@phnx-labs/agents-cli 1.22.4 → 1.22.5

package/dist/lib/secrets/index.js

@@ -257,6 +257,25 @@ function writeHmacKeyRecord(rec) {
     setKeychainToken(HMAC_KEY_ITEM, JSON.stringify(rec), { noAcl: true });
     hashStateCache = null;
 }
+/**
+ * Heal a `hmackey` item that an OLD helper (pre the metadata/hmackey no-ACL
+ * migration fix) re-stamped with a biometry ACL. Such an item makes EVERY hashed
+ * keychain lookup pop the generic "Agents CLI needs to authenticate" sheet,
+ * because the HMAC key is read before every hashed name resolves. The migration
+ * fix stopped the re-stamping but never un-stamped an already-damaged item, and
+ * nothing else re-stores it once hashing is already active — so it prompts forever.
+ *
+ * This re-stores the record no-ACL exactly once per machine (guarded by
+ * `healedNoAcl`), turning every future read silent. The read that produced `rec`
+ * has already happened (and already prompted if it was ACL'd); this only writes.
+ * Returns true if it healed. Exported for tests. No-op when already healed.
+ */
+export function healHmacKeyNoAclOnce(rec) {
+    if (rec.healedNoAcl)
+        return false;
+    writeHmacKeyRecord({ ...rec, healedNoAcl: true });
+    return true;
+}
 function resolveHashState() {
     if (forcedTestKey)
         return { active: true, key: forcedTestKey, record: null };
@@ -404,6 +423,19 @@ function maybeAutoRekey() {
         return;
     const st = resolveHashState();
     if (st.active) {
+        // Heal an already-active machine whose hmackey was re-stamped ACL'd by an old
+        // helper (its read popped the generic Touch ID sheet on every hashed lookup).
+        // Runs once per machine; mutate the local so a later finishPendingDeletes write
+        // preserves the healed flag.
+        if (st.record && !st.record.healedNoAcl) {
+            try {
+                healHmacKeyNoAclOnce(st.record);
+                st.record.healedNoAcl = true;
+            }
+            catch {
+                /* next process retries */
+            }
+        }
         if (st.record?.pendingDeletes?.length) {
             try {
                 finishPendingDeletes(st.record);

package/dist/lib/secrets/mcp.js

@@ -24,7 +24,7 @@
  * unit-testable in-process.
  */
 import * as readline from 'readline';
-import { listBundles, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, validateBundleName, } from './bundles.js';
+import { listBundles, readAndResolveBundleEnv, readBundle, validateBundleName, } from './bundles.js';
 /** MCP protocol revision this server negotiates. */
 export const MCP_PROTOCOL_VERSION = '2024-11-05';
 /** The single tool this server exposes. */
@@ -68,9 +68,13 @@ export function resolveSecret(bundle, key) {
         throw new Error(`Key '${key}' not found in bundle '${bundle}'.` +
             (available.length ? ` Available keys: ${available.join(', ')}.` : ' Bundle has no keys.'));
     }
-    // The MCP get_secret tool is typically served by a background/headless agent
-    // process; resolve broker-only there so it never raises an unwatched prompt.
-    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp', keys: [key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+    // An MCP `get_secret` tool call is a program asking for a value, never a human
+    // at a Touch ID sheet — so the read is always `agentOnly` (SEC-13: never pop
+    // biometry on its own). A `never`/no-ACL or broker-held bundle resolves
+    // silently; a locked bundle THROWS the actionable "unlock <name>" message,
+    // which propagates as the MCP tool error (the caller surfaces it) rather than
+    // popping an unanswerable prompt.
+    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp', keys: [key], keyMode: 'storage', agentOnly: true });
     const value = env[key];
     if (value === undefined) {
         throw new Error(`Key '${key}' in bundle '${bundle}' could not be resolved.`);

