@phnx-labs/agents-cli 1.22.9 → 1.22.11

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 1.22.11
+
+- **`--blocked` iMessage notifications are now phone-actionable.** The forwarded message dropped the block's `--option`s, `--default`, and timeout and instead showed `agents focus <id>` — a CLI command that is useless on a phone. It now shows the choices (`Options: publish / wait`) and the safe-default fallback (`Default in 15 min: wait`) and omits the `agents focus` line, so a `--blocked` post that carries a `--default` self-resolves when the owner can't reply. Source: `apps/cli/src/lib/feed-broadcast.ts`.
+
+- Move operational event logs from the git-backed `~/.agents/` root into `~/.agents/.history/events/`, including existing numbered gzip archives.
+
+- **`agents projects` is out of beta — no `agents beta enable projects` needed.**
+  The command tree (list / add / import / status / link / …) is always registered
+  now; `projects` is dropped from the beta registry (`ALL_BETA_FEATURES`,
+  `BetaFeatureName`) and the `preAction` beta gate is removed. Any lingering
+  `beta.enabled: [projects]` entry is harmlessly ignored, and `agents beta
+  enable/disable projects` prints a friendly "graduated out of beta" note and
+  no-ops instead of erroring (so old scripts survive). Source:
+  `apps/cli/src/lib/beta.ts`, `apps/cli/src/lib/types.ts`,
+  `apps/cli/src/commands/beta.ts`, `apps/cli/src/commands/projects.ts`.
+
+- **`agents projects status` shows every project across the whole fleet by default;
+  scope it with `--device`/`--devices`.** The old `--fleet` flag is gone — status
+  now dials every registered device's workspace (presence, branch, drift) in one
+  parallel SSH round without being asked. `--device <name...>` (repeatable) or
+  `--devices a,b,c` narrows the fan-out to a subset; with no filter the whole fleet
+  is dialled. Reuses the shared `--host`/`--device` target resolution. Source:
+  `apps/cli/src/commands/projects.ts`.
+
+- **`scripts/release.sh` home-base hop: pass a single remote argv to `agents ssh`.** Multi-arg forms (`bash -lc '…'`) are joined without re-quoting by `wrapRemoteCommand`, so the remote `cd` never ran and publish failed with `fatal: not a git repository`. One shell string keeps the command intact. Source: `apps/cli/scripts/release.sh`.
+
+## 1.22.10
+
+- **Plugins package workflows (Phase 5 packaging slice).** A plugin’s `workflows/<name>/WORKFLOW.md` is discovered and resolved by `agents run <name>` with precedence project > user > plugin > extra > system — no separate install into `~/.agents/workflows/` required. Plugin inventory / resource groups list `workflows`. Source: `apps/cli/src/lib/workflows.ts`, `apps/cli/src/lib/plugins.ts`, `apps/cli/src/lib/resources/workflows.ts`.
+
+- **`scripts/release.sh` routes the home-base publish hop via `agents ssh`.** Plain `ssh mac-mini` fails host-key checks on headless Linux workers; `agents ssh` uses the devices registry and brokered credentials. Falls back to plain ssh only when `agents` is not on PATH. Source: `apps/cli/scripts/release.sh`.
+
+- **Touch ID is now raised in exactly one place — `agents secrets unlock`.** `agents secrets list`, `agents run <agent>`, `secrets get`/`export`/`view`, and every background read resolve from the secrets broker / durable session / no-ACL layer and never raise a biometric sheet; a locked keychain bundle fails with an actionable "run `agents secrets unlock <bundle>`" hint instead of prompting. The `AGENTS_SECRETS_NO_PROMPT` environment override and the "a human at a TTY, so prompting is fine" heuristic are deleted — the prompt decision is structural, not an ambient env var. The macOS keychain `list`/`list-synced` enumeration queries now pass `kSecUseAuthenticationUISkip` (enumeration itself was evaluating the biometry ACL, so `agents secrets list` prompted and silently dropped keychain bundles when the sheet was cancelled), and the one-time hash-rekey + metadata-ACL heal run only inside the single `unlock` sheet so nothing on the run/list path can storm. Source: `apps/cli/src/lib/secrets/keychain-helper.swift`, `apps/cli/src/lib/secrets/index.ts`, `apps/cli/src/lib/secrets/bundles.ts`, `apps/cli/src/lib/secrets/headless.ts`, `apps/cli/src/commands/secrets.ts`.
+- **The Factory VS Code extension (`swarm-ext`) no longer decrypts secrets or shells raw `ssh`.** Device health, reachability, and sync route every remote command through `agents ssh <host>` (broker-owned credentials, no prompt); the extension's own secret-resolution path (`resolveSecret`/`discoverSecretsReadCmd`/`extractCredentials`) is removed, so rendering the devices list never raises Touch ID. Source: `apps/factory/src/vscode/deviceHealth.vscode.ts`, `apps/factory/src/vscode/settings.vscode.ts`, `apps/factory/src/vscode/extension.ts`.
+
 ## 1.22.9
 
