@phnx-labs/agents-cli 1.22.35 → 1.22.38

package/dist/lib/account-catalog.d.ts

@@ -0,0 +1,18 @@
+import type { AgentId } from './types.js';
+export interface NativeAccountCatalogEntry {
+    kind: 'native';
+    id: string;
+    agent: AgentId;
+    display: string;
+    email: string | null;
+    versions: string[];
+}
+export declare function groupNativeAccountRows(rows: Array<{
+    agent: AgentId;
+    version: string;
+    accountKey: string | null;
+    email: string | null;
+    signedIn: boolean;
+}>): NativeAccountCatalogEntry[];
+/** Discover signed-in harness-native identities without copying their auth files. */
+export declare function discoverNativeAccounts(): Promise<NativeAccountCatalogEntry[]>;

package/dist/lib/account-catalog.js

@@ -0,0 +1,38 @@
+import { ALL_AGENT_IDS, getAccountInfo, supportsAccountInspection } from './agents.js';
+import { getVersionHomePath, listInstalledVersions } from './versions.js';
+export function groupNativeAccountRows(rows) {
+    const grouped = new Map();
+    for (const row of rows) {
+        if (!row.signedIn)
+            continue;
+        const identity = row.accountKey ?? row.email?.toLowerCase();
+        if (!identity)
+            continue;
+        const key = `${row.agent}:${identity}`;
+        const existing = grouped.get(key);
+        if (existing)
+            existing.versions.push(row.version);
+        else
+            grouped.set(key, {
+                kind: 'native',
+                id: identity,
+                agent: row.agent,
+                display: row.email ?? identity,
+                email: row.email,
+                versions: [row.version],
+            });
+    }
+    return [...grouped.values()].map(entry => ({ ...entry, versions: [...new Set(entry.versions)].sort() }))
+        .sort((a, b) => a.agent.localeCompare(b.agent) || a.display.localeCompare(b.display));
+}
+/** Discover signed-in harness-native identities without copying their auth files. */
+export async function discoverNativeAccounts() {
+    const rows = [];
+    for (const agent of ALL_AGENT_IDS.filter(supportsAccountInspection)) {
+        for (const version of listInstalledVersions(agent)) {
+            const info = await getAccountInfo(agent, getVersionHomePath(agent, version));
+            rows.push({ agent, version, accountKey: info.accountKey, email: info.email, signedIn: info.signedIn });
+        }
+    }
+    return groupNativeAccountRows(rows);
+}

package/dist/lib/account-provider-registry.d.ts

@@ -0,0 +1,18 @@
+import type { AgentId } from './types.js';
+export type AccountAuthKind = 'api-key' | 'setup-token' | 'bearer-token';
+export interface AccountProviderAdapter {
+    provider: string;
+    authKinds: readonly AccountAuthKind[];
+    envFor(host: AgentId, kind: AccountAuthKind): string;
+    connectionEnvFor(host: AgentId): Record<string, string>;
+    /**
+     * The env var a per-account BASE_URL override should be written to for this
+     * host, or null when the provider has no endpoint env on that host. Derived
+     * from the provider's own connection env so the base-url key lives in one
+     * place instead of being re-guessed by callers.
+     */
+    baseUrlEnvFor(host: AgentId): string | null;
+    validate(kind: AccountAuthKind, value: string): void;
+}
+export declare function getAccountProvider(provider: string): AccountProviderAdapter;
+export declare function listAccountProviders(): string[];

