@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/commands/secrets.js

@@ -14,11 +14,11 @@ import * as os from 'os';
 import * as path from 'path';
 import { SSH_TARGET_RE, assertValidSshTarget } from '../lib/ssh-exec.js';
 import { quoteWin32ExecArg, composeWin32CommandLine } from '../lib/platform/index.js';
-import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
+import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, } from '../lib/secrets/remote.js';
 import { resolveBundleForPush, pushResolvedBundleToHost, bundleEnvToDotenv } from '../lib/secrets/push.js';
 export { bundleEnvToDotenv };
-import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, isHeadlessSecretsContext, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, isHeadlessSecretsContext, isAgentInvocationContext, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
 import { parseListFilters, bundleMatchesFilter, bundleExpiry, filterIsActive, describeFilter, parseSortField, sortBundles, SORT_FIELDS, REF_KINDS, DEFAULT_EXPIRING_DAYS, } from '../lib/secrets/list-filter.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, maybeAutoRekey, } from '../lib/secrets/index.js';
@@ -30,7 +30,7 @@ import { saveSession, deleteBundleSessions, deleteAllSessions } from '../lib/sec
 import { getCliVersionFresh } from '../lib/version.js';
 import { readMeta } from '../lib/state.js';
 import { parseDuration } from '../lib/hooks/cache.js';
-import { emit, query } from '../lib/events.js';
+import { emit, query } from '../lib/feed/events.js';
 import { emitSecretAudit } from '../lib/secrets/audit.js';
 import { SYNC_PASSPHRASE_ENV, resolveSyncPassphraseFromEnv } from '../lib/secrets/sync-passphrase.js';
 import { getBundleUsage, getAllBundleUsage, getUsageHistory, SECRET_USAGE_EVENTS, } from '../lib/secrets/usage-db.js';
@@ -38,11 +38,11 @@ import { frequentlyPromptedBundles } from '../lib/secrets/unlock-hints.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { discoverSyncedBundles, importSyncedBundle, } from '../lib/secrets/icloud-import.js';
-import { getVaultSession, vaultExists } from '../lib/secrets/vault.js';
 import { registerSecretsSyncCommands } from './secrets-sync.js';
 import { registerSecretsMigrateAclCommand } from './secrets-migrate.js';
 import { registerSecretsImportKeyringCommand } from './secrets-import.js';
 import { registerSecretsRotatePassphraseCommand } from './secrets-rotate-passphrase.js';
+import { registerSecretsVaultCommands } from './secrets-vault.js';
 /** Prompt the user for a secret value with masked input. Requires an interactive TTY. */
 async function promptForSecret(message) {
     if (!isInteractiveTerminal()) {
@@ -144,7 +144,7 @@ async function resolveVault(vaultOpt) {
 /** Read all available data from stdin synchronously, trimmed. */
 /**
  * Read the raw `.env` text for `import --from <path|->`. A `-` reads the .env
- * from stdin (the SSH push path: `export --host` pipes the resolved dotenv over
+ * from stdin (the SSH push path: `export --device` pipes the resolved dotenv over
  * ssh stdin, which has no `/dev/stdin` on a Windows remote); any other value is
  * a filesystem path.
  */
@@ -262,7 +262,7 @@ function maybePrintSyncedHint(name, stillPresent) {
     }
 }
 /**
- * Build the remote `agents secrets unlock` argv for `unlock --host`. `--all`
+ * Build the remote `agents secrets unlock` argv for `unlock --device`. `--all`
  * forwards verbatim; otherwise the explicit bundle names. A `--ttl` is passed
  * through as-is so the REMOTE parses its own duration (its platform rules, its
  * defaults). Shared with the command action so the wiring is unit-testable
@@ -323,10 +323,10 @@ export function buildRemoteUnlockArgs(names, opts) {
     ];
 }
 /**
- * Build the remote `agents secrets list` argv for `list --host`. Every filter
+ * Build the remote `agents secrets list` argv for `list --device`. Every filter
  * must be forwarded: `browseRemote` sends this argv verbatim, so a flag left out
  * here is not an error — the remote just lists everything, and
- * `secrets list --host zion --expired` reports every bundle on zion as expired.
+ * `secrets list --device zion --expired` reports every bundle on zion as expired.
  * Silent and wrong beats loud and wrong only for the person who wrote the bug.
