@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/daemon/daemon.test-fixture.d.ts

@@ -1,4 +1,3 @@
-import { type KeychainBackend } from '../secrets/index.js';
 /**
  * Shared fixture for the daemon.*.test.ts suite slices (RUSH-2819).
  *
@@ -9,15 +8,14 @@ import { type KeychainBackend } from '../secrets/index.js';
  * process-spawning / real-daemon integration tests across workers; the
  * helpers shared by more than one slice live here.
  */
-/** An in-memory KeychainBackend stand-in, so a test never touches the real OS keychain. */
-export declare function makeMemoryBackend(): {
-    backend: KeychainBackend;
-    store: Map<string, string>;
-};
 /**
- * Registers the keychain-backend swap + AGENTS_SECRETS_NO_AGENT hermeticity
- * beforeEach/afterEach every slice of the original daemon.test.ts ran under,
- * verbatim. Call once at the top level of each slice file.
+ * Isolates every slice against a fresh, empty standalone `secrets` store
+ * (PHNX-3989) — an in-process fake keychain can no longer serve reads, since
+ * the client always spawns the real standalone, and several slices here also
+ * spawn a REAL `__daemon-run` subprocess that must see the SAME isolated
+ * store (a fresh `SECRETS_HOME` covers both: `useFreshSecretsHome` sets it as
+ * a `process.env` var, which every spawned child inherits by default). Call
+ * once at the top level of each slice file.
  */
 export declare function installKeychainHermeticity(): void;
 export declare const REPO_ROOT: string;

package/dist/lib/daemon/daemon.test-fixture.js

@@ -1,8 +1,9 @@
 import { beforeEach, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
-import { setKeychainBackendForTest } from '../secrets/index.js';
-import { deleteBundle } from '../secrets/bundles.js';
+import { deleteBundleSync, _resetSecretsClientForTest } from '../secrets-client.js';
 /**
  * Shared fixture for the daemon.*.test.ts suite slices (RUSH-2819).
  *
@@ -13,54 +14,35 @@ import { deleteBundle } from '../secrets/bundles.js';
  * process-spawning / real-daemon integration tests across workers; the
  * helpers shared by more than one slice live here.
  */
-/** An in-memory KeychainBackend stand-in, so a test never touches the real OS keychain. */
-export function makeMemoryBackend() {
-    const store = new Map();
-    const backend = {
-        has: (item) => store.has(item),
-        get: (item) => {
-            const v = store.get(item);
-            if (v === undefined)
-                throw new Error(`Keychain item '${item}' not found.`);
-            return v;
-        },
-        set: (item, value) => { store.set(item, value); },
-        delete: (item) => store.delete(item),
-        list: (prefix) => Array.from(store.keys()).filter((k) => k.startsWith(prefix)),
-    };
-    return { backend, store };
-}
 /**
- * Registers the keychain-backend swap + AGENTS_SECRETS_NO_AGENT hermeticity
- * beforeEach/afterEach every slice of the original daemon.test.ts ran under,
- * verbatim. Call once at the top level of each slice file.
+ * Isolates every slice against a fresh, empty standalone `secrets` store
+ * (PHNX-3989) — an in-process fake keychain can no longer serve reads, since
+ * the client always spawns the real standalone, and several slices here also
+ * spawn a REAL `__daemon-run` subprocess that must see the SAME isolated
+ * store (a fresh `SECRETS_HOME` covers both: `useFreshSecretsHome` sets it as
+ * a `process.env` var, which every spawned child inherits by default). Call
+ * once at the top level of each slice file.
  */
 export function installKeychainHermeticity() {
-    let restore = null;
-    let prevNoAgent;
+    let home = '';
+    let saved;
     beforeEach(() => {
-        const m = makeMemoryBackend();
-        restore = setKeychainBackendForTest(m.backend);
-        // Hermeticity: readAndResolveBundleEnv consults the running secrets-agent
-        // (bundles.ts agentGetSync fast-path) BEFORE the injected keychain backend.
-        // On a dev machine where the agent is live and the real `claude` bundle is
-        // unlocked, that returns the machine's real CLAUDE_CODE_OAUTH_TOKEN and this
-        // test reads a live credential instead of the seeded value (CI has no agent,
-        // so it only bites locally). Disable the agent so the read falls through to
-        // the in-memory backend above — hermetic regardless of host state.
-        prevNoAgent = process.env.AGENTS_SECRETS_NO_AGENT;
-        process.env.AGENTS_SECRETS_NO_AGENT = '1';
+        saved = process.env.SECRETS_HOME;
+        home = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-daemon-secrets-home-'));
+        process.env.SECRETS_HOME = home;
+        _resetSecretsClientForTest();
     });
     afterEach(() => {
         try {
-            deleteBundle('claude');
+            deleteBundleSync('claude');
         }
         catch { /* not created */ }
-        setKeychainBackendForTest(restore);
-        if (prevNoAgent === undefined)
-            delete process.env.AGENTS_SECRETS_NO_AGENT;
+        if (saved === undefined)
+            delete process.env.SECRETS_HOME;
         else
-            process.env.AGENTS_SECRETS_NO_AGENT = prevNoAgent;
+            process.env.SECRETS_HOME = saved;
+        _resetSecretsClientForTest();
+        fs.rmSync(home, { recursive: true, force: true });
     });
 }
 // The real compiled CLI entry, shared by every slice that drives an actual

