@phnx-labs/agents-cli 1.22.84 → 1.22.85

package/dist/commands/apply.js

@@ -18,7 +18,7 @@ import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../lib/devi
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired, emptyTargetsMessage } from '../lib/fleet/manifest.js';
 import { snapshotAuth } from '../lib/fleet/auth-sync.js';
-import { AUTH_BUNDLE_NAME } from '../lib/secrets/bundles.js';
+import { AUTH_BUNDLE_NAME } from '../lib/secrets-policy.js';
 import { agentIdOf, diffFleet, probeDevice, runFleetApply, pool, sourceHome, expandAllSpecs, rosterNeedsVersions, fleetSecretsBundles, } from '../lib/fleet/apply.js';
 import { listInstalledVersions } from '../lib/installations/versions.js';
 /** Version of the running agents-cli — the fleet target version. */

package/dist/commands/auth-mint.d.ts

@@ -1,8 +1,12 @@
 /**
  * Shared `mint` subcommand registered on both `agents auth` (the ticket
- * surface) and `agents accounts` (the credential noun). Implementation lives
- * in lib/auth-mint.ts so neither command file owns the seed path.
+ * surface) and `agents accounts` (the credential noun). Hidden on both:
+ * `agents accounts add <harness> [name]` / `agents accounts login <harness>#<name>`
+ * is the taught path. Implementation lives in lib/auth-mint.ts so neither
+ * command file owns the seed path.
  */
 import type { Command } from 'commander';
 import { type MintDriveHooks } from '../lib/auth-mint.js';
-export declare function registerMintCommand(parent: Command, testHooks?: MintDriveHooks): Command;
+export declare function registerMintCommand(parent: Command, testHooks?: MintDriveHooks, opts?: {
+    hidden?: boolean;
+}): Command;

package/dist/commands/auth-mint.js

@@ -1,8 +1,16 @@
+/**
+ * Shared `mint` subcommand registered on both `agents auth` (the ticket
+ * surface) and `agents accounts` (the credential noun). Hidden on both:
+ * `agents accounts add <harness> [name]` / `agents accounts login <harness>#<name>`
+ * is the taught path. Implementation lives in lib/auth-mint.ts so neither
+ * command file owns the seed path.
+ */
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { readStdinSync, runOrDie } from '../lib/format.js';
 import { isInteractiveTerminal } from './utils.js';
 import { getMintFlow, listMintableHarnesses, mintAndSeed, } from '../lib/auth-mint.js';
+const MINT_POINTER = 'agents accounts add <harness> [name] / agents accounts login <harness>#<name>';
 function collect(value, previous) {
     return [...previous, value];
 }
@@ -28,9 +36,10 @@ function printResult(result, json) {
         }
     }
 }
-export function registerMintCommand(parent, testHooks) {
+export function registerMintCommand(parent, testHooks, opts) {
+    const hidden = opts?.hidden ?? true;
     const mint = parent
-        .command('mint <harness>')
+        .command('mint <harness>', { hidden })
         .description('Mint a long-lived setup-token and seed it as a named account')
         .option('--account <name-or-email>', 'Named account to create/rotate, or the account email')
         .option('--email <email>', 'Email that keys the reserved auth bundle when --account is a name')
@@ -78,19 +87,22 @@ export function registerMintCommand(parent, testHooks) {
             printResult(result, json);
         }, { json });
     });
+    if (hidden) {
+        mint.hook('preAction', () => {
+            console.error(chalk.gray(`'agents ${parent.name()} mint' is a hidden alias; use \`${MINT_POINTER}\` — still works this release.`));
+        });
+    }
     setHelpSections(mint, {
-        examples: `agents accounts mint claude
-agents accounts mint claude --account ada@example.com
-agents accounts mint claude --account work --email ada@example.com
+        examples: `agents accounts add claude work
+agents accounts login claude#work
 agents accounts mint claude --token-stdin < token.txt
 agents accounts mint claude --code AUTHCODE --json
-agents accounts mint claude --fleet
-agents auth mint claude --account ada@example.com --json`,
-        notes: `Claude is the only harness with an interactive long-lived setup-token (\`claude setup-token\`, ~1 year, shareable across machines). The command drives that flow in a PTY, opens the authorize URL, captures a well-formed sk-ant-oat01- token (refusing the #1767 TTY-banner capture), and seeds:
+agents accounts mint claude --fleet`,
+        notes: `Hidden alias of the worker-credential step that \`agents accounts add <harness> [name]\` (mint during add) and \`agents accounts login <harness>#<name>\` (re-mint) now own. Claude is the only harness with an interactive long-lived setup-token (\`claude setup-token\`, ~1 year, shareable across machines). The command drives that flow in a PTY, opens the authorize URL, captures a well-formed sk-ant-oat01- token (refusing the #1767 TTY-banner capture), and seeds:
   1. a named provider account (policy never) for \`agents run --account\` / \`agents accounts sync\`
   2. the reserved FILE-BASED auth bundle keyed per email, which usage/probe reads
 Native rotating OAuth is never copied. Other harnesses fail loud: device-code login is \`agents fleet login\`; API keys are \`agents accounts add\`.
-Already have a token? \`--token-stdin\` skips the browser dance. \`agents auth mint\` is the same command as \`agents accounts mint\`.`,
+Already have a token? \`--token-stdin\` skips the browser dance. \`agents auth mint\` and \`agents accounts mint\` are the same hidden command.`,
     });
     return mint;
 }