 - **`agents ssh auto` and `agents teams add --device auto` no longer reject with "Unknown device 'auto'" (RUSH-2185).** The `auto` affinity sentinel was a `run`-only preprocessing step (`applyDeviceAutoToOptions` in `smart-launch.ts`, wired only from `agents run`'s exec path) — every other `--host`/`--device` caller went straight to the shared resolver, which had no idea what `auto` meant and reported it as an unregistered device. `matchHost` (the one core every `--host`/`--device` caller shares) now resolves `auto` directly via the same `resolveDeviceAffinity` engine `run` uses, so `agents ssh`, `agents teams add`, and anything else routed through `matchHost`/`resolveHost` (including the generic `--host`/`--device` passthrough) pick a device the same way. `agents teams add --device auto` landing on the local machine now just runs the teammate locally, matching `run`'s "null pick = local" outcome; `agents ssh auto` refuses a local pick with a clear message instead of self-SSHing, since `agents ssh` exists to dial OUT to a remote box. Source: `apps/cli/src/lib/hosts/registry.ts`, `apps/cli/src/lib/devices/resolve-target.ts`, `apps/cli/src/commands/ssh.ts`, `apps/cli/src/commands/teams.ts`, `apps/cli/docs/00-concepts.md`, `apps/cli/docs/hosts.md`, `apps/cli/docs/teams.md`.
@@ -2908,10 +2943,8 @@
   `agentOnly` guard; and `isHeadlessSecretsContext` recognized the `headless` and
   `teams` runtimes but not `terminal`, which is what an interactive run sets. Agent
   launches now resolve broker-only and a locked bundle fails fast naming
-  `agents secrets unlock <bundle>`; `AGENTS_SECRETS_NO_PROMPT=1` is no longer needed
-  as a workaround. `agents secrets get/export/exec` typed in a **plain shell** still
-  prompts — it carries no `AGENTS_RUNTIME`, so the guard does not apply. Run beneath
-  an agent it refuses, because there the agent is the caller. This narrows the
+  `agents secrets unlock <bundle>`. Direct read commands use the same broker-only
+  path even from a plain shell; only an explicit unlock may authenticate. This narrows the
   agent-triggered approval added in RUSH-2032, which is unreleased.
 
 - **`release.sh` now borrows the npm token from a primary device when the local box

package/dist/commands/beta.js

@@ -2,17 +2,23 @@ import chalk from 'chalk';
 import { ALL_BETA_FEATURES, getBetaConfigLocation, getEnabledBetaFeatures, setBetaEnabled, } from '../lib/beta.js';
 const BETA_DESCRIPTIONS = {
     factory: 'Cloud-based agent dispatch via Rush Factory',
-    projects: 'Named multi-repo projects with a progress rollup (agents projects)',
 };
+// Features that used to be beta and are now always-on. `beta enable/disable` on
+// one of these is a friendly no-op, not an "Unknown beta feature" error — so
+// muscle memory and old bootstrap scripts survive the graduation.
+const GRADUATED_FEATURES = new Set(['projects']);
 function parseFeatures(values) {
     const valid = new Set(ALL_BETA_FEATURES);
-    const invalid = values.filter((value) => !valid.has(value));
-    if (invalid.length > 0) {
-        console.error(chalk.red(`Unknown beta feature: ${invalid.join(', ')}`));
+    for (const g of values.filter((v) => GRADUATED_FEATURES.has(v))) {
+        console.error(chalk.gray(`'${g}' has graduated out of beta — it is on by default; no action needed.`));
+    }
+    const unknown = values.filter((v) => !valid.has(v) && !GRADUATED_FEATURES.has(v));
+    if (unknown.length > 0) {
+        console.error(chalk.red(`Unknown beta feature: ${unknown.join(', ')}`));
         console.error(chalk.gray(`Valid features: ${ALL_BETA_FEATURES.join(', ')}`));
         process.exit(1);
     }
-    return values;
+    return values.filter((v) => valid.has(v));
 }
 export function registerBetaCommands(program) {
     const beta = program
@@ -43,16 +49,22 @@ Examples:
         .command('enable <features...>')
         .description('Enable one or more beta features.')
         .action((features) => {
-        const result = setBetaEnabled(parseFeatures(features), true);
-        console.log(chalk.green(`Enabled: ${features.join(', ')}`));
+        const parsed = parseFeatures(features);
+        if (parsed.length === 0)
+            return; // only graduated/no-op names
+        const result = setBetaEnabled(parsed, true);
+        console.log(chalk.green(`Enabled: ${parsed.join(', ')}`));
         console.log(chalk.gray(`Saved to ${result.path}`));
     });
     beta
         .command('disable <features...>')
         .description('Disable one or more beta features.')
         .action((features) => {
-        const result = setBetaEnabled(parseFeatures(features), false);
-        console.log(chalk.green(`Disabled: ${features.join(', ')}`));
+        const parsed = parseFeatures(features);
+        if (parsed.length === 0)
+            return; // only graduated/no-op names
+        const result = setBetaEnabled(parsed, false);
+        console.log(chalk.green(`Disabled: ${parsed.join(', ')}`));
         console.log(chalk.gray(`Saved to ${result.path}`));
     });
 }

