@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/lib/auth-mint.js

@@ -1,26 +1,29 @@
 import { resolveAgentName } from './agents.js';
-import { AUTH_BUNDLE, claudeAccountTokenKey, isValidClaudeSetupToken, readClaudeAccountEmail, } from './claude-account-token.js';
+import { AUTH_BUNDLE, claudeAccountTokenKey, isValidClaudeSetupToken, readClaudeAccountEmail, invalidateClaudeSetupTokenCache, } from './claude-account-token.js';
 import { addAccount, findAccount, readAccountRegistry, setAccountSecret } from './account-registry.js';
-import { bundleBackend, bundleExists, keychainRef, readBundle, rotateBundleSecret, writeBundleWithItems, } from './secrets/bundles.js';
-import { secretsKeychainItem } from './secrets/index.js';
+import { bundleBackendSync, bundleExists, bundleExistsSync, keychainRef, pushBundleToHost, readBundleSync, rotateBundleSecretSync, secretsKeychainItem, storeSetSync, writeBundleWithItemsSync, } from './secrets-client.js';
+import { assertStorableCredentialKind, reservedStoreName, } from './secrets-policy.js';
 import { getBinaryPath, getGlobalDefault, getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 import { shellQuote } from './ssh-exec.js';
 import { defaultPtyDriver, } from './fleet/remote-login.js';
 import { showUrl } from './open-url.js';
 import { loadDevices } from './devices/registry.js';
 import { isSelfHost } from './devices/self-host.js';
-import { pushBundleToHost } from './secrets/push.js';
-import { assertCredentialTransportHostPinned, resolveHostSshTarget } from './secrets/remote.js';
+import { assertCredentialTransportHostPinned, resolveHostSshTarget } from './hosts/credential-transport.js';
 import { resolveRemoteOsSync } from './hosts/remote-os.js';
 /** Well-formed Claude setup-token as it appears inside a TTY blob. */
 export const CLAUDE_SETUP_TOKEN_CAPTURE_RE = /sk-ant-oat01-[A-Za-z0-9_-]+/;
 const ACCOUNT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /**
- * Harnesses that expose an interactive setup-token mint. Native device-code
- * login (codex/droid/kimi/grok) stays on `agents fleet login`; API keys stay
- * on `agents accounts add`. Adding a harness here without a real mint command
- * is a lying table — do not.
+ * Durable-credential flows per harness. Only Claude exposes an interactive
+ * setup-token MINT; every other harness's durable credential is a provider API
+ * key, COLLECTED via `--api-key` or a prompt by `accounts add` (never derived
+ * from OAuth). The api-key entries describe collection only — they have no
+ * mint argv, and `mintAndSeed` refuses them with the `accounts add` pointer.
+ * Native device-code login (kimi/antigravity) stays on `agents fleet login`.
+ * The apiKeyEnv values are pinned to HARNESS_AUTH's `api-key:<ENV>` worker
+ * kinds by auth-mint.test.ts — keep them in lockstep.
