@phnx-labs/agents-cli 1.22.40 → 1.22.42

package/dist/commands/org.js

@@ -0,0 +1,174 @@
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { createSpace, createSpaceInvite, fetchWhoAmI, listSpaceMembers, listSpaces, removeSpaceMember, resolveMemberFromList, resolvePrixToken, resolveSpaceFromList, slugify, updateSpaceMemberRole, } from '../lib/prix-account.js';
+/** Every `agents org` subcommand needs a token up front — one place to say so. */
+function requireToken() {
+    if (!resolvePrixToken())
+        throw new Error("Not signed in. Run 'agents auth login' first.");
+}
+async function resolveSpace(explicit) {
+    const spaces = await listSpaces();
+    return resolveSpaceFromList(spaces, explicit);
+}
+function printSpace(space) {
+    console.log(`${chalk.bold(space.name)}  ${chalk.gray(space.slug)}  ${chalk.gray(space.id)}`);
+    console.log(`  role: ${space.user_role}${space.organization_id ? `  org: ${space.organization_id}` : ''}`);
+}
+function printMembers(members) {
+    if (!members.length) {
+        console.log(chalk.gray('  No members.'));
+        return;
+    }
+    for (const m of members)
+        console.log(`  ${chalk.cyan(m.email)}  ${m.role}  ${chalk.gray(m.user_id)}`);
+}
+async function runCreate(name, o) {
+    requireToken();
+    const space = await createSpace({ name, slug: o.slug ?? slugify(name), description: o.description });
+    if (o.json) {
+        console.log(JSON.stringify(space, null, 2));
+        return;
+    }
+    console.log(chalk.green(`Created space '${space.name}' (${space.slug}).`));
+    printSpace(space);
+}
+async function runList(o) {
+    requireToken();
+    const spaces = await listSpaces();
+    if (o.json) {
+        console.log(JSON.stringify(spaces, null, 2));
+        return;
+    }
+    if (!spaces.length) {
+        console.log(chalk.gray("No spaces. Create one with 'agents org create <name>'."));
+        return;
+    }
+    for (const space of spaces)
+        printSpace(space);
+}
+async function runView(spaceArg, o) {
+    requireToken();
+    const space = await resolveSpace(spaceArg);
+    if (o.json) {
+        console.log(JSON.stringify(space, null, 2));
+        return;
+    }
+    printSpace(space);
+}
+/** `--role` defaults to member when omitted; anything present must be a real role — never silently coerced. */
+export function resolveInviteRole(raw) {
+    return raw === undefined ? 'member' : parseRole(raw);
+}
+async function runInvite(email, o) {
+    requireToken();
+    const role = resolveInviteRole(o.role);
+    const space = await resolveSpace(o.space);
+    const result = await createSpaceInvite(space.id, email, role);
+    if (o.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (result.member_added)
+        console.log(chalk.green(`Added ${email} to '${space.name}' as ${role}.`));
+    else
+        console.log(chalk.green(`Invited ${email} to '${space.name}' as ${role}. They'll get an email.`));
+}
+async function runMembers(spaceArg, o) {
+    requireToken();
+    const space = await resolveSpace(spaceArg);
+    const members = await listSpaceMembers(space.id);
+    if (o.json) {
+        console.log(JSON.stringify(members, null, 2));
+        return;
+    }
+    console.log(chalk.bold(`${space.name} (${members.length} member${members.length === 1 ? '' : 's'})`));
+    printMembers(members);
+}
+/** Validate a role argument before any network call — same rule the backend enforces server-side. */
+export function parseRole(raw) {
+    if (raw === 'admin' || raw === 'member')
+        return raw;
+    throw new Error(`role must be 'admin' or 'member', got '${raw}'.`);
+}
+async function runRole(email, roleRaw, o) {
+    requireToken();
+    const role = parseRole(roleRaw);
+    const space = await resolveSpace(o.space);
+    const members = await listSpaceMembers(space.id);
+    const member = resolveMemberFromList(members, email);
+    const result = await updateSpaceMemberRole(space.id, member.user_id, role);
+    if (o.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(chalk.green(`${email} is now ${role} in '${space.name}'.`));
+}
+async function runRemove(email, o) {
+    requireToken();
+    const space = await resolveSpace(o.space);
