@fastagent-sh/fastagent 0.21.1 → 0.22.0

package/dist/log.d.ts

@@ -1,17 +1,7 @@
-/**
- * Leveled logging. Runtime logs (lifecycle, warnings, errors, the debug turn trace) flow through ONE
- * process-level logger, gated by a single level. It is a module singleton — not an injected dependency —
- * because most runtime logs originate inside author-constructed channels (`channels/*.ts` call the
- * channel factory themselves) and deep engine code, which the CLI cannot thread a logger into. The CLI
- * sets the level by posture (dev → debug, start → info); `FASTAGENT_LOG_LEVEL` overrides it.
- *
- * This is NOT the CLI's user-facing output (help text, command results): that is the program talking to
- * its operator and stays on plain `console`. Everything here is operational logging to stderr.
- */
+/** Leveled logging. */
 type LogLevel = "debug" | "info" | "warn" | "error";
-/** Set the posture default. A valid `FASTAGENT_LOG_LEVEL` wins over it, whenever a line is emitted. */
+/** Set the posture default. */
 export declare function setLogLevel(level: LogLevel): void;
-/** The process logger. Runtime code imports this and calls `log.info(...)` etc. */
 export declare const log: {
     debug: (msg: string) => void;
     info: (msg: string) => void;

package/dist/log.js

@@ -1,28 +1,8 @@
-/**
- * Leveled logging. Runtime logs (lifecycle, warnings, errors, the debug turn trace) flow through ONE
- * process-level logger, gated by a single level. It is a module singleton — not an injected dependency —
- * because most runtime logs originate inside author-constructed channels (`channels/*.ts` call the
- * channel factory themselves) and deep engine code, which the CLI cannot thread a logger into. The CLI
- * sets the level by posture (dev → debug, start → info); `FASTAGENT_LOG_LEVEL` overrides it.
- *
- * This is NOT the CLI's user-facing output (help text, command results): that is the program talking to
- * its operator and stays on plain `console`. Everything here is operational logging to stderr.
- */
+/** Leveled logging. */
 const ORDER = { debug: 0, info: 1, warn: 2, error: 3 };
 const isLevel = (s) => Object.hasOwn(ORDER, s);
 const format = (level, msg) => `${level.toUpperCase().padEnd(5)} ${msg}`;
-/**
- * `FASTAGENT_LOG_LEVEL` resolved PER EMIT, not at import: this module is imported transitively by every
- * command module, so an import-time read runs before any command reaches `loadDotEnv` and could never
- * see the agent's `.secrets/.env` — a key that file could not carry at all.
- *
- * Three states: a valid value wins over the posture; an invalid value warns when it differs from the
- * last warned value and is treated as absent, so a typo (meant to make logs louder) can never silently pin the
- * level nor kill the posture default; absent leaves the posture. Empty is absent, matching
- * `resolveOverridePath` — `KEY=` is how a `.env` parks a key it does not want set, not a typo to warn
- * about. The warning is raw `console.error` because it is the logger reporting on its own gate, but
- * reuses `format` for the same shape.
- */
+/** `FASTAGENT_LOG_LEVEL` resolved PER EMIT, not at import. */
 let posture = "info";
 let warnedFor;
 function effectiveLevel() {
@@ -38,7 +18,7 @@ function effectiveLevel() {
     }
     return posture;
 }
-/** Set the posture default. A valid `FASTAGENT_LOG_LEVEL` wins over it, whenever a line is emitted. */
+/** Set the posture default. */
 export function setLogLevel(level) {
     posture = level;
 }
@@ -46,5 +26,4 @@ const emit = (level) => (msg) => {
     if (ORDER[level] >= ORDER[effectiveLevel()])
         console.error(format(level, msg));
 };
-/** The process logger. Runtime code imports this and calls `log.info(...)` etc. */
 export const log = { debug: emit("debug"), info: emit("info"), warn: emit("warn"), error: emit("error") };

