@phnx-labs/agents-cli 1.20.87 → 1.20.89

package/dist/lib/routines.js

@@ -569,6 +569,12 @@ export function validateTrigger(trigger) {
     if (linear.label !== undefined && typeof linear.label !== 'string') {
         errors.push('trigger.label must be a string');
     }
+    if (linear.stateTo !== undefined && typeof linear.stateTo !== 'string') {
+        errors.push('trigger.stateTo must be a string');
+    }
+    if (linear.stateFrom !== undefined && typeof linear.stateFrom !== 'string') {
+        errors.push('trigger.stateFrom must be a string');
+    }
     return errors;
 }
 function isParseableDate(value) {
@@ -702,8 +708,71 @@ export function hasCompletedOneShotRun(config, now = new Date()) {
 export function shouldPurgeCompletedOneShotRoutine(config, now = new Date()) {
     return hasCompletedOneShotRun(config, now);
 }
+function getPath(obj, path) {
+    const parts = path.split('.');
+    let current = obj;
+    for (const part of parts) {
+        if (current === null || current === undefined)
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+/**
+ * Substitute `{{dotted.path}}` placeholders in a string using a webhook context.
+ * Missing values are replaced with an empty string.
+ */
+export function substituteWebhookPrompt(prompt, context) {
+    return prompt.replace(/\{\{([^{}]+)\}\}/g, (_, rawPath) => {
+        const value = getPath(context, rawPath.trim());
+        if (value === undefined || value === null)
+            return '';
+        return String(value);
+    });
+}
+/**
+ * Substitute `{{dotted.path}}` placeholders in a string destined for a SHELL,
+ * quoting every substituted value so payload content cannot break out of it.
+ *
+ * `run.command` is executed through a shell, and its context is built from an
+ * external webhook payload — `issue.title`, `issue.description`, and the GitHub
+ * `pull_request` fields are free text any outside contributor can set. Pasting
+ * those in raw (as {@link substituteWebhookPrompt} does, correctly, for prompts)
+ * turns an operator's `echo {{issue.title}}` into a command-injection sink.
+ *
+ * The template itself is operator-authored and stays unquoted, so pipes,
+ * redirects, and `&&` in the configured command keep working. Only the
+ * interpolated values are quoted.
+ *
+ * POSIX `sh` quoting: wrap in single quotes and close/escape/reopen for any
+ * embedded single quote. `exec` uses `cmd.exe` on Windows, which does not
+ * honour these rules — see `assertShellSubstitutionSupported`.
+ */
+export function substituteWebhookCommand(command, context) {
+    return command.replace(/\{\{([^{}]+)\}\}/g, (_, rawPath) => {
+        const value = getPath(context, rawPath.trim());
+        if (value === undefined || value === null)
+            return "''";
+        return `'${String(value).replace(/'/g, `'\\''`)}'`;
+    });
+}
+/**
+ * Refuse a `run.command` carrying placeholders on a platform whose shell we
+ * cannot safely quote for. `child_process.exec` runs through `cmd.exe` on
+ * Windows, where POSIX single-quoting is not a quoting mechanism at all, so
+ * {@link substituteWebhookCommand} would not contain a hostile value.
+ *
+ * Fail loud rather than execute something we cannot prove is safe.
+ */
+export function assertShellSubstitutionSupported(command, platform = process.platform) {
+    if (platform === 'win32' && /\{\{[^{}]+\}\}/.test(command)) {
+        throw new Error('run.command with {{…}} placeholders is not supported on Windows: the values come from an ' +
+            'untrusted webhook payload and cmd.exe cannot be quoted safely. Use run.prompt, or a ' +
+            'command with no placeholders.');
+    }
+}
 /** Expand built-in and user-defined template variables in a job's prompt string. */
-export function resolveJobPrompt(config) {
+export function resolveJobPrompt(config, context) {
     const now = new Date();
     const tz = config.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone;
     const days = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
@@ -725,6 +794,10 @@ export function resolveJobPrompt(config) {
             prompt = prompt.replace(new RegExp(`\\{${key}\\}`, 'g'), value);
         }
     }
+    // Webhook-driven variables ({{issue.identifier}}, {{updatedFrom.state.name}}, ...)
+    if (context) {
+        prompt = substituteWebhookPrompt(prompt, context);
+    }
     // Last report (special handling). Only a COMPLETED run's report is injected —
     // a failed run's report.md is the agent's error text (e.g. a login prompt on
     // an auth failure), and feeding that into the next prompt poisons every

