@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/lib/workflows.js

@@ -11,8 +11,7 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { capableAgents, supports } from './capabilities.js';
 import { getProjectAgentsDir, getSystemWorkflowsDir, getUserWorkflowsDir, getTrashWorkflowsDir, getEnabledExtraRepos, getPluginsDir, getSystemPluginsDir, getProjectPluginsDir, } from './state.js';
-import { listInstalledVersions, getVersionHomePath } from './installations/versions.js';
-import { dirsContentMatch, normalizeResourceContent } from './resource-content-diff.js';
+import { listInstalledVersions } from './installations/versions.js';
 /**
  * Hard upper bound on items a single `for_each` expands, absent an explicit
  * `max_items`. A guard against a runaway producer spawning unbounded teammates
@@ -798,98 +797,9 @@ export function removeWorkflow(name) {
  * intentionally ignored. (Verified via strace of `agy`: it opens
  * `$HOME/.gemini/config/global_workflows/<name>.md` and never the version home.)
  */
-function antigravityWorkflowsDir() {
+export function antigravityWorkflowsDir() {
     return path.join(process.env.HOME ?? os.homedir(), '.gemini', 'config', 'global_workflows');
 }
-function workflowTargetRoot(agent, versionHome) {
-    if (agent === 'kimi')
-        return path.join(versionHome, '.kimi-code', 'skills');
-    if (agent === 'antigravity')
-        return antigravityWorkflowsDir();
-    if (agent === 'openclaw')
-        return path.join(versionHome, '.openclaw', 'workflows');
-    if (agent === 'grok')
-        return path.join(versionHome, '.grok', 'workflows');
-    return path.join(versionHome, 'workflows');
-}
-/** List workflow names synced into a specific agent version home. */
-export function listWorkflowsForAgent(agent, versionHome) {
-    if (agent === 'kimi') {
-        const skillsDir = workflowTargetRoot(agent, versionHome);
-        if (!fs.existsSync(skillsDir))
-            return [];
-        return fs.readdirSync(skillsDir, { withFileTypes: true })
-            .filter(d => d.isDirectory() && fs.existsSync(path.join(skillsDir, d.name, 'SKILL.md')))
-            .filter(d => kimiWorkflowMarker(path.join(skillsDir, d.name, 'SKILL.md')) === d.name)
-            .map(d => d.name);
-    }
-    if (agent === 'antigravity') {
-        const dir = workflowTargetRoot(agent, versionHome);
-        if (!fs.existsSync(dir))
-            return [];
-        try {
-            return fs.readdirSync(dir, { withFileTypes: true })
-                .filter(d => d.isFile() && d.name.endsWith('.md') && !d.name.startsWith('.'))
-                .map(d => d.name.slice(0, -'.md'.length))
-                .filter(base => antigravityWorkflowMarker(path.join(dir, `${base}.md`)) === base);
-        }
-        catch {
-            return [];
-        }
-    }
-    if (agent === 'goose') {
-        const recipesDir = path.join(versionHome, '.config', 'goose', 'recipes');
-        if (!fs.existsSync(recipesDir))
-            return [];
-        try {
-            return fs.readdirSync(recipesDir, { withFileTypes: true })
-                .filter(d => d.isFile() && d.name.endsWith('.yaml') && !d.name.startsWith('.'))
-                .map(d => d.name.slice(0, -'.yaml'.length));
-        }
-        catch {
-            return [];
-        }
-    }
-    if (agent === 'openclaw') {
-        const dir = workflowTargetRoot(agent, versionHome);
-        if (!fs.existsSync(dir))
-            return [];
-        try {
-            return fs.readdirSync(dir, { withFileTypes: true })
-                .filter(d => d.isFile() && d.name.endsWith('.lobster') && !d.name.startsWith('.'))
-                .map(d => d.name.slice(0, -'.lobster'.length))
-                .filter(base => openclawWorkflowMarker(path.join(dir, `${base}.lobster`)) === base);
-        }
-        catch {
-            return [];
-        }
-    }
-    if (agent === 'grok') {
-        const dir = workflowTargetRoot(agent, versionHome);
