@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/secrets/push.d.ts

@@ -1,133 +0,0 @@
-/**
- * Serialize a resolved env map to `.env` lines that round-trip losslessly through
- * `parseDotenv` on the remote: `KEY="VALUE"`. parseDotenv strips exactly one outer
- * quote pair and takes the inner bytes verbatim (no unescaping), so any single-line
- * value survives unchanged with no escaping. Newlines would break its line-based
- * parse, so multi-line values are rejected rather than silently corrupted.
- */
-export declare function bundleEnvToDotenv(env: Record<string, string>): string;
-/** Where the bundle should live ON THE REMOTE. */
-export type RemoteBackend = 'keychain' | 'file';
-/** A bundle read once, ready to push to any number of hosts. */
-export interface ResolvedBundleForPush {
-    /** key -> value. Never logged; only its KEY NAMES are ever surfaced. */
-    env: Record<string, string>;
-    /** The same values as a dotenv blob, shipped over ssh stdin (never argv). */
-    dotenv: string;
-    keyCount: number;
-}
-export interface PushBundleOptions {
-    remoteBackend: RemoteBackend;
-    /** Overwrite a key that already exists on the remote. */
-    force?: boolean;
-    /**
-     * Ignored. File-backend export never forwards AGENTS_SECRETS_PASSPHRASE
-     * (PHNX-2371); the remote auto-provisions its own machine-local key.
-     * Kept on the options type so existing callers that passed one still compile.
-     */
-    passphrase?: string;
-    /** Label for the audit trail — `export --device` vs `fleet apply`. */
-    operation: string;
-    /** Preserve an automation account's permanent prompt-free policy remotely. */
-    policyNever?: boolean;
-    /** Permit a human-invoked push to read locally without requiring the agent broker. */
-    agentOnly?: boolean;
-    /** Non-secret literals whose bundle value kind must survive the dotenv transport. */
-    literalValues?: Record<string, string>;
-    /** Per-SSH-operation deadline. Async daemon callers must set this explicitly. */
-    timeoutMs?: number;
-}
-export interface PushBundleResult {
-    ok: boolean;
-    host: string;
-    bundle: string;
-    keyCount: number;
-    /** One line for the caller to render. Never contains a secret value. */
-    message: string;
-}
-export interface LiteralRestorePlan {
-    key: string;
-    removeArgs: string[];
-    addArgs: string[];
-}
-/** Preserve the literal-vs-secret schema that dotenv transport cannot encode. */
-export declare function planLiteralRestoration(bundle: string, literalValues?: Record<string, string>): LiteralRestorePlan[];
-/**
- * Read and resolve a bundle once, for pushing to one or more hosts.
- *
- * `keyMode: 'storage'` is fixed — a push always sends storage-shaped values.
- *
- * `agentOnly` is the caller's to decide, and it is NOT a security level: it
- * selects the broker-only read (fail fast with the `agents secrets unlock` hint)
- * over the interactive read (macOS may raise a Touch ID sheet). The headless
- * guard exists because an AGENT LAUNCH must never enumerate the keychain — a
- * per-bundle prefix becomes a broad `agents-cli.` scan after service-name
- * hashing, and macOS evaluates unrelated biometry ACLs during it, one sheet per
- * installed version (bundles.ts, RUSH-2440). A human at a TTY is not that case:
- * they can answer one prompt, and the interactive sibling reads (`view --reveal`,
- * `exec`) already let them. NOT `get` — it is unconditionally `agentOnly` on
- * purpose, because prompting would hang a `$(agents secrets get …)` capture
- * mid-pipeline (SEC-13b). It defaults to `true` so an automated caller that says
- * nothing stays broker-only.
- */
-export declare function resolveBundleForPush(bundle: string, caller: string, opts?: {
-    agentOnly?: boolean;
-}): ResolvedBundleForPush;
-/**
- * WHICH transport a (backend, target-OS) pair selects, and the exact bytes it
- * will send. One of four outcomes, and picking the wrong one is silent: a
- * Windows target handed a POSIX `bash -lc` produces garbage, and a Windows
- * target handed `--from -` hangs forever on a stdin the `agents.ps1` shim never
- * forwards. Neither shows up as a failed ssh, so the selection is the thing
- * worth pinning.