  */
 export const MINT_FLOWS = {
     claude: {
@@ -32,9 +35,15 @@ export const MINT_FLOWS = {
         verificationUrlRegex: /(https:\/\/[^\s"'<>]+)/i,
         tokenCapture: CLAUDE_SETUP_TOKEN_CAPTURE_RE,
     },
+    codex: { harness: 'codex', provider: 'openai', auth: 'api-key', mintArgs: null, apiKeyEnv: 'OPENAI_API_KEY' },
+    grok: { harness: 'grok', provider: 'xai', auth: 'api-key', mintArgs: null, apiKeyEnv: 'XAI_API_KEY' },
+    opencode: { harness: 'opencode', provider: 'opencode', auth: 'api-key', mintArgs: null, apiKeyEnv: 'OPENCODE_API_KEY' },
+    cursor: { harness: 'cursor', provider: 'cursor', auth: 'api-key', mintArgs: null, apiKeyEnv: 'CURSOR_API_KEY' },
+    droid: { harness: 'droid', provider: 'factory', auth: 'api-key', mintArgs: null, apiKeyEnv: 'FACTORY_API_KEY' },
 };
+/** Harnesses with an interactive setup-token mint (api-key flows are collection, not mint). */
 export function listMintableHarnesses() {
-    return Object.keys(MINT_FLOWS);
+    return Object.values(MINT_FLOWS).filter((f) => f.auth === 'setup-token').map((f) => f.harness);
 }
 export function getMintFlow(harnessRaw) {
     const harness = resolveAgentName(harnessRaw);
@@ -42,8 +51,12 @@ export function getMintFlow(harnessRaw) {
         throw new Error(`Unknown harness '${harnessRaw}'. Interactive setup-token mint is implemented for: ${listMintableHarnesses().join(', ')}.`);
     }
     const flow = MINT_FLOWS[harness];
-    if (flow)
+    if (flow?.auth === 'setup-token')
         return flow;
+    if (flow) {
+        throw new Error(`'${harness}' has no derivable token — its durable credential is an API key (${flow.apiKeyEnv}). `
+            + `Collect it with: agents accounts add ${harness} <name> --api-key <key>.`);
+    }
     throw new Error(unmintableMessage(harness));
 }
 export function unmintableMessage(harness) {
@@ -76,6 +89,8 @@ export function extractClaudeSetupToken(screen) {
 }
 /** First https URL on the screen, trailing punctuation stripped. */
 export function extractMintUrl(screen, flow) {
+    if (!flow.verificationUrlRegex)
+        return undefined;
     const text = stripAnsi(screen);
     const m = text.match(flow.verificationUrlRegex);
     if (!m)
@@ -154,14 +169,15 @@ export function resolveMintIdentity(input) {
 export function seedReservedAuthToken(email, token) {
     const cleaned = assertValidSetupToken(token);
     const key = claudeAccountTokenKey(email);
-    if (bundleExists(AUTH_BUNDLE)) {
-        const backend = bundleBackend(AUTH_BUNDLE);
+    if (bundleExistsSync(AUTH_BUNDLE)) {
+        const backend = bundleBackendSync(AUTH_BUNDLE);
         if (backend !== 'file') {
             throw new Error(`Reserved bundle '${AUTH_BUNDLE}' exists with backend '${backend}', but usage/probe only reads a FILE-backed auth bundle. Recreate it with: agents secrets create ${AUTH_BUNDLE} --backend file --policy never --i-understand --force`);
         }
-        const bundle = readBundle(AUTH_BUNDLE);
+        const bundle = readBundleSync(AUTH_BUNDLE);
         if (key in bundle.vars) {
-            rotateBundleSecret(bundle, key, { newValue: cleaned, meta: { type: 'token' } });
+            rotateBundleSecretSync(bundle, key, { newValue: cleaned, meta: { type: 'token' } });
+            invalidateClaudeSetupTokenCache();
             return { key };
         }
         const item = secretsKeychainItem(AUTH_BUNDLE, key);
@@ -169,7 +185,8 @@ export function seedReservedAuthToken(email, token) {
         if (!bundle.meta)
             bundle.meta = {};
         bundle.meta[key] = { type: 'token' };
-        writeBundleWithItems(bundle, new Map([[item, cleaned]]));
+        writeBundleWithItemsSync(bundle, new Map([[item, cleaned]]));
+        invalidateClaudeSetupTokenCache();
         return { key };
     }
     const item = secretsKeychainItem(AUTH_BUNDLE, key);
@@ -181,9 +198,59 @@ export function seedReservedAuthToken(email, token) {
         vars: { [key]: keychainRef(key) },
         meta: { [key]: { type: 'token' } },
     };
-    writeBundleWithItems(bundle, new Map([[item, cleaned]]));
+    writeBundleWithItemsSync(bundle, new Map([[item, cleaned]]));
+    invalidateClaudeSetupTokenCache();
     return { key };
 }
+/**
+ * The env var a harness's durable worker credential injects as on a worker
+ * (claude's setup-token rides CLAUDE_CODE_OAUTH_TOKEN; api-key harnesses ride
+ * their MINT_FLOWS apiKeyEnv). Throws for a harness with no portable worker
+ * credential — kimi/antigravity log in per box.
