@phnx-labs/agents-cli 1.22.84 → 1.22.85

package/dist/lib/browser/chrome.d.ts

@@ -49,7 +49,7 @@ export interface LaunchResult {
  * needs them can `agents secrets unlock <bundle>`). Exported so the no-prompt
  * behavior is testable on the real keychain path without spawning a browser.
  */
-export declare function resolveProfileSecretsEnv(secrets?: string): Record<string, string>;
+export declare function resolveProfileSecretsEnv(secrets?: string): Promise<Record<string, string>>;
 export declare function launchBrowser(profileName: string, browserType: BrowserType, port: number, options?: ChromeOptions, secrets?: string, customBinary?: string, isElectron?: boolean): Promise<LaunchResult>;
 export declare function attachToChrome(port: number): Promise<string>;
 export declare function killChrome(pid: number): void;

package/dist/lib/browser/chrome.js

@@ -4,7 +4,7 @@ import * as path from 'path';
 import * as os from 'os';
 import { getProfileRuntimeDir } from './profiles.js';
 import { discoverBrowserWsUrl, registerPipeTransport } from './cdp.js';
-import { readAndResolveBundleEnv, bundleExists } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, bundleExists } from '../secrets-client.js';
 import { writeProfileRuntime, readProfileRuntime } from './runtime-state.js';
 // Windows install roots. Resolve from the environment (fall back to the usual
 // defaults) so per-user installs under %LOCALAPPDATA% and 64-bit Program Files
@@ -247,11 +247,11 @@ export function listInstalledBrowsers(platform = os.platform()) {
  * needs them can `agents secrets unlock <bundle>`). Exported so the no-prompt
  * behavior is testable on the real keychain path without spawning a browser.
  */
-export function resolveProfileSecretsEnv(secrets) {
-    if (!secrets || !bundleExists(secrets))
+export async function resolveProfileSecretsEnv(secrets) {
+    if (!secrets || !(await bundleExists(secrets)))
         return {};
     try {
-        const { env } = readAndResolveBundleEnv(secrets, { caller: 'browser profile', agentOnly: true });
+        const { env } = await readAndResolveBundleEnv(secrets, { caller: 'browser profile', agentOnly: true });
         return env;
     }
     catch {
@@ -321,7 +321,7 @@ isElectron = false) {
     ];
     // Profile secrets: agentOnly (SEC-13) — a locked bundle resolves to an empty map
     // (launch proceeds without them), never a Touch ID prompt. See resolveProfileSecretsEnv.
-    const env = { ...process.env, ...resolveProfileSecretsEnv(secrets) };
+    const env = { ...process.env, ...(await resolveProfileSecretsEnv(secrets)) };
     const child = spawn(browserPath, args, {
         detached: true,
         stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'],

package/dist/lib/byok-usage.js

@@ -7,7 +7,7 @@
  * same bar style the native usage system uses, just sourced from the provider
  * API rather than the CLI's own usage tracking.
  */
-import { hasKeychainToken, getKeychainToken } from './secrets/profiles.js';
+import { getKeychainTokenSync, hasKeychainTokenSync } from './secrets-client.js';
 import { renderBar, getUsageColor } from './accounting/usage.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -74,9 +74,9 @@ function resolveByokToken(profile) {
     if (!keychainItem)
         return null;
     try {
-        if (!hasKeychainToken(keychainItem))
+        if (!hasKeychainTokenSync(keychainItem))
             return null;
-        return getKeychainToken(keychainItem);
+        return getKeychainTokenSync(keychainItem);
     }
     catch {
         return null;