package/dist/lib/runner.d.ts

@@ -23,6 +23,11 @@ export interface RunResult {
     meta: RunMeta;
     reportPath: string | null;
 }
+/** Agents the daemon can actually run, derived from the command table above
+ * so the `--agent` help and any validation can never drift from it. */
+export declare const ROUTINE_AGENT_IDS: readonly string[];
+/** Stable working directory for routine children, independent of the daemon's launch cwd. */
+export declare function routineSpawnCwd(config: Pick<JobConfig, 'repo'>, configuredRoot?: string | undefined): string;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string): string[];
 export declare function archiveRoutineTranscripts(meta: Pick<RunMeta, 'jobName' | 'runId' | 'agent'>, runDir: string, overlayHome?: string): void;
@@ -63,7 +68,7 @@ export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow
  * (CLAUDE_CONFIG_DIR / CODEX_HOME / …) so routines share account isolation
  * with `agents run`.
  */
-export declare function buildRoutineSpawnEnv(baseEnv: Record<string, string>, agent: AgentId, version: string | undefined, timezone?: string): Record<string, string>;
+export declare function buildRoutineSpawnEnv(baseEnv: Record<string, string>, agent: AgentId, version: string | undefined, timezone?: string, overlayHome?: string): Record<string, string>;
 export declare function executeJob(config: JobConfig, deps?: LoopDeps): Promise<RunResult>;
 /**
  * Optional lifecycle callbacks for a detached routine run. The daemon passes an
@@ -80,5 +85,15 @@ export interface RoutineHooks {
 export declare function executeJobDetached(config: JobConfig, hooks?: RoutineHooks): Promise<RunMeta>;
 /** Extract the final assistant message from a stream-JSON log file as a markdown report. */
 export declare function extractReport(stdoutPath: string, agentType: AgentId): string | null;
+/** Derive the final status of a detached run by reading the agent's stream-json
+ *  tail. Detached children fire-and-forget, so we never see their exit code
+ *  directly — but Claude's stream-json terminates with a `type: result` line
+ *  that carries `is_error`. If we find it, the run completed cleanly (modulo
+ *  agent-reported error). If not, the process likely died mid-stream and the
+ *  caller should treat the run as failed. */
+export declare function inferFinalStatusFromLog(stdoutPath: string, agent: AgentId): {
+    status: 'completed' | 'failed';
+    exitCode: number;
+} | null;
 /** Scan all runs marked "running" and finalize any whose process has exited. */
 export declare function monitorRunningJobs(): void;