package/dist/lib/daemon/harness-update-service.d.ts

@@ -10,7 +10,7 @@
  * staging an npm install into a sibling directory, `fs.renameSync`/`fs.cpSync`
  * swaps, `fs.rmSync` cleanup — potentially across several installations in one
  * tick. Running that inline on the daemon's own event loop would stall every
- * other service (secrets broker, browser IPC, the scheduler) for the
+ * other service (browser IPC, the scheduler, monitors) for the
  * duration, the same class of problem `self-update-service.ts` solves for the
  * CLI's OWN upgrade by installing into a fresh process it then exits into.
  * Here there is no "exit and let the supervisor restart" option (the daemon

package/dist/lib/daemon/harness-update-service.js

@@ -10,7 +10,7 @@
  * staging an npm install into a sibling directory, `fs.renameSync`/`fs.cpSync`
  * swaps, `fs.rmSync` cleanup — potentially across several installations in one
  * tick. Running that inline on the daemon's own event loop would stall every
- * other service (secrets broker, browser IPC, the scheduler) for the
+ * other service (browser IPC, the scheduler, monitors) for the
  * duration, the same class of problem `self-update-service.ts` solves for the
  * CLI's OWN upgrade by installing into a fresh process it then exits into.
  * Here there is no "exit and let the supervisor restart" option (the daemon

package/dist/lib/daemon/runner.d.ts

@@ -18,7 +18,7 @@ import { readMeta } from '../state.js';
 import type { AgentId } from '../types.js';
 import { type FallbackEntry } from '../exec.js';
 import type { LoopDeps } from '../loop.js';
-import { resolveRunVersion, resolveAccountVersion, type RotateResult } from '../accounting/rotate.js';
+import { resolveRunVersion, resolveAccountCandidate, resolveAccountVersion, type RotateResult } from '../accounting/rotate.js';
 /** Result of a completed job execution, including metadata and optional report. */
 export interface RunResult {
     meta: RunMeta;
@@ -110,7 +110,11 @@ export interface RoutineLaunchPlan {
     rotation: RotateResult | null;
     /** True when `config.version` pinned the target (no rotation). */
     pinned: boolean;
-    /** False when `account` names a harness-native login rather than a durable credential. */
+    /**
+     * When true, `buildJobCommand` appends `--account`. Native slot accounts
+     * share one managed-install version, so the pin is forwarded rather than
+     * treated as implied by the version. False only when the caller opts out.
+     */
     forwardAccount?: boolean;
 }
 /** Claude's own local auth check; unlike account metadata it cannot mistake identity for a usable login. */
@@ -127,6 +131,7 @@ export declare function claudeVersionIsAuthenticated(version: string): boolean;
 export declare function resolveRoutineLaunch(config: JobConfig, cwd?: string, deps?: {
     resolveRunVersion?: typeof resolveRunVersion;
     resolveAccountVersion?: typeof resolveAccountVersion;
+    resolveAccountCandidate?: typeof resolveAccountCandidate;
     findCredentialAccount?: (name: string) => boolean;
     readMeta?: typeof readMeta;
     resolveCredentialAccount?: (name: string, host: AgentId) => {
@@ -181,7 +186,14 @@ export declare function buildHostDispatchOptions(config: JobConfig, ctx: {
     runDir: string;
     detached: boolean;
 }): import('../hosts/run-target.js').HostPromptRun;
-export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume' | 'agent'>): boolean;
+export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume' | 'agent' | 'account'>): boolean;
+/**
+ * Inject a provider account's env into a routine spawn. Native accounts do not
+ * belong here — they re-enter `agents run <agent>#<name>` so T5 slot resolution
+ * picks the HOME. A provider-pinned routine stays on this path so the durable
+ * credential is still in the child env (PHNX-3940 T5 seam / T7).
+ */
+export declare function mergeRoutineProviderEnv(env: Record<string, string>, config: Pick<JobConfig, 'account' | 'agent' | 'workflow' | 'resume'>, agent: AgentId): Record<string, string>;
 /**
  * Merge sandbox/base env with the canonical per-version exec env
  * (CLAUDE_CONFIG_DIR / CODEX_HOME / …) so routines share account isolation