package/dist/commands/browser.js

@@ -5,7 +5,7 @@ import { updateMeta } from '../lib/state.js';
 import { resolveActor } from '../lib/actor.js';
 import { loginsForProfile, profilesLoggedInto, serviceForUrl, loginsWithAccountsForProfile, accountsForProfile, credKeysForService, AUTH_SIGNATURES, } from '../lib/browser/login-detection.js';
 import { parseSecretRef } from '../lib/browser/secret-ref.js';
-import { readAndResolveBundleEnv, isHeadlessSecretsContext, bundleExists, readBundle, describeBundle } from '../lib/secrets/bundles.js';
+import { readAndResolveBundleEnv, bundleExists, readBundle, describeBundle } from '../lib/secrets/bundles.js';
 import { findBrowserPath, getPortOccupant, isLauncherScript } from '../lib/browser/chrome.js';
 import { listProfileCacheDirs, removeProfileCache, listAllProfileSnapshots, } from '../lib/browser/runtime-state.js';
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
@@ -1481,7 +1481,7 @@ function registerTaskCommands(browser) {
                 process.exit(1);
             }
             try {
-                const { env } = readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+                const { env } = readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key], keyMode: 'storage', agentOnly: true });
                 if (!(parsed.key in env)) {
                     console.error(`Key "${parsed.key}" not in bundle "${parsed.bundle}".`);
                     process.exit(1);

package/dist/commands/events.d.ts

@@ -1,7 +1,7 @@
 /**
  * `agents events` — read the unified event stream.
  *
- * One stream over BOTH operational events (`~/.agents/events.jsonl`: every
+ * One stream over BOTH operational events (`~/.agents/.history/events/events.jsonl`: every
  * `agents <module> <cmd>` invocation plus typed events like secrets access,
  * version installs) AND agent-semantic events (the per-session activity logs:
  * plans, PRs, worktrees, sub-agents, artifacts). Each is stamped with who ran

package/dist/commands/events.js

@@ -1,7 +1,7 @@
 /**
  * `agents events` — read the unified event stream.
  *
- * One stream over BOTH operational events (`~/.agents/events.jsonl`: every
+ * One stream over BOTH operational events (`~/.agents/.history/events/events.jsonl`: every
  * `agents <module> <cmd>` invocation plus typed events like secrets access,
  * version installs) AND agent-semantic events (the per-session activity logs:
  * plans, PRs, worktrees, sub-agents, artifacts). Each is stamped with who ran

package/dist/commands/projects.d.ts

@@ -1,8 +1,7 @@
 /**
  * `agents projects` — named, multi-repo projects and the progress
  * rollup. Definitions live in `~/.agents/projects/<name>.yaml` (see
- * `lib/projects.ts`); this registers the command tree over them. Beta-gated on
- * `isBetaEnabled('projects')`, mirroring `agents factory`.
+ * `lib/projects.ts`); this registers the command tree over them.
  *
  * The headline is `status`: instead of the vague per-agent activity line, it
  * rolls every session up by project (matched on cwd) into one card — agents by

