fix(auth-sync): push bundles into the worker's agents root, and let a Cursor slot launch find its binary and lease (PHNX-3940)

[muqsitnawaz]

Problem

Follow-up to #3551 (merged, released as 1.22.90). Two more seams stopped a worker from running cursor#gmail, both found while proving that release end-to-end on yosemite-m0.

1. The push lands in the wrong root on the worker. agents-cli runs its local secrets under SECRETS_HOME=~/.agents (MIG-1), and the worker daemon reads pushed bundles from that root. The remote half of every bundle push ran the receiving secrets with no env prologue, so it used its own default ~/.secrets:

zion:        auth-sync: pushed __cursor__ (1 key(s)) to yosemite-m0
yosemite-m0: ~/.secrets/.cache/secrets/agents-cli.bundles.__cursor__.enc   (18:05, the push)
             ~/.agents/.cache/secrets/  -> no __cursor__
             auth-sync: 1 registered account(s) have no readable durable key on this box yet

The file store is keyed per root (<SECRETS_HOME>/.secrets-key/passphrase), so the two roots cannot share ciphertext either. Every push call site (auth-sync, accounts sync, fleet apply, mint) goes through the one client wrapper.

2. A Cursor slot launch cannot find its binary or take its lease. The slot launch hands the direct alias HOME=<slot dir> with the real home in AGENTS_REAL_HOME; the alias anchored BINARY on $HOME:

$ agents run cursor#gmail "…"        (yosemite-m0, key present, slot provisioned)
[agents] account 'gmail' · cursor
Running: /home/muqsit/.agents/.cache/shims/cursor-agent@main -f -p …
agents: cursor@main not installed

Under a plain HOME the alias still failed, because cursor's own HOME swap ran before the launch lease and agents __launch-lease (state root $HOME/.agents) then answered No installation directory for cursor@main.

Change

• secrets-client.ts: withRemoteStateRoot fills remoteSecretsHome: '~/.agents' (REMOTE_USER_AGENTS_DIR) on every pushBundleToHost[Async] unless the caller named a root; PushBundleOptions gains the field. secrets-cli 0.1.2 (feat(push): remoteSecretsHome pins the remote secrets to the consumer state root on every transport secrets-cli#5) applies it to the import, the read-back verify and literal restoration, with a strict path charset before the value reaches the remote shell.
• shims.ts direct alias (schema 20, regenerated on next sync): every agents-owned path anchors on AGENTS_REAL_HOME; the launch lease runs HOME="$AGENTS_REAL_HOME" before any harness HOME swap; cursor swaps HOME only when $HOME still equals the real home (a spawner-chosen slot HOME is kept).
• Test pin STANDALONE_SECRETS_VERSION → 0.1.2; doc and CHANGELOG updated.

Verification

• tsc --noEmit clean.
• secrets-client.test.ts (withRemoteStateRoot, buildServeEnv): pass. shims.test.ts: 36/36, including the new Cursor and Claude alias cases (real-home anchor, lease before swap, conditional swap) and the Grok fallback path moved to the real home.
• Remote half proven on yosemite-m0 by hand before the code change: an on-box re-import of the pushed bundle into ~/.agents made the daemon provision the slot (auth-sync: provisioned worker slot(s) for 3dbc408e…); the same was applied to the other eight online workers.
• The CI test job goes green once 0.1.2 propagates on npm (published, tag on origin).

Tracking: PHNX-3940.

[muqsitnawaz]

VERDICT: APPROVE

Non-author review (code-reviewer subagent). Verified by execution and tracing, not just the diff: the generated alias bash under a non-slot env (lease under the real home, then the cursor HOME swap) and a slot env (lease under the real home, HOME stays the slot for exec, AGENT_CLI_CREDENTIAL_STORE=file in both); a native-account run always resolves a version and runs the versioned alias (commands/exec.ts → buildExecCommand), so the reported repro is on the fixed path; every push call site goes through withRemoteStateRoot; secrets-cli 0.1.1 ignores the unknown remoteSecretsHome field (checked against its source), so the field is additive.

Two should-fix notes, addressed in e0cf53d: the CHANGELOG said the schema-20 alias regenerates 'on next sync' — it is the daemon self-heal tick (6 h) or agents doctor --fix / agents view; and the bare dispatcher shim (generateShimScript) keeps its $HOME anchor, now stated as out of scope since slot launches never use it.

Checks: shims.test.ts 36/36, withRemoteStateRoot seam test passes, tsc clean; three pre-existing real-Keychain failures in secrets-client.test.ts on macOS are untouched by this diff.