@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/accounts/slots.js

@@ -0,0 +1,100 @@
+/**
+ * Per-device account slots (PHNX-3940).
+ *
+ * An account is a credential slot, not an installation. The binary lives in
+ * the one managed harness install; each account gets a HOME-shaped dir under
+ * `~/.agents/.history/accounts/<harness>/<accountId>/` with no binary in it.
+ * Native OAuth files stay in this dir on the device that minted them and are
+ * never copied. Settings and resources are projected through the same writers
+ * version homes use (`carryForwardSettings`, `getWriter`) — credentials are
+ * excluded by those writers.
+ *
+ * Slot records live in the device doc (`deviceAccounts.slots`), never central.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { agentConfigDirName } from '../agents.js';
+import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
+import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
+import { carryForwardSettings } from '../settings-manifest.js';
+import { getHistoryDir, updateMeta } from '../state.js';
+import { ALL_RESOURCE_KINDS, getDetector, getWriter, kindToCapability } from '../staleness/registry.js';
+import { supports } from '../capabilities.js';
+import { isAgentId } from '../types.js';
+const AUTH_MODES = ['native', 'durable', 'per-device'];
+export function slotDir(harness, accountId) {
+    if (!isAgentId(harness))
+        throw new Error(`Unknown harness '${harness}' for a slot dir.`);
+    if (!accountId || /[\\/]|\.\./.test(accountId)) {
+        throw new Error(`Invalid account id '${accountId}' for a slot dir.`);
+    }
+    return path.join(getHistoryDir(), 'accounts', harness, accountId);
+}
+export function readSlots(meta) {
+    return { ...(meta.deviceAccounts?.slots ?? {}) };
+}
+export function recordSlot(accountId, slot) {
+    if (slot.accountId !== accountId) {
+        throw new Error(`recordSlot accountId mismatch: key '${accountId}' vs slot.accountId '${slot.accountId}'.`);
+    }
+    if (!AUTH_MODES.includes(slot.authMode)) {
+        throw new Error(`recordSlot: unknown authMode '${slot.authMode}'.`);
+    }
+    updateMeta((current) => ({
+        ...current,
+        deviceAccounts: {
+            ...current.deviceAccounts,
+            slots: { ...current.deviceAccounts?.slots, [accountId]: slot },
+        },
+    }));
+}
+function defaultAuthMode(harness) {
+    return harnessWorkerIsPerDevice(harness) ? 'per-device' : 'native';
+}
+function sourceVersion(harness) {
+    return getGlobalDefault(harness) ?? listInstalledVersions(harness)[0] ?? null;
+}
+function projectResources(harness, version, destHome, fromHome) {
+    const cwd = process.cwd();
+    for (const kind of ALL_RESOURCE_KINDS) {
+        if (!supports(harness, kindToCapability(kind), version).ok)
+            continue;
+        const writer = getWriter(kind, harness);
+        if (!writer)
+            continue;
+        if (kind === 'rules') {
+            writer.write({ version, versionHome: destHome, selection: { preset: 'default' }, cwd });
+            continue;
+        }
+        const names = getDetector(kind, harness)?.list({ version, versionHome: fromHome, cwd }) ?? [];
+        if (names.length === 0)
+            continue;
+        writer.write({ version, versionHome: destHome, selection: names, cwd });
+    }
+}
+/**
+ * Create the HOME-shaped slot dir and project settings/resources from the
+ * managed install. Does not copy credentials (carryForwardSettings excludes
+ * them; resource writers write skills/hooks/commands, never OAuth files).
+ * Does not persist the slot record — call {@link recordSlot} after identity
+ * is captured.
+ */
+export function ensureSlot(harness, accountId) {
+    harnessAuth(harness);
+    const dir = slotDir(harness, accountId);
+    fs.mkdirSync(path.join(dir, agentConfigDirName(harness)), { recursive: true });
+    const version = sourceVersion(harness);
+    if (version) {
+        const fromHome = getVersionHomePath(harness, version);
+        if (fs.existsSync(fromHome)) {
+            carryForwardSettings(harness, fromHome, dir);
+            projectResources(harness, version, dir, fromHome);
+        }
+    }
+    return {
+        accountId,
+        slotDir: dir,
+        authMode: defaultAuthMode(harness),
+        verdict: 'unconfigured',
+    };
+}