package/dist/commands/auth.js

@@ -105,7 +105,6 @@ export function registerAuthCommand(program) {
     setHelpSections(auth, {
         examples: `agents auth login                         # device-code sign-in via your browser
 agents auth whoami                        # who this machine is signed in as
-agents auth mint claude                   # mint a Claude setup-token into a named account
 agents auth space create "Design Team"    # start a space
 agents auth space invite ada@example.com  # add a teammate
 agents auth logout                        # clear this machine only`,
@@ -113,7 +112,7 @@ agents auth logout                        # clear this machine only`,
 Sign-in is Google-only and opens a Phoenix-branded page; the CLI never sees a password.
 The session lives in this machine's agents state dir, so logging out here signs out nothing else.
 Point at a different backend with PHOENIX_ID_BASE (defaults to the production service).
-\`agents auth mint\` is the harness setup-token mint (same command as \`agents accounts mint\`); it does not sign you into Phoenix ID.`,
+Harness worker credentials are minted by \`agents accounts add <harness> [name]\` / \`agents accounts login <harness>#<name>\`, not by this command.`,
     });
     auth
         .command('login')
@@ -127,7 +126,7 @@ Point at a different backend with PHOENIX_ID_BASE (defaults to the production se
         const json = !!o.json || !!command.optsWithGlobals().json;
         return runOrDie(() => whoami(json), { json });
     });
-    registerMintCommand(auth);
+    registerMintCommand(auth, undefined, { hidden: true });
     auth
         .command('logout')
         .description("Clear this machine's session (no other device is affected)")

