@phnx-labs/agents-cli 1.22.25 → 1.22.27

package/dist/lib/fleet/apply.d.ts

@@ -8,6 +8,7 @@
  * (`readyProbe`, `bootstrapAgentsCli`, `buildRemoteAgentsInvocation`, `sshExec`).
  */
 import type { DeviceProfile } from '../devices/registry.js';
+import { type RemoteBackend } from '../secrets/push.js';
 import type { DeviceDesired, DeviceProbe, DeviceDiff, FleetAction, FleetPlan, AuthFilePayload } from './types.js';
 /** Strip a version suffix from an agent spec: `claude@latest` -> `claude`. */
 export declare function agentIdOf(spec: string): string;
@@ -54,21 +55,76 @@ export interface DiffContext {
     /** agents-cli version the source is on — the fleet target version. */
     targetCliVersion: string;
     sourceAuth: SourceAuth;
-    /** Secrets-bundle names the profile declares. Values are keychain-local and
-     * can't be pushed, so each reachable device surfaces them as a manual recreate
-     * (`needs-secret`) — informational, never an executed mutation. */
+    /** Secrets-bundle names the profile declares. */
     secretsBundles?: string[];
+    /** `--provision-secrets`. OFF by default: pushing a bundle moves credential
+     *  VALUES to another machine, so it is opted into per invocation and never
+     *  defaulted from the shared `agents.yaml` (RUSH-1968). */
+    provisionSecrets?: boolean;
+    /** Is this device's host key pinned? Injected so `decideSecretPush` stays pure
+     *  and its refusals are testable against real known_hosts fixtures with no
+     *  network. Absent = treated as unpinned, i.e. refuse. */
+    isHostPinned?: (device: string) => boolean;
+    /** `--force`: push a declared bundle even when the device already has it. */
+    forceSecrets?: boolean;
 }
 /** Pure: desired vs probed -> per-device diff + flat action list. */
 export declare function diffFleet(desired: DeviceDesired[], probes: Map<string, DeviceProbe>, ctx: DiffContext): FleetPlan;
+/** Why a declared bundle is or is not pushed to one device. */
+export interface SecretPushDecision {
+    push: boolean;
+    /** Where it would land on the remote. Only meaningful when `push`. */
+    backend: RemoteBackend;
+    /** Set when `push` is false — rendered as the `needs-secret` reminder. */
+    reason: string;
+}
+/**
+ * Decide whether `fleet apply` may push one declared bundle to one device.
+ *
+ * PURE — no ssh, no keychain, no filesystem beyond the injectable pin check — so
+ * every branch is unit-testable with no live fleet. Three gates, in order, and
+ * each REFUSAL still yields a `needs-secret` reminder rather than silence:
+ *
+ *   1. `--provision-secrets` must be set. Off by default, and deliberately a
+ *      flag rather than an `agents.yaml` field: the manifest is shared, so a
+ *      file-level default means someone else's `apply -y` ships credential
+ *      values without deciding to (RUSH-1968's shape of accident).
+ *   2. The device must be reachable — nothing to push to otherwise.
+ *   3. The host key must be PINNED. This moves credential values to another
+ *      machine, so it reuses the same bar `agents exec --copy-creds` already
+ *      sets (EXEC-34): an unpinned device earns its pin through a normal
+ *      `agents ssh <device>` first.
+ *
+ * Backend follows the platform, and this is the load-bearing default of the
+ * whole feature: **file on Linux, keychain on macOS/Windows**. A headless Linux
+ * box has no keychain (`lib/secrets/linux.ts`), and the file store there
+ * auto-provisions its OWN machine-local key — so each box ends up with an
+ * unshared at-rest key and NO passphrase is forwarded. That is the direct
+ * alternative to the fleet-wide shared secret this ticket exists to remove.
+ */
+export declare function decideSecretPush(bundle: string, desired: DeviceDesired, probe: DeviceProbe, ctx: DiffContext): SecretPushDecision;
 export interface ProbeOptions {
     /** Also fetch per-agent installed versions (one extra `agents view --json`
      * round-trip). Enable only when the plan has a version-pinned spec. */
     withVersions?: boolean;
+    /** Also fetch which secrets bundles the device already has (one extra
+     *  `agents secrets list --json`). Enable only when the manifest declares
+     *  bundles and provisioning is on — same cost discipline as `withVersions`. */
+    withSecrets?: boolean;
 }
 /** Probe one device: reachability + agents-cli version + installed agent ids
  * (and, when `withVersions`, the installed version strings per agent). */
 export declare function probeDevice(device: DeviceProfile, opts?: ProbeOptions): DeviceProbe;
+/**
+ * Narrow a remote `secrets list --json` payload to `name -> updated_at`.
+ *
+ * Exported and pure so the parse is unit-tested against real payload shapes with
+ * no live fleet. Returns `{}` rather than throwing on anything unexpected: the
+ * remote runs its own agents-cli version, and a parse failure must degrade to
+ * "unknown, so push" — never to "present, so skip", which would silently leave a
+ * device unprovisioned.
+ */
+export declare function parseRemoteBundles(stdout: string): Record<string, string>;
 export interface ApplyStep {
     kind: FleetAction['kind'];
     ok: boolean;

