@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/lib/accounts/slots.js

@@ -0,0 +1,100 @@
+/**
+ * Per-device account slots (PHNX-3940).
+ *
+ * An account is a credential slot, not an installation. The binary lives in
+ * the one managed harness install; each account gets a HOME-shaped dir under
+ * `~/.agents/.history/accounts/<harness>/<accountId>/` with no binary in it.
+ * Native OAuth files stay in this dir on the device that minted them and are
+ * never copied. Settings and resources are projected through the same writers
+ * version homes use (`carryForwardSettings`, `getWriter`) — credentials are
+ * excluded by those writers.
+ *
+ * Slot records live in the device doc (`deviceAccounts.slots`), never central.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { agentConfigDirName } from '../agents.js';
+import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
+import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
+import { carryForwardSettings } from '../settings-manifest.js';
+import { getHistoryDir, updateMeta } from '../state.js';
+import { ALL_RESOURCE_KINDS, getDetector, getWriter, kindToCapability } from '../staleness/registry.js';
+import { supports } from '../capabilities.js';
+import { isAgentId } from '../types.js';
+const AUTH_MODES = ['native', 'durable', 'per-device'];
+export function slotDir(harness, accountId) {
+    if (!isAgentId(harness))
+        throw new Error(`Unknown harness '${harness}' for a slot dir.`);
+    if (!accountId || /[\\/]|\.\./.test(accountId)) {
+        throw new Error(`Invalid account id '${accountId}' for a slot dir.`);
+    }
+    return path.join(getHistoryDir(), 'accounts', harness, accountId);
+}
+export function readSlots(meta) {
+    return { ...(meta.deviceAccounts?.slots ?? {}) };
+}
+export function recordSlot(accountId, slot) {
+    if (slot.accountId !== accountId) {
+        throw new Error(`recordSlot accountId mismatch: key '${accountId}' vs slot.accountId '${slot.accountId}'.`);
+    }
+    if (!AUTH_MODES.includes(slot.authMode)) {
+        throw new Error(`recordSlot: unknown authMode '${slot.authMode}'.`);
+    }
+    updateMeta((current) => ({
+        ...current,
+        deviceAccounts: {
+            ...current.deviceAccounts,
+            slots: { ...current.deviceAccounts?.slots, [accountId]: slot },
+        },
+    }));
+}
+function defaultAuthMode(harness) {
+    return harnessWorkerIsPerDevice(harness) ? 'per-device' : 'native';
+}
+function sourceVersion(harness) {
+    return getGlobalDefault(harness) ?? listInstalledVersions(harness)[0] ?? null;
+}
+function projectResources(harness, version, destHome, fromHome) {
+    const cwd = process.cwd();
+    for (const kind of ALL_RESOURCE_KINDS) {
+        if (!supports(harness, kindToCapability(kind), version).ok)
+            continue;
+        const writer = getWriter(kind, harness);
+        if (!writer)
+            continue;
+        if (kind === 'rules') {
+            writer.write({ version, versionHome: destHome, selection: { preset: 'default' }, cwd });
+            continue;
+        }
+        const names = getDetector(kind, harness)?.list({ version, versionHome: fromHome, cwd }) ?? [];
+        if (names.length === 0)
+            continue;
+        writer.write({ version, versionHome: destHome, selection: names, cwd });
+    }
+}
+/**
+ * Create the HOME-shaped slot dir and project settings/resources from the
+ * managed install. Does not copy credentials (carryForwardSettings excludes
+ * them; resource writers write skills/hooks/commands, never OAuth files).
+ * Does not persist the slot record — call {@link recordSlot} after identity
+ * is captured.
+ */
+export function ensureSlot(harness, accountId) {
+    harnessAuth(harness);
+    const dir = slotDir(harness, accountId);
+    fs.mkdirSync(path.join(dir, agentConfigDirName(harness)), { recursive: true });
+    const version = sourceVersion(harness);
+    if (version) {
+        const fromHome = getVersionHomePath(harness, version);
+        if (fs.existsSync(fromHome)) {
+            carryForwardSettings(harness, fromHome, dir);
+            projectResources(harness, version, dir, fromHome);
+        }
+    }
+    return {
+        accountId,
+        slotDir: dir,
+        authMode: defaultAuthMode(harness),
+        verdict: 'unconfigured',
+    };
+}