package/dist/lib/agent-spec/agents.d.ts

@@ -236,6 +236,22 @@ export declare function supportsAccountInspection(agentId: AgentId): boolean;
 export declare function accountDisplayLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
 /** Return the email address associated with the agent's auth config, or null. */
 export declare function getAccountEmail(agentId: AgentId, home?: string): Promise<string | null>;
+/**
+ * Extract full account information (identity, plan, usage status, credits) from
+ * the agent's local auth/config files. Supports Claude, Codex, and Gemini.
+ */
+/**
+ * Resolve a file-auth agent's credential file. Sign-in is account-global, but
+ * each installed version gets an isolated home; the credential physically lives
+ * only in the home the user logged in under (the one the `~/.<config>` symlink
+ * targets). Check the per-version `base` first, then fall back to the active
+ * config location under the real HOME so every installed version reflects the
+ * true account state (droid/antigravity/kimi all stored login per-version-home
+ * and showed non-active versions as "not signed in"). Returns the first
+ * existing path, or null.
+ */
+/** True when `dir` is under the per-account slot root (`~/.agents/.history/accounts/`). */
+export declare function isAccountSlotDir(dir: string): boolean;
 /** Where an agent's credential file lives, split into the per-version copy and
  *  the active/global copy under the real HOME. */
 export interface CredentialPresence {

package/dist/lib/agent-spec/agents.js

@@ -22,7 +22,8 @@ import { execFileShellSpec } from '../platform/index.js';
 import { latestFileMtimeMs } from '../fs-walk.js';
 import { damerauLevenshtein } from '../fuzzy.js';
 import { probeCapture } from '../probe.js';
-import { getCacheDir, getVersionsDir, getShimsDir, getHistoryDir, getCliVersionCachePath } from '../state.js';
+import { getCacheDir, getVersionsDir, getShimsDir, getHistoryDir, getCliVersionCachePath, readMeta } from '../state.js';
+import { registeredNativeAccountForEmail, parseNativeIdentityKey } from '../native-accounts.js';
 import { resolveVersion, getVersionHomePath, getBinaryPath } from '../installations/versions.js';
 import { supports } from '../capabilities.js';
 import { MCP_TARGETS } from '../mcp-registry.js';
@@ -1384,6 +1385,12 @@ export async function getAccountEmail(agentId, home) {
  * and showed non-active versions as "not signed in"). Returns the first
  * existing path, or null.
  */
+/** True when `dir` is under the per-account slot root (`~/.agents/.history/accounts/`). */
+export function isAccountSlotDir(dir) {
+    const root = path.resolve(getHistoryDir(), 'accounts');
+    const resolved = path.resolve(dir);
+    return resolved === root || resolved.startsWith(root + path.sep);
+}
 function resolveAccountCredentialPath(base, ...segments) {
     const perVersion = path.join(base, ...segments);
     try {
@@ -1391,6 +1398,10 @@ function resolveAccountCredentialPath(base, ...segments) {
             return perVersion;
     }
     catch { /* unreadable */ }
+    // A slot is the account's own HOME (PHNX-3940 T5). Never inherit another
+    // account's adopted ~/.<config> — that is the cross-account leak.
+    if (isAccountSlotDir(base))
+        return null;
     const active = path.join(process.env.AGENTS_REAL_HOME || os.homedir(), ...segments);
     if (active !== perVersion) {
         try {
@@ -1900,13 +1911,30 @@ export function readClaudeHomeConfig(base) {
     const oa = config.oauthAccount;
     if (!oa)
         return null;
-    const accountId = normalizeIdentityPart(oa.accountUuid);
-    const organizationId = normalizeIdentityPart(oa.organizationUuid);
+    const email = normalizeIdentityPart(oa.emailAddress);
+    let accountId = normalizeIdentityPart(oa.accountUuid);
+    let organizationId = normalizeIdentityPart(oa.organizationUuid);
+    // Worker slot provisioned from a durable setup-token: only the email was
+    // seeded on disk (seedClaudeWorkerHomeIdentity), so accountUuid/organizationUuid
+    // are absent and both accountKey and usageKey would be null — the row reads
+    // "not connected here" (PHNX-3940, sibling worker-identity diagnosis). Complete
+    // the identity from the fleet-synced registry row for this email, keyed exactly
+    // as a headed login's home carries it. Guarded on email-only so a headed home
+    // (uuids on disk) never pays the readMeta() read, and fails CLOSED to email-only
+    // when zero or several rows match (registeredNativeAccountForEmail never guesses).
+    if (email && !accountId && !organizationId) {
+        const registered = registeredNativeAccountForEmail(readMeta(), 'claude', email);
+        const parts = registered ? parseNativeIdentityKey('claude', registered.identityKey) : null;
+        if (parts) {
+            accountId = normalizeIdentityPart(parts.account);
+            organizationId = normalizeIdentityPart(parts.org);
+        }
+    }
     return {
         path: activeFile,
         config,
         identity: {
-            email: oa.emailAddress || null,
+            email: email ?? (oa.emailAddress || null),
             accountId,
             organizationId,
             organizationName: oa.organizationName ?? null,