package/dist/commands/browser.js

@@ -8,7 +8,7 @@ import { declaringDevices, migrateCentralBrowserProfiles, profileKind } from '..
 import { resolveActor } from '../lib/actor.js';
 import { loginsForProfile, profilesLoggedInto, serviceForUrl, loginsWithAccountsForProfile, accountsForProfile, credKeysForService, AUTH_SIGNATURES, } from '../lib/browser/login-detection.js';
 import { parseSecretRef } from '../lib/browser/secret-ref.js';
-import { readAndResolveBundleEnv, bundleExists, readBundle, describeBundle } from '../lib/secrets/bundles.js';
+import { readAndResolveBundleEnv, bundleExists, readBundle } from '../lib/secrets-client.js';
 import { findBrowserPath, getPortOccupant, getProcessUserDataDir, isLauncherScript, listInstalledBrowsers } from '../lib/browser/chrome.js';
 import { listProfileCacheDirs, removeProfileCache, listAllProfileSnapshots, buildProfilePrunePlan, pruneProfiles, PRUNE_REASON_TEXT, identityLoopbackMismatch, } from '../lib/browser/runtime-state.js';
 import { DEFAULT_VIEWPORT, parseWindowSize, parseWindowPosition } from '../lib/browser/devices.js';
@@ -452,16 +452,16 @@ function registerBrowserUseCommand(browser) {
  * keys exist, '-' when not, or '(unknown)' if the metadata read would prompt or
  * fails — the view must never block on Touch ID.
  */
-function credAvailability(bundleName, service) {
+async function credAvailability(bundleName, service) {
     if (!bundleName)
         return '-';
     const keys = credKeysForService(service);
     if (!keys)
         return '-';
     try {
-        if (!bundleExists(bundleName))
+        if (!(await bundleExists(bundleName)))
             return '-';
-        const present = new Set(describeBundle(readBundle(bundleName)).map((e) => e.key));
+        const present = new Set(Object.keys((await readBundle(bundleName)).vars));
         return present.has(keys.user) && present.has(keys.pass) ? bundleName : '-';
     }
     catch {
@@ -590,7 +590,7 @@ function registerProfilesCommands(browser) {
                 console.log(name.padEnd(20) +
                     r.service.padEnd(12) +
                     (r.username ?? '(unknown)').padEnd(32) +
-                    credAvailability(p.secrets, r.service));
+                    (await credAvailability(p.secrets, r.service)));
                 first = false;
             }
         }
@@ -712,7 +712,7 @@ function registerProfilesCommands(browser) {
         }
         // Warn (don't fail) if the declared secrets bundle doesn't exist yet — it
         // may be created later, but a typo should surface now.
-        if (opts.secrets && !bundleExists(opts.secrets)) {
+        if (opts.secrets && !(await bundleExists(opts.secrets))) {
             console.error(`warning: secrets bundle "${opts.secrets}" does not exist yet. Create it with: agents secrets create ${opts.secrets}`);
         }
     });
@@ -847,7 +847,7 @@ function registerProfilesCommands(browser) {
         else {
             console.log(`Updated ${name} on ${machineId()}: ${result.changed.join(', ')}`);
         }
-        if (patch.secrets && !bundleExists(patch.secrets)) {
+        if (patch.secrets && !(await bundleExists(patch.secrets))) {
             console.error(`warning: secrets bundle "${patch.secrets}" does not exist yet. Create it with: agents secrets create ${patch.secrets}`);
         }
     });
@@ -957,7 +957,7 @@ function registerProfilesCommands(browser) {
         const lines = [];
         for (const service of Object.keys(AUTH_SIGNATURES)) {
             const isActive = active.includes(service);
-            const creds = credAvailability(profile.secrets, service);
+            const creds = await credAvailability(profile.secrets, service);
             if (!isActive && creds === '-')
                 continue; // nothing interesting to show
             const status = isActive
@@ -2661,12 +2661,12 @@ function registerTaskCommands(browser) {
                 console.error(`--secret must be <bundle>/<KEY>, got: ${opts.secret}`);
                 process.exit(1);
             }
-            if (!bundleExists(parsed.bundle)) {
+            if (!(await bundleExists(parsed.bundle))) {
                 console.error(`Secrets bundle "${parsed.bundle}" not found.`);
                 process.exit(1);
             }
             try {
-                const { env } = readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key], keyMode: 'storage', agentOnly: true });
+                const { env } = await readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key], keyMode: 'storage', agentOnly: true });
                 if (!(parsed.key in env)) {
                     console.error(`Key "${parsed.key}" not in bundle "${parsed.bundle}".`);
                     process.exit(1);

package/dist/commands/daemon.d.ts

@@ -2,9 +2,11 @@
  * `agents daemon` — runtime, hosted services, and failure visibility for the
  * always-on daemon (RUSH-2354).
  *
- * The daemon holds the routines scheduler, the secrets broker, the browser IPC
- * server, and the watchdog pass — but until this command group existed it had
- * no user-facing surface: no way to see it, restart it, or turn it off.
+ * The daemon holds the routines scheduler, the browser IPC server, and the
+ * watchdog pass — but until this command group existed it had no user-facing
+ * surface: no way to see it, restart it, or turn it off. The secrets broker
+ * moved out of this daemon entirely with the standalone `secrets` engine
+ * (PHNX-3989 OWN-1); `agents daemon status` only probes its reachability.
  * `daemon.ts` (the runtime) has always implemented every mechanism this file
  * wires up; nothing here is new machinery, only the missing CLI surface.
  *
@@ -16,6 +18,8 @@
  */
 import type { Command } from 'commander';
 import { type DaemonServiceId } from '../lib/daemon-services.js';
+/** Parse a `ps -o etime=` value (`[[dd-]hh:]mm:ss`) into elapsed seconds. */
+export declare function parseEtimeToSeconds(raw: string): number | null;
 /** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
 export declare function uptimeSeconds(pid: number): number | null;
 /** One row of the roster every registered daemon service — supervisor-managed or legacy — renders in `agents daemon services`. */

