@phnx-labs/agents-cli 1.22.120 → 1.22.121

package/dist/lib/secrets-cli.d.ts

@@ -1,11 +1,6 @@
 export declare const SECRETS_CLI_NAME = "secrets";
 export declare const SECRETS_CLI_PACKAGE = "@phnx-labs/secrets-cli";
-/** Published standalone `agents setup secrets` installs; bump with the protocol. */
-export declare const SECRETS_CLI_VERSION = "0.1.5";
-export declare const SECRETS_CLI_SPEC = "@phnx-labs/secrets-cli@0.1.5";
-export declare const SECRETS_CLI_INSTALL_HINT = "npm i -g @phnx-labs/secrets-cli@0.1.5";
-/**
- * True when `$SECRETS_BIN` is set or a real `secrets` executable is on PATH
- * outside agents-cli's shims dir. Does not spawn the binary.
- */
+export declare const SECRETS_CLI_VERSION = "0.1.8";
+export declare const SECRETS_CLI_SPEC = "@phnx-labs/secrets-cli@0.1.8";
+export declare const SECRETS_CLI_INSTALL_HINT = "npm i -g @phnx-labs/secrets-cli@0.1.8";
 export declare function isSecretsPresent(): boolean;

package/dist/lib/secrets-cli.js

@@ -1,27 +1,9 @@
-/**
- * The standalone `secrets` CLI that agents-cli talks to (PHNX-3989).
- *
- * The engine lives in `@phnx-labs/secrets-cli`. This module is the single pin
- * and presence check shared by the process client (`secrets-client.ts`) and
- * `agents setup secrets` — it carries no storage. Presence is `findInPath`,
- * which skips `~/.agents/.cache/shims`: a leftover alias there `exec`s
- * `agents secrets` and would recurse (agi-cli#3532).
- *
- * Keep this file free of `cli-resources` imports: `secrets-client.ts` loads it,
- * and a cycle through the host-CLI parser would pull yaml/spawn into the
- * process-client module graph.
- */
 import { findInPath } from './agent-spec/agents.js';
 export const SECRETS_CLI_NAME = 'secrets';
 export const SECRETS_CLI_PACKAGE = '@phnx-labs/secrets-cli';
-/** Published standalone `agents setup secrets` installs; bump with the protocol. */
-export const SECRETS_CLI_VERSION = '0.1.5';
+export const SECRETS_CLI_VERSION = '0.1.8';
 export const SECRETS_CLI_SPEC = `${SECRETS_CLI_PACKAGE}@${SECRETS_CLI_VERSION}`;
 export const SECRETS_CLI_INSTALL_HINT = `npm i -g ${SECRETS_CLI_SPEC}`;
-/**
- * True when `$SECRETS_BIN` is set or a real `secrets` executable is on PATH
- * outside agents-cli's shims dir. Does not spawn the binary.
- */
 export function isSecretsPresent() {
     const explicit = process.env.SECRETS_BIN?.trim();
     if (explicit)

package/dist/lib/secrets-client.d.ts

@@ -1,130 +1,38 @@
 import type { SecretsBundle, SecretsBackend, ResolveBundleOptions, WriteBundleOptions, BundleEntryInfo, RenameOptions, RotateOptions, BundleValue, KeychainReadContext, SecretRef, AgentStatusEntry, PushBundleOptions, PushBundleResult, RemoteBundleSummary, PullOptions, RcSecretFinding } from './secrets-types.js';
-/**
- * Wire contract, mirrored from `secrets-cli/src/protocol.ts`. Both sides MUST
- * agree byte-for-byte; this is the shared schema of the seam, the one thing an
- * independent client legitimately re-declares rather than imports.
