@phnx-labs/agents-cli 1.22.84 → 1.22.85

package/dist/commands/fleet-capture.js

@@ -15,7 +15,7 @@ import * as yaml from 'yaml';
 import { loadDevices } from '../lib/devices/registry.js';
 import { readMeta, updateMeta, getDevicePinsPath } from '../lib/state.js';
 import { machineId } from '../lib/machine-id.js';
-import { listBundles } from '../lib/secrets/bundles.js';
+import { listBundles, SecretsClientError } from '../lib/secrets-client.js';
 import { listJobs } from '../lib/scheduling/routines.js';
 import { captureFleet } from '../lib/fleet/capture.js';
 /** Read THIS machine's pins file into `name -> [id@latest]`. Only used with
@@ -37,6 +37,25 @@ function agentsFromPins(names) {
     const ids = pins?.agents ? Object.keys(pins.agents) : [];
     return ids.length > 0 ? { [self]: ids.map((id) => `${id}@latest`) } : {};
 }
+/**
+ * The names to snapshot into `fleet.secretsBundles` — best-effort. Capture's
+ * primary job (device/agent/routine snapshot) is unrelated to secrets, so a
+ * missing standalone `secrets` install (DIST-1: no fallback engine) degrades
+ * this ONE optional field to empty with a warning rather than failing the
+ * whole capture. A real store error still surfaces.
+ */
+async function captureSecretsBundleNames() {
+    try {
+        return (await listBundles()).map((b) => b.name);
+    }
+    catch (err) {
+        if (err instanceof SecretsClientError && err.code === 'SECRETS_BIN_MISSING') {
+            console.error(chalk.yellow('warning: standalone `secrets` CLI not installed — capturing with no secrets bundles.'));
+            return [];
+        }
+        throw err;
+    }
+}
 async function runCapture(opts) {
     const meta = readMeta();
     // Roster: every registered device name.
@@ -68,7 +87,7 @@ async function runCapture(opts) {
         // Browser profiles are intentionally NOT captured — the central `browser:`
         // block already syncs via the repo, and its ssh:// endpoints can carry
         // `user@host`, which must never be copied into the fleet: block.
-        secretsBundles: listBundles().map((b) => b.name),
+        secretsBundles: await captureSecretsBundleNames(),
         routines: listJobs().map((j) => j.name),
     };
     // Discovery decisions and dismissals are device-scoped now (PHNX-3315): they

package/dist/commands/harness-wizard.js

@@ -29,7 +29,7 @@
 import chalk from 'chalk';
 import { baseUrlEnvKeyForHost, authEnvKeyForHost, modelEnvKeyForHost, validateProfileName, listProfiles, } from '../lib/profiles.js';
 import { listPresets, getPreset } from '../lib/profiles-presets.js';
-import { listBundles } from '../lib/secrets/bundles.js';
+import { listBundles } from '../lib/secrets-client.js';
 import { AGENTS, ALL_AGENT_IDS, isSelfUpdatingAgent, resolveAgentName } from '../lib/agents.js';
 import { readAccountRegistry } from '../lib/account-registry.js';
 /**
@@ -127,7 +127,7 @@ function knownProviders() {
  * is today's behavior, lifted verbatim; RUSH-2220 enriches the bundle browse.
  */
 async function askKeySource(io, draft, provider) {
-    const bundles = listBundles();
+    const bundles = await listBundles();
     const source = bundles.length > 0
         ? await io.select({
             message: `How should '${provider}' get its key?`,