- *
- * Separated from execution so it is decidable without a network: the branch is
- * chosen from the device registry alone, and `pushResolvedBundleToHost` below
- * does nothing but run what this returns.
- */
-export type PushTransport = 
-/** No supported command exists for this pair — fail loud, never a wrong path. */
-{
-    kind: 'refuse';
-    message: string;
-}
-/**
- * A command sent over the raw ssh engine, with the .env on stdin. `multiplex`
- * is always `false`: a push ships credential bytes, so its connection must not
- * reuse — or leave behind — a persistent authenticated control master to the
- * destination the way the default fan-out connections do (RUSH-2527). This
- * mirrors the `--copy-creds` dispatch posture (`multiplex: !opts.copyCreds`).
- */
- | {
-    kind: 'ssh';
-    remoteCmd: string;
-    input: string;
-    multiplex: false;
-}
-/** The OS-aware `agents secrets` wrapper, the READ inverse's own path. Never multiplexed — see the `ssh` kind. */
- | {
-    kind: 'remote-secrets';
-    args: string[];
-    input: string;
-    multiplex: false;
-};
-/** Choose the transport for one push. Pure: registry read in, plan out. */
-export declare function planPushTransport(resolved: ResolvedBundleForPush, bundle: string, host: string, opts: PushBundleOptions): PushTransport;
-/**
- * Push an already-resolved bundle to ONE host.
- *
- * Drives the remote's own `agents secrets import --from -`, so the values land
- * in the remote's chosen backend and the .env is read off ssh stdin rather than
- * parsed by a remote shell. `import` auto-creates the bundle.
- */
-export declare function pushResolvedBundleToHost(resolved: ResolvedBundleForPush, bundle: string, host: string, opts: PushBundleOptions): PushBundleResult;
-/** Resolve and push in one call — for a single host. */
-export declare function pushBundleToHost(bundle: string, host: string, opts: PushBundleOptions): PushBundleResult;
-/**
- * Async, kill-bounded push for daemon services. It preserves the foreground
- * primitive's transport, read-back verification, and literal restoration; only
- * the SSH execution strategy differs.
- */
-export declare function pushResolvedBundleToHostAsync(resolved: ResolvedBundleForPush, bundle: string, host: string, opts: PushBundleOptions): Promise<PushBundleResult>;
-/** Resolve locally once, then run the daemon-safe async push. */
-export declare function pushBundleToHostAsync(bundle: string, host: string, opts: PushBundleOptions): Promise<PushBundleResult>;

package/dist/lib/secrets/push.js

@@ -1,273 +0,0 @@
-/**
- * Push one bundle's values to a remote host over SSH — the provisioning
- * primitive behind `agents secrets export --device` and, from RUSH-1968, behind
- * `agents fleet apply --provision-secrets`.
- *
- * This logic used to live inline in the `export --device` command action. It moved
- * here because `lib/fleet/apply.ts` needs it and a lib MUST NOT import a command
- * module — and because the absence of a callable primitive is part of why
- * `fleet apply` never provisioned secrets at all, leaving an operator to
- * hand-export the file store's master key across the fleet.
- *
- * Two rules shape the shape of this module:
- *
- * - **It never prints.** The lib layer stays `console.*`-free (SEC-14/SEC-16), so
- *   every outcome is returned as data and the CALLER renders it. That is also
- *   what lets `fleet apply` fold a push into its own per-device report instead of
- *   interleaving stray lines into it.
- * - **Resolve once, push N times.** `resolveBundleForPush` is separate because
- *   reading a bundle can prompt (Touch ID); doing it per host would prompt per
- *   host. `export --device a,b,c` resolves once and pushes three times.