package/dist/lib/fleet/apply.js

@@ -8,7 +8,8 @@
  * (`readyProbe`, `bootstrapAgentsCli`, `buildRemoteAgentsInvocation`, `sshExec`).
  */
 import * as os from 'os';
-import { sshTargetFor } from '../devices/connect.js';
+import { pushBundleToHost } from '../secrets/push.js';
+import { deviceIdentityArgs, sshTargetFor } from '../devices/connect.js';
 import { readyProbe, bootstrapAgentsCli } from '../hosts/ready.js';
 import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
 import { sshExec } from '../ssh-exec.js';
@@ -167,14 +168,33 @@ export function diffFleet(desired, probes, ctx) {
                     }
                 }
             }
-            // secrets — surfaced, never pushed (values are keychain-local). Declared
-            // once at the manifest level, so every reachable device gets the same
-            // manual-recreate reminder. Not an executable action (see idempotence
-            // check in commands/apply.ts, which excludes needs-* kinds).
+            // secrets. Declared once at the manifest level, so every reachable device
+            // is considered. Historically this was ALWAYS a manual reminder — "surfaced,
+            // never pushed" — and that gap is a direct cause of RUSH-1968: an operator
+            // who needed secrets on a worker box had no supported path, so they
+            // hand-exported the file store's master key across the fleet instead.
+            //
+            // It is now pushable, but only deliberately. `--provision-secrets` is off by
+            // default and is a FLAG, not a manifest field: `agents.yaml` is shared, and
+            // a file-level default would mean someone else's `apply -y` silently ships
+            // credential values — the same shape of accident this ticket is about.
+            // Everything the gate refuses stays a `needs-secret` reminder, so nothing
+            // is ever silently skipped.
             if (ctx.secretsBundles && ctx.secretsBundles.length > 0) {
                 for (const bundle of ctx.secretsBundles) {
-                    secretsNeeded.push(bundle);
-                    rowActions.push({ device: d.device, kind: 'needs-secret', detail: `recreate secrets bundle '${bundle}' (\`agents secrets create ${bundle}\`)` });
+                    const decision = decideSecretPush(bundle, d, probe, ctx);
+                    if (decision.push) {
+                        rowActions.push({
+                            device: d.device,
+                            kind: 'push-secret',
+                            bundle,
+                            detail: `push secrets bundle '${bundle}' (${decision.backend} backend)`,
+                        });
+                    }
+                    else {
+                        secretsNeeded.push(bundle);
+                        rowActions.push({ device: d.device, kind: 'needs-secret', bundle, detail: decision.reason });
+                    }
                 }
             }
         }
@@ -183,6 +203,66 @@ export function diffFleet(desired, probes, ctx) {
     }
     return { devices, actions };
 }
+/**
+ * Decide whether `fleet apply` may push one declared bundle to one device.
+ *
+ * PURE — no ssh, no keychain, no filesystem beyond the injectable pin check — so
+ * every branch is unit-testable with no live fleet. Three gates, in order, and
+ * each REFUSAL still yields a `needs-secret` reminder rather than silence:
+ *
+ *   1. `--provision-secrets` must be set. Off by default, and deliberately a
+ *      flag rather than an `agents.yaml` field: the manifest is shared, so a
+ *      file-level default means someone else's `apply -y` ships credential
+ *      values without deciding to (RUSH-1968's shape of accident).
+ *   2. The device must be reachable — nothing to push to otherwise.
+ *   3. The host key must be PINNED. This moves credential values to another
+ *      machine, so it reuses the same bar `agents exec --copy-creds` already
+ *      sets (EXEC-34): an unpinned device earns its pin through a normal
+ *      `agents ssh <device>` first.
+ *
+ * Backend follows the platform, and this is the load-bearing default of the
+ * whole feature: **file on Linux, keychain on macOS/Windows**. A headless Linux
+ * box has no keychain (`lib/secrets/linux.ts`), and the file store there
+ * auto-provisions its OWN machine-local key — so each box ends up with an
+ * unshared at-rest key and NO passphrase is forwarded. That is the direct
+ * alternative to the fleet-wide shared secret this ticket exists to remove.
+ */
+export function decideSecretPush(bundle, desired, probe, ctx) {
+    const device = desired.device;
+    const backend = probe.platform === 'linux' ? 'file' : 'keychain';
+    const manual = `recreate secrets bundle '${bundle}' (\`agents ssh ${device} -- secrets create ${bundle}\`)`;
+    if (!ctx.provisionSecrets) {
+        return { push: false, backend, reason: `${manual} — or re-run with --provision-secrets to push it` };
