@phnx-labs/agents-cli 1.22.23 → 1.22.25

package/dist/lib/runner.js

@@ -31,7 +31,8 @@ import { backgroundSpawnOptions, killTree } from './platform/process.js';
 import lockfile from 'proper-lockfile';
 import { ensureLockTarget } from './fs-atomic.js';
 import { walkForFiles } from './fs-walk.js';
-import { getBinaryPath, isVersionInstalled, resolveVersion } from './versions.js';
+import { getBinaryPath, isVersionInstalled, resolveVersion, getVersionHomePath } from './versions.js';
+import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, } from './rotate.js';
 import { readAuthHealth, isDeadVerdict } from './auth-health.js';
 import { machineId } from './machine-id.js';
@@ -51,7 +52,7 @@ function activeRoutineRun(config) {
     const runs = listRuns(config.name);
     for (let i = runs.length - 1; i >= 0; i--) {
         const run = runs[i];
-        if (run.status !== 'running')
+        if (!['running', 'failed', 'timeout'].includes(run.status))
             continue;
         if (run.pid && isPidOurs(run.pid, run.spawnedAt))
             return run;
@@ -234,10 +235,10 @@ export function buildJobCommand(config, resolvedPrompt) {
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'cursor') {
-        // cursor-agent supports --plan, but the capability registry has not been
-        // upgraded yet. RUSH-2101 tracks adding that read-only mode after PR #1721.
-        const cursorMode = resolveHeadlessMode('cursor', mode, false, `routine ${config.name}`);
-        if (cursorMode === 'skip') {
+        if (mode === 'plan') {
+            cmd.push('--plan');
+        }
+        else if (mode === 'skip') {
             cmd.push('-f');
         }
         else {
@@ -537,22 +538,26 @@ export function buildRoutineSpawnEnv(baseEnv, agent, version, timezone, overlayH
         if (v !== undefined)
             out[k] = v;
     }
-    // A routine authenticates through the pinned account's own CLAUDE_CONFIG_DIR
-    // login on THIS box (buildExecEnv points it at the per-account version home).
-    // Claude Code's interactive session refreshes itself per-device; keeping the
-    // daemon out of the credential entirely is what avoids the fleet-wide rotation
-    // logout — a shared/rotating token was the cause, not the fix.
-    //
-    // Injecting a token was already ruled out, but INHERITING one was not:
-    // buildExecEnv spreads the ambient process.env (exec.ts) and sanitizeProcessEnv
-    // only strips loader/interpreter vars, never credentials. So on any box whose
-    // daemon environment happens to carry CLAUDE_CODE_OAUTH_TOKEN, every routine
-    // spawn silently ran on that one shared rotating token instead of the host's
-    // own login — the exact fleet-wide-logout path, arriving by inheritance rather
-    // than injection. CI never caught it because CI has no token to inherit; a
-    // provisioned box does. Drop it here so a routine always uses the login of the
-    // machine it runs on.
-    delete out.CLAUDE_CODE_OAUTH_TOKEN;
+    // CLAUDE_CODE_OAUTH_TOKEN comes in two flavours, and only one is safe for a
+    // routine. KEEP a per-account `claude setup-token` (long-lived, NON-rotating,
+    // keyed to this home's own account) that buildExecEnv injected from the reserved
+    // `auth` bundle (resolveClaudeSetupToken) — that is the durable cure for the
+    // single-use-refresh-token revocation storm: a setup-token never rotates, so a
+    // scheduled routine can't land on a sibling home's just-rotated-out credential.
+    // STRIP an INHERITED ambient value instead: buildExecEnv spreads process.env
+    // (exec.ts) and sanitizeProcessEnv leaves credentials, so a daemon env that
+    // happens to carry a shared/rotating CLAUDE_CODE_OAUTH_TOKEN would otherwise make
+    // every routine run on that one token — the RUSH-1822 fleet-wide-logout path.
+    // Distinguish by value: only the resolved setup-token survives.
+    // Authoritative: buildExecEnv injects the setup-token but then spreads the caller
+    // env over it, so an ambient CLAUDE_CODE_OAUTH_TOKEN would win — re-assert here.
+    const setupToken = agent === 'claude' && version
+        ? resolveClaudeSetupToken(getVersionHomePath('claude', version))
+        : null;
+    if (setupToken)
+        out.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
+    else
+        delete out.CLAUDE_CODE_OAUTH_TOKEN;
     if (agent === 'cursor' && overlayHome) {
         // prepareJobHome links this host's Cursor auth file here. Pin XDG_CONFIG_HOME
         // to the overlay so an ambient value cannot bypass the routine sandbox.