package/dist/lib/daemon/runner.js

@@ -39,10 +39,11 @@ import { logAndContinueOnLockCompromised } from '../lock-compromise.js';
 import { walkForFiles } from '../fs-walk.js';
 import { getBinaryPath, isVersionInstalled, resolveVersion, getVersionHomePath } from '../installations/versions.js';
 import { resolveClaudeSetupToken } from '../claude-account-token.js';
-import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountVersion, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, formatNoVerifiedUsageError, } from '../accounting/rotate.js';
+import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountCandidate, rotationFailoverChain, readinessFromCandidate, formatNoHealthyAccountError, formatNoVerifiedUsageError, } from '../accounting/rotate.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from '../device-config.js';
 import { isSelfUpdatingAgent, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
 import { isCustomHarnessName, readProfile } from '../profiles.js';
+import { findAccount, findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } from '../account-registry.js';
 export class RoutineAlreadyRunningError extends Error {
     constructor(jobName, runId) {
         super(`Routine '${jobName}' already has a running execution (${runId})`);
@@ -571,6 +572,19 @@ export function buildJobCommand(config, resolvedPrompt, forwardAccount = true) {
             cmd.push('--account', config.account);
         return cmd;
     }
+    // Native slot accounts share one managed binary version, so the baked
+    // harness argv cannot identify which login to spawn. Dispatch through
+    // `agents run <agent>#<name>` (the same seam as resume/custom) so T5
+    // spawn-time resolution selects the slot. `--account` is an agents-cli
+    // flag; the harness binary would ignore or reject it.
+    // Provider/durable-pinned accounts stay on the harness argv + env-injection
+    // path: `#name` is a native selector and would not inject their bundle.
+    if (config.account && forwardAccount && !findAccount(config.account)) {
+        const spec = config.version
+            ? `${agent}@${config.version}#${config.account}`
+            : `${agent}#${config.account}`;
+        return ['agents', 'run', spec, resolvedPrompt, '--mode', config.mode];
+    }
     const template = bakeRoutineArgv(agent);
     if (!template) {
         // A name outside both tables was either never valid or was a custom
@@ -934,7 +948,11 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
             throw new Error(`Routine '${config.name}' account '${config.account}' is a ${unified.agent} login and cannot authenticate ${agent}.`);
         }
         const identity = unified?.kind === 'native' ? unified.identityKey : config.account;
-        const accountVersion = await (deps.resolveAccountVersion ?? resolveAccountVersion)(agent, identity);
+        // Prefer the full candidate so a slot-sourced native account (shared
+        // managed-install `version`) still carries its name for `--account`.
+        const accountVersion = deps.resolveAccountVersion
+            ? await deps.resolveAccountVersion(agent, identity)
+            : (await (deps.resolveAccountCandidate ?? resolveAccountCandidate)(agent, identity))?.version ?? null;
         if (accountVersion) {
             if (config.version && config.version !== accountVersion) {
                 throw new Error(`Routine '${config.name}' account '${config.account}' is signed in at ${agent}@${accountVersion}, not pinned ${agent}@${config.version}.`);
@@ -943,7 +961,10 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
                 chain: [{ agent, version: config.version ?? accountVersion }],
                 rotation: null,
                 pinned: true,
-                forwardAccount: false,
+                // Post-T5 every native slot on a harness shares the managed binary
+                // version, so the version pin is no longer enough — forward `--account`
+                // (name or `#name`) so spawn resolves the selected slot.
+                forwardAccount: true,
             };
         }
         throw new Error(`Routine '${config.name}' account '${config.account}' is not signed in for ${agent}; refusing to rotate to another account.`);