- */
-import { sshExec, sshExecAsync } from '../ssh-exec.js';
-import { remoteShellFor, buildWindowsStdinImportCommand } from '../hosts/remote-cmd.js';
-import { resolveRemoteOsSync } from '../hosts/remote-os.js';
-import { remoteSecretsRaw, remoteSecretsRawAsync, verifyRemoteKeychainPush, verifyRemoteKeychainPushAsync, keychainWriteFailureMessage, buildRemoteFileImportCommand, credentialTransportSshOpts, } from './remote.js';
-import { readAndResolveBundleEnv } from './bundles.js';
-/**
- * Serialize a resolved env map to `.env` lines that round-trip losslessly through
- * `parseDotenv` on the remote: `KEY="VALUE"`. parseDotenv strips exactly one outer
- * quote pair and takes the inner bytes verbatim (no unescaping), so any single-line
- * value survives unchanged with no escaping. Newlines would break its line-based
- * parse, so multi-line values are rejected rather than silently corrupted.
- */
-export function bundleEnvToDotenv(env) {
-    const lines = [];
-    for (const [k, v] of Object.entries(env)) {
-        if (/[\r\n]/.test(v)) {
-            throw new Error(`Key '${k}' has a multi-line value; the SSH .env transport can't carry newlines. ` +
-                `Set it directly on the remote with 'agents secrets add ${k} --value-stdin'.`);
-        }
-        lines.push(`${k}="${v}"`);
-    }
-    return lines.join('\n') + '\n';
-}
-/** Preserve the literal-vs-secret schema that dotenv transport cannot encode. */
-export function planLiteralRestoration(bundle, literalValues = {}) {
-    return Object.entries(literalValues).map(([key, value]) => ({
-        key,
-        removeArgs: ['remove', bundle, key, '--yes'],
-        addArgs: ['add', bundle, key, '--value', value],
-    }));
-}
-/**
- * Read and resolve a bundle once, for pushing to one or more hosts.
- *
- * `keyMode: 'storage'` is fixed — a push always sends storage-shaped values.
- *
- * `agentOnly` is the caller's to decide, and it is NOT a security level: it
- * selects the broker-only read (fail fast with the `agents secrets unlock` hint)
- * over the interactive read (macOS may raise a Touch ID sheet). The headless
- * guard exists because an AGENT LAUNCH must never enumerate the keychain — a
- * per-bundle prefix becomes a broad `agents-cli.` scan after service-name
- * hashing, and macOS evaluates unrelated biometry ACLs during it, one sheet per
- * installed version (bundles.ts, RUSH-2440). A human at a TTY is not that case:
- * they can answer one prompt, and the interactive sibling reads (`view --reveal`,
- * `exec`) already let them. NOT `get` — it is unconditionally `agentOnly` on
- * purpose, because prompting would hang a `$(agents secrets get …)` capture
- * mid-pipeline (SEC-13b). It defaults to `true` so an automated caller that says
- * nothing stays broker-only.
- */
-export function resolveBundleForPush(bundle, caller, opts = {}) {
-    const agentOnly = opts.agentOnly ?? true;
-    const { env } = readAndResolveBundleEnv(bundle, { caller, keyMode: 'storage', agentOnly });
-    return { env, dotenv: bundleEnvToDotenv(env), keyCount: Object.keys(env).length };
-}
-function isPowershellTarget(host) {
-    return remoteShellFor(resolveRemoteOsSync(host.split('@').pop() ?? host)) === 'powershell';
-}
-/** Choose the transport for one push. Pure: registry read in, plan out. */
-export function planPushTransport(resolved, bundle, host, opts) {
-    const powershell = isPowershellTarget(host);
-    if (opts.remoteBackend === 'file') {
-        // Both file-backend paths build a POSIX `bash -lc` command. Refuse a Windows
-        // target cleanly rather than emit broken PowerShell (fail loud at the
-        // boundary, never a silent wrong path).
-        if (powershell) {
-            return { kind: 'refuse', message: 'file backend export to a Windows target is not yet supported' };
-        }
-        const { remoteCmd, input } = buildRemoteFileImportCommand(bundle, resolved.dotenv, {
-            force: opts.force,
-            policyNever: opts.policyNever,
-        });
-        return { kind: 'ssh', remoteCmd, input, multiplex: false };
-    }
-    if (powershell) {
-        // Keychain on a Windows target: the `agents.ps1` shim doesn't forward
-        // ssh-piped stdin to node, so `--from -` would hang. Bridge the piped .env
-        // through PowerShell into a temp file and import `--from <file>` (deleted
-        // afterwards). Same hardened ssh engine; the .env still only ever crosses
-        // the wire over ssh stdin.