package/dist/node.d.ts

@@ -1,16 +1,3 @@
-/**
- * Binding a Fetch handler to a Node HTTP server.
- *
- * Its own entry point because it is the one piece of the neutral surface that is RUNTIME-specific:
- * `@hono/node-server` bridges `node:http` ↔ Fetch, and that package is the only third-party weight
- * anywhere behind `/core`. Keeping it here lets a channel package or another engine import the
- * contract without pulling a Node HTTP bridge it will never call — and lets a non-Node runtime
- * (Workers, Deno, Bun's own server) consume `/core` unchanged.
- *
- * Engine-neutral is not the same as runtime-neutral, and the two properties give the surface its
- * three layers: `/core` is both (contract, fetch-shaped kit), `/node` is engine-neutral only (this
- * file: the assembly and the HTTP binding, which need a filesystem, a clock and an environment),
- * `/pi` is neither (it names an engine).
- */
+/** Binding a Fetch handler to a Node HTTP server. */
 export { nodeListener, serveNode } from "./channels/serve.ts";
-export { mountAgentService, type AgentService, type MountableAgent, type MountAgentServiceOptions, } from "./service.ts";
+export { mountAgentService, type AgentService, type HttpSurface, type MountableAgent, type MountAgentServiceOptions, } from "./service.ts";

package/dist/node.js

@@ -1,20 +1,4 @@
-/**
- * Binding a Fetch handler to a Node HTTP server.
- *
- * Its own entry point because it is the one piece of the neutral surface that is RUNTIME-specific:
- * `@hono/node-server` bridges `node:http` ↔ Fetch, and that package is the only third-party weight
- * anywhere behind `/core`. Keeping it here lets a channel package or another engine import the
- * contract without pulling a Node HTTP bridge it will never call — and lets a non-Node runtime
- * (Workers, Deno, Bun's own server) consume `/core` unchanged.
- *
- * Engine-neutral is not the same as runtime-neutral, and the two properties give the surface its
- * three layers: `/core` is both (contract, fetch-shaped kit), `/node` is engine-neutral only (this
- * file: the assembly and the HTTP binding, which need a filesystem, a clock and an environment),
- * `/pi` is neither (it names an engine).
- */
+/** Binding a Fetch handler to a Node HTTP server. */
 export { nodeListener, serveNode } from "./channels/serve.js";
-// The assembly: a MountableAgent becomes a mounted service. Engine-neutral — it reads the SPEC
-// contract plus three paths, so a second engine reuses it with its own opener — but NOT runtime
-// neutral: it reads a directory, a cron and an environment. That is what makes this its entry
-// rather than `/core`.
+// The assembly: a MountableAgent becomes a mounted service.
 export { mountAgentService, } from "./service.js";

package/dist/observe.d.ts

@@ -1,12 +1,6 @@
 /**
- * The turn trace: wrap an Agent to tee each turn's loop — prompt, reasoning, tool calls (name + args)
- * with results, reply, terminal — to the log at DEBUG level. Pass-through: events are forwarded
- * untouched; this only adds a readable line per step. Engine-neutral (the contract only).
- *
- * It is wired in BOTH `dev` and `start`; the level decides visibility. dev runs at debug, so the trace
- * (including end-user content — prompt, tool args/results, reply) shows; start runs at info, so the
- * trace is gated out entirely, keeping that content and its volume out of production logs. That gating
- * is why the trace is debug-level rather than a switch soldered to the command path.
+ * The turn trace: wrap an Agent to tee each turn's loop — prompt, reasoning, tool calls (name + args) with results,
+ * reply, terminal — to the log at DEBUG level.
  */
 import type { Agent } from "./agent.ts";
 export declare function logAgentLoop(agent: Agent, sink?: (line: string) => void): Agent;

package/dist/open-url.d.ts

@@ -1,2 +1,2 @@
-/** Best-effort open a URL in the default browser. Callers must also print the URL for headless use. */
+/** Best-effort open a URL in the default browser. */
 export declare function openExternalUrl(url: string): void;

package/dist/open-url.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-/** Best-effort open a URL in the default browser. Callers must also print the URL for headless use. */
+/** Best-effort open a URL in the default browser. */
 export function openExternalUrl(url) {
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     spawn(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).on("error", () => { });

