@phnx-labs/agents-cli 1.22.22 → 1.22.24

package/dist/lib/run-defaults.js

@@ -17,6 +17,7 @@ import { readMeta, updateMeta } from './state.js';
 import { getProjectRunConfigs } from './run-config.js';
 import chalk from 'chalk';
 const VERSION_RE = /^(?:\*|latest|(?!.*\.\.)[A-Za-z0-9._+-]{1,64})$/;
+const RUN_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'auto'];
 function isAgentId(value) {
     return value in AGENTS;
 }
@@ -42,6 +43,12 @@ function normalizeRunDefaults(defaults, selector) {
         }
         out.model = defaults.model.trim();
     }
+    if (defaults.effort !== undefined) {
+        if (typeof defaults.effort !== 'string' || !RUN_EFFORTS.includes(defaults.effort)) {
+            throw new Error('Invalid effort in run.defaults.' + selector + ': use one of: ' + RUN_EFFORTS.join(', ') + '.');
+        }
+        out.effort = defaults.effort;
+    }
     return out;
 }
 export function parseRunDefaultSelector(input) {
@@ -97,6 +104,10 @@ export function resolveRunDefaultsFromConfig(runConfig, agent, version) {
         resolved.model = wildcard.model;
         resolved.sources.model = wildcardSelector;
     }
+    if (wildcard?.effort) {
+        resolved.effort = wildcard.effort;
+        resolved.sources.effort = wildcardSelector;
+    }
     if (exactSelector && defaults[exactSelector]) {
         const exact = normalizeRunDefaults(defaults[exactSelector], exactSelector);
         if (exact.mode) {
@@ -107,6 +118,10 @@ export function resolveRunDefaultsFromConfig(runConfig, agent, version) {
             resolved.model = exact.model;
             resolved.sources.model = exactSelector;
         }
+        if (exact.effort) {
+            resolved.effort = exact.effort;
+            resolved.sources.effort = exactSelector;
+        }
     }
     return resolved;
 }
@@ -122,6 +137,10 @@ export function resolveRunDefaultsFromConfigs(runConfigs, agent, version) {
             resolved.model = next.model;
             resolved.sources.model = next.sources.model;
         }
+        if (next.effort) {
+            resolved.effort = next.effort;
+            resolved.sources.effort = next.sources.effort;
+        }
     }
     return resolved;
 }
@@ -135,6 +154,8 @@ export function formatRunDefaultEntry(entry) {
         parts.push(`mode ${chalk.white(entry.defaults.mode)}`);
     if (entry.defaults.model)
         parts.push(`model ${chalk.white(entry.defaults.model)}`);
+    if (entry.defaults.effort)
+        parts.push('effort ' + chalk.white(entry.defaults.effort));
     return `${chalk.cyan(entry.selector.padEnd(22))} ${parts.join('  ')}`;
 }
 export function listRunDefaults() {
@@ -149,8 +170,8 @@ export function listRunDefaults() {
 export function setRunDefault(selectorInput, defaultsInput) {
     const parsed = parseRunDefaultSelector(selectorInput);
     const defaults = normalizeRunDefaults(defaultsInput, parsed.selector);
-    if (!defaults.mode && !defaults.model) {
-        throw new Error('Set at least one default: --mode <mode> or --model <model>.');
+    if (!defaults.mode && !defaults.model && !defaults.effort) {
+        throw new Error('Set at least one default: --mode <mode>, --model <model>, or --effort <effort>.');
     }
     updateMeta((meta) => {
         const run = { ...(meta.run ?? {}) };

package/dist/lib/runner.js

@@ -22,6 +22,7 @@ import { getRunsDir } from './state.js';
 import { prepareJobHome, buildSpawnEnv, getJobHomePath } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { createTimer, redactPrompt } from './events.js';
+import { codexEditWritableRoots, codexPolicyArgs } from './codex-policy.js';
 import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, detectAuthFailure, isAuthFailureFromLog, authFailureReason, } from './exec.js';
 import { resolveActor } from './actor.js';
 import { loadTask as loadHostTask } from './hosts/tasks.js';