+    const members = await listSpaceMembers(space.id);
+    const member = resolveMemberFromList(members, email);
+    await removeSpaceMember(space.id, member.user_id);
+    if (o.json) {
+        console.log(JSON.stringify({ removed: email, space: space.slug }, null, 2));
+        return;
+    }
+    console.log(chalk.green(`Removed ${email} from '${space.name}'.`));
+}
+async function runLeave(spaceArg, o) {
+    requireToken();
+    const resolved = resolvePrixToken();
+    if (!resolved)
+        throw new Error("Not signed in. Run 'agents auth login' first.");
+    const who = await fetchWhoAmI(resolved.token);
+    const space = await resolveSpace(spaceArg);
+    if (space.owner_user_id === who.userId) {
+        throw new Error(`You own '${space.name}'. Transfer ownership or delete the space instead of leaving it.`);
+    }
+    await removeSpaceMember(space.id, who.userId);
+    if (o.json) {
+        console.log(JSON.stringify({ left: space.slug }, null, 2));
+        return;
+    }
+    console.log(chalk.green(`Left '${space.name}'.`));
+}
+export function registerOrgCommand(program) {
+    const org = program.command('org').description('Create and manage a team (a Rush "space") you can share with `agents auth login` collaborators');
+    org.command('create <name>').description('Create a space (free tier: 1 owned space)')
+        .option('--slug <slug>', 'Override the derived slug')
+        .option('--description <text>', 'Optional description')
+        .option('--json', 'Machine-readable output')
+        .action((name, o, command) => runCreate(name, { ...o, json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('list').description('List spaces you own or belong to').option('--json', 'Machine-readable output')
+        .action((o, command) => runList({ json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('view [space]').description('Show one space (defaults to your only space)').option('--json', 'Machine-readable output')
+        .action((space, o, command) => runView(space, { json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('invite <email>').description('Invite (or directly add) a member')
+        .option('--role <role>', 'admin | member', 'member')
+        .option('--space <id-or-slug>', 'Space to invite into (defaults to your only space)')
+        .option('--json', 'Machine-readable output')
+        .action((email, o, command) => runInvite(email, { ...o, json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('members [space]').description('List a space\'s members').option('--json', 'Machine-readable output')
+        .action((space, o, command) => runMembers(space, { json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('role <email> <role>').description('Change a member\'s role (owner-only for admin)')
+        .option('--space <id-or-slug>', 'Space to change (defaults to your only space)')
+        .option('--json', 'Machine-readable output')
+        .action((email, role, o, command) => runRole(email, role, { ...o, json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('remove <email>').description('Remove a member from a space')
+        .option('--space <id-or-slug>', 'Space to remove from (defaults to your only space)')
+        .option('--json', 'Machine-readable output')
+        .action((email, o, command) => runRemove(email, { ...o, json: !!(o.json || command.optsWithGlobals().json) }));
+    org.command('leave [space]').description('Leave a space you do not own').option('--json', 'Machine-readable output')
+        .action((space, o, command) => runLeave(space, { json: !!(o.json || command.optsWithGlobals().json) }));
+    setHelpSections(org, {
+        examples: `agents org create acme-team
+agents org list
+agents org view acme-team
+agents org invite dev@example.com --role admin
+agents org members
+agents org role dev@example.com admin
+agents org remove dev@example.com
+agents org leave acme-team`,
+        notes: 'Maps to the Rush backend\'s /api/v1/spaces (the free-tier team primitive), not /api/v1/orgs. Free tier: 1 owned space, 3 members per space. Every command needs `agents auth login` (or a `rush login` session) first. `--space` is only needed once you belong to more than one space.',
+    });
+}