package/dist/commands/daemon.js

@@ -2,9 +2,11 @@
  * `agents daemon` — runtime, hosted services, and failure visibility for the
  * always-on daemon (RUSH-2354).
  *
- * The daemon holds the routines scheduler, the secrets broker, the browser IPC
- * server, and the watchdog pass — but until this command group existed it had
- * no user-facing surface: no way to see it, restart it, or turn it off.
+ * The daemon holds the routines scheduler, the browser IPC server, and the
+ * watchdog pass — but until this command group existed it had no user-facing
+ * surface: no way to see it, restart it, or turn it off. The secrets broker
+ * moved out of this daemon entirely with the standalone `secrets` engine
+ * (PHNX-3989 OWN-1); `agents daemon status` only probes its reachability.
  * `daemon.ts` (the runtime) has always implemented every mechanism this file
  * wires up; nothing here is new machinery, only the missing CLI surface.
  *
@@ -21,7 +23,7 @@ import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
 import { getDaemonStatus, isDaemonRunning, isDaemonWedged, readDaemonLog, startDaemon, stopDaemon, signalDaemonReload, findSurvivingStateDirDaemons, getDaemonLogPath, isDaemonAutostartCircuitOpen, } from '../lib/daemon/daemon.js';
 import { getConfigValue, setConfigValue, isDaemonEnabled } from '../lib/device-config.js';
-import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_SECRETS_BROKER, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
+import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
 import { DAEMON_SERVICE_IDS, listDaemonServiceStates, setDaemonServiceEnabled, getDaemonServicesConfigPath, queueDaemonServiceRestart, } from '../lib/daemon-services.js';
 import { listJobs, getLatestRun } from '../lib/scheduling/routines.js';
 import { JobScheduler } from '../lib/scheduler.js';
@@ -30,7 +32,6 @@ import { parseDuration } from '../lib/hooks/cache.js';
 import { registerFunnelCommand } from './funnel.js';
 import { DEFAULT_WEBHOOK_PORT, DEFAULT_WEBHOOK_RATE_LIMIT, addHostedReceiver, getDaemonWebhooksConfigPath, hostedReceiverPort, readDaemonWebhooksConfig, removeHostedReceiver, } from '../lib/daemon-webhooks.js';
 import { parseFunnelPort } from '../lib/funnel.js';
-import { parseEtimeToSeconds } from '../lib/secrets/reaper.js';
 /**
  * Provably absent, or null when unknowable.
  *
@@ -256,6 +257,19 @@ function registryScopedDuplicates(processes, ownerPid) {
     const registered = new Set(findSurvivingStateDirDaemons(exclude));
     return processes.filter((p) => registered.has(p.pid));
 }
+/** Parse a `ps -o etime=` value (`[[dd-]hh:]mm:ss`) into elapsed seconds. */
+export function parseEtimeToSeconds(raw) {
+    const m = raw.match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/);
+    if (!m)
+        return null;
+    const days = m[1] ? parseInt(m[1], 10) : 0;
+    const hours = m[2] ? parseInt(m[2], 10) : 0;
+    const mins = parseInt(m[3], 10);
+    const secs = parseInt(m[4], 10);
+    if ([days, hours, mins, secs].some(isNaN))
+        return null;
+    return ((days * 24 + hours) * 60 + mins) * 60 + secs;
+}
 /** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
 export function uptimeSeconds(pid) {
     if (process.platform === 'win32')
@@ -264,7 +278,7 @@ export function uptimeSeconds(pid) {
         // `-o etimes=` is a GNU/procps keyword macOS/BSD `ps` rejects with a
         // non-zero exit (`ps: etimes: keyword not found`), so `agents daemon status`
         // errored out entirely on macOS. `etime` (`[[dd-]hh:]mm:ss`) is the portable
-        // POSIX field; `parseEtimeToSeconds` (shared with the keychain reaper) parses it.
+        // POSIX field; `parseEtimeToSeconds` above parses it.
         const out = execFileSync('ps', ['-o', 'etime=', '-p', String(pid)], { encoding: 'utf-8' }).trim();
         return parseEtimeToSeconds(out);
     }
@@ -281,18 +295,18 @@ function humanDuration(seconds) {
         return `${Math.round(seconds / 3600)}h`;
     return `${Math.round(seconds / 86400)}d`;
 }
+/** Reachability probe only — the daemon does not host, supervise, or take over the broker (OWN-1). */
 async function probeSecretsBroker() {
-    const record = readSubsystemHealth(SUBSYSTEM_SECRETS_BROKER);
     try {
-        const { agentPing, agentStatus, secretsBrokerSocketPath } = await import('../lib/secrets/agent.js');
+        const { agentPing, agentStatus } = await import('../lib/secrets-client.js');
         const ping = await agentPing();
         if (!ping.reachable)
-            return { reachable: false, socketPath: secretsBrokerSocketPath(), heldBundles: null, record };
+            return { reachable: false, socketPath: null, heldBundles: null, record: null };
         const entries = await agentStatus();
-        return { reachable: true, socketPath: secretsBrokerSocketPath(), heldBundles: entries.length, record };
+        return { reachable: true, socketPath: null, heldBundles: entries.length, record: null };
     }
     catch {
-        return { reachable: false, socketPath: null, heldBundles: null, record };
+        return { reachable: false, socketPath: null, heldBundles: null, record: null };
     }
 }
 async function probeBrowserIPC() {
@@ -732,8 +746,8 @@ function registerWebhooksSubcommand(parent) {
         notes: `
       The bundle must hold GITHUB_WEBHOOK_SECRET and/or LINEAR_WEBHOOK_SECRET
       ('agents secrets add <bundle> LINEAR_WEBHOOK_SECRET'). The daemon reads it
-      through the secrets broker, so a hosted receiver needs no
-      AGENTS_SECRETS_PASSPHRASE and no nohup. A LOCKED bundle fails that receiver
+      headlessly through the standalone 'secrets' CLI, so a hosted receiver needs
+      no AGENTS_SECRETS_PASSPHRASE and no nohup. A LOCKED bundle fails that receiver
       loud in 'agents daemon logs' rather than binding unverified ingress.
 