package/dist/lib/secrets/Agents CLI.app/Contents/Info.plist

@@ -8,6 +8,8 @@
   <string>Agents CLI</string>
   <key>CFBundleDisplayName</key>
   <string>Agents CLI</string>
+  <key>CFBundleIconFile</key>
+  <string>AppIcon</string>
   <key>CFBundleExecutable</key>
   <string>Agents CLI</string>
   <key>CFBundlePackageType</key>

package/dist/lib/secrets/Agents CLI.app/Contents/_CodeSignature/CodeResources

@@ -3,9 +3,21 @@
 <plist version="1.0">
 <dict>
 	<key>files</key>
-	<dict/>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<data>
+		DFq5H08EkhgWIC3UvGMR9B58BZw=
+		</data>
+	</dict>
 	<key>files2</key>
 	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			mBSjM6jlvN7J1jQowsvqTl7CHM0pur0e6qsHMuzk5k0=
+			</data>
+		</dict>
 		<key>embedded.provisionprofile</key>
 		<dict>
 			<key>hash2</key>

package/dist/lib/secrets/bundles.js

@@ -55,19 +55,7 @@ const keychainStore = {
 const fileItemStore = {
     has: (item) => fileStore.has(item),
     get: (item) => fileStore.get(item),
-    getBatch: (items) => {
-        const out = new Map();
-        for (const item of items) {
-            try {
-                out.set(item, fileStore.get(item));
-            }
-            catch {
-                // Missing/undecryptable item — absent from the map, mirroring
-                // getKeychainTokens (caller decides whether that's an error).
-            }
-        }
-        return out;
-    },
+    getBatch: (items) => fileStore.getBatch(items),
     set: (item, value) => fileStore.set(item, value),
     setBatch: (items) => {
         for (const [item, value] of items) {
@@ -294,6 +282,26 @@ export function readBundle(name) {
         if (vaultExists() && !getVaultSession().loggedIn) {
             throw new Error(`Synced secrets are locked. Run: agents login`);
         }
+        // Distinguish a genuinely-absent bundle from a present-but-unreadable one
+        // (a locked login keychain, or a legacy ACL'd metadata item before first
+        // unlock). `has` counts an unreadable item as present, so a metadata item
+        // that exists but could not be read must not report as "not found" — an
+        // existence answer and a read answer may not contradict (RUSH-2253).
+        if (backend === 'keychain') {
+            let present;
+            try {
+                present = hasKeychainToken(bundleMetaItem(name));
+            }
+            catch (probeErr) {
+                // Keychain unreachable (RUSH-2235 fail-loud): neither absent nor
+                // add-the-key — surface the reachability failure, not a false absence.
+                throw new Error(`Secrets bundle '${name}': ${probeErr.message}`);
+            }
+            if (present) {
+                throw new Error(`Secrets bundle '${name}' is present but its metadata could not be read — the keychain is locked. ` +
+                    `Unlock it (log in, or reboot then log in) and retry. (${err.message})`);
+            }
+        }
         throw new Error(`Secrets bundle '${name}' not found.`);
     }
     let parsed;
@@ -1060,6 +1068,91 @@ export function assertRemoteBundleFlagsUnsupported(bundleName, host, opts, flagL
     throw new Error(`Bundle '${bundleName}@${host}': ${flagLabels.keysFlag} and ${flagLabels.allowExpiredFlag} are not supported for remote (bundle@host) bundles yet. ` +
         `Drop the flag or resolve the bundle locally.`);
 }
+/**
+ * A declared `keychain:` ref resolved to NO value in the batch read. Classify
+ * genuinely-absent vs present-but-unreadable before choosing the error, so a
+ * read can never contradict what `agents secrets view` reports (RUSH-2248,
+ * RUSH-2253). `view`'s "stored" badge comes from `hasKeychainToken` — the exact
+ * existence probe used here — which counts a biometry-ACL'd or locked-keychain
+ * item (`errSecInteractionNotAllowed`) as present. So:
+ *
+ *   - present  ⇒ the item exists but this context could not read it (keychain
+ *     locked, or Touch ID not granted). Report HOW to unlock; NEVER
+ *     "add the key", whose remediation (`secrets add`) would overwrite a good