@@ -30,7 +31,8 @@ import { backgroundSpawnOptions, killTree } from './platform/process.js';
 import lockfile from 'proper-lockfile';
 import { ensureLockTarget } from './fs-atomic.js';
 import { walkForFiles } from './fs-walk.js';
-import { getBinaryPath, isVersionInstalled, resolveVersion } from './versions.js';
+import { getBinaryPath, isVersionInstalled, resolveVersion, getVersionHomePath } from './versions.js';
+import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from './rotate.js';
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
@@ -99,11 +101,12 @@ function terminateRoutineTree(pid) {
 /** CLI command templates per agent, with {prompt} as a placeholder. */
 const AGENT_COMMANDS = {
     claude: ['claude', '-p', '--verbose', '{prompt}', '--output-format', 'stream-json', '--permission-mode', 'plan'],
-    codex: ['codex', 'exec', '--sandbox', 'workspace-write', '{prompt}', '--json'],
+    codex: ['codex', 'exec', '{prompt}', '--json'],
     gemini: ['gemini', '{prompt}', '--output-format', 'stream-json'],
     cursor: ['cursor-agent', '-p', '{prompt}', '--output-format', 'stream-json'],
     kimi: ['kimi', '--prompt', '{prompt}', '--output-format', 'stream-json'],
     droid: ['droid', 'exec', '{prompt}', '-o', 'stream-json'],
+    muse: ['muse', 'exec', '{prompt}', '--json'],
 };
 /** Agents the daemon can actually run, derived from the command table above
  * so the `--agent` help and any validation can never drift from it. */
@@ -137,6 +140,8 @@ const ROUTINE_TRANSCRIPT_SPECS = {
         { root: ['.kimi-code', 'sessions'], ext: '.jsonl' },
     ],
     grok: [{ root: ['.grok', 'sessions'], ext: '.json' }],
+    // Muse: ~/.local/share/muse/sessions/YYYY/MM/DD/<uuid>/session.jsonl
+    muse: [{ root: ['.local', 'share', 'muse', 'sessions'], ext: '.jsonl' }],
 };
 /** Stable working directory for routine children, independent of the daemon's launch cwd. */
 export function routineSpawnCwd(config, configuredRoot = getProjectRoot()) {
@@ -210,24 +215,14 @@ export function buildJobCommand(config, resolvedPrompt) {
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'codex') {
-        if (mode === 'plan') {
-            // The template defaults to workspace-write; plan means read-only.
-            const sbIndex = cmd.indexOf('--sandbox');
-            if (sbIndex !== -1)
-                cmd[sbIndex + 1] = 'read-only';
-        }
-        else if (mode === 'edit' || mode === 'auto') {
-            // Keep the workspace-write sandbox — no approval bypass; only skip drops
-            // the guardrails. Re-enable network, which workspace-write turns off.
-            cmd.push('-c', 'sandbox_workspace_write.network_access=true');
-        }
-        else if (mode === 'skip') {
-            // Remove sandbox restriction, just --dangerously-bypass-approvals-and-sandbox
-            const sbIndex = cmd.indexOf('--sandbox');
-            if (sbIndex !== -1)
-                cmd.splice(sbIndex, 2);
-            cmd.push('--dangerously-bypass-approvals-and-sandbox');
-        }
+        const policyMode = mode === 'plan' || mode === 'skip' ? mode : 'edit';
+        const routineRoots = (config.allow?.dirs ?? []).map((dir) => {
+            if (dir.startsWith('-')) {
+                throw new Error(`allow.dirs entries must not start with '-': ${JSON.stringify(dir)}`);
+            }
+            return dir.replace(/^~/, os.homedir());
+        });
+        cmd.push(...codexPolicyArgs(policyMode, [...codexEditWritableRoots(), ...routineRoots]));
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'gemini') {
@@ -277,6 +272,21 @@ export function buildJobCommand(config, resolvedPrompt) {
         }
         appendModelAndReasoning(cmd, config);
     }
+    if (config.agent === 'muse') {
+        // muse exec: plan ≈ no non-shell writes; auto skips approval prompts but
+        // keeps the OS sandbox; skip is --yolo (no approval, no sandbox, trust).