@@ -1144,7 +1165,29 @@ export function buildHostDispatchOptions(config, ctx) {
     };
 }
 export function dispatchesViaAgentsRun(config) {
-    return Boolean(config.workflow || config.resume || (config.agent && isCustomHarnessName(config.agent)));
+    return Boolean(config.workflow
+        || config.resume
+        || (config.agent && isCustomHarnessName(config.agent))
+        || (config.account && config.agent && !findAccount(config.account)));
+}
+/**
+ * Inject a provider account's env into a routine spawn. Native accounts do not
+ * belong here — they re-enter `agents run <agent>#<name>` so T5 slot resolution
+ * picks the HOME. A provider-pinned routine stays on this path so the durable
+ * credential is still in the child env (PHNX-3940 T5 seam / T7).
+ */
+export function mergeRoutineProviderEnv(env, config, agent) {
+    if (dispatchesViaAgentsRun({ ...config, agent }))
+        return env;
+    const meta = readMeta();
+    const selected = resolveAccountSelection(config.account, agent, meta);
+    if (!selected)
+        return env;
+    const unified = findUnifiedAccount(selected.id, meta, undefined, agent);
+    if (unified?.kind !== 'provider')
+        return env;
+    Object.assign(env, resolveCredentialAccount(unified.name, agent).env);
+    return env;
 }
 /**
  * Merge sandbox/base env with the canonical per-version exec env
@@ -1390,18 +1433,7 @@ async function executeJobPlaced(config, deps, attempt) {
         : harnessName
             ? readProfile(harnessName).host.agent
             : config.agent;
-    if (!dispatchesViaAgentsRun(config)) {
-        const { findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
-        const meta = readMeta();
-        const selectedAccount = resolveAccountSelection(config.account, effectiveAgent, meta)?.id;
-        if (selectedAccount) {
-            // Only a provider account injects env; a native account (explicit or via a
-            // device-scoped binding) is read from the harness home and forwards nothing.
-            const unified = findUnifiedAccount(selectedAccount, meta);
-            if (unified?.kind === 'provider')
-                Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, effectiveAgent).env);
-        }
-    }
+    mergeRoutineProviderEnv(baseEnv, config, effectiveAgent);
     // RUSH-2860: if this host holds gh auth, the sandbox child MUST see it.
     if (useSandbox)
         assertSandboxForwardsHostGhAuth(baseEnv);
@@ -1912,14 +1944,7 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
     const baseEnv = injectRoutineActor(useSandbox
         ? buildSpawnEnv(overlayHome, config.env)
         : { ...process.env }, config);
-    if (!dispatchesViaAgentsRun(config)) {
-        const { findAccount, resolveAccountSelection, resolveCredentialAccount } = await import('../account-registry.js');
-        const selectedAccount = config.account && !findAccount(config.account)
-            ? undefined
-            : resolveAccountSelection(config.account, config.agent, readMeta())?.id;
-        if (selectedAccount)
-            Object.assign(baseEnv, resolveCredentialAccount(selectedAccount, config.agent).env);
-    }
+    mergeRoutineProviderEnv(baseEnv, config, config.agent);
     const spawnEnv = dispatchesViaAgentsRun(config)
         ? (() => {
             const e = { ...baseEnv };

package/dist/lib/daemon-health.d.ts

@@ -1,5 +1,4 @@
 /** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
-export declare const SUBSYSTEM_SECRETS_BROKER = "secrets-broker";
 export declare const SUBSYSTEM_BROWSER_IPC = "browser-ipc";
 /**
  * Daemon startup itself (RUSH-2418). Unlike the two above, this record is
@@ -12,7 +11,7 @@ export declare const SUBSYSTEM_BROWSER_IPC = "browser-ipc";
 export declare const SUBSYSTEM_DAEMON_START = "daemon-start";
 /** One subsystem's health as of the last time it reported in. */
 export interface SubsystemHealth {
-    /** Stable identifier, e.g. 'secrets-broker', 'browser-ipc'. */
+    /** Stable identifier, e.g. 'browser-ipc', 'monitors'. */
     subsystem: string;
     /** Most recent error message, or null if it has never failed. */
     lastError: string | null;