-        return {
-            kind: 'ssh',
-            remoteCmd: buildWindowsStdinImportCommand(bundle, { force: opts.force, policyNever: opts.policyNever }),
-            input: resolved.dotenv,
-            multiplex: false,
-        };
-    }
-    // Keychain on a POSIX target: OS-aware wrapping + the hardened ssh engine
-    // (BatchMode, ConnectTimeout, keepalive, control-socket reuse) via the same
-    // path the READ inverse (`remoteResolveEnv`) uses.
-    return {
-        kind: 'remote-secrets',
-        args: [
-            'import', bundle, '--from', '-',
-            ...(opts.force ? ['--force'] : []),
-            ...(opts.policyNever ? ['--policy', 'never', '--i-understand'] : []),
-        ],
-        input: resolved.dotenv,
-        multiplex: false,
-    };
-}
-/**
- * Push an already-resolved bundle to ONE host.
- *
- * Drives the remote's own `agents secrets import --from -`, so the values land
- * in the remote's chosen backend and the .env is read off ssh stdin rather than
- * parsed by a remote shell. `import` auto-creates the bundle.
- */
-export function pushResolvedBundleToHost(resolved, bundle, host, opts) {
-    const fail = (message) => ({ ok: false, host, bundle, keyCount: resolved.keyCount, message });
-    const plan = planPushTransport(resolved, bundle, host, opts);
-    if (plan.kind === 'refuse')
-        return fail(plan.message);
-    // Every ssh below rides the credential-transport posture: the managed host key
-    // is pinned (a changed key is refused) and the connection never reuses or
-    // leaves a persistent authenticated control master to the destination
-    // (RUSH-2527, `credentialTransportSshOpts`). The plan's `multiplex: false` is
-    // the raw-`ssh` branch's half of that; the `remote-secrets` branch and the
-    // read-back/policy/literal follow-ups pass `secret: true` for the same posture.
-    const res = plan.kind === 'ssh'
-        ? sshExec(host, plan.remoteCmd, { input: plan.input, timeoutMs: opts.timeoutMs, hostKeyOpts: credentialTransportSshOpts(host).hostKeyOpts, multiplex: plan.multiplex })
-        : remoteSecretsRaw(host, plan.args, { input: plan.input, timeoutMs: opts.timeoutMs, osLookupName: host, secret: true });
-    if (res.code === null) {
-        return fail(res.stderr.trim() || (res.timedOut ? 'ssh timed out' : 'ssh failed'));
-    }
-    if (res.code !== 0) {
-        const msg = (res.stderr || res.stdout || '').trim();
-        return fail(`remote import failed (exit ${res.code})${msg ? `: ${msg}` : ''}`);
-    }
-    // A successful remote import is not proof the keys are readable. Two silent
-    // failures hide behind exit 0:
-    //   - keychain: a macOS login keychain is locked under headless SSH, so the
-    //     write lands metadata but no readable value items.
-    //   - file: a forwarded AGENTS_SECRETS_PASSPHRASE keys ciphertext to a secret
-    //     the destination daemon does not hold (PHNX-2371).
-    // Read the bundle back the way a later resolve will and FAIL LOUDLY.