package/dist/lib/claude-account-token.d.ts

@@ -1,3 +1,5 @@
+import { ReservedBundleWrongBackendError } from './reserved-stores.js';
+import type { DeviceAccountSlot, NativeAccountRecord } from './types.js';
 /**
  * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
  * setup-tokens. Usage/probe reads authenticate with these instead of Claude
@@ -6,8 +8,11 @@
  * bare key, so one account's token can't be misapplied to another in a
  * multi-account fleet.
  */
-/** Alias of the secrets-layer reserved name so mint/seed shares one source of truth. */
+/** Alias of the reserved-store name so mint/seed shares one source of truth. */
 export declare const AUTH_BUNDLE = "auth";
+export { ReservedBundleWrongBackendError };
+/** Drop every memoized setup-token; called after this process seeds or rotates one. */
+export declare function invalidateClaudeSetupTokenCache(): void;
 /** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
 export declare function isValidClaudeSetupToken(value: string): boolean;
 /** The per-account key an email maps to inside the `auth` bundle. */
@@ -24,8 +29,8 @@ export declare function readClaudeAccountEmail(home?: string): string | null;
 export declare function resolveClaudeSetupToken(home?: string): string | null;
 /**
  * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
- * any version home's `.claude.json`. This is what lets `agents accounts attach`
- * provision a headless worker home that has never had an interactive login: the
+ * any version home's `.claude.json`. This is what lets worker-slot provisioning
+ * seed a headless worker home that has never had an interactive login: the
  * account's non-rotating setup-token is already fleet-synced in the file-based
  * `auth` bundle, keyed by email ({@link claudeAccountTokenKey}), so we can write
  * the home's `.oauth_token` from it without the circular
@@ -47,4 +52,43 @@ export declare function resolveClaudeSetupTokenForEmail(email: string, cacheKey?
  * It never copies a rotating OAuth credential (`.credentials.json`) — the setup-token
  * stays the credential of record.
  */
+/**
+ * Write a Claude worker slot's `.oauth_token` (0600) from a durable setup-token,
+ * the way the pre-slot worker home was provisioned. Refuses a malformed token so
+ * a corrupt bundle entry can never reach the auth header (see {@link SETUP_TOKEN_RE}).
+ * `home` is the slot dir; the claude adapter shim reads `$CLAUDE_CONFIG_DIR/.oauth_token`
+ * where `CLAUDE_CONFIG_DIR` is `<home>/.claude`. Returns the written path.
+ */
+export declare function writeClaudeWorkerOauthToken(home: string, token: string): string;
+/**
+ * Read one non-rotating credential value from a reserved store by its storage
+ * key. Returns null when the bundle or key is absent. Used to materialize a
+ * worker slot from a synced durable credential (setup-token / API key).
+ *
+ * A reserved `__<harness>__` store is file-backed by design (headless, fleet-
+ * shareable) and its item is read directly, symmetric with how it is written —
+ * `readAndResolveBundleEnv`'s name validation does not yet accept a reserved
+ * name on the READ path (a secrets-track seam; see the PR body). A non-reserved
+ * bundle (the legacy `auth` alias, a provider bundle) goes through the normal
+ * resolver so refs/expiry/lease gates still apply.
+ */
+export declare function readReservedCredential(bundle: string, key: string): string | null;
+/**
+ * Materialize a worker slot for a portable account from its synced durable
+ * credential (PHNX-3940 T6 — the generalization of the pre-slot Claude worker-home
+ * provisioning). Creates the HOME-shaped slot dir (T1 `ensureSlot`), then, for a
+ * durable harness, writes the credential into it the way the Claude worker home is
+ * provisioned today: for `claude`, the setup-token → `.oauth_token` (0600) + the
+ * seeded identity email (the read-side join in agent-spec then completes the uuids
+ * from the registry row). API-key harnesses need no file — the key is injected at
+ * spawn from the reserved store (T5) — so their slot is created and recorded
+ * `durable` with no write. A per-device harness (`worker: 'none'`) gets a
+ * `per-device` slot and no credential — it logs in per box.
+ *
+ * This is worker-side reconciliation: it runs on the box where the key landed and
+ * NEVER transports anything (the SSH push that delivered the key is the daemon's
+ * job — invariant 1). Fails loud when a durable claude account has no resolvable
+ * token on this device rather than recording a slot that cannot authenticate.
+ */
+export declare function provisionWorkerSlot(account: NativeAccountRecord): DeviceAccountSlot;
 export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;

