).trim();
+                return path.isAbsolute(raw) ? raw : path.join(dir, raw);
+            }
+            catch {
+                return null;
+            }
+        };
+        const [rebaseMerge, rebaseApply] = await Promise.all([
+            gitPath('rebase-merge'),
+            gitPath('rebase-apply'),
+        ]);
+        const rebaseInProgress = (rebaseMerge !== null && fs.existsSync(rebaseMerge)) ||
+            (rebaseApply !== null && fs.existsSync(rebaseApply));
+        if (rebaseInProgress) {
+            return {
+                success: false,
+                commit: '',
+                error: `A previous rebase is still in progress — finish or abort it, then pull again.\n\n` +
+                    `  cd ${displayHomePath(dir)} && git status\n` +
+                    `  git rebase --continue   # after resolving\n` +
+                    `  git rebase --abort      # to discard the attempt`,
+            };
+        }
         // Commit this machine's own device-meta first so a per-machine pin change
         // never wedges the pull. Genuine edits elsewhere still block below.
         await commitOwnDeviceMeta(dir);
@@ -825,12 +886,15 @@ export async function pullRepo(dir) {
             };
         }
         const branch = status.current || 'main';
-        await git.fetch('origin');
         // Resolve the upstream ref to fast-forward against. Prefer the local
         // branch's tracking config; otherwise ask origin for its default branch.
         let tracking = status.tracking;
         if (!tracking) {
+            // No tracking config: fetch origin so its HEAD is known, then ask which
+            // branch it points at. This path only ever concerns origin — a branch with
+            // no upstream has no other remote to consult.
             try {
+                await git.fetch('origin');
                 await git.raw(['remote', 'set-head', 'origin', '--auto']);
                 const sym = await git.raw(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
                 tracking = sym.trim();
@@ -839,6 +903,22 @@ export async function pullRepo(dir) {
                 tracking = `origin/${branch}`;
             }
         }
+        // Split the remote-tracking ref (<remote>/<branch>) into its parts and pull
+        // THOSE. Hardcoding 'origin' while comparing against `tracking` is how a
+        // branch tracking e.g. upstream/main silently 'succeeded': revparse saw a
+        // difference, the pull fetched origin/main (already current), and pullRepo
+        // returned success having moved nothing — the same "reported ok, pulled
+        // nothing" failure this change exists to remove. Branch names may contain
+        // slashes, so split on the FIRST separator only.
+        const sep = tracking.indexOf('/');
+        const remoteName = sep > 0 ? tracking.slice(0, sep) : 'origin';
+        const remoteBranch = sep > 0 ? tracking.slice(sep + 1) : branch;
+        // Bare fetch: updates every remote, so the revparse below sees a fresh ref
+        // whichever one the branch tracks. Deliberately argument-less — simple-git's
+        // fetchTask only forwards a remote when BOTH remote and branch are passed,
+        // so `fetch(remoteName)` would silently drop the argument and do exactly
+        // this anyway. Saying so beats an inert argument that reads as targeted.
+        await git.fetch();
         const localRef = await git.revparse(['HEAD']);
         const remoteRef = await git.revparse([tracking]).catch(() => null);
         if (!remoteRef) {
@@ -853,13 +933,31 @@ export async function pullRepo(dir) {
             };
         }
         try {
-            await git.merge(['--ff-only', tracking]);
+            // Rebase, not --ff-only. Fast-forward refuses ANY divergence, conflict or
+            // not, so a single local commit — including the one commitOwnDeviceMeta
+            // makes just above — permanently wedged the pull with nothing actually in
+            // conflict. Every device carries its own devices/<host>/ path, so those
+            // replay cleanly. Matches syncRepoGit (below) and this function's own doc.
+            //
+            // Pull the RESOLVED tracking ref, not `branch`: when the local branch has
+            // no tracking config the block above falls back to origin's default head,
+            // which may be named differently (local `main` vs origin `master`). Using
+            // `branch` there asks origin for a ref it does not have.
+            assertValidBranchName(remoteBranch);
+            await git.pull(remoteName, remoteBranch, { '--rebase': 'true' });
         }
-        catch {
+        catch (err) {
+            // Abort so the tree is restored, matching the atomicity --ff-only gave us.
+            // Without this a conflict leaves the repo detached, mid-rebase, with
+            // conflict markers written into live config (this repo is ~/.agents —
+            // agents.yaml and AGENTS.md are in it), and every later pull misreports
+            // the cause. `agents sync` reaches this path unattended across the fleet,
+            // so a wedged checkout would be worse than the bug this fixes.
+            await git.raw(['rebase', '--abort']).catch(() => { });
             return {
                 success: false,
                 commit: '',
-                error: `Blocked by local commits. Push or reset them before pulling.\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}`,
+                error: `Rebase onto ${tracking} hit a conflict — the pull was rolled back, nothing changed.\n\nResolve the divergence, then pull again:\n\n  cd ${displayHomePath(dir)} && git log --oneline HEAD...${tracking}\n\n${err.message}`,
             };
         }
         installGithooksSymlinks(dir);