package/dist/paths.d.ts

@@ -1,174 +1,110 @@
-/**
- * The directory name `init` gives a nested agent (`<workspace>/fastagent/`) unless `--agent-dir` names
- * another. A DEFAULT, not a rule: resolution reads the config marker and never a name, so renaming an
- * agent directory changes nothing about how it resolves. Visible on purpose — the agent directory holds
- * the AUTHOR's content (persona, skills, tool code: code, not tool configuration), so it follows the
- * repo convention for code (a plain directory), while fastagent's own machinery inside it (`.secrets/`,
- * `.state/`) keeps the dot prefix.
- */
+/** The directory name `init` gives an agent (`<workspace>/fastagent/`) unless `--agent-dir` names another. */
 export declare const DEFAULT_AGENT_DIRNAME = "fastagent";
-/** The user-global machinery home under `$HOME` — hidden, per the dotfile convention for per-user
- *  tool homes (`~/.cargo`, `~/.docker`); unrelated to {@link DEFAULT_AGENT_DIRNAME}, which only names
- *  what `init` creates.
- *  It carries the same shape inside it as an agent dir does (`~/.fastagent/.secrets/auth.json`), so the
- *  resolvers below need no special case: `login` outside any agent simply hands them this directory. */
+/** The user-global machinery home under `$HOME`. */
 export declare const GLOBAL_HOME_DIR = ".fastagent";
-/** The secrets segment inside an agent dir (or the global home): every PATH fastagent resolves —
- *  `.env`, `.env.example`, auth.json, the scaffold's write — derives from it, so they cannot drift
- *  apart. `FASTAGENT_SECRETS_DIR` relocates the RESOLVED dir ({@link resolveSecretsDir}), never this
- *  name. The scaffold's ignore templates are real files the author owns from `init` on, so they spell
- *  their rules out as literal text — renaming this constant means editing them too. */
+/**
+ * The secrets segment inside an agent dir (or the global home). Every path fastagent resolves — `.env`,
+ * `.env.example`, auth.json, the scaffold's write — derives from it, so they cannot drift apart.
+ * `FASTAGENT_SECRETS_DIR` relocates the RESOLVED dir ({@link resolveSecretsDir}), never this name; the scaffolded
+ * ignore templates spell it out as literal text, so renaming this constant means editing them too.
+ */
 export declare const SECRETS_DIRNAME = ".secrets";
 /** The state segment inside an agent dir — same rule and same template caveat as {@link SECRETS_DIRNAME}. */
 export declare const STATE_DIRNAME = ".state";
-/** The config filenames, in load precedence. ONE source: the loader (below) and `scaffoldAgent`'s
- *  already-an-agent refusal both read this, so "is there a config?" can't diverge between them. */
-export declare const AGENT_CONFIG_NAMES: readonly ["fastagent.config.ts", "fastagent.config.js", "fastagent.config.mjs"];
-/** The optional custom-model-endpoint file inside an agent dir (pi's models.json schema). Definition
- *  data, not machinery: it declares WHICH endpoint the agent talks to, so it belongs beside the config
- *  and travels into the deployed image. The name lives HERE, with the other placement facts, because
- *  two neutral readers need it — the loader in engines/pi/models.ts and `dev`'s watcher, whose restart
- *  scope must not silently drift from what the worker actually loads. */
+/**
+ * THE config filename. One spelling, not a family: fastagent generates this file, so a choice of extension buys
+ * an author nothing and costs a precedence order plus a "you have two of them" failure path. Everything else an
+ * author writes (`tools/`, `channels/`, `routines/`) still accepts `.ts`/`.js`/`.mjs` — that is THEIR code.
+ */
+export declare const AGENT_CONFIG_FILE = "fastagent.config.ts";
+/** The optional custom-model-endpoint file inside an agent dir (pi's models.json schema). */
 export declare const AGENT_MODELS_FILE = "models.json";
 export interface ResolvedPlacement {
-    /** The AGENT directory — where the definition (persona.md/skills/tools/channels/schedules), the
-     *  config, and the machinery dirs (`.secrets/`, `.state/`) live. Absolute. */
+    /**
+     * The AGENT directory — where the definition (persona.md/skills/tools/channels/routines), the config, and the
+     * machinery dirs (`.secrets/`, `.state/`) live.
+     */
     agentDir: string;
-    /** The WORKSPACE — what the agent works ON: its cwd, and the start of the ② context walk. ALWAYS the
-     *  directory fastagent was pointed at, which makes it the agent dir's PARENT when the agent was found
-     *  one level down, and the agent dir ITSELF when you aimed straight at it. Absolute.
-     *  `agentDir === workspace` is the only discriminant — there is no mode field, because there are no