+    }
+    if (!probe.reachable) {
+        return { push: false, backend, reason: manual };
+    }
+    // Already there? Skip — otherwise every `apply` re-resolves the bundle, and a
+    // resolve can prompt for Touch ID, so a converged fleet would nag on every run.
+    //
+    // Known limitation, stated rather than hidden: this compares PRESENCE (and
+    // carries `updated_at` for a future content check). It is a timestamp
+    // heuristic, not a content hash — a bundle whose VALUES changed locally still
+    // reads as present. `--force` is the way to overwrite regardless.
+    // hasOwnProperty, NOT `in`: `in` walks the prototype chain, so a bundle named
+    // `toString` / `constructor` / `valueOf` would read as present on an EMPTY map
+    // and be silently skipped — leaving that device unprovisioned, the worse of the
+    // two errors this gate can make.
+    if (!ctx.forceSecrets && probe.remoteBundles
+        && Object.prototype.hasOwnProperty.call(probe.remoteBundles, bundle)) {
+        return { push: false, backend, reason: `secrets bundle '${bundle}' already present on ${device} — pass --force to overwrite` };
+    }
+    if (!ctx.isHostPinned?.(device)) {
+        // Same bar as `exec --copy-creds`: never ship credential values to a host
+        // whose key we have not pinned.
+        return {
+            push: false,
+            backend,
+            reason: `${manual} — host key not pinned; run \`agents ssh ${device}\` once to pin it, then re-apply`,
+        };
+    }
+    return { push: true, backend, reason: '' };
+}
 // ---- execution (real SSH; verified end-to-end, not unit-mocked) ----
 function osHint(platform) {
     return platform === 'windows' ? 'windows' : undefined;
@@ -202,13 +282,14 @@ export function probeDevice(device, opts) {
         return { device: device.name, reachable: false, platform: device.platform, installedAgents: [], note: e.message };
     }
     const hint = osHint(device.platform);
-    const ready = readyProbe(target, hint);
+    const extraSshArgs = deviceIdentityArgs(device);
+    const ready = readyProbe(target, hint, extraSshArgs);
     if (!ready.reachable) {
         return { device: device.name, reachable: false, platform: device.platform, installedAgents: [], note: 'unreachable' };
     }
     let installed = [];
     const remoteCmd = buildRemoteAgentsInvocation(['teams', 'doctor', '--json'], undefined, hint, remoteEnv(device.platform));
-    const res = sshExec(target, remoteCmd, { timeoutMs: 30000, multiplex: true });
+    const res = sshExec(target, remoteCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
     if (res.code === 0) {
         try {
             const map = JSON.parse(res.stdout);
@@ -221,10 +302,19 @@ export function probeDevice(device, opts) {
     let installedVersions;
     if (opts?.withVersions) {
         const viewCmd = buildRemoteAgentsInvocation(['view', '--json'], undefined, hint, remoteEnv(device.platform));
-        const vres = sshExec(target, viewCmd, { timeoutMs: 30000, multiplex: true });
+        const vres = sshExec(target, viewCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
         if (vres.code === 0)
             installedVersions = parseInstalledVersions(vres.stdout);
     }
+    let remoteBundles;
+    if (opts?.withSecrets) {
+        // Metadata only — `secrets list --json` returns names + timestamps and never
+        // values, which is why this is safe to run across the fleet.
+        const listCmd = buildRemoteAgentsInvocation(['secrets', 'list', '--json'], undefined, hint, remoteEnv(device.platform));
+        const lres = sshExec(target, listCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs });
+        if (lres.code === 0)
+            remoteBundles = parseRemoteBundles(lres.stdout);
+    }
     return {
         device: device.name,
         reachable: true,
@@ -232,8 +322,52 @@ export function probeDevice(device, opts) {
         cliVersion: ready.version ?? undefined,
         installedAgents: installed,
         installedVersions,
+        remoteBundles,
     };
 }
+/**
+ * Narrow a remote `secrets list --json` payload to `name -> updated_at`.
+ *
+ * Exported and pure so the parse is unit-tested against real payload shapes with
+ * no live fleet. Returns `{}` rather than throwing on anything unexpected: the
+ * remote runs its own agents-cli version, and a parse failure must degrade to
+ * "unknown, so push" — never to "present, so skip", which would silently leave a
+ * device unprovisioned.
+ */
+export function parseRemoteBundles(stdout) {
+    try {
+        const parsed = JSON.parse(stdout);
+        const rows = Array.isArray(parsed)
+            ? parsed
+            : Array.isArray(parsed?.bundles)
+                ? parsed.bundles
+                : [];
+        // Null-prototype: a remote-supplied name is used as a KEY here, so `{}` would
+        // let `__proto__` hit the prototype setter instead of becoming an own
