@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/commands/exec.js

@@ -843,6 +843,23 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             console.error(chalk.red(`Invalid account picker target: ${agentSpec}. Use agents run <agent>@.`));
             process.exit(1);
         }
+        // Peel `#name` off before --device dispatch so the selector rides the hop
+        // unchanged and the peer resolves ITS slot (PHNX-3940 T5). The later local
+        // parse is idempotent when the values match.
+        {
+            const labelParts = normalizedAgentSpec.split('#');
+            if (labelParts.length > 2 || labelParts[1] === '') {
+                console.error(chalk.red(`Invalid account label in '${normalizedAgentSpec}'.`));
+                process.exit(1);
+            }
+            const specAccountLabel = labelParts[1];
+            if (specAccountLabel && options.account && specAccountLabel !== options.account) {
+                console.error(chalk.red(`Account '${specAccountLabel}' from the agent spec conflicts with --account '${options.account}'.`));
+                process.exit(1);
+            }
+            if (specAccountLabel)
+                options.account = specAccountLabel;
+        }
         // Hard-deprecated harnesses cannot be run — point the user at the successor.
         const runBaseAgentName = normalizedAgentSpec.split('#')[0].split('@')[0];
         const runBaseAgentId = resolveAgentName(runBaseAgentName);
@@ -1130,11 +1147,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             // with an actionable hint instead of hard-failing the run (F5).
             if (netMode === 'tailscale') {
                 const { pickTailscaleBundleFromList } = await import('../lib/crabbox/cli.js');
-                const { listBundles } = await import('../lib/secrets/bundles.js');
+                const { listBundles } = await import('../lib/secrets-client.js');
                 let hasKey = !!process.env.CRABBOX_TAILSCALE_AUTH_KEY;
                 if (!hasKey) {
                     try {
-                        hasKey = !!pickTailscaleBundleFromList(listBundles());
+                        hasKey = !!pickTailscaleBundleFromList(await listBundles());
                     }
                     catch {
                         hasKey = false;
@@ -1800,12 +1817,16 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             }
             process.exit(resumeExit);
         }
-        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, readProfile, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveHostSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, formatNoVerifiedUsageError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
+        const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, implicitModeFor, headlessPlanStallCommand, nativeResume, resolveInteractive, inferredInteractiveWithoutTty }, { ALL_AGENT_IDS, ACCOUNT_INSPECTION_AGENT_IDS, agentLabel, supportsAccountInspection }, { profileExists, readProfile, resolveProfileForRun }, 
+        // Engine DATA ops resolve through the standalone `secrets` process client
+        // (PHNX-3989); the agents-owned `bundle@host` policy helpers stay in agents-cli.
+        { readAndResolveBundleEnv, describeBundle, remoteResolveEnv }, { assertRemoteBundleFlagsUnsupported, splitBundleRef, resolveSecretsContextForRun }, { resolveHostSshTarget }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES, collectHarnessCandidates, pickHarnessWeighted, classifyHarnessCandidates, formatHarnessPickBanner, formatNoHealthyHarnessError, formatNoHealthyAccountError, formatNoVerifiedUsageError, signInRecoverableCandidates }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents, ensureSubagentDispatchTool }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports, capableAgents }, { shareRuntimeEnv },] = await Promise.all([
             import('../lib/exec.js'),
             import('../lib/agents.js'),
             import('../lib/profiles.js'),
-            import('../lib/secrets/bundles.js'),
-            import('../lib/secrets/remote.js'),
+            import('../lib/secrets-client.js'),
+            import('../lib/secrets-policy.js'),
+            import('../lib/hosts/credential-transport.js'),
             import('../lib/accounting/rotate.js'),
             import('../lib/installations/versions.js'),
             import('../lib/plugins/plugins.js'),
@@ -1844,6 +1865,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
         let profileEnv;
         let accountEnv;
         let accountConfigVersion;
+        let execHome;
         let profileProvider;
         let fromProfile = false;
         let profileName;
@@ -2169,6 +2191,10 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 if (!selected)
                     return;
                 version = selected.version;
+                if (selected.nativeAccount)
+                    options.account = selected.nativeAccount;
+                if (selected.slotDir)
+                    execHome = selected.slotDir;
                 if (!options.quiet) {
                     const identity = selected.accountLabel || 'signed-in account';
                     process.stderr.write(chalk.gray(`[agents] selected ${identity} · ${agent}@${selected.version} for this run\n`));
@@ -2204,35 +2230,49 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 process.exit(1);
             }
             if (spawnAccount.kind === 'native') {
-                // A native login is owned by the harness and read from its own home —
-                // it cannot be forwarded to another machine, and no secret/env is
-                // injected. Fail closed for a remote target.
+                // `#name` / `--account` on a --device run is forwarded unchanged at
+                // dispatch time; the peer resolves ITS slot. This block is local-only.
                 const remoteTarget = options.host || options.device;
-                if (remoteTarget) {
-                    console.error(chalk.red(`Account '${spawnAccount.name}' is a device-local ${spawnAccount.agent} login and cannot be forwarded to '${remoteTarget}'. Sign in on that device and name the login there.`));
-                    process.exit(1);
-                }
-                const { CONFIG_ENV_ISOLATED_AGENTS } = await import('../lib/installations/shims.js');
-                if (!CONFIG_ENV_ISOLATED_AGENTS.includes(agent)) {
-                    console.error(chalk.red(`${agent} cannot select native accounts independently of its installed version.`));
-                    process.exit(1);
-                }
-                const { resolveAccountVersion } = await import('../lib/accounting/rotate.js');
-                const { nativeAccountHome } = await import('../lib/account-registry.js');
-                const { readMeta } = await import('../lib/state.js');
-                accountConfigVersion = await resolveAccountVersion(agent, spawnAccount.identityKey, nativeAccountHome(spawnAccount.id, readMeta())) ?? undefined;
-                if (!accountConfigVersion) {