package/dist/lib/runner.js

@@ -32,18 +32,37 @@ import { getBinaryPath, isVersionInstalled, resolveVersion } from './versions.js
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, } from './rotate.js';
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
+import { isSelfUpdatingAgent } from './agents.js';
+import { expandLocalHome, getProjectRoot } from './project-root.js';
 /** CLI command templates per agent, with {prompt} as a placeholder. */
 const AGENT_COMMANDS = {
     claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
     codex: ['codex', 'exec', '--sandbox', 'workspace-write', '{prompt}', '--json'],
     gemini: ['gemini', '{prompt}', '--output-format', 'stream-json'],
+    cursor: ['cursor-agent', '-p', '{prompt}', '--output-format', 'stream-json'],
     kimi: ['kimi', '--prompt', '{prompt}', '--output-format', 'stream-json'],
     droid: ['droid', 'exec', '{prompt}', '-o', 'stream-json'],
 };
+/** Agents the daemon can actually run, derived from the command table above
+ * so the `--agent` help and any validation can never drift from it. */
+export const ROUTINE_AGENT_IDS = Object.freeze(Object.keys(AGENT_COMMANDS));
 const ROUTINE_TRANSCRIPT_SPECS = {
     claude: [{ root: ['.claude', 'projects'], ext: '.jsonl' }],
     codex: [{ root: ['.codex', 'sessions'], ext: '.jsonl' }],
+    cursor: [{ root: ['.cursor', 'projects'], ext: '.jsonl' }],
 };
+/** Stable working directory for routine children, independent of the daemon's launch cwd. */
+export function routineSpawnCwd(config, configuredRoot = getProjectRoot()) {
+    if (!config.repo)
+        return os.homedir();
+    const [owner, repo] = config.repo.split('/');
+    if (configuredRoot) {
+        const root = path.resolve(expandLocalHome(configuredRoot));
+        if (path.basename(root) === owner)
+            return path.join(root, repo);
+    }
+    return path.join(os.homedir(), 'src', 'github.com', owner, repo);
+}
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export function buildJobCommand(config, resolvedPrompt) {
     // Workflow branch: delegate to `agents run <workflow>` which handles subagent
@@ -133,6 +152,20 @@ export function buildJobCommand(config, resolvedPrompt) {
         }
         appendModelAndReasoning(cmd, config);
     }
+    if (config.agent === 'cursor') {
+        // cursor-agent supports --plan, but the capability registry has not been
+        // upgraded yet. RUSH-2101 tracks adding that read-only mode after PR #1721.
+        const cursorMode = resolveHeadlessMode('cursor', mode, false, `routine ${config.name}`);
+        if (cursorMode === 'skip') {
+            cmd.push('-f');
+        }
+        else {
+            // The configured cwd is the user's workspace trust decision. --trust is
+            // narrower than --yolo/-f because it does not bypass tool permissions.
+            cmd.push('--trust');
+        }
+        appendModelAndReasoning(cmd, config);
+    }
     if (config.agent === 'kimi') {
         // kimi daemon jobs always run headless via `--prompt`, which cannot be
         // combined with any startup-mode flag (--plan/--auto/--yolo all abort with
@@ -385,7 +418,7 @@ export function dispatchesViaAgentsRun(config) {
  * (CLAUDE_CONFIG_DIR / CODEX_HOME / …) so routines share account isolation
  * with `agents run`.
  */
-export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone) {
+export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone, overlayHome) {
     const execEnv = buildExecEnv({
         agent,
         version,
@@ -415,6 +448,11 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone) {
     // provisioned box does. Drop it here so a routine always uses the login of the
     // machine it runs on.
     delete out.CLAUDE_CODE_OAUTH_TOKEN;
+    if (agent === 'cursor' && overlayHome) {
+        // prepareJobHome links this host's Cursor auth file here. Pin XDG_CONFIG_HOME
+        // to the overlay so an ambient value cannot bypass the routine sandbox.
+        out.XDG_CONFIG_HOME = path.join(overlayHome, '.config');
+    }
     if (timezone)
         out.TZ = timezone;
     return out;
@@ -424,14 +462,14 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone) {
  * Rate-limit scanning uses only this attempt's log (not prior failover output).
  * The attempt log is also appended into `combinedLogPath` for a continuous trail.
  */
-function spawnJobAttempt(cmd, env, attemptLogPath, timeoutMs, combinedLogPath) {
+function spawnJobAttempt(cmd, env, attemptLogPath, timeoutMs, combinedLogPath, cwd = os.homedir()) {
     // Isolate this attempt's output so detectRateLimit never sees prior attempts.
     fs.writeFileSync(attemptLogPath, '', { mode: 0o600 });
     const stdoutFd = fs.openSync(attemptLogPath, 'a', 0o600);
     return new Promise((resolve) => {
         const child = spawn(cmd[0], cmd.slice(1), {
             stdio: ['ignore', stdoutFd, stdoutFd],
-            ...backgroundSpawnOptions({ fdStdio: true }),
+            ...backgroundSpawnOptions({ cwd, fdStdio: true }),
             env,
         });
         let settled = false;
@@ -579,7 +617,7 @@ export async function executeJob(config, deps) {
     const runDir = getRunDir(config.name, runId);
     fs.mkdirSync(runDir, { recursive: true });
     const baseEnv = injectRoutineActor(useSandbox
-        ? buildSpawnEnv(overlayHome)
+        ? buildSpawnEnv(overlayHome, config.env)
         : { ...process.env }, config);
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
@@ -621,16 +659,20 @@ export async function executeJob(config, deps) {
     const timeoutMs = parseTimeout(config.timeout) || 10 * 60 * 1000;
     // Loop path: delegate to runLoop (same driver as `agents run --loop` / workflow loop:).
     if (config.loop) {
-        const spawnEnv = buildRoutineSpawnEnv(baseEnv, effectiveAgent, primaryVersion, config.timezone);