package/dist/lib/account-provider-registry.js

@@ -0,0 +1,59 @@
+const nonEmpty = (provider, kind, value) => {
+    if (!value.trim())
+        throw new Error(`${provider} ${kind} cannot be empty.`);
+};
+function fixed(provider, authKinds, envByHost, connectionEnvByHost = {}, baseUrlEnvByHost = {}, validate) {
+    return {
+        provider,
+        authKinds,
+        envFor(host, kind) {
+            if (!authKinds.includes(kind))
+                throw new Error(`Provider '${provider}' does not support ${kind} accounts.`);
+            const env = envByHost[host];
+            if (!env)
+                throw new Error(`Provider '${provider}' cannot authenticate the ${host} harness.`);
+            return env;
+        },
+        connectionEnvFor(host) {
+            return connectionEnvByHost[host] ?? {};
+        },
+        baseUrlEnvFor(host) {
+            const connection = connectionEnvByHost[host] ?? {};
+            return baseUrlEnvByHost[host] ?? Object.keys(connection).find(key => key.endsWith('_BASE_URL')) ?? null;
+        },
+        validate(kind, value) {
+            nonEmpty(provider, kind, value);
+            validate?.(kind, value);
+        },
+    };
+}
+const ADAPTERS = new Map([
+    ['anthropic', fixed('anthropic', ['api-key', 'setup-token'], { claude: 'ANTHROPIC_API_KEY' }, {}, {}, (kind, value) => {
+            if (kind === 'setup-token' && !value.startsWith('sk-ant-oat01-')) {
+                throw new Error('Anthropic setup tokens must start with sk-ant-oat01-.');
+            }
+        })],
+    ['cursor', fixed('cursor', ['api-key'], { cursor: 'CURSOR_API_KEY' })],
+    ['openrouter', fixed('openrouter', ['api-key'], { claude: 'ANTHROPIC_AUTH_TOKEN', codex: 'OPENAI_API_KEY', opencode: 'OPENROUTER_API_KEY' }, { claude: { ANTHROPIC_BASE_URL: 'https://openrouter.ai/api' }, codex: { OPENAI_BASE_URL: 'https://openrouter.ai/api/v1' } })],
+    ['deepinfra', fixed('deepinfra', ['api-key'], { codex: 'OPENAI_API_KEY' }, { codex: { OPENAI_BASE_URL: 'https://api.deepinfra.com/v1/openai' } })],
+    ['openai', fixed('openai', ['api-key'], { codex: 'OPENAI_API_KEY', opencode: 'OPENAI_API_KEY' }, {}, { codex: 'OPENAI_BASE_URL', opencode: 'OPENAI_BASE_URL' })],
+    ['xai', fixed('xai', ['api-key'], { grok: 'XAI_API_KEY', claude: 'ANTHROPIC_AUTH_TOKEN' })],
+    ['google', fixed('google', ['api-key'], { gemini: 'GEMINI_API_KEY', antigravity: 'ANTIGRAVITY_API_KEY' })],
+    ['opencode', fixed('opencode', ['api-key'], { opencode: 'OPENCODE_API_KEY' })],
+    ['proxy', fixed('proxy', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN', codex: 'OPENAI_API_KEY' }, {}, { claude: 'ANTHROPIC_BASE_URL', codex: 'OPENAI_BASE_URL' })],
+    ['truefoundry', fixed('truefoundry', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN' }, {}, { claude: 'ANTHROPIC_BASE_URL' })],
+    ['bedrock', fixed('bedrock', ['bearer-token'], { claude: 'AWS_BEARER_TOKEN_BEDROCK' })],
+    ['foundry', fixed('foundry', ['api-key'], { claude: 'ANTHROPIC_FOUNDRY_API_KEY' })],
+    ['litellm', fixed('litellm', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN', codex: 'OPENAI_API_KEY' }, {}, { claude: 'ANTHROPIC_BASE_URL', codex: 'OPENAI_BASE_URL' })],
+    ['vllm', fixed('vllm', ['api-key', 'bearer-token'], { claude: 'ANTHROPIC_AUTH_TOKEN', codex: 'OPENAI_API_KEY' }, {}, { claude: 'ANTHROPIC_BASE_URL', codex: 'OPENAI_BASE_URL' })],
+    ['ollama', fixed('ollama', ['api-key'], { codex: 'OPENAI_API_KEY' }, {}, { codex: 'OPENAI_BASE_URL' })],
+]);
+export function getAccountProvider(provider) {
+    const adapter = ADAPTERS.get(provider.toLowerCase());
+    if (!adapter)
+        throw new Error(`Unknown account provider '${provider}'. Supported: ${listAccountProviders().join(', ')}.`);
+    return adapter;
+}
+export function listAccountProviders() {
+    return [...ADAPTERS.keys()].sort();
+}

