@phnx-labs/agents-cli 1.20.71 → 1.20.73

package/dist/lib/triggers/webhook.js

@@ -77,18 +77,46 @@ function linearTeamKey(payload) {
     return typeof team?.key === 'string' ? team.key : null;
 }
 function linearLabels(payload) {
+    // Linear webhook bodies flatten list relations: an Issue event carries
+    // `data.labels` as a flat array of label objects (`[{ id, name, color }]`),
+    // NOT the `{ nodes: [...] }` connection shape returned by the GraphQL API.
+    // Reading `.nodes` here made every `--label` filter match nothing.
     const data = payload.data;
-    const labels = data?.labels;
-    const nodes = Array.isArray(labels?.nodes) ? labels.nodes : [];
-    return nodes
+    const labels = Array.isArray(data?.labels) ? data?.labels : [];
+    return labels
         .map((n) => n.name)
         .filter((n) => typeof n === 'string' && n.length > 0);
 }
+function githubAction(payload) {
+    return typeof payload.action === 'string' ? payload.action : null;
+}
+function githubLabels(payload) {
+    const names = new Set();
+    const add = (value) => {
+        if (typeof value === 'string' && value.length > 0)
+            names.add(value);
+    };
+    const deliveryLabel = payload.label;
+    add(deliveryLabel?.name);
+    const pr = payload.pull_request;
+    const prLabels = Array.isArray(pr?.labels) ? pr.labels : [];
+    for (const label of prLabels) {
+        add(label.name);
+    }
+    const issue = payload.issue;
+    const issueLabels = Array.isArray(issue?.labels) ? issue.labels : [];
+    for (const label of issueLabels) {
+        add(label.name);
+    }
+    return [...names];
+}
 function githubTriggerMatches(trigger, webhook) {
     if (webhook.source !== 'github')
         return false;
     if (trigger.event !== webhook.event)
         return false;
+    if (trigger.action && githubAction(webhook.payload) !== trigger.action)
+        return false;
     if (trigger.repo) {
         const repo = webhookRepo(webhook.payload);
         if (!repo || repo.toLowerCase() !== trigger.repo.toLowerCase())
@@ -99,6 +127,11 @@ function githubTriggerMatches(trigger, webhook) {
         if (!branches.some((b) => b === trigger.branch))
             return false;
     }
+    if (trigger.label) {
+        const expected = trigger.label.toLowerCase();
+        if (!githubLabels(webhook.payload).some((name) => name.toLowerCase() === expected))
+            return false;
+    }
     return true;
 }
 function linearTriggerMatches(trigger, webhook) {

package/dist/lib/types.d.ts

@@ -508,6 +508,29 @@ export interface VersionResources {
     permissions?: ResourcePattern[];
     mcp?: ResourcePattern[];
 }
+/** Resource-kind selectors controlled by top-level resource profiles. */
+export interface ResourceProfilePreset {
+    description?: string;
+    commands?: ResourcePattern[];
+    skills?: ResourcePattern[];
+    hooks?: ResourcePattern[];
+    subagents?: ResourcePattern[];
+    plugins?: ResourcePattern[];
+    workflows?: ResourcePattern[];
+    permissions?: ResourcePattern[];
+    mcp?: ResourcePattern[];
+    /** Rule preset name to compose while this profile is active. */
+    rules?: string;
+    /** Alias for rules, accepted so YAML can mirror VersionResources naming. */
+    rulesPreset?: string;
+    /** Secrets bundle names, or "*" for every bundle. */
+    secrets?: string[];
+}
+/** Top-level profiles/presets that switch the resolved resource view. */
+export interface ResourceProfilesConfig {
+    active?: string;
+    presets?: Record<string, ResourceProfilePreset>;
+}
 /** A userConfig field declared in a plugin manifest. */
 export interface PluginUserConfigField {
     key: string;
@@ -644,6 +667,28 @@ export interface ExtraRepoConfig {
     path?: string;
     enabled: boolean;
 }
+/**
+ * A white-label brand — a personally-named CLI (e.g. `jack`) that IS agents-cli,
+ * minted by `agents setup mine` / `agents mine`. The brand's shim exports
+ * `AGENTS_BRAND=<name>`; the entrypoint reads it to present under this name and
+ * apply the customization below. Portable user config — rides `agents repo
+ * push/pull`. See lib/brand.ts.