+        if (mode === 'plan') {
+            cmd.push('--disable-write');
+        }
+        else if (mode === 'auto') {
+            cmd.push('--disable-approval');
+        }
+        else if (mode === 'skip') {
+            cmd.push('--yolo');
+        }
+        // edit: default on-request approval + sandbox
+        appendModelAndReasoning(cmd, config);
+    }
     return cmd;
 }
 /**
@@ -528,22 +538,26 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone, overlayH
         if (v !== undefined)
             out[k] = v;
     }
-    // A routine authenticates through the pinned account's own CLAUDE_CONFIG_DIR
-    // login on THIS box (buildExecEnv points it at the per-account version home).
-    // Claude Code's interactive session refreshes itself per-device; keeping the
-    // daemon out of the credential entirely is what avoids the fleet-wide rotation
-    // logout — a shared/rotating token was the cause, not the fix.
-    //
-    // Injecting a token was already ruled out, but INHERITING one was not:
-    // buildExecEnv spreads the ambient process.env (exec.ts) and sanitizeProcessEnv
-    // only strips loader/interpreter vars, never credentials. So on any box whose
-    // daemon environment happens to carry CLAUDE_CODE_OAUTH_TOKEN, every routine
-    // spawn silently ran on that one shared rotating token instead of the host's
-    // own login — the exact fleet-wide-logout path, arriving by inheritance rather
-    // than injection. CI never caught it because CI has no token to inherit; a
-    // provisioned box does. Drop it here so a routine always uses the login of the
-    // machine it runs on.
-    delete out.CLAUDE_CODE_OAUTH_TOKEN;
+    // CLAUDE_CODE_OAUTH_TOKEN comes in two flavours, and only one is safe for a
+    // routine. KEEP a per-account `claude setup-token` (long-lived, NON-rotating,
+    // keyed to this home's own account) that buildExecEnv injected from the reserved
+    // `auth` bundle (resolveClaudeSetupToken) — that is the durable cure for the
+    // single-use-refresh-token revocation storm: a setup-token never rotates, so a
+    // scheduled routine can't land on a sibling home's just-rotated-out credential.
+    // STRIP an INHERITED ambient value instead: buildExecEnv spreads process.env
+    // (exec.ts) and sanitizeProcessEnv leaves credentials, so a daemon env that
+    // happens to carry a shared/rotating CLAUDE_CODE_OAUTH_TOKEN would otherwise make
+    // every routine run on that one token — the RUSH-1822 fleet-wide-logout path.
+    // Distinguish by value: only the resolved setup-token survives.
+    // Authoritative: buildExecEnv injects the setup-token but then spreads the caller
+    // env over it, so an ambient CLAUDE_CODE_OAUTH_TOKEN would win — re-assert here.
+    const setupToken = agent === 'claude' && version
+        ? resolveClaudeSetupToken(getVersionHomePath('claude', version))
+        : null;
+    if (setupToken)
+        out.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
+    else
+        delete out.CLAUDE_CODE_OAUTH_TOKEN;
     if (agent === 'cursor' && overlayHome) {
         // prepareJobHome links this host's Cursor auth file here. Pin XDG_CONFIG_HOME
         // to the overlay so an ambient value cannot bypass the routine sandbox.

package/dist/lib/secrets/bundles.js

@@ -294,6 +294,26 @@ export function readBundle(name) {
         if (vaultExists() && !getVaultSession().loggedIn) {
             throw new Error(`Synced secrets are locked. Run: agents login`);
         }
+        // Distinguish a genuinely-absent bundle from a present-but-unreadable one
+        // (a locked login keychain, or a legacy ACL'd metadata item before first
+        // unlock). `has` counts an unreadable item as present, so a metadata item
+        // that exists but could not be read must not report as "not found" — an
+        // existence answer and a read answer may not contradict (RUSH-2253).
+        if (backend === 'keychain') {
+            let present;
+            try {
+                present = hasKeychainToken(bundleMetaItem(name));
+            }
+            catch (probeErr) {
+                // Keychain unreachable (RUSH-2235 fail-loud): neither absent nor
+                // add-the-key — surface the reachability failure, not a false absence.