package/dist/lib/account-registry.d.ts

@@ -0,0 +1,40 @@
+import type { AgentId, Meta } from './types.js';
+import { type AccountAuthKind } from './account-provider-registry.js';
+export interface CredentialAccount {
+    id: string;
+    name: string;
+    provider: string;
+    auth: AccountAuthKind;
+    secretRef: string;
+    baseUrl?: string;
+}
+export interface AccountRegistryDocument {
+    version: 2;
+    accounts: Record<string, CredentialAccount>;
+}
+export interface ResolvedCredentialAccount {
+    id: string;
+    name: string;
+    provider: string;
+    auth: AccountAuthKind;
+    env: Record<string, string>;
+}
+export declare function accountRegistryPath(base?: string): string;
+export declare function readAccountRegistry(base?: string): AccountRegistryDocument;
+export declare function findAccount(name: string, doc?: AccountRegistryDocument): CredentialAccount | null;
+/** Explicit selection wins over a configured per-harness default. */
+export declare function resolveAccountSelection(explicit: string | undefined, agent: AgentId, meta: Pick<Meta, 'accounts'>, opts?: {
+    useDefault?: boolean;
+}): string | undefined;
+export interface AddAccountOptions {
+    baseUrl?: string;
+}
+export declare function addAccount(name: string, provider: string, auth: AccountAuthKind, secret: string, base?: string, opts?: AddAccountOptions): CredentialAccount;
+export declare function setAccountSecret(name: string, secret: string, base?: string): void;
+export declare function renameAccount(oldName: string, newName: string, base?: string): void;
+export declare function removeAccount(name: string, base?: string): void;
+export declare function inspectAccount(name: string, base?: string): CredentialAccount & {
+    secretPresent: boolean;
+    policy: 'never';
+};
+export declare function resolveCredentialAccount(name: string, host: AgentId, expectedProvider?: string, base?: string): ResolvedCredentialAccount;