+ */
+export interface BrandConfig {
+    /** The brand name; also the binary name on PATH. */
+    name: string;
+    /** Built-in top-level commands this brand hides/disables (e.g. `["teams"]`). */
+    disabledCommands?: string[];
+    /**
+     * Resource-profile preset this brand pins (a key in `profiles.presets`). When
+     * the CLI runs under this brand, that preset becomes the active profile, so
+     * skills/plugins/mcp/hooks/etc. filter to the brand's curated set. Defaults to
+     * `mine-<name>`.
+     */
+    profile?: string;
+    /** False to keep the config but stop minting/using the brand. */
+    enabled: boolean;
+}
 /** Top-level structure of ~/.agents/.system/agents.yaml -- the CLI's persistent state. */
 export interface Meta {
     agents?: Partial<Record<AgentId, string>>;
@@ -682,6 +727,12 @@ export interface Meta {
         enabled?: BetaFeatureName[];
     };
     registries?: Record<RegistryType, Record<string, RegistryConfig>>;
+    /**
+     * Top-level resource profiles. Activating one filters the resolved resource
+     * set across commands, skills, hooks, rules, MCP, permissions, and secrets.
+     * Model-provider run profiles are separate YAML files under profiles/.
+     */
+    profiles?: ResourceProfilesConfig;
     versions?: Partial<Record<AgentId, Record<string, VersionResources>>>;
     source?: string;
     /**
@@ -696,6 +747,12 @@ export interface Meta {
      * via the `path` field.
      */
     extraRepos?: Record<string, ExtraRepoConfig>;
+    /**
+     * White-label brands keyed by name. Each mints a personally-named binary
+     * (e.g. `jack`) that runs agents-cli under that name with its own disabled
+     * commands + curated resource profile. See lib/brand.ts.
+     */
+    brands?: Record<string, BrandConfig>;
     /**
      * Keys like `skill.hermes` — registries seeded from SEEDED_REGISTRIES exactly
      * once. Tracked so a user `registry remove` won't silently re-seed.
@@ -746,6 +803,22 @@ export interface Meta {
         workerName?: string;
         bucketName?: string;
         domain?: string;
+        /** Cloudflare Web Analytics token injected into published HTML pages. */
+        analyticsToken?: string;
+    };
+    /**
+     * Owner/channel notification config for `agents send` / `agents notify`.
+     * `owner` is the default recipient for `agents notify` (channel + target).
+     * `transports` maps a user-facing channel name to the provider that actually
+     * delivers it — explicit, one provider per channel, no fallback. Omitted keys
+     * default to name-identity (channel `slack` -> provider `slack`).
+     */
+    notify?: {
+        owner?: {
+            channel: string;
+            to: string;
+        };
+        transports?: Record<string, string>;
     };
 }
 /** Persisted agent-host entry in agents.yaml (overlay or inline). */

package/dist/lib/uninstall.d.ts

@@ -0,0 +1,84 @@
+import type { AgentId } from './types.js';
+/** What the uninstall intends to do with one agent's config directory. */
+export type ConfigAction = {
+    agent: AgentId;
+    realPath: string;
+    kind: 'restore-backup';
+    source: string;
+} | {
+    agent: AgentId;
+    realPath: string;
+    kind: 'restore-version-home';
+    source: string;
+} | {
+    agent: AgentId;
+    realPath: string;
+    kind: 'remove-dangling';
+} | {
+    agent: AgentId;
+    realPath: string;
+    kind: 'leave-real';
+} | {
+    agent: AgentId;
+    realPath: string;
+    kind: 'leave-foreign';
+} | {
+    agent: AgentId;
+    realPath: string;
+    kind: 'absent';
+};
+/** A home-level file symlink (e.g. `~/.claude.json`) agents-cli owns. */
+export interface HomeFileAction {
+    realPath: string;
+    /** Resolved symlink target whose contents are copied back to `realPath`. */
+    source: string;
+}
+/** The full, read-only plan describing what an uninstall would change. */
+export interface UninstallPlan {
+    isInstalled: boolean;
+    agentsDir: string;
+    legacySymlink: string | null;
+    configs: ConfigAction[];
+    homeFiles: HomeFileAction[];
+    launchers: string[];
+    rcFiles: string[];
+}
+/** Structured result of an executed uninstall (for reporting). */
+export interface UninstallResult {
+    restoredConfigs: Array<{
+        agent: AgentId;
+        realPath: string;
+    }>;
+    removedDanglingConfigs: Array<{
+        agent: AgentId;
+        realPath: string;
+    }>;
+    restoredHomeFiles: string[];
+    releasedLaunchers: string[];
+    cleanedRcFiles: string[];
+    agentsDir: {
+        path: string;
+        disposition: 'moved' | 'purged' | 'absent';
+        movedTo?: string;
+    };
+    legacySymlinkRemoved: boolean;
+    /** True when `--purge` was requested but downgraded to move-aside after errors. */
+    purgeDowngraded: boolean;
+    errors: string[];
+}
+/**
+ * Build a read-only plan of everything a complete uninstall would change.