package/dist/commands/packages.js

@@ -15,7 +15,7 @@ import { getRegistries, setRegistry, removeRegistry, search as searchRegistries,
 import { cloneRepo } from '../lib/git.js';
 import { discoverCommands, resolveCommandSource, installCommand, installCommandCentrally, } from '../lib/commands.js';
 import { discoverSkillsFromRepo, installSkill, installSkillCentrally, } from '../lib/plugins/skills.js';
-import { discoverHooksFromRepo, installHooks, installHooksCentrally, } from '../lib/hooks.js';
+import { discoverHooksFromRepo, installHooks, installHooksCentrally, } from '../lib/hooks/install.js';
 import { discoverWorkflowsFromRepo, installWorkflowCentrally, } from '../lib/workflows.js';
 import { discoverSubagentsFromRepo, installSubagentCentrally, } from '../lib/subagents.js';
 import { discoverPermissionsFromRepo, installPermissionSet, } from '../lib/permissions.js';

package/dist/commands/prune.js

@@ -27,7 +27,7 @@ import { formatBytes } from '../lib/format.js';
 import { confirm } from '@inquirer/prompts';
 import { diffVersionCommands, iterCommandsCapableVersions, removeCommandFromVersion, } from '../lib/commands.js';
 import { diffVersionSkills, iterSkillsCapableVersions, removeSkillFromVersion, } from '../lib/plugins/skills.js';
-import { listUnmanagedHooksInVersionHome, iterHooksCapableVersions, removeHookFromVersion, } from '../lib/hooks.js';
+import { listUnmanagedHooksInVersionHome, iterHooksCapableVersions, removeHookFromVersion, } from '../lib/hooks/install.js';
 import { diffVersionPlugins, iterPluginsCapableVersions, removePluginSkillFromVersion, } from '../lib/plugins/plugins.js';
 import { diffVersionSubagents, iterSubagentsCapableVersions, removeSubagentFromVersion, } from '../lib/subagents.js';
 import { getGlobalDefault } from '../lib/installations/versions.js';

package/dist/commands/routines.js

@@ -24,7 +24,7 @@ import { fireWebhookJobs, matchJobsToWebhook } from '../lib/triggers/webhook.js'
 import { getRoutinesDir } from '../lib/state.js';
 import { IS_WINDOWS } from '../lib/platform/index.js';
 import { safeJoin } from '../lib/paths.js';
-import { executeJob, monitorRunningJobs } from '../lib/runner.js';
+import { executeJob, monitorRunningJobs } from '../lib/daemon/runner.js';
 import { JobScheduler } from '../lib/scheduler.js';
 import { detectOverdueJobs } from '../lib/overdue.js';
 import { runCatchup } from '../lib/catchup.js';

package/dist/commands/run-account-picker.d.ts

@@ -12,10 +12,29 @@ export interface RunAccountChoice {
      */
     signInRequired: boolean;
 }
+/** One named account row for `agents accounts switch` (reuses this picker's layout). */
+export interface SwitchAccountRow {
+    accountName: string;
+    kind: 'provider' | 'native';
+    detail: string;
+    current: boolean;
+    candidate: RotateCandidate | null;
+}
 /** Human-readable remaining capacity for every window the provider exposes. */
 export declare function formatAccountLimits(candidate: RotateCandidate): string;
 /** Build aligned picker rows with usable accounts first and unsafe rows disabled. */
 export declare function buildRunAccountChoices(candidates: RotateCandidate[], globalDefault: string | null): RunAccountChoice[];
+/**
+ * Aligned picker rows for `accounts switch`. Same columns as the run picker
+ * (identity, status, limits) but the value is the named account to set-default.
+ * Rows stay selectable: setting a default is not a launch.
+ */
+export declare function buildSwitchAccountChoices(rows: SwitchAccountRow[]): RunAccountChoice[];
+/**
+ * Prompt for the named account that becomes this harness's default.
+ * A cancelled picker writes nothing.
+ */
+export declare function pickSwitchAccount(agent: AgentId, rows: SwitchAccountRow[]): Promise<string | null>;
 /**
  * Whether a zero-healthy run may recover by launching for a login, or must keep
  * failing loud. Three inputs, all of which have to hold:

package/dist/commands/run-account-picker.js

@@ -124,6 +124,87 @@ export function buildRunAccountChoices(candidates, globalDefault) {
         signInRequired: row.signInRequired,
     }));
 }
+function switchRowStatus(row) {
+    if (!row.candidate) {
+        return {
+            status: row.kind === 'provider' ? 'credential' : 'named',
+            limits: 'limits unavailable',
+            ready: true,
+        };
+    }
+    const readiness = readinessFromCandidate(row.candidate);
+    const authReason = readiness.ready ? null : readiness.reason;
+    const status = authReason === 'revoked'
+        ? 'needs re-login'
+        : authReason === 'signed_out'
+            ? 'logged out'
+            : authReason === 'rate_limited'
+                ? 'rate limited'
+                : authReason === 'out_of_credits'
+                    ? 'out of credits'
+                    : 'logged in';
+    const limits = authReason === 'revoked'
+        ? 'needs re-authentication'
+        : authReason === 'signed_out'
+            ? 'signed out'
+            : formatAccountLimits(row.candidate);
+    return { status, limits, ready: readiness.ready };
+}
+/**
+ * Aligned picker rows for `accounts switch`. Same columns as the run picker
+ * (identity, status, limits) but the value is the named account to set-default.
+ * Rows stay selectable: setting a default is not a launch.
+ */
+export function buildSwitchAccountChoices(rows) {
+    const rendered = rows.map((row) => {
+        const { status, limits, ready } = switchRowStatus(row);
+        const account = row.current ? `${row.accountName} (default)` : row.accountName;
+        const kind = row.kind === 'provider' ? `provider · ${row.detail}` : `native · ${row.detail}`;
+        return { account, kind, status, limits, ready, value: row.accountName };
+    });
+    const accountWidth = Math.max(0, ...rendered.map((row) => row.account.length));
+    const kindWidth = Math.max(0, ...rendered.map((row) => row.kind.length));
+    const statusWidth = Math.max(0, ...rendered.map((row) => row.status.length));
+    return rendered.map((row) => ({
+        name: [
+            row.account.padEnd(accountWidth),
+            row.kind.padEnd(kindWidth),
+            row.status.padEnd(statusWidth),
+            row.limits,
+        ].join('  '),
+        value: row.value,
+        ready: row.ready,
+        signInRequired: false,
+    }));
+}
+/**
+ * Prompt for the named account that becomes this harness's default.
+ * A cancelled picker writes nothing.
+ */
+export async function pickSwitchAccount(agent, rows) {
+    if (!isInteractiveTerminal()) {
+        requireInteractiveSelection(`Selecting a ${agentLabel(agent)} account`, [
+            `agents accounts switch ${agent} <account>`,
+            `agents accounts set-default ${agent} <account>`,
+        ]);
+    }
+    if (rows.length === 0) {
+        throw new Error(`No named accounts for ${agent}. Add one with 'agents accounts add <name> --provider <p>' or 'agents accounts name ${agent}@<version> <name>'.`);
+    }
+    const choices = buildSwitchAccountChoices(rows).map(({ ready: _ready, signInRequired: _signInRequired, ...choice }) => choice);
+    try {
+        return await select({
+            message: `Select the default ${agentLabel(agent)} account:`,
+            choices,
+            loop: false,
+        });
+    }
+    catch (err) {
+        if (isPromptCancelled(err))
+            return null;
+        throw err;
+    }
+}
 /**
  * Whether a zero-healthy run may recover by launching for a login, or must keep
  * failing loud. Three inputs, all of which have to hold:

package/dist/commands/secrets.js

@@ -18,7 +18,7 @@ import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, } from '../lib/secrets/remote.js';
 import { resolveBundleForPush, pushResolvedBundleToHost, bundleEnvToDotenv } from '../lib/secrets/push.js';
 export { bundleEnvToDotenv };
-import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, isHeadlessSecretsContext, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, isHeadlessSecretsContext, isAgentInvocationContext, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
 import { parseListFilters, bundleMatchesFilter, bundleExpiry, filterIsActive, describeFilter, parseSortField, sortBundles, SORT_FIELDS, REF_KINDS, DEFAULT_EXPIRING_DAYS, } from '../lib/secrets/list-filter.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, maybeAutoRekey, } from '../lib/secrets/index.js';
@@ -38,7 +38,6 @@ import { frequentlyPromptedBundles } from '../lib/secrets/unlock-hints.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { discoverSyncedBundles, importSyncedBundle, } from '../lib/secrets/icloud-import.js';
-import { getVaultSession, vaultExists } from '../lib/secrets/vault.js';
 import { registerSecretsSyncCommands } from './secrets-sync.js';
 import { registerSecretsMigrateAclCommand } from './secrets-migrate.js';
 import { registerSecretsImportKeyringCommand } from './secrets-import.js';
@@ -924,14 +923,17 @@ export function registerSecretsCommands(program) {
       # Stop a noisy automation bundle from prompting every run: ask once a week
       agents secrets policy prod hold
 
-      # Eval the bundle into your current shell
-      eval "$(agents secrets export prod --plaintext)"
+      # Run a one-off command with secrets injected (values ride the child env, never stdout)
+      agents secrets exec prod -- ./deploy.sh
+
+      # Need one value inside a script? Read it under injection, not with a printer
+      agents secrets exec prod -- printenv STRIPE_API_KEY
+
+      # Deliberately reveal values at your terminal (interactive only)
+      agents secrets view prod --reveal
 
