@phnx-labs/agents-cli 1.20.88 → 1.20.89

package/dist/lib/runner.js

@@ -33,6 +33,7 @@ import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rot
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
 import { isSelfUpdatingAgent } from './agents.js';
+import { expandLocalHome, getProjectRoot } from './project-root.js';
 /** CLI command templates per agent, with {prompt} as a placeholder. */
 const AGENT_COMMANDS = {
     claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
@@ -50,6 +51,18 @@ const ROUTINE_TRANSCRIPT_SPECS = {
     codex: [{ root: ['.codex', 'sessions'], ext: '.jsonl' }],
     cursor: [{ root: ['.cursor', 'projects'], ext: '.jsonl' }],
 };
+/** Stable working directory for routine children, independent of the daemon's launch cwd. */
+export function routineSpawnCwd(config, configuredRoot = getProjectRoot()) {
+    if (!config.repo)
+        return os.homedir();
+    const [owner, repo] = config.repo.split('/');
+    if (configuredRoot) {
+        const root = path.resolve(expandLocalHome(configuredRoot));
+        if (path.basename(root) === owner)
+            return path.join(root, repo);
+    }
+    return path.join(os.homedir(), 'src', 'github.com', owner, repo);
+}
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export function buildJobCommand(config, resolvedPrompt) {
     // Workflow branch: delegate to `agents run <workflow>` which handles subagent
@@ -449,14 +462,14 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone, overlayH
  * Rate-limit scanning uses only this attempt's log (not prior failover output).
  * The attempt log is also appended into `combinedLogPath` for a continuous trail.
  */
-function spawnJobAttempt(cmd, env, attemptLogPath, timeoutMs, combinedLogPath) {
+function spawnJobAttempt(cmd, env, attemptLogPath, timeoutMs, combinedLogPath, cwd = os.homedir()) {
     // Isolate this attempt's output so detectRateLimit never sees prior attempts.
     fs.writeFileSync(attemptLogPath, '', { mode: 0o600 });
     const stdoutFd = fs.openSync(attemptLogPath, 'a', 0o600);
     return new Promise((resolve) => {
         const child = spawn(cmd[0], cmd.slice(1), {
             stdio: ['ignore', stdoutFd, stdoutFd],
-            ...backgroundSpawnOptions({ fdStdio: true }),
+            ...backgroundSpawnOptions({ cwd, fdStdio: true }),
             env,
         });
         let settled = false;
@@ -604,7 +617,7 @@ export async function executeJob(config, deps) {
     const runDir = getRunDir(config.name, runId);
     fs.mkdirSync(runDir, { recursive: true });
     const baseEnv = injectRoutineActor(useSandbox
-        ? buildSpawnEnv(overlayHome)
+        ? buildSpawnEnv(overlayHome, config.env)
         : { ...process.env }, config);
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
@@ -715,7 +728,7 @@ export async function executeJob(config, deps) {
         const elapsed = Date.now() - Date.parse(meta.startedAt);
         const remaining = Math.max(1_000, timeoutMs - (Number.isFinite(elapsed) ? elapsed : 0));
         const attemptLogPath = path.join(runDir, `stdout.attempt-${i}.log`);
-        const attempt = await spawnJobAttempt(cmd, spawnEnv, attemptLogPath, remaining, stdoutPath);
+        const attempt = await spawnJobAttempt(cmd, spawnEnv, attemptLogPath, remaining, stdoutPath, routineSpawnCwd(config));
         meta.pid = attempt.pid;
         writeRunMeta(meta);
         if (attempt.status === 'timeout') {
@@ -970,7 +983,7 @@ async function executeCommandJobForeground(config) {
     const result = await new Promise((resolve) => {
         const child = spawn(cmd[0], cmd.slice(1), {
             stdio: ['ignore', stdoutFd, stdoutFd],
-            ...backgroundSpawnOptions({ fdStdio: true }),
+            ...backgroundSpawnOptions({ cwd: routineSpawnCwd(config), fdStdio: true }),
             env,