package/dist/lib/hosts/remote-cmd.js

@@ -116,6 +116,8 @@ export const RUN_OPTION_FORWARDING = {
     tailscale: 'local-only', // --tailscale/--no-tailscale gate the lease net mode; never forwarded
     copyCreds: 'local-only', // copies creds TO the host before dispatch — local concern only
     authCheck: 'local-only', // --no-auth-check gates the local interactive login preflight; --host runs skip that preflight entirely
+    // Deprecated alias for --device auto; resolved on the launching box before SSH.
+    smart: 'local-only',
 };
 /** Actionable messages for value-aware rejections, keyed by attribute name. */
 export const RUN_OPTION_REJECT_MESSAGES = {

package/dist/lib/menubar/MenubarHelper.app/Contents/Info.plist

@@ -8,6 +8,8 @@
     <string>com.phnx-labs.agents-menubar</string>
     <key>CFBundleName</key>
     <string>Agents Menu Bar</string>
+    <key>CFBundleIconFile</key>
+    <string>AppIcon</string>
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>

package/dist/lib/menubar/MenubarHelper.app/Contents/_CodeSignature/CodeResources

@@ -3,9 +3,22 @@
 <plist version="1.0">
 <dict>
 	<key>files</key>
-	<dict/>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<data>
+		Vd5nfogg74zSRNspluv4uvDecUA=
+		</data>
+	</dict>
 	<key>files2</key>
-	<dict/>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			DznVe0VgYOux7+B/aiHNgGYLCvSJKzgXDTPJn2jNkNg=
+			</data>
+		</dict>
+	</dict>
 	<key>rules</key>
 	<dict>
 		<key>^Resources/</key>