package/dist/lib/app-bundle-install.js

@@ -1,10 +1,11 @@
 /**
  * Atomic, serialized install of a macOS `.app` bundle to a stable user path.
  *
- * Shared by the two helpers agents-cli installs on darwin — the secrets keychain
- * helper (`lib/secrets/install-helper.ts`) and the menu-bar helper
- * (`lib/menubar/install-menubar.ts`) — both of which are (re)installed on the hot
- * path of ordinary `agents` invocations. Both previously did a non-atomic
+ * Used by the menu-bar helper (`lib/menubar/install-menubar.ts`), which is
+ * (re)installed on the hot path of ordinary `agents` invocations. (A second
+ * helper this module used to also serve, the secrets keychain broker, moved
+ * out of this repo entirely with the standalone `secrets` engine —
+ * PHNX-3989 — and installs itself now.) It previously did a non-atomic
  * `rm -rf dest` + `cp -R src dest` straight onto the live bundle. That copy takes
  * long enough that a concurrent reader (Gatekeeper, or an exec of the bundle) sees
  * a half-written `.app` — a truncated Mach-O / mismatched `_CodeSignature` hash —

package/dist/lib/auth-health.d.ts

@@ -24,6 +24,8 @@ export interface AuthHealth {
     detail?: string;
     /** account label for display (email / id), when known. Never part of the key. */
     account?: string;
+    /** Stable registered account id. Display labels are never used as identity. */
+    accountId?: string;
 }
 /** Maximum age of an auth verdict used for automatic routing decisions. */
 export declare const AUTH_PROBE_MAX_AGE_MS: number;
@@ -173,6 +175,7 @@ export interface AuthProbeRow {
     agent: AgentId;
     version: string;
     account?: string;
+    accountId?: string;
     health: AuthHealth;
 }
 /** One installed (agent, version) home, tagged with its resolved account label. */

package/dist/lib/auth-health.js

@@ -255,6 +255,7 @@ export function readFleetAuthRows(host) {
             agent: agent,
             version: identity.slice(separator + 1),
             account: health.account,
+            accountId: health.accountId,
             health,
         });
     }
@@ -422,6 +423,14 @@ export async function probeLocalFleetAuth(opts) {
         inst.info = await getAccountInfo(inst.agent, inst.home).catch(() => null);
         inst.account = authAccountLabel(inst.info);
     }));
+    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
+        import('./state.js'),
+        import('./account-registry.js'),
+    ]);
+    const meta = readMeta();
+    for (const inst of installs) {
+        inst.accountId = findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
+    }
     // Probe once per (agent, account) — but only for the network-probing agents
     // that can actually 429; best-effort agents stay per-install (see
     // groupFleetAuthInstalls). Groups run in parallel: they target distinct
@@ -430,12 +439,14 @@ export async function probeLocalFleetAuth(opts) {
         const rep = group.probe;
         const health = await probeAuthHealth(rep.agent, rep.home, { cliVersion: opts?.cliVersion, info: rep.info, forceLive: opts?.forceLive, signal: opts?.signal });
         health.account = authAccountLabel(rep.info);
+        health.accountId = rep.accountId;
         if (health.verdict === 'unconfigured')
             return [];
         return group.members.map((inst) => ({
             agent: inst.agent,
             version: inst.version,
             account: health.account,
+            accountId: inst.accountId ?? health.accountId,
             // A distinct object per row so a later mutation of one can't bleed across.
             health: { ...health },
         }));