package/dist/commands/lease.js

@@ -11,8 +11,7 @@ import chalk from 'chalk';
 import { showUrl } from '../lib/open-url.js';
 import { crabboxList, crabboxStop, reapSafeOrphans, reapOrphans, setLeaseSecretsBundle } from '../lib/crabbox/cli.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-import { bundleExists, readBundle, writeBundle, keychainRef, bundleItemStore } from '../lib/secrets/bundles.js';
-import { secretsKeychainItem } from '../lib/secrets/index.js';
+import { bundleExists, keychainRef, readBundle, secretsKeychainItem, writeBundleWithItems } from '../lib/secrets-client.js';
 function fmtIdle(box) {
     if (box.lastTouchedAt === null)
         return 'idle ?';
@@ -108,13 +107,11 @@ async function captureTailscaleAuthKey() {
         console.error(chalk.dim('Skipped Tailscale setup — public-IP leases only.'));
         return;
     }
-    const bundle = bundleExists(TAILSCALE_BUNDLE)
-        ? readBundle(TAILSCALE_BUNDLE)
+    const bundle = (await bundleExists(TAILSCALE_BUNDLE))
+        ? await readBundle(TAILSCALE_BUNDLE)
         : { name: TAILSCALE_BUNDLE, description: 'Tailscale ephemeral auth key for crabbox tailnet leases', vars: {} };
-    const store = bundleItemStore(bundle.backend);
-    store.set(secretsKeychainItem(TAILSCALE_BUNDLE, TAILSCALE_KEY), key);
     bundle.vars[TAILSCALE_KEY] = keychainRef(TAILSCALE_KEY);
-    writeBundle(bundle);
+    await writeBundleWithItems(bundle, new Map([[secretsKeychainItem(TAILSCALE_BUNDLE, TAILSCALE_KEY), key]]));
     console.error(chalk.green(`✔ Stored Tailscale auth key in keychain bundle '${TAILSCALE_BUNDLE}'.`));
     console.error(chalk.dim('  Add --tailscale to a lease (reuse defaults to it) to reach the box over your tailnet.'));
 }
@@ -176,13 +173,11 @@ export async function runLeaseSetup(opts = {}) {
             else
                 spinner.succeed('Token valid — Hetzner API reachable.');
             // Store into the `hetzner.com` keychain bundle (mirrors writeSyncBundle).
-            const bundle = bundleExists(HETZNER_BUNDLE)
-                ? readBundle(HETZNER_BUNDLE)
+            const bundle = (await bundleExists(HETZNER_BUNDLE))
+                ? await readBundle(HETZNER_BUNDLE)
                 : { name: HETZNER_BUNDLE, description: 'Hetzner Cloud API token for crabbox leases', vars: {} };
-            const store = bundleItemStore(bundle.backend);
-            store.set(secretsKeychainItem(HETZNER_BUNDLE, HCLOUD_KEY), token);
             bundle.vars[HCLOUD_KEY] = keychainRef(HCLOUD_KEY);
-            writeBundle(bundle);
+            await writeBundleWithItems(bundle, new Map([[secretsKeychainItem(HETZNER_BUNDLE, HCLOUD_KEY), token]]));
             setLeaseSecretsBundle(HETZNER_BUNDLE);
             console.error(chalk.green(`\n✔ Stored in keychain bundle '${HETZNER_BUNDLE}' and set as the default lease provider.`));
             console.error(chalk.dim('  Run `agents run <agent> "…" --lease` — no env var, no flag needed.'));

package/dist/commands/profiles.d.ts

@@ -38,8 +38,8 @@ export interface AddProfileOptions {
  *
  * Reads the bundle value via {@link getKeychainToken} — this pops Touch ID on
  * macOS once, for that bundle-namespaced item (`agents-cli.secrets.*`, gated by
- * `keychainItemRequiresUserPresence` in `../lib/secrets/index.ts`) — then writes
- * it to `keychainItemName(provider)`, a plain `agents-cli.<provider>.token`
+ * the standalone's user-presence rule for `agents-cli.secrets.*` items) — then writes
+ * it to `profileKeychainItem(provider)`, a plain `agents-cli.<provider>.token`
  * item. That item matches neither the `agents-cli.secrets.` nor
  * `agents-cli.bundles.` prefix, so every later read of the harness's own key is
  * silent — no repeat Touch ID prompt.