+ * Performs no mutations; safe to run for `--dry-run` and to print for confirm.
+ */
+export declare function planUninstall(): UninstallPlan;
+/**
+ * Execute a plan built by {@link planUninstall}. Restores adopted config dirs
+ * and home files, releases adopted launchers, strips shim PATH lines, then
+ * disposes of `~/.agents` — moved aside to `~/.agents.removed-<ts>` (recoverable)
+ * by default, or hard-deleted when `purge` is set. Config restore always runs
+ * before disposal because the backups live inside `~/.agents`.
+ */
+export declare function executeUninstall(plan: UninstallPlan, opts: {
+    purge?: boolean;
+    timestamp: number;
+}): UninstallResult;

package/dist/lib/uninstall.js

@@ -0,0 +1,347 @@
+/**
+ * Complete teardown of agents-cli — the reverse of `agents setup`.
+ *
+ * The hard part is undoing "adoption": normal installs move the user's real
+ * `~/.<agent>` aside and replace it with a symlink into agents-cli's version
+ * homes (see `switchConfigSymlink` / `importAgent`). A clean uninstall must put
+ * those real directories back, release any adopted launchers, strip the shim
+ * directory from the user's PATH, and only then dispose of `~/.agents`.
+ *
+ * Safety invariant: a `~/.<agent>` that agents-cli never adopted is a REAL user
+ * directory and is never touched. Ownership is decided structurally by
+ * `getConfigSymlinkVersion` (non-null only for a symlink into our versions dir),
+ * exactly as `removeVersion` does it — no marker files, no guessing.
+ *
+ * This module is split into a read-only {@link planUninstall} and a mutating
+ * {@link executeUninstall} so `--dry-run` and the real run share one code path.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { AGENTS, ALL_AGENT_IDS } from './agents.js';
+import { getAgentConfigPath, getConfigSymlinkVersion, stripShimPathLines, releaseAdoptedLauncher, } from './shims.js';
+import { getUserAgentsDir, getBackupsDir, getHistoryDir, getShimsDir, getLegacySystemAgentsDir, } from './state.js';
+/** Home dir honoring the AGENTS_REAL_HOME test/override, mirroring shims.ts. */
+function realHome() {
+    return process.env.AGENTS_REAL_HOME || os.homedir();
+}
+/** Newest timestamped backup dir under `<backups>/<agent>/`, or null. */
+function newestBackupDir(agent) {
+    const dir = path.join(getBackupsDir(), agent);
+    let entries;
+    try {
+        entries = fs.readdirSync(dir).filter((n) => /^\d+$/.test(n));
+    }
+    catch {
+        return null;
+    }
+    if (entries.length === 0)
+        return null;
+    entries.sort((a, b) => Number(a) - Number(b));
+    return path.join(dir, entries[entries.length - 1]);
+}
+/** Absolute target of a symlink, or null if `p` is not a readable symlink. */
+function symlinkTarget(p) {
+    try {
+        const raw = fs.readlinkSync(p);
+        return path.resolve(path.dirname(p), raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Remove a symlink/junction at `p` without following into its target. On POSIX
+ * this is a plain `unlinkSync`; on Windows the same call correctly deletes a
+ * junction or directory-symlink reparse point while leaving the target intact —
+ * verified on a real Windows host, where `fs.rmSync(p, { force: true })` instead
+ * throws `EFAULT` on a reparse point. `rmSync` is deliberately NOT used here.
+ */
+function removeLink(p) {
+    fs.unlinkSync(p);
+}
+/**
+ * Move `source` onto `dest` across possibly-different volumes. `renameSync` is
+ * atomic but throws EXDEV when `~/.agents` lives on a different filesystem than
+ * `$HOME`; fall back to copy-then-remove so the restore still completes. The
+ * source (a backup inside `~/.agents`) is removed only after the copy succeeds,
+ * so a mid-copy failure never destroys the sole surviving copy.
