@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/commands/alias.js

@@ -8,9 +8,13 @@ import { setHelpSections } from '../lib/help.js';
 function aliasesFile() {
     return path.join(getUserAgentsDir(), 'aliases.json');
 }
-/** Names that would clobber an agent CLI shim or the `agents` binary itself. */
+/**
+ * Names that would clobber an agent CLI shim, the `agents` binary itself, or the
+ * standalone `secrets` CLI (PHNX-3989): the shims dir sits first on PATH, so an
+ * alias named `secrets` would shadow `@phnx-labs/secrets-cli` for every caller.
+ */
 function reservedNames() {
-    const reserved = new Set(['agents']);
+    const reserved = new Set(['agents', 'secrets']);
     for (const id of ALL_AGENT_IDS)
         reserved.add(AGENTS[id].cliCommand);
     return reserved;
@@ -85,7 +89,7 @@ export function registerAliasCommand(setupCmd) {
             process.exit(1);
         }
         if (reservedNames().has(name)) {
-            console.error(chalk.red(`"${name}" is reserved (collides with an agent CLI or the agents binary).`));
+            console.error(chalk.red(`"${name}" is reserved (collides with an agent CLI, the agents binary, or the standalone secrets CLI).`));
             process.exit(1);
         }
         const target = shimPath(name);

package/dist/commands/apply.js

@@ -18,7 +18,7 @@ import { isHostPinned, isDevicePinned, managedKnownHostsPath } from '../lib/devi
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired, emptyTargetsMessage } from '../lib/fleet/manifest.js';
 import { snapshotAuth } from '../lib/fleet/auth-sync.js';
-import { AUTH_BUNDLE_NAME } from '../lib/secrets/bundles.js';
+import { AUTH_BUNDLE_NAME } from '../lib/secrets-policy.js';
 import { agentIdOf, diffFleet, probeDevice, runFleetApply, pool, sourceHome, expandAllSpecs, rosterNeedsVersions, fleetSecretsBundles, } from '../lib/fleet/apply.js';
 import { listInstalledVersions } from '../lib/installations/versions.js';
 /** Version of the running agents-cli — the fleet target version. */

package/dist/commands/auth-mint.d.ts

@@ -1,8 +1,12 @@
 /**
  * Shared `mint` subcommand registered on both `agents auth` (the ticket
- * surface) and `agents accounts` (the credential noun). Implementation lives
- * in lib/auth-mint.ts so neither command file owns the seed path.
+ * surface) and `agents accounts` (the credential noun). Hidden on both:
+ * `agents accounts add <harness> [name]` / `agents accounts login <harness>#<name>`
+ * is the taught path. Implementation lives in lib/auth-mint.ts so neither
+ * command file owns the seed path.
  */
 import type { Command } from 'commander';
 import { type MintDriveHooks } from '../lib/auth-mint.js';
-export declare function registerMintCommand(parent: Command, testHooks?: MintDriveHooks): Command;
+export declare function registerMintCommand(parent: Command, testHooks?: MintDriveHooks, opts?: {
+    hidden?: boolean;
+}): Command;