package/dist/lib/daemon-health.js

@@ -4,17 +4,19 @@
  * Today a subsystem failure inside `runDaemon()` (daemon.ts) is a single
  * `log('ERROR', ...)` line that scrolls out of the log file and is never
  * surfaced anywhere else — `agents daemon status` has no way to answer "is the
- * secrets broker actually healthy right now?" beyond "the daemon process is
- * alive". This module gives every subsystem a small persisted record —
+ * browser IPC server actually healthy right now?" beyond "the daemon process
+ * is alive". This module gives every subsystem a small persisted record —
  * {@link SubsystemHealth} — so `agents daemon status` / `agents daemon
  * services` can report health, not just liveness (RUSH-2354).
  *
  * Scheduled routines get this for free once migrated onto `agents routines`
  * (their run history already carries success/failure — `agents routines
  * stats`). This module exists for the subsystems that predate routines and have
- * no run history of their own: the secrets broker and the browser IPC server,
- * plus the daemon's own startup (`SUBSYSTEM_DAEMON_START`, RUSH-2418) — which
- * is the one record that also GATES behaviour rather than only reporting it.
+ * no run history of their own: the browser IPC server, plus the daemon's own
+ * startup (`SUBSYSTEM_DAEMON_START`, RUSH-2418) — which is the one record that
+ * also GATES behaviour rather than only reporting it. The secrets broker moved
+ * with the standalone `secrets` engine (PHNX-3989 OWN-1) — this daemon no
+ * longer hosts or supervises it, so it carries no health record here.
  *
  * File-backed (one JSON object keyed by subsystem name) rather than in-memory
  * because `agents daemon status` runs as a SEPARATE process from the daemon —
@@ -26,7 +28,6 @@ import { getDaemonDir } from './state.js';
 import { atomicWriteFileSync, ensureLockTarget, withFileLock } from './fs-atomic.js';
 const HEALTH_FILE = 'health.json';
 /** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
-export const SUBSYSTEM_SECRETS_BROKER = 'secrets-broker';
 export const SUBSYSTEM_BROWSER_IPC = 'browser-ipc';
 /**
  * Daemon startup itself (RUSH-2418). Unlike the two above, this record is

package/dist/lib/daemon-services.d.ts

@@ -7,7 +7,7 @@
  * enabled without pulling in the whole daemon lifecycle.
  */
 /** Every service the daemon can host. IDs are kebab-case and stable. */
-export type DaemonServiceId = 'secrets-broker' | 'scheduler' | 'catchup' | 'monitors' | 'browser-ipc' | 'webhook-receiver' | 'self-heal' | 'self-update' | 'keychain-reap' | 'account-state' | 'account-auth' | 'watchdog' | 'device-probe' | 'state-dir-check' | 'session-index' | 'auth-sync' | 'usage-sync' | 'daemon-heartbeat' | 'tmux-reap' | 'browser-task-reap' | 'session-state' | 'session-summarizer' | 'harness-update';
+export type DaemonServiceId = 'scheduler' | 'catchup' | 'monitors' | 'browser-ipc' | 'webhook-receiver' | 'self-heal' | 'self-update' | 'account-state' | 'account-auth' | 'watchdog' | 'device-probe' | 'state-dir-check' | 'session-index' | 'auth-sync' | 'usage-sync' | 'daemon-heartbeat' | 'tmux-reap' | 'browser-task-reap' | 'session-state' | 'session-summarizer' | 'harness-update';
 /** Human-readable metadata for each service. */
 export interface DaemonServiceDef {
     id: DaemonServiceId;