-                    console.error(chalk.red(`No installed ${spawnAccount.agent} version is signed in as the identity labeled '${spawnAccount.name}'. Sign in as that identity, or label a different account.`));
-                    process.exit(1);
+                if (!remoteTarget) {
+                    const { adoptedConfigPointsAtHome, adoptedSymlinkMismatchError, isSymlinkAdoptedHarness, resolveNativeSpawnHome, symlinkAdoptedAccountError, } = await import('../lib/exec-account-home.js');
+                    const { readMeta } = await import('../lib/state.js');
+                    const meta = readMeta();
+                    if (isSymlinkAdoptedHarness(agent)) {
+                        const defaultName = meta.accounts?.defaults?.[agent];
+                        if (spawnAccount.name !== defaultName) {
+                            console.error(chalk.red(symlinkAdoptedAccountError(agent, spawnAccount.name, defaultName)));
+                            process.exit(1);
+                        }
+                    }
+                    try {
+                        const resolved = await resolveNativeSpawnHome(agent, spawnAccount, meta);
+                        if (isSymlinkAdoptedHarness(agent) && !adoptedConfigPointsAtHome(agent, resolved.execHome)) {
+                            console.error(chalk.red(adoptedSymlinkMismatchError(agent, spawnAccount.name, resolved.execHome)));
+                            process.exit(1);
+                        }
+                        execHome = resolved.execHome;
+                        if (resolved.source === 'legacy-home') {
+                            accountConfigVersion = resolved.label;
+                            // A leftover version-labeled home is both the spawn HOME and
+                            // the account's installation — the pre-T5 `resolveAccountVersion`
+                            // behavior. An explicit `@<label>` still controls the binary.
+                            if (!version && !fromProfile && resolved.label)
+                                version = resolved.label;
+                        }
+                    }
+                    catch (err) {
+                        console.error(chalk.red(err.message));
+                        process.exit(1);
+                    }
+                    // Slot / provisioned: binary comes from the one managed install unless `@<label>` pins it.
+                    if (!version && !fromProfile) {
+                        const { ensureHarnessInstallation } = await import('../lib/installations/store.js');
+                        const { installation } = await ensureHarnessInstallation(agent);
+                        version = installation.label;
+                    }
+                    if (!options.quiet)
+                        process.stderr.write(chalk.gray(`[agents] account '${spawnAccount.name}' · ${agent}\n`));
                 }
-                // An account-only run executes the account's own stable installation.
-                // This keeps its model/mode configuration and binary update policy
-                // together. An explicit installation or profile still controls the
-                // executable independently; configVersion continues to select auth.
-                if (!version && !fromProfile)
-                    version = accountConfigVersion;
-                if (!options.quiet)
-                    process.stderr.write(chalk.gray(`[agents] account '${spawnAccount.name}' · ${agent}\n`));
             }
             else {
                 accountEnv = spawnAccount.env;
@@ -2713,10 +2753,12 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                         authedViaSetupToken = resolveClaudeSetupToken(getVersionHomePath('claude', version)) !== null;
                     }
                     if (!info.signedIn && !authedViaSetupToken) {
-                        const { connectSupported } = await import('../lib/accounts/connect.js');
-                        const hint = connectSupported(agent)
-                            ? `agents accounts connect ${agent}${spawnAccount?.kind === 'native' ? ` ${spawnAccount.name}` : ''}`
-                            : loginHint(agent);
+                        const { addSupported } = await import('../lib/accounts/add.js');
+                        const hint = spawnAccount?.kind === 'native'
+                            ? `agents accounts login ${agent}#${spawnAccount.name}`
+                            : addSupported(agent)
+                                ? `agents accounts add ${agent} <name>`
+                                : loginHint(agent);
                         process.stderr.write(chalk.yellow(`${agent} looks logged out — sign in with: ${hint}. Launching anyway...\n`));
                     }
                 }
@@ -2805,6 +2847,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             ? options.secretsKeys.split(',').map((k) => k.trim()).filter(Boolean)
             : undefined;
         let secretsEnv = {};
+        // Resource-profile scoping (CTX-1): agents-cli computes which bundle
+        // names the active profile allows and forwards it as the client's
+        // `allowedBundles` on every local resolution — the standalone has no
+        // concept of a profile. undefined (no active profile) is full trust.
+        const secretsContext = await resolveSecretsContextForRun(agent);
         for (const bundleRef of options.secrets) {
             try {
                 const { bundle: bundleName, host } = splitBundleRef(bundleRef);
@@ -2822,7 +2869,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     secretsEnv = { ...secretsEnv, ...bundleEnv };
                 }
                 else {
-                    const { bundle, env: bundleEnv } = readAndResolveBundleEnv(bundleName, {
+                    const { bundle, env: bundleEnv } = await readAndResolveBundleEnv(bundleName, {
                         caller: `agent ${agent}`,
                         agent,
                         keys: secretsKeysSubset,
@@ -2834,8 +2881,8 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                         // isHeadlessSecretsContext() left `--interactive` launches (the watchdog's
                         // `agents run auto --interactive`) able to prompt, piling up helper sheets.
                         agentOnly: true,
-                    });
-                    const entries = describeBundle(bundle);
+                    }, secretsContext);
+                    const entries = await describeBundle(bundle, secretsContext);
                     const counts = {};
                     for (const e of entries) {
                         counts[e.kind] = (counts[e.kind] || 0) + 1;
@@ -2881,6 +2928,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             harnessName: profileName,
             version,
             configVersion: accountConfigVersion,
+            execHome,
             prompt,
             interactive: options.interactive || forceInteractive,
             mode: requestedMode,

