@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/secrets/remote.js

@@ -1,344 +0,0 @@
-/**
- * Remote secrets — read and use `agents secrets` bundles that live on another
- * host over the same SSH path that `agents secrets export --device` uses.
- *
- * Browse streams remote stdout verbatim; use resolves a bundle to an env map
- * and injects it ephemerally without persisting it locally.
- */
-import { sshExec, sshExecAsync, sshStream, assertValidSshTarget, shellQuote } from '../ssh-exec.js';
-import { resolveHost } from '../hosts/registry.js';
-import { emitSecretAudit } from './audit.js';
-import { sshTargetFor } from '../hosts/types.js';
-import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
-import { resolveRemoteOsSync } from '../hosts/remote-os.js';
-import { isLoaderOrInterpreterEnv } from './bundles.js';
-import { isHostPinned, hostKeyCheckingOpts } from '../devices/known-hosts.js';
-export const REMOTE_TIMEOUT_MS = 30_000;
-/** The host part of an ssh target (`user@host` -> `host`) for known_hosts matching. */
-function hostKeyLookupName(target) {
-    return target.split('@').pop() ?? target;
-}
-/**
- * SSH options for secret-carrying transport. Pins the managed host key and
- * disables multiplex so no reusable control socket lingers for other invocations.
- */
-export function credentialTransportSshOpts(target) {
-    return { hostKeyOpts: hostKeyCheckingOpts(isHostPinned(hostKeyLookupName(target))), multiplex: false };
-}
-/** Refuse durable credential transfer until the destination SSH key is pinned. */
-export function assertCredentialTransportHostPinned(target, pinned = isHostPinned(hostKeyLookupName(target))) {
-    if (pinned)
-        return;
-    throw new Error(`Refusing to transfer provider credentials to '${target}' before its SSH host key is pinned. ` +
-        `Connect once with 'agents ssh ${target}' and verify the host, then retry.`);
-}
-/**
- * Trust boundary for a remote-resolved env map. A peer's export output is
- * untrusted input that could reshape this process once merged into the env, so
- * block dangerous override classes here for every consumer:
- * loader/interpreter vars, GIT_*, *_PROXY, and *_BASE_URL.
- */
-export function isDangerousRemoteEnvKey(name) {
-    const upper = name.toUpperCase();
-    if (isLoaderOrInterpreterEnv(upper))
-        return true;
-    if (upper.startsWith('GIT_'))
-        return true; // GIT_SSH_COMMAND hijacks git subprocesses
-    if (upper.endsWith('_PROXY'))
-        return true; // *_PROXY = MITM
-    if (upper.endsWith('_BASE_URL'))
-        return true; // *_BASE_URL = model API redirect
-    return false;
-}
-/** Remote OS for a host name or target string. Prefer the original host name
- *  because enrolled inline hosts resolve to `user@address`, while the OS
- *  registry is keyed by the host name. */
-function osForTarget(target, lookupName) {
-    const byName = lookupName ? resolveRemoteOsSync(lookupName) : undefined;
-    return byName ?? resolveRemoteOsSync(target.split('@').pop() ?? target);
-}
-/**
- * Resolve a `--device` value to an ssh target string for the remote-secrets
- * path. Delegates to the same resolver `run --device` uses; on a miss, treats
- * the value as a raw ssh target and validates it.
- */
-export async function resolveHostSshTarget(nameOrAlias) {
-    const host = await resolveHost(nameOrAlias);
-    if (host)
-        return sshTargetFor(host);
-    assertValidSshTarget(nameOrAlias);
-    return nameOrAlias;
-}
-/**
- * Merge `--host` / `--hosts` (and their `--device` / `--devices` aliases) into
- * an ordered, de-duplicated list. Empty when none is set.