+ */
+export function workerCredentialEnv(harness) {
+    if (harness === 'claude')
+        return 'CLAUDE_CODE_OAUTH_TOKEN';
+    const flow = MINT_FLOWS[harness];
+    if (flow?.auth === 'api-key' && flow.apiKeyEnv)
+        return flow.apiKeyEnv;
+    throw new Error(`No portable worker credential env for '${harness}' — it logs in per box.`);
+}
+/**
+ * The reserved-store key for one account's worker credential:
+ * `<ENV>_<accountId>` — keyed by account id, never by name or email, so a
+ * rename or an email change never breaks the key. Hyphens are stripped because
+ * the bundle key grammar (`BUNDLE_KEY_PATTERN`) is env-var-shaped.
+ */
+export function workerCredentialStoreKey(harness, accountId) {
+    const slug = accountId.replace(/-/g, '');
+    if (!/^[A-Za-z0-9_]+$/.test(slug) || !slug) {
+        throw new Error(`Invalid account id '${accountId}' for a worker credential key.`);
+    }
+    return `${workerCredentialEnv(harness)}_${slug}`;
+}
+/**
+ * Write (or rotate) one account's worker credential in the reserved
+ * `__<harness>__` store (PHNX-3940). Only non-rotating kinds may enter
+ * (`assertStorableCredentialKind` refuses a rotating OAuth/session credential at
+ * this boundary — RUSH-1958). FILE-backed, policy `never`, same contract as the
+ * legacy `auth` bundle: a keychain- or vault-backed store of this name fails
+ * loud, since worker provisioning reads the file backend.
+ */
+export function seedReservedStoreKey(harness, kind, key, value) {
+    assertStorableCredentialKind(kind, harness);
+    const name = reservedStoreName(harness);
+    const cleaned = value.trim();
+    if (!cleaned)
+        throw new Error(`Empty ${kind} for reserved store '${name}' key ${key}.`);
+    // A `__<harness>__` reserved store is written and read as raw FILE-backed items,
+    // never as a standalone bundle: the standalone's bundle-name validation rejects
+    // the `__`-wrapped reserved name, so the worker credential rides the raw item
+    // directly, symmetric with how `readReservedCredential` reads it. A first write
+    // and a rotation are the same operation — `store.set` overwrites the item value.
+    storeSetSync('file', secretsKeychainItem(name, key), cleaned);
+    return { bundle: name, key };
+}
 /**
  * Create or rotate the named provider account that `agents run --account` and
  * `agents accounts sync` consume. Existing account of a different kind fails
@@ -211,6 +278,9 @@ function emitMintProgress(line, json) {
  * Tears the session down on the way out (success, timeout, or throw).
  */
 export async function driveSetupTokenMint(command, flow, opts = {}) {
+    if (flow.auth !== 'setup-token' || !flow.tokenCapture) {
+        throw new Error(`Harness '${flow.harness}' has no interactive mint command.`);
+    }
     const driver = opts.driver ?? defaultPtyDriver();
     const initialDelayMs = opts.drive?.initialDelayMs ?? 1500;
     const pollMs = opts.drive?.pollMs ?? 500;
@@ -274,12 +344,16 @@ export async function driveSetupTokenMint(command, flow, opts = {}) {
         await driver.stop(id).catch(() => { });
     }
 }
-export function buildMintCommand(flow, bin, home) {
-    if (!flow.mintArgs) {
+export function buildMintCommand(flow, bin, home, env = {}) {
+    if (flow.auth !== 'setup-token' || !flow.mintArgs) {
         throw new Error(`Harness '${flow.harness}' has no interactive mint command.`);
     }
     const args = flow.mintArgs.map(shellQuote).join(' ');
-    return `HOME=${shellQuote(home)} ${shellQuote(bin)} ${args}`;
+    const envPrefix = [
+        `HOME=${shellQuote(home)}`,
+        ...Object.entries(env).map(([k, v]) => `${k}=${shellQuote(v)}`),
+    ].join(' ');
+    return `${envPrefix} ${shellQuote(bin)} ${args}`;
 }
 export function resolveMintInstallation(harness) {
     const installed = listInstalledVersions(harness);
@@ -382,7 +456,7 @@ async function syncMintedBundles(accountName, device) {
         const account = findAccount(accountName);
         if (!account)
             throw new Error(`Unknown provider account '${accountName}'.`);
-        const accountPush = pushBundleToHost(accountName, device, {