package/dist/commands/profiles.js

@@ -10,9 +10,7 @@ import chalk from 'chalk';
 import { readStdinSync } from '../lib/format.js';
 import { writeProfile, profileFromPreset, profileFromHostModel, baseUrlEnvKeyForHost, authEnvKeyForHost, validateProfileName, profileExists, } from '../lib/profiles.js';
 import { getPreset, listPresets } from '../lib/profiles-presets.js';
-import { hasKeychainToken, keychainItemName, setKeychainToken, getKeychainToken, } from '../lib/secrets/profiles.js';
-import { parseBundleValue, secretsKeychainItem } from '../lib/secrets/index.js';
-import { readBundle } from '../lib/secrets/bundles.js';
+import { getKeychainToken, hasKeychainToken, isSecretsClientError, parseBundleValue, profileKeychainItem, readBundle, secretsKeychainItem, setKeychainToken, } from '../lib/secrets-client.js';
 import { isInteractiveTerminal } from './utils.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
 import { findAccount } from '../lib/account-registry.js';
@@ -28,7 +26,7 @@ export function buildProfileFromCollection(name, preset, collected, version) {
         env: { ...preset.env, ...collected },
         auth: {
             envVar: preset.authEnvVar,
-            keychainItem: keychainItemName(preset.provider),
+            keychainItem: profileKeychainItem(preset.provider),
         },
         authOptional: preset.authOptional,
         description: preset.description,
@@ -47,8 +45,8 @@ async function promptForSecret(message) {
 /** Read all available data from stdin synchronously, trimmed. */
 /** Ensure a provider API key exists in keychain, prompting or reading stdin if missing. */
 export async function ensureProviderToken(provider, signupUrl, fromStdin) {
-    const item = keychainItemName(provider);
-    if (hasKeychainToken(item)) {
+    const item = profileKeychainItem(provider);
+    if (await hasKeychainToken(item)) {
         return;
     }
     let token;
@@ -62,7 +60,7 @@ export async function ensureProviderToken(provider, signupUrl, fromStdin) {
         const hint = signupUrl ? ` (get one at ${signupUrl})` : '';
         token = await promptForSecret(`Enter API key for ${provider}${hint}`);
     }
-    setKeychainToken(item, token);
+    await setKeychainToken(item, token);
     console.log(chalk.green(`Stored in keychain: ${item}`));
 }
 /**
@@ -72,8 +70,8 @@ export async function ensureProviderToken(provider, signupUrl, fromStdin) {
  *
  * Reads the bundle value via {@link getKeychainToken} — this pops Touch ID on
  * macOS once, for that bundle-namespaced item (`agents-cli.secrets.*`, gated by
- * `keychainItemRequiresUserPresence` in `../lib/secrets/index.ts`) — then writes
- * it to `keychainItemName(provider)`, a plain `agents-cli.<provider>.token`
+ * the standalone's user-presence rule for `agents-cli.secrets.*` items) — then writes
+ * it to `profileKeychainItem(provider)`, a plain `agents-cli.<provider>.token`
  * item. That item matches neither the `agents-cli.secrets.` nor
  * `agents-cli.bundles.` prefix, so every later read of the harness's own key is
  * silent — no repeat Touch ID prompt.
@@ -106,7 +104,16 @@ export async function applyFromSecrets(profile, spec, explicitAuthProvider, opts
     const sep = spec.indexOf(':');
     const bundleName = sep === -1 ? spec : spec.slice(0, sep);
     const requestedKey = sep === -1 ? undefined : spec.slice(sep + 1);
-    const bundle = readBundle(bundleName);
+    let bundle;
+    try {
+        bundle = await readBundle(bundleName);
+    }
+    catch (err) {
+        // The standalone reports only a code; name the bundle the user asked for.
+        if (!isSecretsClientError(err, 'NOT_FOUND'))
+            throw err;
+        throw new Error(`Secrets bundle '${bundleName}' not found. List bundles with 'agents secrets list'.`);
+    }
     const keys = Object.keys(bundle.vars);
     const key = requestedKey ?? (keys.length === 1 ? keys[0] : undefined);
     if (!key) {
@@ -123,7 +130,7 @@ export async function applyFromSecrets(profile, spec, explicitAuthProvider, opts
         value = parsed.literal;
     }
     else if (parsed.ref.provider === 'keychain') {
-        value = getKeychainToken(secretsKeychainItem(bundle.name, parsed.ref.value));
+        value = await getKeychainToken(secretsKeychainItem(bundle.name, parsed.ref.value));
     }
     else {
         throw new Error(`Bundle '${bundleName}' key '${key}' is a '${parsed.ref.provider}:' reference, not a keychain-backed secret — --from-secrets only copies keychain-backed values.`);
@@ -134,8 +141,8 @@ export async function applyFromSecrets(profile, spec, explicitAuthProvider, opts
             `on a fork, so it never silently overwrites the source harness's shared keychain item.`);
     }
     const provider = explicitAuthProvider || (profile.auth ? profile.provider : undefined) || bundleName;
-    const item = keychainItemName(provider);
-    setKeychainToken(item, value);
+    const item = profileKeychainItem(provider);
+    await setKeychainToken(item, value);
     if (!profile.auth) {
         const envVar = authEnvKeyForHost(profile.host.agent);
         if (!envVar) {

