@phnx-labs/agents-cli 1.20.61 → 1.20.63

package/dist/lib/startup/command-registry.js

@@ -66,6 +66,8 @@ export const loadMessage = async () => (await import('../../commands/message.js'
 export const loadFeed = async () => (await import('../../commands/feed.js')).registerFeedCommand;
 export const loadServe = async () => (await import('../../commands/serve.js')).registerServeCommand;
 export const loadAudit = async () => (await import('../../commands/audit.js')).registerAuditCommands;
+export const loadWebhook = async () => (await import('../../commands/webhook.js')).registerWebhookCommand;
+export const loadFunnel = async () => (await import('../../commands/funnel.js')).registerFunnelCommand;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help
@@ -151,8 +153,15 @@ export const COMMAND_LOADERS = {
     events: [loadEvents],
     ssh: [loadSsh],
     devices: [loadSsh],
+    // `fleet` is a commander alias of `devices` (see commands/ssh.ts); list it so
+    // lazy registration loads the devices tree when the user types `agents fleet`.
+    fleet: [loadSsh],
     pull: [loadPull],
     push: [loadPush],
+    // `repos` is the canonical command name; `repo` remains a convenience alias
+    // (see commands/repo.ts). List both so lazy registration loads the tree
+    // whichever the user types.
+    repos: [loadRepo],
     repo: [loadRepo],
     setup: [loadSetup],
     sessions: [loadSessions],
@@ -162,4 +171,6 @@ export const COMMAND_LOADERS = {
     feed: [loadFeed],
     serve: [loadServe],
     audit: [loadAudit],
+    webhook: [loadWebhook],
+    funnel: [loadFunnel],
 };

package/dist/lib/state.d.ts

@@ -109,13 +109,21 @@ export declare function getCacheDir(): string;
 export declare function getPackagesDir(): string;
 /** Path to routine YAML definitions (~/.agents/routines/). */
 export declare function getRoutinesDir(): string;
+/**
+ * Path to built-in routine definitions shipped in the system repo
+ * (`~/.agents/.system/routines/`). Unioned under the user routines dir by
+ * listJobs()/readJob(): a routine shipped here fires for every install, and a
+ * user routine of the same name overrides it (a user copy with `enabled: false`
+ * disables the built-in). The daemon fires these; the directory need not exist.
+ */
+export declare function getSystemRoutinesDir(): string;
 /**
  * Path to a project-scoped routines directory (`<project>/.agents/routines/`),
  * or null when no project `.agents/` is found by walking up from cwd.
  *
  * Project routines participate in `list`/`view`/`run` for inspection but are
- * NOT fired by the daemon (which runs from $HOME and only loads user routines).
- * Opt-in firing for project routines is tracked as a follow-up.
+ * NOT fired by the daemon (which runs from $HOME and loads only user + system
+ * routines). Opt-in firing for project routines is tracked as a follow-up.
  */
 export declare function getProjectRoutinesDir(cwd?: string): string | null;
 /** Path to routine execution logs (~/.agents/.history/runs/). */

package/dist/lib/state.js

@@ -69,6 +69,10 @@ const SYSTEM_PERMISSIONS_DIR = path.join(SYSTEM_AGENTS_DIR, 'permissions');
 const SYSTEM_SUBAGENTS_DIR = path.join(SYSTEM_AGENTS_DIR, 'subagents');
 const SYSTEM_WORKFLOWS_DIR = path.join(SYSTEM_AGENTS_DIR, 'workflows');
 const SYSTEM_PLUGINS_DIR = path.join(SYSTEM_AGENTS_DIR, 'plugins');
+// Built-in routines shipped in the system repo (gh:phnx-labs/.agents-system).
+// Unioned under user routines by listJobs()/readJob() so a routine shipped here
+// fires for every install, while a user routine of the same name overrides it.