package/dist/lib/session/sync/config.d.ts

@@ -29,24 +29,25 @@ export interface R2Config {
      */
     syncEncKey?: string;
 }
-/** Window after a prompt-bearing resolution failure during which we skip
- *  re-attempting (and thus re-prompting). SIGHUP / restart bypasses it. */
-export declare const RESOLVE_RETRY_COOLDOWN_MS: number;
 /** Drop the cached resolution so the next call reads the bundle fresh. Called on
  *  daemon SIGHUP (to pick up rotated credentials) and between tests. */
 export declare function clearR2ConfigCache(): void;
 /**
  * Resolve R2 credentials, reading the keychain at most once per process. The
- * first call reads (and may prompt for Touch ID); every later call returns the
- * memoized result. Throws if the bundle/keys are missing — failures are not
- * memoized, but see isSyncConfigured for the re-prompt cooldown.
+ * read is `agentOnly` (resolveR2Config), so it never prompts: a `never`/no-ACL or
+ * broker-held bundle resolves silently and is memoized; a locked `hold`/`always`
+ * bundle throws the actionable "unlock r2.backups" error. Throws (not memoized)
+ * when the bundle/keys are missing or locked — isSyncConfigured catches the throw
+ * and degrades to no-transport.
  */
 export declare function loadR2Config(): R2Config;
 /**
- * True when the sync bundle exists and resolves, without throwing. After a
- * prompt-bearing failure (e.g. a cancelled Touch ID) it returns false without
- * re-reading the keychain for RESOLVE_RETRY_COOLDOWN_MS, so a dismissed prompt
- * does not re-storm every cycle. `now` is injectable for tests.
+ * True when the sync bundle exists and resolves, without throwing. A missing OR
+ * locked bundle resolves to false (session-sync degrades to no-transport) and,
+ * because the `agentOnly` read never prompts, it is re-checked each cycle — so a
+ * later `agents secrets add` / `agents secrets unlock r2.backups` is picked up
+ * promptly with no daemon restart. `now` is accepted for a stable test signature
+ * but no longer gates a cooldown (there is no prompt-bearing failure to back off).
  */
-export declare function isSyncConfigured(now?: number): boolean;
+export declare function isSyncConfigured(_now?: number): boolean;
 export { machineId, normalizeHost } from '../../machine-id.js';