package/dist/lib/agent-spec/agents.d.ts

@@ -236,6 +236,22 @@ export declare function supportsAccountInspection(agentId: AgentId): boolean;
 export declare function accountDisplayLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
 /** Return the email address associated with the agent's auth config, or null. */
 export declare function getAccountEmail(agentId: AgentId, home?: string): Promise<string | null>;
+/**
+ * Extract full account information (identity, plan, usage status, credits) from
+ * the agent's local auth/config files. Supports Claude, Codex, and Gemini.
+ */
+/**
+ * Resolve a file-auth agent's credential file. Sign-in is account-global, but
+ * each installed version gets an isolated home; the credential physically lives
+ * only in the home the user logged in under (the one the `~/.<config>` symlink
+ * targets). Check the per-version `base` first, then fall back to the active
+ * config location under the real HOME so every installed version reflects the
+ * true account state (droid/antigravity/kimi all stored login per-version-home
+ * and showed non-active versions as "not signed in"). Returns the first
+ * existing path, or null.
+ */
+/** True when `dir` is under the per-account slot root (`~/.agents/.history/accounts/`). */
+export declare function isAccountSlotDir(dir: string): boolean;
 /** Where an agent's credential file lives, split into the per-version copy and
  *  the active/global copy under the real HOME. */
 export interface CredentialPresence {

package/dist/lib/agent-spec/agents.js

@@ -22,7 +22,8 @@ import { execFileShellSpec } from '../platform/index.js';
 import { latestFileMtimeMs } from '../fs-walk.js';
 import { damerauLevenshtein } from '../fuzzy.js';
 import { probeCapture } from '../probe.js';
-import { getCacheDir, getVersionsDir, getShimsDir, getHistoryDir, getCliVersionCachePath } from '../state.js';
+import { getCacheDir, getVersionsDir, getShimsDir, getHistoryDir, getCliVersionCachePath, readMeta } from '../state.js';
+import { registeredNativeAccountForEmail, parseNativeIdentityKey } from '../native-accounts.js';
 import { resolveVersion, getVersionHomePath, getBinaryPath } from '../installations/versions.js';
 import { supports } from '../capabilities.js';
 import { MCP_TARGETS } from '../mcp-registry.js';
@@ -126,6 +127,12 @@ export function findInPath(command, options = {}) {
                 const stat = fs.statSync(full);
                 if (!stat.isFile())
                     continue;
+                // A shell only runs an executable file; `which` skips a mode-644 namesake and
+                // so must this, or a stray non-executable `secrets`/`claude` file earlier on
+                // PATH would shadow the real binary further down. On win32 the mode bit is
+                // meaningless (PATHEXT decides), so the check is POSIX-only.
+                if (process.platform !== 'win32')
+                    fs.accessSync(full, fs.constants.X_OK);
                 const native = resolveNativeBinaryPath(command, full, options);
                 if (native)
                     return native;
@@ -1384,6 +1391,12 @@ export async function getAccountEmail(agentId, home) {
  * and showed non-active versions as "not signed in"). Returns the first
  * existing path, or null.
  */
+/** True when `dir` is under the per-account slot root (`~/.agents/.history/accounts/`). */
+export function isAccountSlotDir(dir) {
+    const root = path.resolve(getHistoryDir(), 'accounts');
+    const resolved = path.resolve(dir);
+    return resolved === root || resolved.startsWith(root + path.sep);
+}
 function resolveAccountCredentialPath(base, ...segments) {
     const perVersion = path.join(base, ...segments);
     try {
@@ -1391,6 +1404,10 @@ function resolveAccountCredentialPath(base, ...segments) {
             return perVersion;
     }
     catch { /* unreadable */ }
+    // A slot is the account's own HOME (PHNX-3940 T5). Never inherit another
+    // account's adopted ~/.<config> — that is the cross-account leak.
+    if (isAccountSlotDir(base))
+        return null;
     const active = path.join(process.env.AGENTS_REAL_HOME || os.homedir(), ...segments);
     if (active !== perVersion) {
         try {
@@ -1900,13 +1917,30 @@ export function readClaudeHomeConfig(base) {
     const oa = config.oauthAccount;
     if (!oa)
         return null;
-    const accountId = normalizeIdentityPart(oa.accountUuid);
-    const organizationId = normalizeIdentityPart(oa.organizationUuid);
+    const email = normalizeIdentityPart(oa.emailAddress);
+    let accountId = normalizeIdentityPart(oa.accountUuid);
+    let organizationId = normalizeIdentityPart(oa.organizationUuid);
+    // Worker slot provisioned from a durable setup-token: only the email was
+    // seeded on disk (seedClaudeWorkerHomeIdentity), so accountUuid/organizationUuid
+    // are absent and both accountKey and usageKey would be null — the row reads
+    // "not connected here" (PHNX-3940, sibling worker-identity diagnosis). Complete
+    // the identity from the fleet-synced registry row for this email, keyed exactly
+    // as a headed login's home carries it. Guarded on email-only so a headed home
+    // (uuids on disk) never pays the readMeta() read, and fails CLOSED to email-only
+    // when zero or several rows match (registeredNativeAccountForEmail never guesses).
+    if (email && !accountId && !organizationId) {
+        const registered = registeredNativeAccountForEmail(readMeta(), 'claude', email);
+        const parts = registered ? parseNativeIdentityKey('claude', registered.identityKey) : null;
+        if (parts) {
+            accountId = normalizeIdentityPart(parts.account);
+            organizationId = normalizeIdentityPart(parts.org);
+        }
+    }
     return {
         path: activeFile,
         config,
         identity: {
-            email: oa.emailAddress || null,
+            email: email ?? (oa.emailAddress || null),
             accountId,
             organizationId,
             organizationName: oa.organizationName ?? null,