         });
         meta.pid = child.pid || null;
@@ -1086,7 +1099,7 @@ export async function executeJobDetached(config, hooks) {
     const stdoutPath = path.join(runDir, 'stdout.log');
     const stdoutFd = fs.openSync(stdoutPath, 'w', 0o600);
     const baseEnv = injectRoutineActor(useSandbox
-        ? buildSpawnEnv(overlayHome)
+        ? buildSpawnEnv(overlayHome, config.env)
         : { ...process.env }, config);
     const spawnEnv = dispatchesViaAgentsRun(config)
         ? (() => {
@@ -1135,7 +1148,7 @@ export async function executeJobDetached(config, hooks) {
     }
     const child = spawn(cmd[0], cmd.slice(1), {
         stdio: ['ignore', stdoutFd, stdoutFd],
-        ...backgroundSpawnOptions({ fdStdio: true }),
+        ...backgroundSpawnOptions({ cwd: routineSpawnCwd(config), fdStdio: true }),
         env: spawnEnv,
     });
     let settled = false;
@@ -1233,7 +1246,7 @@ function executeCommandJobDetached(config, hooks) {
     };
     const child = spawn(cmd[0], cmd.slice(1), {
         stdio: ['ignore', stdoutFd, stdoutFd],
-        ...backgroundSpawnOptions({ fdStdio: true }),
+        ...backgroundSpawnOptions({ cwd: routineSpawnCwd(config), fdStdio: true }),
         env,
     });
     // Record the real terminal status ourselves — the daemon stays alive after this

package/dist/lib/secrets/bundles.js

@@ -47,20 +47,19 @@ const keychainStore = {
     delete: deleteKeychainToken,
     list: listKeychainItems,
 };
-// The file store auto-provisions a machine-local passphrase on Linux (the
-// existing headless-libsecret fallback) but NEVER on macOS: a file-backed
-// bundle on a Mac must be unlocked with an explicit AGENTS_SECRETS_PASSPHRASE
-// supplied per run, so the box holds ciphertext only. assertFileBackendUsable()
-// enforces that the passphrase is present before we touch the store.
-const FILE_ALLOW_AUTO_PROVISION = process.platform !== 'darwin';
+// The file store auto-provisions a stable machine-local passphrase on EVERY
+// platform (macOS included) — a 0600 key file, encryption-at-rest with the same
+// posture as an SSH key — so `agents secrets` "just works" with no passphrase to
+// set, type, or remember, and no Touch ID. Set AGENTS_SECRETS_PASSPHRASE to opt
+// into an off-disk key.
 const fileItemStore = {
     has: (item) => fileStore.has(item),
-    get: (item) => fileStore.get(item, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }),
+    get: (item) => fileStore.get(item),
     getBatch: (items) => {
         const out = new Map();
         for (const item of items) {
             try {
-                out.set(item, fileStore.get(item, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }));
+                out.set(item, fileStore.get(item));
             }
             catch {
                 // Missing/undecryptable item — absent from the map, mirroring
@@ -69,10 +68,10 @@ const fileItemStore = {
         }
         return out;
     },
-    set: (item, value) => fileStore.set(item, value, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION }),
+    set: (item, value) => fileStore.set(item, value),
     setBatch: (items) => {
         for (const [item, value] of items) {
-            fileStore.set(item, value, { allowAutoProvision: FILE_ALLOW_AUTO_PROVISION });
+            fileStore.set(item, value);
         }
     },
     delete: (item) => fileStore.delete(item),
@@ -116,24 +115,6 @@ export function bundleBackend(name) {
     }
     return 'keychain';
 }
-/**
- * Guard a file-backed bundle operation. On macOS the file store must be
- * unlocked with an explicit passphrase (env or interactive prompt) — we refuse
- * to silently auto-provision a machine-local key there, so a remote/headless
- * Mac cannot decrypt on its own. Linux keeps the existing auto-provision
- * behavior, so this is a no-op there.