package/dist/commands/repo.js

@@ -64,7 +64,7 @@ async function publishUserRepoAccountState(provisionAuth) {
     if (usage.error)
         console.error(chalk.yellow(`Usage snapshot: ${usage.error}`));
     if (provisionAuth) {
-        const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+        const { syncReservedAuthBundle } = await import('../lib/secrets-policy.js');
         const auth = await syncReservedAuthBundle();
         if (auth.pushed.length > 0)
             console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
@@ -72,7 +72,7 @@ async function publishUserRepoAccountState(provisionAuth) {
             console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
         return;
     }
-    const { publishReservedAuthVerdict } = await import('../lib/secrets/reserved-sync.js');
+    const { publishReservedAuthVerdict } = await import('../lib/secrets-policy.js');
     const auth = await publishReservedAuthVerdict();
     if (auth.error)
         console.error(chalk.yellow(`Auth verdict: ${auth.device}: ${auth.error}`));
@@ -85,7 +85,7 @@ async function consumeUserRepoAccountState() {
         console.log(chalk.gray(`Usage snapshot: merged ${usage.merged} row(s) from ${usage.sources.join(', ')}`));
     for (const err of usage.errors)
         console.error(chalk.yellow(`Usage snapshot: ${err.device}: ${err.message}`));
-    const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+    const { syncReservedAuthBundle } = await import('../lib/secrets-policy.js');
     const auth = await syncReservedAuthBundle();
     if (auth.pushed.length > 0)
         console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));

package/dist/commands/run-account-picker.d.ts

@@ -12,7 +12,7 @@ export interface RunAccountChoice {
      */
     signInRequired: boolean;
 }
-/** One named account row for `agents accounts switch` (reuses this picker's layout). */
+/** One named account row for `agents accounts default` (reuses this picker's layout). */
 export interface SwitchAccountRow {
     accountName: string;
     kind: 'provider' | 'native';
@@ -25,8 +25,8 @@ export declare function formatAccountLimits(candidate: RotateCandidate): string;
 /** Build aligned picker rows with usable accounts first and unsafe rows disabled. */
 export declare function buildRunAccountChoices(candidates: RotateCandidate[], globalDefault: string | null): RunAccountChoice[];
 /**
- * Aligned picker rows for `accounts switch`. Same columns as the run picker
- * (identity, status, limits) but the value is the named account to set-default.
+ * Aligned picker rows for `accounts default`. Same columns as the run picker
+ * (identity, status, limits) but the value is the named account to make default.
  * Rows stay selectable: setting a default is not a launch.
  */
 export declare function buildSwitchAccountChoices(rows: SwitchAccountRow[]): RunAccountChoice[];