+const SYSTEM_ROUTINES_DIR = path.join(SYSTEM_AGENTS_DIR, 'routines');
 const SYSTEM_PROMPTCUTS_FILE = path.join(SYSTEM_AGENTS_DIR, 'hooks', 'promptcuts.yaml');
 const SYSTEM_MCP_CONFIG_FILE = path.join(SYSTEM_AGENTS_DIR, 'mcp.json');
 const SYSTEM_INSTRUCTIONS_FILE = path.join(SYSTEM_AGENTS_DIR, 'instructions.md');
@@ -296,13 +300,21 @@ export function getCacheDir() { return CACHE_DIR; }
 export function getPackagesDir() { return PACKAGES_DIR; }
 /** Path to routine YAML definitions (~/.agents/routines/). */
 export function getRoutinesDir() { return ROUTINES_DIR; }
+/**
+ * Path to built-in routine definitions shipped in the system repo
+ * (`~/.agents/.system/routines/`). Unioned under the user routines dir by
+ * listJobs()/readJob(): a routine shipped here fires for every install, and a
+ * user routine of the same name overrides it (a user copy with `enabled: false`
+ * disables the built-in). The daemon fires these; the directory need not exist.
+ */
+export function getSystemRoutinesDir() { return SYSTEM_ROUTINES_DIR; }
 /**
  * Path to a project-scoped routines directory (`<project>/.agents/routines/`),
  * or null when no project `.agents/` is found by walking up from cwd.
  *
  * Project routines participate in `list`/`view`/`run` for inspection but are
- * NOT fired by the daemon (which runs from $HOME and only loads user routines).
- * Opt-in firing for project routines is tracked as a follow-up.
+ * NOT fired by the daemon (which runs from $HOME and loads only user + system
+ * routines). Opt-in firing for project routines is tracked as a follow-up.
  */
 export function getProjectRoutinesDir(cwd = process.cwd()) {
     const projectAgentsDir = getProjectAgentsDir(cwd);

package/dist/lib/subagents.d.ts

@@ -68,6 +68,27 @@ export declare function transformSubagentForDroid(subagentDir: string): string;
  * See GitHub docs for custom agents.
  */
 export declare const transformSubagentForCopilot: typeof transformSubagentForDroid;
+/**
+ * Transform a subagent into a Cursor CLI custom subagent `.md` file.
+ *
+ * Cursor loads subagents from `.cursor/agents/*.md` (project) or
+ * `~/.cursor/agents/*.md` (user) — Markdown with YAML frontmatter
+ * (name, description, model; also readonly/is_background, which our
+ * frontmatter schema doesn't carry). Cursor has no `color` field, so this is
+ * an alias of transformSubagentForDroid, same as Copilot.
+ * See https://cursor.com/docs/subagents.
+ */
+export declare const transformSubagentForCursor: typeof transformSubagentForDroid;
+/**
+ * Transform a subagent into a ForgeCode custom subagent `.md` file.
+ *
+ * ForgeCode loads named agents from `.forge/agents/*.md` (project) or
+ * `~/.forge/agents/*.md` (user) — Markdown with YAML frontmatter (id, title,
+ * description, tools, model, temperature) + a system-prompt body. ForgeCode has
+ * no `color` field, so this is an alias of transformSubagentForDroid, same as
+ * Copilot/Cursor. See https://forgecode.dev/docs/agent-definition-guide/.
+ */
+export declare const transformSubagentForForge: typeof transformSubagentForDroid;
 /**
  * Transform a subagent into Antigravity's custom-agent markdown shape.
  *
@@ -138,6 +159,17 @@ export declare function transformSubagentForCodex(subagentDir: string): string;
  * set so the subagent can actually run.
  */
 export declare function transformSubagentForKiro(subagentDir: string): string;
+/**
+ * Transform a subagent into a Goose recipe YAML file.
+ *
+ * Goose has no dedicated subagent file format — a named subagent IS a recipe.
+ * Goose resolves named agents from `~/.config/goose/agents/<name>.yaml` (global)
+ * and delegates to them by name in autonomous mode. The recipe schema mirrors the
+ * one agents-cli already emits for Goose workflow recipes (`writeGooseSubrecipe`):
+ * `version`, `title`, `description`, `instructions`, `prompt`, plus an optional
+ * `settings.goose_model`. See goose-docs.ai context-engineering/subagents.
