@phnx-labs/agents-cli 1.22.25 → 1.22.26

package/dist/lib/browser/stream.js

@@ -0,0 +1,71 @@
+import { createInterface } from 'readline';
+import { connectBrowserIPC } from './ipc.js';
+import { assertRemoteControlAllowed } from './remote-control.js';
+function parseRequest(line) {
+    const parsed = JSON.parse(line);
+    if (!parsed ||
+        typeof parsed !== 'object' ||
+        Array.isArray(parsed) ||
+        typeof parsed.action !== 'string') {
+        throw new Error('Each input line must be a JSON object with an action');
+    }
+    return parsed;
+}
+function writeResponse(output, response) {
+    output.write(`${JSON.stringify(response)}\n`);
+}
+function writeErrorResponse(output, error) {
+    writeResponse(output, {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+    });
+}
+/**
+ * Read browser IPC requests as NDJSON and write one NDJSON response per line.
+ * The Node process and daemon connection stay alive until input closes.
+ */
+export async function runBrowserIPCStream(options) {
+    const client = await connectBrowserIPC({ autoStartDaemon: options.autoStartDaemon });
+    const lines = createInterface({ input: options.input, crlfDelay: Infinity });
+    let defaultTask = options.task;
+    try {
+        for await (const line of lines) {
+            if (!line.trim())
+                continue;
+            let request;
+            try {
+                request = parseRequest(line);
+            }
+            catch (error) {
+                writeErrorResponse(options.output, error);
+                continue;
+            }
+            if (request.action === 'start') {
+                try {
+                    assertRemoteControlAllowed();
+                }
+                catch (error) {
+                    writeErrorResponse(options.output, error);
+                    continue;
+                }
+                request = {
+                    ...request,
+                    taskName: request.taskName ?? defaultTask,
+                    actor: request.actor ?? options.actor,
+                    launchId: request.launchId ?? options.launchId,
+                };
+            }
+            else if (!request.task && defaultTask) {
+                request = { ...request, task: defaultTask };
+            }
+            const response = await client.request(request);
+            if (response.task)
+                defaultTask = response.task;
+            writeResponse(options.output, response);
+        }
+    }
+    finally {
+        lines.close();
+        await client.close();
+    }
+}

package/dist/lib/channels/owner-sink.d.ts

@@ -0,0 +1,27 @@
+import type { Meta } from '../types.js';
+/** Why the owner sink cannot deliver from this box. */
+export type OwnerSinkReason = 'rush-not-on-path' | 'rush-signed-out';
+export interface OwnerSinkStatus {
+    /** Owner delivery is configured for this fleet (humans.yaml / notify.owner).
+     *  When false, no finding is emitted — an un-opted-in box is not "broken". */
+    configured: boolean;
+    /** This box can actually deliver an owner notification right now. */
+    reachable: boolean;
+    /** Resolved owner channel (e.g. `imessage`). */
+    channel?: string;
+    /** Resolved transport after `notify.transports` mapping (usually === channel). */
+    transport?: string;
+    /** Set only when `reachable` is false. */
+    reason?: OwnerSinkReason;
+}
+/**
+ * Probe whether THIS box can deliver an owner notification right now. Returns
+ * `configured:false` (and the caller emits no finding) when the fleet has no
+ * owner channel configured — an un-opted-in box is not broken. When configured,
+ * reports whether the resolved transport can actually deliver from here.
+ *
+ * Only the concrete rush-backed failure the lane hits is reported as unreachable;
+ * non-rush transports (desktop / mailbox / …) deliver locally and are treated as
+ * reachable rather than probed, so this never invents a critical it cannot back.
+ */
+export declare function probeOwnerSink(meta: Meta): Promise<OwnerSinkStatus>;