package/dist/commands/auth-mint.js

@@ -1,8 +1,16 @@
+/**
+ * Shared `mint` subcommand registered on both `agents auth` (the ticket
+ * surface) and `agents accounts` (the credential noun). Hidden on both:
+ * `agents accounts add <harness> [name]` / `agents accounts login <harness>#<name>`
+ * is the taught path. Implementation lives in lib/auth-mint.ts so neither
+ * command file owns the seed path.
+ */
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { readStdinSync, runOrDie } from '../lib/format.js';
 import { isInteractiveTerminal } from './utils.js';
 import { getMintFlow, listMintableHarnesses, mintAndSeed, } from '../lib/auth-mint.js';
+const MINT_POINTER = 'agents accounts add <harness> [name] / agents accounts login <harness>#<name>';
 function collect(value, previous) {
     return [...previous, value];
 }
@@ -28,9 +36,10 @@ function printResult(result, json) {
         }
     }
 }
-export function registerMintCommand(parent, testHooks) {
+export function registerMintCommand(parent, testHooks, opts) {
+    const hidden = opts?.hidden ?? true;
     const mint = parent
-        .command('mint <harness>')
+        .command('mint <harness>', { hidden })
         .description('Mint a long-lived setup-token and seed it as a named account')
         .option('--account <name-or-email>', 'Named account to create/rotate, or the account email')
         .option('--email <email>', 'Email that keys the reserved auth bundle when --account is a name')
@@ -78,19 +87,22 @@ export function registerMintCommand(parent, testHooks) {
             printResult(result, json);
         }, { json });
     });
+    if (hidden) {
+        mint.hook('preAction', () => {
+            console.error(chalk.gray(`'agents ${parent.name()} mint' is a hidden alias; use \`${MINT_POINTER}\` — still works this release.`));
+        });
+    }
     setHelpSections(mint, {
-        examples: `agents accounts mint claude
-agents accounts mint claude --account ada@example.com
-agents accounts mint claude --account work --email ada@example.com
+        examples: `agents accounts add claude work
+agents accounts login claude#work
 agents accounts mint claude --token-stdin < token.txt
 agents accounts mint claude --code AUTHCODE --json
-agents accounts mint claude --fleet
-agents auth mint claude --account ada@example.com --json`,
-        notes: `Claude is the only harness with an interactive long-lived setup-token (\`claude setup-token\`, ~1 year, shareable across machines). The command drives that flow in a PTY, opens the authorize URL, captures a well-formed sk-ant-oat01- token (refusing the #1767 TTY-banner capture), and seeds:
+agents accounts mint claude --fleet`,
+        notes: `Hidden alias of the worker-credential step that \`agents accounts add <harness> [name]\` (mint during add) and \`agents accounts login <harness>#<name>\` (re-mint) now own. Claude is the only harness with an interactive long-lived setup-token (\`claude setup-token\`, ~1 year, shareable across machines). The command drives that flow in a PTY, opens the authorize URL, captures a well-formed sk-ant-oat01- token (refusing the #1767 TTY-banner capture), and seeds:
   1. a named provider account (policy never) for \`agents run --account\` / \`agents accounts sync\`
   2. the reserved FILE-BASED auth bundle keyed per email, which usage/probe reads
 Native rotating OAuth is never copied. Other harnesses fail loud: device-code login is \`agents fleet login\`; API keys are \`agents accounts add\`.
-Already have a token? \`--token-stdin\` skips the browser dance. \`agents auth mint\` is the same command as \`agents accounts mint\`.`,
+Already have a token? \`--token-stdin\` skips the browser dance. \`agents auth mint\` and \`agents accounts mint\` are the same hidden command.`,
     });
     return mint;
 }

package/dist/commands/auth.js

@@ -105,7 +105,6 @@ export function registerAuthCommand(program) {
     setHelpSections(auth, {
         examples: `agents auth login                         # device-code sign-in via your browser
 agents auth whoami                        # who this machine is signed in as
-agents auth mint claude                   # mint a Claude setup-token into a named account
 agents auth space create "Design Team"    # start a space
 agents auth space invite ada@example.com  # add a teammate
 agents auth logout                        # clear this machine only`,
@@ -113,7 +112,7 @@ agents auth logout                        # clear this machine only`,
 Sign-in is Google-only and opens a Phoenix-branded page; the CLI never sees a password.
 The session lives in this machine's agents state dir, so logging out here signs out nothing else.
 Point at a different backend with PHOENIX_ID_BASE (defaults to the production service).
-\`agents auth mint\` is the harness setup-token mint (same command as \`agents accounts mint\`); it does not sign you into Phoenix ID.`,
+Harness worker credentials are minted by \`agents accounts add <harness> [name]\` / \`agents accounts login <harness>#<name>\`, not by this command.`,
     });
     auth
         .command('login')
@@ -127,7 +126,7 @@ Point at a different backend with PHOENIX_ID_BASE (defaults to the production se
         const json = !!o.json || !!command.optsWithGlobals().json;
         return runOrDie(() => whoami(json), { json });
     });
-    registerMintCommand(auth);
+    registerMintCommand(auth, undefined, { hidden: true });
     auth
         .command('logout')
         .description("Clear this machine's session (no other device is affected)")