package/dist/lib/account-registry.js

@@ -0,0 +1,239 @@
+/**
+ * Credential accounts, stored as canonical `agents secrets` bundles (RUSH-2470).
+ *
+ * One account IS one bundle: the bundle label is the account name, its vars
+ * carry the identity (ACCOUNT_ID / PROVIDER / AUTH_TYPE / optional BASE_URL)
+ * and the secret (API_KEY or TOKEN), and it uses the `never` prompt policy so
+ * it reads headlessly and syncs across the fleet with no Touch ID. The bundle
+ * shape lives in [[account-schema]]; this module owns the CRUD, resolution,
+ * and the one-time migration off the legacy `accounts.yaml`.
+ *
+ * `readAccountRegistry()` still returns the historical
+ * `{ version: 2, accounts }` view so existing consumers (harness, profiles,
+ * exec) keep working — it is now a projection over the account bundles, not a
+ * file read. Native OAuth logins are NOT accounts here; they stay native and
+ * surface through unified discovery in [[account-catalog]].
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import * as yaml from 'yaml';
+import { atomicWriteFileSync } from './fs-atomic.js';
+import { getUserAgentsDir } from './state.js';
+import { deleteKeychainToken, getKeychainToken, hasKeychainToken } from './secrets/index.js';
+import { bundleExists, deleteBundle, listBundles, readBundle, renameBundle, writeBundleWithItems } from './secrets/bundles.js';
+import { getAccountProvider } from './account-provider-registry.js';
+import { accountSecretItem, buildAccountBundle, parseAccountBundle } from './account-schema.js';
+const NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+const AUTH_KINDS = ['api-key', 'setup-token', 'bearer-token'];
+export function accountRegistryPath(base = getUserAgentsDir()) { return path.join(base, 'accounts.yaml'); }
+function assertName(name) {
+    if (!NAME.test(name))
+        throw new Error('Account name must start with a letter or number and contain only letters, numbers, dot, underscore, or dash.');
+}
+function isAccountAuthKind(value) {
+    return typeof value === 'string' && AUTH_KINDS.includes(value);
+}
+function toCredentialAccount(record) {
+    return {
+        id: record.id,
+        name: record.name,
+        provider: record.provider,
+        auth: record.auth,
+        secretRef: accountSecretItem(record.name, record.auth),
+        baseUrl: record.baseUrl,
+    };
+}
+/** Every account bundle currently on this device, keyed by stable id. */
+function readAccountBundles() {
+    const out = [];
+    for (const bundle of listBundles()) {
+        const record = parseAccountBundle(bundle);
+        if (record)
+            out.push(toCredentialAccount(record));
+    }
+    return out;
+}
+/**
+ * Fold a legacy `accounts.yaml` into account bundles, then archive it.
+ * Transactional: every bundle is written first, and the file is archived (and
+ * the old per-account keychain items dropped) ONLY after all writes succeed —
+ * so an interrupted migration leaves the file in place and the next read
+ * retries, skipping accounts that already landed as a bundle.
+ */
+function migrateLegacyRegistryFile(base) {
+    const file = accountRegistryPath(base);
+    if (!fs.existsSync(file))
+        return;
+    const raw = yaml.parse(fs.readFileSync(file, 'utf8'));
+    if (!raw || Array.isArray(raw))
+        throw new Error(`Account registry corrupted at ${file}: expected a YAML map.`);
+    // Legacy version-bound labels (pre-credential-accounts) are not credentials —
+    // archive them so they are never resurrected as fake accounts.
+    if (raw.version === undefined && raw.labels !== undefined) {
+        archiveLegacyFile(file, 'accounts.legacy-labels.yaml');
+        return;
+    }
+    if (raw.version !== 2)
+        throw new Error(`Unsupported account registry version '${String(raw.version)}' at ${file}.`);
+    const legacyAccounts = (raw.accounts && typeof raw.accounts === 'object' && !Array.isArray(raw.accounts))
+        ? raw.accounts
+        : {};
+    const retiredSecretItems = [];
+    for (const [key, value] of Object.entries(legacyAccounts)) {
+        const item = value ?? {};
+        const auth = item.auth;
+        if (!isAccountAuthKind(auth))
+            throw new Error(`Account '${key}' has unsupported auth kind '${String(auth)}'.`);
+        const id = String(item.id ?? key);
+        const name = String(item.name ?? '');
+        assertName(name);
+        const provider = String(item.provider ?? '');
+        const legacySecretRef = String(item.secretRef ?? `agents-cli.accounts.${id}.credential`);
+        retiredSecretItems.push(legacySecretRef);
+        if (bundleExists(name)) {
+            const existing = parseAccountBundle(readBundle(name));
+            if (!existing || existing.id !== id) {
+                throw new Error(`Cannot migrate account '${name}': a different secrets bundle already uses that name.`);
+            }
+            continue; // already migrated on an earlier, interrupted run
+        }
+        const baseUrl = item.baseUrl ? String(item.baseUrl) : undefined;
+        const record = { id, name, provider, auth, baseUrl };
+        const secret = hasKeychainToken(legacySecretRef) ? getKeychainToken(legacySecretRef) : '';
+        const { bundle, items } = buildAccountBundle(record, secret || 'x');
+        if (!secret)
+            items.clear(); // no device-local secret: write metadata only
+        writeBundleWithItems(bundle, items);
+    }
+    // Success: the file's accounts all exist as bundles now. Archive it and drop
+    // the superseded per-account keychain items.
+    archiveLegacyFile(file, 'accounts.migrated.yaml');
+    for (const legacyItem of retiredSecretItems)
+        deleteKeychainToken(legacyItem);
+}
+function archiveLegacyFile(file, archiveName) {
+    const archived = path.join(path.dirname(file), archiveName);
+    if (fs.existsSync(archived))
+        fs.rmSync(archived, { force: true });
+    fs.renameSync(file, archived);
+}
+export function readAccountRegistry(base = getUserAgentsDir()) {
+    migrateLegacyRegistryFile(base);
+    const accounts = {};
+    for (const account of readAccountBundles())