+        const accountPush = await pushBundleToHost(accountName, device, {
             remoteBackend,
             force: true,
             operation: 'accounts mint --fleet',
@@ -397,8 +471,8 @@ async function syncMintedBundles(accountName, device) {
         });
         if (!accountPush.ok)
             throw new Error(accountPush.message);
-        if (bundleExists(AUTH_BUNDLE)) {
-            const authPush = pushBundleToHost(AUTH_BUNDLE, device, {
+        if (await bundleExists(AUTH_BUNDLE)) {
+            const authPush = await pushBundleToHost(AUTH_BUNDLE, device, {
                 remoteBackend: 'file',
                 force: true,
                 operation: 'accounts mint --fleet',
@@ -417,32 +491,36 @@ async function syncMintedBundles(accountName, device) {
 /**
  * True when a Claude setup-token is already seeded on this box (setup status).
  *
- * Read-only status probe (`agents setup`, `agents doctor`) — the reserved
- * auth-bundle check below MUST NOT crash the whole command because the
- * keychain could not be reached (e.g. the macOS Keychain helper source is
- * unavailable — PHNX-3385); `bundleExists()`/`hasKeychainToken()` document
- * themselves as failing loud, but that contract is for destructive-write
- * guards, not a diagnostic. An unreachable keychain here just means "cannot
- * confirm the reserved bundle," reported honestly rather than propagated.
+ * Read-only status probe (`agents setup`, `agents doctor`) — neither the
+ * account-registry read nor the reserved auth-bundle check MUST crash the whole
+ * command because the secret store could not be reached (the macOS Keychain
+ * helper source unavailable — PHNX-3385 — or the standalone `secrets` CLI
+ * missing / unspawnable); the client's calls fail loud by contract, but that
+ * contract is for destructive-write guards, not a diagnostic. An unreachable
+ * store here just means "cannot confirm," reported honestly rather than
+ * propagated.
  */
 export function hasMintedSetupToken() {
-    const records = Object.values(readAccountRegistry().accounts);
-    const setup = records.filter((a) => a.auth === 'setup-token' && a.provider === 'anthropic');
-    if (setup.length) {
-        return { ready: true, detail: `${setup.length} Claude setup-token account${setup.length === 1 ? '' : 's'}` };
-    }
     try {
-        if (bundleExists(AUTH_BUNDLE) && bundleBackend(AUTH_BUNDLE) === 'file') {
-            const bundle = readBundle(AUTH_BUNDLE);
+        // The registry is the account bundles behind the standalone `secrets` CLI, so
+        // this read is as reachable — or as unreachable — as the auth-bundle read
+        // below and sits inside the same guard.
+        const records = Object.values(readAccountRegistry().accounts);
+        const setup = records.filter((a) => a.auth === 'setup-token' && a.provider === 'anthropic');
+        if (setup.length) {
+            return { ready: true, detail: `${setup.length} Claude setup-token account${setup.length === 1 ? '' : 's'}` };
+        }
+        if (bundleExistsSync(AUTH_BUNDLE) && bundleBackendSync(AUTH_BUNDLE) === 'file') {
+            const bundle = readBundleSync(AUTH_BUNDLE);
             const keys = Object.keys(bundle.vars).filter((k) => k.startsWith('CLAUDE_CODE_OAUTH_TOKEN_'));
             if (keys.length)
                 return { ready: true, detail: `reserved auth bundle (${keys.length} account key${keys.length === 1 ? '' : 's'})` };
         }
     }
     catch (err) {
-        return { ready: false, detail: `could not check the reserved auth bundle: ${err.message}` };
+        return { ready: false, detail: `could not check the secret store: ${err.message}` };
     }
-    return { ready: false, detail: 'no Claude setup-token minted — agents accounts mint claude' };
+    return { ready: false, detail: 'no Claude setup-token minted — agents accounts add claude [name]' };
 }
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));

package/dist/lib/browser/chrome.d.ts

@@ -49,7 +49,7 @@ export interface LaunchResult {
  * needs them can `agents secrets unlock <bundle>`). Exported so the no-prompt
  * behavior is testable on the real keychain path without spawning a browser.