+ *     secret.
+ *   - absent   ⇒ genuinely not stored on this machine — the honest "not found"
+ *     with the `secrets add` remediation.
+ *   - probe throws ⇒ the keychain itself is unreachable (RUSH-2235 fail-loud):
+ *     neither absent nor add-the-key — surface the reachability failure verbatim.
+ *
+ * Only the keychain backend has a locked/biometry state; a file/vault miss is
+ * genuinely absent.
+ */
+function missingBundleKeychainItemError(bundleName, key, item, backendKind) {
+    if (backendKind === 'keychain') {
+        let present;
+        try {
+            present = hasKeychainToken(item);
+        }
+        catch (err) {
+            return new Error(`Bundle '${bundleName}' key '${key}': ${err.message}`);
+        }
+        if (present) {
+            return new Error(`Bundle '${bundleName}' key '${key}': stored item '${item}' is present but could not be read — ` +
+                `the keychain is locked or Touch ID was not granted for this read. ` +
+                `Run: agents secrets unlock ${bundleName}  (or read it once at an interactive terminal so Touch ID can be granted). ` +
+                `Do NOT run 'agents secrets add' — the secret is already stored and adding would overwrite it.`);
+        }
+    }
+    return new Error(`Bundle '${bundleName}' key '${key}': stored item '${item}' not found. ` +
+        `Run: agents secrets add ${bundleName} ${key}`);
+}
+/**
+ * Resolve every selected key of an already-read bundle into a flat env map,
+ * given a pre-fetched keychain batch. The single per-key resolution loop shared
+ * by `resolveBundleEnv` and `readAndResolveBundleEnv` so the keychain lookup and
+ * the missing-item classification can never diverge again (RUSH-2252: the two
+ * paths drifted — one did the hashed-alias fallback lookup and one did not, and
+ * only one classified a missing item honestly).
+ *
+ * The keychain lookup tries the cleartext name first (Linux / file store), then
+ * its hashed storage alias (macOS with #316 hashing active) — the batch keys its
+ * results by the names it was ASKED for, which for the metadata + declared keys
+ * is the cleartext form and for an enumerated leftover is the hashed form.
+ */
+function assembleBundleEnv(bundle, selectedKeys, parsedByKey, fetched, keyMode, backendKind) {
+    const env = {};
+    const owners = new Map();
+    for (const [key] of Object.entries(bundle.vars)) {
+        if (!selectedKeys.has(key))
+            continue;
+        const parsed = parsedByKey.get(key);
+        if ('literal' in parsed) {
+            assignResolvedEnvValue(env, bundle, key, parsed.literal, keyMode, owners);
+            continue;
+        }
+        if (parsed.ref.provider === 'keychain') {
+            const item = secretsKeychainItem(bundle.name, parsed.ref.value);
+            const value = fetched.get(item) ?? fetched.get(keychainServiceAlias(item));
+            if (value === undefined) {
+                throw missingBundleKeychainItemError(bundle.name, key, item, backendKind);
+            }
+            assignResolvedEnvValue(env, bundle, key, value, keyMode, owners);
+            continue;
+        }
+        try {
+            const value = resolveRef(parsed.ref, {
+                allowExec: bundle.allow_exec,
+                keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
+            });
+            assignResolvedEnvValue(env, bundle, key, value, keyMode, owners);
+        }
+        catch (err) {
+            throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
+        }
+    }
+    return env;
+}
 // Walk the bundle and produce a flat env map. Every keychain: ref is gathered
 // into a single batch read so macOS shows ONE Touch ID prompt for the whole
 // bundle — including the metadata fetch that already happened in readBundle
@@ -1093,37 +1186,7 @@ export function resolveBundleEnv(bundle, _opts = {}) {
             ? getKeychainTokens(keychainItemsToFetch, { silentNoAcl: bundlePolicy(bundle) === 'never' })