+        accounts[account.id] = account;
+    return { version: 2, accounts };
+}
+export function findAccount(name, doc = readAccountRegistry()) {
+    return doc.accounts[name] ?? Object.values(doc.accounts).find(account => account.name === name) ?? null;
+}
+/** Explicit selection wins over a configured per-harness default. */
+export function resolveAccountSelection(explicit, agent, meta, opts = {}) {
+    if (explicit)
+        return explicit;
+    return opts.useDefault === false ? undefined : meta.accounts?.defaults?.[agent];
+}
+function profileConsumers(name, base) {
+    const dir = path.join(base, 'profiles');
+    if (!fs.existsSync(dir))
+        return [];
+    const consumers = [];
+    for (const file of fs.readdirSync(dir).filter(value => /\.ya?ml$/.test(value))) {
+        const raw = yaml.parse(fs.readFileSync(path.join(dir, file), 'utf8'));
+        if (raw?.account === name)
+            consumers.push(file.replace(/\.ya?ml$/, ''));
+    }
+    return consumers.sort();
+}
+function renameProfileConsumers(oldName, newName, base) {
+    const dir = path.join(base, 'profiles');
+    for (const profile of profileConsumers(oldName, base)) {
+        const file = path.join(dir, `${profile}.yml`);
+        const yamlFile = fs.existsSync(file) ? file : path.join(dir, `${profile}.yaml`);
+        const raw = yaml.parse(fs.readFileSync(yamlFile, 'utf8'));
+        raw.account = newName;
+        atomicWriteFileSync(yamlFile, yaml.stringify(raw));
+    }
+}
+export function addAccount(name, provider, auth, secret, base = getUserAgentsDir(), opts = {}) {
+    assertName(name);
+    const adapter = getAccountProvider(provider);
+    adapter.validate(auth, secret);
+    if (bundleExists(name))
+        throw new Error(`Secrets bundle '${name}' already exists. Choose a different account name.`);
+    if (findAccount(name, readAccountRegistry(base)))
+        throw new Error(`Account '${name}' already exists.`);
+    const record = { id: crypto.randomUUID(), name, provider: adapter.provider, auth, baseUrl: opts.baseUrl };
+    const { bundle, items } = buildAccountBundle(record, secret);
+    writeBundleWithItems(bundle, items);
+    return toCredentialAccount(record);
+}
+export function setAccountSecret(name, secret, base = getUserAgentsDir()) {
+    const account = findAccount(name, readAccountRegistry(base));
+    if (!account)
+        throw new Error(`Unknown account '${name}'.`);
+    getAccountProvider(account.provider).validate(account.auth, secret);
+    const record = { id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl };
+    const { bundle, items } = buildAccountBundle(record, secret);
+    bundle.created_at = readBundle(account.name).created_at; // rotate the secret, keep the bundle's birth time
+    writeBundleWithItems(bundle, items);
+}
+export function renameAccount(oldName, newName, base = getUserAgentsDir()) {
+    assertName(newName);
+    const doc = readAccountRegistry(base);
+    const account = findAccount(oldName, doc);
+    if (!account)
+        throw new Error(`Unknown account '${oldName}'.`);
+    if (findAccount(newName, doc))
+        throw new Error(`Account '${newName}' already exists.`);
+    renameBundle(account.name, newName); // moves metadata + secret, preserves ACCOUNT_ID
+    renameProfileConsumers(account.name, newName, base);
+}
+export function removeAccount(name, base = getUserAgentsDir()) {
+    const account = findAccount(name, readAccountRegistry(base));
+    if (!account)
+        throw new Error(`Unknown account '${name}'.`);
+    const consumers = [...new Set([...profileConsumers(account.name, base), ...profileConsumers(account.id, base)])].sort();
+    if (consumers.length)
+        throw new Error(`Account '${account.name}' is used by harness${consumers.length === 1 ? '' : 'es'}: ${consumers.join(', ')}. Reassign them before removing it.`);
+    deleteKeychainToken(account.secretRef);
+    deleteBundle(account.name);
+}
+export function inspectAccount(name, base = getUserAgentsDir()) {
+    const account = findAccount(name, readAccountRegistry(base));
+    if (!account)
+        throw new Error(`Unknown account '${name}'.`);
+    const bundle = readBundle(account.name);
+    if (bundle.policy !== 'never')
+        throw new Error(`Account bundle '${account.name}' must use secrets policy 'never'.`);
+    return { ...account, secretPresent: hasKeychainToken(account.secretRef), policy: bundle.policy };
+}
+export function resolveCredentialAccount(name, host, expectedProvider, base = getUserAgentsDir()) {
+    const account = findAccount(name, readAccountRegistry(base));
+    if (!account)
+        throw new Error(`Unknown account '${name}'.`);
+    if (expectedProvider && account.provider !== expectedProvider)
+        throw new Error(`Account '${account.name}' uses provider '${account.provider}', but this harness requires '${expectedProvider}'.`);
+    const adapter = getAccountProvider(account.provider);
+    if (account.auth === 'setup-token' && (account.provider !== 'anthropic' || host !== 'claude')) {
+        throw new Error(`Provider '${account.provider}' cannot use a setup-token with the ${host} harness.`);
+    }
+    const envVar = account.auth === 'setup-token' ? 'CLAUDE_CODE_OAUTH_TOKEN' : adapter.envFor(host, account.auth);
+    if (!hasKeychainToken(account.secretRef))
+        throw new Error(`Credential for account '${account.name}' is missing on this device. Add it with 'agents accounts set-key ${account.name}'.`);
+    const connectionEnv = { ...adapter.connectionEnvFor(host) };
+    if (account.baseUrl) {
+        const baseUrlEnv = adapter.baseUrlEnvFor(host);
+        if (!baseUrlEnv)
+            throw new Error(`Account '${account.name}' has a base URL override, but provider '${account.provider}' cannot apply it to the ${host} harness.`);
+        connectionEnv[baseUrlEnv] = account.baseUrl;
+    }
+    return {
+        id: account.id,
+        name: account.name,
+        provider: account.provider,
+        auth: account.auth,
+        env: { ...connectionEnv, [envVar]: getKeychainToken(account.secretRef) },
+    };
+}