+        // property (and then read back as absent). It also means the presence check
+        // cannot see inherited names.
+        const out = Object.create(null);
+        for (const row of rows) {
+            if (!row || typeof row !== 'object')
+                continue;
+            const r = row;
+            const name = typeof r.name === 'string' ? r.name : undefined;
+            if (!name)
+                continue;
+            // `updatedAt` is the real field name in `secrets list --json` — verified
+            // against a live payload, not assumed. `updated_at` is accepted too so an
+            // older remote is not silently recorded with an empty timestamp.
+            const ts = typeof r.updatedAt === 'string' ? r.updatedAt
+                : typeof r.updated_at === 'string' ? r.updated_at
+                    : '';
+            out[name] = ts;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 /** Execute one device's planned actions in order. Real SSH — no mocks. */
 export function reconcileDevice(row, device, ctx) {
     if (!row.probe.reachable) {
@@ -249,12 +383,13 @@ export function reconcileDevice(row, device, ctx) {
     }
     const hint = osHint(device.platform);
     const env = remoteEnv(device.platform);
+    const extraSshArgs = deviceIdentityArgs(device);
     let ok = true;
-    const sshAgents = (args, input) => sshExec(target, buildRemoteAgentsInvocation(args, undefined, hint, env), { timeoutMs: 300000, multiplex: true, input });
+    const sshAgents = (args, input) => sshExec(target, buildRemoteAgentsInvocation(args, undefined, hint, env), { timeoutMs: 300000, multiplex: true, input, extraSshArgs });
     // 1. agents-cli install/upgrade.
     const cliAction = row.actions.find((a) => a.kind === 'install-cli' || a.kind === 'upgrade-cli');
     if (cliAction) {
-        const r = bootstrapAgentsCli(target, ctx.targetCliVersion, hint);
+        const r = bootstrapAgentsCli(target, ctx.targetCliVersion, hint, extraSshArgs);
         steps.push({ kind: cliAction.kind, ok: r.ok, detail: cliAction.detail });
         ok = ok && r.ok;
     }
@@ -290,6 +425,50 @@ export function reconcileDevice(row, device, ctx) {
         steps.push({ kind: 'push-login', ok: r.code === 0, detail: `propagate login: ${pushAgents.join(', ')}` });
         ok = ok && r.code === 0;
     }
+    // 5. secrets provisioning — LAST, and deliberately so. It is the most
+    // sensitive mutation apply performs (credential VALUES crossing to another
+    // machine), so every lower-risk step above is already recorded before we
+    // touch it: a failure here never obscures what did land.
+    //
+    // Resolve ONCE per device even for several bundles is not possible (a resolve
+    // is per bundle), but each bundle resolves once and pushes once — the read can
+    // prompt, so it must not repeat.
+    const pushSecrets = row.actions.filter((a) => a.kind === 'push-secret');
+    for (const action of pushSecrets) {
+        const bundle = action.bundle;
+        if (!bundle) {
+            // A push-secret action without a bundle name is a planner bug, not a
+            // recoverable state — fail loud rather than push nothing and report ok.
+            steps.push({ kind: 'push-secret', ok: false, detail: 'push-secret action carried no bundle name' });
+            ok = false;
+            continue;
+        }
+        const backend = device.platform === 'linux' ? 'file' : 'keychain';
+        try {
+            const out = pushBundleToHost(bundle, target, {
+                remoteBackend: backend,
+                operation: `fleet apply ${row.device}`,
+                // No passphrase, ever, from this path. On the file backend the remote
+                // auto-provisions its OWN machine-local key, which is the entire point:
+                // each box gets an unshared at-rest key instead of the fleet-wide shared
+                // secret RUSH-1968 is about.
+            });
+            steps.push({
+                kind: 'push-secret',
+                ok: out.ok,
+                detail: out.ok
+                    ? `secrets '${bundle}' -> ${row.device} (${backend}): ${out.message}`
+                    : `secrets '${bundle}' -> ${row.device}: ${out.message}`,
+            });
+            ok = ok && out.ok;
+        }
+        catch (e) {
+            // A local resolve failure (locked store, missing bundle, multi-line value)
+            // is reported per bundle rather than aborting the whole device.
+            steps.push({ kind: 'push-secret', ok: false, detail: `secrets '${bundle}': ${e.message}` });
+            ok = false;
+        }
+    }
     // Surface blocked logins as (non-fatal) informational steps.
     for (const blocked of row.loginBlocked) {
         steps.push({ kind: 'needs-login', ok: false, detail: `${blocked} needs a manual login (\`agents ssh ${row.device} -- ${blocked}\`)` });