package/dist/lib/auth-mint.d.ts

@@ -15,25 +15,34 @@
  */
 import type { AgentId } from './types.js';
 import { type CredentialAccount } from './account-registry.js';
+import { type StorableCredentialKind } from './secrets-policy.js';
 import { type DriveOptions, type PtyDriver } from './fleet/remote-login.js';
 /** Well-formed Claude setup-token as it appears inside a TTY blob. */
 export declare const CLAUDE_SETUP_TOKEN_CAPTURE_RE: RegExp;
 export interface MintFlow {
     harness: AgentId;
     provider: string;
-    auth: 'setup-token';
-    /** Interactive mint argv after HOME=… <bin>. Null when stdin-seed only. */
+    auth: 'setup-token' | 'api-key';
+    /** Interactive mint argv after HOME=… <bin>. Null when stdin-seed only or an api-key collection flow. */
     mintArgs: string[] | null;
-    verificationUrlRegex: RegExp;
-    tokenCapture: RegExp;
+    /** api-key flows: the env var the collected key injects as on a worker (e.g. OPENAI_API_KEY). */
+    apiKeyEnv?: string;
+    /** setup-token flows: authorize-URL and token patterns scraped from the PTY. */
+    verificationUrlRegex?: RegExp;
+    tokenCapture?: RegExp;
 }
 /**
- * Harnesses that expose an interactive setup-token mint. Native device-code
- * login (codex/droid/kimi/grok) stays on `agents fleet login`; API keys stay
- * on `agents accounts add`. Adding a harness here without a real mint command
- * is a lying table — do not.
+ * Durable-credential flows per harness. Only Claude exposes an interactive
+ * setup-token MINT; every other harness's durable credential is a provider API
+ * key, COLLECTED via `--api-key` or a prompt by `accounts add` (never derived
+ * from OAuth). The api-key entries describe collection only — they have no
+ * mint argv, and `mintAndSeed` refuses them with the `accounts add` pointer.
+ * Native device-code login (kimi/antigravity) stays on `agents fleet login`.
+ * The apiKeyEnv values are pinned to HARNESS_AUTH's `api-key:<ENV>` worker
+ * kinds by auth-mint.test.ts — keep them in lockstep.
  */
 export declare const MINT_FLOWS: Record<string, MintFlow>;
+/** Harnesses with an interactive setup-token mint (api-key flows are collection, not mint). */
 export declare function listMintableHarnesses(): AgentId[];
 export declare function getMintFlow(harnessRaw: string): MintFlow;
 export declare function unmintableMessage(harness: string): string;
@@ -75,6 +84,32 @@ export declare function resolveMintIdentity(input: ResolveMintIdentityInput): Re
 export declare function seedReservedAuthToken(email: string, token: string): {
     key: string;
 };
+/**
+ * The env var a harness's durable worker credential injects as on a worker
+ * (claude's setup-token rides CLAUDE_CODE_OAUTH_TOKEN; api-key harnesses ride
+ * their MINT_FLOWS apiKeyEnv). Throws for a harness with no portable worker
+ * credential — kimi/antigravity log in per box.
+ */
+export declare function workerCredentialEnv(harness: AgentId): string;
+/**
+ * The reserved-store key for one account's worker credential:
+ * `<ENV>_<accountId>` — keyed by account id, never by name or email, so a
+ * rename or an email change never breaks the key. Hyphens are stripped because
+ * the bundle key grammar (`BUNDLE_KEY_PATTERN`) is env-var-shaped.
+ */
+export declare function workerCredentialStoreKey(harness: AgentId, accountId: string): string;
+/**
+ * Write (or rotate) one account's worker credential in the reserved
+ * `__<harness>__` store (PHNX-3940). Only non-rotating kinds may enter
+ * (`assertStorableCredentialKind` refuses a rotating OAuth/session credential at
+ * this boundary — RUSH-1958). FILE-backed, policy `never`, same contract as the
+ * legacy `auth` bundle: a keychain- or vault-backed store of this name fails
+ * loud, since worker provisioning reads the file backend.
+ */
+export declare function seedReservedStoreKey(harness: AgentId, kind: StorableCredentialKind, key: string, value: string): {
+    bundle: string;
+    key: string;
+};
 /**
  * Create or rotate the named provider account that `agents run --account` and
  * `agents accounts sync` consume. Existing account of a different kind fails
@@ -104,7 +139,7 @@ export interface DriveSetupTokenMintOpts extends MintDriveHooks {
  * Tears the session down on the way out (success, timeout, or throw).
  */
 export declare function driveSetupTokenMint(command: string, flow: MintFlow, opts?: DriveSetupTokenMintOpts): Promise<DriveMintResult>;
-export declare function buildMintCommand(flow: MintFlow, bin: string, home: string): string;
+export declare function buildMintCommand(flow: MintFlow, bin: string, home: string, env?: Record<string, string>): string;
 export declare function resolveMintInstallation(harness: AgentId): {
     version: string;
     bin: string;
@@ -146,13 +181,14 @@ export declare function resolveSyncTargets(fleet: boolean, devices: string[]): P
 /**
  * True when a Claude setup-token is already seeded on this box (setup status).
  *
- * Read-only status probe (`agents setup`, `agents doctor`) — the reserved
- * auth-bundle check below MUST NOT crash the whole command because the
- * keychain could not be reached (e.g. the macOS Keychain helper source is
- * unavailable — PHNX-3385); `bundleExists()`/`hasKeychainToken()` document
- * themselves as failing loud, but that contract is for destructive-write
- * guards, not a diagnostic. An unreachable keychain here just means "cannot
- * confirm the reserved bundle," reported honestly rather than propagated.
+ * Read-only status probe (`agents setup`, `agents doctor`) — neither the
+ * account-registry read nor the reserved auth-bundle check MUST crash the whole
+ * command because the secret store could not be reached (the macOS Keychain
+ * helper source unavailable — PHNX-3385 — or the standalone `secrets` CLI
+ * missing / unspawnable); the client's calls fail loud by contract, but that
+ * contract is for destructive-write guards, not a diagnostic. An unreachable
+ * store here just means "cannot confirm," reported honestly rather than
+ * propagated.
  */
 export declare function hasMintedSetupToken(): {
     ready: boolean;