-        if (!fs.existsSync(dir))
-            return [];
-        try {
-            return fs.readdirSync(dir, { withFileTypes: true })
-                .filter(d => d.isFile() && d.name.endsWith('.rhai') && !d.name.startsWith('.'))
-                .map(d => d.name.slice(0, -'.rhai'.length))
-                .filter(base => grokWorkflowMarker(path.join(dir, `${base}.rhai`)) === base);
-        }
-        catch {
-            return [];
-        }
-    }
-    const workflowsDir = workflowTargetRoot(agent, versionHome);
-    if (!fs.existsSync(workflowsDir))
-        return [];
-    try {
-        return fs.readdirSync(workflowsDir, { withFileTypes: true })
-            .filter(d => d.isDirectory() && fs.existsSync(path.join(workflowsDir, d.name, 'WORKFLOW.md')))
-            .map(d => d.name);
-    }
-    catch {
-        return [];
-    }
-}
 function parseSubrecipeFrontmatter(filePath) {
     const content = fs.readFileSync(filePath, 'utf-8');
     const lines = content.split('\n');
@@ -913,7 +823,7 @@ function parseSubrecipeFrontmatter(filePath) {
         body: lines.slice(endIndex + 2).join('\n').trim(),
     };
 }
-function selectedWorkflowSubagents(workflowPath, allowedAgents) {
+export function selectedWorkflowSubagents(workflowPath, allowedAgents) {
     const subagentsDir = path.join(workflowPath, 'subagents');
     if (!fs.existsSync(subagentsDir))
         return [];
@@ -924,7 +834,7 @@ function selectedWorkflowSubagents(workflowPath, allowedAgents) {
         .filter(name => !allowed || allowed.has(name))
         .sort();
 }
-function writeGooseSubrecipe(workflowPath, subrecipeName, destDir) {
+export function writeGooseSubrecipe(workflowPath, subrecipeName, destDir) {
     const sourcePath = path.join(workflowPath, 'subagents', `${subrecipeName}.md`);
     const parsed = parseSubrecipeFrontmatter(sourcePath);
     const body = parsed.body || parsed.description || subrecipeName;
@@ -939,12 +849,12 @@ function writeGooseSubrecipe(workflowPath, subrecipeName, destDir) {
     fs.writeFileSync(path.join(destDir, `${subrecipeName}.yaml`), yaml.stringify(recipe), 'utf-8');
 }
 /**
- * Render the main Goose recipe YAML for a workflow — the exact bytes
- * `syncWorkflowToGooseRecipe` writes to `<name>.yaml`. Extracted so the sync
- * writer and the doctor content-drift check (`workflowContentMatches`) render
- * from ONE source and can never disagree. Returns null on invalid frontmatter.
+ * Render the main Goose recipe YAML for a workflow — the exact bytes the Goose
+ * `WORKFLOW_TARGETS` entry writes to `<name>.yaml`. Extracted so the writer and
+ * the doctor content-drift check (`matches`) render from ONE source and can
+ * never disagree. Returns null on invalid frontmatter.
  */
-function renderGooseRecipeYaml(workflowPath, name) {
+export function renderGooseRecipeYaml(workflowPath, name) {
     const frontmatter = parseWorkflowFrontmatter(workflowPath);
     if (!frontmatter)
         return null;
@@ -969,231 +879,6 @@ function renderGooseRecipeYaml(workflowPath, name) {
     }
     return yaml.stringify(recipe);
 }
-function syncWorkflowToGooseRecipe(workflowPath, name, versionHome) {
-    const frontmatter = parseWorkflowFrontmatter(workflowPath);
-    if (!frontmatter) {
-        return { success: false, error: `Workflow '${name}' has invalid WORKFLOW.md frontmatter` };
-    }
-    const recipesDir = path.join(versionHome, '.config', 'goose', 'recipes');
-    const recipePath = path.join(recipesDir, `${name}.yaml`);
-    const subrecipesDir = path.join(recipesDir, `${name}.subrecipes`);
-    const subagents = selectedWorkflowSubagents(workflowPath, frontmatter.allowedAgents);
-    const recipeYaml = renderGooseRecipeYaml(workflowPath, name);
-    if (recipeYaml == null) {
-        return { success: false, error: `Workflow '${name}' has invalid WORKFLOW.md frontmatter` };
-    }
-    try {
-        fs.mkdirSync(recipesDir, { recursive: true });
-        if (fs.existsSync(subrecipesDir)) {