package/dist/lib/daemon-services.js

@@ -12,11 +12,6 @@ import * as yaml from 'yaml';
 import { getDaemonConfigDir } from './state.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 export const DAEMON_SERVICES = [
-    {
-        id: 'secrets-broker',
-        title: 'Secrets broker',
-        description: 'Hosts the keychain-backed secrets broker socket so unlocked bundles stay warm across agent runs.',
-    },
     {
         id: 'scheduler',
         title: 'Routine scheduler',
@@ -40,7 +35,7 @@ export const DAEMON_SERVICES = [
     {
         id: 'webhook-receiver',
         title: 'Webhook receiver',
-        description: 'Hosts signed GitHub/Linear webhook ingress declared in daemon/webhooks.yaml, drawing signing secrets from the broker; binds nothing when no receivers are declared.',
+        description: 'Hosts signed GitHub/Linear webhook ingress declared in daemon/webhooks.yaml, drawing signing secrets from the standalone secrets CLI; binds nothing when no receivers are declared.',
     },
     {
         id: 'self-heal',
@@ -52,11 +47,6 @@ export const DAEMON_SERVICES = [
         title: 'Self-update',
         description: 'Checks npm for a newer agents-cli, installs + verifies it, then exits so the OS supervisor relaunches onto the new code (PHNX-3695).',
     },
-    {
-        id: 'keychain-reap',
-        title: 'Keychain reap',
-        description: 'Reaps orphaned keychain helpers and stuck agents processes.',
-    },
     {
         id: 'account-state',
         title: 'Account usage refresh',

package/dist/lib/daemon-ticks.js

@@ -162,8 +162,29 @@ export async function runActiveSessionsWarmTick(opts = {}) {
         console.log('active-sessions warm: idle (no recent reader), skipping gather');
         return { sessions: 0 };
     }
-    const r = await publishLocalActiveSessions({ gather: opts.gather, nowMs });
-    console.log(`active-sessions warm: ${r.sessions.length} session(s) published`);
+    // ONE gather per tick, then fold, then publish. The order is load-bearing:
+    // the publish's per-row merge reads the timeline cache, so folding first is
+    // what puts a CURRENT timeline on the row this tick writes to the journal
+    // rather than the previous tick's (PHNX-3939).
+    const gather = opts.gather ?? (async () => {
+        const { getActiveSessions } = await import('./session/active.js');
+        return getActiveSessions({ localOnly: true });
+    });
+    const gathered = await gather();
+    // Bounded so it can never own the tick: at most 8 sessions, and for the
+    // resumable harnesses only the bytes each transcript grew by. A failure here
+    // must not cost the publish.
+    const { runTimelinePassSync } = await import('./session/timeline-pass.js');
+    let timeline = { computed: 0, reused: 0, skipped: 0 };
+    try {
+        timeline = runTimelinePassSync({ sessions: gathered, nowMs });
+    }
+    catch (err) {
+        console.log(`active-sessions warm: timeline pass failed: ${err.message}`);
+    }
+    const r = await publishLocalActiveSessions({ gather: async () => gathered, nowMs });
+    console.log(`active-sessions warm: ${r.sessions.length} session(s) published; `
+        + `timeline ${timeline.computed} folded, ${timeline.reused} current, ${timeline.skipped} skipped`);
     return { sessions: r.sessions.length };
 }
 /**

package/dist/lib/daemon-webhooks.d.ts

@@ -4,9 +4,10 @@
  * `~/.agents/daemon/webhooks.yaml` declares which signed webhook receivers THIS
  * box hosts — bundle, local port, rate limit, and an optional public Tailscale
  * Funnel port. The daemon's `webhook-receiver` service reads it and binds one
- * receiver per entry, drawing each receiver's signing secret from the broker /
- * machine-local file store (no `AGENTS_SECRETS_PASSPHRASE`, no `nohup`). An
- * absent or empty file hosts nothing, so an unconfigured box binds nothing.
+ * receiver per entry, drawing each receiver's signing secret through the
+ * standalone `secrets` CLI (an agentOnly read via secrets-client.ts — no
+ * `AGENTS_SECRETS_PASSPHRASE`, no `nohup`). An absent or empty file hosts
+ * nothing, so an unconfigured box binds nothing.
  *
  * This is per-box operational state (a public receiver runs on exactly one box),
  * so it is deliberately NOT part of the fleet-synced device config — it mirrors
@@ -87,15 +88,15 @@ type Logger = (level: string, message: string) => void;
  * `server.listen()` surfaces EADDRINUSE as an `'error'` event, so a `try/catch`
  * around the start call never sees it and the event reaches the process-level
  * `uncaughtException` handler (`index.ts`), which exits 1 for the supervisor to
- * restart — a crash loop that would take the secrets broker, scheduler,
- * monitors, browser IPC, and self-heal down with it. `waitForListening` is what
- * turns that into one skipped receiver.
+ * restart — a crash loop that would take the scheduler, monitors, browser IPC,
+ * and self-heal down with it. `waitForListening` is what turns that into one
+ * skipped receiver.
  */
 export declare function startHostedWebhookReceivers(opts: {
     log: Logger;
     /**
      * How a receiver's signing secrets are resolved. Defaults to
-     * `resolveReceiverSecrets` (the real broker read). Injectable for the same
+     * `resolveReceiverSecrets` (the real secrets-client read). Injectable for the same
      * reason `FireWebhookOptions.dispatch` is — so a test can exercise the bind
      * path against real sockets without a machine-local secrets bundle.
      */