package/dist/lib/session/sync/config.js

@@ -11,7 +11,7 @@
  * actually wired. Credentials come from the `r2.backups` secrets bundle (OS
  * keychain on macOS, libsecret on Linux) — never from env or disk.
  */
-import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../../secrets/bundles.js';
+import { readAndResolveBundleEnv } from '../../secrets/bundles.js';
 /** Secrets bundle holding the R2 credentials. */
 export const SYNC_BUNDLE = 'r2.backups';
 /**
@@ -20,13 +20,17 @@ export const SYNC_BUNDLE = 'r2.backups';
  * without real credentials (no silent fallback).
  */
 function resolveR2Config() {
-    // A headless caller (no TTY — e.g. a routine or SSH-dispatched command) must
-    // resolve broker-only: isHeadlessSecretsContext() true means a broker miss
-    // can never pop an unattended Touch ID sheet on the user's screen (the same
-    // broker-only-when-headless rationale the secrets readers use). Using the
-    // shared predicate rather than a literal keeps it consistent with the other
-    // callers and lets any interactive caller of loadR2Config still prompt.
-    const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'session-transport', agentOnly: isHeadlessSecretsContext() });
+    // Session-sync is a BACKGROUND read: the daemon's ~90s cycle (and the ~2-min
+    // watchdog) resolve this on their own, never at a human's request — so it must
+    // NEVER pop a Touch ID sheet, on the interactive launcher included (SEC-13: an
+    // agent launch never raises biometry on its own). The read is always
+    // `agentOnly`: a `never`/no-ACL or broker-held `r2.backups` bundle resolves
+    // silently; a locked `hold`/`always` bundle THROWS the actionable "unlock
+    // r2.backups" message instead of prompting. isSyncConfigured catches that throw
+    // and degrades to no-transport (sync disabled) with no prompt and no crash —
+    // unlock once (`agents secrets unlock r2.backups`) or set it no-ACL
+    // (`agents secrets policy r2.backups never`) for silent zero-friction sync.
+    const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'session-transport', agentOnly: true });
     const accountId = env.R2_ACCOUNT_ID?.trim();
     const bucket = env.R2_BUCKET_NAME?.trim();
     const accessKeyId = env.R2_ACCESS_KEY_ID?.trim();
@@ -55,31 +59,32 @@ function resolveR2Config() {
     };
 }
 // ── Resolution cache ────────────────────────────────────────────────────────
-// The daemon calls isSyncConfigured() + syncSessions() every ~90s, and each used
-// to trigger a fresh read of the biometry-gated `r2.backups` keychain items —
-// one Touch ID prompt per gated item, every cycle, forever. We instead resolve
-// at most once per process: a success is memoized for the process lifetime
-// (cleared on daemon SIGHUP via clearR2ConfigCache), so subsequent cycles never
-// touch the keychain again. A *prompt-bearing* failure (cancelled Touch ID, etc.)
-// starts a cooldown so a dismissed prompt is not re-issued every cycle. A simply
-// absent bundle never prompts, so it is re-checked each cycle (fast pickup when
-// the user later adds credentials).
+// The daemon calls isSyncConfigured() + syncSessions() every ~90s. The read is
+// now `agentOnly` (resolveR2Config) so it can NEVER pop Touch ID — a locked bundle
+// throws a cheap, deterministic "unlock r2.backups" error instead. We still resolve
+// at most once per process: a success is memoized for the process lifetime (cleared
+// on daemon SIGHUP via clearR2ConfigCache), so subsequent cycles never touch the
+// keychain again. A failure (absent bundle, or a LOCKED `hold`/`always` bundle) is
+// NOT memoized and never prompts, so it is re-checked each cycle — session-sync
+// degrades to no-transport until the bundle is added / unlocked, then picks it up
+// promptly with no restart.
+//
+// The historical prompt-backoff cooldown (a cancelled Touch ID sheet) is gone: with
+// agentOnly there is no sheet to cancel, so no failure is prompt-bearing and none
+// needs a backoff.
 let cachedConfig = null;
-let lastPromptFailureAt = 0;
-/** Window after a prompt-bearing resolution failure during which we skip
- *  re-attempting (and thus re-prompting). SIGHUP / restart bypasses it. */
-export const RESOLVE_RETRY_COOLDOWN_MS = 30 * 60 * 1000; // 30 minutes
 /** Drop the cached resolution so the next call reads the bundle fresh. Called on
  *  daemon SIGHUP (to pick up rotated credentials) and between tests. */
 export function clearR2ConfigCache() {
     cachedConfig = null;
-    lastPromptFailureAt = 0;
 }
 /**
  * Resolve R2 credentials, reading the keychain at most once per process. The
- * first call reads (and may prompt for Touch ID); every later call returns the
- * memoized result. Throws if the bundle/keys are missing — failures are not
- * memoized, but see isSyncConfigured for the re-prompt cooldown.
+ * read is `agentOnly` (resolveR2Config), so it never prompts: a `never`/no-ACL or
+ * broker-held bundle resolves silently and is memoized; a locked `hold`/`always`
+ * bundle throws the actionable "unlock r2.backups" error. Throws (not memoized)
+ * when the bundle/keys are missing or locked — isSyncConfigured catches the throw
+ * and degrades to no-transport.
  */
 export function loadR2Config() {
     if (cachedConfig)
@@ -88,26 +93,23 @@ export function loadR2Config() {
     return cachedConfig;
 }
 /**
- * True when the sync bundle exists and resolves, without throwing. After a
- * prompt-bearing failure (e.g. a cancelled Touch ID) it returns false without
- * re-reading the keychain for RESOLVE_RETRY_COOLDOWN_MS, so a dismissed prompt
- * does not re-storm every cycle. `now` is injectable for tests.
+ * True when the sync bundle exists and resolves, without throwing. A missing OR
+ * locked bundle resolves to false (session-sync degrades to no-transport) and,
+ * because the `agentOnly` read never prompts, it is re-checked each cycle — so a
+ * later `agents secrets add` / `agents secrets unlock r2.backups` is picked up
+ * promptly with no daemon restart. `now` is accepted for a stable test signature
+ * but no longer gates a cooldown (there is no prompt-bearing failure to back off).
  */
-export function isSyncConfigured(now = Date.now()) {
+export function isSyncConfigured(_now = Date.now()) {
     if (cachedConfig)
         return true;
-    if (lastPromptFailureAt && now - lastPromptFailureAt < RESOLVE_RETRY_COOLDOWN_MS)
-        return false;
     try {
         loadR2Config();
         return true;
     }
-    catch (err) {
-        // A missing bundle never prompts, so keep re-checking it each cycle (so a
-        // later `agents secrets add` is picked up quickly). Any other failure may
-        // have cost a prompt (cancelled Touch ID, keychain error) — back off.
-        if (!/not found/i.test(err.message))
-            lastPromptFailureAt = now;
+    catch {
+        // Absent or locked bundle — never prompted (agentOnly), so no backoff: keep
+        // re-checking each cycle for fast pickup once the bundle is added / unlocked.
         return false;
     }
 }

