AgentSecrets v2.0.0
Welcome to AgentSecrets v2.0.0! This is a major architectural milestone that introduces a fundamentally new security model, alongside significant performance and Developer Experience (DX) improvements.
What's New in v2.0.0
Additions
Process-Level Security with keychain-auth (Major Architectural Shift)
In v2.0.0, we are reintroducing the completely overhauled keychain-auth daemon (our Anti-Impersonation feature). While introduced in an early alpha version and temporarily deprecated, it has been massively matured and rebuilt from the ground up.
- True Zero-Knowledge: Secrets are no longer just protected at rest; access is now strictly verified at the process level using binary hash verification.
- Auto-Setup: The CLI automatically configures and manages the
keychain-authdaemon behind the scenes. This ensures your AI agents and scripts can securely access secrets without exposing sensitive credentials, while unauthorized binaries are strictly blocked from impersonating legitimate tools. - Note: This represents a major architectural change, hence the 2.0.0 version bump.
Improvements
Sub-Millisecond Status Checks
We've significantly optimized the agentsecrets status command. By implementing a local cloud metadata cache, we've eliminated redundant API calls during routine checks.
- Latency dropped from ~1.2s to ~0.3s, making environment checks near-instantaneous.
- The status command now uses a cached diff for lightning-fast comparisons.
Brand Alignment & Dark Mode Readability
The CLI has been completely visually overhauled to match the core AgentSecrets brand identity.
- Replaced the generic sky-blue palette with our signature vibrant teal (
#00C6A5). - Carefully selected secondary colors, warnings (amber), and errors (red) to ensure maximum contrast and readability on dark terminal backgrounds.
Focused & Clutter-Free Terminal Output
We heard your feedback! The terminal output was too chatty, distracting from the actual results of your commands. We've introduced a "self-clearing" spinner architecture for background tasks:
- Ephemeral Spinners: Background operations like
keychain-authsetup or silent session token refreshes now use spinners that self-clear immediately upon success. - Zero Noise: Redundant success messages have been removed. If a background process succeeds, it gets out of your way.
- Intelligent Diff Guidance: The
secrets diffcommand output has been polished. It now clearly shows your synchronized states (including identical keys) and intelligently adjusts its contextual help-text so it won't mistakenly ask you to push local changes when comparing two remote cloud environments. - Errors Persist: If something fails, the error message and helpful suggestions still stay firmly on your screen so you know exactly what to fix.
Upgrading & Migration
The Migration Path
Because v2.0.0 introduces the keychain-auth daemon as the exclusive broker for your secrets, it takes over ownership of credentials from the legacy CLI. For most users, the upgrade is seamless and the daemon will read your existing keys without issue.
However, depending on your operating system's strictness (especially on macOS/Linux), you may encounter OS permission prompts when the new daemon attempts to read or overwrite legacy keys. If you encounter these prompts, simply click "Always Allow". This authorizes the new daemon and securely migrates the ownership of the secret in your native keychain.
Alternatively, you can forcefully refresh your local state from the cloud by running:
agentsecrets pull
Note: pull will fetch your cloud secrets and overwrite the specific keychain entries locally. You may still need to approve the OS permission prompt to allow the overwrite.