package/dist/lib/app-bundle-install.js

@@ -1,10 +1,11 @@
 /**
  * Atomic, serialized install of a macOS `.app` bundle to a stable user path.
  *
- * Shared by the two helpers agents-cli installs on darwin — the secrets keychain
- * helper (`lib/secrets/install-helper.ts`) and the menu-bar helper
- * (`lib/menubar/install-menubar.ts`) — both of which are (re)installed on the hot
- * path of ordinary `agents` invocations. Both previously did a non-atomic
+ * Used by the menu-bar helper (`lib/menubar/install-menubar.ts`), which is
+ * (re)installed on the hot path of ordinary `agents` invocations. (A second
+ * helper this module used to also serve, the secrets keychain broker, moved
+ * out of this repo entirely with the standalone `secrets` engine —
+ * PHNX-3989 — and installs itself now.) It previously did a non-atomic
  * `rm -rf dest` + `cp -R src dest` straight onto the live bundle. That copy takes
  * long enough that a concurrent reader (Gatekeeper, or an exec of the bundle) sees
  * a half-written `.app` — a truncated Mach-O / mismatched `_CodeSignature` hash —

package/dist/lib/auth-health.d.ts

@@ -24,6 +24,8 @@ export interface AuthHealth {
     detail?: string;
     /** account label for display (email / id), when known. Never part of the key. */
     account?: string;
+    /** Stable registered account id. Display labels are never used as identity. */
+    accountId?: string;
 }
 /** Maximum age of an auth verdict used for automatic routing decisions. */
 export declare const AUTH_PROBE_MAX_AGE_MS: number;
@@ -173,6 +175,7 @@ export interface AuthProbeRow {
     agent: AgentId;
     version: string;
     account?: string;
+    accountId?: string;
     health: AuthHealth;
 }
 /** One installed (agent, version) home, tagged with its resolved account label. */