+                throw new Error(`Secrets bundle '${name}': ${probeErr.message}`);
+            }
+            if (present) {
+                throw new Error(`Secrets bundle '${name}' is present but its metadata could not be read — the keychain is locked. ` +
+                    `Unlock it (log in, or reboot then log in) and retry. (${err.message})`);
+            }
+        }
         throw new Error(`Secrets bundle '${name}' not found.`);
     }
     let parsed;
@@ -1060,6 +1080,91 @@ export function assertRemoteBundleFlagsUnsupported(bundleName, host, opts, flagL
     throw new Error(`Bundle '${bundleName}@${host}': ${flagLabels.keysFlag} and ${flagLabels.allowExpiredFlag} are not supported for remote (bundle@host) bundles yet. ` +
         `Drop the flag or resolve the bundle locally.`);
 }
+/**
+ * A declared `keychain:` ref resolved to NO value in the batch read. Classify
+ * genuinely-absent vs present-but-unreadable before choosing the error, so a
+ * read can never contradict what `agents secrets view` reports (RUSH-2248,
+ * RUSH-2253). `view`'s "stored" badge comes from `hasKeychainToken` — the exact
+ * existence probe used here — which counts a biometry-ACL'd or locked-keychain
+ * item (`errSecInteractionNotAllowed`) as present. So:
+ *
+ *   - present  ⇒ the item exists but this context could not read it (keychain
+ *     locked, or Touch ID not granted). Report HOW to unlock; NEVER
+ *     "add the key", whose remediation (`secrets add`) would overwrite a good
+ *     secret.
+ *   - absent   ⇒ genuinely not stored on this machine — the honest "not found"
+ *     with the `secrets add` remediation.
+ *   - probe throws ⇒ the keychain itself is unreachable (RUSH-2235 fail-loud):
+ *     neither absent nor add-the-key — surface the reachability failure verbatim.
+ *
+ * Only the keychain backend has a locked/biometry state; a file/vault miss is
+ * genuinely absent.
+ */
+function missingBundleKeychainItemError(bundleName, key, item, backendKind) {
+    if (backendKind === 'keychain') {
+        let present;
+        try {
+            present = hasKeychainToken(item);
+        }
+        catch (err) {
+            return new Error(`Bundle '${bundleName}' key '${key}': ${err.message}`);
+        }
+        if (present) {
+            return new Error(`Bundle '${bundleName}' key '${key}': stored item '${item}' is present but could not be read — ` +
+                `the keychain is locked or Touch ID was not granted for this read. ` +
+                `Run: agents secrets unlock ${bundleName}  (or read it once at an interactive terminal so Touch ID can be granted). ` +
+                `Do NOT run 'agents secrets add' — the secret is already stored and adding would overwrite it.`);
+        }
+    }
+    return new Error(`Bundle '${bundleName}' key '${key}': stored item '${item}' not found. ` +
+        `Run: agents secrets add ${bundleName} ${key}`);
+}
+/**
+ * Resolve every selected key of an already-read bundle into a flat env map,
+ * given a pre-fetched keychain batch. The single per-key resolution loop shared
+ * by `resolveBundleEnv` and `readAndResolveBundleEnv` so the keychain lookup and
+ * the missing-item classification can never diverge again (RUSH-2252: the two
+ * paths drifted — one did the hashed-alias fallback lookup and one did not, and
+ * only one classified a missing item honestly).
+ *
+ * The keychain lookup tries the cleartext name first (Linux / file store), then
+ * its hashed storage alias (macOS with #316 hashing active) — the batch keys its
+ * results by the names it was ASKED for, which for the metadata + declared keys
+ * is the cleartext form and for an enumerated leftover is the hashed form.