package/dist/lib/daemon-webhooks.js

@@ -4,9 +4,10 @@
  * `~/.agents/daemon/webhooks.yaml` declares which signed webhook receivers THIS
  * box hosts — bundle, local port, rate limit, and an optional public Tailscale
  * Funnel port. The daemon's `webhook-receiver` service reads it and binds one
- * receiver per entry, drawing each receiver's signing secret from the broker /
- * machine-local file store (no `AGENTS_SECRETS_PASSPHRASE`, no `nohup`). An
- * absent or empty file hosts nothing, so an unconfigured box binds nothing.
+ * receiver per entry, drawing each receiver's signing secret through the
+ * standalone `secrets` CLI (an agentOnly read via secrets-client.ts — no
+ * `AGENTS_SECRETS_PASSPHRASE`, no `nohup`). An absent or empty file hosts
+ * nothing, so an unconfigured box binds nothing.
  *
  * This is per-box operational state (a public receiver runs on exactly one box),
  * so it is deliberately NOT part of the fleet-synced device config — it mirrors
@@ -18,8 +19,8 @@ import * as yaml from 'yaml';
 import { exec } from 'child_process';
 import { getDaemonConfigDir, getRuntimeStateDir } from './state.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
-import { closeServerBounded } from './secrets/agent.js';
-import { readAndResolveBundleEnv } from './secrets/bundles.js';
+import { closeServerBounded } from './net-close.js';
+import { readAndResolveBundleEnvSync } from './secrets-client.js';
 import { startWebhookServer, createFileDeliveryStore, waitForListening } from './triggers/webhook.js';
 import { buildFunnelUpCommand, FUNNEL_PORTS } from './funnel.js';
 export const DEFAULT_WEBHOOK_PORT = 8787;
@@ -107,7 +108,7 @@ export function removeHostedReceiver(port) {
  * verifiable signature. Throws when neither webhook secret is present.
  */
 export function resolveReceiverSecrets(bundle) {
-    const { env } = readAndResolveBundleEnv(bundle, { caller: 'daemon webhook-receiver', agentOnly: true });
+    const { env } = readAndResolveBundleEnvSync(bundle, { caller: 'daemon webhook-receiver', agentOnly: true });
     const secrets = {};
     if (env.GITHUB_WEBHOOK_SECRET)
         secrets.github = env.GITHUB_WEBHOOK_SECRET;
@@ -150,9 +151,9 @@ function reconcileFunnel(publicPort, localPort, log) {
  * `server.listen()` surfaces EADDRINUSE as an `'error'` event, so a `try/catch`
  * around the start call never sees it and the event reaches the process-level
  * `uncaughtException` handler (`index.ts`), which exits 1 for the supervisor to
- * restart — a crash loop that would take the secrets broker, scheduler,
- * monitors, browser IPC, and self-heal down with it. `waitForListening` is what
- * turns that into one skipped receiver.
+ * restart — a crash loop that would take the scheduler, monitors, browser IPC,
+ * and self-heal down with it. `waitForListening` is what turns that into one
+ * skipped receiver.
  */
 export async function startHostedWebhookReceivers(opts) {
     const { log } = opts;