package/dist/lib/auth-mint.js

@@ -1,26 +1,29 @@
 import { resolveAgentName } from './agents.js';
-import { AUTH_BUNDLE, claudeAccountTokenKey, isValidClaudeSetupToken, readClaudeAccountEmail, } from './claude-account-token.js';
+import { AUTH_BUNDLE, claudeAccountTokenKey, isValidClaudeSetupToken, readClaudeAccountEmail, invalidateClaudeSetupTokenCache, } from './claude-account-token.js';
 import { addAccount, findAccount, readAccountRegistry, setAccountSecret } from './account-registry.js';
-import { bundleBackend, bundleExists, keychainRef, readBundle, rotateBundleSecret, writeBundleWithItems, } from './secrets/bundles.js';
-import { secretsKeychainItem } from './secrets/index.js';
+import { bundleBackendSync, bundleExists, bundleExistsSync, keychainRef, pushBundleToHost, readBundleSync, rotateBundleSecretSync, secretsKeychainItem, storeSetSync, writeBundleWithItemsSync, } from './secrets-client.js';
+import { assertStorableCredentialKind, reservedStoreName, } from './secrets-policy.js';
 import { getBinaryPath, getGlobalDefault, getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 import { shellQuote } from './ssh-exec.js';
 import { defaultPtyDriver, } from './fleet/remote-login.js';
 import { showUrl } from './open-url.js';
 import { loadDevices } from './devices/registry.js';
 import { isSelfHost } from './devices/self-host.js';
-import { pushBundleToHost } from './secrets/push.js';
-import { assertCredentialTransportHostPinned, resolveHostSshTarget } from './secrets/remote.js';
+import { assertCredentialTransportHostPinned, resolveHostSshTarget } from './hosts/credential-transport.js';
 import { resolveRemoteOsSync } from './hosts/remote-os.js';
 /** Well-formed Claude setup-token as it appears inside a TTY blob. */
 export const CLAUDE_SETUP_TOKEN_CAPTURE_RE = /sk-ant-oat01-[A-Za-z0-9_-]+/;
 const ACCOUNT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /**
- * Harnesses that expose an interactive setup-token mint. Native device-code
- * login (codex/droid/kimi/grok) stays on `agents fleet login`; API keys stay
- * on `agents accounts add`. Adding a harness here without a real mint command
- * is a lying table — do not.
+ * Durable-credential flows per harness. Only Claude exposes an interactive
+ * setup-token MINT; every other harness's durable credential is a provider API
+ * key, COLLECTED via `--api-key` or a prompt by `accounts add` (never derived
+ * from OAuth). The api-key entries describe collection only — they have no
+ * mint argv, and `mintAndSeed` refuses them with the `accounts add` pointer.
+ * Native device-code login (kimi/antigravity) stays on `agents fleet login`.
+ * The apiKeyEnv values are pinned to HARNESS_AUTH's `api-key:<ENV>` worker
+ * kinds by auth-mint.test.ts — keep them in lockstep.
  */
 export const MINT_FLOWS = {
     claude: {
@@ -32,9 +35,15 @@ export const MINT_FLOWS = {
         verificationUrlRegex: /(https:\/\/[^\s"'<>]+)/i,
         tokenCapture: CLAUDE_SETUP_TOKEN_CAPTURE_RE,
     },
+    codex: { harness: 'codex', provider: 'openai', auth: 'api-key', mintArgs: null, apiKeyEnv: 'OPENAI_API_KEY' },
+    grok: { harness: 'grok', provider: 'xai', auth: 'api-key', mintArgs: null, apiKeyEnv: 'XAI_API_KEY' },
+    opencode: { harness: 'opencode', provider: 'opencode', auth: 'api-key', mintArgs: null, apiKeyEnv: 'OPENCODE_API_KEY' },
+    cursor: { harness: 'cursor', provider: 'cursor', auth: 'api-key', mintArgs: null, apiKeyEnv: 'CURSOR_API_KEY' },
+    droid: { harness: 'droid', provider: 'factory', auth: 'api-key', mintArgs: null, apiKeyEnv: 'FACTORY_API_KEY' },
 };
+/** Harnesses with an interactive setup-token mint (api-key flows are collection, not mint). */
 export function listMintableHarnesses() {
-    return Object.keys(MINT_FLOWS);
+    return Object.values(MINT_FLOWS).filter((f) => f.auth === 'setup-token').map((f) => f.harness);