package/dist/lib/claude-account-token.js

@@ -1,9 +1,10 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { AUTH_BUNDLE_NAME, ReservedBundleWrongBackendError, bundleBackend, bundleExists, readAndResolveBundleEnv, } from './secrets/bundles.js';
-import { fileStoreItemPath } from './secrets/filestore.js';
-import { secretsKeychainItem } from './secrets/index.js';
+import { bundleBackendSync, bundleExistsSync, isSecretsClientError, readAndResolveBundleEnvSync, secretsKeychainItem, storeGetSync, storeHasSync, } from './secrets-client.js';
+import { AUTH_STORE_ALIAS, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, isReservedStoreName, } from './reserved-stores.js';
+import { ensureSlot, recordSlot } from './accounts/slots.js';
+import { harnessWorkerKinds } from './harness-auth-capabilities.js';
 /**
  * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
  * setup-tokens. Usage/probe reads authenticate with these instead of Claude
@@ -12,8 +13,9 @@ import { secretsKeychainItem } from './secrets/index.js';
  * bare key, so one account's token can't be misapplied to another in a
  * multi-account fleet.
  */
-/** Alias of the secrets-layer reserved name so mint/seed shares one source of truth. */
-export const AUTH_BUNDLE = AUTH_BUNDLE_NAME;
+/** Alias of the reserved-store name so mint/seed shares one source of truth. */
+export const AUTH_BUNDLE = AUTH_STORE_ALIAS;
+export { ReservedBundleWrongBackendError };
 /**
  * A well-formed Claude OAuth setup-token: the `sk-ant-oat01-` prefix followed by
  * token-safe characters only, on a single line. `claude setup-token` mints exactly
@@ -28,8 +30,49 @@ export const AUTH_BUNDLE = AUTH_BUNDLE_NAME;
  * where a corrupt bundle entry must be caught before it reaches the auth header.
  */
 const SETUP_TOKEN_RE = /^sk-ant-oat01-[A-Za-z0-9_-]+$/;
-/** Process-local only: plaintext setup-tokens are never written to another cache. */
+/**
+ * Process-local memo of resolved setup-tokens, keyed by the caller's cache key
+ * AND the per-account token key — a version home that switches accounts must
+ * miss, never be served the previous account's token. Plaintext setup-tokens
+ * are never written to another cache. The bundle now
+ * lives behind the standalone `secrets` process (one spawn per read), so the
+ * memo is what keeps a probe loop over many accounts from re-decrypting the
+ * whole `auth` bundle per account; it is bounded by {@link SETUP_TOKEN_MEMO_TTL_MS}
+ * so a rotation performed by another process is observed within seconds, and
+ * an in-process writer clears it outright ({@link invalidateClaudeSetupTokenCache}).
+ */
 const setupTokenCache = new Map();
+const SETUP_TOKEN_MEMO_TTL_MS = 10_000;
+/** Drop every memoized setup-token; called after this process seeds or rotates one. */
+export function invalidateClaudeSetupTokenCache() {
+    setupTokenCache.clear();
+}
+/**
+ * Read the reserved `auth` bundle through the standalone. Returns null when it
+ * does not exist — checked explicitly, because a prompt-free (`agentOnly`) read
+ * of a bundle that does not exist reports LOCKED, and a genuinely locked store
+ * must stay distinguishable from an absent bundle. A keychain- or vault-backed
+ * `auth` fails loud with {@link ReservedBundleWrongBackendError} — whether the
+ * standalone refused the resolve (`WRONG_BACKEND`) or the returned metadata
+ * names the wrong backend — so usage/probe never silently ignores a seeded
+ * token (SEC-GAP-3).
+ */
+function readReservedAuthBundle(caller) {
+    if (!bundleExistsSync(AUTH_BUNDLE))
+        return null;
+    let resolved;
+    try {
+        resolved = readAndResolveBundleEnvSync(AUTH_BUNDLE, { caller, agentOnly: true });
+    }
+    catch (err) {
+        if (isSecretsClientError(err, 'WRONG_BACKEND')) {
+            throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, bundleBackendSync(AUTH_BUNDLE));
+        }
+        throw err;
+    }
+    assertReservedAuthBackend(resolved.bundle.backend ?? 'keychain');
+    return resolved;
+}
 function credentialFingerprint(credentialPath) {
     try {
         const stat = fs.statSync(credentialPath, { bigint: true });
@@ -117,7 +160,7 @@ function discoverClaudeAccountEmailFromOauthToken(home) {
         return email;
     }
     catch (err) {
-        if (err instanceof ReservedBundleWrongBackendError)
+        if (isReservedBundleBackendError(err))
             throw err;
         return null;
     }
@@ -132,13 +175,10 @@ function discoverEmailUncached(home, tokenPath) {
     }
     if (!isValidClaudeSetupToken(token))
         return null;
-    if (!bundleExists(AUTH_BUNDLE))
+    const resolved = readReservedAuthBundle('usage');
+    if (!resolved)
         return null;
-    if (bundleBackend(AUTH_BUNDLE) !== 'file') {
-        throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, bundleBackend(AUTH_BUNDLE));