package/dist/commands/fleet-capture.js

@@ -15,7 +15,7 @@ import * as yaml from 'yaml';
 import { loadDevices } from '../lib/devices/registry.js';
 import { readMeta, updateMeta, getDevicePinsPath } from '../lib/state.js';
 import { machineId } from '../lib/machine-id.js';
-import { listBundles } from '../lib/secrets/bundles.js';
+import { listBundles, SecretsClientError } from '../lib/secrets-client.js';
 import { listJobs } from '../lib/scheduling/routines.js';
 import { captureFleet } from '../lib/fleet/capture.js';
 /** Read THIS machine's pins file into `name -> [id@latest]`. Only used with
@@ -37,6 +37,25 @@ function agentsFromPins(names) {
     const ids = pins?.agents ? Object.keys(pins.agents) : [];
     return ids.length > 0 ? { [self]: ids.map((id) => `${id}@latest`) } : {};
 }
+/**
+ * The names to snapshot into `fleet.secretsBundles` — best-effort. Capture's
+ * primary job (device/agent/routine snapshot) is unrelated to secrets, so a
+ * missing standalone `secrets` install (DIST-1: no fallback engine) degrades
+ * this ONE optional field to empty with a warning rather than failing the
+ * whole capture. A real store error still surfaces.
+ */
+async function captureSecretsBundleNames() {
+    try {
+        return (await listBundles()).map((b) => b.name);
+    }
+    catch (err) {
+        if (err instanceof SecretsClientError && err.code === 'SECRETS_BIN_MISSING') {
+            console.error(chalk.yellow('warning: standalone `secrets` CLI not installed — capturing with no secrets bundles.'));
+            return [];
+        }
+        throw err;
+    }
+}
 async function runCapture(opts) {
     const meta = readMeta();
     // Roster: every registered device name.
@@ -68,7 +87,7 @@ async function runCapture(opts) {
         // Browser profiles are intentionally NOT captured — the central `browser:`
         // block already syncs via the repo, and its ssh:// endpoints can carry
         // `user@host`, which must never be copied into the fleet: block.
-        secretsBundles: listBundles().map((b) => b.name),
+        secretsBundles: await captureSecretsBundleNames(),
         routines: listJobs().map((j) => j.name),
     };
     // Discovery decisions and dismissals are device-scoped now (PHNX-3315): they