package/dist/lib/channels/owner-sink.js

@@ -0,0 +1,93 @@
+/**
+ * Owner-delivery-sink reachability probe (RUSH-2262).
+ *
+ * The feed/notify owner-delivery lane (`agents notify`, `agents feed post
+ * --level important` / `--blocked`) reaches the owner over the rush-backed owner
+ * channel (iMessage via `rush message send`). That transport can only deliver
+ * from a context that BOTH finds the `rush` CLI on PATH and can read its
+ * keychain-bound session. So a headless Linux fleet box (no rush) or a non-GUI
+ * SSH session on a mac (login keychain locked) structurally cannot escalate —
+ * and the failure is silent until a block is filed, surfacing only as the
+ * after-the-fact `owner failed: …` line. `agents doctor` had no signal for it,
+ * which is exactly the gap RUSH-2258 / RUSH-2262 flagged.
+ *
+ * This probes the SAME transport the lane uses, from the SAME context doctor runs
+ * in, so `agents doctor` can fail loud when this box cannot reach the owner. It is
+ * deliberately honest about context: `rush whoami` is what tells a real signed-in
+ * session apart from a keychain that is present but unreadable HERE. The session
+ * token is a keychain item, NOT `~/.rush/user.yaml` (RUSH-2262), so this never
+ * reads that file — checking it is the mistake that made a signed-in box look
+ * signed out.
+ *
+ * `agents notify --dry-run` is NOT this probe: it short-circuits before the
+ * `which rush` preflight (`providers/rush.ts`), so it reports `ok:true` on a box
+ * with no rush at all. Resolvability (does the envelope build?) and reachability
+ * (can this box actually deliver?) are different questions; this answers the
+ * second.
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { readOwnerDest } from './send.js';
+import { RUSH_CHANNELS } from './providers/rush.js';
+const execFileAsync = promisify(execFile);
+async function rushOnPath() {
+    try {
+        await execFileAsync('which', ['rush'], { timeout: 4000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Signed-in state from `rush whoami`, read with THIS context's keychain access.
+ *  'unknown' (a timeout or output we can't classify) is treated as reachable by
+ *  the caller — a slow or unexpected probe must not cry wolf and paint a false
+ *  critical. Only a definitive "not logged in" is reported as signed out. */
+async function rushSignedIn() {
+    const classify = (s) => {
+        const out = s.toLowerCase();
+        if (/not (logged in|signed in)/.test(out))
+            return 'no';
+        if (/logged in as|session:\s*valid/.test(out))
+            return 'yes';
+        return 'unknown';
+    };
+    try {
+        const { stdout, stderr } = await execFileAsync('rush', ['whoami'], { timeout: 5000 });
+        return classify(`${stdout}\n${stderr}`);
+    }
+    catch (err) {
+        const e = err;
+        if (e.killed)
+            return 'unknown'; // timed out — do not conclude signed-out
+        // A signed-out rush commonly exits non-zero; trust an explicit message only.
+        return classify(`${e.stdout ?? ''}\n${e.stderr ?? ''}`);
+    }
+}
+/**
+ * Probe whether THIS box can deliver an owner notification right now. Returns
+ * `configured:false` (and the caller emits no finding) when the fleet has no
+ * owner channel configured — an un-opted-in box is not broken. When configured,
+ * reports whether the resolved transport can actually deliver from here.
+ *
+ * Only the concrete rush-backed failure the lane hits is reported as unreachable;
+ * non-rush transports (desktop / mailbox / …) deliver locally and are treated as
+ * reachable rather than probed, so this never invents a critical it cannot back.
+ */
+export async function probeOwnerSink(meta) {
+    const dest = readOwnerDest(meta);
+    if (!dest)
+        return { configured: false, reachable: false };
+    const channel = dest.channel;
+    const transport = meta.notify?.transports?.[channel] ?? channel;
+    if (RUSH_CHANNELS.includes(transport)) {
+        if (!(await rushOnPath())) {
+            return { configured: true, reachable: false, channel, transport, reason: 'rush-not-on-path' };
+        }
+        if ((await rushSignedIn()) === 'no') {
+            return { configured: true, reachable: false, channel, transport, reason: 'rush-signed-out' };
+        }
+        return { configured: true, reachable: true, channel, transport };
+    }
+    return { configured: true, reachable: true, channel, transport };
+}