package/dist/lib/auth-health.js

@@ -255,6 +255,7 @@ export function readFleetAuthRows(host) {
             agent: agent,
             version: identity.slice(separator + 1),
             account: health.account,
+            accountId: health.accountId,
             health,
         });
     }
@@ -422,6 +423,14 @@ export async function probeLocalFleetAuth(opts) {
         inst.info = await getAccountInfo(inst.agent, inst.home).catch(() => null);
         inst.account = authAccountLabel(inst.info);
     }));
+    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
+        import('./state.js'),
+        import('./account-registry.js'),
+    ]);
+    const meta = readMeta();
+    for (const inst of installs) {
+        inst.accountId = findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
+    }
     // Probe once per (agent, account) — but only for the network-probing agents
     // that can actually 429; best-effort agents stay per-install (see
     // groupFleetAuthInstalls). Groups run in parallel: they target distinct
@@ -430,12 +439,14 @@ export async function probeLocalFleetAuth(opts) {
         const rep = group.probe;
         const health = await probeAuthHealth(rep.agent, rep.home, { cliVersion: opts?.cliVersion, info: rep.info, forceLive: opts?.forceLive, signal: opts?.signal });
         health.account = authAccountLabel(rep.info);
+        health.accountId = rep.accountId;
         if (health.verdict === 'unconfigured')
             return [];
         return group.members.map((inst) => ({
             agent: inst.agent,
             version: inst.version,
             account: health.account,
+            accountId: inst.accountId ?? health.accountId,
             // A distinct object per row so a later mutation of one can't bleed across.
             health: { ...health },
         }));