             : store.getBatch(keychainItemsToFetch)
         : new Map();
-    const env = {};
-    const owners = new Map();
-    for (const [key, raw] of Object.entries(bundle.vars)) {
-        if (!selectedKeys.has(key))
-            continue;
-        const parsed = parsedByKey.get(key);
-        if ('literal' in parsed) {
-            assignResolvedEnvValue(env, bundle, key, parsed.literal, _opts.keyMode, owners);
-            continue;
-        }
-        if (parsed.ref.provider === 'keychain') {
-            const item = secretsKeychainItem(bundle.name, parsed.ref.value);
-            const value = fetched.get(item);
-            if (value === undefined) {
-                throw new Error(`Bundle '${bundle.name}' key '${key}': stored item '${item}' not found. ` +
-                    `Run: agents secrets add ${bundle.name} ${key}`);
-            }
-            assignResolvedEnvValue(env, bundle, key, value, _opts.keyMode, owners);
-            continue;
-        }
-        try {
-            const value = resolveRef(parsed.ref, {
-                allowExec: bundle.allow_exec,
-                keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
-            });
-            assignResolvedEnvValue(env, bundle, key, value, _opts.keyMode, owners);
-        }
-        catch (err) {
-            throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
-        }
-    }
+    const env = assembleBundleEnv(bundle, selectedKeys, parsedByKey, fetched, _opts.keyMode, bundle.backend ?? 'keychain');
     // `caller` is intentionally unused; see ResolveBundleOptions.
     void _opts.caller;
     return env;
@@ -1265,13 +1328,6 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         : store.getBatch([...new Set([metaItem, ...secretItems])]);
     const json = fetched.get(metaItem);
     if (json === undefined) {
-        // For a file-backed bundle the metadata item is on disk (that's how
-        // bundleBackend resolved to 'file'); a missing decrypt means the wrong
-        // passphrase, not a missing bundle. getBatch swallowed the decrypt error,
-        // so distinguish here rather than report a misleading "not found".
-        if (backend === 'file' && fileStore.has(metaItem)) {
-            throw new Error(`Bundle '${name}': failed to decrypt — wrong AGENTS_SECRETS_PASSPHRASE or tampered file store.`);
-        }
         if (vaultExists() && !getVaultSession().loggedIn) {
             throw new Error(`Synced secrets are locked. Run: agents login`);
         }
@@ -1327,6 +1383,53 @@ export function readAndResolveBundleEnv(name, opts = {}) {
     }
     const keys = [...selectedKeys].sort();
     keychainKeys.sort();
+    // RUSH-2252: complete the read set from the bundle's DECLARED keys, not only
+    // from the enumeration above. `store.list()` derives the batch by enumerating
+    // the bundle's namespace, and that enumeration is lossy by construction — the
+    // macOS helper's `list` omits every biometry-ACL'd item
+    // (`kSecUseAuthenticationUISkip`) and skips the whole data-protection pass when
+    // the keychain is locked, so a `hold`-policy bundle's value items never appear
+    // and a present secret reads as "not found" (RUSH-2248). A declared key whose
+    // item did not enumerate is therefore absent from `fetched`; read those exact
+    // items directly — a point read DOES evaluate the ACL, so it triggers Touch ID
+    // and returns the value the enumeration could not see. The enumeration still
+    // earns its place (it catches hashed/aliased storage names and stale leftovers
+    // not named in the metadata), so this is a UNION, not a replacement.
+    //
+    // One Touch ID sheet is preserved: the items missing from `fetched` are exactly
+    // the ACL'd ones the enumeration dropped, so the first batch (metadata plus any
+    // no-ACL / `never` items) raised no sheet, and this second batch raises the
+    // single sheet that covers all of them. When the enumeration is healthy every
+    // declared item is already in `fetched`, `missingDeclared` is empty, and this