- */
 export declare const PROTOCOL_VERSION = 1;
-/**
- * The synchronous path serves the surfaces that resolve secrets before they can
- * continue — `agents view`, the account-catalog rows, and the account listing and
- * setup-token read on the `agents run` launch path. Those must never hang for the
- * standalone's own 60s deadline (the exact hang PHNX-3989 hit when the child ran
- * under Bun), so the sync serve carries a hard bound below it instead of the
- * async path's 65s. The bound covers a COLD PROCESS, not just the operation: every
- * request spawns `secrets __serve` afresh, so it pays a Node boot plus the
- * standalone's module load before the tens-of-milliseconds op runs: ~0.3s on a
- * quiet box, 0.4–2.6s and occasionally more on a desktop at load average ~100
- * (measured 2026-09-12), where the previous 3s bound turned load into a failed
- * launch (`secrets request failed: spawnSync sh ETIMEDOUT` from `agents run`).
- * 30s absorbs that boot under load and still fails a broken or wedged standalone
- * well before its 60s self-deadline. It is NOT a fallback to the embedded engine
- * (DIST-1); the standalone stays the only implementation. Exported so the
- * real-standalone test can assert a round-trip beats the bound.
- */
 export declare const SYNC_SERVE_TIMEOUT_MS = 30000;
 export interface SecretsContext {
-    /** Bundle allowlist; absent ⇒ full trust (the local agents client today). */
     allowedBundles?: string[];
-    /** Opaque scope the standalone folds into resolution — the harness name. */
     scope?: string;
 }
-/** Carries the server's `{code, message}`, or a client-side transport code. */
 export declare class SecretsClientError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
-    /**
-     * Serialize to a plain `{code, message}`. A consumer that folds a failure into
-     * a structure it later `JSON.stringify`s (a teammate's meta.json, a failure
-     * record, a spawn env) must never make the serializer chase this Error's
-     * internal references and throw `Converting circular structure to JSON`
-     * mid-launch — the value here is the two fields a caller actually needs.
-     */
     toJSON(): {
         code: string;
         message: string;
     };
 }
-/** True when `error` is a {@link SecretsClientError}, optionally with the given code. */
 export declare function isSecretsClientError(error: unknown, code?: string): error is SecretsClientError;
-/** True when `error` is a {@link SecretsClientError} from the transport itself (the
- * standalone was unreachable/unusable), not a data error it answered with. */
 export declare function isSecretsTransportError(error: unknown): error is SecretsClientError;
-/** The raw item holding one bundle key's value. */
 export declare function secretsKeychainItem(bundle: string, key: string): string;
-/** The raw item holding a profile provider's token (`agents-cli.<provider>.token`). */
 export declare function profileKeychainItem(provider: string): string;
-/** The bundle-var form that points a key at its own raw item. */
 export declare function keychainRef(key: string): string;
 export type { BundleValue, SecretRef };
-/**
- * Parse a bundle value into either a literal string or a typed secret ref. A
- * `{ value }` object is an escaped literal (a URL that happens to start with a
- * ref prefix is never misread as a reference).
- */
 export declare function parseBundleValue(raw: BundleValue): {
     literal: string;
 } | {
     ref: SecretRef;
 };
-/**
- * Resolve the standalone `secrets` executable: `$SECRETS_BIN` if set, else the
- * `secrets` command on PATH — resolved with `findInPath`, which skips agents-cli's
- * own shims dir. That skip is load-bearing, not tidiness: before PHNX-3989 the
- * shims dir carried a `secrets` command shim that `exec`s `agents secrets`, it
- * sits FIRST on PATH, and it survives an in-place upgrade (its baked entrypoint
- * still exists). A plain `which secrets` returned that shim, so `agents secrets`
- * → shim → `agents secrets` → … spawned an unbounded process chain on every box
- * upgraded from 1.22.84 (the whole fleet, via R5 auto-update). A `secrets` inside
- * our shims dir can never be the standalone, so it is not a candidate at all.
- * Cached for the process. A miss throws with install guidance — there is NO
- * fallback to the embedded engine (DIST-1).