- */
-function assertFileBackendUsable(name) {
-    if (process.platform !== 'darwin')
-        return;
-    if (process.env.AGENTS_SECRETS_PASSPHRASE && process.env.AGENTS_SECRETS_PASSPHRASE.length > 0)
-        return;
-    if (process.stdin.isTTY)
-        return;
-    throw new Error(`File-backed bundle '${name}' needs AGENTS_SECRETS_PASSPHRASE to be set on macOS ` +
-        `(no biometry prompt is available headlessly). Set it for this run, e.g.\n` +
-        `  AGENTS_SECRETS_PASSPHRASE=… agents secrets exec ${name} -- <command>`);
-}
 function assertVaultBackendUsable(name) {
     if (getVaultSession().loggedIn)
         return;
@@ -286,8 +267,6 @@ export function readBundleIfDecryptable(name) {
 export function readBundle(name) {
     validateBundleName(name);
     const backend = bundleBackend(name);
-    if (backend === 'file')
-        assertFileBackendUsable(name);
     if (backend === 'vault')
         assertVaultBackendUsable(name);
     let json;
@@ -395,8 +374,6 @@ export function shouldEvictAfterBundleWrite(skipRequested, noAgentEnv, backendOv
 function prepareBundleWrite(bundle) {
     validateBundleName(bundle.name);
     const backend = bundle.backend ?? 'keychain';
-    if (backend === 'file')
-        assertFileBackendUsable(bundle.name);
     if (backend === 'vault')
         assertVaultBackendUsable(bundle.name);
     for (const key of Object.keys(bundle.vars)) {
@@ -1177,8 +1154,6 @@ export function readAndResolveBundleEnv(name, opts = {}) {
                 `never raises a Touch ID sheet on its own.`);
         }
     }
-    if (backend === 'file')
-        assertFileBackendUsable(name);
     if (backend === 'vault')
         assertVaultBackendUsable(name);
     const store = itemStore(backend);

package/dist/lib/secrets/filestore.d.ts

@@ -3,18 +3,19 @@
  *
  * An AES-256-GCM encrypted-file store under `~/.agents/.cache/secrets/`. The
  * encryption key is scrypt-derived from a passphrase read from
- * `AGENTS_SECRETS_PASSPHRASE` (preferred), a machine-local provisioned key, or
- * a TTY prompt. One `<item>.enc` JSON file per item, mode 0600.
+ * `AGENTS_SECRETS_PASSPHRASE` (preferred) or a machine-local key the store
+ * auto-provisions on first use. One `<item>.enc` JSON file per item, mode 0600.
  *
- * Two callers:
+ * Two callers, one policy: the store silently auto-provisions a stable
+ * machine-local key (a 0600 file under `~/.agents/.secrets-key/`) on EVERY
+ * platform, so it works out of the box with no passphrase to set or remember and
+ * never pops a prompt or Touch ID sheet.
  *  - Linux (src/lib/secrets/linux.ts): the headless fallback when the default
- *    Secret Service collection is locked. Auto-provisions a machine-local
- *    passphrase so `agents secrets` works out of the box on a server.
- *  - macOS file-backed bundles (src/lib/secrets/bundles.ts): an explicit,
- *    opt-in non-biometry backend for headless/remote release runs. The bundle
- *    layer guards this path so it only activates with an explicit
- *    AGENTS_SECRETS_PASSPHRASE (or TTY) — never the silent machine-local
- *    auto-provision — so a remote box holds ciphertext only.
+ *    Secret Service collection is locked.
+ *  - macOS/Windows file-backed bundles (src/lib/secrets/bundles.ts): an explicit,
+ *    opt-in non-biometry backend for headless/remote runs.