  *
  * Values pass through unparsed so the REMOTE validates them under its own rules,
@@ -923,14 +923,17 @@ export function registerSecretsCommands(program) {
       # Stop a noisy automation bundle from prompting every run: ask once a week
       agents secrets policy prod hold
 
-      # Eval the bundle into your current shell
-      eval "$(agents secrets export prod --plaintext)"
+      # Run a one-off command with secrets injected (values ride the child env, never stdout)
+      agents secrets exec prod -- ./deploy.sh
 
-      # Push the bundle to remote machine(s) over SSH (lands as a native bundle there)
-      agents secrets export prod --host yosemite-s0 --host yosemite-s1 --force
+      # Need one value inside a script? Read it under injection, not with a printer
+      agents secrets exec prod -- printenv STRIPE_API_KEY
 
-      # Run a one-off command with secrets injected
-      agents secrets exec prod -- ./deploy.sh
+      # Deliberately reveal values at your terminal (interactive only)
+      agents secrets view prod --reveal
+
+      # Push the bundle to remote machine(s) over SSH (lands as a native bundle there)
+      agents secrets export prod --device yosemite-s0 --device yosemite-s1 --force
     `,
         notes: `
       Bundles are containers; secrets are the variables inside them. Keychain values
@@ -983,15 +986,15 @@ export function registerSecretsCommands(program) {
         { title: 'Raw item commands', names: ['get', 'set'] },
         { title: 'Sync commands', names: ['push', 'pull', 'remote-list'] },
         { title: 'Utilities', names: ['exec', 'mcp', 'generate', 'migrate-acl'] },
+        { title: 'Synced vault', names: ['vault'] },
     ]);
+    registerSecretsVaultCommands(cmd);
     const listCmd = cmd
         .command('list [query]')
         .alias('ls')
-        .description('List configured secrets bundles, optionally filtered (use --host/--hosts for other machines over SSH)')
-        .option('--host <target>', 'List bundles on a remote host over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
-        .option('--hosts <list>', 'Comma-separated hosts to list in one shot, e.g. yosemite-s0,yosemite-s1')
-        .option('--device <target>', 'Alias for --host')
-        .option('--devices <list>', 'Alias for --hosts')
+        .description('List configured secrets bundles, optionally filtered (use --device/--devices for other machines over SSH)')
+        .option('--device <target>', 'List bundles on a remote device over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
+        .option('--devices <list>', 'Comma-separated devices to list in one shot, e.g. yosemite-s0,yosemite-s1')
         .option('--json', 'Emit machine-readable JSON (bundle metadata only — never secret values) instead of the table')
         .option('--policy <list>', "Only these prompt policies (comma-separated): hold, always, never. '--policy never' is the audit for bundles that read with no Touch ID at all")
         .option('--backend <list>', 'Only these backends (comma-separated): keychain, file, vault')
@@ -1005,7 +1008,7 @@ export function registerSecretsCommands(program) {
         .addOption(new Option('--sort <field>', 'Sort by: name (default), used (most recently used), uses (most frequently accessed), created, updated, expiry').choices([...SORT_FIELDS]))
         .option('-n, --limit <n>', 'Show at most this many bundles (after filtering and sorting)')
         .action(async (query, opts) => {
-        const targets = parseHostsOption(opts);
+        const targets = parseHostsOption({ device: opts.device, devices: opts.devices });
         if (targets.length > 0) {
             // Forward the filters — browseRemote sends this argv verbatim, so a
             // dropped flag would make the remote silently list everything.
@@ -1028,7 +1031,7 @@ export function registerSecretsCommands(program) {
             // hold-state filter would answer from no data — every bundle would look
             // not-held. Refuse rather than return a confidently wrong list.
             if (filter.held !== undefined && process.platform !== 'darwin') {
-                throw new Error('--held/--not-held need the secrets-agent, which is macOS-only. Run it on a Mac, or with --host <mac>.');
+                throw new Error('--held/--not-held need the secrets-agent, which is macOS-only. Run it on a Mac, or with --device <mac>.');
             }
         }
         catch (err) {
@@ -1160,16 +1163,16 @@ export function registerSecretsCommands(program) {
       agents secrets list --policy hold --backend file --expiring
 
       # Same filters, on another machine, machine-readable
-      agents secrets list --expired --host mac-mini --json
+      agents secrets list --expired --device mac-mini --json
     `,
         notes: `
       - Filters compose: every flag you add narrows the list further.
       - An unknown value is an error, not an empty list — '--policy hodl' names the valid set.
-      - --held/--not-held read live broker state, so they need macOS. Use --host <mac> from elsewhere.
+      - --held/--not-held read live broker state, so they need macOS. Use --device <mac> from elsewhere.
       - --expired and --expiring are different questions: already lapsed vs coming due. The EXPIRING column counts both and turns red once anything has lapsed.
       - --unused matches bundles never read at all, not just old ones.
       - Filters apply before --json, so the JSON is the exact twin of the table.
-      - Filters are forwarded over --host, so a remote list narrows the same way.
+      - Filters are forwarded over --device, so a remote list narrows the same way.
       - --sort used|uses read the value-free usage read-model (~/.agents/secrets/secrets.db); see 'agents secrets activity'.
     `,
     });
@@ -1221,16 +1224,23 @@ export function registerSecretsCommands(program) {
         .command('view [name]')
         .alias('show')
         .description('Show a bundle. Keychain values are masked by default — pass --reveal to see them.')