package/dist/lib/share/config.js

@@ -76,6 +76,9 @@ export function storeWriteToken(token) {
 export function readWriteTokenFromBundle() {
     const { env } = readAndResolveBundleEnv(SHARE_BUNDLE, {
         caller: 'share',
+        // Explicit `agents share` command (a human published a file): a headless agent
+        // subprocess resolves broker-only, an interactive human may unlock. This is NOT
+        // an agent LAUNCH read (that is exec.ts's --secrets injection, always agentOnly).
         agentOnly: isHeadlessSecretsContext(),
     });
     const token = env[SHARE_TOKEN_KEY];
@@ -133,6 +136,7 @@ export function readCloudflareCreds(bundle = DEFAULT_CF_BUNDLE, override) {
     }
     const { env } = readAndResolveBundleEnv(bundle, {
         caller: 'share',
+        // Explicit `agents share setup` provisioning read — not an agent launch.
         agentOnly: isHeadlessSecretsContext(),
     });
     const find = (re) => {

package/dist/lib/types.d.ts

@@ -764,6 +764,16 @@ export interface Meta {
      */
     isolatedAgents?: Partial<Record<AgentId, string>>;
     run?: RunConfig;
+    /**
+     * Cost-tier overrides for `--model cheap|default|best|ultra`. Keyed by the same
+     * `<agent>:<version>` selector run.defaults uses (`kimi:*`, `kimi:0.19.2`); each
+     * value maps a tier to a concrete model id. Written by `agents models tier set`,
+     * never hand-edited. Resolution: exact version selector wins over `<agent>:*`,
+     * which wins over the auto-ranking. See lib/model-tier-overrides.ts.
+     */
+    model?: {
+        tiers?: Record<string, Partial<Record<'cheap' | 'default' | 'best' | 'ultra', string>>>;
+    };
     /**
      * Daemon watchdog config. `rotate` (default `on`) lets the watchdog rotate a
      * rate-limited session IN PLACE onto a healthy account/harness via

package/dist/lib/versions.js

@@ -1358,6 +1358,38 @@ function relocateGrokBinaryToVersionHome(installedVersion) {
             return;
     }
 }
+/**
+ * Grok's version directory is keyed by release number alone, not by account —
+ * so two DIFFERENT accounts that both self-update to the identical upstream
+ * release ("latest") target the SAME on-disk `versions/grok/<version>/` home.
+ * When that happens, the second account's `agents add grok@latest` writes
+ * into an already-signed-in directory: grok's own auth flow treats
+ * `~/.grok/auth.json` as authoritative for whichever process invoked it, so
+ * the second account's credential record lands in a file that still names it
+ * as the first account's install everywhere else in agents-cli's bookkeeping.
+ *
+ * Refuse before that happens: if the target version's home already has a
+ * signed-in account whose identity differs from the account currently
+ * driving this update (the previous global default), fail loud instead of
+ * letting the second account silently displace the first's install.
+ */
+async function checkGrokAccountCollision(installedVersion) {
+    const targetHome = getVersionHomePath('grok', installedVersion);
+    if (!fs.existsSync(targetHome))
+        return; // fresh directory, nothing to collide with
+    const sourceVersion = getGlobalDefault('grok');
+    if (!sourceVersion || sourceVersion === installedVersion)
+        return; // same install, not a collision
+    const [targetEmail, sourceEmail] = await Promise.all([
+        getAccountEmail('grok', targetHome),
+        getAccountEmail('grok', getVersionHomePath('grok', sourceVersion)),
+    ]);
+    if (!targetEmail || !sourceEmail || targetEmail === sourceEmail)
+        return;
+    throw new Error(`grok@${installedVersion} is already installed for ${targetEmail}, but this update is running as ${sourceEmail}. ` +
+        `Grok's self-updater can't distinguish two accounts that land on the same release — sign in to ${targetEmail}'s ` +
+        `install (agents use grok@${installedVersion}) before updating it, or wait until the releases diverge.`);
+}
 /**
  * Install a specific version of an agent.
  */
@@ -1428,6 +1460,9 @@ export async function installVersion(agent, version, onProgress, opts) {
                 // install into the real version so it stops shadowing `agents view`.
                 await reconcileStaleLatestDir(agent, installedVersion);
             }
+            if (agent === 'grok') {
+                await checkGrokAccountCollision(installedVersion);
+            }
             onProgress?.(`${agentConfig.name} installed. Setting up agents-cli version home for isolation...`);
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.4",
+  "version": "1.22.5",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",