-    const verdict = verifyRemoteKeychainPush(host, bundle, Object.keys(resolved.env), { osLookupName: host, secret: true, timeoutMs: opts.timeoutMs });
-    if (!verdict.ok) {
-        if (opts.remoteBackend === 'keychain' && verdict.kind === 'locked-keychain') {
-            return fail(keychainWriteFailureMessage(host, bundle, verdict.reason));
-        }
-        if (opts.remoteBackend === 'file') {
-            return fail(`${host}: pushed '${bundle}' but the remote could not decrypt it (${verdict.reason}). ` +
-                `File-backend export never forwards AGENTS_SECRETS_PASSPHRASE — the remote keys ` +
-                `the bundle under its own machine-local key. If the destination still cannot read, ` +
-                `unset a stale AGENTS_SECRETS_PASSPHRASE there (\`agents doctor\`).`);
-        }
-        return fail(`pushed '${bundle}' but could not verify it on the remote: ${verdict.reason}`);
-    }
-    for (const step of planLiteralRestoration(bundle, opts.literalValues)) {
-        const removed = remoteSecretsRaw(host, step.removeArgs, { osLookupName: host, secret: true, timeoutMs: opts.timeoutMs });
-        if (removed.code !== 0) {
-            const msg = (removed.stderr || removed.stdout || '').trim();
-            return fail(`pushed '${bundle}' but could not replace transported ${step.key}${msg ? `: ${msg}` : ''}`);
-        }
-        const literal = remoteSecretsRaw(host, step.addArgs, { osLookupName: host, secret: true, timeoutMs: opts.timeoutMs });
-        if (literal.code !== 0) {
-            const msg = (literal.stderr || literal.stdout || '').trim();
-            return fail(`pushed '${bundle}' but could not preserve literal ${step.key}${msg ? `: ${msg}` : ''}`);
-        }
-    }
-    const remoteMsg = (res.stdout || '').trim().split('\n').map((l) => l.trim()).filter(Boolean).pop();
-    return {
-        ok: true,
-        host,
-        bundle,
-        keyCount: resolved.keyCount,
-        message: remoteMsg || `${resolved.keyCount} key(s) exported`,
-    };
-}
-/** Resolve and push in one call — for a single host. */
-export function pushBundleToHost(bundle, host, opts) {
-    return pushResolvedBundleToHost(resolveBundleForPush(bundle, opts.operation, { agentOnly: opts.agentOnly }), bundle, host, opts);
-}
-/**
- * Async, kill-bounded push for daemon services. It preserves the foreground
- * primitive's transport, read-back verification, and literal restoration; only
- * the SSH execution strategy differs.
- */
-export async function pushResolvedBundleToHostAsync(resolved, bundle, host, opts) {
-    const fail = (message) => ({ ok: false, host, bundle, keyCount: resolved.keyCount, message });
-    const plan = planPushTransport(resolved, bundle, host, opts);
-    if (plan.kind === 'refuse')
-        return fail(plan.message);
-    const res = plan.kind === 'ssh'
-        ? await sshExecAsync(host, plan.remoteCmd, {
-            input: plan.input,
-            timeoutMs: opts.timeoutMs,
-            hostKeyOpts: credentialTransportSshOpts(host).hostKeyOpts,
-            multiplex: plan.multiplex,
-        })
-        : await remoteSecretsRawAsync(host, plan.args, {
-            input: plan.input,
-            timeoutMs: opts.timeoutMs,
-            osLookupName: host,
-            secret: true,
-        });
-    if (res.code === null)
-        return fail(res.stderr.trim() || (res.timedOut ? 'ssh timed out' : 'ssh failed'));
-    if (res.code !== 0) {
-        const msg = (res.stderr || res.stdout || '').trim();
-        return fail(`remote import failed (exit ${res.code})${msg ? `: ${msg}` : ''}`);
-    }
-    const verdict = await verifyRemoteKeychainPushAsync(host, bundle, Object.keys(resolved.env), {
-        osLookupName: host,
-        secret: true,
-        timeoutMs: opts.timeoutMs,
-    });
-    if (!verdict.ok) {
-        if (opts.remoteBackend === 'keychain' && verdict.kind === 'locked-keychain') {
-            return fail(keychainWriteFailureMessage(host, bundle, verdict.reason));
-        }
-        if (opts.remoteBackend === 'file') {
-            return fail(`${host}: pushed '${bundle}' but the remote could not decrypt it (${verdict.reason}). ` +
-                `File-backend export never forwards AGENTS_SECRETS_PASSPHRASE — the remote keys ` +
-                `the bundle under its own machine-local key. If the destination still cannot read, ` +