+ */
+function moveDirCrossDevice(source, dest) {
+    try {
+        fs.renameSync(source, dest);
+    }
+    catch (err) {
+        if (err.code !== 'EXDEV')
+            throw err;
+        fs.cpSync(source, dest, { recursive: true });
+        fs.rmSync(source, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy `source` to `dest`, dropping any symlink whose target resolves back into
+ * `~/.agents`. Adoption syncs managed resources (skills/commands) into the
+ * version home as symlinks into `~/.agents`; copying them verbatim would leave
+ * the restored config full of links that dangle the moment `~/.agents` is
+ * disposed. Stripping them yields a clean, self-contained restore.
+ */
+function copyDirStrippingAgentsSymlinks(source, dest, agentsDir) {
+    const inside = agentsDir + path.sep;
+    fs.cpSync(source, dest, {
+        recursive: true,
+        filter: (src) => {
+            try {
+                const st = fs.lstatSync(src);
+                if (st.isSymbolicLink()) {
+                    const tgt = path.resolve(path.dirname(src), fs.readlinkSync(src));
+                    if (tgt === agentsDir || tgt.startsWith(inside))
+                        return false;
+                }
+            }
+            catch {
+                /* unreadable entry — let cpSync surface it on the real copy */
+            }
+            return true;
+        },
+    });
+}
+/** Classify one agent's config dir without mutating anything. */
+function planConfig(agent) {
+    const realPath = getAgentConfigPath(agent);
+    let stat;
+    try {
+        stat = fs.lstatSync(realPath);
+    }
+    catch {
+        return { agent, realPath, kind: 'absent' };
+    }
+    // A real directory means agents-cli never adopted it — leave it alone.
+    if (!stat.isSymbolicLink())
+        return { agent, realPath, kind: 'leave-real' };
+    // A symlink we don't own (target not under our versions dir) — leave it alone.
+    if (getConfigSymlinkVersion(agent) === null)
+        return { agent, realPath, kind: 'leave-foreign' };
+    // Owned symlink: prefer the timestamped backup (switchConfigSymlink moved the
+    // real dir there); otherwise the symlink target itself holds the user's data
+    // (importAgent renamed the real dir INTO the version home).
+    const backup = newestBackupDir(agent);
+    if (backup)
+        return { agent, realPath, kind: 'restore-backup', source: backup };
+    const target = symlinkTarget(realPath);
+    if (target && fs.existsSync(target)) {
+        return { agent, realPath, kind: 'restore-version-home', source: target };
+    }
+    return { agent, realPath, kind: 'remove-dangling' };
+}
+/** Owned home-file symlinks (e.g. `~/.claude.json`) to copy back as real files. */
+function planHomeFiles() {
+    const home = realHome();
+    const userDir = getUserAgentsDir();
+    const out = [];
+    for (const agent of ALL_AGENT_IDS) {
+        const homeFiles = AGENTS[agent].homeFiles;
+        if (!homeFiles)
+            continue;
+        for (const fileName of homeFiles) {
+            const realPath = path.join(home, fileName);
+            let stat;
+            try {
+                stat = fs.lstatSync(realPath);
+            }
+            catch {
+                continue;
+            }
+            if (!stat.isSymbolicLink())
+                continue;
+            const target = symlinkTarget(realPath);
+            // Only ours (points into ~/.agents) and only if the target still exists.
+            if (target && target.startsWith(userDir + path.sep) && fs.existsSync(target)) {
+                out.push({ realPath, source: target });
+            }
+        }
+    }
+    return out;
+}
+/** cliCommand basenames that have an adopted-launcher record to release. */
+function planLaunchers() {
+    const dir = path.join(getHistoryDir(), 'adopted-launchers');
+    try {
+        return fs.readdirSync(dir).filter((n) => !n.startsWith('.'));
+    }
+    catch {
+        return [];
+    }
+}
+/** Candidate shell rc files that currently contain a shim PATH entry. */
+function planRcFiles() {
+    const home = realHome();
+    const shimsDir = getShimsDir();
+    const candidates = ['.zshrc', '.bashrc', '.bash_profile', '.profile', path.join('.config', 'fish', 'config.fish')];
+    const out = [];
+    for (const rel of candidates) {
+        const rc = path.join(home, rel);
+        let content;
+        try {
+            content = fs.readFileSync(rc, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        if (stripShimPathLines(content, shimsDir) !== content)
+            out.push(rc);
+    }
+    return out;
+}
+/**
+ * Build a read-only plan of everything a complete uninstall would change.