       Port is the identity: a second 'add' on the same port edits that receiver.
@@ -831,7 +845,7 @@ function runWebhooksList(json) {
 export function registerDaemonCommand(program) {
     const cmd = program
         .command('daemon')
-        .description('The always-on daemon: secrets broker, browser IPC, watchdog, and the routines scheduler. Bare `agents daemon` shows status.')
+        .description('The always-on daemon: browser IPC, watchdog, and the routines scheduler. Bare `agents daemon` shows status.')
         .option('--json', 'Emit as JSON')
         .action(async (opts, command) => {
         await runStatus({ json: command.optsWithGlobals().json === true });
@@ -860,12 +874,12 @@ export function registerDaemonCommand(program) {
       agents daemon services
 
       # Toggle or restart a service live — applies without a daemon restart
-      # for supervisor-managed services (secrets-broker, browser-ipc,
-      # account-state, session-index, monitors' off-transition, watchdog,
-      # device-probe, self-heal, keychain-reap, state-dir-check)
-      agents daemon services disable secrets-broker
-      agents daemon services enable secrets-broker
-      agents daemon services restart secrets-broker
+      # for supervisor-managed services (browser-ipc, account-state,
+      # session-index, monitors' off-transition, watchdog, device-probe,
+      # self-heal, state-dir-check)
+      agents daemon services disable browser-ipc
+      agents daemon services enable browser-ipc
+      agents daemon services restart browser-ipc
 
       # Host a signed webhook receiver here, supervised and restarted on crash
       agents daemon webhooks add --secrets-bundle linear-webhook
@@ -1006,17 +1020,18 @@ export function registerDaemonCommand(program) {
       agents daemon services
 
       # Machine-readable — additive: also carries the pre-existing
-      # secretsBroker/browserIpc hosted-socket fields
+      # secretsBroker (reachability-only probe, PHNX-3989)/browserIpc
+      # hosted-socket fields
       agents daemon services --json
 
