AgentSecrets v3.1.x

The AgentSecrets v3.1.x release series focuses on performance optimization, natural CLI ergonomics, structured output formats, and extended transport-layer redaction.

No breaking changes. No migration required.

v3.1.1

Additions

Structured JSON Output for call (--output json)

The agentsecrets call command now supports programmatic consumption via the --output json flag, outputting a structured JSON envelope containing the HTTP status code, sanitized response headers, and parsed response body:

agentsecrets call --url https://api.stripe.com/v1/balance --bearer STRIPE_KEY --output json

Example JSON response:

{
  "status_code": 200,
  "headers": {
    "content-type": "application/json",
    "request-id": "req_12345"
  },
  "body": {
    "object": "balance",
    "available": [{"amount": 10000, "currency": "usd"}]
  }
}

Improvements

Extended Header Redaction

The proxy's real-time redaction engine now scrubs sensitive credential values reflected in upstream HTTP response headers (such as Set-Cookie, WWW-Authenticate, redirect Location headers, or echoed API key headers) in addition to response bodies, preventing accidental credential leaks from verbose APIs.

v3.1.0

Additions

More Natural CLI (Verb-Noun Commands & Dual-Number Nouns)

Based on how developers naturally invoke commands, AgentSecrets now supports intuitive verb-noun commands alongside the existing command hierarchy, accepting both singular and plural nouns:

• Secrets: list-secrets, set-secrets, pull-secrets, push-secrets, delete-secrets, diff-secrets
• Projects: create-project, list-projects, use-project, update-project, delete-project, invite-project
• Workspaces: create-workspace, list-workspaces, switch-workspace, invite-workspace, list-members, remove-member, promote-member, demote-member, delete-workspace
• Allowlists: add-allowlist, remove-allowlist, list-allowlists, get-allowlist-logs
• Agents: register-agent, list-agents, issue-token, list-tokens, revoke-token, get-agent-policy, set-agent-policy
• Logs: list-logs, show-log, watch-logs, export-logs, verify-logs, replay-log

Existing hierarchical commands continue to work exactly as before.

Metadata Cache

Frequently accessed metadata such as secret names and policies is cached for 5 seconds by default:

• Only metadata is cached: Plaintext secret values are never cached, ensuring secret rotations and revocations remain immediately visible.
• The cache duration can be configured via AGENTSECRETS_KEYCHAIN_CACHE_TTL_MS (set to 0 to disable caching entirely).

Improvements

Faster Startup

Commands now start approximately 200 ms faster by removing unnecessary initialization work from the startup path:

• Removed the daemon acceptance probe that added ~200 ms to every invocation.
• Eliminated redundant initialization requests during connection setup.
• Lazily constructed the CLI application graph so commands like --help and --version no longer initialize networking.

Lifetime Master Key Cache

The daemon now retrieves the master encryption key once and reuses it throughout its lifetime:

• Previously, every secret operation could trigger another key retrieval, particularly expensive on WSL where helper processes must be spawned repeatedly.
• With lifetime caching, batch operations over many secrets now complete in milliseconds instead of seconds.

Proxy Optimizations & Asynchronous Logging

• Non-Blocking Audit Logs: Proxy requests no longer block on synchronous SQLite logging, while preserving strict cryptographic hash-chain ordering.
• Single-Pass Parsing: Request bodies are parsed only once while preserving the original Content-Type.
• Compiled Regexes: Redaction regular expressions are compiled once at initialization and reused.
• Smaller Downloads: Release binaries are approximately 6 MB smaller through optimized build flags.

Stronger Default File Permissions (0600)

Environment files written by AgentSecrets are now created with strict 0600 permissions. Previously, these files could be readable by other users and processes on the system (0644). They are now restricted exclusively to the file owner.

Safer Authentication & Reliability

• Server-Side Session Generation: Session tokens are now generated exclusively on the server during rotation.
• Deletion Protection: Personal workspaces are protected against accidental deletion across every service layer.
• Safe Token Refresh: Non-idempotent requests refresh tokens without replaying request bodies incorrectly.
• Daemon Dependency: Requires keychain-auth v3.2.0+ (installed automatically).

Fixes

Telemetry & Connection Stability

• Telemetry Counters: Fixed telemetry counters that could silently discard proxy redaction statistics during reloads.
• Buffer Allocation: Increased client read buffers to 10 MB for large prefix-read frames.
• Socket Cleanup: Fixed socket connection leaks during reconnect cycles.

Upgrading & Migration

1Upgrade the CLI

brew update && brew upgrade The-17/tap/agentsecrets

2Verify the Upgrade

agentsecrets --version