-            fs.rmSync(subrecipesDir, { recursive: true, force: true });
-        }
-        for (const subagentName of subagents) {
-            writeGooseSubrecipe(workflowPath, subagentName, subrecipesDir);
-        }
-        fs.writeFileSync(recipePath, recipeYaml, 'utf-8');
-        return { success: true };
-    }
-    catch (err) {
-        return { success: false, error: err.message };
-    }
-}
-/**
- * True when workflow `name` materialized in `agent`'s version home byte-matches
- * what the writer would produce NOW from `sourcePath` — the content-drift
- * predicate `agents doctor` uses. Layout-aware per the same per-harness map the
- * writer (`syncWorkflowToVersion`) and detector use: Claude/default copy the
- * whole WORKFLOW.md tree (recursive dir compare); Kimi/Antigravity/OpenClaw/Grok
- * render one transformed file; Goose renders a recipe YAML. Antigravity's target
- * is the shared HOME-global dir, not a per-version path. Returns false when the
- * home copy is absent (surfaced as `missing` at the name level, not here).
- */
-export function workflowContentMatches(agent, versionHome, name, sourcePath) {
-    const root = workflowTargetRoot(agent, versionHome);
-    const renderedMatches = (homePath, expected) => {
-        let actual;
-        try {
-            actual = fs.readFileSync(homePath, 'utf-8');
-        }
-        catch {
-            return false;
-        }
-        return normalizeResourceContent(actual) === normalizeResourceContent(expected);
-    };
-    switch (agent) {
-        case 'kimi':
-            return renderedMatches(path.join(root, name, 'SKILL.md'), transformWorkflowForKimi(sourcePath, name));
-        case 'antigravity':
-            return renderedMatches(path.join(root, `${name}.md`), transformWorkflowForAntigravity(sourcePath, name));
-        case 'openclaw':
-            return renderedMatches(path.join(root, `${name}.lobster`), transformWorkflowForOpenClaw(sourcePath, name));
-        case 'grok':
-            return renderedMatches(path.join(root, `${name}.rhai`), transformWorkflowForGrok(sourcePath, name));
-        case 'goose': {
-            const expected = renderGooseRecipeYaml(sourcePath, name);
-            if (expected == null)
-                return false;
-            return renderedMatches(path.join(versionHome, '.config', 'goose', 'recipes', `${name}.yaml`), expected);
-        }
-        default:
-            return dirsContentMatch(sourcePath, path.join(root, name));
-    }
-}
-/** Copy a workflow directory into a version home at {versionHome}/workflows/<name>/. */
-export function syncWorkflowToVersion(workflowPath, name, agent, versionHome) {
-    if (agent === 'goose') {
-        return syncWorkflowToGooseRecipe(workflowPath, name, versionHome);
-    }
-    try {
-        if (agent === 'kimi') {
-            const targetDir = path.join(workflowTargetRoot(agent, versionHome), name);
-            const targetFile = path.join(targetDir, 'SKILL.md');
-            if (fs.existsSync(targetFile)) {
-                const marker = kimiWorkflowMarker(targetFile);
-                if (marker !== name) {
-                    return { success: false, error: `Kimi skill '${name}' already exists and is not managed by agents-cli` };
-                }
-            }
-            fs.mkdirSync(targetDir, { recursive: true });
-            fs.writeFileSync(targetFile, transformWorkflowForKimi(workflowPath, name), 'utf-8');
-            return { success: true };
-        }
-        if (agent === 'antigravity') {
-            const targetDir = workflowTargetRoot(agent, versionHome);
-            const targetFile = path.join(targetDir, `${name}.md`);
-            if (fs.existsSync(targetFile)) {
-                const marker = antigravityWorkflowMarker(targetFile);
-                if (marker !== name) {
-                    return { success: false, error: `Antigravity workflow '${name}' already exists and is not managed by agents-cli` };
-                }