package/dist/lib/auth-mint.d.ts

@@ -15,25 +15,34 @@
  */
 import type { AgentId } from './types.js';
 import { type CredentialAccount } from './account-registry.js';
+import { type StorableCredentialKind } from './secrets-policy.js';
 import { type DriveOptions, type PtyDriver } from './fleet/remote-login.js';
 /** Well-formed Claude setup-token as it appears inside a TTY blob. */
 export declare const CLAUDE_SETUP_TOKEN_CAPTURE_RE: RegExp;
 export interface MintFlow {
     harness: AgentId;
     provider: string;
-    auth: 'setup-token';
-    /** Interactive mint argv after HOME=… <bin>. Null when stdin-seed only. */
+    auth: 'setup-token' | 'api-key';
+    /** Interactive mint argv after HOME=… <bin>. Null when stdin-seed only or an api-key collection flow. */
     mintArgs: string[] | null;
-    verificationUrlRegex: RegExp;
-    tokenCapture: RegExp;
+    /** api-key flows: the env var the collected key injects as on a worker (e.g. OPENAI_API_KEY). */
+    apiKeyEnv?: string;
+    /** setup-token flows: authorize-URL and token patterns scraped from the PTY. */
+    verificationUrlRegex?: RegExp;
+    tokenCapture?: RegExp;
 }
 /**
- * Harnesses that expose an interactive setup-token mint. Native device-code
- * login (codex/droid/kimi/grok) stays on `agents fleet login`; API keys stay
- * on `agents accounts add`. Adding a harness here without a real mint command
- * is a lying table — do not.
+ * Durable-credential flows per harness. Only Claude exposes an interactive
+ * setup-token MINT; every other harness's durable credential is a provider API
+ * key, COLLECTED via `--api-key` or a prompt by `accounts add` (never derived
+ * from OAuth). The api-key entries describe collection only — they have no
+ * mint argv, and `mintAndSeed` refuses them with the `accounts add` pointer.
+ * Native device-code login (kimi/antigravity) stays on `agents fleet login`.
+ * The apiKeyEnv values are pinned to HARNESS_AUTH's `api-key:<ENV>` worker
+ * kinds by auth-mint.test.ts — keep them in lockstep.
  */
 export declare const MINT_FLOWS: Record<string, MintFlow>;
+/** Harnesses with an interactive setup-token mint (api-key flows are collection, not mint). */
 export declare function listMintableHarnesses(): AgentId[];
 export declare function getMintFlow(harnessRaw: string): MintFlow;
 export declare function unmintableMessage(harness: string): string;
@@ -75,6 +84,32 @@ export declare function resolveMintIdentity(input: ResolveMintIdentityInput): Re
 export declare function seedReservedAuthToken(email: string, token: string): {
     key: string;
 };
+/**
+ * The env var a harness's durable worker credential injects as on a worker
+ * (claude's setup-token rides CLAUDE_CODE_OAUTH_TOKEN; api-key harnesses ride
+ * their MINT_FLOWS apiKeyEnv). Throws for a harness with no portable worker
+ * credential — kimi/antigravity log in per box.
+ */
+export declare function workerCredentialEnv(harness: AgentId): string;
+/**
+ * The reserved-store key for one account's worker credential:
+ * `<ENV>_<accountId>` — keyed by account id, never by name or email, so a
+ * rename or an email change never breaks the key. Hyphens are stripped because
+ * the bundle key grammar (`BUNDLE_KEY_PATTERN`) is env-var-shaped.
+ */
+export declare function workerCredentialStoreKey(harness: AgentId, accountId: string): string;
+/**
+ * Write (or rotate) one account's worker credential in the reserved
+ * `__<harness>__` store (PHNX-3940). Only non-rotating kinds may enter
+ * (`assertStorableCredentialKind` refuses a rotating OAuth/session credential at
+ * this boundary — RUSH-1958). FILE-backed, policy `never`, same contract as the
+ * legacy `auth` bundle: a keychain- or vault-backed store of this name fails
+ * loud, since worker provisioning reads the file backend.
+ */
+export declare function seedReservedStoreKey(harness: AgentId, kind: StorableCredentialKind, key: string, value: string): {
+    bundle: string;
+    key: string;
+};
 /**
  * Create or rotate the named provider account that `agents run --account` and
  * `agents accounts sync` consume. Existing account of a different kind fails
@@ -104,7 +139,7 @@ export interface DriveSetupTokenMintOpts extends MintDriveHooks {
  * Tears the session down on the way out (success, timeout, or throw).
  */
 export declare function driveSetupTokenMint(command: string, flow: MintFlow, opts?: DriveSetupTokenMintOpts): Promise<DriveMintResult>;
-export declare function buildMintCommand(flow: MintFlow, bin: string, home: string): string;
+export declare function buildMintCommand(flow: MintFlow, bin: string, home: string, env?: Record<string, string>): string;
 export declare function resolveMintInstallation(harness: AgentId): {
     version: string;
     bin: string;
@@ -146,13 +181,14 @@ export declare function resolveSyncTargets(fleet: boolean, devices: string[]): P
 /**
  * True when a Claude setup-token is already seeded on this box (setup status).
  *
- * Read-only status probe (`agents setup`, `agents doctor`) — the reserved
- * auth-bundle check below MUST NOT crash the whole command because the
- * keychain could not be reached (e.g. the macOS Keychain helper source is
- * unavailable — PHNX-3385); `bundleExists()`/`hasKeychainToken()` document
- * themselves as failing loud, but that contract is for destructive-write
- * guards, not a diagnostic. An unreachable keychain here just means "cannot
- * confirm the reserved bundle," reported honestly rather than propagated.
+ * Read-only status probe (`agents setup`, `agents doctor`) — neither the
+ * account-registry read nor the reserved auth-bundle check MUST crash the whole
+ * command because the secret store could not be reached (the macOS Keychain
+ * helper source unavailable — PHNX-3385 — or the standalone `secrets` CLI
+ * missing / unspawnable); the client's calls fail loud by contract, but that
+ * contract is for destructive-write guards, not a diagnostic. An unreachable
+ * store here just means "cannot confirm," reported honestly rather than
+ * propagated.
  */
 export declare function hasMintedSetupToken(): {
     ready: boolean;