package/dist/lib/account-schema.d.ts

@@ -0,0 +1,44 @@
+import type { SecretsBundle } from './secrets/bundles.js';
+import type { AccountAuthKind } from './account-provider-registry.js';
+/** Canonical bundle variable names for a provider-account bundle. */
+export declare const ACCOUNT_VARS: {
+    readonly id: "ACCOUNT_ID";
+    readonly provider: "PROVIDER";
+    readonly authType: "AUTH_TYPE";
+    readonly baseUrl: "BASE_URL";
+    readonly apiKey: "API_KEY";
+    readonly token: "TOKEN";
+};
+/**
+ * Account bundles are stored with the `never` prompt policy: no biometry ACL,
+ * so reads are silent and the bundle syncs across the fleet without Touch ID.
+ */
+export declare const ACCOUNT_POLICY: "never";
+/** The parsed identity of an account, independent of where its bytes live. */
+export interface AccountSchemaRecord {
+    id: string;
+    name: string;
+    provider: string;
+    auth: AccountAuthKind;
+    baseUrl?: string;
+}
+/** The single secret var name that carries the credential for an auth kind. */
+export declare function secretVarFor(auth: AccountAuthKind): 'API_KEY' | 'TOKEN';
+/** The keychain item that stores an account bundle's secret value. */
+export declare function accountSecretItem(name: string, auth: AccountAuthKind): string;
+/**
+ * Build the canonical account bundle plus the keychain item map holding its
+ * secret. The identity vars are literals; the secret var is a `keychain:` ref
+ * whose value lives in the returned item map, ready for `writeBundleWithItems`.
+ */
+export declare function buildAccountBundle(record: AccountSchemaRecord, secret: string): {
+    bundle: SecretsBundle;
+    items: Map<string, string>;
+};
+/**
+ * Parse an account record from a bundle, or null when the bundle is not an
+ * account bundle (missing ACCOUNT_ID / PROVIDER / a known AUTH_TYPE). The
+ * catalog uses the null return to keep ordinary secrets bundles out of the
+ * account list.
+ */
+export declare function parseAccountBundle(bundle: SecretsBundle): AccountSchemaRecord | null;