-            }
-            fs.mkdirSync(targetDir, { recursive: true });
-            fs.writeFileSync(targetFile, transformWorkflowForAntigravity(workflowPath, name), 'utf-8');
-            return { success: true };
-        }
-        if (agent === 'openclaw') {
-            const targetDir = workflowTargetRoot(agent, versionHome);
-            const targetFile = path.join(targetDir, `${name}.lobster`);
-            if (fs.existsSync(targetFile)) {
-                const marker = openclawWorkflowMarker(targetFile);
-                if (marker !== name) {
-                    return { success: false, error: `OpenClaw workflow '${name}' already exists and is not managed by agents-cli` };
-                }
-            }
-            fs.mkdirSync(targetDir, { recursive: true });
-            fs.writeFileSync(targetFile, transformWorkflowForOpenClaw(workflowPath, name), 'utf-8');
-            return { success: true };
-        }
-        if (agent === 'grok') {
-            const targetDir = workflowTargetRoot(agent, versionHome);
-            const targetFile = path.join(targetDir, `${name}.rhai`);
-            if (fs.existsSync(targetFile)) {
-                const marker = grokWorkflowMarker(targetFile);
-                if (marker !== name) {
-                    return { success: false, error: `Grok workflow '${name}' already exists and is not managed by agents-cli` };
-                }
-            }
-            fs.mkdirSync(targetDir, { recursive: true });
-            fs.writeFileSync(targetFile, transformWorkflowForGrok(workflowPath, name), 'utf-8');
-            return { success: true };
-        }
-        const targetDir = path.join(workflowTargetRoot(agent, versionHome), name);
-        fs.mkdirSync(workflowTargetRoot(agent, versionHome), { recursive: true });
-        if (fs.existsSync(targetDir)) {
-            fs.rmSync(targetDir, { recursive: true, force: true });
-        }
-        fs.cpSync(workflowPath, targetDir, { recursive: true });
-        return { success: true };
-    }
-    catch (err) {
-        return { success: false, error: err.message };
-    }
-}
-/** Remove a workflow from a specific agent version home. */
-export function removeWorkflowFromVersion(agent, version, name) {
-    const versionHome = getVersionHomePath(agent, version);
-    if (agent === 'antigravity') {
-        const targetFile = path.join(workflowTargetRoot(agent, versionHome), `${name}.md`);
-        if (!fs.existsSync(targetFile)) {
-            return { success: false, error: `Workflow '${name}' not synced to ${agent}@${version}` };
-        }
-        if (antigravityWorkflowMarker(targetFile) !== name) {
-            return { success: false, error: `Antigravity workflow '${name}' is not managed by agents-cli` };
-        }
-        try {
-            fs.rmSync(targetFile, { force: true });
-            return { success: true };
-        }
-        catch (err) {
-            return { success: false, error: err.message };
-        }
-    }
-    if (agent === 'goose') {
-        const recipePath = path.join(versionHome, '.config', 'goose', 'recipes', `${name}.yaml`);
-        const subrecipesDir = path.join(versionHome, '.config', 'goose', 'recipes', `${name}.subrecipes`);
-        if (!fs.existsSync(recipePath) && !fs.existsSync(subrecipesDir)) {
-            return { success: false, error: `Workflow '${name}' not synced to ${agent}@${version}` };
-        }
-        try {
-            if (fs.existsSync(recipePath))
-                fs.rmSync(recipePath, { force: true });
-            if (fs.existsSync(subrecipesDir))
-                fs.rmSync(subrecipesDir, { recursive: true, force: true });
-            return { success: true };
-        }
-        catch (err) {
-            return { success: false, error: err.message };
-        }
-    }
-    if (agent === 'openclaw') {
-        const targetFile = path.join(workflowTargetRoot(agent, versionHome), `${name}.lobster`);
-        if (!fs.existsSync(targetFile)) {