package/dist/commands/run-account-picker.js

@@ -4,6 +4,7 @@ import { agentLabel } from '../lib/agents.js';
 import { loginHint } from '../lib/signin-badge.js';
 import { collectRunCandidates, readinessFromCandidate, isSignInRecoverable, } from '../lib/accounting/rotate.js';
 import { compareVersions, getGlobalDefault } from '../lib/installations/versions.js';
+import { verdictLabel } from '../lib/auth-health.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 const CANCEL_SELECTION = '__agents_cancel_account_selection__';
 const WINDOW_ORDER = ['session', 'week', 'sonnet_week', 'month'];
@@ -65,28 +66,28 @@ export function buildRunAccountChoices(candidates, globalDefault) {
         const readiness = readinessFromCandidate(candidate);
         const disabled = disabledReason(candidate, readiness);
         const signInRequired = isSignInRecoverable(readiness);
-        const version = candidate.version === globalDefault
-            ? `${candidate.version} (default)`
-            : candidate.version;
-        // `revoked` is signed-in-but-rejected, so it reads as a re-login rather
-        // than "logged out"; every throttle is still a signed-in account.
-        const authReason = readiness.ready ? null : readiness.reason;
-        const status = authReason === 'revoked'
+        const account = candidate.nativeAccount
+            || candidate.accountLabel
+            || 'account unavailable';
+        const marked = candidate.version === globalDefault && !candidate.nativeAccount
+            ? `${account} (default)`
+            : account;
+        const verdict = !readiness.ready && readiness.reason === 'revoked'
             ? 'needs re-login'
-            : authReason === 'signed_out'
+            : !readiness.ready && readiness.reason === 'signed_out'
                 ? 'logged out'
-                : 'logged in';
+                : candidate.authVerdict
+                    ? verdictLabel(candidate.authVerdict).toLowerCase()
+                    : 'live';
         return {
             candidate,
-            account: candidate.accountLabel || 'account unavailable',
-            version,
-            status,
-            plan: candidate.usageSnapshot?.plan ?? candidate.plan ?? 'plan unavailable',
+            account: marked,
+            verdict,
             // An auth-blocked row shows what picking it DOES; its quota is moot until
             // there is a credential to spend it with.
-            limits: authReason === 'revoked'
+            limits: !readiness.ready && readiness.reason === 'revoked'
                 ? 'launch to re-authenticate'
-                : authReason === 'signed_out'
+                : !readiness.ready && readiness.reason === 'signed_out'
                     ? 'launch to sign in'
                     : formatAccountLimits(candidate),
             disabled,
@@ -107,23 +108,22 @@ export function buildRunAccountChoices(candidates, globalDefault) {
         return compareVersions(b.candidate.version, a.candidate.version);
     });
     const accountWidth = Math.max(0, ...rows.map((row) => row.account.length));
-    const versionWidth = Math.max(0, ...rows.map((row) => row.version.length));
-    const statusWidth = Math.max(0, ...rows.map((row) => row.status.length));
-    const planWidth = Math.max(0, ...rows.map((row) => row.plan.length));
+    const verdictWidth = Math.max(0, ...rows.map((row) => row.verdict.length));
     return rows.map((row) => ({
         name: [
             row.account.padEnd(accountWidth),
-            row.version.padEnd(versionWidth),
-            row.status.padEnd(statusWidth),
-            row.plan.padEnd(planWidth),
+            row.verdict.padEnd(verdictWidth),
             row.limits,
         ].join('  '),
-        value: row.candidate.version,
+        value: row.candidate.nativeAccount ?? row.candidate.version,
         disabled: row.disabled,
         ready: row.ready,
         signInRequired: row.signInRequired,
     }));
 }
+function candidatePickerValue(candidate) {
+    return candidate.nativeAccount ?? candidate.version;
+}
 function switchRowStatus(row) {
     if (!row.candidate) {
         return {
@@ -151,8 +151,8 @@ function switchRowStatus(row) {
     return { status, limits, ready: readiness.ready };
 }
 /**
- * Aligned picker rows for `accounts switch`. Same columns as the run picker
- * (identity, status, limits) but the value is the named account to set-default.
+ * Aligned picker rows for `accounts default`. Same columns as the run picker
+ * (identity, status, limits) but the value is the named account to make default.
  * Rows stay selectable: setting a default is not a launch.
  */
 export function buildSwitchAccountChoices(rows) {
@@ -184,12 +184,11 @@ export function buildSwitchAccountChoices(rows) {
 export async function pickSwitchAccount(agent, rows) {
     if (!isInteractiveTerminal()) {
         requireInteractiveSelection(`Selecting a ${agentLabel(agent)} account`, [
-            `agents accounts switch ${agent} <account>`,
-            `agents accounts set-default ${agent} <account>`,
+            `agents accounts default ${agent} <account>`,
         ]);
     }
     if (rows.length === 0) {
-        throw new Error(`No named accounts for ${agent}. Add one with 'agents accounts add <name> --provider <p>' or 'agents accounts name ${agent}@<version> <name>'.`);
+        throw new Error(`No named accounts for ${agent}. Add one with 'agents accounts add ${agent} [name]'.`);
     }
     const choices = buildSwitchAccountChoices(rows).map(({ ready: _ready, signInRequired: _signInRequired, ...choice }) => choice);
     try {
@@ -292,16 +291,16 @@ export async function pickRunAccountCandidate(agent) {
         });
     }
     try {
-        const version = await select({
+        const picked = await select({
             message: needsSignIn
                 ? `Select a ${agentLabel(agent)} account for this run (pick a logged-out one to sign in):`
                 : `Select a ${agentLabel(agent)} account for this run:`,
             choices: promptChoices,
             loop: false,
         });
-        if (version === CANCEL_SELECTION)
+        if (picked === CANCEL_SELECTION)
             return null;
-        return candidates.find((candidate) => candidate.version === version) ?? null;
+        return candidates.find((candidate) => candidatePickerValue(candidate) === picked) ?? null;
     }
     catch (err) {
         if (isPromptCancelled(err))