package/dist/commands/harness-wizard.js

@@ -29,7 +29,7 @@
 import chalk from 'chalk';
 import { baseUrlEnvKeyForHost, authEnvKeyForHost, modelEnvKeyForHost, validateProfileName, listProfiles, } from '../lib/profiles.js';
 import { listPresets, getPreset } from '../lib/profiles-presets.js';
-import { listBundles } from '../lib/secrets/bundles.js';
+import { listBundles } from '../lib/secrets-client.js';
 import { AGENTS, ALL_AGENT_IDS, isSelfUpdatingAgent, resolveAgentName } from '../lib/agents.js';
 import { readAccountRegistry } from '../lib/account-registry.js';
 /**
@@ -127,7 +127,7 @@ function knownProviders() {
  * is today's behavior, lifted verbatim; RUSH-2220 enriches the bundle browse.
  */
 async function askKeySource(io, draft, provider) {
-    const bundles = listBundles();
+    const bundles = await listBundles();
     const source = bundles.length > 0
         ? await io.select({
             message: `How should '${provider}' get its key?`,

package/dist/commands/lease.js

@@ -11,8 +11,7 @@ import chalk from 'chalk';
 import { showUrl } from '../lib/open-url.js';
 import { crabboxList, crabboxStop, reapSafeOrphans, reapOrphans, setLeaseSecretsBundle } from '../lib/crabbox/cli.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-import { bundleExists, readBundle, writeBundle, keychainRef, bundleItemStore } from '../lib/secrets/bundles.js';
-import { secretsKeychainItem } from '../lib/secrets/index.js';
+import { bundleExists, keychainRef, readBundle, secretsKeychainItem, writeBundleWithItems } from '../lib/secrets-client.js';
 function fmtIdle(box) {
     if (box.lastTouchedAt === null)
         return 'idle ?';
@@ -108,13 +107,11 @@ async function captureTailscaleAuthKey() {
         console.error(chalk.dim('Skipped Tailscale setup — public-IP leases only.'));
         return;
     }
-    const bundle = bundleExists(TAILSCALE_BUNDLE)
-        ? readBundle(TAILSCALE_BUNDLE)
+    const bundle = (await bundleExists(TAILSCALE_BUNDLE))
+        ? await readBundle(TAILSCALE_BUNDLE)
         : { name: TAILSCALE_BUNDLE, description: 'Tailscale ephemeral auth key for crabbox tailnet leases', vars: {} };
-    const store = bundleItemStore(bundle.backend);
-    store.set(secretsKeychainItem(TAILSCALE_BUNDLE, TAILSCALE_KEY), key);
     bundle.vars[TAILSCALE_KEY] = keychainRef(TAILSCALE_KEY);
-    writeBundle(bundle);
+    await writeBundleWithItems(bundle, new Map([[secretsKeychainItem(TAILSCALE_BUNDLE, TAILSCALE_KEY), key]]));
     console.error(chalk.green(`✔ Stored Tailscale auth key in keychain bundle '${TAILSCALE_BUNDLE}'.`));
     console.error(chalk.dim('  Add --tailscale to a lease (reuse defaults to it) to reach the box over your tailnet.'));
 }
@@ -176,13 +173,11 @@ export async function runLeaseSetup(opts = {}) {
             else
                 spinner.succeed('Token valid — Hetzner API reachable.');
             // Store into the `hetzner.com` keychain bundle (mirrors writeSyncBundle).
-            const bundle = bundleExists(HETZNER_BUNDLE)
-                ? readBundle(HETZNER_BUNDLE)
+            const bundle = (await bundleExists(HETZNER_BUNDLE))
+                ? await readBundle(HETZNER_BUNDLE)
                 : { name: HETZNER_BUNDLE, description: 'Hetzner Cloud API token for crabbox leases', vars: {} };
-            const store = bundleItemStore(bundle.backend);
-            store.set(secretsKeychainItem(HETZNER_BUNDLE, HCLOUD_KEY), token);
             bundle.vars[HCLOUD_KEY] = keychainRef(HCLOUD_KEY);
-            writeBundle(bundle);
+            await writeBundleWithItems(bundle, new Map([[secretsKeychainItem(HETZNER_BUNDLE, HCLOUD_KEY), token]]));
             setLeaseSecretsBundle(HETZNER_BUNDLE);
             console.error(chalk.green(`\n✔ Stored in keychain bundle '${HETZNER_BUNDLE}' and set as the default lease provider.`));
             console.error(chalk.dim('  Run `agents run <agent> "…" --lease` — no env var, no flag needed.'));