package/dist/lib/runner.js

@@ -27,9 +27,7 @@ import { loadTask as loadHostTask } from './hosts/tasks.js';
 import { reconcileTask as reconcileHostTask } from './hosts/reconcile.js';
 import { backgroundSpawnOptions } from './platform/process.js';
 import { walkForFiles } from './fs-walk.js';
-import { getBinaryPath, getVersionHomePath, isVersionInstalled, resolveVersion } from './versions.js';
-import { claudeHomeHasOwnCredential } from './agents.js';
-import { resolveAccountSetupToken } from './secrets/account-token.js';
+import { getBinaryPath, isVersionInstalled, resolveVersion } from './versions.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, } from './rotate.js';
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
@@ -400,29 +398,12 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone) {
         if (v !== undefined)
             out[k] = v;
     }
-    // A headless routine should authenticate the rotation-pinned account via its
-    // long-lived, NON-rotating setup-token, not the interactive OAuth session.
-    // Claude Code's interactive session uses single-use rotating refresh tokens: one
-    // fleet machine refreshing invalidates that account on every other machine, so
-    // they 401 and log out (Claude Code #25609 / #56339) — the fleet-wide daily
-    // logout. If the daemon injected this account's per-account
-    // CLAUDE_CODE_OAUTH_TOKEN_<slug> (from a headless-readable no-ACL bundle), use it;
-    // that also works on macOS, where the drop path below is inert
-    // (claudeHomeHasOwnCredential is false on darwin, agents.ts).
-    //
-    // Fallback (RUSH-1979): with no per-account token, keep the prior behavior — drop
-    // the single ambient CLAUDE_CODE_OAUTH_TOKEN when the pinned account has its own
-    // on-disk credential (Linux) so it isn't shadowed; keep it otherwise.
-    if (agent === 'claude' && version && out.CLAUDE_CONFIG_DIR) {
-        const home = getVersionHomePath('claude', version);
-        const accountToken = resolveAccountSetupToken(baseEnv, home);
-        if (accountToken) {
-            out.CLAUDE_CODE_OAUTH_TOKEN = accountToken;
-        }
-        else if (claudeHomeHasOwnCredential(home)) {
-            delete out.CLAUDE_CODE_OAUTH_TOKEN;
-        }
-    }
+    // No Claude token is injected here. A routine authenticates through the pinned
+    // account's own CLAUDE_CONFIG_DIR login (buildExecEnv points it at the
+    // per-account version home), identical to interactive `agents run`. Claude
+    // Code's interactive session refreshes itself per-device; keeping the daemon
+    // out of the credential entirely is what avoids the fleet-wide rotation logout
+    // — a shared/rotating token was the cause, not the fix.
     if (timezone)
         out.TZ = timezone;
     return out;
@@ -1063,6 +1044,28 @@ export async function executeJobDetached(config, hooks) {
         completedAt: null,
         exitCode: null,
     };
+    // Auth preflight (mirrors executeJob): with no injected token, a daemon-fired
+    // Claude routine authenticates via the pinned account's own CLAUDE_CONFIG_DIR
+    // login. If the last live probe rejected that (agent, version)'s token, the run
+    // is guaranteed to 401 — fail fast with a re-login hint instead of spawning a
+    // doomed run + poisoned report. Cache-only; fails OPEN on any non-dead/missing
+    // verdict, and agents with no live probe (codex/gemini/grok) are never blocked.
+    const preflightVersion = launch.chain[0]?.version;
+    if (preflightVersion) {
+        const health = readAuthHealth(machineId(), effectiveAgent, preflightVersion);
+        if (health && isDeadVerdict(health.verdict)) {
+            const reason = `auth_preflight: ${health.verdict}`;
+            process.stderr.write(`[agents] routine ${config.name}: ${effectiveAgent}@${preflightVersion} token ${health.verdict} — skipping run (re-login required)\n`);
+            try {
+                fs.closeSync(stdoutFd);
+            }
+            catch { /* already closed */ }
+            finalizeRunMeta(meta, 'failed', 1, { errorMessage: reason });
+            writeRunMeta(meta);
+            archiveRoutineTranscripts(meta, runDir, overlayHome);
+            return meta;
+        }
+    }
     const child = spawn(cmd[0], cmd.slice(1), {
         stdio: ['ignore', stdoutFd, stdoutFd],
         ...backgroundSpawnOptions({ fdStdio: true }),

package/dist/lib/sandbox.js

@@ -44,12 +44,6 @@ const ENV_ALLOWLIST = [
     'VISUAL',
     'NO_COLOR',
     'FORCE_COLOR',
-    // Headless Claude auth: the routines daemon injects CLAUDE_CODE_OAUTH_TOKEN
-    // from the `claude` secrets bundle (see daemon.ts). Without this allowlist
-    // entry, sandboxed routine spawns drop the token and look "unconfigured".
-    // Intentionally NOT ANTHROPIC_API_KEY / other provider secrets — those stay
-    // stripped (see tests/sandbox.test.ts "does not include sensitive env vars").
-    'CLAUDE_CODE_OAUTH_TOKEN',
 ];
 /** Tools safe to grant as wildcards (no filesystem access). */
 const SAFE_TOOLS = {
@@ -75,16 +69,6 @@ export function buildSpawnEnv(overlayHome, extraEnv) {
             env[key] = process.env[key];
         }
     }
-    // Per-account Claude setup-tokens: the daemon injects a CLAUDE_CODE_OAUTH_TOKEN_<slug>
-    // for each account so a routine authenticates its rotation-pinned account via a
-    // long-lived, non-rotating token (see runner.ts buildRoutineSpawnEnv). Forward every
-    // such key by prefix — same trust tier as CLAUDE_CODE_OAUTH_TOKEN above; still no API
-    // keys or other provider secrets.
-    for (const key of Object.keys(process.env)) {
-        if (key.startsWith('CLAUDE_CODE_OAUTH_TOKEN_') && process.env[key]) {
-            env[key] = process.env[key];
-        }
-    }
     if (extraEnv) {
         Object.assign(env, extraEnv);
     }