- */
 export declare function resolveSecretsBin(): string;
-/**
- * How to invoke the resolved binary. A `.js`/`.mjs`/`.cjs` entrypoint (a dev
- * build, or `$SECRETS_BIN` pointing at `dist/index.js`) is run through this
- * process's Node so it works without an executable bit and on Windows; an
- * installed `secrets` shim/binary is spawned directly. Exported so a caller
- * that needs to run an interactive standalone verb directly (e.g. `secrets
- * migrate`, which isn't in this client's op table) can build the same argv.
- */
 export declare function invocation(bin: string): {
     command: string;
     prefix: string[];
 };
-/**
- * Spawn env for the child, applied to a base env (defaults to `process.env`):
- *
- *  - `SECRETS_HOME` defaults to the user agents dir so the standalone adopts the
- *    existing stores in place (MIG-1); an explicit value in the base env wins.
- *  - The standalone renamed every `AGENTS_SECRETS_*` knob to `SECRETS_*`, so a
- *    caller env still carrying the old `AGENTS_SECRETS_PASSPHRASE` (the name
- *    agents-cli's own engine reads — filestore/linux/windows) would be invisible
- *    to `secrets`, which reads only `SECRETS_PASSPHRASE`. Forward it so the child
- *    can decrypt the very file store agents-cli wrote, rather than silently
- *    provisioning a fresh machine-local key. An explicit `SECRETS_PASSPHRASE`
- *    wins — this only bridges the rename, it never overrides.
- *
- * Exported for the seam test (a pure env mapping, no spawn).
- */
 export declare function buildServeEnv(base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-/**
- * Send one operation to the standalone secrets CLI and await its typed result.
- * Spawns `secrets __serve` once for the operation; `parseResponse` checks the
- * protocol on the reply it already carries. Throws a {@link SecretsClientError}
- * carrying the server's `{code, message}` on failure.
- */
 export declare function secretsRequest<T = unknown>(op: string, args?: unknown[], context?: SecretsContext): Promise<T>;
-/**
- * Synchronous sibling of {@link secretsRequest} for the consumers that resolve
- * secrets on a synchronous path (e.g. building a child env before spawn).
- * Bounded by a spawn timeout. POSIX only.
- */
 export declare function secretsRequestSync<T = unknown>(op: string, args?: unknown[], context?: SecretsContext): T;
-/** Test hook: forget the cached binary so a new env is re-resolved. */
 export declare function _resetSecretsClientForTest(): void;
-/** Shorten the sync bound for a test that plants a hanging standalone; reset restores it. */
 export declare function _setSyncServeTimeoutForTest(ms: number): void;
 export declare function readAndResolveBundleEnv(name: string, opts?: ResolveBundleOptions, context?: SecretsContext): Promise<{
     bundle: SecretsBundle;
@@ -136,12 +44,6 @@ export declare function readAndResolveBundleEnvSync(name: string, opts?: Resolve
 };
 export declare function listBundles(context?: SecretsContext): Promise<SecretsBundle[]>;
 export declare function listBundlesSync(context?: SecretsContext): SecretsBundle[];
-/**
- * Per-key kind breakdown (`literal`/`file`/`onepassword`/…) of an already-resolved
- * bundle — the cosmetic `[secrets] Resolved <name>: N keys (…)` summary line. Pure
- * over the bundle document server-side; the wrapper forwards the object the caller
- * already holds from {@link readAndResolveBundleEnv} so the same shape is described.