- */
-export function parseHostsOption(opts) {
-    const out = [];
-    const seen = new Set();
-    const push = (h) => {
-        const t = h.trim();
-        if (t && !seen.has(t)) {
-            seen.add(t);
-            out.push(t);
-        }
-    };
-    if (opts.host)
-        push(opts.host);
-    if (opts.device)
-        push(opts.device);
-    if (opts.hosts)
-        for (const h of opts.hosts.split(','))
-            push(h);
-    if (opts.devices)
-        for (const h of opts.devices.split(','))
-            push(h);
-    return out;
-}
-/**
- * Split a `bundle@host` reference. No `@` → a local bundle. Bundle names can't
- * contain `@`, so the FIRST `@` separates bundle from ssh target; the target
- * itself may be `user@host` (e.g. `r2.backups@muqsit@box`).
- */
-export function splitBundleRef(ref) {
-    const at = ref.indexOf('@');
-    if (at === -1)
-        return { bundle: ref };
-    const bundle = ref.slice(0, at);
-    const host = ref.slice(at + 1);
-    if (!bundle || !host) {
-        throw new Error(`Invalid remote bundle reference ${JSON.stringify(ref)}. Expected 'bundle@host'.`);
-    }
-    return { bundle, host };
-}
-/**
- * Run `agents secrets <args>` on a remote host over ssh and return the raw
- * result. Used by browse commands; `tty` forces `-tt` so remote passphrase
- * prompts can surface.
- */
-export function remoteSecretsRaw(target, args, opts = {}) {
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', ...args], undefined, osForTarget(target, opts.osLookupName));
-    // `secret: true` pins the managed host key and refuses multiplex; `-tt`
-    // additionally allocates a PTY and never multiplexes. The two compose.
-    const posture = opts.secret ? credentialTransportSshOpts(target) : {};
-    const conn = opts.tty
-        ? { ...posture, extraSshArgs: ['-tt'], multiplex: false }
-        : posture;
-    return sshExec(target, remoteCmd, {
-        timeoutMs: opts.timeoutMs ?? REMOTE_TIMEOUT_MS,
-        input: opts.input,
-        ...conn,
-    });
-}
-/** Async, kill-bounded inverse of {@link remoteSecretsRaw} for daemon callers. */
-export function remoteSecretsRawAsync(target, args, opts = {}) {
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', ...args], undefined, osForTarget(target, opts.osLookupName));
-    const posture = opts.secret ? credentialTransportSshOpts(target) : {};
-    const conn = opts.tty
-        ? { ...posture, extraSshArgs: ['-tt'], multiplex: false }
-        : posture;
-    return sshExecAsync(target, remoteCmd, {
-        timeoutMs: opts.timeoutMs ?? REMOTE_TIMEOUT_MS,
-        input: opts.input,
-        ...conn,
-    });
-}
-/**
- * Run a remote `agents secrets <args>` foreground with local stdio inherited,
- * so the remote sees a real TTY and its passphrase prompt surfaces and reads
- * keystrokes. Output streams to the terminal; only the exit code is returned.
- */
-export function remoteSecretsStream(target, args, opts = {}) {
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', ...args], undefined, osForTarget(target, opts.osLookupName));
-    return sshStream(target, remoteCmd, { tty: true, ...credentialTransportSshOpts(target) });
-}
-/**
- * Resolve a remote bundle to a plaintext env map by driving the remote's
- * `agents secrets export <bundle> --plaintext --format json`. Values cross over
- * ssh stdout, parsed in memory, never persisted.
- *
- * The remote unlocks the bundle with its own credentials; this machine does NOT
- * forward its passphrase because the remote bundle is encrypted with the
- * remote's passphrase.
- */
-export async function remoteResolveEnv(target, bundle, opts = {}) {
-    assertValidSshTarget(target);
-    // AGENTS_SECRETS_REMOTE_TRANSPORT marks this as the machine-to-machine JSON
-    // resolve path (the public shell-eval export mode was removed).
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName), { AGENTS_SECRETS_REMOTE_TRANSPORT: '1' });
-    const res = sshExec(target, remoteCmd, {
-        timeoutMs: REMOTE_TIMEOUT_MS,
-        ...credentialTransportSshOpts(target),
-    });
-    if (res.code !== 0) {
-        const msg = (res.stderr || res.stdout || '').trim();
-        const why = res.timedOut ? 'timed out' : res.code === null ? 'ssh failed' : `exit ${res.code}`;
-        throw new Error(`Failed to resolve '${bundle}' on ${target} (${why})${msg ? `: ${msg}` : ''}`);
-    }
-    // Tolerate login-shell banner noise on stdout: take the outer { … } object.