-     *  two placements to distinguish: there is one lookup and the directory you gave it. The naming
-     *  follows git: the repository sits at the root of its working tree, and WORK belongs to the tree. */
+    /**
+     * The WORKSPACE — what the agent works ON: its cwd, and the start of the ② context walk. Always the agent
+     * directory's parent, whichever of the two the command was pointed at.
+     */
     workspace: string;
 }
 /**
- * The agents `dir` resolves over: ITSELF when it holds a config, else the ones directly inside it —
- * never both, because aiming at an agent can only mean that agent. Exported for `init`, which asks the
- * same question this lookup asks: which agents would `dir` resolve over, before and after scaffolding.
+ * The agents `dir` resolves over: ITSELF when it holds a config, else the ones directly inside it — never both,
+ * because aiming at an agent can only mean that agent.
  */
 export declare function agentsAt(dir: string): string[];
-/**
- * The one-line hint for "you pointed at the agent, but the project around it is what you meant" — or
- * undefined. The workspace being whatever you aimed at is deliberate (a deployed box may hold nothing
- * but the agent), and the cost is that `cd my-agent && fastagent dev` legitimately narrows the agent's
- * WORKSPACE to its own directory: its cwd, its coding tools' root, and deploy's build context. (②
- * context is not affected — that walk climbs ancestors either way.) Resolution must not guess which you
- * wanted, so this is a HINT — and a hint may use the heuristic ("the parent carries an AGENTS.md or a
- * .git") that a rule may not.
- *
- * It suggests a command only after RUNNING the lookup that command would run, because a hint that dead-ends
- * is worse than none: with several agents beside this one, `..` refuses and names them — sending the
- * reader to a refusal whose own advice points back here.
- */
-export declare function workspaceHint({ agentDir, workspace }: ResolvedPlacement, env?: NodeJS.ProcessEnv): string | undefined;
-/** The agent dir for `dir`, or undefined when there is none — {@link findPlacement} without the pair
- *  or the throw. Login and standalone channel senders also operate outside configured agents, so
- *  they need absence as a value. Filesystem errors still propagate. */
+/** The agent dir for `dir`, or undefined when there is none — {@link findPlacement} without the pair or the throw. */
 export declare function findAgentDir(dir: string): string | undefined;
 /**
- * The agent whose DEFINITION contains `dir` — scaffolding there would make the new agent part of the
- * outer one's loaded surface rather than an agent of its own. Narrower than {@link enclosingAgentDir} on
- * purpose: an agent owns only what it LOADS ({@link LOADED_SURFACE}); the rest of its directory is the
- * author's tree, where a second agent (a monorepo package, say) is a legitimate thing to create.
- * `enclosingAgentDir` answers a different question ("where do I `cd` to?"), and for that an agent's
- * `src/` genuinely IS inside it.
+ * The agent whose DEFINITION contains `dir` — scaffolding there would make the new agent part of the outer one's
+ * loaded surface rather than an agent of its own.
  */
 export declare function agentDefinitionOwner(dir: string): string | undefined;
-/**
- * Why `dir` is not an agent, when it has its OWN way out — or undefined when it is simply not near one.
- * Two positions qualify: standing INSIDE an agent (its `tools/`, its `src/`), and standing on a
- * directory whose several agents nothing selects between. Both matter because the generic advice ("run
- * `fastagent init`") would not help — the agent already exists, one step away.
- *
- * Exported because `login` is the one command allowed to run outside an agent, and it must tell "truly
- * outside" (→ the global credential) from "a dead end" (→ refuse, like every other command).
- */
+/** Why `dir` is not an agent, when it has its OWN way out — or undefined when it is simply not near one. */
 export declare function placementDeadEnd(dir: string, env?: NodeJS.ProcessEnv): string | undefined;
 /**
- * Resolve a directory into its placement — the ONE owner of the rule ({@link findPlacement}): `dir` is
- * the workspace, and the agent is the single `fastagent.config.*` holder at it or one level inside.
- * Placement is never configured and never detected from surroundings; it is that lookup and the
- * directory you pointed at.
+ * Resolve a directory into its placement — the ONE owner of the rule ({@link findPlacement}).
  *