package/dist/commands/secrets-passthrough.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `agents secrets` — thin passthrough to the standalone `secrets` CLI
+ * (PHNX-3989, DIST-1). Every bundle/keychain/vault operation now lives in
+ * `@phnx-labs/secrets-cli`, not in this repo; this command re-declares no
+ * subcommand or flag of its own. `agents secrets <anything>` execs the
+ * installed executable with the same argv, `SECRETS_HOME` defaulted to this
+ * box's existing store (`buildServeEnv`, matching the process client's own
+ * default so an interactive `secrets list` and an injected `readBundle` see
+ * the same store), and `SECRETS_SCOPE`/`SECRETS_CONTEXT` passed through
+ * unmodified from the ambient environment — this is the operator's own
+ * terminal, not an injected agent exec, so there is no separate scope to
+ * compute here (that stays in `lib/exec.ts` for the run/inject path).
+ *
+ * A missing executable fails loud with install guidance — no fallback to the
+ * retired in-repo engine (`commands/secrets.ts` and its siblings), which stays
+ * in the tree, unregistered, until every consumer has moved off it (tasks.md
+ * item 7).
+ */
+import type { Command } from 'commander';
+export declare function registerSecretsCommands(program: Command): void;

package/dist/commands/secrets-passthrough.js

@@ -0,0 +1,43 @@
+import chalk from 'chalk';
+import { spawnSync } from 'node:child_process';
+import { buildServeEnv, invocation, resolveSecretsBin, SecretsClientError } from '../lib/secrets-client.js';
+const INSTALL_HINT = 'npm i -g @phnx-labs/secrets-cli';
+export function registerSecretsCommands(program) {
+    program
+        .command('secrets')
+        .description('Named bundles of env variables — passthrough to the standalone `secrets` CLI. Run `agents secrets --help` (or `agents setup secrets`) for the full subcommand list.')
+        .allowUnknownOption()
+        .allowExcessArguments()
+        // Hand `-h`/`--help` through too — the real subcommand help lives in the
+        // installed `secrets` binary, not in this passthrough.
+        .helpOption(false)
+        .action(() => {
+        let bin;
+        try {
+            bin = resolveSecretsBin();
+        }
+        catch (err) {
+            if (err instanceof SecretsClientError && err.code === 'SECRETS_BIN_MISSING') {
+                console.error(chalk.red('The standalone `secrets` CLI is not installed.'));
+                console.error(chalk.gray(`Install it, then re-run this command:`));
+                console.error(chalk.cyan(`  ${INSTALL_HINT}`));
+                process.exit(1);
+            }
+            throw err;
+        }
+        // Everything after the literal `secrets` token on the real argv — the
+        // subcommand + its own flags, verbatim, never re-parsed by commander.
+        const secretsIndex = process.argv.indexOf('secrets');
+        const forwarded = secretsIndex >= 0 ? process.argv.slice(secretsIndex + 1) : [];
+        const { command, prefix } = invocation(bin);
+        const res = spawnSync(command, [...prefix, ...forwarded], {
+            stdio: 'inherit',
+            env: buildServeEnv(),
+        });
+        if (res.error) {
+            console.error(chalk.red(`Failed to run \`secrets\`: ${res.error.message}`));
+            process.exit(1);
+        }
+        process.exit(res.status ?? 1);
+    });
+}