package/dist/lib/secrets/Agents CLI.app/Contents/Info.plist

@@ -8,6 +8,8 @@
   <string>Agents CLI</string>
   <key>CFBundleDisplayName</key>
   <string>Agents CLI</string>
+  <key>CFBundleIconFile</key>
+  <string>AppIcon</string>
   <key>CFBundleExecutable</key>
   <string>Agents CLI</string>
   <key>CFBundlePackageType</key>

package/dist/lib/secrets/Agents CLI.app/Contents/_CodeSignature/CodeResources

@@ -3,9 +3,21 @@
 <plist version="1.0">
 <dict>
 	<key>files</key>
-	<dict/>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<data>
+		Vd5nfogg74zSRNspluv4uvDecUA=
+		</data>
+	</dict>
 	<key>files2</key>
 	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			DznVe0VgYOux7+B/aiHNgGYLCvSJKzgXDTPJn2jNkNg=
+			</data>
+		</dict>
 		<key>embedded.provisionprofile</key>
 		<dict>
 			<key>hash2</key>

package/dist/lib/secrets/agent.d.ts

@@ -25,6 +25,8 @@
  */
 import * as net from 'net';
 import type { SecretsBundle } from './bundles.js';
+import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
+export { GLOBAL_HARNESS, bundleScopeChain };
 /** Default lifetime of an unlocked bundle when `--ttl` is not given. */
 export declare const DEFAULT_TTL_MS: number;
 /**