+    // is skipped entirely — zero behavior change and no extra spawn on the hot path.
+    if (backend === 'keychain') {
+        const missingDeclared = [];
+        for (const key of keychainKeys) {
+            const p = parsedByKey.get(key);
+            if (!('ref' in p) || p.ref.provider !== 'keychain')
+                continue;
+            const item = secretsKeychainItem(bundle.name, p.ref.value);
+            if (fetched.get(item) === undefined && fetched.get(keychainServiceAlias(item)) === undefined) {
+                missingDeclared.push(item);
+            }
+        }
+        if (missingDeclared.length > 0) {
+            const declaredFetched = getKeychainTokens([...new Set(missingDeclared)], {
+                agent: opts.agent || process.env.AGENTS_AGENT_NAME || 'Agents CLI',
+                bundle: name,
+                sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
+                reason: opts.caller ? `to ${opts.caller}` : reason,
+                duration: opts.duration || humanUnlockDuration(secretsHoldMs()),
+                // The policy is known now (metadata parsed), so the prompt names the real
+                // duration instead of the pre-read default the first batch had to guess.
+                defaultPolicy: bundlePolicy(bundle),
+                forceDuration: Boolean(opts.duration),
+                silentNoAcl: verifiedNoAclBundle,
+            });
+            for (const [k, v] of declaredFetched)
+                fetched.set(k, v);
+        }
+    }
     const emitReadAudit = (status, err) => {
         emitSecretAudit({
             event: 'secrets.get',
@@ -1342,40 +1445,10 @@ export function readAndResolveBundleEnv(name, opts = {}) {
         });
     };
     try {
-        const env = {};
-        const owners = new Map();
-        for (const [key] of Object.entries(bundle.vars)) {
-            if (!selectedKeys.has(key))
-                continue;
-            const p = parsedByKey.get(key);
-            if ('literal' in p) {
-                assignResolvedEnvValue(env, bundle, key, p.literal, opts.keyMode, owners);
-                continue;
-            }
-            if (p.ref.provider === 'keychain') {
-                const item = secretsKeychainItem(bundle.name, p.ref.value);
-                // The batch keys results by the names it was ASKED for: the cleartext
-                // metaItem, plus enumerated storage names. Look up the cleartext name
-                // first (Linux / file store), then its hashed storage alias (macOS).
-                const value = fetched.get(item) ?? fetched.get(keychainServiceAlias(item));
-                if (value === undefined) {
-                    throw new Error(`Bundle '${bundle.name}' key '${key}': stored item '${item}' not found. ` +
-                        `Run: agents secrets add ${bundle.name} ${key}`);
-                }
-                assignResolvedEnvValue(env, bundle, key, value, opts.keyMode, owners);
-                continue;
-            }
-            try {
-                const value = resolveRef(p.ref, {
-                    allowExec: bundle.allow_exec,
-                    keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
-                });
-                assignResolvedEnvValue(env, bundle, key, value, opts.keyMode, owners);
-            }
-            catch (err) {
-                throw new Error(`Bundle '${bundle.name}' key '${key}': ${err.message}`);
-            }
-        }
+        // Shared per-key resolver: same keychain lookup (cleartext name, then hashed
+        // storage alias) and same missing-item classification as resolveBundleEnv, so
+        // the two paths can never diverge again (RUSH-2252, RUSH-2253).
+        const env = assembleBundleEnv(bundle, selectedKeys, parsedByKey, fetched, opts.keyMode, backend);
         emitReadAudit('success');
         // Auto-cache: this was a real keychain read (the agent fast-path returned
         // earlier on a hit). If the bundle opts into the `daily` policy and the user