-    }
-    const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
-    for (const [key, value] of Object.entries(env)) {
+    for (const [key, value] of Object.entries(resolved.env)) {
         if (value.trim() !== token)
             continue;
         const email = emailFromTokenKey(key);
@@ -175,8 +215,8 @@ function emailFromTokenKey(key) {
 }
 /**
  * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
- * any version home's `.claude.json`. This is what lets `agents accounts attach`
- * provision a headless worker home that has never had an interactive login: the
+ * any version home's `.claude.json`. This is what lets worker-slot provisioning
+ * seed a headless worker home that has never had an interactive login: the
  * account's non-rotating setup-token is already fleet-synced in the file-based
  * `auth` bundle, keyed by email ({@link claudeAccountTokenKey}), so we can write
  * the home's `.oauth_token` from it without the circular
@@ -192,44 +232,23 @@ export function resolveClaudeSetupTokenForEmail(email, cacheKey) {
         const trimmed = email.trim();
         if (!trimmed)
             return null;
-        if (!bundleExists(AUTH_BUNDLE))
-            return null;
-        const backend = bundleBackend(AUTH_BUNDLE);
-        if (backend !== 'file') {
-            // SEC-GAP-3: a keychain/vault-backed `auth` used to return null here, so
-            // usage/probe fell through to the interactive login (Touch ID) with no
-            // hint that the seeded setup-token was being ignored.
-            throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, backend);
-        }
         const key = claudeAccountTokenKey(trimmed);
-        const ck = cacheKey ?? `email:${trimmed}`;
-        const item = secretsKeychainItem(AUTH_BUNDLE, key);
-        const credentialPath = fileStoreItemPath(item);
-        for (let attempt = 0; attempt < 2; attempt++) {
-            const before = credentialFingerprint(credentialPath);
-            const cached = setupTokenCache.get(ck);
-            if (cached?.credentialPath === credentialPath && cached.fingerprint === before) {
-                return cached.token;
-            }
-            if (before === 'missing') {
-                setupTokenCache.set(ck, { credentialPath, fingerprint: before, token: null });
-                return null;
-            }
-            const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
-            const v = (env[key] ?? '').trim();
-            const token = v.length > 0 && isValidClaudeSetupToken(v) ? v : null;
-            const after = credentialFingerprint(credentialPath);
-            if (before === after) {
-                setupTokenCache.set(ck, { credentialPath, fingerprint: after, token });
-                return token;
-            }
-        }
-        // The credential changed during both decrypt attempts. Fail closed rather
-        // than return a token whose current file fingerprint was never observed.
-        return null;
+        const ck = `${cacheKey ?? `email:${trimmed}`}\0${key}`;
+        const cached = setupTokenCache.get(ck);
+        if (cached && Date.now() - cached.readAt < SETUP_TOKEN_MEMO_TTL_MS)
+            return cached.token;
+        // SEC-GAP-3: a keychain/vault-backed `auth` used to return null here, so
+        // usage/probe fell through to the interactive login (Touch ID) with no
+        // hint that the seeded setup-token was being ignored. readReservedAuthBundle
+        // throws ReservedBundleWrongBackendError instead, which propagates.
+        const resolved = readReservedAuthBundle('usage');
+        const v = (resolved?.env[key] ?? '').trim();
+        const token = v.length > 0 && isValidClaudeSetupToken(v) ? v : null;
+        setupTokenCache.set(ck, { readAt: Date.now(), token });
+        return token;
     }
     catch (err) {
-        if (err instanceof ReservedBundleWrongBackendError)
+        if (isReservedBundleBackendError(err))
             throw err;
         return null;
     }
@@ -244,6 +263,109 @@ export function resolveClaudeSetupTokenForEmail(email, cacheKey) {
  * It never copies a rotating OAuth credential (`.credentials.json`) — the setup-token
  * stays the credential of record.
  */
+/**
+ * Write a Claude worker slot's `.oauth_token` (0600) from a durable setup-token,
+ * the way the pre-slot worker home was provisioned. Refuses a malformed token so
+ * a corrupt bundle entry can never reach the auth header (see {@link SETUP_TOKEN_RE}).
+ * `home` is the slot dir; the claude adapter shim reads `$CLAUDE_CONFIG_DIR/.oauth_token`
+ * where `CLAUDE_CONFIG_DIR` is `<home>/.claude`. Returns the written path.
+ */
+export function writeClaudeWorkerOauthToken(home, token) {
+    if (!isValidClaudeSetupToken(token)) {