package/dist/commands/projects.js

@@ -1,8 +1,7 @@
 /**
  * `agents projects` — named, multi-repo projects and the progress
  * rollup. Definitions live in `~/.agents/projects/<name>.yaml` (see
- * `lib/projects.ts`); this registers the command tree over them. Beta-gated on
- * `isBetaEnabled('projects')`, mirroring `agents factory`.
+ * `lib/projects.ts`); this registers the command tree over them.
  *
  * The headline is `status`: instead of the vague per-agent activity line, it
  * rolls every session up by project (matched on cwd) into one card — agents by
@@ -12,7 +11,6 @@ import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync, spawnSync } from 'child_process';
-import { betaEnableHint, isBetaEnabled } from '../lib/beta.js';
 import { setHelpSections } from '../lib/help.js';
 import { getMainRepoRoot } from '../lib/git.js';
 import { parseOwnerRepoFromRemote } from '../lib/registry.js';
@@ -437,25 +435,24 @@ warnWorkspaces = []) {
         console.log('');
 }
 export function registerProjectsCommands(program) {
-    const enabled = isBetaEnabled('projects');
     const projects = program
-        .command('projects', { hidden: !enabled })
+        .command('projects')
         .description('Named multi-repo projects with a progress rollup.');
     setHelpSections(projects, {
         examples: `
       agents projects import --from-linear  # the projects you actually track
       agents projects add rush --repo phnx-labs/rush --path apps/web
       agents projects list
-      agents projects status              # progress card for every project
+      agents projects status              # every project, across the whole fleet
       agents projects status rush         # one project (same body as view/show)
       agents projects view rush           # alias of status <name>
-      agents projects status --fleet      # + per-device workspace drift over SSH
+      agents projects status --device s0  # scope to one device (or --devices a,b,c)
       agents projects link rush --linear  # bind the Linear project (auto-suggest)
       agents run --project rush           # land an agent in the project
     `,
         notes: `
       Definitions are hand-editable YAML in ~/.agents/projects/ and sync across
-      machines with 'agents push/pull'. Enable with: agents beta enable projects.
+      machines with 'agents push/pull'.
 