       # Push the bundle to remote machine(s) over SSH (lands as a native bundle there)
       agents secrets export prod --device yosemite-s0 --device yosemite-s1 --force
-
-      # Run a one-off command with secrets injected
-      agents secrets exec prod -- ./deploy.sh
     `,
         notes: `
       Bundles are containers; secrets are the variables inside them. Keychain values
@@ -1222,13 +1224,22 @@ export function registerSecretsCommands(program) {
         .command('view [name]')
         .alias('show')
         .description('Show a bundle. Keychain values are masked by default — pass --reveal to see them.')
-        .option('--reveal', 'Print keychain-backed values in the clear (TTY only unless --plaintext)')
-        .option('--plaintext', 'Allow --reveal in non-interactive shells (use with care)')
+        .option('--reveal', 'Print keychain-backed values in the clear (interactive terminal only)')
         .option('--json', 'Emit machine-readable JSON (values masked unless --reveal) instead of the human view')
         .option('--device <target>', 'Show a bundle on a remote device over SSH (enrolled `agents hosts` name, ssh-config alias, or user@host)')
         .option('--devices <list>', 'Comma-separated devices to show in one shot, e.g. yosemite-s0,yosemite-s1')
         .action(async (name, opts) => {
         try {
+            // `--reveal` is a deliberate HUMAN reveal: interactive terminal only, and
+            // never inside an agent session (an agent under tmux has a TTY, so the
+            // env markers are the load-bearing check). The old `--plaintext` escape
+            // that allowed a piped/non-TTY reveal is removed (RUSH-2774) — printed
+            // values land in an agent's context and session transcript.
+            if (opts.reveal && (isAgentInvocationContext() || !isInteractiveTerminal())) {
+                console.error(chalk.red('--reveal prints values in the clear and needs a real interactive terminal outside an agent session.'));
+                console.error(chalk.dim('Run the consuming command under injection instead: agents secrets exec <bundle> -- <cmd>'));
+                process.exit(1);
+            }
             const targets = parseHostsOption({ device: opts.device, devices: opts.devices });
             if (targets.length > 0) {
                 if (!name) {
@@ -1238,14 +1249,13 @@ export function registerSecretsCommands(program) {
                 const args = ['view', name];
                 if (opts.reveal)
                     args.push('--reveal');
-                if (opts.plaintext)
-                    args.push('--plaintext');
                 if (opts.json)
                     args.push('--json');
                 // With --reveal, force a TTY so the remote keychain prompt can surface
-                // (and the remote's "--reveal in a non-TTY needs --plaintext" gate is
-                // satisfied) — only when this side is itself interactive.
-                const tty = Boolean(opts.reveal) && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+                // and the remote's own interactive-terminal gate is satisfied. The
+                // early gate above already proved this side is an interactive,
+                // non-agent terminal.
+                const tty = Boolean(opts.reveal);
                 // `--reveal` streams the plaintext value back over ssh stdout — a
                 // secret-bearing read that must pin the host key and not multiplex,
                 // whether it runs on the interactive (tty) or `--plaintext` non-tty path.
@@ -1288,14 +1298,10 @@ export function registerSecretsCommands(program) {
             emitSecretAudit({ event: 'secrets.view', bundle: bundle.name, operation: opts.json ? 'view --json' : 'view', source: 'view', status: 'success' });
             if (opts.json) {
                 // Machine-readable discovery for agents. Values are null unless --reveal
-                // (which still routes through the same non-TTY/plaintext gate + audit
-                // event as the human path). Gated on the explicit flag, not stdout.isTTY,
-                // so a piped human view never silently swaps formats.
+                // (already gated above: interactive terminal, outside an agent session).
+                // Gated on the explicit flag, not stdout.isTTY, so a piped human view
+                // never silently swaps formats.
                 const reveal = Boolean(opts.reveal);
-                if (reveal && !isInteractiveTerminal() && !opts.plaintext) {
-                    console.error(chalk.red('--reveal in a non-TTY requires --plaintext.'));
-                    process.exit(1);
-                }
                 const revealed = new Map();
                 if (reveal) {
                     const { env } = readAndResolveBundleEnv(bundle.name, {
@@ -1415,10 +1421,6 @@ export function registerSecretsCommands(program) {
                 return;
             }
             const reveal = Boolean(opts.reveal);
-            if (reveal && !isInteractiveTerminal() && !opts.plaintext) {
-                console.error(chalk.red('--reveal in a non-TTY requires --plaintext.'));
-                process.exit(1);
-            }
             // An explicit human `view --reveal` at a terminal is a deliberate value
             // access: resolve interactively (one Touch ID) so a locked bundle shows
             // its values. Under an agent (AGENTS_RUNTIME) or headless (no TTY) it
@@ -1491,50 +1493,38 @@ export function registerSecretsCommands(program) {
     });
     cmd
         .command('get <item> [key]')
-        .description('Print one secret value for shell hooks/automation. One arg = a raw keychain item by name; two args = one KEY out of a bundle (`get <bundle> <KEY>`). Cross-platform.')
+        .description('Print one raw keychain item by name, for shell hooks/automation. Cross-platform. Bundle values are never printed — run commands under `agents secrets exec` instead.')