package/dist/commands/profiles.d.ts

@@ -38,8 +38,8 @@ export interface AddProfileOptions {
  *
  * Reads the bundle value via {@link getKeychainToken} — this pops Touch ID on
  * macOS once, for that bundle-namespaced item (`agents-cli.secrets.*`, gated by
- * `keychainItemRequiresUserPresence` in `../lib/secrets/index.ts`) — then writes
- * it to `keychainItemName(provider)`, a plain `agents-cli.<provider>.token`
+ * the standalone's user-presence rule for `agents-cli.secrets.*` items) — then writes
+ * it to `profileKeychainItem(provider)`, a plain `agents-cli.<provider>.token`
  * item. That item matches neither the `agents-cli.secrets.` nor
  * `agents-cli.bundles.` prefix, so every later read of the harness's own key is
  * silent — no repeat Touch ID prompt.

package/dist/commands/profiles.js

@@ -10,9 +10,7 @@ import chalk from 'chalk';
 import { readStdinSync } from '../lib/format.js';
 import { writeProfile, profileFromPreset, profileFromHostModel, baseUrlEnvKeyForHost, authEnvKeyForHost, validateProfileName, profileExists, } from '../lib/profiles.js';
 import { getPreset, listPresets } from '../lib/profiles-presets.js';
-import { hasKeychainToken, keychainItemName, setKeychainToken, getKeychainToken, } from '../lib/secrets/profiles.js';
-import { parseBundleValue, secretsKeychainItem } from '../lib/secrets/index.js';
-import { readBundle } from '../lib/secrets/bundles.js';
+import { getKeychainToken, hasKeychainToken, isSecretsClientError, parseBundleValue, profileKeychainItem, readBundle, secretsKeychainItem, setKeychainToken, } from '../lib/secrets-client.js';
 import { isInteractiveTerminal } from './utils.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
 import { findAccount } from '../lib/account-registry.js';
@@ -28,7 +26,7 @@ export function buildProfileFromCollection(name, preset, collected, version) {
         env: { ...preset.env, ...collected },
         auth: {
             envVar: preset.authEnvVar,
-            keychainItem: keychainItemName(preset.provider),
+            keychainItem: profileKeychainItem(preset.provider),
         },
         authOptional: preset.authOptional,
         description: preset.description,
@@ -47,8 +45,8 @@ async function promptForSecret(message) {
 /** Read all available data from stdin synchronously, trimmed. */
 /** Ensure a provider API key exists in keychain, prompting or reading stdin if missing. */
 export async function ensureProviderToken(provider, signupUrl, fromStdin) {
-    const item = keychainItemName(provider);
-    if (hasKeychainToken(item)) {
+    const item = profileKeychainItem(provider);
+    if (await hasKeychainToken(item)) {
         return;
     }
     let token;
@@ -62,7 +60,7 @@ export async function ensureProviderToken(provider, signupUrl, fromStdin) {
         const hint = signupUrl ? ` (get one at ${signupUrl})` : '';
         token = await promptForSecret(`Enter API key for ${provider}${hint}`);
     }
-    setKeychainToken(item, token);
+    await setKeychainToken(item, token);
     console.log(chalk.green(`Stored in keychain: ${item}`));
 }
 /**
@@ -72,8 +70,8 @@ export async function ensureProviderToken(provider, signupUrl, fromStdin) {
  *
  * Reads the bundle value via {@link getKeychainToken} — this pops Touch ID on
  * macOS once, for that bundle-namespaced item (`agents-cli.secrets.*`, gated by
- * `keychainItemRequiresUserPresence` in `../lib/secrets/index.ts`) — then writes
- * it to `keychainItemName(provider)`, a plain `agents-cli.<provider>.token`
+ * the standalone's user-presence rule for `agents-cli.secrets.*` items) — then writes
+ * it to `profileKeychainItem(provider)`, a plain `agents-cli.<provider>.token`
  * item. That item matches neither the `agents-cli.secrets.` nor
  * `agents-cli.bundles.` prefix, so every later read of the harness's own key is