+        const spawnEnv = buildRoutineSpawnEnv(baseEnv, effectiveAgent, primaryVersion, config.timezone, overlayHome);
         const execOptions = {
             agent: effectiveAgent,
-            version: primaryVersion,
+            // Routine-supported self-updating CLIs (Cursor/Droid) use one global
+            // binary; a versioned shim would point at a nonexistent isolated install.
+            version: isSelfUpdatingAgent(effectiveAgent) ? undefined : primaryVersion,
             prompt: resolvedPrompt,
             mode: normalizeMode(config.mode),
             effort: config.effort,
             env: spawnEnv,
             json: true,
             headless: true,
+            modeWarningContext: `routine ${config.name}`,
+            modeWarningState: {},
             ...(config.config?.model ? { model: config.config.model } : {}),
             ...(config.allow?.dirs ? {
                 addDirs: config.allow.dirs
@@ -681,12 +723,12 @@ export async function executeJob(config, deps) {
                     e.TZ = config.timezone;
                 return e;
             })()
-            : buildRoutineSpawnEnv(baseEnv, attemptAgent, attemptVersion, config.timezone);
+            : buildRoutineSpawnEnv(baseEnv, attemptAgent, attemptVersion, config.timezone, overlayHome);
         // Remaining timeout budget shared across failover attempts.
         const elapsed = Date.now() - Date.parse(meta.startedAt);
         const remaining = Math.max(1_000, timeoutMs - (Number.isFinite(elapsed) ? elapsed : 0));
         const attemptLogPath = path.join(runDir, `stdout.attempt-${i}.log`);
-        const attempt = await spawnJobAttempt(cmd, spawnEnv, attemptLogPath, remaining, stdoutPath);
+        const attempt = await spawnJobAttempt(cmd, spawnEnv, attemptLogPath, remaining, stdoutPath, routineSpawnCwd(config));
         meta.pid = attempt.pid;
         writeRunMeta(meta);
         if (attempt.status === 'timeout') {
@@ -941,7 +983,7 @@ async function executeCommandJobForeground(config) {
     const result = await new Promise((resolve) => {
         const child = spawn(cmd[0], cmd.slice(1), {
             stdio: ['ignore', stdoutFd, stdoutFd],
-            ...backgroundSpawnOptions({ fdStdio: true }),
+            ...backgroundSpawnOptions({ cwd: routineSpawnCwd(config), fdStdio: true }),
             env,
         });
         meta.pid = child.pid || null;
@@ -1057,7 +1099,7 @@ export async function executeJobDetached(config, hooks) {
     const stdoutPath = path.join(runDir, 'stdout.log');
     const stdoutFd = fs.openSync(stdoutPath, 'w', 0o600);
     const baseEnv = injectRoutineActor(useSandbox
-        ? buildSpawnEnv(overlayHome)
+        ? buildSpawnEnv(overlayHome, config.env)
         : { ...process.env }, config);
     const spawnEnv = dispatchesViaAgentsRun(config)
         ? (() => {
@@ -1067,7 +1109,7 @@ export async function executeJobDetached(config, hooks) {
             return e;
         })()
         // Non-command path only: config.agent is always set here (command/workflow branch earlier).
-        : buildRoutineSpawnEnv(baseEnv, config.agent, version, config.timezone);
+        : buildRoutineSpawnEnv(baseEnv, config.agent, version, config.timezone, overlayHome);
     const effectiveAgent = config.workflow ? 'claude' : config.agent;
     const meta = {
         jobName: config.name,
@@ -1106,7 +1148,7 @@ export async function executeJobDetached(config, hooks) {
     }
     const child = spawn(cmd[0], cmd.slice(1), {
         stdio: ['ignore', stdoutFd, stdoutFd],
-        ...backgroundSpawnOptions({ fdStdio: true }),
+        ...backgroundSpawnOptions({ cwd: routineSpawnCwd(config), fdStdio: true }),
         env: spawnEnv,
     });
     let settled = false;
@@ -1204,7 +1246,7 @@ function executeCommandJobDetached(config, hooks) {
     };
     const child = spawn(cmd[0], cmd.slice(1), {
         stdio: ['ignore', stdoutFd, stdoutFd],
-        ...backgroundSpawnOptions({ fdStdio: true }),
+        ...backgroundSpawnOptions({ cwd: routineSpawnCwd(config), fdStdio: true }),
         env,
     });
     // Record the real terminal status ourselves — the daemon stays alive after this
@@ -1262,7 +1304,7 @@ export function extractReport(stdoutPath, agentType) {
         for (const line of lines) {
             try {
                 const parsed = JSON.parse(line);
-                if (agentType === 'claude') {
+                if (agentType === 'claude' || agentType === 'cursor') {
                     if (parsed.type === 'assistant' && parsed.message?.content) {
                         for (const block of parsed.message.content) {
                             if (block.type === 'text' && block.text) {
@@ -1298,7 +1340,7 @@ export function extractReport(stdoutPath, agentType) {
  *  that carries `is_error`. If we find it, the run completed cleanly (modulo
  *  agent-reported error). If not, the process likely died mid-stream and the
  *  caller should treat the run as failed. */
-function inferFinalStatusFromLog(stdoutPath, agent) {
+export function inferFinalStatusFromLog(stdoutPath, agent) {
     if (!fs.existsSync(stdoutPath))
         return null;
     try {
@@ -1309,7 +1351,7 @@ function inferFinalStatusFromLog(stdoutPath, agent) {
         for (let i = lines.length - 1, scanned = 0; i >= 0 && scanned < 20; i--, scanned++) {
             try {
                 const parsed = JSON.parse(lines[i]);
-                if (agent === 'claude' && parsed.type === 'result') {
+                if ((agent === 'claude' || agent === 'cursor') && parsed.type === 'result') {
                     return parsed.is_error
                         ? { status: 'failed', exitCode: 1 }
                         : { status: 'completed', exitCode: 0 };