package/dist/commands/browser.js

@@ -8,7 +8,7 @@ import { declaringDevices, migrateCentralBrowserProfiles, profileKind } from '..
 import { resolveActor } from '../lib/actor.js';
 import { loginsForProfile, profilesLoggedInto, serviceForUrl, loginsWithAccountsForProfile, accountsForProfile, credKeysForService, AUTH_SIGNATURES, } from '../lib/browser/login-detection.js';
 import { parseSecretRef } from '../lib/browser/secret-ref.js';
-import { readAndResolveBundleEnv, bundleExists, readBundle, describeBundle } from '../lib/secrets/bundles.js';
+import { readAndResolveBundleEnv, bundleExists, readBundle } from '../lib/secrets-client.js';
 import { findBrowserPath, getPortOccupant, getProcessUserDataDir, isLauncherScript, listInstalledBrowsers } from '../lib/browser/chrome.js';
 import { listProfileCacheDirs, removeProfileCache, listAllProfileSnapshots, buildProfilePrunePlan, pruneProfiles, PRUNE_REASON_TEXT, identityLoopbackMismatch, } from '../lib/browser/runtime-state.js';
 import { DEFAULT_VIEWPORT, parseWindowSize, parseWindowPosition } from '../lib/browser/devices.js';
@@ -452,16 +452,16 @@ function registerBrowserUseCommand(browser) {
  * keys exist, '-' when not, or '(unknown)' if the metadata read would prompt or
  * fails — the view must never block on Touch ID.
  */
-function credAvailability(bundleName, service) {
+async function credAvailability(bundleName, service) {
     if (!bundleName)
         return '-';
     const keys = credKeysForService(service);
     if (!keys)
         return '-';
     try {
-        if (!bundleExists(bundleName))
+        if (!(await bundleExists(bundleName)))
             return '-';
-        const present = new Set(describeBundle(readBundle(bundleName)).map((e) => e.key));
+        const present = new Set(Object.keys((await readBundle(bundleName)).vars));
         return present.has(keys.user) && present.has(keys.pass) ? bundleName : '-';
     }
     catch {
@@ -590,7 +590,7 @@ function registerProfilesCommands(browser) {
                 console.log(name.padEnd(20) +
                     r.service.padEnd(12) +
                     (r.username ?? '(unknown)').padEnd(32) +
-                    credAvailability(p.secrets, r.service));
+                    (await credAvailability(p.secrets, r.service)));
                 first = false;
             }
         }
@@ -712,7 +712,7 @@ function registerProfilesCommands(browser) {
         }
         // Warn (don't fail) if the declared secrets bundle doesn't exist yet — it
         // may be created later, but a typo should surface now.
-        if (opts.secrets && !bundleExists(opts.secrets)) {
+        if (opts.secrets && !(await bundleExists(opts.secrets))) {
             console.error(`warning: secrets bundle "${opts.secrets}" does not exist yet. Create it with: agents secrets create ${opts.secrets}`);
         }
     });
@@ -847,7 +847,7 @@ function registerProfilesCommands(browser) {
         else {
             console.log(`Updated ${name} on ${machineId()}: ${result.changed.join(', ')}`);
         }
-        if (patch.secrets && !bundleExists(patch.secrets)) {
+        if (patch.secrets && !(await bundleExists(patch.secrets))) {
             console.error(`warning: secrets bundle "${patch.secrets}" does not exist yet. Create it with: agents secrets create ${patch.secrets}`);
         }
     });
@@ -957,7 +957,7 @@ function registerProfilesCommands(browser) {
         const lines = [];
         for (const service of Object.keys(AUTH_SIGNATURES)) {
             const isActive = active.includes(service);
-            const creds = credAvailability(profile.secrets, service);
+            const creds = await credAvailability(profile.secrets, service);
             if (!isActive && creds === '-')
                 continue; // nothing interesting to show
             const status = isActive
@@ -2661,12 +2661,12 @@ function registerTaskCommands(browser) {
                 console.error(`--secret must be <bundle>/<KEY>, got: ${opts.secret}`);
                 process.exit(1);
             }
-            if (!bundleExists(parsed.bundle)) {
+            if (!(await bundleExists(parsed.bundle))) {
                 console.error(`Secrets bundle "${parsed.bundle}" not found.`);
                 process.exit(1);
             }
             try {
-                const { env } = readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key], keyMode: 'storage', agentOnly: true });
+                const { env } = await readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key], keyMode: 'storage', agentOnly: true });
                 if (!(parsed.key in env)) {
                     console.error(`Key "${parsed.key}" not in bundle "${parsed.bundle}".`);
                     process.exit(1);