package/dist/lib/devices/doctor-findings.d.ts

@@ -1,6 +1,7 @@
 import type { AgentId } from '../types.js';
 import type { DuplicateVersionHook } from '../hooks.js';
 import type { RcSecretFinding } from '../secrets/rc-hygiene.js';
+import type { OwnerSinkStatus } from '../channels/owner-sink.js';
 import type { SyncStatusRow, OrphanRow } from '../drift.js';
 import type { FetchStatusMarker } from '../auto-pull.js';
 import type { VersionResourceReport } from '../doctor-diff.js';
@@ -10,7 +11,7 @@ export type FindingSeverity = 'critical' | 'warning';
  *  the JSON consumer group by kind. */
 /** Every finding class. Severity is NOT annotated here — {@link FINDING_SEVERITY}
  *  below owns it, and a second copy in these comments is a fourth place to drift. */
-export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli"];
+export declare const ALL_FINDING_KINDS: readonly ["logged-out", "logout-unprovable", "missing-hook", "missing-plugin", "unwired-hook", "cli-missing", "missing-resource", "content-drift", "never-synced", "stale", "repo-behind", "repo-drift", "fleet-resource-gap", "host-cli-missing", "host-cli-invalid", "version-skew", "orphan", "duplicate-hook", "duplicate-hook-drift", "rc-secret-export", "env-secret-export", "exec-policy", "stale-cli", "owner-sink-unreachable"];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
  * the builders below and asserted against both prose rubrics by
@@ -106,6 +107,11 @@ export interface LocalFindingInputs {
      *  sweep deliberately skips isolated copies, so a collapsed row would print a
      *  remediation that does not fix them. */
     isolatedVersions?: string[];
+    /** Whether the feed/notify owner-delivery lane can reach the owner from this box
+     *  (RUSH-2262). Collected by `probeOwnerSink` in the command (it spawns the real
+     *  `rush` transport, so it stays out of this pure module). Absent → no probe ran
+     *  → no finding. */
+    ownerSink?: OwnerSinkStatus;
 }
 /**
  * Fold this machine's signals into findings. Missing hooks/plugins and unwired

package/dist/lib/devices/doctor-findings.js

@@ -18,7 +18,8 @@
  * with. Keep this list exhaustive; a kind missing from it is a doc that lies.
  *   CRITICAL — logged-out (provable) · missing-hook · missing-plugin ·
  *              unwired-hook (a hook on disk that settings.json never fires) ·
- *              cli-missing.
+ *              cli-missing · owner-sink-unreachable (the feed/notify owner lane
+ *              cannot reach the owner from this box).
  *   WARNING  — logout-unprovable (hedged) · missing-resource · content-drift ·
  *              never-synced · stale · repo-behind · repo-drift · version-skew ·
  *              fleet-resource-gap · orphan · duplicate-hook ·
@@ -97,6 +98,7 @@ export const ALL_FINDING_KINDS = [
     'env-secret-export', // the file-store master key live in THIS process's env
     'exec-policy', // Windows execution policy blocks agents.ps1
     'stale-cli',
+    'owner-sink-unreachable', // the feed/notify owner-delivery lane can't reach the owner from this box
 ];
 /**
  * The severity each kind is emitted with - the SINGLE source of truth, read by
@@ -116,6 +118,9 @@ export const FINDING_SEVERITY = {
     'missing-plugin': 'critical',
     'unwired-hook': 'critical',
     'cli-missing': 'critical',
+    // A factory that cannot escalate a blocked agent to the owner is not healthy,
+    // and the failure is otherwise silent until a block is filed (RUSH-2262/2258).
+    'owner-sink-unreachable': 'critical',
     // Everything else is resolvable by a routine sync/cleanup and does not block
     // the harness right now. RUSH-2162 moved never-synced and duplicate-hook-drift
     // here: both are stale-sync states that one `agents sync` resolves.
@@ -251,6 +256,13 @@ export function remediationFor(finding) {
             return 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned';
         case 'stale-cli':
             return 'upgrade';
+        case 'owner-sink-unreachable':
+            // The lane delivers over the rush-backed owner channel, which needs rush on
+            // PATH AND a usable session in THIS context. Non-interactive shells miss a
+            // ~/.zshrc export (RUSH-2258), and the session is keychain-bound, not in
+            // ~/.rush/user.yaml (RUSH-2262) — so `rush login` here, or the Rush App for
+            // a GUI keychain, is what makes it reachable.
+            return "put rush on PATH for non-interactive shells (~/.zshenv) and run 'rush login'";
     }
 }
 function finding(f) {
@@ -293,6 +305,22 @@ export function buildLocalFindings(input) {
             message: `${agentName(agent)} binary not found`,
         }));
     }
+    // owner-sink-unreachable — the feed/notify owner-delivery lane can't reach the
+    // owner from this box (RUSH-2262). Only when owner delivery is CONFIGURED for the
+    // fleet; an un-opted-in box is not broken. The message names the concrete reason.
+    const sink = input.ownerSink;
+    if (sink?.configured && !sink.reachable) {
+        const chan = sink.channel ?? 'owner';
+        const why = sink.reason === 'rush-not-on-path'
+            ? `rush CLI not on this box's PATH`
+            : sink.reason === 'rush-signed-out'
+                ? 'rush has no usable session here'
+                : 'transport unreachable';
+        out.push(finding({
+            severity: FINDING_SEVERITY['owner-sink-unreachable'], kind: 'owner-sink-unreachable', device,
+            message: `${chan} → owner unreachable: ${why}`,
+        }));
+    }
     // Per-version resource reports → missing hook/plugin (critical), unwired hook
     // (critical), other missing kinds (warning), content drift (warning).
     for (const report of input.reports) {
@@ -782,6 +810,10 @@ function subjectLabel(f) {
     return f.version ? `${f.agent} @${f.version}` : f.agent;
 }
 function critLabel(f) {
+    // Machine-level criticals with no agent get a category subject so the left
+    // column is not blank; the owner-sink row reads `owner  …`, not an empty label.
+    if (f.kind === 'owner-sink-unreachable')
+        return { left: 'owner', account: '', message: f.message };
     return {
         left: subjectLabel(f),
         account: f.account ?? '',