         .action((item, key) => {
-        if (key === undefined) {
-            // Raw keychain item path — unchanged.
-            try {
-                // Routes through the platform keychain layer: macOS reads bare items
-                // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
-                // encrypted-file fallback. The value goes to stdout (newline-terminated
-                // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
-                // to stderr so they never pollute the captured value.
-                const value = getKeychainToken(item);
-                // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
-                // `item` is the keychain service name, never the value.
-                emitSecretAudit({ event: 'secrets.get', item, source: 'raw-item', status: 'success' });
-                process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
-            }
-            catch {
-                // Missing item is a normal, quiet outcome for a hook probe: exit 1,
-                // print nothing to stdout. Callers test the exit code / empty capture.
-                process.exit(1);
-            }
-            return;
+        if (key !== undefined) {
+            // The bundle-key form (`get <bundle> <KEY>`) is REMOVED (RUSH-2774): a
+            // one-liner that prints a bundle credential is the exfiltration path
+            // this change closes, for every caller. The injection replacement is
+            // just as short for a human script and never touches this stdout.
+            console.error(chalk.red(`'secrets get <bundle> <KEY>' has been removed — printing a bundle value to stdout is the exfiltration path this blocks.`));
+            console.error(chalk.dim(`Use: agents secrets exec ${item} -- printenv ${key}   (or run the consuming command directly under exec)`));
+            process.exit(1);
         }
-        // Bundle-key path: `get <bundle> <KEY>` prints exactly one resolved value.
-        // Ungated like the raw path (it IS the automation primitive); the
-        // `secrets.get` audit event is emitted inside readAndResolveBundleEnv.
+        // Raw keychain item path — a single ad-hoc token, not a credential bundle.
+        // Deliberately NOT agent-gated (unlike the removed bundle-key form): shell
+        // hooks that run inside agent sessions inherit the session env markers and
+        // legitimately capture a raw item into their own variables (e.g. the
+        // posthog analytics hook), where the value never reaches the transcript.
+        // A single ad-hoc token is the accepted narrower residual (RUSH-2774).
         try {
-            if (!bundleExists(item) && !(vaultExists() && !getVaultSession().loggedIn)) {
-                console.error(chalk.red(`Secrets bundle '${item}' not found.`));
-                process.exit(1);
-            }
-            // `secrets get` is the scriptable automation primitive ($(agents secrets
-            // get bundle KEY)). Every read is broker-only; a locked bundle points at
-            // the explicit unlock command instead of raising Touch ID.
-            const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key], keyMode: 'storage', agentOnly: true });
-            if (!(key in env)) {
-                console.error(chalk.red(`Key '${key}' not in bundle '${item}'.`));
-                process.exit(1);
-            }
-            const value = env[key];
+            // Routes through the platform keychain layer: macOS reads bare items
+            // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
+            // encrypted-file fallback. The value goes to stdout (newline-terminated
+            // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
+            // to stderr so they never pollute the captured value.
+            const value = getKeychainToken(item);
+            // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
+            // `item` is the keychain service name, never the value.
+            emitSecretAudit({ event: 'secrets.get', item, source: 'raw-item', status: 'success' });
             process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
         }
-        catch (err) {
-            console.error(chalk.red(err.message));
+        catch {
+            // Missing item is a normal, quiet outcome for a hook probe: exit 1,
+            // print nothing to stdout. Callers test the exit code / empty capture.
             process.exit(1);
         }
     });
@@ -2133,18 +2123,23 @@ Examples:
     });
     cmd
         .command('export [bundle]')
-        .description('Resolve a bundle and print KEY=VALUE lines, push it to a 1Password vault with --to-1password, or push it to remote machine(s) over SSH with --device.')
-        .option('--plaintext', 'Acknowledge that the resolved values will be printed in the clear (shell export mode)')
+        .description('Move a bundle without exposing it: push to remote machine(s) over SSH with --device, to a 1Password vault with --to-1password, or to an encrypted file with --to-file.')
+        // Both transport flags are hidden, not documented: the ONLY caller is the
+        // machine-to-machine SSH resolve (remoteResolveEnv / verifyRemoteKeychainPush),
+        // which sets AGENTS_SECRETS_REMOTE_TRANSPORT=1 on the remote invocation. The
+        // old public shell-eval mode (`eval "$(agents secrets export … --plaintext)"`)
+        // was the top agent-exfiltration path and is removed (RUSH-2774).
+        .addOption(new Option('--plaintext', 'internal remote-resolve transport').hideHelp())
+        .addOption(new Option('--format <json>', 'internal remote-resolve transport').hideHelp())
         .option('--to-1password', 'Push every key in the bundle as a PASSWORD item in a 1Password vault')