- * Anything else throws (fail visibly). Resolution never walks UP — an agent must not be claimed from
- * arbitrarily deep inside it — but the MESSAGE reads the path, so each dead end gets the exit that fits
- * it ({@link placementDeadEnd}).
+ * WHERE AN UNREADABLE CANDIDATE IS SPENT, and only here: this caller MUST produce an agent, so a directory it
+ * could not look into is the difference between "there is none" and "there might be". `placementDeadEnd` is
+ * asked a weaker question — is this place a dead end with its own way out — by callers like `login`, for which
+ * a neighbour it may not enter is environment noise, not a reason to exit instead of logging in globally. It
+ * also comes AFTER that call: with two agents to choose between, a permission problem in a third directory is
+ * not the message that gets the caller moving.
  */
 export declare function resolvePlacement(dir: string, env?: NodeJS.ProcessEnv): ResolvedPlacement;
-/** How to WRITE a path for someone standing in `cwd`: relative when it is inside `cwd`, absolute when
- *  it climbs out (a `../../..` is noise), and undefined when it IS `cwd` (nothing to say). ONE policy,
- *  shared by `init`'s `cd` step, `add`'s next-steps paths and `fire`'s "looked in" hint — they all answer
- *  the same question, which is a placement-PRESENTATION question, not a scaffolding one. */
+/** How to WRITE a path for someone standing in `cwd`. */
 export declare function displayPath(cwd: string, dir: string): string | undefined;
-/** Does a path exist? Plain fs, no placement in it — it lives here because `paths.ts` is where the
- *  neutral path helpers are, and the scaffolder is not a utility home for the CLI and deploy. */
 export declare function exists(p: string): Promise<boolean>;
-/** The file's text, or undefined when there is no file. ONLY absence reads as absence: a file that
- *  exists but cannot be read (EACCES, a directory in its place) throws, because a decision made on
- *  "not there" — regenerate it, skip its gate — is the wrong one for a file that is there. */
+/** The file's text, or undefined when there is no file. */
 export declare function readTextIfExists(p: string): Promise<string | undefined>;
 /**
- * Resolve a user-supplied path override (a CLI flag or an env var) to an absolute path, expanding a
- * leading `~`/`~/` to the home dir FIRST. Path-valued config from `.env` (or any non-shell source)
- * never gets the shell's `~` expansion, so a bare `resolve("~/x")` would silently create a literal `~`
- * directory — a fail-silently footgun for a secret/state path. Expanding here makes `~` mean home
- * everywhere these knobs are read.
+ * Resolve a user-supplied path override (a CLI flag or an env var) to an absolute path, expanding a leading `~`/`~/`
+ * to the home dir FIRST.
  */
 export declare function resolveOverridePath(raw: string | undefined): string | undefined;
 /**
- * The resolved state root — the durable machine-state home (sessions/, channels/<kind>/, schedule/,
- * control.json): `FASTAGENT_STATE_DIR` env > `<agentDir>/.state`. Absolute, so channels and the
- * startup report agree regardless of cwd. Definition: mutable runtime state — single lifecycle
- * (precious, survives redeploy), single process; a container points this at its mounted volume.
- * Secrets are NOT here — they live under {@link resolveSecretsDir} (a different deploy lifecycle:
- * secret store vs volume). The finer knob (`FASTAGENT_SESSIONS_DIR`) still overrides its path on top.
- *
- * `FASTAGENT_STATE_DIR` is an OPERATOR override, so a relative value resolves against `process.cwd()`
- * — the CLI convention its sibling knobs share (`resolveOverridePath`), NOT against `dir`. Only the
- * DEFAULT (`<root>/.state`) is dir-anchored.
+ * The resolved state root — the durable machine-state home (sessions/, channels/<kind>/, schedule/):
+ * `FASTAGENT_STATE_DIR` env > `<agentDir>/.state`.
  */
 export declare function resolveStateRoot(dir: string, env?: NodeJS.ProcessEnv): string;
 /**
- * The resolved secrets dir — everything fastagent manages that must NEVER leave the machine (the
- * agent's `.env` + auth.json): `FASTAGENT_SECRETS_DIR` env > `<agentDir>/.secrets`. Split from
- * the state root on deploy lifecycle: secrets travel through the host's secret store (env vars / the
- * auth seed), state through a volume. A deployed box sets both env knobs at its volume (e.g.
- * `/data/.secrets`, `/data/.state`) so a seeded-then-ROTATED OAuth credential persists across
- * restarts. The `.env`'s OWN location resolves from the REAL environment — commands locate and load
- * `.env` before anything else, so a `FASTAGENT_SECRETS_DIR` set INSIDE `.env` still relocates