package/dist/lib/sandbox.d.ts

@@ -21,6 +21,8 @@ export declare function buildSpawnEnv(overlayHome: string, extraEnv?: Record<str
 export declare function getJobHomePath(name: string): string;
 /** Create a fresh overlay HOME for a job, including agent config and allowed-dir symlinks. */
 export declare function prepareJobHome(config: JobConfig): string;
+/** Link this host's Cursor login and CLI config into the disposable overlay. */
+export declare function generateCursorConfig(overlayHome: string): void;
 /** Remove a job's overlay HOME directory entirely. */
 export declare function cleanJobHome(name: string): void;
 /** Symlink allowed directories into the overlay HOME, skipping paths outside the real HOME. */

package/dist/lib/sandbox.js

@@ -100,11 +100,49 @@ export function prepareJobHome(config) {
     else if (config.agent === 'gemini') {
         generateGeminiConfig(overlayHome, config);
     }
+    else if (config.agent === 'cursor') {
+        generateCursorConfig(overlayHome);
+    }
     if (config.allow?.dirs) {
         symlinkAllowedDirs(overlayHome, config.allow.dirs);
     }
     return overlayHome;
 }
+/** Link this host's Cursor login and CLI config into the disposable overlay. */
+export function generateCursorConfig(overlayHome) {
+    const realConfigHome = process.env.XDG_CONFIG_HOME || path.join(resolveRealHome(), '.config');
+    const realAuth = path.join(realConfigHome, 'cursor', 'auth.json');
+    if (!fs.existsSync(realAuth))
+        return;
+    const overlayCursorDir = path.join(overlayHome, '.config', 'cursor');
+    fs.mkdirSync(overlayCursorDir, { recursive: true });
+    const overlayAuth = path.join(overlayCursorDir, 'auth.json');
+    if (process.platform === 'win32') {
+        // File symlinks need Developer Mode on Windows. A same-volume hard link
+        // shares the credential inode without copying its contents to another host.
+        try {
+            fs.linkSync(realAuth, overlayAuth);
+        }
+        catch { /* cross-volume or link creation refused: Cursor will fail auth loudly */ }
+    }
+    else {
+        fs.symlinkSync(realAuth, overlayAuth);
+    }
+    // Setting XDG_CONFIG_HOME makes Cursor look for cli-config.json beside auth.json.
+    // This file carries account identity (authId, displayName, email, userId) as
+    // well as preferences, so it must remain linked rather than copied.
+    const realCliConfig = path.join(resolveRealHome(), '.cursor', 'cli-config.json');
+    if (fs.existsSync(realCliConfig)) {
+        const overlayCliConfig = path.join(overlayCursorDir, 'cli-config.json');
+        try {
+            if (process.platform === 'win32')
+                fs.linkSync(realCliConfig, overlayCliConfig);
+            else
+                fs.symlinkSync(realCliConfig, overlayCliConfig);
+        }
+        catch { /* cross-volume or link creation refused: Cursor will fail auth loudly */ }
+    }
+}
 /** Remove a job's overlay HOME directory entirely. */
 export function cleanJobHome(name) {
     const overlayHome = getJobHomePath(name);