package/dist/lib/fleet/remote-login.d.ts

@@ -44,6 +44,7 @@ export interface PendingLogin {
     platform?: string;
     /** ssh dial target for the device. */
     target: string;
+    extraSshArgs?: string[];
     flow: LoginFlow;
     /** True when a device-code flow this command can actually drive. */
     remotable: boolean;
@@ -75,7 +76,7 @@ export declare function selectLoginTargets(devices: DeviceProfile[], agents: (Ag
  * devices need the askpass shim env, which the PTY env allowlist strips — those
  * are a follow-up (TODO), surfaced as an error rather than silently mis-driven.
  */
-export declare function buildRemoteLoginSshCommand(target: string, flow: LoginFlow): string;
+export declare function buildRemoteLoginSshCommand(target: string, flow: LoginFlow, extraSshArgs?: string[]): string;
 export type LoginMode = 'bulk' | 'interactive';
 /** Per-pair status shape shared between the driver, the status endpoint, and the page. */
 export type LoginStatusState = 'pending' | 'driving' | 'ready' | 'authorized' | 'error' | 'skipped';
@@ -138,7 +139,7 @@ export interface DriveResult extends ScrapedLogin {
  * in the browser; the caller polls the credential file for completion. Testable
  * against a fake {@link PtyDriver}.
  */
-export declare function driveRemoteLogin(target: string, flow: LoginFlow, driver: PtyDriver, opts?: DriveOptions): Promise<DriveResult>;
+export declare function driveRemoteLogin(target: string, flow: LoginFlow, driver: PtyDriver, opts?: DriveOptions, extraSshArgs?: string[]): Promise<DriveResult>;
 export interface DetectOptions {
     agents?: (AgentId | string)[];
     devices?: string[];
@@ -157,7 +158,7 @@ export declare function detectPending(opts?: DetectOptions): Promise<PendingLogi
  * bumping after the human completes the browser step. POSIX `stat` only (the
  * device-code agents are all POSIX-fleet).
  */
-export declare function remoteFileMtime(target: string, homeRel: string): Promise<number>;
+export declare function remoteFileMtime(target: string, homeRel: string, extraSshArgs?: string[]): Promise<number>;
 export interface RunFleetLoginOptions {
     agents?: (AgentId | string)[];
     devices?: string[];