+ */
+export declare function transformSubagentForGoose(subagentDir: string): string;
 /**
  * Sync a subagent to an OpenClaw workspace
  * Copies full directory, renames AGENT.md to AGENTS.md

package/dist/lib/subagents.js

@@ -274,6 +274,27 @@ export function transformSubagentForDroid(subagentDir) {
  * See GitHub docs for custom agents.
  */
 export const transformSubagentForCopilot = transformSubagentForDroid;
+/**
+ * Transform a subagent into a Cursor CLI custom subagent `.md` file.
+ *
+ * Cursor loads subagents from `.cursor/agents/*.md` (project) or
+ * `~/.cursor/agents/*.md` (user) — Markdown with YAML frontmatter
+ * (name, description, model; also readonly/is_background, which our
+ * frontmatter schema doesn't carry). Cursor has no `color` field, so this is
+ * an alias of transformSubagentForDroid, same as Copilot.
+ * See https://cursor.com/docs/subagents.
+ */
+export const transformSubagentForCursor = transformSubagentForDroid;
+/**
+ * Transform a subagent into a ForgeCode custom subagent `.md` file.
+ *
+ * ForgeCode loads named agents from `.forge/agents/*.md` (project) or
+ * `~/.forge/agents/*.md` (user) — Markdown with YAML frontmatter (id, title,
+ * description, tools, model, temperature) + a system-prompt body. ForgeCode has
+ * no `color` field, so this is an alias of transformSubagentForDroid, same as
+ * Copilot/Cursor. See https://forgecode.dev/docs/agent-definition-guide/.
+ */
+export const transformSubagentForForge = transformSubagentForDroid;
 /**
  * Transform a subagent into Antigravity's custom-agent markdown shape.
  *
@@ -493,6 +514,45 @@ export function transformSubagentForKiro(subagentDir) {
     }
     return JSON.stringify(config, null, 2);
 }
+/**
+ * Transform a subagent into a Goose recipe YAML file.
+ *
+ * Goose has no dedicated subagent file format — a named subagent IS a recipe.
+ * Goose resolves named agents from `~/.config/goose/agents/<name>.yaml` (global)
+ * and delegates to them by name in autonomous mode. The recipe schema mirrors the
+ * one agents-cli already emits for Goose workflow recipes (`writeGooseSubrecipe`):
+ * `version`, `title`, `description`, `instructions`, `prompt`, plus an optional
+ * `settings.goose_model`. See goose-docs.ai context-engineering/subagents.
+ */
+export function transformSubagentForGoose(subagentDir) {
+    const agentMd = path.join(subagentDir, 'AGENT.md');
+    const frontmatter = parseSubagentFrontmatter(agentMd);
+    const body = getSubagentBody(agentMd);
+    if (!frontmatter) {
+        throw new Error(`Invalid AGENT.md in ${subagentDir}`);
+    }
+    const files = fs.readdirSync(subagentDir)
+        .filter(f => f.endsWith('.md') && f !== 'AGENT.md')
+        .sort();
+    let prompt = body || frontmatter.description || frontmatter.name;
+    for (const file of files) {
+        const content = fs.readFileSync(path.join(subagentDir, file), 'utf-8').trim();
+        const sectionName = file.replace('.md', '');
+        const title = sectionName.charAt(0).toUpperCase() + sectionName.slice(1).toLowerCase();
+        prompt += `\n\n## ${title}\n\n${content}`;
+    }
+    const recipe = {
+        version: '1.0.0',
+        title: frontmatter.name || path.basename(subagentDir),
+        description: frontmatter.description || frontmatter.name || path.basename(subagentDir),
+        instructions: prompt,
+        prompt,
+    };
+    if (frontmatter.model) {
+        recipe.settings = { goose_model: frontmatter.model };
+    }
+    return yaml.stringify(recipe);
+}
 /**
  * Sync a subagent to an OpenClaw workspace
  * Copies full directory, renames AGENT.md to AGENTS.md
@@ -609,6 +669,51 @@ export function installSubagentToAgent(subagentDir, subagentName, agent, agentHo
             return { success: false, error: String(err) };
         }
     }
+    else if (agent === 'cursor') {
+        // Cursor: flattened .md custom subagent under ~/.cursor/agents/
+        const agentsDir = path.join(agentHome, '.cursor', 'agents');
+        if (!fs.existsSync(agentsDir)) {
+            fs.mkdirSync(agentsDir, { recursive: true });
+        }
+        try {
+            const transformed = transformSubagentForCursor(subagentDir);
+            fs.writeFileSync(safeJoin(agentsDir, `${subagentName}.md`), transformed);