package/dist/lib/secrets/filestore.d.ts

@@ -29,9 +29,11 @@ export declare function machinePassphraseExists(): boolean;
  * Resolve the passphrase for the encrypted file store.
  *
  * Order: AGENTS_SECRETS_PASSPHRASE > previously-provisioned machine-local key >
- * a freshly auto-provisioned machine-local key. It NEVER prompts and NEVER
- * hard-fails — the file store must work on every platform (macOS included)
- * without the user setting, typing, or remembering a passphrase. Provisioning
+ * legacy co-located key > a freshly auto-provisioned machine-local key. It NEVER
+ * prompts, and never fails for WANT of a passphrase — the file store must work on
+ * every platform (macOS included) without the user setting, typing, or
+ * remembering one. (It can still throw if provisioning cannot write the key file
+ * at all; that is a disk/permissions failure, not a missing passphrase.) Provisioning
  * writes a 0600 key file (encryption-at-rest, same posture as an SSH key); set
  * AGENTS_SECRETS_PASSPHRASE to opt into an off-disk key.
  */
@@ -51,6 +53,7 @@ export declare function encryptForFallback(plaintext: string, passphrase: string
 export declare function decryptForFallback(enc: EncFile, passphrase: string): string;
 declare function fileHas(item: string): boolean;
 declare function fileGet(item: string): string;
+declare function fileGetBatch(items: string[]): Map<string, string>;
 declare function fileSet(item: string, value: string): void;
 declare function fileDelete(item: string): boolean;
 declare function fileList(prefix: string): string[];
@@ -61,6 +64,7 @@ export declare function fileStoreHasItems(): boolean;
 export declare const fileStore: {
     has: typeof fileHas;
     get: typeof fileGet;
+    getBatch: typeof fileGetBatch;
     set: typeof fileSet;
     delete: typeof fileDelete;
     list: typeof fileList;

package/dist/lib/secrets/filestore.js

@@ -110,11 +110,13 @@ function readMachinePassphrase() {
  * the keyring is locked and no AGENTS_SECRETS_PASSPHRASE is set.
  *
  * Security model: this is encryption-at-rest with the key held in a 0600 file —
- * the same posture as an SSH private key, and identical to the common
- * "export AGENTS_SECRETS_PASSPHRASE=… in ~/.zshenv (chmod 600)" workaround. The
- * keyring (key in a daemon's locked memory) is stronger but is unavailable
- * without a graphical/unlocked session. For an off-disk key, set
- * AGENTS_SECRETS_PASSPHRASE (it always takes precedence) or unlock the keyring.
+ * the same posture as an SSH private key. It is NOT equivalent to the common
+ * "export AGENTS_SECRETS_PASSPHRASE=… in ~/.zshenv (chmod 600)" workaround, and
+ * is strictly safer: this file is read by the one process that needs it, while
+ * a shell-rc export is inherited by every process the login shell spawns and is
+ * readable from /proc/<pid>/environ by any same-user process (RUSH-1968; see
+ * rc-hygiene.ts). The keyring (key in a daemon's locked memory) is stronger
+ * still but is unavailable without a graphical/unlocked session.
  */
 function provisionMachinePassphrase() {
     const existing = readMachinePassphrase();
@@ -145,9 +147,11 @@ function provisionMachinePassphrase() {
  * Resolve the passphrase for the encrypted file store.
  *
  * Order: AGENTS_SECRETS_PASSPHRASE > previously-provisioned machine-local key >
- * a freshly auto-provisioned machine-local key. It NEVER prompts and NEVER
- * hard-fails — the file store must work on every platform (macOS included)
- * without the user setting, typing, or remembering a passphrase. Provisioning
+ * legacy co-located key > a freshly auto-provisioned machine-local key. It NEVER
+ * prompts, and never fails for WANT of a passphrase — the file store must work on
+ * every platform (macOS included) without the user setting, typing, or
+ * remembering one. (It can still throw if provisioning cannot write the key file
+ * at all; that is a disk/permissions failure, not a missing passphrase.) Provisioning
  * writes a 0600 key file (encryption-at-rest, same posture as an SSH key); set
  * AGENTS_SECRETS_PASSPHRASE to opt into an off-disk key.
  */
@@ -233,6 +237,18 @@ function fileGet(item) {
         throw new Error(`Failed to decrypt '${item}'. Wrong AGENTS_SECRETS_PASSPHRASE or tampered file.`);
     }
 }
+function fileGetBatch(items) {
+    const out = new Map();
+    for (const item of items) {
+        // A missing file is an absent item. Any error reading an existing file,
+        // especially an AES-GCM authentication failure, is a broken store and must
+        // stop the caller rather than silently produce an incomplete environment.
+        if (!fileHas(item))
+            continue;
+        out.set(item, fileGet(item));
+    }
+    return out;
+}
 function fileSet(item, value) {
     ensureFileDir();
     // Under the store lock: a write must not interleave with a rotation's swap.
@@ -279,6 +295,7 @@ export function fileStoreHasItems() {
 export const fileStore = {
     has: fileHas,
     get: fileGet,
+    getBatch: fileGetBatch,
     set: fileSet,
     delete: fileDelete,
     list: fileList,

