@phnx-labs/agents-cli 1.22.20 → 1.22.21

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.22.21
+
+- **`agents secrets exec <bundle> -- <cmd>` now resolves a locked keychain bundle
+  interactively at a real terminal.** The local resolve hardcoded `agentOnly: true`
+  (`commands/secrets.ts`), so running `exec` on a locked bundle at a terminal
+  failed closed with "run `agents secrets unlock` first" instead of raising the one
+  Touch ID sheet the human just implied by asking to use the values. It now gates
+  `agentOnly` on `isHeadlessSecretsContext() || !isInteractiveTerminal()`: an
+  unlocked bundle still runs silently, a locked bundle at an interactive terminal
+  resolves with a single sheet and then runs the command with the secrets injected,
+  and under an agent (`AGENTS_RUNTIME`) or headless (no TTY) it stays broker-only —
+  release/CI scripts never prompt. Mirrors the same fix for `view --reveal`.
+  `--host` remote resolves and `export`/`get` are unchanged. Source:
+  `apps/cli/src/commands/secrets.ts`.
+
 ## 1.22.20
 
 - **Claude sessions are attributed to the account that produced them.** The session

package/dist/commands/secrets.js

@@ -2307,7 +2307,13 @@ Examples:
                     caller: `command ${cmd}`,
                     keys: keysSubset,
                     allowExpired: execOpts.allowExpired,
-                    agentOnly: true,
+                    // An explicit `secrets exec` at a real terminal is a deliberate use of
+                    // the values: an unlocked bundle runs silently, a locked one resolves
+                    // with one Touch ID sheet, then the command runs with the secrets
+                    // injected. Under an agent (AGENTS_RUNTIME) or headless (no TTY) it
+                    // stays broker-only and points at the explicit unlock command instead
+                    // of raising a sheet — so release/CI scripts never prompt.
+                    agentOnly: isHeadlessSecretsContext() || !isInteractiveTerminal(),
                 }).env;
             }
             const { spawn } = await import('child_process');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.20",
+  "version": "1.22.21",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",