+ */
+function assembleBundleEnv(bundle, selectedKeys, parsedByKey, fetched, keyMode, backendKind) {
+    const env = {};
+    const owners = new Map();
+    for (const [key] of Object.entries(bundle.vars)) {
+        if (!selectedKeys.has(key))
+            continue;
+        const parsed = parsedByKey.get(key);
+        if ('literal' in parsed) {
+            assignResolvedEnvValue(env, bundle, key, parsed.literal, keyMode, owners);
+            continue;
+        }
+        if (parsed.ref.provider === 'keychain') {
+            const item = secretsKeychainItem(bundle.name, parsed.ref.value);
+            const value = fetched.get(item) ?? fetched.get(keychainServiceAlias(item));
+            if (value === undefined) {
+                throw missingBundleKeychainItemError(bundle.name, key, item, backendKind);
+            }
+            assignResolvedEnvValue(env, bundle, key, value, keyMode, owners);
+            continue;
+        }
+        try {
+            const value = resolveRef(parsed.ref, {
+                allowExec: bundle.allow_exec,
+                keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
+            });
+            assignResolvedEnvValue(env, bundle, key, value, keyMode, owners);
+        }
+        catch (err) {
+            throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
+        }
+    }
+    return env;
+}
 // Walk the bundle and produce a flat env map. Every keychain: ref is gathered
 // into a single batch read so macOS shows ONE Touch ID prompt for the whole
 // bundle — including the metadata fetch that already happened in readBundle
@@ -1093,37 +1198,7 @@ export function resolveBundleEnv(bundle, _opts = {}) {
             ? getKeychainTokens(keychainItemsToFetch, { silentNoAcl: bundlePolicy(bundle) === 'never' })
             : store.getBatch(keychainItemsToFetch)
         : new Map();
-    const env = {};
-    const owners = new Map();
-    for (const [key, raw] of Object.entries(bundle.vars)) {
-        if (!selectedKeys.has(key))
-            continue;
-        const parsed = parsedByKey.get(key);
-        if ('literal' in parsed) {
-            assignResolvedEnvValue(env, bundle, key, parsed.literal, _opts.keyMode, owners);
-            continue;
-        }
-        if (parsed.ref.provider === 'keychain') {
-            const item = secretsKeychainItem(bundle.name, parsed.ref.value);
-            const value = fetched.get(item);
-            if (value === undefined) {
-                throw new Error(`Bundle '${bundle.name}' key '${key}': stored item '${item}' not found. ` +
-                    `Run: agents secrets add ${bundle.name} ${key}`);
-            }
-            assignResolvedEnvValue(env, bundle, key, value, _opts.keyMode, owners);
-            continue;
-        }
-        try {
-            const value = resolveRef(parsed.ref, {
-                allowExec: bundle.allow_exec,
-                keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
-            });
-            assignResolvedEnvValue(env, bundle, key, value, _opts.keyMode, owners);
-        }
-        catch (err) {
-            throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
-        }
-    }
+    const env = assembleBundleEnv(bundle, selectedKeys, parsedByKey, fetched, _opts.keyMode, bundle.backend ?? 'keychain');
     // `caller` is intentionally unused; see ResolveBundleOptions.
     void _opts.caller;
     return env;
@@ -1327,6 +1402,53 @@ export function readAndResolveBundleEnv(name, opts = {}) {
     }
     const keys = [...selectedKeys].sort();
     keychainKeys.sort();
+    // RUSH-2252: complete the read set from the bundle's DECLARED keys, not only
+    // from the enumeration above. `store.list()` derives the batch by enumerating
+    // the bundle's namespace, and that enumeration is lossy by construction — the
+    // macOS helper's `list` omits every biometry-ACL'd item
+    // (`kSecUseAuthenticationUISkip`) and skips the whole data-protection pass when
+    // the keychain is locked, so a `hold`-policy bundle's value items never appear
+    // and a present secret reads as "not found" (RUSH-2248). A declared key whose
+    // item did not enumerate is therefore absent from `fetched`; read those exact
+    // items directly — a point read DOES evaluate the ACL, so it triggers Touch ID
+    // and returns the value the enumeration could not see. The enumeration still
+    // earns its place (it catches hashed/aliased storage names and stale leftovers
+    // not named in the metadata), so this is a UNION, not a replacement.
+    //
+    // One Touch ID sheet is preserved: the items missing from `fetched` are exactly
+    // the ACL'd ones the enumeration dropped, so the first batch (metadata plus any
+    // no-ACL / `never` items) raised no sheet, and this second batch raises the
+    // single sheet that covers all of them. When the enumeration is healthy every
+    // declared item is already in `fetched`, `missingDeclared` is empty, and this
+    // is skipped entirely — zero behavior change and no extra spawn on the hot path.