  * silent — no repeat Touch ID prompt.
@@ -106,7 +104,16 @@ export async function applyFromSecrets(profile, spec, explicitAuthProvider, opts
     const sep = spec.indexOf(':');
     const bundleName = sep === -1 ? spec : spec.slice(0, sep);
     const requestedKey = sep === -1 ? undefined : spec.slice(sep + 1);
-    const bundle = readBundle(bundleName);
+    let bundle;
+    try {
+        bundle = await readBundle(bundleName);
+    }
+    catch (err) {
+        // The standalone reports only a code; name the bundle the user asked for.
+        if (!isSecretsClientError(err, 'NOT_FOUND'))
+            throw err;
+        throw new Error(`Secrets bundle '${bundleName}' not found. List bundles with 'agents secrets list'.`);
+    }
     const keys = Object.keys(bundle.vars);
     const key = requestedKey ?? (keys.length === 1 ? keys[0] : undefined);
     if (!key) {
@@ -123,7 +130,7 @@ export async function applyFromSecrets(profile, spec, explicitAuthProvider, opts
         value = parsed.literal;
     }
     else if (parsed.ref.provider === 'keychain') {
-        value = getKeychainToken(secretsKeychainItem(bundle.name, parsed.ref.value));
+        value = await getKeychainToken(secretsKeychainItem(bundle.name, parsed.ref.value));
     }
     else {
         throw new Error(`Bundle '${bundleName}' key '${key}' is a '${parsed.ref.provider}:' reference, not a keychain-backed secret — --from-secrets only copies keychain-backed values.`);
@@ -134,8 +141,8 @@ export async function applyFromSecrets(profile, spec, explicitAuthProvider, opts
             `on a fork, so it never silently overwrites the source harness's shared keychain item.`);
     }
     const provider = explicitAuthProvider || (profile.auth ? profile.provider : undefined) || bundleName;
-    const item = keychainItemName(provider);
-    setKeychainToken(item, value);
+    const item = profileKeychainItem(provider);
+    await setKeychainToken(item, value);
     if (!profile.auth) {
         const envVar = authEnvKeyForHost(profile.host.agent);
         if (!envVar) {

package/dist/commands/repo.js

@@ -64,7 +64,7 @@ async function publishUserRepoAccountState(provisionAuth) {
     if (usage.error)
         console.error(chalk.yellow(`Usage snapshot: ${usage.error}`));
     if (provisionAuth) {
-        const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+        const { syncReservedAuthBundle } = await import('../lib/secrets-policy.js');
         const auth = await syncReservedAuthBundle();
         if (auth.pushed.length > 0)
             console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
@@ -72,7 +72,7 @@ async function publishUserRepoAccountState(provisionAuth) {
             console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
         return;
     }
-    const { publishReservedAuthVerdict } = await import('../lib/secrets/reserved-sync.js');
+    const { publishReservedAuthVerdict } = await import('../lib/secrets-policy.js');
     const auth = await publishReservedAuthVerdict();
     if (auth.error)
         console.error(chalk.yellow(`Auth verdict: ${auth.device}: ${auth.error}`));
@@ -85,7 +85,7 @@ async function consumeUserRepoAccountState() {
         console.log(chalk.gray(`Usage snapshot: merged ${usage.merged} row(s) from ${usage.sources.join(', ')}`));
     for (const err of usage.errors)
         console.error(chalk.yellow(`Usage snapshot: ${err.device}: ${err.message}`));
-    const { syncReservedAuthBundle } = await import('../lib/secrets/reserved-sync.js');
+    const { syncReservedAuthBundle } = await import('../lib/secrets-policy.js');
     const auth = await syncReservedAuthBundle();
     if (auth.pushed.length > 0)
         console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));