       # Just the enable/disable metadata, no health probe
       agents daemon services list
 
       # Toggle or restart live — no daemon restart for a supervisor-managed
-      # service (secrets-broker, browser-ipc, account-state, session-index)
-      agents daemon services disable secrets-broker
-      agents daemon services enable secrets-broker
-      agents daemon services restart secrets-broker
+      # service (browser-ipc, account-state, session-index)
+      agents daemon services disable browser-ipc
+      agents daemon services enable browser-ipc
+      agents daemon services restart browser-ipc
     `,
         notes: `
       A service disabled at daemon boot is normally not registered on the

package/dist/commands/doctor.js

@@ -24,7 +24,7 @@ import { resolveAgentTargets, AgentSpecError } from '../lib/agent-spec/index.js'
 import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { diffVersionResources, DOCTOR_ALL_KINDS, } from '../lib/doctor-diff.js';
 import { inspectDuplicateVersionHooks } from '../lib/hooks/install.js';
-import { inspectReservedAuthBundle } from '../lib/secrets/bundles.js';
+import { inspectReservedAuthBundle } from '../lib/secrets-policy.js';
 import { isVersionIsolated } from '../lib/installations/versions.js';
 import { computeDrift, checkSyncStatus, countOrphans, computeSourceBehind } from '../lib/drift.js';
 import { readAuthHealthCache, summarizeHostAuth } from '../lib/auth-health.js';
@@ -35,13 +35,39 @@ import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
 import { auditWindowsSshEnrollment, diagnoseWindowsSshFailure } from '../lib/devices/windows-ssh-enrollment.js';
-import { scanUserRcFiles, masterPassphraseInEnv } from '../lib/secrets/rc-hygiene.js';
+import { scanUserRcFilesSync, masterPassphraseInEnvSync, isSecretsTransportError, } from '../lib/secrets-client.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
 import { detectAgentsBinaryShadows } from '../lib/binary-shadow.js';
 import * as fs from 'fs';
 const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
 // ─── overview mode (no target) ────────────────────────────────────────────────
+// doctor is the umbrella diagnostic and must never crash on one subsystem
+// (§Diagnostic command taxonomy). The standalone secrets CLI being absent from
+// PATH is a routine, expected state on a box that hasn't installed it — not a
+// reason to abort the whole report — so these two checks degrade to "nothing to
+// report" on a transport error and let every other finding still print. A data
+// error the standalone actually answered with must still surface.
+function scanUserRcFiles() {
+    try {
+        return scanUserRcFilesSync();
+    }
+    catch (error) {
+        if (isSecretsTransportError(error))
+            return [];
+        throw error;
+    }
+}
+function masterPassphraseInEnv() {
+    try {
+        return masterPassphraseInEnvSync();
+    }
+    catch (error) {
+        if (isSecretsTransportError(error))
+            return false;
+        throw error;
+    }
+}
 function collapseWhitespace(s) {
     return s.replace(/\s+/g, ' ').trim();
 }