+            return { success: true };
+        }
+        catch (err) {
+            return { success: false, error: String(err) };
+        }
+    }
+    else if (agent === 'forge') {
+        // ForgeCode: flattened .md custom subagent under ~/.forge/agents/
+        const agentsDir = path.join(agentHome, '.forge', 'agents');
+        if (!fs.existsSync(agentsDir)) {
+            fs.mkdirSync(agentsDir, { recursive: true });
+        }
+        try {
+            const transformed = transformSubagentForForge(subagentDir);
+            fs.writeFileSync(safeJoin(agentsDir, `${subagentName}.md`), transformed);
+            return { success: true };
+        }
+        catch (err) {
+            return { success: false, error: String(err) };
+        }
+    }
+    else if (agent === 'goose') {
+        // Goose: recipe YAML custom-agent file under ~/.config/goose/agents/
+        const agentsDir = path.join(agentHome, '.config', 'goose', 'agents');
+        if (!fs.existsSync(agentsDir)) {
+            fs.mkdirSync(agentsDir, { recursive: true });
+        }
+        try {
+            const transformed = transformSubagentForGoose(subagentDir);
+            fs.writeFileSync(safeJoin(agentsDir, `${subagentName}.yaml`), transformed);
+            return { success: true };
+        }
+        catch (err) {
+            return { success: false, error: String(err) };
+        }
+    }
     else {
         // Other agents don't support subagents yet
         return { success: false, error: `Agent '${agent}' does not support subagents` };
@@ -670,6 +775,27 @@ export function removeSubagentFromAgent(subagentName, agent, agentHome) {
             }
             return { success: true };
         }
+        else if (agent === 'cursor') {
+            const targetPath = safeJoin(path.join(agentHome, '.cursor', 'agents'), `${subagentName}.md`);
+            if (fs.existsSync(targetPath)) {
+                fs.unlinkSync(targetPath);
+            }
+            return { success: true };
+        }
+        else if (agent === 'forge') {
+            const targetPath = safeJoin(path.join(agentHome, '.forge', 'agents'), `${subagentName}.md`);
+            if (fs.existsSync(targetPath)) {
+                fs.unlinkSync(targetPath);
+            }
+            return { success: true };
+        }
+        else if (agent === 'goose') {
+            const targetPath = safeJoin(path.join(agentHome, '.config', 'goose', 'agents'), `${subagentName}.yaml`);
+            if (fs.existsSync(targetPath)) {
+                fs.unlinkSync(targetPath);
+            }
+            return { success: true };
+        }
         else {
             return { success: true }; // No-op for unsupported agents
         }
@@ -886,6 +1012,61 @@ export function listSubagentsForAgent(agentId, home) {
             });
         }
     }
+    else if (agentId === 'cursor') {
+        // Cursor: flat `<name>.md` files under ~/.cursor/agents/
+        const agentsDir = path.join(home, '.cursor', 'agents');
+        if (!fs.existsSync(agentsDir))
+            return subagents;
+        for (const file of fs.readdirSync(agentsDir)) {
+            if (!file.endsWith('.md'))
+                continue;
+            const filePath = path.join(agentsDir, file);
+            if (!fs.statSync(filePath).isFile())
+                continue;
+            const name = file.replace(/\.md$/, '');
+            const frontmatter = parseSubagentFrontmatter(filePath) ?? { name, description: '' };
+            subagents.push({ name, path: filePath, files: [file], frontmatter });
+        }
+    }
+    else if (agentId === 'forge') {
+        // ForgeCode: flat `<name>.md` files under ~/.forge/agents/
+        const agentsDir = path.join(home, '.forge', 'agents');
+        if (!fs.existsSync(agentsDir))
+            return subagents;
+        for (const file of fs.readdirSync(agentsDir)) {
+            if (!file.endsWith('.md'))
+                continue;
+            const filePath = path.join(agentsDir, file);
+            if (!fs.statSync(filePath).isFile())
+                continue;
+            const name = file.replace(/\.md$/, '');
+            const frontmatter = parseSubagentFrontmatter(filePath) ?? { name, description: '' };