-                `unset a stale AGENTS_SECRETS_PASSPHRASE there (\`agents doctor\`).`);
-        }
-        return fail(`pushed '${bundle}' but could not verify it on the remote: ${verdict.reason}`);
-    }
-    for (const step of planLiteralRestoration(bundle, opts.literalValues)) {
-        const removed = await remoteSecretsRawAsync(host, step.removeArgs, {
-            osLookupName: host,
-            secret: true,
-            timeoutMs: opts.timeoutMs,
-        });
-        if (removed.code !== 0) {
-            const msg = (removed.stderr || removed.stdout || '').trim();
-            return fail(`pushed '${bundle}' but could not replace transported ${step.key}${msg ? `: ${msg}` : ''}`);
-        }
-        const literal = await remoteSecretsRawAsync(host, step.addArgs, {
-            osLookupName: host,
-            secret: true,
-            timeoutMs: opts.timeoutMs,
-        });
-        if (literal.code !== 0) {
-            const msg = (literal.stderr || literal.stdout || '').trim();
-            return fail(`pushed '${bundle}' but could not preserve literal ${step.key}${msg ? `: ${msg}` : ''}`);
-        }
-    }
-    const remoteMsg = (res.stdout || '').trim().split('\n').map((line) => line.trim()).filter(Boolean).pop();
-    return {
-        ok: true,
-        host,
-        bundle,
-        keyCount: resolved.keyCount,
-        message: remoteMsg || `${resolved.keyCount} key(s) exported`,
-    };
-}
-/** Resolve locally once, then run the daemon-safe async push. */
-export function pushBundleToHostAsync(bundle, host, opts) {
-    return pushResolvedBundleToHostAsync(resolveBundleForPush(bundle, opts.operation, { agentOnly: opts.agentOnly }), bundle, host, opts);
-}

package/dist/lib/secrets/rc-hygiene.d.ts

@@ -1,63 +0,0 @@
-/**
- * Detect credentials exported from shell rc files.
- *
- * A secret exported from `~/.zshenv`, `~/.zshrc`, `~/.bashrc`, `~/.profile`, …
- * is inherited by every process the login shell spawns and is readable from
- * `/proc/<pid>/environ` by any same-user process — the master passphrase leak
- * behind RUSH-1968. `.zshenv` in particular is sourced by *every* zsh
- * invocation, including non-interactive `ssh host 'cmd'`, so the value lands in
- * the environment of essentially everything the box runs.
- *
- * The keychain-backed store (`agents secrets`) is the sanctioned home for
- * credentials; the file-store master passphrase belongs in the off-env 0600 key
- * file (`~/.agents/.secrets-key/passphrase`), never a shell rc export.
- *
- * This scanner powers a warn-level advisory in `agents doctor`. It reads only
- * the exported variable *name* and its line number — never the value — so a
- * finding can be printed, logged, or shipped without leaking the secret.
- */
-/** Shell rc files sourced at login/startup, in the order a report lists them. */
-export declare const RC_FILENAMES: readonly [".zshenv", ".zprofile", ".zshrc", ".zlogin", ".bash_profile", ".bash_login", ".bashrc", ".profile", ".kshrc"];
-/**
- * A single credential-shaped export found in an rc file. Carries the variable
- * NAME and location only — the value is never captured.
- */
-export interface RcSecretFinding {
-    /** Basename of the rc file, e.g. `.zshenv`. */
-    file: string;
-    /** 1-based line number of the export. */
-    line: number;
-    /** The exported variable name (e.g. `AGENTS_SECRETS_PASSPHRASE`). Never the value. */
-    name: string;
-    /** The file-store master passphrase gets called out separately — it is the highest-severity case. */
-    isMasterPassphrase: boolean;
-}
-/** The file-store master key. Its own resolution prefers an off-env 0600 file, so
- *  a shell-rc export is always wrong once the store exists (RUSH-1968). */
-export declare const MASTER_PASSPHRASE = "AGENTS_SECRETS_PASSPHRASE";
-/**
- * True when the file-store master key is live in THIS process's environment.
- *
- * The scanner above reads FILES, and that leaves a hole: a value inherited by a
- * long-lived process outlives the rc line that set it, so deleting the export
- * makes `scanRcExports` report clean while every shell, editor and agent started
- * beforehand still carries the key and passes it to everything it spawns.
- * Returns a boolean — never the value — so a finding built from it can be
- * printed, logged, or shipped without leaking the secret.