package/dist/commands/setup-accounts.d.ts

@@ -1,7 +1,8 @@
 /**
  * `agents setup accounts` — mint a Claude setup-token so unattended usage/probe
- * is not stuck on "usage pending". Delegates to the same mint engine as
- * `agents accounts mint` / `agents auth mint`.
+ * is not stuck on "usage pending". Delegates to the same mint engine as the
+ * mint step of `agents accounts add claude [name]` /
+ * `agents accounts login claude#<name>`.
  */
 import type { Command } from 'commander';
 export declare function runAccountsSetupWizard(): Promise<void>;

package/dist/commands/setup-accounts.js

@@ -6,13 +6,13 @@ export async function runAccountsSetupWizard() {
     const status = hasMintedSetupToken();
     if (status.ready) {
         console.log(chalk.green(`Setup-token already minted (${status.detail}).`));
-        console.log(chalk.gray('Re-mint with: agents accounts mint claude'));
+        console.log(chalk.gray('Re-mint with: agents accounts login claude#<name>'));
         return;
     }
     if (!isInteractiveTerminal()) {
         console.log(chalk.yellow('No Claude setup-token on this machine.'));
-        console.log(chalk.gray('Mint one with: agents accounts mint claude'));
-        console.log(chalk.gray('Already have a token: agents accounts mint claude --token-stdin'));
+        console.log(chalk.gray('Mint one with: agents accounts add claude [name]'));
+        console.log(chalk.gray('Already have a token: agents accounts add claude [name]'));
         process.exitCode = 1;
         return;
     }
@@ -21,7 +21,7 @@ export async function runAccountsSetupWizard() {
         default: true,
     });
     if (!proceed) {
-        console.log(chalk.gray('Skipped. Run `agents accounts mint claude` when ready.'));
+        console.log(chalk.gray('Skipped. Run `agents accounts add claude [name]` when ready.'));
         return;
     }
     const result = await mintAndSeed({ harness: 'claude' });

package/dist/commands/setup-secrets.d.ts

@@ -1,28 +1,23 @@
 /**
- * `agents setup secrets` — guided defaults for `agents secrets` onboarding.
+ * `agents setup secrets` — install guidance for the standalone `secrets` CLI,
+ * then a pass-through to its own `secrets migrate` onboarding (PHNX-3989).
  *
- * The wizard writes setup preferences and delegates imports to the existing
- * `agents secrets import` command, keeping bundle storage as the source of truth.
+ * The wizard that used to pick a default backend/policy and delegate imports
+ * lived entirely against the in-repo secrets engine. That engine is extracted
+ * to `@phnx-labs/secrets-cli`, which owns its own interactive onboarding
+ * (`secrets migrate`) — agents-cli never rebundles it (DIST-1), so there is no
+ * in-process fallback when it isn't installed: this command names the install
+ * command and stops.
  */
 import type { Command } from 'commander';
-import type { SecretsPolicy } from '../lib/secrets/bundles.js';
-interface SetupSecretsOptions {
-    backend?: string;
-    policy?: string;
-    importFrom?: string;
-    bundle?: string;
-    vault?: string;
-    iUnderstand?: boolean;
-    force?: boolean;
-}
 export declare function setupSecretsPrefsPath(): string;
-/** The wizard's `--policy` shares the canonical parser with `agents secrets
- * policy`, so it accepts `hold` (and the `daily`/`session` aliases) rather than
- * carrying its own copy that knows only the retired vocabulary. `parsePolicyOpt`
- * defaults an absent value to `always`; the wizard's own default is `hold`, so
- * it is supplied here rather than inherited. */
-export declare function parsePolicy(raw: string | undefined): SecretsPolicy;
-export declare function runSecretsSetupWizard(opts?: SetupSecretsOptions): Promise<boolean>;
+/** True when the standalone `secrets` executable resolves ($SECRETS_BIN or PATH). */
+export declare function isSecretsCliInstalled(): boolean;
+/**
+ * Print install guidance when the standalone is missing, else hand off to its
+ * own interactive `secrets migrate`. Returns whether setup is now complete
+ * (installed, and — when it ran — `migrate` exited 0).
+ */
+export declare function runSecretsSetupWizard(): Promise<boolean>;
 /** Register `agents setup secrets` under the parent `setup` command. */
 export declare function registerSetupSecretsCommand(setupCmd: Command): void;
-export {};