-    const raw = res.stdout;
-    const start = raw.indexOf('{');
-    const end = raw.lastIndexOf('}');
-    const jsonText = start >= 0 && end >= start ? raw.slice(start, end + 1) : raw.trim();
-    let parsed;
-    try {
-        parsed = JSON.parse(jsonText);
-    }
-    catch {
-        throw new Error(`Could not parse secrets JSON from '${bundle}' on ${target}. ` +
-            `Is the remote agents-cli new enough for 'secrets export --format json'?`);
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error(`Unexpected payload resolving '${bundle}' on ${target}.`);
-    }
-    const env = {};
-    const blocked = [];
-    for (const [k, v] of Object.entries(parsed)) {
-        // Drop dangerous-override keys returned by the (untrusted) peer.
-        if (isDangerousRemoteEnvKey(k)) {
-            blocked.push(k);
-            continue;
-        }
-        env[k] = typeof v === 'string' ? v : String(v);
-    }
-    if (blocked.length > 0) {
-        process.stderr.write(`[secrets] Dropped ${blocked.length} dangerous key(s) from '${bundle}'@${target} ` +
-            `(remote override blocked): ${blocked.join(', ')}\n`);
-    }
-    // Audit the event on the initiating host too; values never enter the payload.
-    emitSecretAudit({
-        event: 'secrets.get',
-        bundle,
-        operation: 'remote resolve',
-        source: 'remote',
-        host: target,
-        status: 'success',
-        keyCount: Object.keys(env).length,
-    });
-    return env;
-}
-/**
- * True when the remote's headless read-back raised the locked-login-keychain
- * signature. Anything else must NOT be mislabeled as a locked keychain.
- */
-function isLockedKeychainReadBackError(stderr) {
-    const s = stderr.toLowerCase();
-    return (s.includes('not unlocked') ||
-        s.includes('secrets agent') ||
-        s.includes('stored item') ||
-        s.includes('not found'));
-}
-/**
- * Decide whether a keychain-backed push to a remote actually persisted its
- * secret value items by reading the bundle back the same way a later resolve
- * will. Catches the silent failure where headless SSH writes metadata but not
- * readable value items to a locked macOS login keychain.
- */
-export function evaluateKeychainWriteVerification(pushedKeys, readBack) {
-    if (!readBack.ok) {
-        const stderr = readBack.stderr.trim();
-        if (isLockedKeychainReadBackError(stderr)) {
-            return {
-                ok: false,
-                kind: 'locked-keychain',
-                reason: `the remote could not read it back${stderr ? ` (${stderr})` : ''}`,
-            };
-        }
-        return {
-            ok: false,
-            kind: 'error',
-            reason: stderr || 'read-back failed',
-        };
-    }
-    const present = new Set(readBack.keys);
-    const missing = pushedKeys.filter((k) => !present.has(k));
-    if (missing.length > 0) {
-        return {
-            ok: false,
-            kind: 'locked-keychain',
-            reason: `${missing.length} of ${pushedKeys.length} key(s) did not persist on the remote ` +
-                `(missing: ${missing.slice(0, 5).join(', ')}${missing.length > 5 ? ', …' : ''})`,
-        };
-    }
-    return { ok: true };
-}
-/**
- * Actionable error message for a failed keychain-over-SSH push. Names the cause
- * (locked remote login keychain) and steers to the two real fixes.
- */
-export function keychainWriteFailureMessage(host, bundle, reason) {
-    return (`${host}: pushed '${bundle}' but the keychain items did not persist — ${reason}. ` +
-        `A macOS login keychain is LOCKED under headless SSH, so a keychain-backed write ` +
-        `lands the bundle metadata but no readable secret items, and later reads fail with ` +
-        `"stored item '…' not found". Re-run with a headless-readable backend:\n` +
-        `    agents secrets export ${bundle} --device ${host} --remote-backend file\n` +
-        `(needs AGENTS_SECRETS_PASSPHRASE set locally), or unlock the remote keychain first ` +
-        `(e.g. an interactive login / \`agents secrets unlock\` on ${host}) and retry.`);
-}
-/**
- * Read a bundle back from a remote over SSH and confirm the pushed keys
- * materialized. Drives the marker-gated json transport but keeps only KEY NAMES;
- * plaintext values are discarded immediately. Returns a verification verdict.