-            return { success: false, error: `Workflow '${name}' not synced to ${agent}@${version}` };
-        }
-        if (openclawWorkflowMarker(targetFile) !== name) {
-            return { success: false, error: `OpenClaw workflow '${name}' is not managed by agents-cli` };
-        }
-        try {
-            fs.rmSync(targetFile, { force: true });
-            return { success: true };
-        }
-        catch (err) {
-            return { success: false, error: err.message };
-        }
-    }
-    if (agent === 'grok') {
-        const targetFile = path.join(workflowTargetRoot(agent, versionHome), `${name}.rhai`);
-        if (!fs.existsSync(targetFile)) {
-            return { success: false, error: `Workflow '${name}' not synced to ${agent}@${version}` };
-        }
-        if (grokWorkflowMarker(targetFile) !== name) {
-            return { success: false, error: `Grok workflow '${name}' is not managed by agents-cli` };
-        }
-        try {
-            fs.rmSync(targetFile, { force: true });
-            return { success: true };
-        }
-        catch (err) {
-            return { success: false, error: err.message };
-        }
-    }
-    const targetPath = path.join(workflowTargetRoot(agent, versionHome), name);
-    if (!fs.existsSync(targetPath)) {
-        return { success: false, error: `Workflow '${name}' not synced to ${agent}@${version}` };
-    }
-    try {
-        if (agent === 'kimi') {
-            const targetFile = path.join(targetPath, 'SKILL.md');
-            if (kimiWorkflowMarker(targetFile) !== name) {
-                return { success: false, error: `Kimi skill '${name}' is not managed by agents-cli` };
-            }
-        }
-        fs.rmSync(targetPath, { recursive: true, force: true });
-        return { success: true };
-    }
-    catch (err) {
-        return { success: false, error: err.message };
-    }
-}
 function parseSkillFrontmatter(filePath) {
     const content = fs.readFileSync(filePath, 'utf-8');
     const lines = content.split('\n');
@@ -1206,7 +891,7 @@ function parseSkillFrontmatter(filePath) {
     const parsed = yaml.parse(frontmatter);
     return parsed && typeof parsed === 'object' ? parsed : null;
 }
-function kimiWorkflowMarker(filePath) {
+export function kimiWorkflowMarker(filePath) {
     try {
         const fm = parseSkillFrontmatter(filePath);
         return fm?.type === 'flow' && typeof fm.agents_workflow === 'string' ? fm.agents_workflow : null;
@@ -1215,7 +900,7 @@ function kimiWorkflowMarker(filePath) {
         return null;
     }
 }
-function antigravityWorkflowMarker(filePath) {
+export function antigravityWorkflowMarker(filePath) {
     try {
         const fm = parseSkillFrontmatter(filePath);
         return typeof fm?.agents_workflow === 'string' ? fm.agents_workflow : null;
@@ -1224,7 +909,7 @@ function antigravityWorkflowMarker(filePath) {
         return null;
     }
 }
-function openclawWorkflowMarker(filePath) {
+export function openclawWorkflowMarker(filePath) {
     try {
         const parsed = yaml.parse(fs.readFileSync(filePath, 'utf-8'));
         if (!parsed || typeof parsed !== 'object' || !parsed.env || typeof parsed.env !== 'object' || Array.isArray(parsed.env)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.84",
+  "version": "1.22.86",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -43,7 +43,7 @@
     "url": "https://github.com/phnx-labs/agi-cli/issues"
   },
   "scripts": {
-    "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",
+    "build": "tsc && rm -rf 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",
     "build:bin": "scripts/build-bin.sh",
     "prepare": "npm run build",
     "prepack": "cp ../README.md README.md",
@@ -95,7 +95,6 @@
     "@xterm/headless": "6.0.0",
     "@zed-industries/agent-client-protocol": "0.4.5",
     "acorn": "8.18.0",
-    "age-encryption": "0.3.0",
     "aws4fetch": "1.0.20",
     "chalk": "5.6.2",
     "commander": "15.0.0",