+            subagents.push({ name, path: filePath, files: [file], frontmatter });
+        }
+    }
+    else if (agentId === 'goose') {
+        // Goose: recipe YAML files under ~/.config/goose/agents/
+        const agentsDir = path.join(home, '.config', 'goose', 'agents');
+        if (!fs.existsSync(agentsDir))
+            return subagents;
+        for (const file of fs.readdirSync(agentsDir)) {
+            if (!file.endsWith('.yaml'))
+                continue;
+            const filePath = path.join(agentsDir, file);
+            if (!fs.statSync(filePath).isFile())
+                continue;
+            const name = file.replace(/\.yaml$/, '');
+            let frontmatter;
+            try {
+                const recipe = yaml.parse(fs.readFileSync(filePath, 'utf-8'));
+                frontmatter = { name: recipe?.title || name, description: recipe?.description || '' };
+            }
+            catch {
+                continue;
+            }
+            subagents.push({ name, path: filePath, files: [file], frontmatter });
+        }
+    }
     return subagents;
 }
 /**
@@ -984,6 +1165,42 @@ export function diffVersionSubagents(agent, version) {
             }
         }
     }
+    else if (agent === 'cursor') {
+        const agentsDir = path.join(versionHome, '.cursor', 'agents');
+        if (fs.existsSync(agentsDir)) {
+            for (const file of fs.readdirSync(agentsDir)) {
+                if (!file.endsWith('.md'))
+                    continue;
+                const name = path.basename(file, '.md');
+                if (!discovered.has(name))
+                    orphans.push(name);
+            }
+        }
+    }
+    else if (agent === 'forge') {
+        const agentsDir = path.join(versionHome, '.forge', 'agents');
+        if (fs.existsSync(agentsDir)) {
+            for (const file of fs.readdirSync(agentsDir)) {
+                if (!file.endsWith('.md'))
+                    continue;
+                const name = path.basename(file, '.md');
+                if (!discovered.has(name))
+                    orphans.push(name);
+            }
+        }
+    }
+    else if (agent === 'goose') {
+        const agentsDir = path.join(versionHome, '.config', 'goose', 'agents');
+        if (fs.existsSync(agentsDir)) {
+            for (const file of fs.readdirSync(agentsDir)) {
+                if (!file.endsWith('.yaml'))
+                    continue;
+                const name = path.basename(file, '.yaml');
+                if (!discovered.has(name))
+                    orphans.push(name);
+            }
+        }
+    }
     return { agent, version, orphans: orphans.sort() };
 }
 /**
@@ -1071,6 +1288,27 @@ export function removeSubagentFromVersion(agent, version, subagentName) {
                 fs.renameSync(targetPath, path.join(trashDir, `${subagentName}.json.${stamp}`));
             }
         }
+        else if (agent === 'cursor') {
+            const targetPath = path.join(versionHome, '.cursor', 'agents', `${subagentName}.md`);
+            if (fs.existsSync(targetPath)) {
+                fs.mkdirSync(trashDir, { recursive: true, mode: 0o700 });
+                fs.renameSync(targetPath, path.join(trashDir, `${subagentName}.md.${stamp}`));
+            }
+        }
+        else if (agent === 'forge') {
+            const targetPath = path.join(versionHome, '.forge', 'agents', `${subagentName}.md`);
+            if (fs.existsSync(targetPath)) {
+                fs.mkdirSync(trashDir, { recursive: true, mode: 0o700 });
+                fs.renameSync(targetPath, path.join(trashDir, `${subagentName}.md.${stamp}`));
+            }
+        }
+        else if (agent === 'goose') {
+            const targetPath = path.join(versionHome, '.config', 'goose', 'agents', `${subagentName}.yaml`);
+            if (fs.existsSync(targetPath)) {
+                fs.mkdirSync(trashDir, { recursive: true, mode: 0o700 });
+                fs.renameSync(targetPath, path.join(trashDir, `${subagentName}.yaml.${stamp}`));
+            }
+        }
         return { success: true };
     }
     catch (err) {

package/dist/lib/triggers/webhook.d.ts

@@ -1,29 +1,34 @@
 /**
- * GitHub webhook trigger receiver for routines.