+ * Set AGENTS_SECRETS_PASSPHRASE to opt into a key held off disk instead (e.g. to
+ * share one bundle's ciphertext across boxes under a common key).
  *
  * The item-name scheme is shared with the keychain backend so a file-backed
  * item and its keychain twin carry identical names:
@@ -22,31 +23,19 @@
  */
 import type { KeychainBackend } from './index.js';
 export declare function fileDir(): string;
-/**
- * Turn off terminal echo on the controlling TTY, or throw — fail CLOSED. If echo
- * cannot be disabled (`stty` missing, no controlling terminal) we must NOT fall
- * through and read the passphrase anyway: that echoes the secret to the screen
- * and into scrollback (RUSH-1764). Refuse and point the user at the environment
- * variable instead. `run` performs the echo-disable and throws iff it fails.
- * Exported so the fail-closed contract has direct test coverage.
- */
-export declare function disableTtyEchoOrThrow(run: () => void): void;
 /** True if a machine-local passphrase has already been provisioned. */
 export declare function machinePassphraseExists(): boolean;
 /**
  * Resolve the passphrase for the encrypted file store.
  *
  * Order: AGENTS_SECRETS_PASSPHRASE > previously-provisioned machine-local key >
- * (interactive) TTY prompt > (headless) auto-provisioned machine-local key.
- *
- * `allowAutoProvision` (default true, used by the Linux fallback) controls the
- * last two steps. macOS file-backed bundles pass `false` so a missing
- * passphrase is a hard, explicit error instead of a silently provisioned
- * on-disk key — the caller (bundles.ts) guards this before we get here.
+ * a freshly auto-provisioned machine-local key. It NEVER prompts and NEVER
+ * hard-fails — the file store must work on every platform (macOS included)
+ * without the user setting, typing, or remembering a passphrase. Provisioning
+ * writes a 0600 key file (encryption-at-rest, same posture as an SSH key); set
+ * AGENTS_SECRETS_PASSPHRASE to opt into an off-disk key.
  */
-export declare function getPassphrase(opts?: {
-    allowAutoProvision?: boolean;
-}): string;
+export declare function getPassphrase(): string;
 /** Encrypted-file on-disk shape. Exported for tests. */
 export interface EncFile {
     salt: string;
@@ -61,12 +50,8 @@ export declare function encryptForFallback(plaintext: string, passphrase: string
  *  ciphertext (auth-tag mismatch). Exported for tests. */
 export declare function decryptForFallback(enc: EncFile, passphrase: string): string;
 declare function fileHas(item: string): boolean;
-declare function fileGet(item: string, opts?: {
-    allowAutoProvision?: boolean;
-}): string;
-declare function fileSet(item: string, value: string, opts?: {
-    allowAutoProvision?: boolean;
-}): void;
+declare function fileGet(item: string): string;
+declare function fileSet(item: string, value: string): void;
 declare function fileDelete(item: string): boolean;
 declare function fileList(prefix: string): string[];
 /** True if the fallback dir has any committed encrypted items. */
@@ -85,10 +70,143 @@ export declare const fileStore: {
 export declare const fileBackend: KeychainBackend;
 /** Resolved passphrase directory (exported for integration tests). */
 export declare function resolvePassphraseDir(): string;
+/**
+ * Path of the machine-local passphrase file that currently holds the file-store
+ * key, or null if none is provisioned. Prefers the canonical #479 location and
+ * falls back to the legacy co-located path, mirroring `readMachinePassphrase`.