package/dist/lib/fleet/apply.d.ts

@@ -8,6 +8,7 @@
  * (`readyProbe`, `bootstrapAgentsCli`, `buildRemoteAgentsInvocation`, `sshExec`).
  */
 import type { DeviceProfile } from '../devices/registry.js';
+import { type RemoteBackend } from '../secrets/push.js';
 import type { DeviceDesired, DeviceProbe, DeviceDiff, FleetAction, FleetPlan, AuthFilePayload } from './types.js';
 /** Strip a version suffix from an agent spec: `claude@latest` -> `claude`. */
 export declare function agentIdOf(spec: string): string;
@@ -54,21 +55,76 @@ export interface DiffContext {
     /** agents-cli version the source is on — the fleet target version. */
     targetCliVersion: string;
     sourceAuth: SourceAuth;
-    /** Secrets-bundle names the profile declares. Values are keychain-local and
-     * can't be pushed, so each reachable device surfaces them as a manual recreate
-     * (`needs-secret`) — informational, never an executed mutation. */
+    /** Secrets-bundle names the profile declares. */
     secretsBundles?: string[];
+    /** `--provision-secrets`. OFF by default: pushing a bundle moves credential
+     *  VALUES to another machine, so it is opted into per invocation and never
+     *  defaulted from the shared `agents.yaml` (RUSH-1968). */
+    provisionSecrets?: boolean;
+    /** Is this device's host key pinned? Injected so `decideSecretPush` stays pure
+     *  and its refusals are testable against real known_hosts fixtures with no
+     *  network. Absent = treated as unpinned, i.e. refuse. */
+    isHostPinned?: (device: string) => boolean;
+    /** `--force`: push a declared bundle even when the device already has it. */
+    forceSecrets?: boolean;
 }
 /** Pure: desired vs probed -> per-device diff + flat action list. */
 export declare function diffFleet(desired: DeviceDesired[], probes: Map<string, DeviceProbe>, ctx: DiffContext): FleetPlan;
+/** Why a declared bundle is or is not pushed to one device. */
+export interface SecretPushDecision {
+    push: boolean;
+    /** Where it would land on the remote. Only meaningful when `push`. */
+    backend: RemoteBackend;
+    /** Set when `push` is false — rendered as the `needs-secret` reminder. */
+    reason: string;
+}
+/**
+ * Decide whether `fleet apply` may push one declared bundle to one device.
+ *
+ * PURE — no ssh, no keychain, no filesystem beyond the injectable pin check — so
+ * every branch is unit-testable with no live fleet. Three gates, in order, and
+ * each REFUSAL still yields a `needs-secret` reminder rather than silence:
+ *
+ *   1. `--provision-secrets` must be set. Off by default, and deliberately a
+ *      flag rather than an `agents.yaml` field: the manifest is shared, so a
+ *      file-level default means someone else's `apply -y` ships credential
+ *      values without deciding to (RUSH-1968's shape of accident).
+ *   2. The device must be reachable — nothing to push to otherwise.
+ *   3. The host key must be PINNED. This moves credential values to another
+ *      machine, so it reuses the same bar `agents exec --copy-creds` already
+ *      sets (EXEC-34): an unpinned device earns its pin through a normal
+ *      `agents ssh <device>` first.
+ *
+ * Backend follows the platform, and this is the load-bearing default of the
+ * whole feature: **file on Linux, keychain on macOS/Windows**. A headless Linux
+ * box has no keychain (`lib/secrets/linux.ts`), and the file store there
+ * auto-provisions its OWN machine-local key — so each box ends up with an
+ * unshared at-rest key and NO passphrase is forwarded. That is the direct
+ * alternative to the fleet-wide shared secret this ticket exists to remove.
+ */
+export declare function decideSecretPush(bundle: string, desired: DeviceDesired, probe: DeviceProbe, ctx: DiffContext): SecretPushDecision;
 export interface ProbeOptions {
     /** Also fetch per-agent installed versions (one extra `agents view --json`
      * round-trip). Enable only when the plan has a version-pinned spec. */
     withVersions?: boolean;
+    /** Also fetch which secrets bundles the device already has (one extra
+     *  `agents secrets list --json`). Enable only when the manifest declares
+     *  bundles and provisioning is on — same cost discipline as `withVersions`. */
+    withSecrets?: boolean;
 }
 /** Probe one device: reachability + agents-cli version + installed agent ids
  * (and, when `withVersions`, the installed version strings per agent). */
 export declare function probeDevice(device: DeviceProfile, opts?: ProbeOptions): DeviceProbe;
+/**
+ * Narrow a remote `secrets list --json` payload to `name -> updated_at`.
+ *
+ * Exported and pure so the parse is unit-tested against real payload shapes with
+ * no live fleet. Returns `{}` rather than throwing on anything unexpected: the
+ * remote runs its own agents-cli version, and a parse failure must degrade to
+ * "unknown, so push" — never to "present, so skip", which would silently leave a
+ * device unprovisioned.
+ */
+export declare function parseRemoteBundles(stdout: string): Record<string, string>;
 export interface ApplyStep {
     kind: FleetAction['kind'];
     ok: boolean;