  */
-export declare function resolveProfileSecretsEnv(secrets?: string): Record<string, string>;
+export declare function resolveProfileSecretsEnv(secrets?: string): Promise<Record<string, string>>;
 export declare function launchBrowser(profileName: string, browserType: BrowserType, port: number, options?: ChromeOptions, secrets?: string, customBinary?: string, isElectron?: boolean): Promise<LaunchResult>;
 export declare function attachToChrome(port: number): Promise<string>;
 export declare function killChrome(pid: number): void;

package/dist/lib/browser/chrome.js

@@ -4,7 +4,7 @@ import * as path from 'path';
 import * as os from 'os';
 import { getProfileRuntimeDir } from './profiles.js';
 import { discoverBrowserWsUrl, registerPipeTransport } from './cdp.js';
-import { readAndResolveBundleEnv, bundleExists } from '../secrets/bundles.js';
+import { readAndResolveBundleEnv, bundleExists } from '../secrets-client.js';
 import { writeProfileRuntime, readProfileRuntime } from './runtime-state.js';
 // Windows install roots. Resolve from the environment (fall back to the usual
 // defaults) so per-user installs under %LOCALAPPDATA% and 64-bit Program Files
@@ -247,11 +247,11 @@ export function listInstalledBrowsers(platform = os.platform()) {
  * needs them can `agents secrets unlock <bundle>`). Exported so the no-prompt
  * behavior is testable on the real keychain path without spawning a browser.
  */
-export function resolveProfileSecretsEnv(secrets) {
-    if (!secrets || !bundleExists(secrets))
+export async function resolveProfileSecretsEnv(secrets) {
+    if (!secrets || !(await bundleExists(secrets)))
         return {};
     try {
-        const { env } = readAndResolveBundleEnv(secrets, { caller: 'browser profile', agentOnly: true });
+        const { env } = await readAndResolveBundleEnv(secrets, { caller: 'browser profile', agentOnly: true });
         return env;
     }
     catch {
@@ -321,7 +321,7 @@ isElectron = false) {
     ];
     // Profile secrets: agentOnly (SEC-13) — a locked bundle resolves to an empty map
     // (launch proceeds without them), never a Touch ID prompt. See resolveProfileSecretsEnv.
-    const env = { ...process.env, ...resolveProfileSecretsEnv(secrets) };
+    const env = { ...process.env, ...(await resolveProfileSecretsEnv(secrets)) };
     const child = spawn(browserPath, args, {
         detached: true,
         stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'],

package/dist/lib/byok-usage.js

@@ -7,7 +7,7 @@
  * same bar style the native usage system uses, just sourced from the provider
  * API rather than the CLI's own usage tracking.
  */
-import { hasKeychainToken, getKeychainToken } from './secrets/profiles.js';
+import { getKeychainTokenSync, hasKeychainTokenSync } from './secrets-client.js';
 import { renderBar, getUsageColor } from './accounting/usage.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -74,9 +74,9 @@ function resolveByokToken(profile) {
     if (!keychainItem)
         return null;
     try {
-        if (!hasKeychainToken(keychainItem))
+        if (!hasKeychainTokenSync(keychainItem))
             return null;
-        return getKeychainToken(keychainItem);
+        return getKeychainTokenSync(keychainItem);
     }
     catch {
         return null;

package/dist/lib/claude-account-token.d.ts

@@ -1,3 +1,5 @@
+import { ReservedBundleWrongBackendError } from './reserved-stores.js';
+import type { DeviceAccountSlot, NativeAccountRecord } from './types.js';
 /**
  * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
  * setup-tokens. Usage/probe reads authenticate with these instead of Claude
@@ -6,8 +8,11 @@
  * bare key, so one account's token can't be misapplied to another in a
  * multi-account fleet.