package/dist/lib/account-schema.js

@@ -0,0 +1,91 @@
+/**
+ * Canonical on-disk shape of a provider credential account.
+ *
+ * RUSH-2470 makes a `agents secrets` bundle the single source of truth for a
+ * credential account: one account IS one bundle. The bundle's label is the
+ * account name; its variables carry the account's identity plus its secret:
+ *
+ *   ACCOUNT_ID   the stable UUID (a literal, survives rename)
+ *   PROVIDER     the provider id (a literal, e.g. 'openrouter')
+ *   AUTH_TYPE    'api-key' | 'setup-token' | 'bearer-token' (a literal)
+ *   BASE_URL     optional endpoint override (a literal)
+ *   API_KEY      the secret, for AUTH_TYPE 'api-key'      (a keychain ref)
+ *   TOKEN        the secret, for setup-token/bearer-token (a keychain ref)
+ *
+ * The identity vars are non-secret literals stored inline in the bundle
+ * metadata; only API_KEY / TOKEN reference a keychain-backed value. Account
+ * bundles use the `never` prompt policy so their values carry no biometry ACL
+ * and sync (and read headlessly) with no Touch ID — the whole point of the
+ * change. This module is pure: it builds a bundle from a record and parses a
+ * record back out, with no I/O. The registry ([[account-registry]]) owns
+ * reads and writes; the catalog ([[account-catalog]]) owns discovery.
+ */
+import { parseBundleValue, secretsKeychainItem } from './secrets/index.js';
+/** Canonical bundle variable names for a provider-account bundle. */
+export const ACCOUNT_VARS = {
+    id: 'ACCOUNT_ID',
+    provider: 'PROVIDER',
+    authType: 'AUTH_TYPE',
+    baseUrl: 'BASE_URL',
+    apiKey: 'API_KEY',
+    token: 'TOKEN',
+};
+/**
+ * Account bundles are stored with the `never` prompt policy: no biometry ACL,
+ * so reads are silent and the bundle syncs across the fleet without Touch ID.
+ */
+export const ACCOUNT_POLICY = 'never';
+/** The single secret var name that carries the credential for an auth kind. */
+export function secretVarFor(auth) {
+    return auth === 'api-key' ? ACCOUNT_VARS.apiKey : ACCOUNT_VARS.token;
+}
+/** The keychain item that stores an account bundle's secret value. */
+export function accountSecretItem(name, auth) {
+    return secretsKeychainItem(name, secretVarFor(auth));
+}
+/** Read a bundle var as a literal string, or undefined if it is a secret ref. */
+function literalOf(raw) {
+    if (raw === undefined)
+        return undefined;
+    const parsed = parseBundleValue(raw);
+    return 'literal' in parsed ? parsed.literal : undefined;
+}
+function isAccountAuthKind(value) {
+    return value === 'api-key' || value === 'setup-token' || value === 'bearer-token';
+}
+/**
+ * Build the canonical account bundle plus the keychain item map holding its
+ * secret. The identity vars are literals; the secret var is a `keychain:` ref
+ * whose value lives in the returned item map, ready for `writeBundleWithItems`.
+ */
+export function buildAccountBundle(record, secret) {
+    const secretVar = secretVarFor(record.auth);
+    const vars = {
+        [ACCOUNT_VARS.id]: record.id,
+        [ACCOUNT_VARS.provider]: record.provider,
+        [ACCOUNT_VARS.authType]: record.auth,
+        [secretVar]: `keychain:${secretVar}`,
+    };
+    // Wrap BASE_URL as an escaped literal so a URL that happens to start with a
+    // ref prefix (e.g. 'env://…') is never misread as a secret reference.
+    if (record.baseUrl)
+        vars[ACCOUNT_VARS.baseUrl] = { value: record.baseUrl };
+    const bundle = { name: record.name, policy: ACCOUNT_POLICY, vars };
+    const items = new Map([[secretsKeychainItem(record.name, secretVar), secret]]);
+    return { bundle, items };
+}
+/**
+ * Parse an account record from a bundle, or null when the bundle is not an
+ * account bundle (missing ACCOUNT_ID / PROVIDER / a known AUTH_TYPE). The
+ * catalog uses the null return to keep ordinary secrets bundles out of the
+ * account list.
+ */
+export function parseAccountBundle(bundle) {
+    const id = literalOf(bundle.vars[ACCOUNT_VARS.id]);
+    const provider = literalOf(bundle.vars[ACCOUNT_VARS.provider]);
+    const auth = literalOf(bundle.vars[ACCOUNT_VARS.authType]);
+    if (!id || !provider || !isAccountAuthKind(auth))
+        return null;
+    const baseUrl = literalOf(bundle.vars[ACCOUNT_VARS.baseUrl]);
+    return { id, name: bundle.name, provider, auth, baseUrl };
+}