+ * Public webhook trigger receiver for routines.
  *
  * A routine may declare a `trigger` block instead of (or alongside) a cron
  * `schedule` (see `JobConfig.trigger` in `../routines.ts`). This module turns
- * an incoming GitHub webhook into the set of routines it should fire, and
- * dispatches those routines through the exact same path a cron fire uses
+ * incoming GitHub or Linear webhooks into the set of routines they should fire,
+ * and dispatches those routines through the exact same path a cron fire uses
  * (`executeJobDetached`).
  *
- * The matching logic (`matchJobsToWebhook`) is a pure, side-effect-free
- * function so it can be unit-tested without a running daemon or http server.
- * The optional http listener (`startWebhookServer`) is a thin adapter over it.
+ * The matching logic is pure, so it can be unit-tested without a daemon or HTTP
+ * server. The listener adds the public-ingress requirements: raw-body HMAC
+ * verification, idempotency, source allow-listing, and rate limiting.
  */
 import * as http from 'http';
+import type { IncomingHttpHeaders } from 'http';
 import type { JobConfig, RunMeta } from '../routines.js';
-/**
- * A parsed GitHub webhook: the event name (from the `X-GitHub-Event` HTTP
- * header) plus the decoded JSON body. Kept deliberately loose (`payload` is an
- * arbitrary object) because callers may hand us any of GitHub's event shapes.
- */
-export interface GithubWebhook {
-    /** The GitHub event name, e.g. `pull_request`, `push`, `issue_comment`. */
+export type WebhookSource = 'github' | 'linear';
+export interface IncomingWebhook {
+    /** Delivery source, derived from `/hooks/<source>` or one-shot command flags. */
+    source: WebhookSource;
+    /** Source event name: GitHub header event or Linear payload `type`. */
     event: string;
-    /** The decoded JSON request body. */
+    /** Decoded JSON request body. */
     payload: Record<string, unknown>;
 }
+export type GithubWebhook = IncomingWebhook & {
+    source: 'github';
+};
+export type LinearWebhook = IncomingWebhook & {
+    source: 'linear';
+};
 /** Read `repository.full_name` (`owner/name`) from a webhook payload, if present. */
 export declare function webhookRepo(payload: Record<string, unknown>): string | null;
 /**
@@ -37,14 +42,13 @@ export declare function webhookRepo(payload: Record<string, unknown>): string |
  */
 export declare function webhookBranches(event: string, payload: Record<string, unknown>): string[];
 /** True when a single job's trigger matches the given webhook. Pure. */
-export declare function jobMatchesWebhook(job: JobConfig, webhook: GithubWebhook): boolean;
+export declare function jobMatchesWebhook(job: JobConfig, webhook: IncomingWebhook): boolean;
 /**
  * Pure matcher: given a set of jobs and an incoming webhook, return the jobs
- * whose `trigger` matches (event + optional repo + optional branch). Jobs
- * without a trigger (schedule-only routines) are never selected — proving
- * time-based jobs are unaffected by webhook delivery.
+ * whose `trigger` matches. Jobs without a trigger (schedule-only routines) are
+ * never selected — proving time-based jobs are unaffected by webhook delivery.