package/dist/commands/run-account-picker.d.ts

@@ -12,7 +12,7 @@ export interface RunAccountChoice {
      */
     signInRequired: boolean;
 }
-/** One named account row for `agents accounts switch` (reuses this picker's layout). */
+/** One named account row for `agents accounts default` (reuses this picker's layout). */
 export interface SwitchAccountRow {
     accountName: string;
     kind: 'provider' | 'native';
@@ -25,8 +25,8 @@ export declare function formatAccountLimits(candidate: RotateCandidate): string;
 /** Build aligned picker rows with usable accounts first and unsafe rows disabled. */
 export declare function buildRunAccountChoices(candidates: RotateCandidate[], globalDefault: string | null): RunAccountChoice[];
 /**
- * Aligned picker rows for `accounts switch`. Same columns as the run picker
- * (identity, status, limits) but the value is the named account to set-default.
+ * Aligned picker rows for `accounts default`. Same columns as the run picker
+ * (identity, status, limits) but the value is the named account to make default.
  * Rows stay selectable: setting a default is not a launch.
  */
 export declare function buildSwitchAccountChoices(rows: SwitchAccountRow[]): RunAccountChoice[];

package/dist/commands/run-account-picker.js

@@ -4,6 +4,7 @@ import { agentLabel } from '../lib/agents.js';
 import { loginHint } from '../lib/signin-badge.js';
 import { collectRunCandidates, readinessFromCandidate, isSignInRecoverable, } from '../lib/accounting/rotate.js';
 import { compareVersions, getGlobalDefault } from '../lib/installations/versions.js';
+import { verdictLabel } from '../lib/auth-health.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 const CANCEL_SELECTION = '__agents_cancel_account_selection__';
 const WINDOW_ORDER = ['session', 'week', 'sonnet_week', 'month'];
@@ -65,28 +66,28 @@ export function buildRunAccountChoices(candidates, globalDefault) {
         const readiness = readinessFromCandidate(candidate);
         const disabled = disabledReason(candidate, readiness);
         const signInRequired = isSignInRecoverable(readiness);
-        const version = candidate.version === globalDefault
-            ? `${candidate.version} (default)`
-            : candidate.version;
-        // `revoked` is signed-in-but-rejected, so it reads as a re-login rather
-        // than "logged out"; every throttle is still a signed-in account.
-        const authReason = readiness.ready ? null : readiness.reason;
-        const status = authReason === 'revoked'
+        const account = candidate.nativeAccount
+            || candidate.accountLabel
+            || 'account unavailable';
+        const marked = candidate.version === globalDefault && !candidate.nativeAccount
+            ? `${account} (default)`
+            : account;
+        const verdict = !readiness.ready && readiness.reason === 'revoked'
             ? 'needs re-login'
-            : authReason === 'signed_out'
+            : !readiness.ready && readiness.reason === 'signed_out'
                 ? 'logged out'
-                : 'logged in';
+                : candidate.authVerdict
+                    ? verdictLabel(candidate.authVerdict).toLowerCase()
+                    : 'live';
         return {
             candidate,
-            account: candidate.accountLabel || 'account unavailable',
-            version,
-            status,
-            plan: candidate.usageSnapshot?.plan ?? candidate.plan ?? 'plan unavailable',
+            account: marked,
+            verdict,
             // An auth-blocked row shows what picking it DOES; its quota is moot until
             // there is a credential to spend it with.
-            limits: authReason === 'revoked'
+            limits: !readiness.ready && readiness.reason === 'revoked'
                 ? 'launch to re-authenticate'
-                : authReason === 'signed_out'
+                : !readiness.ready && readiness.reason === 'signed_out'
                     ? 'launch to sign in'
                     : formatAccountLimits(candidate),
             disabled,
@@ -107,23 +108,22 @@ export function buildRunAccountChoices(candidates, globalDefault) {
         return compareVersions(b.candidate.version, a.candidate.version);
     });
     const accountWidth = Math.max(0, ...rows.map((row) => row.account.length));
-    const versionWidth = Math.max(0, ...rows.map((row) => row.version.length));
-    const statusWidth = Math.max(0, ...rows.map((row) => row.status.length));