package/dist/lib/fleet/remote-login.js

@@ -29,7 +29,7 @@
 import * as http from 'http';
 import { isControlDevice } from '../devices/registry.js';
 import { loadDevices } from '../devices/registry.js';
-import { fleetDialTarget } from '../devices/connect.js';
+import { deviceIdentityArgs, fleetDialTarget } from '../devices/connect.js';
 import { planFleetTargets } from '../devices/fleet.js';
 import { assertValidSshTarget, shellQuote, sshExecAsync } from '../ssh-exec.js';
 import { machineId } from '../session/sync/config.js';
@@ -134,6 +134,7 @@ export function selectLoginTargets(devices, agents, cache, opts = {}) {
                 agent,
                 platform: device.platform,
                 target: fleetDialTarget(device),
+                extraSshArgs: deviceIdentityArgs(device),
                 flow,
                 remotable,
                 reason,
@@ -152,7 +153,7 @@ export function selectLoginTargets(devices, agents, cache, opts = {}) {
  * devices need the askpass shim env, which the PTY env allowlist strips — those
  * are a follow-up (TODO), surfaced as an error rather than silently mis-driven.
  */
-export function buildRemoteLoginSshCommand(target, flow) {
+export function buildRemoteLoginSshCommand(target, flow, extraSshArgs = []) {
     assertValidSshTarget(target);
     // The agent CLIs (kimi/droid/codex/…) are agents-cli shims that live in
     // ~/.agents/.cache/shims and are only on PATH in an interactive/login shell.
@@ -165,6 +166,7 @@ export function buildRemoteLoginSshCommand(target, flow) {
         'ssh', '-tt',
         '-o', 'StrictHostKeyChecking=accept-new',
         '-o', 'ConnectTimeout=10',
+        ...extraSshArgs.map(shellQuote),
         shellQuote(target),
         shellQuote(remoteCmd),
     ].join(' ');
@@ -367,7 +369,7 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
  * in the browser; the caller polls the credential file for completion. Testable
  * against a fake {@link PtyDriver}.
  */
-export async function driveRemoteLogin(target, flow, driver, opts = {}) {
+export async function driveRemoteLogin(target, flow, driver, opts = {}, extraSshArgs = []) {
     const initialDelayMs = opts.initialDelayMs ?? 4000;
     const pollMs = opts.pollMs ?? 1000;
     const timeoutMs = opts.timeoutMs ?? 90000;
@@ -377,7 +379,7 @@ export async function driveRemoteLogin(target, flow, driver, opts = {}) {
     // `ssh -tt` process it drives) leaks until the sidecar's idle reaper. On the
     // normal return paths the caller owns stop() via the returned sessionId.
     try {
-        await driver.exec(id, buildRemoteLoginSshCommand(target, flow));
+        await driver.exec(id, buildRemoteLoginSshCommand(target, flow, extraSshArgs));
         await sleep(initialDelayMs);
         if (flow.deviceCodeSelect) {
             await driver.write(id, flow.deviceCodeSelect);
@@ -431,9 +433,9 @@ export async function detectPending(opts = {}) {
  * bumping after the human completes the browser step. POSIX `stat` only (the
  * device-code agents are all POSIX-fleet).
  */
-export async function remoteFileMtime(target, homeRel) {
+export async function remoteFileMtime(target, homeRel, extraSshArgs = []) {
     const cmd = `stat -c %Y "$HOME/${homeRel}" 2>/dev/null || stat -f %m "$HOME/${homeRel}" 2>/dev/null || echo 0`;
-    const res = await sshExecAsync(target, cmd, { timeoutMs: 15000, multiplex: true }).catch(() => null);
+    const res = await sshExecAsync(target, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs }).catch(() => null);
     if (!res || res.code !== 0)
         return 0;
     const n = parseInt(res.stdout.trim(), 10);
@@ -507,10 +509,10 @@ export async function runFleetLogin(opts = {}) {
         const k = key(p.device, p.agent);
         const st = statuses.get(k);
         st.state = 'driving';
-        const baseMtime = await remoteFileMtime(p.target, p.flow.successFile).catch(() => 0);
+        const baseMtime = await remoteFileMtime(p.target, p.flow.successFile, p.extraSshArgs).catch(() => 0);
         let sessionId;
         try {
-            const r = await driveRemoteLogin(p.target, p.flow, driver, opts.drive);
+            const r = await driveRemoteLogin(p.target, p.flow, driver, opts.drive, p.extraSshArgs);
             sessionId = r.sessionId;
             if (r.url && r.code) {
                 st.url = r.url;
@@ -539,7 +541,7 @@ export async function runFleetLogin(opts = {}) {
                 st.detail = 'device code expired before authorization';
                 break;
             }
-            const mtime = await remoteFileMtime(p.target, p.flow.successFile).catch(() => 0);
+            const mtime = await remoteFileMtime(p.target, p.flow.successFile, p.extraSshArgs).catch(() => 0);
             if (mtime > baseMtime) {
                 st.state = 'authorized';
                 break;