package/dist/lib/account-state-service.d.ts

@@ -0,0 +1,21 @@
+/** Device-local owner for usage snapshots and authentication health. */
+export declare const USAGE_STATE_TICK_MS = 60000;
+export declare const AUTH_STATE_TICK_MS: number;
+export interface AccountStateService {
+    stop(): void;
+}
+export interface AccountStateServiceDeps {
+    refreshUsage: () => Promise<void>;
+    refreshAuth: () => Promise<void>;
+    onError?: (area: 'usage' | 'auth', error: unknown) => void;
+    setInterval?: typeof globalThis.setInterval;
+    clearInterval?: typeof globalThis.clearInterval;
+}
+/**
+ * Start the daemon-owned account-state loops.
+ *
+ * Each loop is overlap-safe within the daemon. Provider-level work is also
+ * guarded by the cross-process refresh lease, so an explicit CLI refresh and
+ * an older routine process converge on the same published result.
+ */
+export declare function startAccountStateService(deps: AccountStateServiceDeps): AccountStateService;

package/dist/lib/account-state-service.js

@@ -0,0 +1,60 @@
+/** Device-local owner for usage snapshots and authentication health. */
+export const USAGE_STATE_TICK_MS = 60_000;
+export const AUTH_STATE_TICK_MS = 3 * 60_000;
+/**
+ * Start the daemon-owned account-state loops.
+ *
+ * Each loop is overlap-safe within the daemon. Provider-level work is also
+ * guarded by the cross-process refresh lease, so an explicit CLI refresh and
+ * an older routine process converge on the same published result.
+ */
+export function startAccountStateService(deps) {
+    const setTimer = deps.setInterval ?? globalThis.setInterval;
+    const clearTimer = deps.clearInterval ?? globalThis.clearInterval;
+    let usageRunning = false;
+    let authRunning = false;
+    let stopped = false;
+    const runUsage = async () => {
+        if (stopped || usageRunning)
+            return;
+        usageRunning = true;
+        try {
+            await deps.refreshUsage();
+        }
+        catch (error) {
+            deps.onError?.('usage', error);
+        }
+        finally {
+            usageRunning = false;
+        }
+    };
+    const runAuth = async () => {
+        if (stopped || authRunning)
+            return;
+        authRunning = true;
+        try {
+            await deps.refreshAuth();
+        }
+        catch (error) {
+            deps.onError?.('auth', error);
+        }
+        finally {
+            authRunning = false;
+        }
+    };
+    const usageTimer = setTimer(() => { void runUsage(); }, USAGE_STATE_TICK_MS);
+    const authTimer = setTimer(() => { void runAuth(); }, AUTH_STATE_TICK_MS);
+    usageTimer.unref?.();
+    authTimer.unref?.();
+    void runUsage();
+    void runAuth();
+    return {
+        stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearTimer(usageTimer);
+            clearTimer(authTimer);
+        },
+    };
+}

package/dist/lib/activity.d.ts

@@ -7,7 +7,7 @@ export type MilestoneEvent = 'plan.created' | 'pr.opened' | 'pr.merged' | 'workt
 /** Deliberate agent-authored progress post (`agents feed post`). */
  | 'status.posted'
 /**
- * An agent terminal spawned from the Factory VS Code extension. A milestone
+ * An agent terminal spawned from AGI EXT, the VS Code extension. A milestone
  * because it is the BIRTH of a session — it carries the sessionId and the
  * terminalId that every later event on that session joins through, the same
  * way `subagent.spawned` roots a sub-agent. Written out of process by