package/dist/commands/exec.js

@@ -843,6 +843,23 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             console.error(chalk.red(`Invalid account picker target: ${agentSpec}. Use agents run <agent>@.`));
             process.exit(1);
         }
+        // Peel `#name` off before --device dispatch so the selector rides the hop
+        // unchanged and the peer resolves ITS slot (PHNX-3940 T5). The later local
+        // parse is idempotent when the values match.
+        {
+            const labelParts = normalizedAgentSpec.split('#');
+            if (labelParts.length > 2 || labelParts[1] === '') {
+                console.error(chalk.red(`Invalid account label in '${normalizedAgentSpec}'.`));
+                process.exit(1);
+            }
+            const specAccountLabel = labelParts[1];
+            if (specAccountLabel && options.account && specAccountLabel !== options.account) {
+                console.error(chalk.red(`Account '${specAccountLabel}' from the agent spec conflicts with --account '${options.account}'.`));
+                process.exit(1);
+            }
+            if (specAccountLabel)
+                options.account = specAccountLabel;
+        }
         // Hard-deprecated harnesses cannot be run — point the user at the successor.
         const runBaseAgentName = normalizedAgentSpec.split('#')[0].split('@')[0];
         const runBaseAgentId = resolveAgentName(runBaseAgentName);
@@ -1130,11 +1147,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             // with an actionable hint instead of hard-failing the run (F5).
             if (netMode === 'tailscale') {
                 const { pickTailscaleBundleFromList } = await import('../lib/crabbox/cli.js');
-                const { listBundles } = await import('../lib/secrets/bundles.js');
+                const { listBundles } = await import('../lib/secrets-client.js');
                 let hasKey = !!process.env.CRABBOX_TAILSCALE_AUTH_KEY;
                 if (!hasKey) {
                     try {
-                        hasKey = !!pickTailscaleBundleFromList(listBundles());
+                        hasKey = !!pickTailscaleBundleFromList(await listBundles());
                     }
                     catch {
                         hasKey = false;
@@ -1800,12 +1817,16 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             }
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, readProfile, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, formatNoVerifiedUsageError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, readProfile, resolveProfileForRun }, 
+        // Engine DATA ops resolve through the standalone `secrets` process client
+        // (PHNX-3989); the agents-owned `bundle@host` policy helpers stay in agents-cli.
+        { readAndResolveBundleEnv, describeBundle, remoteResolveEnv }, { assertRemoteBundleFlagsUnsupported, splitBundleRef, resolveSecretsContextForRun }, { resolveHostSshTarget }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, formatNoVerifiedUsageError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
-            import('../lib/secrets/bundles.js'),
-            import('../lib/secrets/remote.js'),
+            import('../lib/secrets-client.js'),
+            import('../lib/secrets-policy.js'),
+            import('../lib/hosts/credential-transport.js'),
             import('../lib/accounting/rotate.js'),
             import('../lib/installations/versions.js'),
             import('../lib/plugins/plugins.js'),
@@ -1844,6 +1865,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         let profileEnv;
         let accountEnv;
         let accountConfigVersion;
+        let execHome;
         let profileProvider;
         let fromProfile = false;
         let profileName;
@@ -2169,6 +2191,10 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 if (!selected)
                     return;
                 version = selected.version;
+                if (selected.nativeAccount)
+                    options.account = selected.nativeAccount;
+                if (selected.slotDir)
+                    execHome = selected.slotDir;
                 if (!options.quiet) {
                     const identity = selected.accountLabel || 'signed-in account';
                     process.stderr.write(chalk.gray(`[agents] selected ${identity} · ${agent}@${selected.version} for this run\n`));
@@ -2204,35 +2230,49 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 process.exit(1);
             }
             if (spawnAccount.kind === 'native') {
-                // A native login is owned by the harness and read from its own home —
-                // it cannot be forwarded to another machine, and no secret/env is
-                // injected. Fail closed for a remote target.
+                // `#name` / `--account` on a --device run is forwarded unchanged at
+                // dispatch time; the peer resolves ITS slot. This block is local-only.
                 const remoteTarget = options.host || options.device;
-                if (remoteTarget) {
-                    console.error(chalk.red(`Account '${spawnAccount.name}' is a device-local ${spawnAccount.agent} login and cannot be forwarded to '${remoteTarget}'. Sign in on that device and name the login there.`));
-                    process.exit(1);
-                }
-                const { CONFIG_ENV_ISOLATED_AGENTS } = await import('../lib/installations/shims.js');
-                if (!CONFIG_ENV_ISOLATED_AGENTS.includes(agent)) {
-                    console.error(chalk.red(`${agent} cannot select native accounts independently of its installed version.`));
-                    process.exit(1);
-                }
-                const { resolveAccountVersion } = await import('../lib/accounting/rotate.js');
-                const { nativeAccountHome } = await import('../lib/account-registry.js');
-                const { readMeta } = await import('../lib/state.js');
-                accountConfigVersion = await resolveAccountVersion(agent, spawnAccount.identityKey, nativeAccountHome(spawnAccount.id, readMeta())) ?? undefined;
-                if (!accountConfigVersion) {
-                    console.error(chalk.red(`No installed ${spawnAccount.agent} version is signed in as the identity labeled '${spawnAccount.name}'. Sign in as that identity, or label a different account.`));
-                    process.exit(1);
+                if (!remoteTarget) {
+                    const { adoptedConfigPointsAtHome, adoptedSymlinkMismatchError, isSymlinkAdoptedHarness, resolveNativeSpawnHome, symlinkAdoptedAccountError, } = await import('../lib/exec-account-home.js');