package/dist/commands/daemon.d.ts

@@ -2,9 +2,11 @@
  * `agents daemon` — runtime, hosted services, and failure visibility for the
  * always-on daemon (RUSH-2354).
  *
- * The daemon holds the routines scheduler, the secrets broker, the browser IPC
- * server, and the watchdog pass — but until this command group existed it had
- * no user-facing surface: no way to see it, restart it, or turn it off.
+ * The daemon holds the routines scheduler, the browser IPC server, and the
+ * watchdog pass — but until this command group existed it had no user-facing
+ * surface: no way to see it, restart it, or turn it off. The secrets broker
+ * moved out of this daemon entirely with the standalone `secrets` engine
+ * (PHNX-3989 OWN-1); `agents daemon status` only probes its reachability.
  * `daemon.ts` (the runtime) has always implemented every mechanism this file
  * wires up; nothing here is new machinery, only the missing CLI surface.
  *
@@ -16,6 +18,8 @@
  */
 import type { Command } from 'commander';
 import { type DaemonServiceId } from '../lib/daemon-services.js';
+/** Parse a `ps -o etime=` value (`[[dd-]hh:]mm:ss`) into elapsed seconds. */
+export declare function parseEtimeToSeconds(raw: string): number | null;
 /** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
 export declare function uptimeSeconds(pid: number): number | null;
 /** One row of the roster every registered daemon service — supervisor-managed or legacy — renders in `agents daemon services`. */