package/scripts/postinstall.js

@@ -22,7 +22,6 @@ const AGENTS_JS_ENTRYPOINT = fileURLToPath(new URL('../dist/index.js', import.me
 // is what EDR (CrowdStrike Falcon) flags when an editor child spawns it (#315).
 const AGENTS_NATIVE_MACOS_BIN = fileURLToPath(new URL('../dist/bin/agents', import.meta.url));
 const AGENTS_BIN = resolveAgentsBin();
-const INSTALL_HELPER_SCRIPT = fileURLToPath(new URL('./install-helper.js', import.meta.url));
 
 function resolveAgentsBin() {
   if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT;
@@ -46,23 +45,44 @@ function resolveAgentsBin() {
   return AGENTS_JS_ENTRYPOINT;
 }
 
-function installKeychainHelper() {
-  if (process.platform !== 'darwin') return;
-  if (!fs.existsSync(INSTALL_HELPER_SCRIPT)) return;
-  // Sub-process so a hard failure (codesign / spctl missing on a weird host)
-  // can't take down the rest of postinstall. install-helper.js stays silent
-  // on no-op and emits one stdout line on success.
-  spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });
-}
-
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
 // Shorthands that delegate to the installed agents-cli entrypoint.
-const ALIASES = ['sessions', 'secrets', 'browser', 'pty', 'teams'];
+const ALIASES = ['sessions', 'browser', 'pty', 'teams'];
+
+// Aliases this script USED to write and must now remove on every install.
+// `secrets`: the name belongs to the standalone `@phnx-labs/secrets-cli` binary
+// (PHNX-3989); `agents secrets` is a passthrough to it, so an alias shim that
+// `exec`s `agents secrets` can only re-enter the passthrough, and it shadows the
+// real `secrets` bin because the shims dir sits first on PATH. The self-heal
+// shim pass prunes it too, but that only runs from a daemon or a TTY session —
+// postinstall is what every upgrade path actually executes, so it cleans up here.
+const RETIRED_ALIASES = ['secrets'];
+
+function removeRetiredAliasShims() {
+  for (const name of RETIRED_ALIASES) {
+    for (const file of [path.join(SHIMS_DIR, name), path.join(SHIMS_DIR, name + '.cmd')]) {
+      let content;
+      try {
+        content = fs.readFileSync(file, 'utf8');
+      } catch {
+        continue;
+      }
+      // Only ever remove OUR alias — the POSIX shim ends in `<name> "$@"`, the
+      // Windows companion in `<name> %*` — never an unrelated file someone placed
+      // under that name, and never a user's own `agents setup alias` shim, which
+      // is marked `# Alias shim:` (the same guard pruneOrphanedCommandShim keeps).
+      if (content.includes('# Alias shim:')) continue;
+      if (!content.includes(`${name} "$@"`) && !content.includes(`${name} %*`)) continue;
+      fs.rmSync(file, { force: true });
+    }
+  }
+}
 
 function writeAliasShims() {
+  removeRetiredAliasShims();
   const written = [];
   for (const name of ALIASES) {
     const target = path.join(SHIMS_DIR, name);
@@ -93,7 +113,6 @@ const isGlobalInstall = process.env.npm_config_global || process.argv.includes('
 if (!isGlobalInstall) {
   // Still create user directories for local installs
   fs.mkdirSync(USER_DIR, { recursive: true, mode: 0o700 });
-  installKeychainHelper();
   console.log(`
 agents-cli installed locally.
 To complete setup, run: npx agents setup
@@ -115,10 +134,6 @@ To complete setup, run: npx agents setup
 fs.mkdirSync(USER_DIR, { recursive: true, mode: 0o700 });
 fs.mkdirSync(SHIMS_DIR, { recursive: true });
 