- */
-export function verifyRemoteKeychainPush(target, bundle, pushedKeys, opts = {}) {
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName), { AGENTS_SECRETS_REMOTE_TRANSPORT: '1' });
-    const res = sshExec(target, remoteCmd, {
-        timeoutMs: opts.timeoutMs ?? REMOTE_TIMEOUT_MS,
-        ...(opts.secret ? credentialTransportSshOpts(target) : {}),
-    });
-    return evaluateRemoteKeychainPushResult(pushedKeys, res);
-}
-/** Async, kill-bounded read-back verification for daemon-originated pushes. */
-export async function verifyRemoteKeychainPushAsync(target, bundle, pushedKeys, opts = {}) {
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName), { AGENTS_SECRETS_REMOTE_TRANSPORT: '1' });
-    const res = await sshExecAsync(target, remoteCmd, {
-        timeoutMs: opts.timeoutMs ?? REMOTE_TIMEOUT_MS,
-        ...(opts.secret ? credentialTransportSshOpts(target) : {}),
-    });
-    return evaluateRemoteKeychainPushResult(pushedKeys, res);
-}
-function evaluateRemoteKeychainPushResult(pushedKeys, res) {
-    if (res.code !== 0) {
-        const why = res.timedOut ? 'timed out' : res.code === null ? 'ssh failed' : `exit ${res.code}`;
-        const stderr = `${why}${(res.stderr || res.stdout || '').trim() ? `: ${(res.stderr || res.stdout).trim()}` : ''}`;
-        return evaluateKeychainWriteVerification(pushedKeys, { ok: false, stderr });
-    }
-    // Tolerate login-shell banner noise; keep only key names and discard values.
-    const raw = res.stdout;
-    const start = raw.indexOf('{');
-    const end = raw.lastIndexOf('}');
-    const jsonText = start >= 0 && end >= start ? raw.slice(start, end + 1) : raw.trim();
-    let keys;
-    try {
-        const parsed = JSON.parse(jsonText);
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-            return evaluateKeychainWriteVerification(pushedKeys, {
-                ok: false,
-                stderr: 'unexpected read-back payload',
-            });
-        }
-        keys = Object.keys(parsed);
-    }
-    catch {
-        return evaluateKeychainWriteVerification(pushedKeys, {
-            ok: false,
-            stderr: 'could not parse read-back JSON',
-        });
-    }
-    return evaluateKeychainWriteVerification(pushedKeys, { ok: true, keys });
-}
-/**
- * `bash -lc` command + stdin payload for a file-backed remote import.
- *
- * The file store is passphrase-free: the remote auto-provisions its own machine-
- * local key, so reads are headless. AGENTS_SECRETS_PASSPHRASE must NOT be
- * forwarded (PHNX-2371): a remote keyed to a secret its daemon does not hold
- * reports "Imported N key(s)" then fails every later decrypt.
- */
-export function buildRemoteFileImportCommand(bundle, dotenv, opts = {}) {
-    const force = opts.force ? ' --force' : '';
-    const policy = opts.policyNever ? ' --policy never --i-understand' : '';
-    const importCmd = `agents secrets import ${shellQuote(bundle)} --from - --backend file${force}${policy}`;
-    // No prologue — AGENTS_SECRETS_PASSPHRASE stays unset on the remote.