package/dist/commands/daemon.js

@@ -2,9 +2,11 @@
  * `agents daemon` — runtime, hosted services, and failure visibility for the
  * always-on daemon (RUSH-2354).
  *
- * The daemon holds the routines scheduler, the secrets broker, the browser IPC
- * server, and the watchdog pass — but until this command group existed it had
- * no user-facing surface: no way to see it, restart it, or turn it off.
+ * The daemon holds the routines scheduler, the browser IPC server, and the
+ * watchdog pass — but until this command group existed it had no user-facing
+ * surface: no way to see it, restart it, or turn it off. The secrets broker
+ * moved out of this daemon entirely with the standalone `secrets` engine
+ * (PHNX-3989 OWN-1); `agents daemon status` only probes its reachability.
  * `daemon.ts` (the runtime) has always implemented every mechanism this file
  * wires up; nothing here is new machinery, only the missing CLI surface.
  *
@@ -21,7 +23,7 @@ import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
 import { getDaemonStatus, isDaemonRunning, isDaemonWedged, readDaemonLog, startDaemon, stopDaemon, signalDaemonReload, findSurvivingStateDirDaemons, getDaemonLogPath, isDaemonAutostartCircuitOpen, } from '../lib/daemon/daemon.js';
 import { getConfigValue, setConfigValue, isDaemonEnabled } from '../lib/device-config.js';
-import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_SECRETS_BROKER, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
+import { readSubsystemHealth, readAllSubsystemHealth, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START, } from '../lib/daemon-health.js';
 import { DAEMON_SERVICE_IDS, listDaemonServiceStates, setDaemonServiceEnabled, getDaemonServicesConfigPath, queueDaemonServiceRestart, } from '../lib/daemon-services.js';
 import { listJobs, getLatestRun } from '../lib/scheduling/routines.js';
 import { JobScheduler } from '../lib/scheduler.js';
@@ -30,7 +32,6 @@ import { parseDuration } from '../lib/hooks/cache.js';
 import { registerFunnelCommand } from './funnel.js';
 import { DEFAULT_WEBHOOK_PORT, DEFAULT_WEBHOOK_RATE_LIMIT, addHostedReceiver, getDaemonWebhooksConfigPath, hostedReceiverPort, readDaemonWebhooksConfig, removeHostedReceiver, } from '../lib/daemon-webhooks.js';
 import { parseFunnelPort } from '../lib/funnel.js';
-import { parseEtimeToSeconds } from '../lib/secrets/reaper.js';
 /**
  * Provably absent, or null when unknowable.
  *
@@ -256,6 +257,19 @@ function registryScopedDuplicates(processes, ownerPid) {
     const registered = new Set(findSurvivingStateDirDaemons(exclude));
     return processes.filter((p) => registered.has(p.pid));
 }
+/** Parse a `ps -o etime=` value (`[[dd-]hh:]mm:ss`) into elapsed seconds. */
+export function parseEtimeToSeconds(raw) {
+    const m = raw.match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/);
+    if (!m)
+        return null;
+    const days = m[1] ? parseInt(m[1], 10) : 0;
+    const hours = m[2] ? parseInt(m[2], 10) : 0;
+    const mins = parseInt(m[3], 10);
+    const secs = parseInt(m[4], 10);
+    if ([days, hours, mins, secs].some(isNaN))
+        return null;
+    return ((days * 24 + hours) * 60 + mins) * 60 + secs;
+}
 /** Elapsed wall-clock seconds since `pid` started, or null if unavailable (best-effort, POSIX only). */
 export function uptimeSeconds(pid) {
     if (process.platform === 'win32')
@@ -264,7 +278,7 @@ export function uptimeSeconds(pid) {
         // `-o etimes=` is a GNU/procps keyword macOS/BSD `ps` rejects with a
         // non-zero exit (`ps: etimes: keyword not found`), so `agents daemon status`
         // errored out entirely on macOS. `etime` (`[[dd-]hh:]mm:ss`) is the portable
-        // POSIX field; `parseEtimeToSeconds` (shared with the keychain reaper) parses it.
+        // POSIX field; `parseEtimeToSeconds` above parses it.
         const out = execFileSync('ps', ['-o', 'etime=', '-p', String(pid)], { encoding: 'utf-8' }).trim();
         return parseEtimeToSeconds(out);
     }
@@ -281,18 +295,18 @@ function humanDuration(seconds) {
         return `${Math.round(seconds / 3600)}h`;
     return `${Math.round(seconds / 86400)}d`;
 }
+/** Reachability probe only — the daemon does not host, supervise, or take over the broker (OWN-1). */
 async function probeSecretsBroker() {
-    const record = readSubsystemHealth(SUBSYSTEM_SECRETS_BROKER);
     try {
-        const { agentPing, agentStatus, secretsBrokerSocketPath } = await import('../lib/secrets/agent.js');
+        const { agentPing, agentStatus } = await import('../lib/secrets-client.js');
         const ping = await agentPing();
         if (!ping.reachable)
-            return { reachable: false, socketPath: secretsBrokerSocketPath(), heldBundles: null, record };
+            return { reachable: false, socketPath: null, heldBundles: null, record: null };
         const entries = await agentStatus();
-        return { reachable: true, socketPath: secretsBrokerSocketPath(), heldBundles: entries.length, record };
+        return { reachable: true, socketPath: null, heldBundles: entries.length, record: null };
     }
     catch {
-        return { reachable: false, socketPath: null, heldBundles: null, record };
+        return { reachable: false, socketPath: null, heldBundles: null, record: null };
     }
 }
 async function probeBrowserIPC() {
@@ -732,8 +746,8 @@ function registerWebhooksSubcommand(parent) {
         notes: `
       The bundle must hold GITHUB_WEBHOOK_SECRET and/or LINEAR_WEBHOOK_SECRET
       ('agents secrets add <bundle> LINEAR_WEBHOOK_SECRET'). The daemon reads it
-      through the secrets broker, so a hosted receiver needs no
-      AGENTS_SECRETS_PASSPHRASE and no nohup. A LOCKED bundle fails that receiver
+      headlessly through the standalone 'secrets' CLI, so a hosted receiver needs
+      no AGENTS_SECRETS_PASSPHRASE and no nohup. A LOCKED bundle fails that receiver
       loud in 'agents daemon logs' rather than binding unverified ingress.
 
       Port is the identity: a second 'add' on the same port edits that receiver.
@@ -831,7 +845,7 @@ function runWebhooksList(json) {
 export function registerDaemonCommand(program) {
     const cmd = program
         .command('daemon')
-        .description('The always-on daemon: secrets broker, browser IPC, watchdog, and the routines scheduler. Bare `agents daemon` shows status.')
+        .description('The always-on daemon: browser IPC, watchdog, and the routines scheduler. Bare `agents daemon` shows status.')
         .option('--json', 'Emit as JSON')
         .action(async (opts, command) => {
         await runStatus({ json: command.optsWithGlobals().json === true });
@@ -860,12 +874,12 @@ export function registerDaemonCommand(program) {
       agents daemon services
 