  */
-/** Alias of the secrets-layer reserved name so mint/seed shares one source of truth. */
+/** Alias of the reserved-store name so mint/seed shares one source of truth. */
 export declare const AUTH_BUNDLE = "auth";
+export { ReservedBundleWrongBackendError };
+/** Drop every memoized setup-token; called after this process seeds or rotates one. */
+export declare function invalidateClaudeSetupTokenCache(): void;
 /** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
 export declare function isValidClaudeSetupToken(value: string): boolean;
 /** The per-account key an email maps to inside the `auth` bundle. */
@@ -24,8 +29,8 @@ export declare function readClaudeAccountEmail(home?: string): string | null;
 export declare function resolveClaudeSetupToken(home?: string): string | null;
 /**
  * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
- * any version home's `.claude.json`. This is what lets `agents accounts attach`
- * provision a headless worker home that has never had an interactive login: the
+ * any version home's `.claude.json`. This is what lets worker-slot provisioning
+ * seed a headless worker home that has never had an interactive login: the
  * account's non-rotating setup-token is already fleet-synced in the file-based
  * `auth` bundle, keyed by email ({@link claudeAccountTokenKey}), so we can write
  * the home's `.oauth_token` from it without the circular
@@ -47,4 +52,43 @@ export declare function resolveClaudeSetupTokenForEmail(email: string, cacheKey?
  * It never copies a rotating OAuth credential (`.credentials.json`) — the setup-token
  * stays the credential of record.
  */
+/**
+ * Write a Claude worker slot's `.oauth_token` (0600) from a durable setup-token,
+ * the way the pre-slot worker home was provisioned. Refuses a malformed token so
+ * a corrupt bundle entry can never reach the auth header (see {@link SETUP_TOKEN_RE}).
+ * `home` is the slot dir; the claude adapter shim reads `$CLAUDE_CONFIG_DIR/.oauth_token`
+ * where `CLAUDE_CONFIG_DIR` is `<home>/.claude`. Returns the written path.
+ */
+export declare function writeClaudeWorkerOauthToken(home: string, token: string): string;
+/**
+ * Read one non-rotating credential value from a reserved store by its storage
+ * key. Returns null when the bundle or key is absent. Used to materialize a
+ * worker slot from a synced durable credential (setup-token / API key).
+ *
+ * A reserved `__<harness>__` store is file-backed by design (headless, fleet-
+ * shareable) and its item is read directly, symmetric with how it is written —
+ * `readAndResolveBundleEnv`'s name validation does not yet accept a reserved
+ * name on the READ path (a secrets-track seam; see the PR body). A non-reserved
+ * bundle (the legacy `auth` alias, a provider bundle) goes through the normal
+ * resolver so refs/expiry/lease gates still apply.
+ */
+export declare function readReservedCredential(bundle: string, key: string): string | null;
+/**
+ * Materialize a worker slot for a portable account from its synced durable
+ * credential (PHNX-3940 T6 — the generalization of the pre-slot Claude worker-home
+ * provisioning). Creates the HOME-shaped slot dir (T1 `ensureSlot`), then, for a
+ * durable harness, writes the credential into it the way the Claude worker home is
+ * provisioned today: for `claude`, the setup-token → `.oauth_token` (0600) + the
+ * seeded identity email (the read-side join in agent-spec then completes the uuids
+ * from the registry row). API-key harnesses need no file — the key is injected at
+ * spawn from the reserved store (T5) — so their slot is created and recorded
+ * `durable` with no write. A per-device harness (`worker: 'none'`) gets a
+ * `per-device` slot and no credential — it logs in per box.
+ *
+ * This is worker-side reconciliation: it runs on the box where the key landed and
+ * NEVER transports anything (the SSH push that delivered the key is the daemon's
+ * job — invariant 1). Fails loud when a durable claude account has no resolvable
+ * token on this device rather than recording a slot that cannot authenticate.
+ */
+export declare function provisionWorkerSlot(account: NativeAccountRecord): DeviceAccountSlot;
 export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;