         .option('--vault <name>', '1Password vault name (used with --to-1password)')
         .option('--device <target...>', 'Push the bundle over SSH to this device (host alias or user@host); repeatable for multiple machines')
         .option('--remote-backend <backend>', 'Backend for the bundle on the remote device (with --device): keychain (default) or file. file is headless-readable via the remote\'s machine-local key; it forwards AGENTS_SECRETS_PASSPHRASE over stdin only if set (opt-in).', 'keychain')
         .option('--force', 'Overwrite existing keys/items on the target (used with --to-1password and --device)')
-        .option('--format <shell|json>', 'Output for --plaintext export: shell (default) or json (lossless, machine-readable; used by remote resolve)', 'shell')
         .option('--to-file <path>', `Write the bundle as an AES-256-GCM encrypted offline file (needs ${SYNC_PASSPHRASE_ENV}; symmetric counterpart of import --from-file)`)
         .action(async (bundleName, opts) => {
         try {
-            const { readAndResolveBundleEnv, bundleToEnvPrefix, isReservedEnvName } = await import('../lib/secrets/bundles.js');
+            const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
             const resolvedBundleName = bundleName ?? (await pickBundleName('export'));
             if (opts.toFile) {
                 // Transport, not the local store's master key — see lib/secrets/sync-passphrase.ts.
@@ -2251,41 +2246,36 @@ Examples:
                 console.log(chalk.green(`Exported to 1Password vault '${vault}': ${parts.join(', ')}.`));
                 return;
             }
-            if (opts.format && opts.format !== 'shell' && opts.format !== 'json') {
-                console.error(chalk.red(`Invalid --format ${JSON.stringify(opts.format)}. Expected 'shell' or 'json'.`));
+            // The shell-eval print mode (`eval "$(agents secrets export … --plaintext)"`)
+            // is REMOVED (RUSH-2774): a whole bundle printed to stdout lands in a
+            // coding agent's context and session transcript, and it was the single
+            // most-copied exfiltration one-liner on the fleet. The sole surviving
+            // stdout emitter is the machine-to-machine SSH resolve transport, which
+            // requires the remote-invocation marker AND a non-agent context — both
+            // set only by remoteResolveEnv / verifyRemoteKeychainPush building the
+            // remote command. Everything else gets the refusal with the paved paths.
+            const isTransportCall = process.env.AGENTS_SECRETS_REMOTE_TRANSPORT === '1' &&
+                Boolean(opts.plaintext) &&
+                opts.format === 'json' &&
+                !isAgentInvocationContext();
+            if (!isTransportCall) {
+                console.error(chalk.red('export no longer prints values. Pick a destination:'));
+                console.error(chalk.red('  --device <host> | --to-1password | --to-file <path>'));
+                console.error(chalk.dim(`Run a command with the values injected instead:  agents secrets exec ${resolvedBundleName} -- <cmd>`));
+                console.error(chalk.dim(`Reveal one value at your terminal:               agents secrets view ${resolvedBundleName} --reveal`));
                 process.exit(1);
             }
-            if (!opts.plaintext) {
-                console.error(chalk.red('export prints secrets in the clear and requires --plaintext (works for TTY and pipes alike).'));
-                process.exit(1);
-            }
-            // `agents secrets export --plaintext` is what release/CI scripts eval.
-            // Every caller is broker-only, including a plain shell, so export never
-            // raises Touch ID on the interactive user's screen.
+            // Machine-readable form consumed by `remoteResolveEnv` over SSH: single
+            // object of injected env KEY -> value; values verbatim. Broker-only, so a
+            // headless remote read fails fast rather than raising Touch ID. The
+            // resolve emits its own `secrets.get` audit on the remote; no export
+            // event here — that would tally every peer pull as an export.
             const { env } = readAndResolveBundleEnv(resolvedBundleName, {
-                caller: `export to shell`,
+                caller: 'remote resolve transport',
                 keyMode: 'process',
                 agentOnly: true,
             });
-            if (opts.format === 'json') {
-                // Machine-readable form consumed by `remoteResolveEnv` over SSH.
-                // Single object of injected env KEY -> value; values verbatim.
-                process.stdout.write(JSON.stringify(env));
-                return;
-            }
-            const prefix = bundleToEnvPrefix(resolvedBundleName);
-            for (const [k, v] of Object.entries(env)) {
-                const exportKey = isReservedEnvName(k) ? `${prefix}_${k}` : k;
-                const needsQuotes = /[\s$`"'\\|&;<>(){}[\]!#~]/.test(v);
-                const output = needsQuotes ? `'${v.replace(/'/g, `'\\''`)}'` : v;
-                process.stdout.write(`export ${exportKey}=${output}\n`);
-            }
-            // Record the shell export (the `eval "$(...)"` path). The `--format json`
-            // branch above is the machine-to-machine remote-resolve transport (already
-            // counted as an access on this machine by the resolve above), so it is
-            // deliberately not counted here as an export — that would tally every peer
-            // pull as an export.
-            emitSecretAudit({ event: 'secrets.export', bundle: resolvedBundleName, operation: 'export --plaintext', source: 'shell', status: 'success', keyCount: Object.keys(env).length });
+            process.stdout.write(JSON.stringify(env));
         }
         catch (err) {
             if (isPromptCancelled(err))