       # Toggle or restart a service live — applies without a daemon restart
-      # for supervisor-managed services (secrets-broker, browser-ipc,
-      # account-state, session-index, monitors' off-transition, watchdog,
-      # device-probe, self-heal, keychain-reap, state-dir-check)
-      agents daemon services disable secrets-broker
-      agents daemon services enable secrets-broker
-      agents daemon services restart secrets-broker
+      # for supervisor-managed services (browser-ipc, account-state,
+      # session-index, monitors' off-transition, watchdog, device-probe,
+      # self-heal, state-dir-check)
+      agents daemon services disable browser-ipc
+      agents daemon services enable browser-ipc
+      agents daemon services restart browser-ipc
 
       # Host a signed webhook receiver here, supervised and restarted on crash
       agents daemon webhooks add --secrets-bundle linear-webhook
@@ -1006,17 +1020,18 @@ export function registerDaemonCommand(program) {
       agents daemon services
 
       # Machine-readable — additive: also carries the pre-existing
-      # secretsBroker/browserIpc hosted-socket fields
+      # secretsBroker (reachability-only probe, PHNX-3989)/browserIpc
+      # hosted-socket fields
       agents daemon services --json
 
       # Just the enable/disable metadata, no health probe
       agents daemon services list
 
       # Toggle or restart live — no daemon restart for a supervisor-managed
-      # service (secrets-broker, browser-ipc, account-state, session-index)
-      agents daemon services disable secrets-broker
-      agents daemon services enable secrets-broker
-      agents daemon services restart secrets-broker
+      # service (browser-ipc, account-state, session-index)
+      agents daemon services disable browser-ipc
+      agents daemon services enable browser-ipc
+      agents daemon services restart browser-ipc
     `,
         notes: `
       A service disabled at daemon boot is normally not registered on the

package/dist/commands/doctor.js

@@ -24,7 +24,7 @@ import { resolveAgentTargets, AgentSpecError } from '../lib/agent-spec/index.js'
 import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { diffVersionResources, DOCTOR_ALL_KINDS, } from '../lib/doctor-diff.js';
 import { inspectDuplicateVersionHooks } from '../lib/hooks/install.js';
-import { inspectReservedAuthBundle } from '../lib/secrets/bundles.js';
+import { inspectReservedAuthBundle } from '../lib/secrets-policy.js';
 import { isVersionIsolated } from '../lib/installations/versions.js';
 import { computeDrift, checkSyncStatus, countOrphans, computeSourceBehind } from '../lib/drift.js';
 import { readAuthHealthCache, summarizeHostAuth } from '../lib/auth-health.js';
@@ -35,13 +35,39 @@ import { listCliStatus, listCliStatusAsync } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
 import { auditWindowsSshEnrollment, diagnoseWindowsSshFailure } from '../lib/devices/windows-ssh-enrollment.js';
-import { scanUserRcFiles, masterPassphraseInEnv } from '../lib/secrets/rc-hygiene.js';
+import { scanUserRcFilesSync, masterPassphraseInEnvSync, isSecretsTransportError, } from '../lib/secrets-client.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
 import { detectAgentsBinaryShadows } from '../lib/binary-shadow.js';
 import * as fs from 'fs';
 const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
 // ─── overview mode (no target) ────────────────────────────────────────────────
+// doctor is the umbrella diagnostic and must never crash on one subsystem
+// (§Diagnostic command taxonomy). The standalone secrets CLI being absent from
+// PATH is a routine, expected state on a box that hasn't installed it — not a
+// reason to abort the whole report — so these two checks degrade to "nothing to
+// report" on a transport error and let every other finding still print. A data
+// error the standalone actually answered with must still surface.
+function scanUserRcFiles() {
+    try {
+        return scanUserRcFilesSync();
+    }
+    catch (error) {
+        if (isSecretsTransportError(error))
+            return [];
+        throw error;
+    }
+}
+function masterPassphraseInEnv() {
+    try {
+        return masterPassphraseInEnvSync();
+    }
+    catch (error) {
+        if (isSecretsTransportError(error))
+            return false;
+        throw error;
+    }
+}
 function collapseWhitespace(s) {
     return s.replace(/\s+/g, ' ').trim();
 }