package/dist/lib/fleet/apply.js

@@ -8,6 +8,7 @@
  * (`readyProbe`, `bootstrapAgentsCli`, `buildRemoteAgentsInvocation`, `sshExec`).
  */
 import * as os from 'os';
+import { pushBundleToHost } from '../secrets/push.js';
 import { sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
@@ -167,14 +168,33 @@ export function diffFleet(desired, probes, ctx) {
                     }
                 }
             }
-            // secrets — surfaced, never pushed (values are keychain-local). Declared
-            // once at the manifest level, so every reachable device gets the same
-            // manual-recreate reminder. Not an executable action (see idempotence
-            // check in commands/apply.ts, which excludes needs-* kinds).
+            // secrets. Declared once at the manifest level, so every reachable device
+            // is considered. Historically this was ALWAYS a manual reminder — "surfaced,
+            // never pushed" — and that gap is a direct cause of RUSH-1968: an operator
+            // who needed secrets on a worker box had no supported path, so they
+            // hand-exported the file store's master key across the fleet instead.
+            //
+            // It is now pushable, but only deliberately. `--provision-secrets` is off by
+            // default and is a FLAG, not a manifest field: `agents.yaml` is shared, and
+            // a file-level default would mean someone else's `apply -y` silently ships
+            // credential values — the same shape of accident this ticket is about.
+            // Everything the gate refuses stays a `needs-secret` reminder, so nothing
+            // is ever silently skipped.
             if (ctx.secretsBundles && ctx.secretsBundles.length > 0) {
                 for (const bundle of ctx.secretsBundles) {
-                    secretsNeeded.push(bundle);
-                    rowActions.push({ device: d.device, kind: 'needs-secret', detail: `recreate secrets bundle '${bundle}' (\`agents secrets create ${bundle}\`)` });
+                    const decision = decideSecretPush(bundle, d, probe, ctx);
+                    if (decision.push) {
+                        rowActions.push({
+                            device: d.device,
+                            kind: 'push-secret',
+                            bundle,
+                            detail: `push secrets bundle '${bundle}' (${decision.backend} backend)`,
+                        });
+                    }
+                    else {
+                        secretsNeeded.push(bundle);
+                        rowActions.push({ device: d.device, kind: 'needs-secret', bundle, detail: decision.reason });
+                    }
                 }
             }
         }
@@ -183,6 +203,66 @@ export function diffFleet(desired, probes, ctx) {
     }
     return { devices, actions };
 }
+/**
+ * Decide whether `fleet apply` may push one declared bundle to one device.
+ *
+ * PURE — no ssh, no keychain, no filesystem beyond the injectable pin check — so
+ * every branch is unit-testable with no live fleet. Three gates, in order, and
+ * each REFUSAL still yields a `needs-secret` reminder rather than silence:
+ *
+ *   1. `--provision-secrets` must be set. Off by default, and deliberately a
+ *      flag rather than an `agents.yaml` field: the manifest is shared, so a
+ *      file-level default means someone else's `apply -y` ships credential
+ *      values without deciding to (RUSH-1968's shape of accident).
+ *   2. The device must be reachable — nothing to push to otherwise.
+ *   3. The host key must be PINNED. This moves credential values to another
+ *      machine, so it reuses the same bar `agents exec --copy-creds` already
+ *      sets (EXEC-34): an unpinned device earns its pin through a normal
+ *      `agents ssh <device>` first.
+ *
+ * Backend follows the platform, and this is the load-bearing default of the
+ * whole feature: **file on Linux, keychain on macOS/Windows**. A headless Linux
+ * box has no keychain (`lib/secrets/linux.ts`), and the file store there