+        throw new Error('Refusing to write a malformed Claude setup-token to a worker slot.');
+    }
+    const tokenPath = path.join(home, '.claude', '.oauth_token');
+    fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+    fs.writeFileSync(tokenPath, token, { mode: 0o600 });
+    return tokenPath;
+}
+/**
+ * Read one non-rotating credential value from a reserved store by its storage
+ * key. Returns null when the bundle or key is absent. Used to materialize a
+ * worker slot from a synced durable credential (setup-token / API key).
+ *
+ * A reserved `__<harness>__` store is file-backed by design (headless, fleet-
+ * shareable) and its item is read directly, symmetric with how it is written —
+ * `readAndResolveBundleEnv`'s name validation does not yet accept a reserved
+ * name on the READ path (a secrets-track seam; see the PR body). A non-reserved
+ * bundle (the legacy `auth` alias, a provider bundle) goes through the normal
+ * resolver so refs/expiry/lease gates still apply.
+ */
+export function readReservedCredential(bundle, key) {
+    try {
+        if (isReservedStoreName(bundle) && bundle.startsWith('__')) {
+            const item = secretsKeychainItem(bundle, key);
+            if (!storeHasSync('file', item))
+                return null;
+            const value = storeGetSync('file', item).trim();
+            return value.length > 0 ? value : null;
+        }
+        const { env } = readAndResolveBundleEnvSync(bundle, {
+            keys: [key],
+            keyMode: 'storage',
+            agentOnly: true,
+            caller: 'provision-worker-slot',
+        });
+        const value = (env[key] ?? '').trim();
+        return value.length > 0 ? value : null;
+    }
+    catch (err) {
+        if (isReservedBundleBackendError(err))
+            throw err;
+        return null;
+    }
+}
+/**
+ * Materialize a worker slot for a portable account from its synced durable
+ * credential (PHNX-3940 T6 — the generalization of the pre-slot Claude worker-home
+ * provisioning). Creates the HOME-shaped slot dir (T1 `ensureSlot`), then, for a
+ * durable harness, writes the credential into it the way the Claude worker home is
+ * provisioned today: for `claude`, the setup-token → `.oauth_token` (0600) + the
+ * seeded identity email (the read-side join in agent-spec then completes the uuids
+ * from the registry row). API-key harnesses need no file — the key is injected at
+ * spawn from the reserved store (T5) — so their slot is created and recorded
+ * `durable` with no write. A per-device harness (`worker: 'none'`) gets a
+ * `per-device` slot and no credential — it logs in per box.
+ *
+ * This is worker-side reconciliation: it runs on the box where the key landed and
+ * NEVER transports anything (the SSH push that delivered the key is the daemon's
+ * job — invariant 1). Fails loud when a durable claude account has no resolvable
+ * token on this device rather than recording a slot that cannot authenticate.
+ */
+export function provisionWorkerSlot(account) {
+    const harness = account.agent;
+    const durable = harnessWorkerKinds(harness).some((kind) => kind === 'setup-token' || kind.startsWith('api-key'));
+    const slot = ensureSlot(harness, account.id);
+    const checkedAt = new Date().toISOString();
+    if (!durable) {
+        const record = { ...slot, authMode: 'per-device', verdict: 'unconfigured', checkedAt };
+        recordSlot(account.id, record);
+        return record;
+    }
+    if (harness === 'claude') {
+        const cred = account.workerCredential;
+        const token = cred
+            ? readReservedCredential(cred.bundle, cred.key)
+            // Claude row predating T1 (no workerCredential): the legacy `auth` bundle
+            // keys the token by the account email.
+            : account.identityLabel
+                ? resolveClaudeSetupTokenForEmail(account.identityLabel, slot.slotDir)
+                : null;
+        if (!token) {
+            const where = cred ? `${cred.bundle}:${cred.key}` : `'${AUTH_BUNDLE}' keyed by ${account.identityLabel ?? '(no email)'}`;
+            throw new Error(`No durable Claude setup-token for account ${account.id} on this device (${where}). `
+                + `Mint and sync it from the headed device.`);
+        }
+        writeClaudeWorkerOauthToken(slot.slotDir, token);
+        if (account.identityLabel)
+            seedClaudeWorkerHomeIdentity(slot.slotDir, account.identityLabel);
+    }
+    // API-key harnesses: the key rides the reserved store and is injected at spawn
+    // (T5); nothing is written into the slot here.
+    const record = { ...slot, authMode: 'durable', verdict: 'unverified', checkedAt };
+    recordSlot(account.id, record);
+    return record;
+}
 export function seedClaudeWorkerHomeIdentity(versionHome, email) {
     const trimmed = email.trim();
     if (!trimmed)