 }
 export function getMintFlow(harnessRaw) {
     const harness = resolveAgentName(harnessRaw);
@@ -42,8 +51,12 @@ export function getMintFlow(harnessRaw) {
         throw new Error(`Unknown harness '${harnessRaw}'. Interactive setup-token mint is implemented for: ${listMintableHarnesses().join(', ')}.`);
     }
     const flow = MINT_FLOWS[harness];
-    if (flow)
+    if (flow?.auth === 'setup-token')
         return flow;
+    if (flow) {
+        throw new Error(`'${harness}' has no derivable token — its durable credential is an API key (${flow.apiKeyEnv}). `
+            + `Collect it with: agents accounts add ${harness} <name> --api-key <key>.`);
+    }
     throw new Error(unmintableMessage(harness));
 }
 export function unmintableMessage(harness) {
@@ -76,6 +89,8 @@ export function extractClaudeSetupToken(screen) {
 }
 /** First https URL on the screen, trailing punctuation stripped. */
 export function extractMintUrl(screen, flow) {
+    if (!flow.verificationUrlRegex)
+        return undefined;
     const text = stripAnsi(screen);
     const m = text.match(flow.verificationUrlRegex);
     if (!m)
@@ -154,14 +169,15 @@ export function resolveMintIdentity(input) {
 export function seedReservedAuthToken(email, token) {
     const cleaned = assertValidSetupToken(token);
     const key = claudeAccountTokenKey(email);
-    if (bundleExists(AUTH_BUNDLE)) {
-        const backend = bundleBackend(AUTH_BUNDLE);
+    if (bundleExistsSync(AUTH_BUNDLE)) {
+        const backend = bundleBackendSync(AUTH_BUNDLE);
         if (backend !== 'file') {
             throw new Error(`Reserved bundle '${AUTH_BUNDLE}' exists with backend '${backend}', but usage/probe only reads a FILE-backed auth bundle. Recreate it with: agents secrets create ${AUTH_BUNDLE} --backend file --policy never --i-understand --force`);
         }
-        const bundle = readBundle(AUTH_BUNDLE);
+        const bundle = readBundleSync(AUTH_BUNDLE);
         if (key in bundle.vars) {
-            rotateBundleSecret(bundle, key, { newValue: cleaned, meta: { type: 'token' } });
+            rotateBundleSecretSync(bundle, key, { newValue: cleaned, meta: { type: 'token' } });
+            invalidateClaudeSetupTokenCache();
             return { key };
         }
         const item = secretsKeychainItem(AUTH_BUNDLE, key);
@@ -169,7 +185,8 @@ export function seedReservedAuthToken(email, token) {
         if (!bundle.meta)
             bundle.meta = {};
         bundle.meta[key] = { type: 'token' };
-        writeBundleWithItems(bundle, new Map([[item, cleaned]]));
+        writeBundleWithItemsSync(bundle, new Map([[item, cleaned]]));
+        invalidateClaudeSetupTokenCache();
         return { key };
     }
     const item = secretsKeychainItem(AUTH_BUNDLE, key);
@@ -181,9 +198,59 @@ export function seedReservedAuthToken(email, token) {
         vars: { [key]: keychainRef(key) },
         meta: { [key]: { type: 'token' } },
     };
-    writeBundleWithItems(bundle, new Map([[item, cleaned]]));
+    writeBundleWithItemsSync(bundle, new Map([[item, cleaned]]));
+    invalidateClaudeSetupTokenCache();
     return { key };
 }
+/**
+ * The env var a harness's durable worker credential injects as on a worker
+ * (claude's setup-token rides CLAUDE_CODE_OAUTH_TOKEN; api-key harnesses ride
+ * their MINT_FLOWS apiKeyEnv). Throws for a harness with no portable worker
+ * credential — kimi/antigravity log in per box.
+ */
+export function workerCredentialEnv(harness) {
+    if (harness === 'claude')
+        return 'CLAUDE_CODE_OAUTH_TOKEN';
+    const flow = MINT_FLOWS[harness];
+    if (flow?.auth === 'api-key' && flow.apiKeyEnv)
+        return flow.apiKeyEnv;
+    throw new Error(`No portable worker credential env for '${harness}' — it logs in per box.`);
+}
+/**
+ * The reserved-store key for one account's worker credential:
+ * `<ENV>_<accountId>` — keyed by account id, never by name or email, so a
+ * rename or an email change never breaks the key. Hyphens are stripped because
+ * the bundle key grammar (`BUNDLE_KEY_PATTERN`) is env-var-shaped.
+ */
+export function workerCredentialStoreKey(harness, accountId) {
+    const slug = accountId.replace(/-/g, '');
+    if (!/^[A-Za-z0-9_]+$/.test(slug) || !slug) {
+        throw new Error(`Invalid account id '${accountId}' for a worker credential key.`);
+    }
+    return `${workerCredentialEnv(harness)}_${slug}`;
+}
+/**
+ * Write (or rotate) one account's worker credential in the reserved
+ * `__<harness>__` store (PHNX-3940). Only non-rotating kinds may enter
+ * (`assertStorableCredentialKind` refuses a rotating OAuth/session credential at
+ * this boundary — RUSH-1958). FILE-backed, policy `never`, same contract as the
+ * legacy `auth` bundle: a keychain- or vault-backed store of this name fails
+ * loud, since worker provisioning reads the file backend.
+ */
+export function seedReservedStoreKey(harness, kind, key, value) {
+    assertStorableCredentialKind(kind, harness);
+    const name = reservedStoreName(harness);
+    const cleaned = value.trim();
+    if (!cleaned)
+        throw new Error(`Empty ${kind} for reserved store '${name}' key ${key}.`);
+    // A `__<harness>__` reserved store is written and read as raw FILE-backed items,
+    // never as a standalone bundle: the standalone's bundle-name validation rejects
+    // the `__`-wrapped reserved name, so the worker credential rides the raw item
+    // directly, symmetric with how `readReservedCredential` reads it. A first write
+    // and a rotation are the same operation — `store.set` overwrites the item value.
+    storeSetSync('file', secretsKeychainItem(name, key), cleaned);
+    return { bundle: name, key };
+}
 /**
  * Create or rotate the named provider account that `agents run --account` and
  * `agents accounts sync` consume. Existing account of a different kind fails
@@ -211,6 +278,9 @@ function emitMintProgress(line, json) {
  * Tears the session down on the way out (success, timeout, or throw).
  */
 export async function driveSetupTokenMint(command, flow, opts = {}) {
+    if (flow.auth !== 'setup-token' || !flow.tokenCapture) {
+        throw new Error(`Harness '${flow.harness}' has no interactive mint command.`);
+    }
     const driver = opts.driver ?? defaultPtyDriver();
     const initialDelayMs = opts.drive?.initialDelayMs ?? 1500;
     const pollMs = opts.drive?.pollMs ?? 500;
@@ -274,12 +344,16 @@ export async function driveSetupTokenMint(command, flow, opts = {}) {
         await driver.stop(id).catch(() => { });
     }
 }
-export function buildMintCommand(flow, bin, home) {
-    if (!flow.mintArgs) {
+export function buildMintCommand(flow, bin, home, env = {}) {
+    if (flow.auth !== 'setup-token' || !flow.mintArgs) {
         throw new Error(`Harness '${flow.harness}' has no interactive mint command.`);
     }
     const args = flow.mintArgs.map(shellQuote).join(' ');
-    return `HOME=${shellQuote(home)} ${shellQuote(bin)} ${args}`;
+    const envPrefix = [
+        `HOME=${shellQuote(home)}`,
+        ...Object.entries(env).map(([k, v]) => `${k}=${shellQuote(v)}`),
+    ].join(' ');
+    return `${envPrefix} ${shellQuote(bin)} ${args}`;
 }
 export function resolveMintInstallation(harness) {
     const installed = listInstalledVersions(harness);
@@ -382,7 +456,7 @@ async function syncMintedBundles(accountName, device) {
         const account = findAccount(accountName);
         if (!account)
             throw new Error(`Unknown provider account '${accountName}'.`);
-        const accountPush = pushBundleToHost(accountName, device, {
+        const accountPush = await pushBundleToHost(accountName, device, {
             remoteBackend,