- */
-export declare function masterPassphraseInEnv(): boolean;
-/** True if a variable name looks like it holds a credential value. */
-export declare function isCredentialName(name: string): boolean;
-/**
- * Scan one rc file's contents for credential-shaped exports. Pure — takes the
- * text, returns findings (names + line numbers only, never values). A trailing
- * `# comment` is stripped before matching so a commented-out export is ignored;
- * the variable name always precedes any inline `#`, so stripping never loses it.
- */
-export declare function scanRcExports(basename: string, content: string): RcSecretFinding[];
-/**
- * Scan the current user's shell rc files. Reads each file that exists under
- * `homeDir` (default `os.homedir()`) and aggregates the findings. Missing or
- * unreadable files are skipped silently — an advisory, not a hard requirement.
- */
-export declare function scanUserRcFiles(homeDir?: string): RcSecretFinding[];

package/dist/lib/secrets/rc-hygiene.js

@@ -1,143 +0,0 @@
-/**
- * Detect credentials exported from shell rc files.
- *
- * A secret exported from `~/.zshenv`, `~/.zshrc`, `~/.bashrc`, `~/.profile`, …
- * is inherited by every process the login shell spawns and is readable from
- * `/proc/<pid>/environ` by any same-user process — the master passphrase leak
- * behind RUSH-1968. `.zshenv` in particular is sourced by *every* zsh
- * invocation, including non-interactive `ssh host 'cmd'`, so the value lands in
- * the environment of essentially everything the box runs.
- *
- * The keychain-backed store (`agents secrets`) is the sanctioned home for
- * credentials; the file-store master passphrase belongs in the off-env 0600 key
- * file (`~/.agents/.secrets-key/passphrase`), never a shell rc export.
- *
- * This scanner powers a warn-level advisory in `agents doctor`. It reads only
- * the exported variable *name* and its line number — never the value — so a
- * finding can be printed, logged, or shipped without leaking the secret.
- */
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-/** Shell rc files sourced at login/startup, in the order a report lists them. */
-export const RC_FILENAMES = [
-    '.zshenv',
-    '.zprofile',
-    '.zshrc',
-    '.zlogin',
-    '.bash_profile',
-    '.bash_login',
-    '.bashrc',
-    '.profile',
-    '.kshrc',
-];
-/** The file-store master key. Its own resolution prefers an off-env 0600 file, so
- *  a shell-rc export is always wrong once the store exists (RUSH-1968). */
-export const MASTER_PASSPHRASE = 'AGENTS_SECRETS_PASSPHRASE';
-/**
- * True when the file-store master key is live in THIS process's environment.
- *
- * The scanner above reads FILES, and that leaves a hole: a value inherited by a
- * long-lived process outlives the rc line that set it, so deleting the export
- * makes `scanRcExports` report clean while every shell, editor and agent started
- * beforehand still carries the key and passes it to everything it spawns.
- * Returns a boolean — never the value — so a finding built from it can be
- * printed, logged, or shipped without leaking the secret.
- */
-export function masterPassphraseInEnv() {
-    return (process.env[MASTER_PASSPHRASE] ?? '').length > 0;
-}
-/**
- * Last `_`-delimited segment values that mark a variable as credential-shaped.
- * Matched against the FINAL segment (segment equality, not substring) so
- * `X_API_KEY` fires on `KEY` while `SOME_KEY_PATH` (ends `PATH`) and `MONKEY`
- * (single segment, not equal to `KEY`) do not.
- */
-const CREDENTIAL_SEGMENTS = new Set([
-    'PASSPHRASE',
-    'PASSWORD',
-    'PASSWD',
-    'SECRET',
-    'SECRETS',
-    'TOKEN',
-    'KEY',
-    'APIKEY',
-    'PAT',
-    'CREDENTIAL',
-    'CREDENTIALS',
-]);
-/**
- * Final segments that look credential-shaped but name a file path, socket, or
- * config knob rather than a secret value — excluded to cut false positives.
- * Applied to the whole name's final segment before the credential check.