package/dist/lib/fleet/types.d.ts

@@ -95,13 +95,28 @@ export interface DeviceProbe {
      * undefined, version-pinned specs fall back to id-level presence.
      */
     installedVersions?: Record<string, string[]>;
+    /**
+     * Secrets bundles already present on the device: name -> `updated_at` (or ''
+     * when the remote reports none). Only populated when the manifest declares
+     * bundles AND `--provision-secrets` is set — a fleet that uses no bundles
+     * never pays for the extra round trip.
+     *
+     * METADATA ONLY. `agents secrets list --json` returns names and timestamps and
+     * explicitly never values, which is what makes this probe safe to run.
+     */
+    remoteBundles?: Record<string, string>;
     /** Reason string when `reachable` is false or the probe partially failed. */
     note?: string;
 }
 /** One planned action against a device, in a single reconcile dimension. */
 export type FleetActionKind = 'install-cli' | 'upgrade-cli' | 'add-agent' | 'sync-config' | 'push-login' | 'needs-login'
-/** Secrets bundles the profile declares but that can't be pushed (values are
- * keychain-local) — surfaced as a manual recreate, like `needs-login`. */
+/** Push a declared secrets bundle to the device over SSH. Opt-in only
+ * (`--provision-secrets`) and gated on a pinned host key, because this moves
+ * credential VALUES to another machine (RUSH-1968). */
+ | 'push-secret'
+/** A declared secrets bundle that could NOT be pushed — the flag is off, the
+ * host key isn't pinned, or the bundle is already current. Surfaced as a manual
+ * recreate, like `needs-login`. */
  | 'needs-secret';
 export interface FleetAction {
     device: string;
@@ -111,6 +126,10 @@ export interface FleetAction {
     /** Full agent spec for `add-agent` (e.g. `claude@2.1.170`) so the plan can show
      * the exact version being installed; equals the id for a bare/latest spec. */
     spec?: string;
+    /** Bundle name for `push-secret` / `needs-secret`, so the executor pushes the
+     *  bundle the planner decided on rather than re-deriving it from the detail
+     *  string. */
+    bundle?: string;
     /** Human, one-line description of the action. */
     detail: string;
 }

package/dist/lib/gemini-settings.d.ts

@@ -1,4 +1,3 @@
 export declare function readGeminiSettings(settingsPath: string): Record<string, unknown>;
 export declare function writeGeminiSettings(settingsPath: string, settings: Record<string, unknown>): void;
 export declare function updateGeminiSettings(settingsPath: string, mutate: (settings: Record<string, unknown>) => void): Record<string, unknown>;
-export declare function setGeminiAutoUpdateDisabled(settings: Record<string, unknown>): void;

package/dist/lib/gemini-settings.js

@@ -1,3 +1,15 @@
+/**
+ * Generic reader/writer for a `.gemini/…/settings.json`-shaped JSON config.
+ *
+ * Despite the name, this module is no longer gemini-specific: gemini itself
+ * is hard-deprecated and has no live caller left (its own settings writer,
+ * `generateGeminiConfig`, was removed with the RUSH-2202 runner.ts fix — a
+ * gemini routine is rejected before it ever reaches sandbox prep). Antigravity
+ * nests its own `settings.json` under the same `.gemini/antigravity-cli/` tree
+ * and shares this exact shape, so `permissions.ts` reuses `updateGeminiSettings`
+ * for antigravity's live permission writes. Keep the generic helpers; do not
+ * reintroduce gemini-only logic here.
+ */
 import * as fs from 'fs';
 import * as path from 'path';
 function isRecord(value) {
@@ -24,10 +36,3 @@ export function updateGeminiSettings(settingsPath, mutate) {
     writeGeminiSettings(settingsPath, settings);
     return settings;
 }
-export function setGeminiAutoUpdateDisabled(settings) {
-    const general = isRecord(settings.general) ? settings.general : {};
-    settings.general = {
-        ...general,
-        enableAutoUpdate: false,
-    };
-}