+ * Performs no mutations; safe to run for `--dry-run` and to print for confirm.
+ */
+export function planUninstall() {
+    const agentsDir = getUserAgentsDir();
+    const legacy = getLegacySystemAgentsDir();
+    let legacySymlink = null;
+    try {
+        // Only claim it if it's actually a link (symlink on POSIX, junction on Windows —
+        // both report isSymbolicLink()); a real directory here is left alone so removeLink
+        // (unlinkSync) is always the correct primitive for what we captured.
+        if (fs.lstatSync(legacy).isSymbolicLink())
+            legacySymlink = legacy;
+    }
+    catch {
+        legacySymlink = null;
+    }
+    return {
+        isInstalled: fs.existsSync(agentsDir),
+        agentsDir,
+        legacySymlink,
+        configs: ALL_AGENT_IDS.map(planConfig),
+        homeFiles: planHomeFiles(),
+        launchers: planLaunchers(),
+        rcFiles: planRcFiles(),
+    };
+}
+/**
+ * Execute a plan built by {@link planUninstall}. Restores adopted config dirs
+ * and home files, releases adopted launchers, strips shim PATH lines, then
+ * disposes of `~/.agents` — moved aside to `~/.agents.removed-<ts>` (recoverable)
+ * by default, or hard-deleted when `purge` is set. Config restore always runs
+ * before disposal because the backups live inside `~/.agents`.
+ */
+export function executeUninstall(plan, opts) {
+    const result = {
+        restoredConfigs: [],
+        removedDanglingConfigs: [],
+        restoredHomeFiles: [],
+        releasedLaunchers: [],
+        cleanedRcFiles: [],
+        agentsDir: { path: plan.agentsDir, disposition: 'absent' },
+        legacySymlinkRemoved: false,
+        purgeDowngraded: false,
+        errors: [],
+    };
+    // 1. Restore adopted config directories (reads backups inside ~/.agents).
+    for (const c of plan.configs) {
+        try {
+            if (c.kind === 'restore-backup') {
+                // The adopted link carries no data (the real dir is the backup); drop it,
+                // then move the backup out of ~/.agents onto the real path — EXDEV-safe so a
+                // cross-volume ~/.agents can't strand the backup mid-restore. unlinkSync (not
+                // rmSync) is deliberate: it removes a POSIX symlink AND a Windows junction/
+                // dir-symlink without following into the target, whereas rmSync throws EFAULT
+                // on a Windows reparse point.
+                removeLink(c.realPath);
+                moveDirCrossDevice(c.source, c.realPath);
+                result.restoredConfigs.push({ agent: c.agent, realPath: c.realPath });
+            }
+            else if (c.kind === 'restore-version-home') {
+                // importAgent renamed the real dir INTO the version home; copy it back
+                // (step 6 disposes the original) while stripping resource symlinks that
+                // would dangle once ~/.agents is gone.
+                removeLink(c.realPath);
+                copyDirStrippingAgentsSymlinks(c.source, c.realPath, plan.agentsDir);
+                result.restoredConfigs.push({ agent: c.agent, realPath: c.realPath });
+            }
+            else if (c.kind === 'remove-dangling') {
+                removeLink(c.realPath);
+                result.removedDanglingConfigs.push({ agent: c.agent, realPath: c.realPath });
+            }
+            // leave-real / leave-foreign / absent: intentionally untouched.
+        }
+        catch (err) {
+            result.errors.push(`config ${c.agent} (${c.realPath}): ${err.message}`);
+        }
+    }
+    // 2. Restore owned home-file symlinks as real files (e.g. ~/.claude.json).
+    for (const hf of plan.homeFiles) {
+        try {
+            removeLink(hf.realPath);
+            fs.cpSync(hf.source, hf.realPath, { recursive: true });
+            result.restoredHomeFiles.push(hf.realPath);
+        }
+        catch (err) {
+            result.errors.push(`home file ${hf.realPath}: ${err.message}`);
+        }
+    }
+    // 3. Release adopted launchers (reads records inside ~/.agents).