-    return { remoteCmd: `bash -lc ${shellQuote(importCmd)}`, input: dotenv };
-}

package/dist/lib/secrets/reserved-sync.d.ts

@@ -1,66 +0,0 @@
-import { type PushBundleResult } from './push.js';
-import { type DeviceProfile } from '../devices/registry.js';
-import { type SharedAuthStatus } from '../fleet-shared-state.js';
-/** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
-export declare const AUTH_SYNC_PUSH_DEADLINE_MS = 20000;
-export interface AuthSyncDevice {
-    name: string;
-    reachable: boolean;
-    pinned: boolean;
-    remoteAuth: SharedAuthStatus | 'unknown';
-}
-export type AuthSyncPlanItem = {
-    action: 'push';
-    device: string;
-} | {
-    action: 'skip';
-    device: string;
-    reason: string;
-};
-export declare function planAuthBundlePush(localAuthOk: boolean, localIsPublisher: boolean, devices: AuthSyncDevice[]): AuthSyncPlanItem[];
-export interface AuthSyncResult {
-    publisher: string | null;
-    stateChanged: boolean;
-    pushed: string[];
-    skipped: Array<{
-        device: string;
-        reason: string;
-    }>;
-    errors: Array<{
-        device: string;
-        message: string;
-    }>;
-}
-export interface AuthSyncDeps {
-    inspectLocal?: () => {
-        exists: boolean;
-        ok: boolean;
-    };
-    listDevices?: () => DeviceProfile[];
-    localName?: string;
-    userAgentsDir?: string;
-    isPinned?: (name: string) => boolean;
-    push?: (bundle: string, host: string) => Promise<PushBundleResult>;
-    sshTarget?: (device: DeviceProfile) => string;
-}
-export interface PublishAuthVerdictOptions {
-    inspectLocal?: () => {
-        exists: boolean;
-        ok: boolean;
-    };
-    localName?: string;
-    userAgentsDir?: string;
-}
-export interface PublishAuthVerdictResult {
-    device: string;
-    status: SharedAuthStatus;
-    changed: boolean;
-    error: string | null;
-}
-/** Publish only safe readiness metadata; useful immediately before a repo push. */
-export declare function publishReservedAuthVerdict(options?: PublishAuthVerdictOptions): Promise<PublishAuthVerdictResult>;
-/**
- * Publish local readiness, elect one ready source, then asynchronously provision
- * only peers whose shared verdict says the bundle is missing.
- */
-export declare function syncReservedAuthBundle(deps?: AuthSyncDeps): Promise<AuthSyncResult>;

package/dist/lib/secrets/reserved-sync.js

@@ -1,147 +0,0 @@
-/**
- * Fleet sync of the reserved file-backed `auth` bundle (PHNX-2371/PHNX-3609).
- *
- * Every daemon publishes only a safe auth readiness verdict into its owned
- * fleet-shared state file. A deterministic ready publisher reads those verdicts
- * and transfers the actual bundle only to a peer reporting `missing`. Secret
- * values never enter Git; the exceptional provisioning transfer remains SSH,
- * now async and kill-bounded instead of blocking the daemon event loop.
- */
-import { AUTH_BUNDLE_NAME, inspectReservedAuthBundle } from './bundles.js';
-import { pushBundleToHostAsync } from './push.js';
-import { isDialableDevice, loadDevicesSync } from '../devices/registry.js';
-import { sshTargetFor } from '../devices/connect.js';
-import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../devices/known-hosts.js';
-import { machineId, normalizeHost } from '../session/sync/config.js';
-import { readFleetSharedDeviceStates, updateFleetSharedDeviceStateAsync, } from '../fleet-shared-state.js';
-import { getUserAgentsDir } from '../state.js';
-/** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
-export const AUTH_SYNC_PUSH_DEADLINE_MS = 20_000;
-export function planAuthBundlePush(localAuthOk, localIsPublisher, devices) {
-    if (!localAuthOk) {