- * auth.json but cannot move the file it is read from (env.ts dotEnvPath).
+ * WHERE an agent's session records live: `<state root>/sessions`, always. Records are machine state like channel
+ * state and schedule claims, so they move with the ONE knob that moves all of it rather than with a second one that
+ * moves only them — a split every reader would then have to agree about, and which left channel state behind anyway.
+ * An embedder that really wants the records elsewhere passes `sessionsDir` to `createAgentService`; there is no env
+ * or flag spelling of it, for the reason `resolveAuthPathOverride` states.
+ */
+export declare function resolveSessionsDir(dir: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * The resolved secrets dir — everything fastagent manages that must NEVER leave the machine (the agent's `.env` +
+ * auth.json).
  */
 export declare function resolveSecretsDir(dir: string, env?: NodeJS.ProcessEnv): string;
-/** What a file under {@link resolveSecretsDir} is written with (auth.json, .env). */
-export declare const SECRET_FILE_MODE = 384;
+/** Is this process the deployed container the generated artifacts describe? ONE reading of the
+ *  environment fact the image states, so a second spelling cannot drift from it. */
+export declare function isDeployedWorkspace(): boolean;
+/** Is this process running inside the AgentCore Runtime? Set by the generated deploy artifacts. */
+export declare function isAgentcoreRuntime(): boolean;
 /**
- * Create the secrets directory with the mode its contents require — and REPAIR it when it already
- * exists, which is the case that matters.
+ * The mode of a file fastagent CREATES to hold a secret: `auth.json`, a `.env` it makes itself,
+ * a host's parameter file. That is the whole extent of its opinion about permissions — a file it did not create
+ * keeps the mode its owner gave it, and no directory's mode is ever decided or repaired. Every comparable tool
+ * draws the line here: Rails chmods the `master.key` it generates and leaves `config/` alone
+ * (rails/rails@4c6c357), the aws CLI ships a 0600 `~/.aws/config` inside a 0755 `~/.aws`.
  *
- * The DIRECTORY is the boundary that actually protects a credential: without its `x` bit nothing
- * below it is reachable, whatever a file's own mode says. And it is decided ONCE, by whichever
- * writer gets there first — `mkdir`'s `mode` is ignored for a directory that already exists, so a
- * later, more careful caller silently inherits the first one's answer. Four callers create this
- * directory (`init`, `add <channel>`, the credential store, the deploy seed) and the ordinary order
- * is init → add → login, so the careful one is LAST: the rule has to live where all of them can
- * reach it, and it has to chmod rather than trust the create.
+ * "Who created the file" is the load-bearing half: asking instead whether a given WRITE carries a secret has a
+ * different answer at every call site and one more with each new writer.
  *
- * A chmod the caller never asked for owes them its reason: the raw `EPERM ... chmod '/shared/creds'`
- * reads as a bug in whatever they WERE doing (storing a credential), not as fastagent tightening a
- * directory they pointed it at, and says nothing about the way out.
- */
-export declare function ensureSecretsDir(dir: string): Promise<void>;
-/**
- * Guard that `<agentDir>/<name>` resolves INSIDE the agent dir — a symlink that escapes (or an
- * absolute target) is rejected, so discovery/scaffolding never reaches out of the definition directory.
- * A missing target is fine (nothing to guard yet).
+ * One consequence worth knowing: `writeFileAtomic` sets the mode on the temp file it renames into place, so a
+ * file it owns end-to-end (`auth.json`) is 0600 after every write, including one an operator had
+ * placed by hand. Appending to a file fastagent did not create (`.env`) cannot and does not do that.
  */
+export declare const SECRET_FILE_MODE = 384;
+/** Guard that `<agentDir>/<name>` resolves INSIDE the agent dir. */
 export declare function assertInsideAgentDir(agentDir: string, name: string): Promise<void>;
-/**
- * Whether `targetPath` lives inside `baseDir` (same path counts). Used to ask "did an override move
- * this OUT of the agent?" — the startup report's redeploy notes, `add`'s printed `.env` label, and the
- * dev watcher's "your .env is not watched" warning all turn on that fact. Reporting only: fastagent
- * does not act on where a user's paths point.
- */
+/** Whether `targetPath` lives inside `baseDir` (same path counts). */
 export declare function isUnderDir(targetPath: string, baseDir: string): boolean;