package/dist/lib/secrets/index.js

@@ -781,9 +781,23 @@ export function hasKeychainToken(item) {
         }, KEYCHAIN_SILENT_TIMEOUT_MS).status === 0;
     }
     const bin = getKeychainHelperPath();
-    return spawnKeychainHelper(bin, ['has', item, os.userInfo().username], {
+    const r = spawnKeychainHelper(bin, ['has', item, os.userInfo().username], {
         stdio: ['ignore', 'pipe', 'pipe'],
-    }, KEYCHAIN_SILENT_TIMEOUT_MS).status === 0;
+    }, KEYCHAIN_SILENT_TIMEOUT_MS);
+    // The helper exits 0 = present (incl. errSecInteractionNotAllowed — a locked or
+    // biometry-ACL'd item still EXISTS), 1 = genuinely absent. Any other outcome
+    // (bad args, helper failure, spawn error) means the keychain could not be
+    // reached — and a false "absent" silently disarms every destructive-write guard
+    // that calls this (see the docblock), so it MUST fail loud rather than answer
+    // "no" (RUSH-2235). Timeouts already throw inside spawnKeychainHelper.
+    if (r.status === 0)
+        return true;
+    if (r.status === 1)
+        return false;
+    const stderr = r.stderr?.toString().trim();
+    throw new Error(stderr ||
+        `keychain existence check for '${item}' failed (helper exit ${r.status ?? 'null'}` +
+            `${r.error ? `: ${r.error.message}` : ''}) — keychain unreachable, not a proven absence.`);
 }
 /**
  * The detector the raw-read storm guard consults, overridable so tests on any
@@ -1175,14 +1189,26 @@ export function deleteKeychainToken(item) {
     if (isWindows())
         return windowsBackend.delete(item);
     const bin = getKeychainHelperPath();
-    const deleted = spawnKeychainHelper(bin, ['delete', item, os.userInfo().username], {
+    const r = spawnKeychainHelper(bin, ['delete', item, os.userInfo().username], {
         stdio: ['ignore', 'pipe', 'pipe'],
-    }, KEYCHAIN_SILENT_TIMEOUT_MS).status === 0;
-    // A deleted item must fail its next read as plain "not found", not with a
-    // stale back-off error left over from a pre-delete cancel.
-    if (deleted)
+    }, KEYCHAIN_SILENT_TIMEOUT_MS);
+    // The helper exits 0 = an item was removed from at least one keychain, 1 =
+    // nothing to delete (genuinely absent). Any other outcome means the keychain
+    // could not be reached; like hasKeychainToken this must fail loud rather than
+    // report a false "nothing was there" (RUSH-2235) — a swallowed failure lets a
+    // rename/purge believe it cleared a name it did not.
+    if (r.status === 0) {
+        // A deleted item must fail its next read as plain "not found", not with a
+        // stale back-off error left over from a pre-delete cancel.
         clearKeychainReadBackoff(requested);
-    return deleted;
+        return true;
+    }
+    if (r.status === 1)
+        return false;
+    const stderr = r.stderr?.toString().trim();
+    throw new Error(stderr ||
+        `keychain delete for '${item}' failed (helper exit ${r.status ?? 'null'}` +
+            `${r.error ? `: ${r.error.message}` : ''}) — keychain unreachable, deletion unproven.`);
 }
 /**
  * True when the active keychain backend transparently routes reads/writes to

