secretslisted

# Secrets Store credentials in the OS keychain and inject them into agent runs. The engine is the standalone **`secrets` CLI** (`@phnx-labs/secrets-cli`). `agents secrets` is a passthrough to the same binary. agi-cli does not ship the engine. ## Install ```bash agents clis install secrets # or: npm i -g @phnx-labs/secrets-cli@0.1.2 # or: agents setup secrets ``` No extra environment variables. After install, `secrets --version` prints `0.1.2`. The macOS broker is `secrets _agent-run`, not `agents daemon`. Socket: `$SECRETS_HOME/.cache/helpers/secrets-agent/`. Store credentials in your OS keychain and inject them into agent runs. Nothing touches disk in plaintext — not even the bundle metadata. ## Platform support | Platform | Backend | Install | |----------|---------|---------| | macOS | Keychain | Built-in | | Linux (desktop) | GNOME Keyring (libsecret) | `sudo apt install libsecret-tools` | | Linux (headless/server) | Use `env:` refs | See below | | Windows | Credential Manager (primary) + encrypted-file fallback | Built-in | **Desktop Linux:** GNOME Keyring (or another Secret Service provider) must be running. Most desktop environments start it automatically. **Headless Windows (service accounts, SSH with no interactive logon):** Credential Manager needs a logon session; without one it fails with `ERROR_NO_SUCH_LOGON_SESSION` (1312) and secrets transparently route to the AES-256-GCM encrypted-file store. Set `AGENTS_SECRETS_PASSPHRASE` so that store has an off-di