+    const byCli = new Map(ALL_AGENT_IDS.map((a) => [AGENTS[a].cliCommand, a]));
+    for (const cli of plan.launchers) {
+        const agent = byCli.get(cli);
+        if (!agent)
+            continue;
+        try {
+            releaseAdoptedLauncher(agent);
+            result.releasedLaunchers.push(cli);
+        }
+        catch (err) {
+            result.errors.push(`launcher ${cli}: ${err.message}`);
+        }
+    }
+    // 4. Strip the shim directory from the user's PATH across all rc files.
+    const shimsDir = getShimsDir();
+    for (const rc of plan.rcFiles) {
+        try {
+            const content = fs.readFileSync(rc, 'utf-8');
+            fs.writeFileSync(rc, stripShimPathLines(content, shimsDir));
+            result.cleanedRcFiles.push(rc);
+        }
+        catch (err) {
+            result.errors.push(`rc file ${rc}: ${err.message}`);
+        }
+    }
+    // 5. Remove the legacy back-compat symlink, if present. `~/.agents-system` is a
+    // link (junction on Windows — createLink uses 'junction' for a dir source), so it
+    // goes through removeLink for the same reason as the config links: rmSync throws
+    // EFAULT on a Windows reparse point.
+    if (plan.legacySymlink) {
+        try {
+            removeLink(plan.legacySymlink);
+            result.legacySymlinkRemoved = true;
+        }
+        catch (err) {
+            result.errors.push(`legacy ${plan.legacySymlink}: ${err.message}`);
+        }
+    }
+    // 6. Dispose of ~/.agents LAST (its backups fed step 1). If any restore above
+    // failed, downgrade a --purge to a recoverable move-aside: a swallowed restore
+    // error must never let the hard-delete take the user's only copy with it.
+    if (fs.existsSync(plan.agentsDir)) {
+        const purge = !!opts.purge && result.errors.length === 0;
+        if (opts.purge && !purge)
+            result.purgeDowngraded = true;
+        try {
+            if (purge) {
+                fs.rmSync(plan.agentsDir, { recursive: true, force: true });
+                result.agentsDir = { path: plan.agentsDir, disposition: 'purged' };
+            }
+            else {
+                const movedTo = `${plan.agentsDir}.removed-${opts.timestamp}`;
+                fs.renameSync(plan.agentsDir, movedTo);
+                result.agentsDir = { path: plan.agentsDir, disposition: 'moved', movedTo };
+            }
+        }
+        catch (err) {
+            result.errors.push(`dispose ${plan.agentsDir}: ${err.message}`);
+        }
+    }
+    return result;
+}

package/dist/lib/usage.d.ts

@@ -1,5 +1,17 @@
 import { type AccountInfo } from './agents.js';
 import type { AgentId } from './types.js';
+/**
+ * True when a Claude OAuth access token is within the refresh leeway of expiry
+ * (or already expired) — i.e. it "would need a refresh" before the next use.
+ *
+ * Single source of truth for the expiry gate, shared by the two callers that
+ * must agree on it but act differently: the run/usage hot path
+ * (`getClaudeAccessToken`) refreshes when this is true; the health probe
+ * (`probeClaudeStatus`) must NOT refresh and instead reports the non-fatal
+ * `expired` state (RUSH-1822). A missing `expiresAt` is treated as "still
+ * fresh" (never force a refresh on a token with no known expiry).
+ */
+export declare function claudeAccessTokenNeedsRefresh(expiresAt: number | null | undefined, nowMs?: number): boolean;
 /** Discriminator for usage window types. */
 export type UsageWindowKey = 'session' | 'week' | 'sonnet_week' | 'month';
 /** A single rate-limit window with utilization percentage and reset time. */
@@ -201,7 +213,7 @@ export interface ProviderProbe {
     /** Network/parse error message when status is null but a token was present. */
     error?: string;
 }
-/** Probe Claude's OAuth token against the usage endpoint. Refreshes an expired access token (safe for Claude). */
+/** Probe Claude's OAuth token against the usage endpoint. Never refreshes — reports `expired` for a near-expiry token; see the comment below (RUSH-1822). */
 export declare function probeClaudeStatus(home?: string, cliVersion?: string | null): Promise<ProviderProbe>;
 /** Probe Kimi's OAuth token against the /usages endpoint. Never refreshes (single-use rotation — see getKimiUsageInfo). */
 export declare function probeKimiStatus(home?: string): Promise<ProviderProbe>;