       'import --from-factory' reads Factory's auto-detected registry, which
       guesses from checkouts on disk — it imports only 'high' confidence rows by
@@ -463,18 +460,6 @@ export function registerProjectsCommands(program) {
       with 'agents projects rm <name>'.
     `,
     });
-    projects.hook('preAction', (_thisCommand, actionCommand) => {
-        if (enabled)
-            return;
-        // `probe` is the peer half of `status --fleet`: it must answer whenever the
-        // binary carries it, even where the beta flag is off — a gated peer would
-        // look unreachable to every fleet member on a newer CLI.
-        if (actionCommand.name() === 'probe')
-            return;
-        console.error(chalk.red('agents projects is in beta.'));
-        console.error(chalk.gray(betaEnableHint('projects')));
-        process.exit(1);
-    });
     // ---- list ----
     projects
         .command('list')
@@ -553,6 +538,15 @@ export function registerProjectsCommands(program) {
         console.log(chalk.gray(`  ${target}`));
         console.log(chalk.gray(`  root ${def.root}${def.repo ? `  ·  repo ${def.repo}` : ''}`));
     });
+    /** Merge `--device a b` (variadic) and `--devices a,b,c` (comma list) into one
+     *  deduped device filter; undefined when neither was given (= whole fleet). */
+    function resolveDeviceFilter(device, devices) {
+        const merged = [
+            ...(device ?? []),
+            ...(devices ? devices.split(',').map((s) => s.trim()).filter(Boolean) : []),
+        ];
+        return merged.length ? [...new Set(merged)] : undefined;
+    }
     /** Print the YAML-side fields that sit under the shared card in `view` mode. */
     function printProjectDefinition(def, name) {
         console.log();
@@ -598,16 +592,16 @@ export function registerProjectsCommands(program) {
         }
         const windowDays = Math.max(1, Number.parseInt(opts.window ?? '7', 10) || 7);
         const nowMs = Date.now();
-        // --fleet: probe each shown def's workspace paths (root + repos[].path)
-        // locally and on every peer in one parallel SSH round, and widen the
-        // live-session rollup to the whole fleet via the existing sessions
-        // fan-out. Both are opt-in — they dial the fleet. `view` accepts the flag
-        // too so the two verbs stay interchangeable once a name is given.
-        const fleetTargets = opts.fleet ? [...new Set(defs.flatMap(workspaceTargetsForDef))] : [];
+        // Fleet is the default: probe each shown def's workspace paths (root +
+        // repos[].path) locally AND on every peer in one parallel SSH round, and
+        // widen the live-session rollup to the fleet via the sessions fan-out.
+        // `--device`/`--devices` scopes the remote fan-out to a subset; with no
+        // filter every registered device is dialled.
+        const fleetTargets = [...new Set(defs.flatMap(workspaceTargetsForDef))];
         let fleetWs = [];
         let fleetSkipped = [];
         let fleetSessions = [];
-        if (opts.fleet) {
+        {
             const self = machineId();
             fleetWs.push(...probeProjectWorkspaces(fleetTargets).map((s) => ({ ...s, host: self })));
             const [probeRes, activeRes] = await Promise.all([
@@ -615,11 +609,12 @@ export function registerProjectsCommands(program) {
                     ? gatherRemoteAgentsJson({
                         args: ['projects', 'probe', '--json', ...fleetTargets],
                         noFanoutEnv: PROJECTS_NO_FANOUT_ENV,
+                        hosts: opts.deviceFilter,
                         parse: parseRemoteProbe,
                         quiet: true,
                     })
                     : Promise.resolve({ items: [], deviceCount: 0, skipped: [] }),
-                gatherRemoteActive(undefined, { quiet: true }),
+                gatherRemoteActive(opts.deviceFilter, { quiet: true }),
             ]);
             fleetWs.push(...probeRes.items);
             fleetSkipped = probeRes.skipped;
@@ -636,17 +631,6 @@ export function registerProjectsCommands(program) {
             const targets = new Set(workspaceTargetsForDef(d));
             return fleetWs.filter((s) => targets.has(s.path));
         };
-        /** Local-only workspace probe for the warnings footer when --fleet is off. */
-        const localWsCache = new Map();
-        const localWsFor = (d) => {
-            const cached = localWsCache.get(d.name);
-            if (cached)
-                return cached;
-            const self = machineId();
-            const rows = probeProjectWorkspaces(workspaceTargetsForDef(d)).map((s) => ({ ...s, host: self }));
-            localWsCache.set(d.name, rows);
-            return rows;
-        };
         if (opts.json) {
             if (fleetSkipped.length > 0)
                 process.stderr.write(formatFleetSkippedNote(fleetSkipped));
@@ -677,7 +661,7 @@ export function registerProjectsCommands(program) {
                     lastArtifact: rem?.lastArtifact ?? null,
                     windowDays,
                     repos: [d.repo, ...(d.repos ?? []).map((r2) => r2.slug)].filter(Boolean),
-                    ...(opts.fleet ? { workspaces: fleetFor(d) } : {}),
+                    workspaces: fleetFor(d),
                 };
             }), null, 2));
             return;
@@ -685,10 +669,10 @@ export function registerProjectsCommands(program) {
         // Compact rollup shows the next milestone; `view` shows every declared one.
         const milestoneLimit = detail ? Number.POSITIVE_INFINITY : 1;
         for (const d of defs) {
-            renderCard(d, roll.get(d.name), remote.get(d.name), opts.fleet ? fleetFor(d) : undefined, linear.get(d.name), nowMs, milestoneLimit, focus.get(d.name) ?? [], detail, 
-            // Always feed workspace rows into the warnings footer — full fleet when
-            // --fleet, otherwise a local-only probe so behind/dirty is never silent.
-            opts.fleet ? fleetFor(d) : localWsFor(d));
+            renderCard(d, roll.get(d.name), remote.get(d.name), fleetFor(d), linear.get(d.name), nowMs, milestoneLimit, focus.get(d.name) ?? [], detail, 
+            // Always feed workspace rows into the warnings footer so behind/dirty
+            // is never silent.
+            fleetFor(d));
             if (detail)
                 printProjectDefinition(d, d.name);
         }
@@ -699,15 +683,23 @@ export function registerProjectsCommands(program) {
         .command('status [name]')
         .alias('view')
         .alias('show')
-        .description('Progress card for every project, or one named project (aliases: view, show). Named form also prints every milestone and the stored definition.')
+        .description('Progress card for every project across the whole fleet, or one named project (aliases: view, show). Named form also prints every milestone and the stored definition.')
         .option('--json', 'Machine-readable output')
         .option('--window <days>', 'Window for merged PRs, artifacts, and focus areas', '7')
         .option('--no-remote', 'Skip the GitHub and Linear lookups; faster, offline')
-        .option('--fleet', 'Also dial every fleet device for workspace presence, branch, and drift (one SSH per peer)')
-        .action(async (name, opts) => {
+        .option('--device <name...>', 'Scope fleet status to one or more devices (repeatable)')
+        .option('--devices <names>', 'Scope fleet status to a comma-separated list of devices')
+        .action(async (name, rawOpts) => {
         // Named invocation = `view` depth (all milestones + definition). Unnamed
         // stays the scannable multi-project rollup. `view`/`show` are commander
         // aliases of this same command, so there is only one implementation.
+        // Fleet is dialled by default; --device/--devices narrows it to a subset.
+        const opts = {
+            json: rawOpts.json,
+            window: rawOpts.window,
+            remote: rawOpts.remote,
+            deviceFilter: resolveDeviceFilter(rawOpts.device, rawOpts.devices),
+        };
         const mode = name ? 'view' : 'status';
         await runProjectCard(name, opts, mode);
     });