-        .option('--reveal', 'Print keychain-backed values in the clear (TTY only unless --plaintext)')
-        .option('--plaintext', 'Allow --reveal in non-interactive shells (use with care)')
+        .option('--reveal', 'Print keychain-backed values in the clear (interactive terminal only)')
         .option('--json', 'Emit machine-readable JSON (values masked unless --reveal) instead of the human view')
-        .option('--host <target>', 'Show a bundle on a remote host over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
-        .option('--hosts <list>', 'Comma-separated hosts to show in one shot, e.g. yosemite-s0,yosemite-s1')
-        .option('--device <target>', 'Alias for --host')
-        .option('--devices <list>', 'Alias for --hosts')
+        .option('--device <target>', 'Show a bundle on a remote device over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
+        .option('--devices <list>', 'Comma-separated devices to show in one shot, e.g. yosemite-s0,yosemite-s1')
         .action(async (name, opts) => {
         try {
-            const targets = parseHostsOption(opts);
+            // `--reveal` is a deliberate HUMAN reveal: interactive terminal only, and
+            // never inside an agent session (an agent under tmux has a TTY, so the
+            // env markers are the load-bearing check). The old `--plaintext` escape
+            // that allowed a piped/non-TTY reveal is removed (RUSH-2774) — printed
+            // values land in an agent's context and session transcript.
+            if (opts.reveal && (isAgentInvocationContext() || !isInteractiveTerminal())) {
+                console.error(chalk.red('--reveal prints values in the clear and needs a real interactive terminal outside an agent session.'));
+                console.error(chalk.dim('Run the consuming command under injection instead: agents secrets exec <bundle> -- <cmd>'));
+                process.exit(1);
+            }
+            const targets = parseHostsOption({ device: opts.device, devices: opts.devices });
             if (targets.length > 0) {
                 if (!name) {
                     console.error(chalk.red('A bundle name is required when viewing a remote host (interactive pick needs a local terminal).'));
@@ -1239,14 +1249,13 @@ export function registerSecretsCommands(program) {
                 const args = ['view', name];
                 if (opts.reveal)
                     args.push('--reveal');
-                if (opts.plaintext)
-                    args.push('--plaintext');
                 if (opts.json)
                     args.push('--json');
                 // With --reveal, force a TTY so the remote keychain prompt can surface
-                // (and the remote's "--reveal in a non-TTY needs --plaintext" gate is
-                // satisfied) — only when this side is itself interactive.
-                const tty = Boolean(opts.reveal) && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+                // and the remote's own interactive-terminal gate is satisfied. The
+                // early gate above already proved this side is an interactive,
+                // non-agent terminal.
+                const tty = Boolean(opts.reveal);
                 // `--reveal` streams the plaintext value back over ssh stdout — a
                 // secret-bearing read that must pin the host key and not multiplex,
                 // whether it runs on the interactive (tty) or `--plaintext` non-tty path.
@@ -1289,14 +1298,10 @@ export function registerSecretsCommands(program) {
             emitSecretAudit({ event: 'secrets.view', bundle: bundle.name, operation: opts.json ? 'view --json' : 'view', source: 'view', status: 'success' });
             if (opts.json) {
                 // Machine-readable discovery for agents. Values are null unless --reveal
-                // (which still routes through the same non-TTY/plaintext gate + audit
-                // event as the human path). Gated on the explicit flag, not stdout.isTTY,
-                // so a piped human view never silently swaps formats.
+                // (already gated above: interactive terminal, outside an agent session).
+                // Gated on the explicit flag, not stdout.isTTY, so a piped human view
+                // never silently swaps formats.
                 const reveal = Boolean(opts.reveal);
-                if (reveal && !isInteractiveTerminal() && !opts.plaintext) {
-                    console.error(chalk.red('--reveal in a non-TTY requires --plaintext.'));
-                    process.exit(1);
-                }
                 const revealed = new Map();
                 if (reveal) {
                     const { env } = readAndResolveBundleEnv(bundle.name, {
@@ -1382,7 +1387,7 @@ export function registerSecretsCommands(program) {
             if (bundle.backend === 'file')
                 console.log(chalk.gray('backend: file (encrypted at rest; headless reads via a machine-local key, or AGENTS_SECRETS_PASSPHRASE if set — no Touch ID)'));
             if (bundle.backend === 'vault')
-                console.log(chalk.gray('storage: synced (age-encrypted ~/.agents/vault.age; needs agents login)'));
+                console.log(chalk.gray('storage: synced (age-encrypted ~/.agents/vault.age; needs `agents secrets vault unlock`)'));
             if (bundlePolicy(bundle) === 'never') {
                 console.log(chalk.red.bold('policy: never — NO biometry ACL; reads are silent (no Touch ID, no user-presence check). Automation-only.'));
             }
@@ -1416,10 +1421,6 @@ export function registerSecretsCommands(program) {
                 return;
             }
             const reveal = Boolean(opts.reveal);
-            if (reveal && !isInteractiveTerminal() && !opts.plaintext) {
-                console.error(chalk.red('--reveal in a non-TTY requires --plaintext.'));
-                process.exit(1);
-            }
             // An explicit human `view --reveal` at a terminal is a deliberate value
             // access: resolve interactively (one Touch ID) so a locked bundle shows
             // its values. Under an agent (AGENTS_RUNTIME) or headless (no TTY) it
@@ -1492,50 +1493,38 @@ export function registerSecretsCommands(program) {
     });
     cmd
         .command('get <item> [key]')
-        .description('Print one secret value for shell hooks/automation. One arg = a raw keychain item by name; two args = one KEY out of a bundle (`get <bundle> <KEY>`). Cross-platform.')