-// Copy the signed macOS Keychain helper to a stable user path so its trusted-app
-// ACLs survive future npm publishes (which re-sign the bundle).
-installKeychainHelper();
-
 const shellName = path.basename(process.env.SHELL || '/bin/bash');
 
 function getShellRc() {
@@ -377,10 +392,12 @@ function retargetManagedLinksToNativeBin() {
 /**
  * Self-heal long-running processes onto the just-installed code (darwin + linux).
  *
- * The root cause behind stale-behavior bugs is a daemon/broker that keeps
+ * The root cause behind stale-behavior bugs is a daemon that keeps
  * running pre-upgrade code for days. An in-place `npm i -g` swaps the files but
  * not the running processes — so we bounce them here, the one moment we know the
- * code just changed. Always start (or restart) the supervised daemon so a fresh
+ * code just changed. (The secrets broker is not one of them — the standalone
+ * `secrets` CLI owns its own broker lifecycle, PHNX-3989.) Always start (or
+ * restart) the supervised daemon so a fresh
  * install gets launchd/systemd KeepAlive without waiting for routines add.
  * Best-effort and non-fatal: a failure must never break the install. Skipped in
  * CI and when AGENTS_NO_HEAL=1. Windows is out of scope (detached-only, no KeepAlive).
@@ -389,18 +406,6 @@ async function healLongRunningProcesses() {
   if (process.platform !== 'darwin' && process.platform !== 'linux') return;
   if (process.env.CI || process.env.AGENTS_NO_HEAL === '1') return;
 
-  // Retire the legacy standalone secrets-agent service FIRST (#416 step 2) so
-  // that when the daemon (re)starts below its coexistence guard sees no
-  // standalone broker and hosts the broker socket itself. No-op if no legacy
-  // plist is present; never blocks. Darwin-only in practice (launchd service).
-  try {
-    const a = await import('../dist/lib/secrets/agent.js');
-    if (a.secretsAgentServiceInstalled?.()) {
-      a.retireLegacySecretsAgentService?.();
-      console.log('  Retired the standalone secrets-agent service — the daemon now hosts the broker.');
-    }
-  } catch { /* best effort */ }
-
   // Always (re)start so first install writes the LaunchAgent/systemd unit and
   // upgrades bounce onto the new binary — but honor daemon.enabled for cold
   // starts (SING-4a). If it was already running under a disable, stop and leave

package/dist/commands/secrets-import.d.ts

@@ -1,18 +0,0 @@
-/**
- * `agents secrets import-keyring` — migrate agents-cli secrets out of the native
- * credential store (GNOME Keyring / Windows Credential Manager) and into the
- * encrypted file store.
- *
- * Why: on headless Linux/Windows the file store is the durable, passwordless
- * backend, but secrets written earlier (e.g. while a desktop keyring was
- * unlocked) can linger in the native store where a headless session can't reach
- * them. This is the Linux/Windows analogue of the macOS `migrate-acl` /
- * orphan sweep. Dry-run by default; `--commit` performs the copy.
- *
- * Requires the native store to be reachable/unlocked — a locked keyring can't be
- * read, so unlock it first (or the values are already only in the file store and
- * there is nothing to do).
- */
-import type { Command } from 'commander';
-/** Register `agents secrets import-keyring` on the parent secrets Command. */
-export declare function registerSecretsImportKeyringCommand(secrets: Command): void;