package/dist/commands/secrets.js

@@ -18,10 +18,10 @@ import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, verifyRemoteKeychainPush, keychainWriteFailureMessage, } from '../lib/secrets/remote.js';
 import { remoteShellFor, buildWindowsStdinImportCommand } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
 import { parseListFilters, bundleMatchesFilter, bundleExpiry, filterIsActive, describeFilter, parseSortField, sortBundles, SORT_FIELDS, REF_KINDS, DEFAULT_EXPIRING_DAYS, } from '../lib/secrets/list-filter.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
-import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
+import { getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, maybeAutoRekey, } from '../lib/secrets/index.js';
 import { assertOpAvailable, createPasswordItem, deleteItemByTitle, extractSecrets, itemExistsByTitle, listItems, listVaults, } from '../lib/onepassword.js';
 import { GLOBAL_HARNESS } from '../lib/secrets/scope.js';
 import { secretsHoldMs, secretsAgentDurable, agentLoad, agentLock, agentPing, agentStatus, ensureAgentRunning, runAgentLoadFromStdin, runSecretsAgent, uninstallSecretsAgentService, } from '../lib/secrets/agent.js';
@@ -1251,15 +1251,15 @@ export function registerSecretsCommands(program) {
                 }
                 const revealed = new Map();
                 if (reveal) {
-                    const items = entries
-                        .filter((e) => e.kind === 'keychain')
-                        .map((e) => secretsKeychainItem(bundle.name, e.detail));
-                    try {
-                        for (const [item, value] of getKeychainTokens(items))
-                            revealed.set(item, value);
-                    }
-                    catch {
-                        /* cancelled / batch failure — fall through to masked (null) values */
+                    const { env } = readAndResolveBundleEnv(bundle.name, {
+                        caller: 'view --reveal --json',
+                        keyMode: 'storage',
+                        agentOnly: true,
+                    });
+                    for (const entry of entries) {
+                        if (entry.kind === 'keychain' && env[entry.key] !== undefined) {
+                            revealed.set(secretsKeychainItem(bundle.name, entry.detail), env[entry.key]);
+                        }
                     }
                     const exposed = revealed.size + entries.filter((e) => e.kind === 'literal').length;
                     if (exposed > 0) {
@@ -1369,23 +1369,20 @@ export function registerSecretsCommands(program) {
                 console.error(chalk.red('--reveal in a non-TTY requires --plaintext.'));
                 process.exit(1);
             }
-            // Batch every backend read into one helper call where supported, so
-            // keychain --reveal pops Touch ID once and synced/file bundles use
-            // their declared storage.
+            // Resolve through the broker / durable-session path. A locked keychain
+            // bundle errors with the explicit unlock hint; viewing never raises a
+            // Touch ID sheet itself.
             const revealedValues = new Map();
             if (reveal) {
-                const items = entries
-                    .filter((e) => e.kind === 'keychain')
-                    .map((e) => secretsKeychainItem(bundle.name, e.detail));
-                try {
-                    const fetched = bundle.backend
-                        ? new Map(items.map((item) => [item, bundleItemStore(bundle.backend).get(item)]))
-                        : getKeychainTokens(items);
-                    for (const [item, value] of fetched)
-                        revealedValues.set(item, value);
-                }
-                catch {
-                    // Fall through to masked output on cancellation / batch failure.
+                const { env } = readAndResolveBundleEnv(bundle.name, {
+                    caller: 'view --reveal',
+                    keyMode: 'storage',
+                    agentOnly: true,
+                });
+                for (const entry of entries) {
+                    if (entry.kind === 'keychain' && env[entry.key] !== undefined) {
+                        revealedValues.set(secretsKeychainItem(bundle.name, entry.detail), env[entry.key]);
+                    }
                 }
                 // Revealing plaintext bypasses readAndResolveBundleEnv (the usual
                 // audit chokepoint), so emit here — a `--reveal` exposes real values
@@ -1475,10 +1472,9 @@ export function registerSecretsCommands(program) {
                 process.exit(1);
             }
             // `secrets get` is the scriptable automation primitive ($(agents secrets
-            // get bundle KEY)); when embedded in a headless routine/CI script — or run
-            // beneath any agent, which inherits AGENTS_RUNTIME — it must not pop an