package/dist/lib/hooks/cache.js

@@ -505,6 +505,21 @@ if [ "$CACHE_STATUS" = miss ]; then
     if [ "$_in_backoff" -eq 0 ]; then
       # Fix 1: lockdir — only one background refresh runs at a time.
       LOCK_DIR="$CACHE_FILE.bg.lck"
+      # Fix 4 (RUSH-2259): reclaim a stale lock. The lock is released by the bg
+      # subshell's EXIT trap, but a hard kill (SIGKILL, OOM, reboot) skips the
+      # trap and orphans the dir — after which every future mkdir fails and bg
+      # refresh stops FOREVER while stale cache is served indefinitely. The dir
+      # mtime is fixed at mkdir time (the refresh writes elsewhere), so its age
+      # is the time the lock has been held; treat a lock older than LOCK_TTL_SEC
+      # as abandoned and remove it before locking. LOCK_TTL_SEC is set well above
+      # any real hook runtime so a live refresh is never reclaimed out from under.
+      LOCK_TTL_SEC=300
+      if [ -d "$LOCK_DIR" ]; then
+        _lock_mtime=$("$PY" -c 'import os,sys; print(int(os.path.getmtime(sys.argv[1])))' "$LOCK_DIR" 2>/dev/null || echo 0)
+        _lock_now_s=$(date +%s)
+        _lock_age=$((_lock_now_s - \${_lock_mtime:-0}))
+        [ "$_lock_age" -ge "$LOCK_TTL_SEC" ] && rm -rf "$LOCK_DIR" 2>/dev/null
+      fi
       if mkdir "$LOCK_DIR" 2>/dev/null; then
         tmp="$CACHE_FILE.new.$$"
         # Fix 3: background subshell captures and logs its own real exit code.

package/dist/lib/hooks.d.ts

@@ -217,12 +217,15 @@ export declare function listCentralHooks(): HookEntry[];
  *
  * A bare number stays seconds (`timeout: 30` → 30) for backward compatibility.
  * A Go-style duration string is parsed into seconds: `5s`, `2m`, `1h30m`,
- * `90s`, `1h`. This intentionally does NOT reuse {@link parseTimeout} from
- * routines.ts — that one returns milliseconds, has no seconds (`s`) unit, and
- * floors at one minute, none of which fit hook timeouts (typically 5–600s).
+ * `90s`, `1h`. Suffixed durations longer than 24 hours are rejected as likely
+ * typos, while bare seconds stay uncapped for backward compatibility. This
+ * intentionally does NOT reuse {@link parseTimeout} from routines.ts — that one
+ * returns milliseconds, has no seconds (`s`) unit, and floors at one minute,
+ * none of which fit hook timeouts (typically 5–600s).
  *
- * Returns the seconds value, or `null` when the input is not a positive number
- * or a parseable duration string — the caller decides how to surface that.
+ * Returns the seconds value, or `null` when the input is not a positive number,
+ * is not parseable, or is a suffixed duration longer than 24 hours — the caller
+ * decides how to surface that.
  */
 export declare function normalizeHookTimeoutSeconds(value: unknown): number | null;
 /**

package/dist/lib/hooks.js

@@ -1160,17 +1160,21 @@ export function listCentralHooks() {
     }
     return results;
 }
+const MAX_HOOK_DURATION_SECONDS = 24 * 60 * 60;
 /**
  * Normalize a hook `timeout` from agents.yaml into a whole number of seconds.
  *
  * A bare number stays seconds (`timeout: 30` → 30) for backward compatibility.
  * A Go-style duration string is parsed into seconds: `5s`, `2m`, `1h30m`,
- * `90s`, `1h`. This intentionally does NOT reuse {@link parseTimeout} from
- * routines.ts — that one returns milliseconds, has no seconds (`s`) unit, and
- * floors at one minute, none of which fit hook timeouts (typically 5–600s).
+ * `90s`, `1h`. Suffixed durations longer than 24 hours are rejected as likely
+ * typos, while bare seconds stay uncapped for backward compatibility. This
+ * intentionally does NOT reuse {@link parseTimeout} from routines.ts — that one
+ * returns milliseconds, has no seconds (`s`) unit, and floors at one minute,
+ * none of which fit hook timeouts (typically 5–600s).
  *
- * Returns the seconds value, or `null` when the input is not a positive number
- * or a parseable duration string — the caller decides how to surface that.
+ * Returns the seconds value, or `null` when the input is not a positive number,
+ * is not parseable, or is a suffixed duration longer than 24 hours — the caller
+ * decides how to surface that.
  */
 export function normalizeHookTimeoutSeconds(value) {
     if (typeof value === 'number') {
@@ -1194,7 +1198,7 @@ export function normalizeHookTimeoutSeconds(value) {
         const minutes = Number(m[4] || 0);
         const seconds = Number(m[5] || 0);
         const total = ((weeks * 7 + days) * 24 + hours) * 3600 + minutes * 60 + seconds;
-        return total > 0 ? total : null;
+        return total > 0 && total <= MAX_HOOK_DURATION_SECONDS ? total : null;
     }
     return null;
 }