+ */
+export declare function machinePassphraseSourcePath(): string | null;
+/** Outcome of a `rotatePassphrase` run. Carries no secret material. */
+export interface RotatePassphraseReport {
+    /** True when nothing was written (report-only). */
+    dryRun: boolean;
+    /** True when the store was re-encrypted and the key file swapped. */
+    committed: boolean;
+    /** Encrypted items that decrypt under the current key and were (or would be) re-keyed. */
+    bundleCount: number;
+    /** `.enc` files that do NOT decrypt under the current key — left untouched, never re-keyed. */
+    skipped: string[];
+    /** Every re-keyed item round-tripped (decrypt) under the new key before any swap. */
+    roundTripOk: boolean;
+    /** The machine-local passphrase file that was (or would be) rewritten in place. */
+    keyFilePath: string;
+    /**
+     * A previous rotation had left artifacts on disk and they were healed before
+     * this rotation proceeded. This happens under `--dry-run` too — recovery is how
+     * a crashed store becomes readable again without re-keying it — and is the only
+     * thing a dry run writes.
+     */
+    recoveredInterruptedRotation: boolean;
+}
+/**
+ * Recover from a rotation that was interrupted mid-swap on a prior run, so the
+ * store is always left in a single, self-consistent, readable state.
+ *
+ * Recovery is CONTENT-aware, not presence-aware, and it classifies the WHOLE
+ * store, not just one item. The mere existence of the store dir and the key file
+ * does not prove they match (RUSH-1975 data-loss window): on the non-co-located
+ * key path the swap is four renames, and a crash after the store swap
+ * (`stageDir`->`dir`) but before the key swap (`keyTmp`->`keyPath`) finishes
+ * leaves a NEW-key store next to the OLD key file, both present. A presence check
+ * would see "both here" and wrongly sweep the only copies of the old ciphertext
+ * (`<dir>.rotate-old-*`) and the new key (`<key>.rotate-new`), permanently
+ * orphaning every secret. So we probe the actual ciphertext with `classifyStore`,
+ * which distinguishes a store that opens fully under one key ('all') from one that
+ * is MIXED — some items under the live key, others under the incoming key ('some',
+ * e.g. after a mid-swap crash contaminated by a later `secrets set`):
+ *
+ *  1. The live key opens EVERY non-orphan item ('all') → rotation complete and
+ *     consistent (or never interrupted); sweeping the `.rotate-*` artifacts is safe —
+ *     unless a `<dir>.rotate-old-*` backup still holds `.enc` items absent from the
+ *     live dir. That means the live dir is not the post-swap store but a fresh dir an
+ *     interstitial `secrets set` created after a crash in the move-aside window left
+ *     the store dir absent, so the backup is the only copy of those items → REFUSE.
+ *  2. Else, if `<key>.rotate-new` opens every non-orphan item ('all'), the crash
+ *     landed after the store swap but before the key swap finished → finish the
+ *     rotation forward by installing `.rotate-new` as the live key, then sweep.
+ *  3. Else, if neither key opens any item, roll back: restore the
+ *     `<dir>.rotate-old-*` backup over `dir` and `<key>.rotate-oldkey` over the key
+ *     file — but only once the backup is proven to open fully under the old key.
+ *  4. If a key opens SOME but not all items ('some'), the store is MIXED — an
+ *     interrupted rotation contaminated by a later write, with live data under two
+ *     keys at once. Sweeping would delete the only copy of one of those keys, so we
+ *     REFUSE: throw an actionable error and preserve every recovery artifact for
+ *     out-of-band repair. Likewise, if neither forward nor rollback can be proven,
+ *     leave every artifact in place — a leftover temp dir is recoverable, deleting
+ *     the only copy of a key or ciphertext is not.
+ *
+ * A phase-marker / journal file was considered and deliberately skipped: the
+ * AES-256-GCM auth tag already makes the decrypt probe an authoritative,
+ * self-validating record of which key matches the store. A separate marker would
+ * be a second source of truth that can disagree with reality — its own write has
+ * crash windows, and a stale marker misleads — so it would weaken, not strengthen,
+ * this guarantee. Idempotent; a no-op when no rotation artifacts are present.
+ * Callers run this under the store lock (see `withStoreLock`).