package/dist/commands/secrets-import.js

@@ -1,74 +0,0 @@
-/**
- * `agents secrets import-keyring` — migrate agents-cli secrets out of the native
- * credential store (GNOME Keyring / Windows Credential Manager) and into the
- * encrypted file store.
- *
- * Why: on headless Linux/Windows the file store is the durable, passwordless
- * backend, but secrets written earlier (e.g. while a desktop keyring was
- * unlocked) can linger in the native store where a headless session can't reach
- * them. This is the Linux/Windows analogue of the macOS `migrate-acl` /
- * orphan sweep. Dry-run by default; `--commit` performs the copy.
- *
- * Requires the native store to be reachable/unlocked — a locked keyring can't be
- * read, so unlock it first (or the values are already only in the file store and
- * there is nothing to do).
- */
-import chalk from 'chalk';
-import { importNativeItems } from '../lib/secrets/index.js';
-/** Register `agents secrets import-keyring` on the parent secrets Command. */
-export function registerSecretsImportKeyringCommand(secrets) {
-    secrets
-        .command('import-keyring')
-        .description('Migrate agents-cli secrets from the OS keyring / Credential Manager into the encrypted file store (headless-safe). Dry-run by default.')
-        .option('--commit', 'Perform the import (default is dry-run reporting only)')
-        .option('--prefix <p>', 'Only import items beginning with PREFIX (default: all agents-cli items)')
-        .action((opts) => {
-        try {
-            if (process.platform === 'darwin') {
-                throw new Error('import-keyring is for the Linux/Windows file-store fallback. On macOS use `agents secrets migrate-acl`.');
-            }
-            const commit = !!opts.commit;
-            const report = importNativeItems(opts.prefix ?? '', commit);
-            if (!report.available) {
-                console.log(chalk.gray('No native credential tooling found (secret-tool / PowerShell) — nothing to import.'));
-                return;
-            }
-            if (report.locked) {
-                console.error(chalk.yellow('The native credential store is locked/unreachable, so its secrets can\'t be read. ' +
-                    'Unlock it and retry (a locked store can\'t be migrated).'));
-                process.exit(1);
-            }
-            if (report.results.length === 0) {
-                console.log(chalk.green('Nothing to import — no native secrets outside the file store.'));
-                return;
-            }
-            const imported = report.results.filter((r) => r.status === 'imported' || r.status === 'would-import');
-            const existing = report.results.filter((r) => r.status === 'exists');
-            const failed = report.results.filter((r) => r.status === 'failed');
-            for (const r of report.results) {
-                if (r.status === 'imported')
-                    console.log(`  ${chalk.green('imported')}  ${r.item}`);
-                else if (r.status === 'would-import')
-                    console.log(`  ${chalk.cyan('would import')}  ${r.item}`);
-                else if (r.status === 'exists')
-                    console.log(`  ${chalk.gray('exists')}    ${r.item} ${chalk.gray('(already in file store)')}`);
-                else
-                    console.log(`  ${chalk.red('failed')}    ${r.item} ${chalk.gray(r.detail ?? '')}`);
-            }
-            console.log();
-            if (!commit) {
-                console.log(chalk.gray(`Dry-run: ${imported.length} would be imported, ${existing.length} already present, ${failed.length} unreadable. Pass --commit to write.`));
-                return;
-            }
-            if (failed.length > 0) {
-                console.error(chalk.yellow(`Imported ${imported.length}; ${existing.length} already present; ${failed.length} failed.`));
-                process.exit(1);
-            }
-            console.log(chalk.green(`Imported ${imported.length} secret(s) into the file store (${existing.length} already present).`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-}

package/dist/commands/secrets-migrate.d.ts

@@ -1,25 +0,0 @@
-/**
- * `agents secrets migrate-acl` — refresh existing keychain items so they pick
- * up the new SecAccess ACL written by the signed Agents CLI.app helper.
- *
- * Items created before 1.19.2 (or by `security add-generic-password` directly)
- * may carry the legacy "this-app-only" ACL that prompts the user for a
- * password on every read. Re-writing them through the helper bakes in the
- * empty trusted-app ACL that suppresses the prompt and lets the helper read
- * them under LocalAuthentication instead.
- *
- * Sequence per item:
- *   1. Read the current value (no auth prompt path — uses the unauthenticated
- *      `security` CLI for non-sync items, helper `get` for sync items).
- *   2. Append (item, value, sync) to an encrypted backup before any writes.
- *   3. Delete + rewrite via the helper so macOS hands us a fresh ACL on the
- *      new item.
- *   4. Read back via the helper to verify the value round-trips.
- *
- * `--dry-run` (default) reports the planned actions. `--commit` performs the
- * writes and produces the backup.
- */
-import type { Command } from 'commander';
-/** Register the keychain-migration commands (`migrate-acl`, `rekey`) on the
- * parent secrets Command. */
-export declare function registerSecretsMigrateAclCommand(secrets: Command): void;