             force: true,
             operation: 'accounts mint --fleet',
@@ -397,8 +471,8 @@ async function syncMintedBundles(accountName, device) {
         });
         if (!accountPush.ok)
             throw new Error(accountPush.message);
-        if (bundleExists(AUTH_BUNDLE)) {
-            const authPush = pushBundleToHost(AUTH_BUNDLE, device, {
+        if (await bundleExists(AUTH_BUNDLE)) {
+            const authPush = await pushBundleToHost(AUTH_BUNDLE, device, {
                 remoteBackend: 'file',
                 force: true,
                 operation: 'accounts mint --fleet',
@@ -417,32 +491,36 @@ async function syncMintedBundles(accountName, device) {
 /**
  * True when a Claude setup-token is already seeded on this box (setup status).
  *
- * Read-only status probe (`agents setup`, `agents doctor`) — the reserved
- * auth-bundle check below MUST NOT crash the whole command because the
- * keychain could not be reached (e.g. the macOS Keychain helper source is
- * unavailable — PHNX-3385); `bundleExists()`/`hasKeychainToken()` document
- * themselves as failing loud, but that contract is for destructive-write
- * guards, not a diagnostic. An unreachable keychain here just means "cannot
- * confirm the reserved bundle," reported honestly rather than propagated.
+ * Read-only status probe (`agents setup`, `agents doctor`) — neither the
+ * account-registry read nor the reserved auth-bundle check MUST crash the whole
+ * command because the secret store could not be reached (the macOS Keychain
+ * helper source unavailable — PHNX-3385 — or the standalone `secrets` CLI
+ * missing / unspawnable); the client's calls fail loud by contract, but that
+ * contract is for destructive-write guards, not a diagnostic. An unreachable
+ * store here just means "cannot confirm," reported honestly rather than
+ * propagated.
  */
 export function hasMintedSetupToken() {
-    const records = Object.values(readAccountRegistry().accounts);
-    const setup = records.filter((a) => a.auth === 'setup-token' && a.provider === 'anthropic');
-    if (setup.length) {
-        return { ready: true, detail: `${setup.length} Claude setup-token account${setup.length === 1 ? '' : 's'}` };
-    }
     try {
-        if (bundleExists(AUTH_BUNDLE) && bundleBackend(AUTH_BUNDLE) === 'file') {
-            const bundle = readBundle(AUTH_BUNDLE);
+        // The registry is the account bundles behind the standalone `secrets` CLI, so
+        // this read is as reachable — or as unreachable — as the auth-bundle read
+        // below and sits inside the same guard.
+        const records = Object.values(readAccountRegistry().accounts);
+        const setup = records.filter((a) => a.auth === 'setup-token' && a.provider === 'anthropic');
+        if (setup.length) {
+            return { ready: true, detail: `${setup.length} Claude setup-token account${setup.length === 1 ? '' : 's'}` };
+        }
+        if (bundleExistsSync(AUTH_BUNDLE) && bundleBackendSync(AUTH_BUNDLE) === 'file') {
+            const bundle = readBundleSync(AUTH_BUNDLE);
             const keys = Object.keys(bundle.vars).filter((k) => k.startsWith('CLAUDE_CODE_OAUTH_TOKEN_'));
             if (keys.length)
                 return { ready: true, detail: `reserved auth bundle (${keys.length} account key${keys.length === 1 ? '' : 's'})` };
         }
     }
     catch (err) {
-        return { ready: false, detail: `could not check the reserved auth bundle: ${err.message}` };
+        return { ready: false, detail: `could not check the secret store: ${err.message}` };
     }
-    return { ready: false, detail: 'no Claude setup-token minted — agents accounts mint claude' };
+    return { ready: false, detail: 'no Claude setup-token minted — agents accounts add claude [name]' };
 }
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));