+    if (backend === 'keychain') {
+        const missingDeclared = [];
+        for (const key of keychainKeys) {
+            const p = parsedByKey.get(key);
+            if (!('ref' in p) || p.ref.provider !== 'keychain')
+                continue;
+            const item = secretsKeychainItem(bundle.name, p.ref.value);
+            if (fetched.get(item) === undefined && fetched.get(keychainServiceAlias(item)) === undefined) {
+                missingDeclared.push(item);
+            }
+        }
+        if (missingDeclared.length > 0) {
+            const declaredFetched = getKeychainTokens([...new Set(missingDeclared)], {
+                agent: opts.agent || process.env.AGENTS_AGENT_NAME || 'Agents CLI',
+                bundle: name,
+                sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
+                reason: opts.caller ? `to ${opts.caller}` : reason,
+                duration: opts.duration || humanUnlockDuration(secretsHoldMs()),
+                // The policy is known now (metadata parsed), so the prompt names the real
+                // duration instead of the pre-read default the first batch had to guess.
+                defaultPolicy: bundlePolicy(bundle),
+                forceDuration: Boolean(opts.duration),
+                silentNoAcl: verifiedNoAclBundle,
+            });
+            for (const [k, v] of declaredFetched)
+                fetched.set(k, v);
+        }
+    }
     const emitReadAudit = (status, err) => {
         emitSecretAudit({
             event: 'secrets.get',
@@ -1342,40 +1464,10 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         });
     };
     try {
-        const env = {};
-        const owners = new Map();
-        for (const [key] of Object.entries(bundle.vars)) {
-            if (!selectedKeys.has(key))
-                continue;
-            const p = parsedByKey.get(key);
-            if ('literal' in p) {
-                assignResolvedEnvValue(env, bundle, key, p.literal, opts.keyMode, owners);
-                continue;
-            }
-            if (p.ref.provider === 'keychain') {
-                const item = secretsKeychainItem(bundle.name, p.ref.value);
-                // The batch keys results by the names it was ASKED for: the cleartext
-                // metaItem, plus enumerated storage names. Look up the cleartext name
-                // first (Linux / file store), then its hashed storage alias (macOS).
-                const value = fetched.get(item) ?? fetched.get(keychainServiceAlias(item));
-                if (value === undefined) {
-                    throw new Error(`Bundle '${bundle.name}' key '${key}': stored item '${item}' not found. ` +
-                        `Run: agents secrets add ${bundle.name} ${key}`);
-                }
-                assignResolvedEnvValue(env, bundle, key, value, opts.keyMode, owners);
-                continue;
-            }
-            try {
-                const value = resolveRef(p.ref, {
-                    allowExec: bundle.allow_exec,
-                    keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
-                });
-                assignResolvedEnvValue(env, bundle, key, value, opts.keyMode, owners);
-            }
-            catch (err) {
-                throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
-            }
-        }
+        // Shared per-key resolver: same keychain lookup (cleartext name, then hashed
+        // storage alias) and same missing-item classification as resolveBundleEnv, so
+        // the two paths can never diverge again (RUSH-2252, RUSH-2253).
+        const env = assembleBundleEnv(bundle, selectedKeys, parsedByKey, fetched, opts.keyMode, backend);
         emitReadAudit('success');
         // Auto-cache: this was a real keychain read (the agent fast-path returned
         // earlier on a hit). If the bundle opts into the `daily` policy and the user

package/dist/lib/secrets/filestore.d.ts

@@ -29,9 +29,11 @@ export declare function machinePassphraseExists(): boolean;
  * Resolve the passphrase for the encrypted file store.
  *
  * Order: AGENTS_SECRETS_PASSPHRASE > previously-provisioned machine-local key >
- * a freshly auto-provisioned machine-local key. It NEVER prompts and NEVER
- * hard-fails — the file store must work on every platform (macOS included)
- * without the user setting, typing, or remembering a passphrase. Provisioning
+ * legacy co-located key > a freshly auto-provisioned machine-local key. It NEVER
+ * prompts, and never fails for WANT of a passphrase — the file store must work on
+ * every platform (macOS included) without the user setting, typing, or
+ * remembering one. (It can still throw if provisioning cannot write the key file
+ * at all; that is a disk/permissions failure, not a missing passphrase.) Provisioning
  * writes a 0600 key file (encryption-at-rest, same posture as an SSH key); set
  * AGENTS_SECRETS_PASSPHRASE to opt into an off-disk key.