package/dist/lib/cloud/antigravity.js

@@ -20,7 +20,7 @@
  * back to GEMINI_API_KEY / GOOGLE_API_KEY in the environment.
  */
 import { resolveDispatchRepos, normalizeProviderStatus } from './types.js';
-import { readAndResolveBundleEnv } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv } from '../secrets-client.js';
 const INTERACTIONS_URL = 'https://generativelanguage.googleapis.com/v1beta/interactions';
 const DEFAULT_MODEL = 'antigravity-preview-05-2026';
 const KEY_NAMES = ['GEMINI_API_KEY', 'GOOGLE_API_KEY'];
@@ -62,7 +62,7 @@ export class AntigravityCloudProvider {
         return KEY_NAMES.some((k) => Boolean(process.env[k]));
     }
     /** Resolve the Gemini API key from the configured bundle or the environment. */
-    resolveApiKey() {
+    async resolveApiKey() {
         if (this.secretsBundle) {
             try {
                 // Cloud dispatch resolves the key on its own (no human at a sheet), so the
@@ -71,7 +71,7 @@ export class AntigravityCloudProvider {
                 // catch below re-raises verbatim — dispatch genuinely needs the key, so it
                 // fails LOUD with the unlock hint rather than swallowing it into a wrong
                 // path. A `never`/no-ACL or broker-held bundle resolves silently.
-                const { env } = readAndResolveBundleEnv(this.secretsBundle, { caller: 'cloud:antigravity', agentOnly: true });
+                const { env } = await readAndResolveBundleEnv(this.secretsBundle, { caller: 'cloud:antigravity', agentOnly: true });
                 for (const k of KEY_NAMES) {
                     if (env[k])
                         return env[k];
@@ -112,7 +112,7 @@ export class AntigravityCloudProvider {
             throw new Error(`Antigravity cloud is a raw sandbox with no GitHub repo → PR flow. Got repo(s): ${repos.join(', ')}. ` +
                 `Use --provider rush for repo-backed dispatch.`);
         }
-        const apiKey = this.resolveApiKey();
+        const apiKey = await this.resolveApiKey();
         const model = options.model ?? this.model;
         const body = buildInteractionBody(options.prompt, model);
         let resp;