package/dist/lib/secrets/rc-hygiene.d.ts

@@ -32,6 +32,20 @@ export interface RcSecretFinding {
     /** The file-store master passphrase gets called out separately — it is the highest-severity case. */
     isMasterPassphrase: boolean;
 }
+/** The file-store master key. Its own resolution prefers an off-env 0600 file, so
+ *  a shell-rc export is always wrong once the store exists (RUSH-1968). */
+export declare const MASTER_PASSPHRASE = "AGENTS_SECRETS_PASSPHRASE";
+/**
+ * True when the file-store master key is live in THIS process's environment.
+ *
+ * The scanner above reads FILES, and that leaves a hole: a value inherited by a
+ * long-lived process outlives the rc line that set it, so deleting the export
+ * makes `scanRcExports` report clean while every shell, editor and agent started
+ * beforehand still carries the key and passes it to everything it spawns.
+ * Returns a boolean — never the value — so a finding built from it can be
+ * printed, logged, or shipped without leaking the secret.
+ */
+export declare function masterPassphraseInEnv(): boolean;
 /** True if a variable name looks like it holds a credential value. */
 export declare function isCredentialName(name: string): boolean;
 /**

package/dist/lib/secrets/rc-hygiene.js

@@ -33,7 +33,20 @@ export const RC_FILENAMES = [
 ];
 /** The file-store master key. Its own resolution prefers an off-env 0600 file, so
  *  a shell-rc export is always wrong once the store exists (RUSH-1968). */
-const MASTER_PASSPHRASE = 'AGENTS_SECRETS_PASSPHRASE';
+export const MASTER_PASSPHRASE = 'AGENTS_SECRETS_PASSPHRASE';
+/**
+ * True when the file-store master key is live in THIS process's environment.
+ *
+ * The scanner above reads FILES, and that leaves a hole: a value inherited by a
+ * long-lived process outlives the rc line that set it, so deleting the export
+ * makes `scanRcExports` report clean while every shell, editor and agent started
+ * beforehand still carries the key and passes it to everything it spawns.
+ * Returns a boolean — never the value — so a finding built from it can be
+ * printed, logged, or shipped without leaking the secret.
+ */
+export function masterPassphraseInEnv() {
+    return (process.env[MASTER_PASSPHRASE] ?? '').length > 0;
+}
 /**
  * Last `_`-delimited segment values that mark a variable as credential-shaped.
  * Matched against the FINAL segment (segment equality, not substring) so

package/dist/lib/secrets/reaper.d.ts

@@ -68,6 +68,16 @@ export interface ReapPlan {
  * not match the helper, or whose parent is no longer in the snapshot.
  */
 export declare function planKeychainReap(snapshots: KeychainProcessSnapshot[], now: number, prevCandidates: ReadonlyMap<number, StuckParentCandidate>): ReapPlan;
+/**
+ * Parse macOS `ps -o etime=` elapsed time into whole seconds.
+ *
+ * BSD `etime` renders as `[[dd-]hh:]mm:ss` (e.g. `05:03`, `01:02:03`,
+ * `14-04:10:52`). This is the portable keyword: `etimes` (raw seconds) is a
+ * GNU/Linux procps extension that macOS `ps` rejects with a non-zero exit, so
+ * the reaper — which only ever runs on darwin — must read `etime`.
+ * Returns null for an unparseable value so the caller drops the row.
+ */
+export declare function parseEtimeToSeconds(raw: string): number | null;
 /** Test seam: reset the persisted candidate state. */
 export declare function resetKeychainReaperCandidatesForTest(): void;
 /**