-        return devices.map((device) => ({ action: 'skip', device: device.name, reason: 'no local file-backed auth bundle' }));
-    }
-    if (!localIsPublisher) {
-        return devices.map((device) => ({ action: 'skip', device: device.name, reason: 'another ready device is the elected auth publisher' }));
-    }
-    return devices.map((device) => {
-        if (!device.reachable)
-            return { action: 'skip', device: device.name, reason: 'unreachable' };
-        if (!device.pinned) {
-            return { action: 'skip', device: device.name, reason: `host key not pinned; run \`agents ssh ${device.name}\` once` };
-        }
-        if (device.remoteAuth === 'ready')
-            return { action: 'skip', device: device.name, reason: 'already present' };
-        if (device.remoteAuth === 'invalid')
-            return { action: 'skip', device: device.name, reason: 'remote auth bundle uses the wrong backend' };
-        if (device.remoteAuth === 'unknown') {
-            return { action: 'skip', device: device.name, reason: 'no shared auth verdict has arrived from this peer' };
-        }
-        return { action: 'push', device: device.name };
-    });
-}
-function defaultDevices() {
-    return Object.values(loadDevicesSync());
-}
-function authStatus(local) {
-    if (!local.exists)
-        return 'missing';
-    return local.ok ? 'ready' : 'invalid';
-}
-/** Publish only safe readiness metadata; useful immediately before a repo push. */
-export async function publishReservedAuthVerdict(options = {}) {
-    const local = (options.inspectLocal ?? inspectReservedAuthBundle)();
-    const status = authStatus(local);
-    const device = options.localName ?? machineId();
-    try {
-        const write = await updateFleetSharedDeviceStateAsync(device, { auth: { status } }, options.userAgentsDir ?? getUserAgentsDir());
-        return { device, status, changed: write.changed, error: null };
-    }
-    catch (err) {
-        return { device, status, changed: false, error: err.message };
-    }
-}
-/**
- * Publish local readiness, elect one ready source, then asynchronously provision
- * only peers whose shared verdict says the bundle is missing.
- */
-export async function syncReservedAuthBundle(deps = {}) {
-    const result = {
-        publisher: null,
-        stateChanged: false,
-        pushed: [],
-        skipped: [],
-        errors: [],
-    };
-    const published = await publishReservedAuthVerdict(deps);
-    const localStatus = published.status;
-    const localName = published.device;
-    const localNorm = normalizeHost(localName);
-    const root = deps.userAgentsDir ?? getUserAgentsDir();
-    const devices = (deps.listDevices ?? defaultDevices)().filter((device) => normalizeHost(device.name) !== localNorm);
-    result.stateChanged = published.changed;
-    if (published.error)
-        result.errors.push({ device: localName, message: `could not publish auth verdict: ${published.error}` });
-    const read = readFleetSharedDeviceStates(root);
-    result.errors.push(...read.errors);
-    const stateByDevice = new Map(read.states.map((state) => [normalizeHost(state.device), state]));
-    const registered = new Map(devices.map((device) => [normalizeHost(device.name), device]));
-    const readyPublishers = read.states
-        .filter((state) => {
-        if (state.auth?.status !== 'ready')
-            return false;
-        if (normalizeHost(state.device) === localNorm)
-            return localStatus === 'ready';
-        const device = registered.get(normalizeHost(state.device));
-        // Removed and known-offline device files are stale observations, not live
-        // executors. Letting one win election would suppress provisioning forever.