- */
-const BENIGN_FINAL_SEGMENTS = new Set([
-    'PATH',
-    'FILE',
-    'DIR',
-    'SOCK',
-    'SOCKET',
-    'ID',
-    'NAME',
-    'PARALLELISM', // TOKENIZERS_PARALLELISM and friends
-]);
-/** True if a variable name looks like it holds a credential value. */
-export function isCredentialName(name) {
-    if (name === MASTER_PASSPHRASE)
-        return true;
-    const segments = name.toUpperCase().split('_');
-    const last = segments[segments.length - 1];
-    if (BENIGN_FINAL_SEGMENTS.has(last))
-        return false;
-    return CREDENTIAL_SEGMENTS.has(last);
-}
-// Matches an env assignment that puts a value in the environment:
-//   export NAME=...            (sh/bash/zsh)
-//   typeset -x NAME=... / declare -x NAME=...   (bash/zsh export-attribute form)
-const EXPORT_RE = /^\s*(?:export\s+|(?:typeset|declare)\s+-[A-Za-z]*x[A-Za-z]*\s+)([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-/**
- * Scan one rc file's contents for credential-shaped exports. Pure — takes the
- * text, returns findings (names + line numbers only, never values). A trailing
- * `# comment` is stripped before matching so a commented-out export is ignored;
- * the variable name always precedes any inline `#`, so stripping never loses it.
- */
-export function scanRcExports(basename, content) {
-    const out = [];
-    const lines = content.split('\n');
-    for (let i = 0; i < lines.length; i++) {
-        const code = lines[i].replace(/#.*$/, '');
-        const m = EXPORT_RE.exec(code);
-        if (!m)
-            continue;
-        const name = m[1];
-        if (!isCredentialName(name))
-            continue;
-        out.push({
-            file: basename,
-            line: i + 1,
-            name,
-            isMasterPassphrase: name === MASTER_PASSPHRASE,
-        });
-    }
-    return out;
-}
-/**
- * Scan the current user's shell rc files. Reads each file that exists under
- * `homeDir` (default `os.homedir()`) and aggregates the findings. Missing or
- * unreadable files are skipped silently — an advisory, not a hard requirement.
- */
-export function scanUserRcFiles(homeDir = os.homedir()) {
-    const out = [];
-    for (const name of RC_FILENAMES) {
-        const fp = path.join(homeDir, name);
-        let content;
-        try {
-            content = fs.readFileSync(fp, 'utf8');
-        }
-        catch {
-            continue; // absent or unreadable — nothing to report
-        }
-        out.push(...scanRcExports(name, content));
-    }
-    return out;
-}

package/dist/lib/secrets/read-backoff.d.ts

@@ -1,27 +0,0 @@
-/**
- * Negative memo for failed/cancelled macOS keychain reads (the "back-off").
- *
- * A cancelled Touch ID sheet is the user saying "not now" — but a polling
- * caller (AGI EXT host's `agents view` loop, a watch script)
- * retries the same read a few seconds later and pops the sheet again, forever.
- * The headless guard (index.ts `assertRawKeychainReadAllowed`) covers the
- * no-TTY case; this memo covers a context that CAN prompt but just had its
- * prompt cancelled or fail: the next read of the same item within the TTL
- * throws the back-off error instead of re-prompting. Any successful read (or
- * write) of the item clears the memo.
- *
- * Stored as regenerable state under `~/.agents/.cache/keychain-read-backoff/`,
- * one file per item (filename is a hash of the item name; the file carries no
- * secret material — a name and a deadline only). All operations are
- * best-effort: a lost memo costs at most one extra prompt, never a read.
- */
-/** How long a failed/cancelled read suppresses retries of the same item. */
-export declare const KEYCHAIN_READ_BACKOFF_TTL_MS: number;
-/** Test seam: point the memo at a temp dir so tests never touch the real cache. */
-export declare function setKeychainReadBackoffDirForTest(dir: string | null): void;
-/** True while `key` is inside the back-off window opened by a failed/cancelled read. */
-export declare function isKeychainReadBackedOff(key: string, now?: number): boolean;
-/** Open (or refresh) the back-off window for `key` after a failed/cancelled read. */
-export declare function noteKeychainReadFailure(key: string, now?: number): void;
-/** Clear the memo: a successful read or write of the item resets the back-off. */
-export declare function clearKeychainReadBackoff(key: string): void;