- */
 export declare function describeBundle(bundle: SecretsBundle, context?: SecretsContext): Promise<BundleEntryInfo[]>;
 export declare function readBundle(name: string, context?: SecretsContext): Promise<SecretsBundle>;
 export declare function readBundleSync(name: string, context?: SecretsContext): SecretsBundle;
@@ -153,10 +55,8 @@ export declare function writeBundle(bundle: SecretsBundle, opts?: WriteBundleOpt
 export declare function writeBundleWithItems(bundle: SecretsBundle, items: Map<string, string>, opts?: WriteBundleOptions, context?: SecretsContext): Promise<void>;
 export declare function writeBundleWithItemsSync(bundle: SecretsBundle, items: Map<string, string>, opts?: WriteBundleOptions, context?: SecretsContext): void;
 export declare function deleteBundleSync(name: string, context?: SecretsContext): boolean;
-/** Rename a bundle: metadata and raw items move together; the source is deleted last. */
 export declare function renameBundle(oldName: string, newName: string, opts?: RenameOptions, context?: SecretsContext): Promise<void>;
 export declare function renameBundleSync(oldName: string, newName: string, opts?: RenameOptions, context?: SecretsContext): void;
-/** Rotate one keychain-backed key's value in place, preserving or patching its meta. */
 export declare function rotateBundleSecret(bundle: SecretsBundle, key: string, opts: RotateOptions, context?: SecretsContext): Promise<void>;
 export declare function rotateBundleSecretSync(bundle: SecretsBundle, key: string, opts: RotateOptions, context?: SecretsContext): void;
 export declare function agentPing(): Promise<{
@@ -177,11 +77,6 @@ export declare function hasKeychainTokenSync(item: string): boolean;
 export declare function deleteKeychainToken(item: string): Promise<boolean>;
 export declare function deleteKeychainTokenSync(item: string): boolean;
 export declare function listKeychainItems(prefix: string): Promise<string[]>;
-/**
- * True when `keychain`-backend items are being routed to the standalone's
- * encrypted file store (headless Linux/Windows with no reachable keyring):
- * on such a host no test or probe can reach a real OS keychain.
- */
 export declare function keychainUsesFileFallback(): Promise<boolean>;
 export declare function storeGetSync(backend: SecretsBackend, item: string): string;
 export declare function storeHasSync(backend: SecretsBackend, item: string): boolean;
@@ -190,18 +85,7 @@ export declare function storeSetSync(backend: SecretsBackend, item: string, valu
 export declare function remoteResolveEnv(target: string, bundle: string, opts?: {
     osLookupName?: string;
 }): Promise<Record<string, string>>;
-/**
- * The user agents dir as the RECEIVING agents-cli resolves it — `~/.agents` on
- * every box, the same root {@link buildServeEnv} pins the local standalone to
- * (MIG-1). A push must name it, because the remote `secrets` otherwise runs
- * under its own default `~/.secrets`: the import succeeds, the file store there
- * is keyed by a different machine-local passphrase, and the receiving daemon's
- * `readReservedCredential` never finds the bundle (yosemite-m0, 2026-09-07:
- * `pushed __cursor__` on the publisher, `no readable durable key` on the worker).
- * Remote-relative on purpose — the local absolute dir means nothing over there.
- */
 export declare const REMOTE_USER_AGENTS_DIR = "~/.agents";
-/** Fill in the remote state root unless the caller named one. Pure, for the seam test. */
 export declare function withRemoteStateRoot(opts: PushBundleOptions): PushBundleOptions;
 export declare function pushBundleToHost(bundle: string, host: string, opts: PushBundleOptions): Promise<PushBundleResult>;
 export declare function pushBundleToHostAsync(bundle: string, host: string, opts: PushBundleOptions): Promise<PushBundleResult>;
@@ -211,5 +95,4 @@ export declare function scanUserRcFiles(homeDir?: string, context?: SecretsConte
 export declare function scanUserRcFilesSync(homeDir?: string, context?: SecretsContext): RcSecretFinding[];
 export declare function masterPassphraseInEnv(context?: SecretsContext): Promise<boolean>;
 export declare function masterPassphraseInEnvSync(context?: SecretsContext): boolean;
-/** Strip loader/interpreter overrides from an env before it reaches a spawned child. */
 export declare function sanitizeProcessEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;