package/dist/lib/device-config.js

@@ -182,7 +182,7 @@ export const CONFIG_KEYS = [
         visibility: 'machine',
         type: 'bool',
         defaultValue: true,
-        description: 'Whether the daemon may run on this device at all (secrets broker, browser IPC, watchdog, and the ' +
+        description: 'Whether the daemon may run on this device at all (browser IPC, watchdog, and the ' +
             'routines scheduler). Disabling is the top-level kill switch: nothing auto-starts the daemon while it ' +
             'is set, including `routines add`/`routines start`/`routines catchup`/`monitors add`/webhook triggers. ' +
             '`agents daemon start` still starts it explicitly.',

package/dist/lib/devices/doctor-findings.d.ts

@@ -1,7 +1,7 @@
 import type { AgentId } from '../types.js';
 import type { DuplicateVersionHook } from '../hooks/install.js';
 import type { AgentsBinaryShadow } from '../binary-shadow.js';
-import type { RcSecretFinding } from '../secrets/rc-hygiene.js';
+import type { RcSecretFinding } from '../secrets-types.js';
 import type { OwnerSinkStatus } from '../channels/owner-sink.js';
 import { type WindowsSshEnrollmentAudit } from './windows-ssh-enrollment.js';
 import type { SyncStatusRow, OrphanRow } from '../drift.js';

package/dist/lib/devices/harness-inventory.d.ts

@@ -1,6 +1,7 @@
 import { type AccountInfo } from '../agents.js';
 import type { AgentId } from '../types.js';
 import { type UsageSnapshot } from '../accounting/usage.js';
+import { type AccountVerdict } from '../signin-badge.js';
 /** An account's usage headroom rolled into one glanceable summary. */
 export interface QuotaSummary {
     /**
@@ -33,6 +34,8 @@ export interface HarnessRow {
     ready: boolean;
     /** When `!ready`, a short reason ("signed out" / "rate-limited"). */
     reason?: string;
+    verdict: AccountVerdict;
+    fix: string | null;
 }
 /** One host's rows, or the reason it produced none. */
 export interface HostHarnessResult {
@@ -65,6 +68,25 @@ export interface AccountGroup {
  * account) and takes the highest utilization across those windows. Pure.
  */
 export declare function summarizeQuota(snapshot: UsageSnapshot | null | undefined, unavailableReason?: string | null, accountStatus?: AccountInfo['usageStatus']): QuotaSummary;
+/**
+ * Scope/permission failures on a worker mean the usage endpoint cannot be read.
+ * They are not evidence of exhausted credits, even when stale account metadata
+ * previously carried that coarse status.
+ */
+export declare function summarizeObservedQuota(snapshot: UsageSnapshot | null | undefined, error: string | null | undefined, accountStatus?: AccountInfo['usageStatus']): {
+    quota: QuotaSummary;
+    unverified: boolean;
+};
+/**
+ * A scope/permission failure on the usage endpoint is not a credit claim.
+ * Strip utilization and, only when auth still looks healthy, surface
+ * `unverified` instead of `live`/`rate_limited`. A real auth failure
+ * (expired/revoked/missing) stays the auth failure.
+ */
+export declare function applyUsageHonesty(verdict: AccountVerdict, usage: QuotaSummary | null): {
+    verdict: AccountVerdict;
+    usage: QuotaSummary | null;
+};
 /**
  * "Ready" = signed in AND not rate-limited. A missing quota snapshot does NOT
  * block readiness: the account is signed in and usable, we just have no live
@@ -104,3 +126,20 @@ export declare function renderHarnessMatrix(results: HostHarnessResult[]): strin
  * account (installs sharing it collapsed), showing which harnesses use it. Pure.
  */
 export declare function renderAccountsMatrix(results: HostHarnessResult[]): string[];
+export interface AccountFleetMatrixRow {
+    harness: AgentId;
+    name: string | null;
+    identityLabel: string;
+    devices: Array<{
+        device: string;
+        verdict: AccountVerdict;
+    }>;
+}
+/**
+ * Account × device matrix used by `agents accounts list --fleet`.
+ * Rows are logical accounts, not installations. Columns come from the
+ * daemon-state observations already joined onto each account row.
+ */
+export declare function renderAccountFleetMatrix(rows: AccountFleetMatrixRow[], opts?: {
+    uncoveredDevices?: string[];
+}): string[];