+ * auto-provisions its OWN machine-local key — so each box ends up with an
+ * unshared at-rest key and NO passphrase is forwarded. That is the direct
+ * alternative to the fleet-wide shared secret this ticket exists to remove.
+ */
+export function decideSecretPush(bundle, desired, probe, ctx) {
+    const device = desired.device;
+    const backend = probe.platform === 'linux' ? 'file' : 'keychain';
+    const manual = `recreate secrets bundle '${bundle}' (\`agents ssh ${device} -- secrets create ${bundle}\`)`;
+    if (!ctx.provisionSecrets) {
+        return { push: false, backend, reason: `${manual} — or re-run with --provision-secrets to push it` };
+    }
+    if (!probe.reachable) {
+        return { push: false, backend, reason: manual };
+    }
+    // Already there? Skip — otherwise every `apply` re-resolves the bundle, and a
+    // resolve can prompt for Touch ID, so a converged fleet would nag on every run.
+    //
+    // Known limitation, stated rather than hidden: this compares PRESENCE (and
+    // carries `updated_at` for a future content check). It is a timestamp
+    // heuristic, not a content hash — a bundle whose VALUES changed locally still
+    // reads as present. `--force` is the way to overwrite regardless.
+    // hasOwnProperty, NOT `in`: `in` walks the prototype chain, so a bundle named
+    // `toString` / `constructor` / `valueOf` would read as present on an EMPTY map
+    // and be silently skipped — leaving that device unprovisioned, the worse of the
+    // two errors this gate can make.
+    if (!ctx.forceSecrets && probe.remoteBundles
+        && Object.prototype.hasOwnProperty.call(probe.remoteBundles, bundle)) {
+        return { push: false, backend, reason: `secrets bundle '${bundle}' already present on ${device} — pass --force to overwrite` };
+    }
+    if (!ctx.isHostPinned?.(device)) {
+        // Same bar as `exec --copy-creds`: never ship credential values to a host
+        // whose key we have not pinned.
+        return {
+            push: false,
+            backend,
+            reason: `${manual} — host key not pinned; run \`agents ssh ${device}\` once to pin it, then re-apply`,
+        };
+    }
+    return { push: true, backend, reason: '' };
+}
 // ---- execution (real SSH; verified end-to-end, not unit-mocked) ----
 function osHint(platform) {
     return platform === 'windows' ? 'windows' : undefined;
@@ -225,6 +305,15 @@ export function probeDevice(device, opts) {
         if (vres.code === 0)
             installedVersions = parseInstalledVersions(vres.stdout);
     }
+    let remoteBundles;
+    if (opts?.withSecrets) {
+        // Metadata only — `secrets list --json` returns names + timestamps and never
+        // values, which is why this is safe to run across the fleet.
+        const listCmd = buildRemoteAgentsInvocation(['secrets', 'list', '--json'], undefined, hint, remoteEnv(device.platform));
+        const lres = sshExec(target, listCmd, { timeoutMs: 30000, multiplex: true });
+        if (lres.code === 0)
+            remoteBundles = parseRemoteBundles(lres.stdout);
+    }
     return {
         device: device.name,
         reachable: true,
@@ -232,8 +321,52 @@ export function probeDevice(device, opts) {
         cliVersion: ready.version ?? undefined,
         installedAgents: installed,
         installedVersions,
+        remoteBundles,
     };
 }
+/**
+ * Narrow a remote `secrets list --json` payload to `name -> updated_at`.
+ *
+ * Exported and pure so the parse is unit-tested against real payload shapes with
+ * no live fleet. Returns `{}` rather than throwing on anything unexpected: the
+ * remote runs its own agents-cli version, and a parse failure must degrade to
+ * "unknown, so push" — never to "present, so skip", which would silently leave a
+ * device unprovisioned.
+ */
+export function parseRemoteBundles(stdout) {
+    try {
+        const parsed = JSON.parse(stdout);
+        const rows = Array.isArray(parsed)
+            ? parsed
+            : Array.isArray(parsed?.bundles)
+                ? parsed.bundles