package/dist/lib/cloud/cursor.js

@@ -1,6 +1,6 @@
 /** Cursor Cloud Agents provider backed by the public v1 REST API. */
 import { normalizeProviderStatus, resolveDispatchRepos } from './types.js';
-import { readAndResolveBundleEnv } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv } from '../secrets-client.js';
 export const CURSOR_API_BASE_URL = 'https://api.cursor.com/v1';
 const KEY_NAME = 'CURSOR_API_KEY';
 /** Translate unified dispatch options into Cursor's documented v1 create shape. */
@@ -111,10 +111,10 @@ export class CursorCloudProvider {
     hasKeySource() {
         return Boolean(this.secretsBundle || process.env[KEY_NAME]);
     }
-    resolveApiKey() {
+    async resolveApiKey() {
         if (this.secretsBundle) {
             try {
-                const { env } = readAndResolveBundleEnv(this.secretsBundle, { caller: 'cloud:cursor', agentOnly: true });
+                const { env } = await readAndResolveBundleEnv(this.secretsBundle, { caller: 'cloud:cursor', agentOnly: true });
                 if (env[KEY_NAME])
                     return env[KEY_NAME];
                 throw new Error(`Secrets bundle '${this.secretsBundle}' has no ${KEY_NAME}. Add one: agents secrets add ${this.secretsBundle} ${KEY_NAME}`);
@@ -143,7 +143,7 @@ export class CursorCloudProvider {
         };
     }
     async request(path, init) {
-        const apiKey = this.resolveApiKey();
+        const apiKey = await this.resolveApiKey();
         let response;
         try {
             response = await fetch(`${CURSOR_API_BASE_URL}${path}`, {

package/dist/lib/crabbox/cli.d.ts

@@ -11,7 +11,7 @@
  * needs a provider token (e.g. HCLOUD_TOKEN) in the environment. We inject it
  * from a secrets bundle when one is configured (see `crabboxEnv`).
  */
-import { type SecretsBundle } from '../secrets/bundles.js';
+import type { SecretsBundle } from '../secrets-types.js';
 /** A crabbox machine as reported by `crabbox list --json`. */
 export interface CrabboxBox {
     /** Provider machine name, e.g. `crabbox-blue-hermit-1039689b`. */