package/dist/lib/secrets/bundles.js

@@ -47,20 +47,19 @@ const keychainStore = {
     delete: deleteKeychainToken,
     list: listKeychainItems,
 };
-// The file store auto-provisions a machine-local passphrase on Linux (the
-// existing headless-libsecret fallback) but NEVER on macOS: a file-backed
-// bundle on a Mac must be unlocked with an explicit AGENTS_SECRETS_PASSPHRASE
-// supplied per run, so the box holds ciphertext only. assertFileBackendUsable()
-// enforces that the passphrase is present before we touch the store.
-const FILE_ALLOW_AUTO_PROVISION = process.platform !== 'darwin';
+// The file store auto-provisions a stable machine-local passphrase on EVERY
+// platform (macOS included) — a 0600 key file, encryption-at-rest with the same
+// posture as an SSH key — so `agents secrets` "just works" with no passphrase to
+// set, type, or remember, and no Touch ID. Set AGENTS_SECRETS_PASSPHRASE to opt
+// into an off-disk key.
 const fileItemStore = {
     has: (item) => fileStore.has(item),
-    get: (item) => fileStore.get(item, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }),
+    get: (item) => fileStore.get(item),
     getBatch: (items) => {
         const out = new Map();
         for (const item of items) {
             try {
-                out.set(item, fileStore.get(item, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }));
+                out.set(item, fileStore.get(item));
             }
             catch {
                 // Missing/undecryptable item — absent from the map, mirroring
@@ -69,10 +68,10 @@ const fileItemStore = {
         }
         return out;
     },
-    set: (item, value) => fileStore.set(item, value, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }),
+    set: (item, value) => fileStore.set(item, value),
     setBatch: (items) => {
         for (const [item, value] of items) {
-            fileStore.set(item, value, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION });
+            fileStore.set(item, value);
         }
     },
     delete: (item) => fileStore.delete(item),
@@ -116,24 +115,6 @@ export function bundleBackend(name) {
     }
     return 'keychain';
 }
-/**
- * Guard a file-backed bundle operation. On macOS the file store must be
- * unlocked with an explicit passphrase (env or interactive prompt) — we refuse
- * to silently auto-provision a machine-local key there, so a remote/headless
- * Mac cannot decrypt on its own. Linux keeps the existing auto-provision
- * behavior, so this is a no-op there.
- */
-function assertFileBackendUsable(name) {
-    if (process.platform !== 'darwin')
-        return;
-    if (process.env.AGENTS_SECRETS_PASSPHRASE && process.env.AGENTS_SECRETS_PASSPHRASE.length > 0)
-        return;
-    if (process.stdin.isTTY)
-        return;
-    throw new Error(`File-backed bundle '${name}' needs AGENTS_SECRETS_PASSPHRASE to be set on macOS ` +
-        `(no biometry prompt is available headlessly). Set it for this run, e.g.\n` +
-        `  AGENTS_SECRETS_PASSPHRASE=… agents secrets exec ${name} -- <command>`);
-}
 function assertVaultBackendUsable(name) {
     if (getVaultSession().loggedIn)
         return;
@@ -286,8 +267,6 @@ export function readBundleIfDecryptable(name) {
 export function readBundle(name) {
     validateBundleName(name);
     const backend = bundleBackend(name);
-    if (backend === 'file')
-        assertFileBackendUsable(name);
     if (backend === 'vault')
         assertVaultBackendUsable(name);
     let json;
@@ -395,8 +374,6 @@ export function shouldEvictAfterBundleWrite(skipRequested, noAgentEnv, backendOv
 function prepareBundleWrite(bundle) {
     validateBundleName(bundle.name);
     const backend = bundle.backend ?? 'keychain';
-    if (backend === 'file')
-        assertFileBackendUsable(bundle.name);
     if (backend === 'vault')
         assertVaultBackendUsable(bundle.name);
     for (const key of Object.keys(bundle.vars)) {
@@ -1177,8 +1154,6 @@ export function readAndResolveBundleEnv(name, opts = {}) {
                 `never raises a Touch ID sheet on its own.`);
         }
     }
-    if (backend === 'file')
-        assertFileBackendUsable(name);
     if (backend === 'vault')
         assertVaultBackendUsable(name);
     const store = itemStore(backend);