-        return !!device && isDialableDevice(device);
-    })
-        .map((state) => state.device);
-    if (localStatus === 'ready' && !readyPublishers.some((name) => normalizeHost(name) === localNorm)) {
-        readyPublishers.push(localName);
-    }
-    readyPublishers.sort((a, b) => normalizeHost(a).localeCompare(normalizeHost(b)));
-    result.publisher = readyPublishers[0] ?? null;
-    const localIsPublisher = result.publisher !== null && normalizeHost(result.publisher) === localNorm;
-    const pinned = deps.isPinned ?? ((name) => isHostPinned(name, managedKnownHostsPath()));
-    const plan = planAuthBundlePush(localStatus === 'ready', localIsPublisher, devices.map((device) => ({
-        name: device.name,
-        reachable: isDialableDevice(device),
-        pinned: isDevicePinned(device, pinned),
-        remoteAuth: stateByDevice.get(normalizeHost(device.name))?.auth?.status ?? 'unknown',
-    })));
-    const byName = new Map(devices.map((device) => [device.name, device]));
-    const push = deps.push ?? ((bundle, host) => pushBundleToHostAsync(bundle, host, {
-        remoteBackend: 'file',
-        operation: 'auth-sync',
-        agentOnly: true,
-        timeoutMs: AUTH_SYNC_PUSH_DEADLINE_MS,
-    }));
-    const targetOf = deps.sshTarget ?? sshTargetFor;
-    const outcomes = await Promise.all(plan.map(async (item) => {
-        if (item.action === 'skip')
-            return { kind: 'skip', device: item.device, message: item.reason };
-        const profile = byName.get(item.device);
-        if (!profile)
-            return { kind: 'skip', device: item.device, message: 'not in registry' };
-        try {
-            const out = await push(AUTH_BUNDLE_NAME, targetOf(profile));
-            return out.ok
-                ? { kind: 'pushed', device: item.device, message: out.message }
-                : { kind: 'error', device: item.device, message: out.message };
-        }
-        catch (err) {
-            return { kind: 'error', device: item.device, message: err.message };
-        }
-    }));
-    for (const outcome of outcomes) {
-        if (outcome.kind === 'pushed')
-            result.pushed.push(outcome.device);
-        else if (outcome.kind === 'skip')
-            result.skipped.push({ device: outcome.device, reason: outcome.message });
-        else
-            result.errors.push({ device: outcome.device, message: outcome.message });
-    }
-    return result;
-}

package/dist/lib/secrets/scope.d.ts

@@ -1,26 +0,0 @@
-/**
- * Harness scoping for an unlocked bundle — the shared vocabulary of the broker
- * (agent.ts), the durable session store (session-store.ts), and the read path
- * (bundles.ts).
- *
- * A grant is stored under a scope and read under a scope; the two must agree or
- * the bundle is invisible. `agents secrets unlock --agent <agent>` exists to NARROW
- * a grant to one harness, so an unlock without it is global by definition.
- *
- * This module deliberately has NO imports: agent.ts and session-store.ts already
- * import each other, and hanging the scope constants off either one would close
- * that cycle — under ESM a cyclic `const` read can land in the temporal dead zone
- * and throw at runtime even though tsc is happy.
- */
-/**
- * Scope of an unlock that was not narrowed with `--agent`: readable by every
- * harness. Not a valid harness name, so it can never collide with one.
- */
-export declare const GLOBAL_HARNESS = "*";
-/**
- * Scopes a reader consults, most specific first: its own harness, then the global
- * grant. This is the resolution order of the scoped-grant model — a narrow
- * `--agent claude` unlock stays claude-only while an unscoped unlock serves
- * everyone — not a fallback papering over a miss.
- */
-export declare function bundleScopeChain(harness: string | undefined): string[];

package/dist/lib/secrets/scope.js

@@ -1,29 +0,0 @@
-/**
- * Harness scoping for an unlocked bundle — the shared vocabulary of the broker
- * (agent.ts), the durable session store (session-store.ts), and the read path
- * (bundles.ts).
- *
- * A grant is stored under a scope and read under a scope; the two must agree or
- * the bundle is invisible. `agents secrets unlock --agent <agent>` exists to NARROW
- * a grant to one harness, so an unlock without it is global by definition.
- *
- * This module deliberately has NO imports: agent.ts and session-store.ts already
- * import each other, and hanging the scope constants off either one would close
- * that cycle — under ESM a cyclic `const` read can land in the temporal dead zone
- * and throw at runtime even though tsc is happy.
- */
-/**
- * Scope of an unlock that was not narrowed with `--agent`: readable by every
- * harness. Not a valid harness name, so it can never collide with one.
- */
-export const GLOBAL_HARNESS = '*';
-/**
- * Scopes a reader consults, most specific first: its own harness, then the global
- * grant. This is the resolution order of the scoped-grant model — a narrow
- * `--agent claude` unlock stays claude-only while an unscoped unlock serves
- * everyone — not a fallback papering over a miss.
- */
-export function bundleScopeChain(harness) {
-    const own = harness || GLOBAL_HARNESS;
-    return own === GLOBAL_HARNESS ? [GLOBAL_HARNESS] : [own, GLOBAL_HARNESS];
-}