+                    const { readMeta } = await import('../lib/state.js');
+                    const meta = readMeta();
+                    if (isSymlinkAdoptedHarness(agent)) {
+                        const defaultName = meta.accounts?.defaults?.[agent];
+                        if (spawnAccount.name !== defaultName) {
+                            console.error(chalk.red(symlinkAdoptedAccountError(agent, spawnAccount.name, defaultName)));
+                            process.exit(1);
+                        }
+                    }
+                    try {
+                        const resolved = await resolveNativeSpawnHome(agent, spawnAccount, meta);
+                        if (isSymlinkAdoptedHarness(agent) && !adoptedConfigPointsAtHome(agent, resolved.execHome)) {
+                            console.error(chalk.red(adoptedSymlinkMismatchError(agent, spawnAccount.name, resolved.execHome)));
+                            process.exit(1);
+                        }
+                        execHome = resolved.execHome;
+                        if (resolved.source === 'legacy-home') {
+                            accountConfigVersion = resolved.label;
+                            // A leftover version-labeled home is both the spawn HOME and
+                            // the account's installation — the pre-T5 `resolveAccountVersion`
+                            // behavior. An explicit `@<label>` still controls the binary.
+                            if (!version && !fromProfile && resolved.label)
+                                version = resolved.label;
+                        }
+                    }
+                    catch (err) {
+                        console.error(chalk.red(err.message));
+                        process.exit(1);
+                    }
+                    // Slot / provisioned: binary comes from the one managed install unless `@<label>` pins it.
+                    if (!version && !fromProfile) {
+                        const { ensureHarnessInstallation } = await import('../lib/installations/store.js');
+                        const { installation } = await ensureHarnessInstallation(agent);
+                        version = installation.label;
+                    }
+                    if (!options.quiet)
+                        process.stderr.write(chalk.gray(`[agents] account '${spawnAccount.name}' · ${agent}\n`));
                 }
-                // An account-only run executes the account's own stable installation.
-                // This keeps its model/mode configuration and binary update policy
-                // together. An explicit installation or profile still controls the
-                // executable independently; configVersion continues to select auth.
-                if (!version && !fromProfile)
-                    version = accountConfigVersion;
-                if (!options.quiet)
-                    process.stderr.write(chalk.gray(`[agents] account '${spawnAccount.name}' · ${agent}\n`));
             }
             else {
                 accountEnv = spawnAccount.env;
@@ -2713,10 +2753,12 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                         authedViaSetupToken = resolveClaudeSetupToken(getVersionHomePath('claude', version)) !== null;
                     }
                     if (!info.signedIn && !authedViaSetupToken) {
-                        const { connectSupported } = await import('../lib/accounts/connect.js');
-                        const hint = connectSupported(agent)
-                            ? `agents accounts connect ${agent}${spawnAccount?.kind === 'native' ? ` ${spawnAccount.name}` : ''}`
-                            : loginHint(agent);
+                        const { addSupported } = await import('../lib/accounts/add.js');
+                        const hint = spawnAccount?.kind === 'native'
+                            ? `agents accounts login ${agent}#${spawnAccount.name}`
+                            : addSupported(agent)
+                                ? `agents accounts add ${agent} <name>`
+                                : loginHint(agent);
                         process.stderr.write(chalk.yellow(`${agent} looks logged out — sign in with: ${hint}. Launching anyway...\n`));
                     }
                 }
@@ -2805,6 +2847,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             ? options.secretsKeys.split(',').map((k) => k.trim()).filter(Boolean)
             : undefined;
         let secretsEnv = {};
+        // Resource-profile scoping (CTX-1): agents-cli computes which bundle
+        // names the active profile allows and forwards it as the client's
+        // `allowedBundles` on every local resolution — the standalone has no
+        // concept of a profile. undefined (no active profile) is full trust.
+        const secretsContext = await resolveSecretsContextForRun(agent);
         for (const bundleRef of options.secrets) {
             try {
                 const { bundle: bundleName, host } = splitBundleRef(bundleRef);
@@ -2822,7 +2869,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     secretsEnv = { ...secretsEnv, ...bundleEnv };
                 }
                 else {
-                    const { bundle, env: bundleEnv } = readAndResolveBundleEnv(bundleName, {
+                    const { bundle, env: bundleEnv } = await readAndResolveBundleEnv(bundleName, {
                         caller: `agent ${agent}`,
                         agent,
                         keys: secretsKeysSubset,
@@ -2834,8 +2881,8 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                         // isHeadlessSecretsContext() left `--interactive` launches (the watchdog's
                         // `agents run auto --interactive`) able to prompt, piling up helper sheets.
                         agentOnly: true,
-                    });
-                    const entries = describeBundle(bundle);
+                    }, secretsContext);
+                    const entries = await describeBundle(bundle, secretsContext);
                     const counts = {};
                     for (const e of entries) {
                         counts[e.kind] = (counts[e.kind] || 0) + 1;
@@ -2881,6 +2928,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             harnessName: profileName,
             version,
             configVersion: accountConfigVersion,
+            execHome,
             prompt,
             interactive: options.interactive || forceInteractive,
             mode: requestedMode,