-            // unwatched Touch ID prompt. Typed in a plain shell it still prompts.
-            const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+            // get bundle KEY)). Every read is broker-only; a locked bundle points at
+            // the explicit unlock command instead of raising Touch ID.
+            const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key], keyMode: 'storage', agentOnly: true });
             if (!(key in env)) {
                 console.error(chalk.red(`Key '${key}' not in bundle '${item}'.`));
                 process.exit(1);
@@ -2083,7 +2079,7 @@ Examples:
                     throw new Error('--to-file needs AGENTS_SECRETS_PASSPHRASE set to encrypt the bundle. ' +
                         'Set it for this command, then supply the same value when importing.');
                 }
-                const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: 'export --to-file', keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+                const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: 'export --to-file', keyMode: 'storage', agentOnly: true });
                 exportBundleToFile(env, opts.toFile, passphrase);
                 emitSecretAudit({ event: 'secrets.export', bundle: resolvedBundleName, operation: 'export --to-file', source: 'file', status: 'success', keyCount: Object.keys(env).length });
                 console.log(chalk.green(`Exported ${Object.keys(env).length} key(s) to ${opts.toFile}`));
@@ -2111,7 +2107,7 @@ Examples:
                             'bundle at rest on the remote. Set it for this command, then unlock it the same way per run.');
                     }
                 }
-                const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: `ssh export`, keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+                const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: `ssh export`, keyMode: 'storage', agentOnly: true });
                 const dotenv = bundleEnvToDotenv(env);
                 const keyCount = Object.keys(env).length;
                 // Drive the remote's own `agents secrets import --from -` so the values
@@ -2200,7 +2196,7 @@ Examples:
             if (opts.to1password) {
                 assertOpAvailable();
                 const vault = await resolveVault(opts.vault);
-                const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: `1Password vault ${vault}`, keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+                const { env } = readAndResolveBundleEnv(resolvedBundleName, { caller: `1Password vault ${vault}`, keyMode: 'storage', agentOnly: true });
                 let created = 0;
                 let overwritten = 0;
                 let skipped = 0;
@@ -2240,14 +2236,12 @@ Examples:
                 process.exit(1);
             }
             // `agents secrets export --plaintext` is what release/CI scripts eval.
-            // When it runs detached (both stdio non-TTY) or beneath ANY agent — which
-            // inherits AGENTS_RUNTIME — resolve broker-only so it can never pop a Touch
-            // ID sheet on the interactive user's screen. An `eval "$(...)"` typed in a
-            // plain shell carries no AGENTS_RUNTIME, so it is not headless and still prompts.
+            // Every caller is broker-only, including a plain shell, so export never
+            // raises Touch ID on the interactive user's screen.
             const { env } = readAndResolveBundleEnv(resolvedBundleName, {
                 caller: `export to shell`,
                 keyMode: 'process',
-                agentOnly: isHeadlessSecretsContext(),
+                agentOnly: true,
             });
             if (opts.format === 'json') {
                 // Machine-readable form consumed by `remoteResolveEnv` over SSH.
@@ -2309,7 +2303,7 @@ Examples:
                     caller: `command ${cmd}`,
                     keys: keysSubset,
                     allowExpired: execOpts.allowExpired,
-                    agentOnly: isHeadlessSecretsContext(),
+                    agentOnly: true,
                 }).env;
             }
             const { spawn } = await import('child_process');
@@ -2575,6 +2569,11 @@ Examples:
                     duration: humanRemaining(Date.now() + ttlMs),
                     keyMode: 'storage',
                 });
+                // Migrations are authorized only by this explicit unlock. The bundle
+                // metadata was included in the successful authenticated batch, so the
+                // ACL heal can rewrite that already-read value without another read.
+                maybeAutoRekey();
+                healKeychainBundleMetadataAclOnce(new Map([[bundle.name, JSON.stringify(bundle)]]));
                 if (await agentLoad(name, bundle, env, ttlMs, harness)) {
                     loaded++;
                     // Persist a durable session snapshot so the unlock survives a daemon