+ */
+/**
+ * Whether a previous rotation left artifacts on disk — i.e. whether
+ * {@link recoverInterruptedRotation} would do any work. Read-only, so `--dry-run`
+ * can report a pending recovery without performing (and thus writing) one.
+ */
+export declare function hasInterruptedRotationArtifacts(keyPath: string): boolean;
+/**
+ * Rotate the machine-local file-store passphrase: decrypt every `.enc` item
+ * under the current key and re-encrypt it under a freshly generated one, then
+ * swap both the ciphertext and the key file atomically.
+ *
+ * Safety contract (RUSH-1975):
+ *  - Verify before writing: every re-keyed item must round-trip decrypt under
+ *    the new key, and the re-keyed count must reconcile with the source, or the
+ *    run aborts having written nothing.
+ *  - Atomic: the new store is staged in a sibling temp dir, fsync'd, then swapped
+ *    into place by directory rename; the new key file is fsync'd and swapped the
+ *    same way. A crash before the swap leaves the old store and old key fully
+ *    intact and readable; a crash inside the swap self-heals on the next run
+ *    (see `recoverInterruptedRotation`). No half-re-keyed store is ever exposed.
+ *  - No plaintext (secret value or passphrase) is ever written to disk, argv, or
+ *    a log — only ciphertext is staged, and the new key lands only in the 0600
+ *    key file.
+ *  - Items that do not decrypt under the current key (orphan caches, stale test
+ *    artifacts written under another key) are copied through verbatim, never
+ *    re-keyed, and reported in `skipped`.
+ *
+ * `newPassphrase` and the `on*` callbacks are test seams. `newPassphrase` pins the
+ * generated key so a test can assert the swap. `onStagedBeforeCommit` fires after
+ * staging but before any swap (a crash here leaves the old store fully intact).
+ * `onStoreSwappedBeforeKeySwap` fires after the store swap but before the key swap
+ * begins (Window A: NEW-key store beside the OLD key file). `onKeyBackedUpBeforeNewKey`
+ * fires after the old key is moved aside but before the new key lands (Window B: NEW
+ * store, key file absent). Each throws to simulate a mid-swap crash at that exact
+ * point, and next-run recovery must heal it without data loss. `tamperStaged` forces
+ * a staged item to fail its round-trip check, exercising the verify-before-swap abort.
+ */
+export interface RotatePassphraseOpts {
+    dryRun?: boolean;
+    newPassphrase?: string;
+    onStagedBeforeCommit?: () => void;
+    onStoreMovedAsideBeforeSwap?: () => void;
+    onStoreSwappedBeforeKeySwap?: (heartbeat: () => void) => void;
+    onKeyBackedUpBeforeNewKey?: () => void;
+    tamperStaged?: boolean;
+}
+/**
+ * Rotate under the exclusive store lock, so no `secrets set`/`delete` and no
+ * second rotation can interleave with the swap (see `withStoreLock`). The whole
+ * run — recovery, verify, swap — holds the lock; it is released on return or throw.
+ */
+export declare function rotatePassphrase(opts?: RotatePassphraseOpts): RotatePassphraseReport;
 /** Test-only: reset module state (file dir + cached passphrase). */
 export declare function _resetFileStoreForTest(opts?: {
     fileDir?: string | null;
     passphraseDir?: string | null;
     passphrase?: string | null;
 }): void;
+/** Test-only: shorten the store-lock acquire timeout so a contended-lock assertion
+ *  fails fast instead of waiting out the 30s production budget. */
+export declare function _setFileStoreLockTimeoutForTest(ms: number | null): void;
+/** Test-only: shrink the store-lock stale window so a heartbeat/steal assertion runs
+ *  in milliseconds instead of the 5s production window. */
+export declare function _setFileStoreLockStaleMsForTest(ms: number | null): void;
+/** Test-only: the cross-process store-lock target (sibling of the store dir). */
+export declare function _fileStoreLockPathForTest(): string;
 export {};