  */
-export declare function matchJobsToWebhook(jobs: JobConfig[], webhook: GithubWebhook): JobConfig[];
+export declare function matchJobsToWebhook(jobs: JobConfig[], webhook: IncomingWebhook): JobConfig[];
 /** Options for firing webhook-matched jobs (dispatch is injectable for tests). */
 export interface FireWebhookOptions {
     /** Job source. Defaults to all persisted routines (`listJobs()`). */
@@ -55,31 +59,70 @@ export interface FireWebhookOptions {
      * matching without spawning real agent processes.
      */
     dispatch?: (config: JobConfig) => Promise<RunMeta>;
+    /** Matched job names that already completed for this delivery. */
+    skipJobNames?: ReadonlySet<string>;
+    /** Called immediately after a single matched job dispatch succeeds. */
+    onJobFired?: (job: JobConfig, fired: FiredJob) => void;
 }
 /** Result of firing one matched job. */
 export interface FiredJob {
     jobName: string;
     runId: string;
 }
+export declare class WebhookDispatchError extends Error {
+    readonly fired: FiredJob[];
+    readonly failures: {
+        jobName: string;
+        error: Error;
+    }[];
+    constructor(message: string, fired: FiredJob[], failures: {
+        jobName: string;
+        error: Error;
+    }[]);
+}
 /**
  * Match an incoming webhook against the persisted routines and fire each match
  * through the cron dispatch path. Returns one entry per fired job.
  */
-export declare function fireWebhookJobs(webhook: GithubWebhook, options?: FireWebhookOptions): Promise<FiredJob[]>;
+export declare function fireWebhookJobs(webhook: IncomingWebhook, options?: FireWebhookOptions): Promise<FiredJob[]>;
+export declare function verifyGithubSignature(headers: IncomingHttpHeaders, rawBody: Buffer, secret: string): boolean;
+export declare function verifyLinearSignature(headers: IncomingHttpHeaders, rawBody: Buffer, secret: string): boolean;
+export declare function verifyLinearTimestamp(payload: Record<string, unknown>, now?: number, toleranceMs?: number): boolean;
+export interface WebhookSecrets {
+    github?: string;
+    linear?: string;
+}
+export interface DeliveryStore {
+    seen(id: string): boolean;
+    mark(id: string): void;
+    completedJobs(id: string): ReadonlySet<string>;
+    markJob(id: string, jobName: string): void;
+}
+export declare function createMemoryDeliveryStore(maxEntries?: number): DeliveryStore;
+export interface RateLimiter {
+    take(key: string): boolean;
+}
+export declare function createMemoryRateLimiter(limit: number, windowMs: number): RateLimiter;
 /** Options for the local webhook http listener. */
 export interface WebhookServerOptions {
     port?: number;
     host?: string;
+    /** HMAC signing secrets keyed by source. */
+    secrets: WebhookSecrets;
     /** Override the fire options (mainly for tests). */
     fire?: FireWebhookOptions;
     /** Called after each delivery is handled (mainly for tests/observability). */
-    onDelivery?: (event: string, fired: FiredJob[]) => void;
+    onDelivery?: (webhook: IncomingWebhook, fired: FiredJob[]) => void;
+    deliveryStore?: DeliveryStore;
+    rateLimiter?: RateLimiter;
+    rateLimitPerMinute?: number;
+    maxBodyBytes?: number;
 }
 /**
- * Start a minimal local webhook receiver. POSTs are read as JSON, the GitHub
- * event is taken from the `X-GitHub-Event` header, and matching routines are
- * fired via {@link fireWebhookJobs}. Returns the underlying server so callers
- * can `close()` it. The heavy lifting is the pure matcher above; this is only
- * the transport.
+ * Start a localhost-bound receiver. It accepts only:
+ *   POST /hooks/github  with X-Hub-Signature-256
+ *   POST /hooks/linear  with Linear-Signature + fresh webhookTimestamp
+ *
+ * Returns the underlying server so callers can `close()` it.
  */
-export declare function startWebhookServer(options?: WebhookServerOptions): http.Server;
+export declare function startWebhookServer(options: WebhookServerOptions): http.Server;