  */

package/dist/lib/secrets/filestore.js

@@ -110,11 +110,13 @@ function readMachinePassphrase() {
  * the keyring is locked and no AGENTS_SECRETS_PASSPHRASE is set.
  *
  * Security model: this is encryption-at-rest with the key held in a 0600 file —
- * the same posture as an SSH private key, and identical to the common
- * "export AGENTS_SECRETS_PASSPHRASE=… in ~/.zshenv (chmod 600)" workaround. The
- * keyring (key in a daemon's locked memory) is stronger but is unavailable
- * without a graphical/unlocked session. For an off-disk key, set
- * AGENTS_SECRETS_PASSPHRASE (it always takes precedence) or unlock the keyring.
+ * the same posture as an SSH private key. It is NOT equivalent to the common
+ * "export AGENTS_SECRETS_PASSPHRASE=… in ~/.zshenv (chmod 600)" workaround, and
+ * is strictly safer: this file is read by the one process that needs it, while
+ * a shell-rc export is inherited by every process the login shell spawns and is
+ * readable from /proc/<pid>/environ by any same-user process (RUSH-1968; see
+ * rc-hygiene.ts). The keyring (key in a daemon's locked memory) is stronger
+ * still but is unavailable without a graphical/unlocked session.
  */
 function provisionMachinePassphrase() {
     const existing = readMachinePassphrase();
@@ -145,9 +147,11 @@ function provisionMachinePassphrase() {
  * Resolve the passphrase for the encrypted file store.
  *
  * Order: AGENTS_SECRETS_PASSPHRASE > previously-provisioned machine-local key >
- * a freshly auto-provisioned machine-local key. It NEVER prompts and NEVER
- * hard-fails — the file store must work on every platform (macOS included)
- * without the user setting, typing, or remembering a passphrase. Provisioning
+ * legacy co-located key > a freshly auto-provisioned machine-local key. It NEVER
+ * prompts, and never fails for WANT of a passphrase — the file store must work on
+ * every platform (macOS included) without the user setting, typing, or
+ * remembering one. (It can still throw if provisioning cannot write the key file
+ * at all; that is a disk/permissions failure, not a missing passphrase.) Provisioning
  * writes a 0600 key file (encryption-at-rest, same posture as an SSH key); set
  * AGENTS_SECRETS_PASSPHRASE to opt into an off-disk key.
  */

package/dist/lib/secrets/index.d.ts

@@ -22,10 +22,24 @@
  * through the explicit export/import flow in src/lib/secrets/sync.ts
  * rather than the system's cloud-keychain path.
  */
-import { type SpawnSyncOptions } from 'child_process';
+import { type SpawnSyncOptions, type SpawnSyncReturns } from 'child_process';
 import type { NativeImportReport } from './fallback.js';
 export type { NativeImportReport, NativeImportResult, NativeImportStatus } from './fallback.js';
 export declare const SECRETS_ITEM_PREFIX = "agents-cli.secrets.";
+/**
+ * Thrown when a keychain helper / security spawnSync is killed because it
+ * exceeded its timeout. A wedged coreauthd / LocalAuthentication dialog can hang
+ * the parent forever; this makes the failure explicit and arms the read back-off.
+ */
+export declare class KeychainHelperTimeoutError extends Error {
+    readonly bin: string;
+    readonly args: string[];
+    constructor(bin: string, args: string[]);
+}
+/** Test seam: suppress the side-effect daemon boot in unit tests. */
+export declare function setKeychainDaemonBootForTest(enabled: boolean): void;
+/** Test seam: exercise the timeout wrapper with an arbitrary binary. */
+export declare function spawnKeychainHelperForTest(bin: string, args: string[], opts: SpawnSyncOptions, timeoutMs: number): SpawnSyncReturns<Buffer>;
 /** Supported secret resolution backends. */
 export type SecretProvider = 'keychain' | 'env' | 'file' | 'exec';
 /** A typed reference to a secret, consisting of a provider and a provider-specific value. */