package/dist/lib/crabbox/cli.js

@@ -12,7 +12,7 @@
  * from a secrets bundle when one is configured (see `crabboxEnv`).
  */
 import { spawn, spawnSync } from 'child_process';
-import { readAndResolveBundleEnv, listBundles, bundleExists } from '../secrets/bundles.js';
+import { readAndResolveBundleEnvSync, listBundlesSync, bundleExistsSync } from '../secrets-client.js';
 import { readMeta, writeMeta } from '../state.js';
 import { DEFAULT_CRABBOX_PROFILE } from './config.js';
 /** Locate the crabbox binary, or throw an actionable error. */
@@ -59,7 +59,7 @@ function resolveTailscaleBundleMemo() {
     if (!tailscaleBundleMemo) {
         let value;
         try {
-            value = pickTailscaleBundleFromList(listBundles());
+            value = pickTailscaleBundleFromList(listBundlesSync());
         }
         catch {
             /* secrets unreadable — no auto-detect */
@@ -88,7 +88,7 @@ function resolveTailscaleKeyValueMemo(ts) {
     if (!tailscaleValueMemo) {
         let value;
         try {
-            const { env } = readAndResolveBundleEnv(ts.name, {
+            const { env } = readAndResolveBundleEnvSync(ts.name, {
                 caller: 'agents run --lease (crabbox tailscale)',
                 keys: [ts.key],
                 agentOnly: true,
@@ -129,14 +129,14 @@ export function resolveLeaseBundle() {
         return { name: env };
     try {
         const configured = readMeta().lease?.secretsBundle;
-        if (configured && bundleExists(configured))
+        if (configured && bundleExistsSync(configured))
             return { name: configured };
     }
     catch {
         /* config unreadable — fall through to auto-detect */
     }
     try {
-        const bundles = listBundles();
+        const bundles = listBundlesSync();
         const name = pickLeaseBundleFromList(bundles);
         if (name) {
             const b = bundles.find((x) => x.name === name);
@@ -187,7 +187,7 @@ function resolveLeaseEnvMemo(explicitBundle) {
                 // privilege; an unrelated bundle can't leak its other secrets into crabbox).
                 // An explicitly-named bundle (env/config or `opts.secretsBundle`) injects
                 // whole — the user chose it. Same resolver `agents secrets exec` uses.
-                const { env } = readAndResolveBundleEnv(resolved.name, {
+                const { env } = readAndResolveBundleEnvSync(resolved.name, {
                     caller: 'agents run --lease (crabbox)',
                     keys: resolved.keys,
                     // --lease is headless by contract and a locked bundle must fail loud with

package/dist/lib/crabbox/runtimes.d.ts

@@ -78,9 +78,9 @@ export declare const CLAUDE_TOKEN_REMOTE = ".claude/.credentials.json";
  * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
  * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
  *
- * On macOS the token is in the login Keychain, read SILENTLY via
- * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
- * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * On macOS the token is in the login Keychain, read SILENTLY via the standalone
+ * `secrets` client's `getKeychainTokenSync` (the `/usr/bin/security … -w` path —
+ * Claude's item trusts it, no Touch ID). A default native install uses the bare `Claude Code-credentials`
  * service; an agents-cli managed install (where `~/.claude` symlinks into a
  * versioned home) uses a hash-suffixed service, so we try the bare service first,
  * then enumerate installed version homes (preferring the account whose email

package/dist/lib/crabbox/runtimes.js

@@ -16,7 +16,7 @@ import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
 import { getAccountInfo } from '../agents.js';
-import { getKeychainToken } from '../secrets/index.js';
+import { getKeychainTokenSync } from '../secrets-client.js';
 import { getClaudeKeychainService } from '../accounting/usage.js';
 import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 export const LEASE_RUNTIMES = [
@@ -185,9 +185,9 @@ function isClaudeCredentialsBlob(s) {
  * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
  * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
  *
- * On macOS the token is in the login Keychain, read SILENTLY via
- * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
- * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * On macOS the token is in the login Keychain, read SILENTLY via the standalone
+ * `secrets` client's `getKeychainTokenSync` (the `/usr/bin/security … -w` path —
+ * Claude's item trusts it, no Touch ID). A default native install uses the bare `Claude Code-credentials`
  * service; an agents-cli managed install (where `~/.claude` symlinks into a
  * versioned home) uses a hash-suffixed service, so we try the bare service first,
  * then enumerate installed version homes (preferring the account whose email
@@ -203,7 +203,7 @@ function isClaudeCredentialsBlob(s) {
  * real Keychain.
  */
 export async function resolveClaudeCredentialsBlob(opts) {
-    const readItem = opts?.readItem ?? getKeychainToken;
+    const readItem = opts?.readItem ?? getKeychainTokenSync;
     const service = opts?.service ?? getClaudeKeychainService;
     const listVersions = opts?.listVersions ?? (() => listInstalledVersions('claude'));
     const versionHome = opts?.versionHome ?? ((v) => getVersionHomePath('claude', v));