+        .description('Print one raw keychain item by name, for shell hooks/automation. Cross-platform. Bundle values are never printed — run commands under `agents secrets exec` instead.')
         .action((item, key) => {
-        if (key === undefined) {
-            // Raw keychain item path — unchanged.
-            try {
-                // Routes through the platform keychain layer: macOS reads bare items
-                // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
-                // encrypted-file fallback. The value goes to stdout (newline-terminated
-                // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
-                // to stderr so they never pollute the captured value.
-                const value = getKeychainToken(item);
-                // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
-                // `item` is the keychain service name, never the value.
-                emitSecretAudit({ event: 'secrets.get', item, source: 'raw-item', status: 'success' });
-                process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
-            }
-            catch {
-                // Missing item is a normal, quiet outcome for a hook probe: exit 1,
-                // print nothing to stdout. Callers test the exit code / empty capture.
-                process.exit(1);
-            }
-            return;
+        if (key !== undefined) {
+            // The bundle-key form (`get <bundle> <KEY>`) is REMOVED (RUSH-2774): a
+            // one-liner that prints a bundle credential is the exfiltration path
+            // this change closes, for every caller. The injection replacement is
+            // just as short for a human script and never touches this stdout.
+            console.error(chalk.red(`'secrets get <bundle> <KEY>' has been removed — printing a bundle value to stdout is the exfiltration path this blocks.`));
+            console.error(chalk.dim(`Use: agents secrets exec ${item} -- printenv ${key}   (or run the consuming command directly under exec)`));
+            process.exit(1);
         }
-        // Bundle-key path: `get <bundle> <KEY>` prints exactly one resolved value.
-        // Ungated like the raw path (it IS the automation primitive); the
-        // `secrets.get` audit event is emitted inside readAndResolveBundleEnv.
+        // Raw keychain item path — a single ad-hoc token, not a credential bundle.
+        // Deliberately NOT agent-gated (unlike the removed bundle-key form): shell
+        // hooks that run inside agent sessions inherit the session env markers and
+        // legitimately capture a raw item into their own variables (e.g. the
+        // posthog analytics hook), where the value never reaches the transcript.
+        // A single ad-hoc token is the accepted narrower residual (RUSH-2774).
         try {
-            if (!bundleExists(item) && !(vaultExists() && !getVaultSession().loggedIn)) {
-                console.error(chalk.red(`Secrets bundle '${item}' not found.`));
-                process.exit(1);
-            }
-            // `secrets get` is the scriptable automation primitive ($(agents secrets
-            // get bundle KEY)). Every read is broker-only; a locked bundle points at
-            // the explicit unlock command instead of raising Touch ID.
-            const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key], keyMode: 'storage', agentOnly: true });
-            if (!(key in env)) {
-                console.error(chalk.red(`Key '${key}' not in bundle '${item}'.`));
-                process.exit(1);
-            }
-            const value = env[key];
+            // Routes through the platform keychain layer: macOS reads bare items
+            // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
+            // encrypted-file fallback. The value goes to stdout (newline-terminated
+            // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
+            // to stderr so they never pollute the captured value.
+            const value = getKeychainToken(item);
+            // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
+            // `item` is the keychain service name, never the value.
+            emitSecretAudit({ event: 'secrets.get', item, source: 'raw-item', status: 'success' });
             process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
         }
-        catch (err) {
-            console.error(chalk.red(err.message));
+        catch {
+            // Missing item is a normal, quiet outcome for a hook probe: exit 1,
+            // print nothing to stdout. Callers test the exit code / empty capture.