-    const planWidth = Math.max(0, ...rows.map((row) => row.plan.length));
+    const verdictWidth = Math.max(0, ...rows.map((row) => row.verdict.length));
     return rows.map((row) => ({
         name: [
             row.account.padEnd(accountWidth),
-            row.version.padEnd(versionWidth),
-            row.status.padEnd(statusWidth),
-            row.plan.padEnd(planWidth),
+            row.verdict.padEnd(verdictWidth),
             row.limits,
         ].join('  '),
-        value: row.candidate.version,
+        value: row.candidate.nativeAccount ?? row.candidate.version,
         disabled: row.disabled,
         ready: row.ready,
         signInRequired: row.signInRequired,
     }));
 }
+function candidatePickerValue(candidate) {
+    return candidate.nativeAccount ?? candidate.version;
+}
 function switchRowStatus(row) {
     if (!row.candidate) {
         return {
@@ -151,8 +151,8 @@ function switchRowStatus(row) {
     return { status, limits, ready: readiness.ready };
 }
 /**
- * Aligned picker rows for `accounts switch`. Same columns as the run picker
- * (identity, status, limits) but the value is the named account to set-default.
+ * Aligned picker rows for `accounts default`. Same columns as the run picker
+ * (identity, status, limits) but the value is the named account to make default.
  * Rows stay selectable: setting a default is not a launch.
  */
 export function buildSwitchAccountChoices(rows) {
@@ -184,12 +184,11 @@ export function buildSwitchAccountChoices(rows) {
 export async function pickSwitchAccount(agent, rows) {
     if (!isInteractiveTerminal()) {
         requireInteractiveSelection(`Selecting a ${agentLabel(agent)} account`, [
-            `agents accounts switch ${agent} <account>`,
-            `agents accounts set-default ${agent} <account>`,
+            `agents accounts default ${agent} <account>`,
         ]);
     }
     if (rows.length === 0) {
-        throw new Error(`No named accounts for ${agent}. Add one with 'agents accounts add <name> --provider <p>' or 'agents accounts name ${agent}@<version> <name>'.`);
+        throw new Error(`No named accounts for ${agent}. Add one with 'agents accounts add ${agent} [name]'.`);
     }
     const choices = buildSwitchAccountChoices(rows).map(({ ready: _ready, signInRequired: _signInRequired, ...choice }) => choice);
     try {
@@ -292,16 +291,16 @@ export async function pickRunAccountCandidate(agent) {
         });
     }
     try {
-        const version = await select({
+        const picked = await select({
             message: needsSignIn
                 ? `Select a ${agentLabel(agent)} account for this run (pick a logged-out one to sign in):`
                 : `Select a ${agentLabel(agent)} account for this run:`,
             choices: promptChoices,
             loop: false,
         });
-        if (version === CANCEL_SELECTION)
+        if (picked === CANCEL_SELECTION)
             return null;
-        return candidates.find((candidate) => candidate.version === version) ?? null;
+        return candidates.find((candidate) => candidatePickerValue(candidate) === picked) ?? null;
     }
     catch (err) {
         if (isPromptCancelled(err))

package/dist/commands/secrets-passthrough.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `agents secrets` — thin passthrough to the standalone `secrets` CLI
+ * (PHNX-3989, DIST-1). Every bundle/keychain/vault operation now lives in
+ * `@phnx-labs/secrets-cli`, not in this repo; this command re-declares no
+ * subcommand or flag of its own. `agents secrets <anything>` execs the
+ * installed executable with the same argv, `SECRETS_HOME` defaulted to this
+ * box's existing store (`buildServeEnv`, matching the process client's own
+ * default so an interactive `secrets list` and an injected `readBundle` see
+ * the same store), and `SECRETS_SCOPE`/`SECRETS_CONTEXT` passed through
+ * unmodified from the ambient environment — this is the operator's own
+ * terminal, not an injected agent exec, so there is no separate scope to
+ * compute here (that stays in `lib/exec.ts` for the run/inject path).
+ *
+ * A missing executable fails loud with install guidance — no fallback to the
+ * retired in-repo engine (`commands/secrets.ts` and its siblings), which stays
+ * in the tree, unregistered, until every consumer has moved off it (tasks.md
+ * item 7).
+ */
+import type { Command } from 'commander';
+export declare function registerSecretsCommands(program: Command): void;