fix(secretsbus): carry PP CLI config.toml as a file instead of parsing it as dotenv

[mvanhorn]

Problem

Every auto-discovered Printing Press CLI failed to sync its secrets. agentcookie source --once printed 40 secrets-bus errors in two classes:

• Parse failures — read ~/.config/<cli>/config.toml: line 1: whitespace around '=' is not allowed, or missing '=' (expected KEY=VALUE) where the file opens with a [table] header. These CLIs had real credentials on disk that silently never reached the sink.
• Missing files — read-in-place file missing for ~26 CLIs that were simply never authenticated. A normal state, reported as an error on every push.

Root cause

DeriveManifestFromPP pointed [secrets.file] at ~/.config/<cli_name>/config.toml. But [secrets.file] is env-shaped by contract and is read by the strict KEY=VALUE parser, while PP CLIs write actual TOML there. The spec already knew this — §5.4 says "a TOML config.toml cannot ride as a single KEY=VALUE value" — but §7 mapped the PP adapter to the env-shaped slot anyway. The adapter took the canonical path from the PP audit and did not carry across its format finding.

Fix

Derive a [[files]] carriage item instead — machinery the repo already ships for exactly this case, whose doc example is literally a pp-cli config.toml. Bytes are carried verbatim, so nested tables and comments survive; nothing is parsed.

• U1 — carry config.toml as a file, gated on the manifest declaring at least one sensitive key so preference-only configs (espn's [favorites]) are not swept in
• U2 — ErrCarrySourceMissing lets never-configured CLIs skip quietly, while hand-written manifests (whose author chose the path) still error
• U3 — agentcookie secret link-configs bridges carried configs into ~/.config/
• U4 — end-to-end coverage of the three real shapes
• U5 — spec §7.4 + audit follow-through

Why a link step instead of an env pointer

Carried files materialize under ~/.agentcookie/, but PP CLIs read ~/.config/<slug>/config.toml. I measured the installed fleet:

Binary	Built	XDG_CONFIG_HOME / <API>_CONFIG_DIR
espn, tesla, prediction-goat	2026-05	ignored
ordertogo	2026-06-24	ignored
human-goat, juneoven	2026-07	honored

Only 2 of 59 installed binaries can follow an env pointer. Writing directly into ~/.config/ would reach all 59 but would break the containment invariant validateMaterializeTarget exists to enforce — the sink's defense against a manifest naming an arbitrary write path. So linking is a separate explicit step: read-only planning, dry run by default, refuses to replace an existing config or write through a symlink pointing outside ~/.agentcookie/.

Verification

Measured on a real machine, not just fixtures:

• secrets-bus error lines: 40 -> 0
• CLIs contributing secrets: 2 (main) -> 9 (branch) — seven configured CLIs that were silently shipping nothing now ship
• Carried bytes are byte-identical to source, [table] headers and comments intact
• go build, go vet, gofmt clean; secretsbus 115 passing

Four tests fail on this branch (TestInstacartAdapter_IsInstalled_*, TestCheckDaemonBinaryPath) — all four fail identically on main, verified by checkout.

Known limitations

• The gate is only as good as the PP metadata. booking-com and ebay declare no auth_env_vars and no auth_env_var_specs, so they are excluded despite holding access tokens. Not a regression (they did not sync before either), but the fix does not reach them. The gate cannot be loosened, because espn declares nothing either and metadata alone cannot separate "has no secrets" from "did not say." The fix belongs in those CLIs' .printing-press.json.
• Whole-file carriage has no per-key filter, so it ships more than [sync.keys] would. The audit's per-file local-only marker is the real answer and is still open.
• Sink-side materialization was not verified end to end — the sink was unreachable throughout (an unrelated network problem).
• Companion files (cookies.json, browser-session-proof.json) are still uncarried.

Review note

Two regressions from this change were caught and fixed before this PR: secret revoke emitted an invalid path = "" in its copy-pasteable silencing manifest, and discover mislabelled carriage-based manifests as (legacy bus dir). Both stemmed from consumers assuming a non-empty ReadInPlacePath.

Plan: docs/plans/2026-08-13-2206-fix-pp-cli-toml-secrets-carriage-plan.md

🤖 Generated with Claude Code

https://claude.ai/code/session_015AGvauBWJUf3EyrHSotKdL

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[greptile-apps]

Greptile Summary

The PR moves auto-discovered Printing Press CLI TOML configurations from env-file parsing to verbatim file carriage and adds an explicit command for linking materialized configurations into the locations consumed by those CLIs.

• Derives carriage entries only for CLIs declaring sensitive keys and quietly skips missing convention-based sources.
• Adds dry-run and apply flows for safely linking carried configurations under ~/.config.
• Updates discovery, revoke guidance, specifications, audit notes, and end-to-end coverage.

Confidence Score: 5/5

The PR appears safe to merge because both previously reported containment failures are fixed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/secretsbus/linkconfigs.go	Adds home- and config-root-anchored planning and application of configuration links, addressing both previously reported symlink escape paths.
internal/secretsbus/pp_cli_adapter.go	Changes derived PP CLI manifests to carry credential-bearing TOML files verbatim rather than exposing them to dotenv parsing.
internal/secretsbus/discover_merge.go	Quietly suppresses missing carriage sources only for convention-derived PP CLI manifests while retaining errors for explicit manifests.
internal/cli/secret.go	Adds the dry-run-by-default secret link-configs command and delegates filesystem safety decisions to the secretsbus implementation.
internal/secretsbus/linkconfigs_test.go	Covers existing destinations, parent and config-root symlinks, post-planning replacements, internal config-root links, and containment races.
internal/secretsbus/discover_merge_files_test.go	Adds end-to-end coverage for configured, preference-only, and never-authenticated PP CLI shapes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Printing Press metadata] --> B{Sensitive key declared?}
    B -->|No| C[Skip carriage]
    B -->|Yes| D[Carry config.toml verbatim]
    D --> E[Materialize under ~/.agentcookie]
    E --> F[Plan link-configs]
    F --> G{Destination safe and absent?}
    G -->|No| H[Refuse or report already linked]
    G -->|Yes, with --apply| I[Create link through config-root os.Root]

Loading

_{Reviews (4): Last reviewed commit: "docs: note that ~/.config is opened thro..." | Re-trigger Greptile}