             process.exit(1);
         }
     });
@@ -2019,12 +2008,28 @@ Examples:
         .option('--backend <backend>', 'When creating the bundle: keychain or file (defaults to agents.yaml secrets.backend)')
         .option('--synced', 'When creating the bundle, store it in the age-encrypted synced secrets file')
         .option('--force', 'Overwrite an existing key in the bundle')
+        .option('--policy <policy>', 'Set the bundle prompt policy as part of this import (always, hold, or never)')
+        .option('--i-understand', 'Confirm an import with policy never (no biometry ACL)')
         .option('--purge', 'With --from icloud: delete the iCloud copies after a successful import (iCloud propagates the deletion to your other devices)')
         .option('--from-file <path>', `Import from an AES-256-GCM encrypted offline bundle file (needs ${SYNC_PASSPHRASE_ENV}; symmetric counterpart of export --to-file)`)
-        .option('--from-ssh', 'Pull the bundle from a fleet peer over SSH and import it locally (requires --host)')
-        .option('--host <peer>', 'SSH peer to pull from when using --from-ssh (host alias or user@host)')
+        .option('--from-ssh', 'Pull the bundle from a fleet peer over SSH and import it locally (requires --device)')
+        .option('--device <peer>', 'SSH peer to pull from when using --from-ssh (device alias or user@host)')
         .action(async (bundleName, opts) => {
         try {
+            const importPolicy = opts.policy ? parsePolicyOpt(opts.policy) : undefined;
+            const policyAck = assertNeverPolicyAcknowledged(importPolicy, {
+                iUnderstand: opts.iUnderstand,
+                interactive: isInteractiveTerminal(),
+            });
+            if (policyAck === 'prompt' && !(await confirmNeverPolicyInteractive(bundleName ?? 'imported bundle'))) {
+                console.error(chalk.yellow('Aborted.'));
+                return;
+            }
+            const applyImportPolicy = (bundle) => {
+                if (importPolicy)
+                    bundle.policy = importPolicy;
+                return bundle;
+            };
             // A single import can name only one source. --from-file / --from-ssh are
             // early-return paths, so guard them against each other and the --from /
             // --from-1password pair (which parseImportSource guards on its own).
@@ -2043,24 +2048,24 @@ Examples:
                 }
                 const env = importBundleFromFile(opts.fromFile, passphrase);
                 const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
-                const bundle = resolveImportBundle(resolvedBundleName, opts.backend, opts.synced, opts.force);
+                const bundle = applyImportPolicy(resolveImportBundle(resolvedBundleName, opts.backend, opts.synced, opts.force));
                 const { added, skipped } = applyEnvToBundle(bundle, env, opts);
                 emitSecretAudit({ event: 'secrets.import', bundle: bundle.name, operation: 'import --from-file', source: 'file', status: 'success', keyCount: added });
                 console.log(chalk.green(`Imported ${added} key(s) from file${skipped ? `, skipped ${skipped} (already set, pass --force)` : ''}.`));
                 return;
             }
             if (opts.fromSsh) {
-                if (!opts.host) {
-                    throw new Error('--from-ssh requires --host <peer>.');
+                if (!opts.device) {
+                    throw new Error('--from-ssh requires --device <peer>.');
                 }
-                assertValidSshTarget(opts.host);
+                assertValidSshTarget(opts.device);
                 const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
-                const target = await resolveHostSshTarget(opts.host);
-                const env = await remoteResolveEnv(target, resolvedBundleName, { osLookupName: opts.host });
-                const bundle = resolveImportBundle(resolvedBundleName, opts.backend, opts.synced, opts.force);
+                const target = await resolveHostSshTarget(opts.device);
+                const env = await remoteResolveEnv(target, resolvedBundleName, { osLookupName: opts.device });
+                const bundle = applyImportPolicy(resolveImportBundle(resolvedBundleName, opts.backend, opts.synced, opts.force));
                 const { added, skipped } = applyEnvToBundle(bundle, env, opts);
-                emitSecretAudit({ event: 'secrets.import', bundle: bundle.name, operation: 'import --from-ssh', source: 'ssh', host: opts.host, status: 'success', keyCount: added });
-                console.log(chalk.green(`Imported ${added} key(s) from ${opts.host}${skipped ? `, skipped ${skipped} (already set, pass --force)` : ''}.`));
+                emitSecretAudit({ event: 'secrets.import', bundle: bundle.name, operation: 'import --from-ssh', source: 'ssh', host: opts.device, status: 'success', keyCount: added });
+                console.log(chalk.green(`Imported ${added} key(s) from ${opts.device}${skipped ? `, skipped ${skipped} (already set, pass --force)` : ''}.`));
                 return;
             }
             const source = parseImportSource(opts);
@@ -2083,9 +2088,9 @@ Examples:
             const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
             // resolveImportBundle inherits an existing bundle's backend (and refuses
             // to downgrade keychain -> file) or creates it with the requested backend
-            // so a single `import --backend file` works (what `export --host ...
+            // so a single `import --backend file` works (what `export --device ...
             // --remote-backend file` drives on the remote).
-            const bundle = resolveImportBundle(resolvedBundleName, opts.backend, opts.synced, opts.force);
+            const bundle = applyImportPolicy(resolveImportBundle(resolvedBundleName, opts.backend, opts.synced, opts.force));
             if (source.kind === '1password') {
                 assertOpAvailable();
                 const vault = await resolveVault(source.vault);
@@ -2118,24 +2123,23 @@ Examples:
     });
     cmd
         .command('export [bundle]')
-        .description('Resolve a bundle and print KEY=VALUE lines, push it to a 1Password vault with --to-1password, or push it to remote machine(s) over SSH with --host.')
-        .option('--plaintext', 'Acknowledge that the resolved values will be printed in the clear (shell export mode)')
+        .description('Move a bundle without exposing it: push to remote machine(s) over SSH with --device, to a 1Password vault with --to-1password, or to an encrypted file with --to-file.')
+        // Both transport flags are hidden, not documented: the ONLY caller is the
+        // machine-to-machine SSH resolve (remoteResolveEnv / verifyRemoteKeychainPush),
+        // which sets AGENTS_SECRETS_REMOTE_TRANSPORT=1 on the remote invocation. The
+        // old public shell-eval mode (`eval "$(agents secrets export … --plaintext)"`)
+        // was the top agent-exfiltration path and is removed (RUSH-2774).
+        .addOption(new Option('--plaintext', 'internal remote-resolve transport').hideHelp())
+        .addOption(new Option('--format <json>', 'internal remote-resolve transport').hideHelp())
         .option('--to-1password', 'Push every key in the bundle as a PASSWORD item in a 1Password vault')
         .option('--vault <name>', '1Password vault name (used with --to-1password)')
-        .option('--host <target...>', 'Push the bundle over SSH to this target (host alias or user@host); repeatable for multiple machines')
-        .option('--device <target...>', 'Alias for --host; repeatable')
-        .option('--remote-backend <backend>', 'Backend for the bundle on the remote (with --host): keychain (default) or file. file is headless-readable via the remote\'s machine-local key; it forwards AGENTS_SECRETS_PASSPHRASE over stdin only if set (opt-in).', 'keychain')
-        .option('--force', 'Overwrite existing keys/items on the target (used with --to-1password and --host)')
-        .option('--format <shell|json>', 'Output for --plaintext export: shell (default) or json (lossless, machine-readable; used by remote resolve)', 'shell')
+        .option('--device <target...>', 'Push the bundle over SSH to this device (host alias or user@host); repeatable for multiple machines')
+        .option('--remote-backend <backend>', 'Backend for the bundle on the remote device (with --device): keychain (default) or file. file is headless-readable via the remote\'s machine-local key; it forwards AGENTS_SECRETS_PASSPHRASE over stdin only if set (opt-in).', 'keychain')
+        .option('--force', 'Overwrite existing keys/items on the target (used with --to-1password and --device)')
         .option('--to-file <path>', `Write the bundle as an AES-256-GCM encrypted offline file (needs ${SYNC_PASSPHRASE_ENV}; symmetric counterpart of import --from-file)`)
         .action(async (bundleName, opts) => {
         try {
-            // `--device` is an alias for `--host` (fleet vocabulary parity with
-            // `agents run --device`); fold it into the host list up front so
-            // every downstream branch sees one resolved target list.
-            if (opts.device?.length)
-                opts.host = [...(opts.host ?? []), ...opts.device];
-            const { readAndResolveBundleEnv, bundleToEnvPrefix, isReservedEnvName } = await import('../lib/secrets/bundles.js');
+            const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
             const resolvedBundleName = bundleName ?? (await pickBundleName('export'));
             if (opts.toFile) {
                 // Transport, not the local store's master key — see lib/secrets/sync-passphrase.ts.
@@ -2150,10 +2154,10 @@ Examples:
                 console.log(chalk.green(`Exported ${Object.keys(env).length} key(s) to ${opts.toFile}`));
                 return;
             }
-            // The presence of --host selects SSH push: --host is the destination
+            // The presence of --device selects SSH push: --device is the destination
             // and carries the mode (no separate --to-ssh needed — it would be
-            // strictly redundant since SSH always requires at least one host).
-            const hosts = opts.host ?? [];
+            // strictly redundant since SSH always requires at least one device).
+            const hosts = opts.device ?? [];
             if (hosts.length > 0) {
                 for (const h of hosts)
                     assertValidSshTarget(h);
@@ -2203,7 +2207,7 @@ Examples:
                     }
                     console.log(chalk.green(`${host} -> '${resolvedBundleName}': ${out.message}`));
                 }
-                emitSecretAudit({ event: 'secrets.export', bundle: resolvedBundleName, operation: `export --host ${hosts.join(',')}`, source: 'ssh', host: hosts.join(','), status: failures > 0 ? 'error' : 'success', keyCount });
+                emitSecretAudit({ event: 'secrets.export', bundle: resolvedBundleName, operation: `export --device ${hosts.join(',')}`, source: 'ssh', host: hosts.join(','), status: failures > 0 ? 'error' : 'success', keyCount });
                 if (failures > 0)
                     process.exit(1);
                 return;
@@ -2242,41 +2246,36 @@ Examples:
                 console.log(chalk.green(`Exported to 1Password vault '${vault}': ${parts.join(', ')}.`));
                 return;
             }
-            if (opts.format && opts.format !== 'shell' && opts.format !== 'json') {
-                console.error(chalk.red(`Invalid --format ${JSON.stringify(opts.format)}. Expected 'shell' or 'json'.`));
-                process.exit(1);
-            }
-            if (!opts.plaintext) {
-                console.error(chalk.red('export prints secrets in the clear and requires --plaintext (works for TTY and pipes alike).'));
+            // The shell-eval print mode (`eval "$(agents secrets export … --plaintext)"`)
+            // is REMOVED (RUSH-2774): a whole bundle printed to stdout lands in a
+            // coding agent's context and session transcript, and it was the single
+            // most-copied exfiltration one-liner on the fleet. The sole surviving
+            // stdout emitter is the machine-to-machine SSH resolve transport, which
+            // requires the remote-invocation marker AND a non-agent context — both
+            // set only by remoteResolveEnv / verifyRemoteKeychainPush building the
+            // remote command. Everything else gets the refusal with the paved paths.
+            const isTransportCall = process.env.AGENTS_SECRETS_REMOTE_TRANSPORT === '1' &&
+                Boolean(opts.plaintext) &&
+                opts.format === 'json' &&
+                !isAgentInvocationContext();
+            if (!isTransportCall) {
+                console.error(chalk.red('export no longer prints values. Pick a destination:'));
+                console.error(chalk.red('  --device <host> | --to-1password | --to-file <path>'));
+                console.error(chalk.dim(`Run a command with the values injected instead:  agents secrets exec ${resolvedBundleName} -- <cmd>`));
+                console.error(chalk.dim(`Reveal one value at your terminal:               agents secrets view ${resolvedBundleName} --reveal`));
                 process.exit(1);
             }
-            // `agents secrets export --plaintext` is what release/CI scripts eval.
-            // Every caller is broker-only, including a plain shell, so export never
-            // raises Touch ID on the interactive user's screen.
+            // Machine-readable form consumed by `remoteResolveEnv` over SSH: single
+            // object of injected env KEY -> value; values verbatim. Broker-only, so a
+            // headless remote read fails fast rather than raising Touch ID. The
+            // resolve emits its own `secrets.get` audit on the remote; no export
+            // event here — that would tally every peer pull as an export.
             const { env } = readAndResolveBundleEnv(resolvedBundleName, {
-                caller: `export to shell`,
+                caller: 'remote resolve transport',
                 keyMode: 'process',
                 agentOnly: true,
             });
-            if (opts.format === 'json') {
-                // Machine-readable form consumed by `remoteResolveEnv` over SSH.
-                // Single object of injected env KEY -> value; values verbatim.
-                process.stdout.write(JSON.stringify(env));
-                return;
-            }
-            const prefix = bundleToEnvPrefix(resolvedBundleName);
-            for (const [k, v] of Object.entries(env)) {
-                const exportKey = isReservedEnvName(k) ? `${prefix}_${k}` : k;
-                const needsQuotes = /[\s$`"'\\|&;<>(){}[\]!#~]/.test(v);
-                const output = needsQuotes ? `'${v.replace(/'/g, `'\\''`)}'` : v;
-                process.stdout.write(`export ${exportKey}=${output}\n`);
-            }
-            // Record the shell export (the `eval "$(...)"` path). The `--format json`
-            // branch above is the machine-to-machine remote-resolve transport (already
-            // counted as an access on this machine by the resolve above), so it is
-            // deliberately not counted here as an export — that would tally every peer
-            // pull as an export.
-            emitSecretAudit({ event: 'secrets.export', bundle: resolvedBundleName, operation: 'export --plaintext', source: 'shell', status: 'success', keyCount: Object.keys(env).length });
+            process.stdout.write(JSON.stringify(env));
         }
         catch (err) {
             if (isPromptCancelled(err))
@@ -2287,8 +2286,8 @@ Examples:
     });
     cmd
         .command('exec <bundle> [command...]')
-        .description('Run a command with the bundle\'s secrets injected into the environment (use --host to resolve the bundle from a remote machine, ephemerally)')
-        .option('--host <target>', 'Resolve <bundle> on a remote host over SSH and inject it (ephemeral — never stored on this machine)')
+        .description('Run a command with the bundle\'s secrets injected into the environment (use --device to resolve the bundle from a remote machine, ephemerally)')
+        .option('--device <target>', 'Resolve <bundle> on a remote device over SSH and inject it (ephemeral — never stored on this machine)')
         .option('--keys <keys>', 'Inject only this comma-separated subset of keys (e.g. KEY1,KEY2). Missing keys are an error.')
         .option('--allow-expired', 'Inject keys even if their expiry date has passed (overrides the pre-run expiry abort).')
         .allowUnknownOption()
@@ -2303,14 +2302,14 @@ Examples:
                 ? execOpts.keys.split(',').map((k) => k.trim()).filter(Boolean)
                 : undefined;
             let secretEnv;
-            if (execOpts.host) {
+            if (execOpts.device) {
                 // Least-privilege flags do not yet cross the SSH resolver —
                 // silently applying them would inject the full remote env or an
                 // expired key. Fail loud so the user can drop the flag or run
                 // locally instead.
                 const { assertRemoteBundleFlagsUnsupported } = await import('../lib/secrets/bundles.js');
-                assertRemoteBundleFlagsUnsupported(bundleName, execOpts.host, { keys: keysSubset, allowExpired: execOpts.allowExpired }, { keysFlag: '--keys', allowExpiredFlag: '--allow-expired' });
-                secretEnv = await remoteResolveEnv(await resolveHostSshTarget(execOpts.host), bundleName, { osLookupName: execOpts.host });
+                assertRemoteBundleFlagsUnsupported(bundleName, execOpts.device, { keys: keysSubset, allowExpired: execOpts.allowExpired }, { keysFlag: '--keys', allowExpiredFlag: '--allow-expired' });
+                secretEnv = await remoteResolveEnv(await resolveHostSshTarget(execOpts.device), bundleName, { osLookupName: execOpts.device });
             }
             else {
                 const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
@@ -2497,14 +2496,14 @@ Examples:
     });
     cmd
         .command('unlock [names...]')
-        .description('Hold a bundle in the secrets-agent after one Touch ID, so concurrent runs read it without re-prompting (macOS). With --host, unlock FILE-backed bundle(s) on a remote (the passphrase prompt surfaces over the SSH TTY); keychain/biometry bundles are GUI-only and can\'t be remote-unlocked.')
+        .description('Hold a bundle in the secrets-agent after one Touch ID, so concurrent runs read it without re-prompting (macOS). With --device, unlock FILE-backed bundle(s) on a remote (the passphrase prompt surfaces over the SSH TTY); keychain/biometry bundles are GUI-only and can\'t be remote-unlocked.')
         .option('--ttl <duration>', 'How long to hold it (e.g. 30m, 8h, 3d). Default 7d.')
         .option('--until <date>', 'Hold until this absolute date or timestamp (for example 2026-08-06T12:00:00Z). Mutually exclusive with --ttl.')
         .option('--durable', 'Keep the unlock across sleep + reboot too (default: survives upgrade/restart but re-locks on sleep). Set secrets.agent.durable in agents.yaml to make this the default.')
         .option('--agent <agent>', 'Narrow the unlock to ONE harness type (for example claude, codex, or kimi). Default: the grant is global — every harness and a plain shell can read it, so one Touch ID covers them all.')
         .option('--keys <keys>', 'Hold ONLY this comma-separated subset of the bundle\'s keys instead of the whole bundle. Scopes exactly one bundle; fails closed on an unknown key. `secrets status` shows which keys a scoped hold covers.')
         .option('--all', 'Unlock every configured bundle')
-        .option('--host <target>', 'Unlock the bundle(s) on this remote machine over SSH instead of locally (file-backed bundles only — the remote\'s passphrase prompt surfaces on your terminal over a -tt session). Single-valued (NOT variadic) so it never swallows the bundle name: `unlock <name> --host <machine>`.')
+        .option('--device <target>', 'Unlock the bundle(s) on this remote device over SSH instead of locally (file-backed bundles only — the remote\'s passphrase prompt surfaces on your terminal over a -tt session). Single-valued (NOT variadic) so it never swallows the bundle name: `unlock <name> --device <machine>`.')
         .action(async (names, opts) => {
         if (opts.ttl && opts.until) {
             console.error(chalk.red('--ttl and --until are mutually exclusive.'));
@@ -2512,10 +2511,10 @@ Examples:
         }
         if (opts.keys !== undefined) {
             // --keys scopes ONE bundle to an explicit subset. It is local-only (a
-            // remote --host unlock holds the whole file-backed bundle) and cannot
+            // remote --device unlock holds the whole file-backed bundle) and cannot
             // combine with --all, which would hold every bundle whole.
-            if (opts.host) {
-                console.error(chalk.red('--keys is local-only; a remote (--host) unlock holds the whole file-backed bundle.'));
+            if (opts.device) {
+                console.error(chalk.red('--keys is local-only; a remote (--device) unlock holds the whole file-backed bundle.'));
                 process.exit(1);
             }
             if (opts.all || !names || names.length !== 1) {
@@ -2523,10 +2522,10 @@ Examples:
                 process.exit(1);
             }
         }
-        // Single-valued (not variadic): a variadic --host greedily consumes the
-        // positional bundle name (`unlock --host mac wztest` -> host=[mac,wztest],
+        // Single-valued (not variadic): a variadic --device greedily consumes the
+        // positional bundle name (`unlock --device mac wztest` -> device=[mac,wztest],
         // names=[]). Unlock targets one remote at a time anyway.
-        const hosts = opts.host ? [opts.host] : [];
+        const hosts = opts.device ? [opts.device] : [];
         if (hosts.length > 0) {
             // Remote unlock: the REMOTE enforces its own platform rules, so the
             // local darwin-only guard below does NOT apply. Only file-backed

package/dist/commands/sessions-backfill.js

@@ -204,7 +204,7 @@ export function registerSessionsBackfillCommand(sessionsCmd) {
     tools.action(async (_options, command) => {
         const options = command.optsWithGlobals();
         if (options.local && (options.fleet || mergeHosts(options).length > 0)) {
-            console.error(chalk.red('--local cannot be combined with --fleet, --host, or --device.'));
+            console.error(chalk.red('--local cannot be combined with --fleet or --device.'));
             process.exitCode = 1;
             return;
         }