+                : [];
+        // Null-prototype: a remote-supplied name is used as a KEY here, so `{}` would
+        // let `__proto__` hit the prototype setter instead of becoming an own
+        // property (and then read back as absent). It also means the presence check
+        // cannot see inherited names.
+        const out = Object.create(null);
+        for (const row of rows) {
+            if (!row || typeof row !== 'object')
+                continue;
+            const r = row;
+            const name = typeof r.name === 'string' ? r.name : undefined;
+            if (!name)
+                continue;
+            // `updatedAt` is the real field name in `secrets list --json` — verified
+            // against a live payload, not assumed. `updated_at` is accepted too so an
+            // older remote is not silently recorded with an empty timestamp.
+            const ts = typeof r.updatedAt === 'string' ? r.updatedAt
+                : typeof r.updated_at === 'string' ? r.updated_at
+                    : '';
+            out[name] = ts;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 /** Execute one device's planned actions in order. Real SSH — no mocks. */
 export function reconcileDevice(row, device, ctx) {
     if (!row.probe.reachable) {
@@ -290,6 +423,50 @@ export function reconcileDevice(row, device, ctx) {
         steps.push({ kind: 'push-login', ok: r.code === 0, detail: `propagate login: ${pushAgents.join(', ')}` });
         ok = ok && r.code === 0;
     }
+    // 5. secrets provisioning — LAST, and deliberately so. It is the most
+    // sensitive mutation apply performs (credential VALUES crossing to another
+    // machine), so every lower-risk step above is already recorded before we
+    // touch it: a failure here never obscures what did land.
+    //
+    // Resolve ONCE per device even for several bundles is not possible (a resolve
+    // is per bundle), but each bundle resolves once and pushes once — the read can
+    // prompt, so it must not repeat.
+    const pushSecrets = row.actions.filter((a) => a.kind === 'push-secret');
+    for (const action of pushSecrets) {
+        const bundle = action.bundle;
+        if (!bundle) {
+            // A push-secret action without a bundle name is a planner bug, not a
+            // recoverable state — fail loud rather than push nothing and report ok.
+            steps.push({ kind: 'push-secret', ok: false, detail: 'push-secret action carried no bundle name' });
+            ok = false;
+            continue;
+        }
+        const backend = device.platform === 'linux' ? 'file' : 'keychain';
+        try {
+            const out = pushBundleToHost(bundle, target, {
+                remoteBackend: backend,
+                operation: `fleet apply ${row.device}`,
+                // No passphrase, ever, from this path. On the file backend the remote
+                // auto-provisions its OWN machine-local key, which is the entire point:
+                // each box gets an unshared at-rest key instead of the fleet-wide shared
+                // secret RUSH-1968 is about.
+            });
+            steps.push({
+                kind: 'push-secret',
+                ok: out.ok,
+                detail: out.ok
+                    ? `secrets '${bundle}' -> ${row.device} (${backend}): ${out.message}`
+                    : `secrets '${bundle}' -> ${row.device}: ${out.message}`,
+            });
+            ok = ok && out.ok;
+        }
+        catch (e) {
+            // A local resolve failure (locked store, missing bundle, multi-line value)
+            // is reported per bundle rather than aborting the whole device.
+            steps.push({ kind: 'push-secret', ok: false, detail: `secrets '${bundle}': ${e.message}` });
+            ok = false;
+        }
+    }
     // Surface blocked logins as (non-fatal) informational steps.
     for (const blocked of row.loginBlocked) {
         steps.push({ kind: 'needs-login', ok: false, detail: `${blocked} needs a manual login (\`agents ssh ${row.device} -- ${blocked}\`)` });

package/dist/lib/fleet/types.d.ts

@@ -95,13 +95,28 @@ export interface DeviceProbe {
      * undefined, version-pinned specs fall back to id-level presence.
      */
     installedVersions?: Record<string, string[]>;
+    /**
+     * Secrets bundles already present on the device: name -> `updated_at` (or ''
+     * when the remote reports none). Only populated when the manifest declares
+     * bundles AND `--provision-secrets` is set — a fleet that uses no bundles
+     * never pays for the extra round trip.
+     *
+     * METADATA ONLY. `agents secrets list --json` returns names and timestamps and
+     * explicitly never values, which is what makes this probe safe to run.
+     */
+    remoteBundles?: Record<string, string>;
     /** Reason string when `reachable` is false or the probe partially failed. */
     note?: string;
 }
 /** One planned action against a device, in a single reconcile dimension. */
 export type FleetActionKind = 'install-cli' | 'upgrade-cli' | 'add-agent' | 'sync-config' | 'push-login' | 'needs-login'
-/** Secrets bundles the profile declares but that can't be pushed (values are
- * keychain-local) — surfaced as a manual recreate, like `needs-login`. */
+/** Push a declared secrets bundle to the device over SSH. Opt-in only
+ * (`--provision-secrets`) and gated on a pinned host key, because this moves
+ * credential VALUES to another machine (RUSH-1968). */
+ | 'push-secret'
+/** A declared secrets bundle that could NOT be pushed — the flag is off, the
+ * host key isn't pinned, or the bundle is already current. Surfaced as a manual
+ * recreate, like `needs-login`. */
  | 'needs-secret';
 export interface FleetAction {
     device: string;
@@ -111,6 +126,10 @@ export interface FleetAction {
     /** Full agent spec for `add-agent` (e.g. `claude@2.1.170`) so the plan can show
      * the exact version being installed; equals the id for a bare/latest spec. */
     spec?: string;
+    /** Bundle name for `push-secret` / `needs-secret`, so the executor pushes the
+     *  bundle the planner decided on rather than re-deriving it from the detail
+     *  string. */
+    bundle?: string;
     /** Human, one-line description of the action. */
     detail: string;
 }