package/dist/lib/secrets/agent.js

@@ -34,8 +34,14 @@ import { isAlive } from '../platform/process.js';
 import { getKeychainHelperPath } from './install-helper.js';
 import { getCliVersion, getCliVersionFresh } from '../version.js';
 import { getCliLaunch } from '../cli-entry.js';
+import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
 import { rehydrateSessions, pruneSessionsOnSleep } from './session-store.js';
 import { SYNC_GET_CMD, SYNC_PING_CMD, SYNC_LOCK_CMD } from './sync-commands.js';
+// Re-exported so callers already reaching for agent.js keep one obvious home for
+// the scope vocabulary; the definitions live in the leaf module scope.ts because
+// agent.ts and session-store.ts import each other and a cyclic `const` read can
+// hit the ESM temporal dead zone at runtime.
+export { GLOBAL_HARNESS, bundleScopeChain };
 /** Bumped when the wire protocol changes; a client that pings a mismatched
  * server kills and respawns it rather than talking a stale dialect. */
 const PROTOCOL_VERSION = 2;
@@ -133,7 +139,7 @@ function onDarwin() {
 function rehydrateStore(now = Date.now()) {
     const store = new Map();
     for (const { name, entry } of rehydrateSessions(now)) {
-        const harness = entry.harness || 'cli';
+        const harness = entry.harness || GLOBAL_HARNESS;
         store.set(scopedBundleKey(name, harness), { bundle: entry.bundle, env: entry.env, expiresAt: entry.expiresAt, harness });
     }
     return store;
@@ -309,17 +315,23 @@ export function handleAgentRequest(store, req, now = Date.now()) {
             // the broker is running pre-upgrade code and should be restarted.
             return { ok: true, cmd: 'ping', version: PROTOCOL_VERSION, cliVersion: getCliVersion() };
         case 'get': {
-            const key = scopedBundleKey(req.name, req.harness || 'cli');
-            const e = store.get(key);
-            if (!e || now >= e.expiresAt) {
-                if (e)
-                    store.delete(key); // drop expired on read
-                return { ok: true, cmd: 'get', hit: false };
+            // Walk own-harness → global so a `--for` grant wins over a global one and
+            // an unscoped unlock serves every harness (bundleScopeChain).
+            for (const scope of bundleScopeChain(req.harness)) {
+                const key = scopedBundleKey(req.name, scope);
+                const e = store.get(key);
+                if (!e)
+                    continue;
+                if (now >= e.expiresAt) {
+                    store.delete(key);
+                    continue;
+                } // drop expired on read
+                return { ok: true, cmd: 'get', hit: true, bundle: e.bundle, env: e.env };
             }
-            return { ok: true, cmd: 'get', hit: true, bundle: e.bundle, env: e.env };
+            return { ok: true, cmd: 'get', hit: false };
         }
         case 'load':
-            const harness = req.harness || 'cli';
+            const harness = req.harness || GLOBAL_HARNESS;
             store.set(scopedBundleKey(req.name, harness), { bundle: req.bundle, env: req.env, expiresAt: now + req.ttlMs, harness });
             return { ok: true, cmd: 'load' };
         case 'lock': {
@@ -834,7 +846,7 @@ function syncClient(sub, timeout) {
  * null if the agent isn't running / doesn't hold this bundle / anything fails
  * (soft — caller falls through to the real keychain). macOS only.
  */
-export function agentGetSync(name, harness = 'cli') {
+export function agentGetSync(name, harness = GLOBAL_HARNESS) {
     if (!agentSocketExists())
         return null;
     const r = syncClient([SYNC_GET_CMD, name, harness], SYNC_GET_TIMEOUT_MS);
@@ -914,7 +926,7 @@ export function agentEvictSync(name) {
 // so a cache hit never runs checkForUpdates() or forks a detached sync.
 /** Body of `__secrets-get <name>`. Prints `{bundle, env}` as JSON on a
  * cache hit. Exit 0 = hit, 3 = miss or broker down. */
-export async function runAgentGetSync(name, harness = 'cli') {
+export async function runAgentGetSync(name, harness = GLOBAL_HARNESS) {
     const r = await request({ cmd: 'get', name, harness }, SOCKET_GET_TIMEOUT_MS);
     if (r?.ok === true && r.cmd === 'get' && r.hit) {
         // Trailing newline: the parent reads the LAST line (see lastLine), so the
@@ -1066,7 +1078,7 @@ export function clampHoldMs(v) {
  * The worker reuses the robust `ensureAgentRunning` path (spawn-then-ping) rather
  * than a tight inline retry loop. Best-effort; never throws. macOS only.
  */
-export function agentAutoLoadSync(name, bundle, env, ttlMs, harness = 'cli') {
+export function agentAutoLoadSync(name, bundle, env, ttlMs, harness = GLOBAL_HARNESS) {
     if (!onDarwin())
         return;
     const payload = JSON.stringify({ name, bundle, env, ttlMs, harness });
@@ -1136,12 +1148,12 @@ export async function runAgentLoadFromStdin() {
         process.exitCode = 1; // broker couldn't be brought up — did NOT load
         return;
     }
-    const loaded = await agentLoad(payload.name, payload.bundle, payload.env, payload.ttlMs ?? DEFAULT_TTL_MS, payload.harness ?? 'cli');
+    const loaded = await agentLoad(payload.name, payload.bundle, payload.env, payload.ttlMs ?? DEFAULT_TTL_MS, payload.harness ?? GLOBAL_HARNESS);
     if (!loaded)
         process.exitCode = 1; // transport failed — did NOT load
 }
 /** Store a resolved bundle in the broker. Returns false on transport failure. */
-export async function agentLoad(name, bundle, env, ttlMs, harness = 'cli') {
+export async function agentLoad(name, bundle, env, ttlMs, harness = GLOBAL_HARNESS) {
     const r = await request({ cmd: 'load', name, bundle, env, ttlMs, harness });
     return r?.ok === true && r.cmd === 'load';
 }

package/dist/lib/secrets/bundles.d.ts

@@ -301,7 +301,7 @@ export declare function resolveBundleEnv(bundle: SecretsBundle, _opts?: ResolveB
  *
  * A read in a macOS headless context resolves broker-only (agentOnly) and fails
  * fast with an actionable error instead of hijacking Touch ID. This generalizes
- * the per-caller pattern already used by the daemon (daemon.ts:readDaemonClaudeOAuthToken).
+ * the per-caller broker-only pattern used across the headless secrets readers.
  */
 export declare function isHeadlessSecretsContext(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, tty?: {
     stdin?: boolean;