@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/commands/{login.js → secrets-vault.js}

@@ -1,7 +1,15 @@
+/**
+ * `agents secrets vault` — unlock/lock the age-encrypted synced-secrets file
+ * at ~/.agents/vault.age (distinct from `agents secrets unlock|lock`, which
+ * holds keychain bundles in the secrets-agent).
+ *
+ * Formerly top-level `agents login` / `agents logout`.
+ */
 import chalk from 'chalk';
 import * as fs from 'fs';
 import { readStdinSync } from '../lib/format.js';
 import { clearVaultKey, createVault, getVaultSession, joinVault, unlock, vaultExists, vaultPath, } from '../lib/secrets/vault.js';
+import { setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 async function promptPassword(message) {
     if (!isInteractiveTerminal()) {
@@ -19,7 +27,7 @@ async function readPassword(opts, message) {
     }
     return promptPassword(message);
 }
-async function chooseFreshLoginMode(opts) {
+async function chooseFreshMode(opts) {
     if (opts.create && opts.join)
         throw new Error('--create and --join are mutually exclusive.');
     if (opts.create)
@@ -31,10 +39,10 @@ async function chooseFreshLoginMode(opts) {
     }
     const { select } = await import('@inquirer/prompts');
     return select({
-        message: 'No synced secrets login found. What do you want to do?',
+        message: 'No synced secrets vault found. What do you want to do?',
         choices: [
-            { name: 'Create a new login', value: 'create' },
-            { name: 'Join with an existing synced secrets file', value: 'join' },
+            { name: 'Create a new vault', value: 'create' },
+            { name: 'Join with an existing vault.age file', value: 'join' },
         ],
     });
 }
@@ -51,9 +59,21 @@ function formatRemaining(expiresAt) {
     const days = Math.round(hours / 24);
     return `${days} day${days === 1 ? '' : 's'}`;
 }
-export function registerLoginCommands(program) {
-    program
-        .command('login')
+/** Register `agents secrets vault unlock|lock` under the secrets parent. */
+export function registerSecretsVaultCommands(secretsCmd) {
+    const vault = secretsCmd
+        .command('vault')
+        .description('Unlock or lock the age-encrypted synced-secrets file (~/.agents/vault.age)');
+    setHelpSections(vault, {
+        examples: `agents secrets vault unlock
+agents secrets vault unlock --create
+agents secrets vault unlock --join ~/Downloads/vault.age
+agents secrets vault lock`,
+        notes: `This is the synced vault passphrase cache — not \`agents secrets unlock\`, which holds keychain bundles in the secrets-agent after Touch ID.
+Harness OAuth sign-out is \`agents accounts logout\` (OAuth native logins only).`,
+    });
+    vault
+        .command('unlock')
         .description('Unlock synced secrets for this shell session')
         .option('--create', 'Create a new encrypted synced-secrets file at ~/.agents/vault.age')
         .option('--join <path>', 'Copy and unlock an existing vault.age file')
@@ -69,10 +89,10 @@ export function registerLoginCommands(program) {
                 unlock(password);
                 const session = getVaultSession();
                 const ttl = session.loggedIn ? formatRemaining(session.expiresAt) : '8 hours';
-                console.log(chalk.green(`Logged in. Synced secrets unlocked for ${ttl}.`));
+                console.log(chalk.green(`Unlocked. Synced secrets available for ${ttl}.`));
                 return;
             }
-            const mode = await chooseFreshLoginMode(opts);
+            const mode = await chooseFreshMode(opts);
             if (mode === 'join') {
                 let source = opts.join;
                 if (!source) {
@@ -86,12 +106,12 @@ export function registerLoginCommands(program) {
                 }
                 const password = await readPassword(opts, 'Master password');
                 joinVault(password, source, { overwrite: opts.force });
-                console.log(chalk.green(`Logged in. Copied synced secrets file to ${vaultPath()}.`));
+                console.log(chalk.green(`Unlocked. Copied synced secrets file to ${vaultPath()}.`));
                 return;
             }
             const password = await readPassword(opts, 'Choose a master password');
             createVault(password, { overwrite: opts.force });
-            console.log(chalk.green(`Logged in. Created synced secrets file at ${vaultPath()}.`));
+            console.log(chalk.green(`Unlocked. Created synced secrets file at ${vaultPath()}.`));
         }
         catch (err) {
             if (isPromptCancelled(err))
@@ -100,11 +120,11 @@ export function registerLoginCommands(program) {
             process.exit(1);
         }
     });
-    program
-        .command('logout')
+    vault
+        .command('lock')
         .description('Forget the cached synced-secrets key')
         .action(() => {
         clearVaultKey();
-        console.log(chalk.green('Logged out. Synced secrets are locked.'));
+        console.log(chalk.green('Locked. Synced secrets require unlock again.'));
     });
 }

package/dist/commands/secrets.d.ts

@@ -17,7 +17,7 @@ import { type BundleUsageSummary } from '../lib/secrets/usage-db.js';
 /** Read all available data from stdin synchronously, trimmed. */
 /**
  * Read the raw `.env` text for `import --from <path|->`. A `-` reads the .env
- * from stdin (the SSH push path: `export --host` pipes the resolved dotenv over
+ * from stdin (the SSH push path: `export --device` pipes the resolved dotenv over
  * ssh stdin, which has no `/dev/stdin` on a Windows remote); any other value is
  * a filesystem path.
  */
@@ -45,7 +45,7 @@ export declare function parseImportSource(opts: {
     vault?: string;
 }): ImportSource;
 /**
- * Build the remote `agents secrets unlock` argv for `unlock --host`. `--all`
+ * Build the remote `agents secrets unlock` argv for `unlock --device`. `--all`
  * forwards verbatim; otherwise the explicit bundle names. A `--ttl` is passed
  * through as-is so the REMOTE parses its own duration (its platform rules, its
  * defaults). Shared with the command action so the wiring is unit-testable
@@ -78,10 +78,10 @@ export declare function buildRemoteUnlockArgs(names: string[], opts: {
     durable?: boolean;
 }): string[];
 /**
- * Build the remote `agents secrets list` argv for `list --host`. Every filter
+ * Build the remote `agents secrets list` argv for `list --device`. Every filter
  * must be forwarded: `browseRemote` sends this argv verbatim, so a flag left out
  * here is not an error — the remote just lists everything, and
- * `secrets list --host zion --expired` reports every bundle on zion as expired.
+ * `secrets list --device zion --expired` reports every bundle on zion as expired.
  * Silent and wrong beats loud and wrong only for the person who wrote the bug.
  *
  * Values pass through unparsed so the REMOTE validates them under its own rules,