package/dist/commands/ssh.js

@@ -16,7 +16,7 @@ import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { getCliVersion } from '../lib/version.js';
-import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
+import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { isDeviceAuto, resolveDeviceAffinity } from '../lib/smart-launch.js';
 import { registerFleetCaptureCommand } from './fleet-capture.js';
@@ -31,7 +31,7 @@ import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-targe
 import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
-import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, ASKPASS_AGENT_ONLY_ENV, buildSshInvocation, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
 import { fanOutDevices, fleetHealthSkip, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
@@ -1514,9 +1514,8 @@ async function runAskpass() {
     }
     // A read-only stats probe sets ASKPASS_AGENT_ONLY_ENV to force a broker-only
     // resolve even under a TTY — so `agents devices` never pops Touch ID just to
-    // render load/mem for an uncached password-auth device (RUSH-1970). Otherwise
-    // fall back to the headless-context heuristic.
-    const agentOnly = process.env[ASKPASS_AGENT_ONLY_ENV] === '1' || isHeadlessSecretsContext();
+    // render load/mem for an uncached password-auth device (RUSH-1970).
+    const agentOnly = true;
     try {
         const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh', keys: [key], keyMode: 'storage', agentOnly });
         const value = env[key];

package/dist/commands/workflows.js

@@ -29,7 +29,7 @@ Structure:
     skills/            optional: knowledge packs scoped to this workflow
     plugins/           optional: plugin bundles scoped to this workflow
 
-Resolution: project (.agents/workflows/) > user (~/.agents/workflows/) > system.
+Resolution: project > user > plugin (plugins/*/workflows/) > extra > system.
 
 Note: agents run defaults to --mode plan (read-only). For workflows that
 write files, post comments, or otherwise mutate state, pass --mode edit or

package/dist/index.js

@@ -1177,7 +1177,7 @@ if (process.env.AGENTS_SKIP_MIGRATION !== '1') {
         // Bumping the suffix re-runs migrations for every user; binary releases that
         // don't change the schema must NOT re-run (they would destroy user content
         // when migration steps overlap with user-authored paths). See issue #20.
-        const sentinelValue = 'v13';
+        const sentinelValue = 'v14';
         let needRun = true;
         try {
             if (fs.existsSync(sentinel) && fs.readFileSync(sentinel, 'utf-8').trim() === sentinelValue) {

package/dist/lib/beta.d.ts

@@ -8,7 +8,7 @@
  * checks.
  */
 import type { BetaFeatureName } from './types.js';
-export declare const ALL_BETA_FEATURES: readonly ["factory", "projects"];
+export declare const ALL_BETA_FEATURES: readonly ["factory"];
 export declare function getEnabledBetaFeatures(): BetaFeatureName[];
 export declare function isBetaEnabled(feature: BetaFeatureName): boolean;
 export declare function getBetaConfigLocation(): {

package/dist/lib/beta.js

@@ -10,7 +10,7 @@
 import * as path from 'path';
 import { getAgentsDir, getOptionalUserAgentsDir, readMeta, writeMeta } from './state.js';
 import { readManifest, writeManifest } from './manifest.js';
-export const ALL_BETA_FEATURES = ['factory', 'projects'];
+export const ALL_BETA_FEATURES = ['factory'];
 function isBetaFeatureName(value) {
     return typeof value === 'string' && ALL_BETA_FEATURES.includes(value);
 }

package/dist/lib/event-stream.d.ts

@@ -1,6 +1,6 @@
 /**
  * The unified event reader -- one stream over BOTH operational events
- * (`~/.agents/events.jsonl` via events.ts: secrets, commands, teams, ...) and
+ * (`~/.agents/.history/events/events.jsonl` via events.ts: secrets, commands, teams, ...) and
  * agent-semantic events (the per-session activity logs via activity.ts: plans,
  * PRs, worktrees, sub-agents, artifacts). They share one {@link EventType}
  * vocabulary and one {@link EventRecord} shape, so `agents events` and any

package/dist/lib/event-stream.js

@@ -1,6 +1,6 @@
 /**
  * The unified event reader -- one stream over BOTH operational events
- * (`~/.agents/events.jsonl` via events.ts: secrets, commands, teams, ...) and
+ * (`~/.agents/.history/events/events.jsonl` via events.ts: secrets, commands, teams, ...) and
  * agent-semantic events (the per-session activity logs via activity.ts: plans,
  * PRs, worktrees, sub-agents, artifacts). They share one {@link EventType}
  * vocabulary and one {@link EventRecord} shape, so `agents events` and any

package/dist/lib/events.d.ts

@@ -1,7 +1,7 @@
 /**
  * Centralized event logging for agents-cli.
  *
- * Structured JSONL audit log at ~/.agents/events.jsonl with lossless numbered
+ * Structured JSONL audit log at ~/.agents/.history/events/events.jsonl with lossless numbered
  * gzip rotation at 10 MB and rich metadata for debugging/auditing.
  *
  * Features: