@phnx-labs/agents-cli 1.22.112 → 1.22.114

package/dist/lib/github/project-prs.js

@@ -0,0 +1,173 @@
+/**
+ * `agents projects prs <PROJECT>` — every OPEN pull request across a project's
+ * attached repositories, as one machine-readable envelope for AGI Menu.
+ *
+ * Why this exists: `agents projects status`'s `openPrs` only carries the PRs the
+ * fleet's own SESSIONS opened (the session rollup), so a project's board of open
+ * PRs — drafts, other people's PRs, anything not tied to a live session — is
+ * invisible to it. This reads the truth straight from GitHub.
+ *
+ * Design constraints (see docs conventions + the contract in
+ * `.agents/scratch/contracts-status.json`):
+ *   - Repos come ONLY from the ProjectDef's own attached slugs
+ *     ({@link projectRepoSlugs}); `--repo` is refused unless it is one of them.
+ *   - The list is REST + paginated (`gh api repos/{repo}/pulls?state=open
+ *     --paginate`), includes drafts, and applies NO author filter — it is the
+ *     whole open board, not this user's mergeable set. REST is the budget the
+ *     fleet's GraphQL poll loops do not drain (PHNX-3501).
+ *   - `checks` / `reviewDecision` are null in the list; `--number N` enriches
+ *     exactly that one PR against its live head SHA (checks via REST
+ *     {@link rollupForSha}, reviewDecision via a single lazy `gh pr view`).
+ *   - A per-repo fetch failure is reported as `repositories[].error` and flips
+ *     `partial` — it is NEVER relabeled as "zero open PRs".
+ */
+import { ghExec, canonicalizeRepo, projectRepoSlugs } from './pr-mergeable.js';
+import { rollupForSha } from './rest.js';
+/** The jq projection that flattens a REST PR object into {@link ProjectPr}'s scalars. */
+const PR_JQ = '{number, title, url: .html_url, isDraft: (.draft // false), ' +
+    'state: (.state // "" | ascii_upcase), updatedAt: (.updated_at // ""), ' +
+    'login: (.user.login // ""), avatarUrl: (.user.avatar_url // ""), ' +
+    'headRefName: (.head.ref // ""), baseRefName: (.base.ref // ""), ' +
+    'headSha: (.head.sha // ""), body: (.body // "")}';
+/** Parse newline-delimited JSON (gh `--jq` streams one object per line/page). */
+function parseNdjson(out) {
+    const rows = [];
+    for (const line of out.split('\n')) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        rows.push(JSON.parse(t));
+    }
+    return rows;
+}
+/** Build a {@link ProjectPr} from the flattened jq row. checks/reviewDecision start null. */
+export function rowToProjectPr(row) {
+    return {
+        number: Number(row.number),
+        title: String(row.title ?? ''),
+        url: String(row.url ?? ''),
+        isDraft: Boolean(row.isDraft),
+        state: String(row.state ?? ''),
+        updatedAt: String(row.updatedAt ?? ''),
+        author: { login: String(row.login ?? ''), avatarUrl: String(row.avatarUrl ?? '') },
+        headRefName: String(row.headRefName ?? ''),
+        baseRefName: String(row.baseRefName ?? ''),
+        headSha: String(row.headSha ?? ''),
+        body: String(row.body ?? ''),
+        checks: null,
+        reviewDecision: null,
+    };
+}
+/**
+ * Every OPEN PR for one repo, over REST, fully paginated, drafts included, no
+ * author filter. `--paginate` follows Link headers; `--jq` streams one flattened
+ * object per line so a multi-page result stays parseable.
+ */
+export async function listOpenPrs(repo, gh = ghExec) {
+    const out = await gh([
+        'api',
+        `repos/${repo}/pulls?state=open&per_page=100`,
+        '--paginate',
+        '--jq',
+        `.[] | ${PR_JQ}`,
+    ]);
+    return parseNdjson(out).map(rowToProjectPr);
+}
+/** One PR by number, over REST (`GET repos/{repo}/pulls/{n}`). Throws if it is gone. */
+export async function fetchOnePr(repo, number, gh = ghExec) {
+    const out = await gh(['api', `repos/${repo}/pulls/${number}`, '--jq', PR_JQ]);
+    const rows = parseNdjson(out);
+    if (rows.length === 0)
+        throw new Error(`no PR ${repo}#${number}`);
+    return rowToProjectPr(rows[0]);
+}
+/**
+ * GitHub's computed review decision AND the PR's current head oid, from ONE lazy
+ * `gh pr view` (GraphQL). reviewDecision is deliberately NOT REST-derived: it is
+ * a branch-protection / CODEOWNERS decision REST cannot compute, and
+ * approximating it could mislead a merge decision (PHNX-3501 note). `headRefOid`
+ * rides the same call so the checks and the review verdict can be anchored to the
+ * SAME head — a PR that advanced between the REST read and this call would
+ * otherwise pair a stale check rollup with a current review. One call per
+ * `--number`, never a poll loop, so it does not drain the shared GraphQL budget.
+ */
+export async function fetchReviewAndHead(repo, number, gh = ghExec) {
+    const out = (await gh([
+        'pr', 'view', String(number), '--repo', repo, '--json', 'reviewDecision,headRefOid',
+    ])).trim();
+    const parsed = out ? JSON.parse(out) : {};
+    return {
+        reviewDecision: parsed.reviewDecision || null,
+        headRefOid: parsed.headRefOid || null,
+    };
+}
+/**
+ * Enrich one PR with its checks + reviewDecision, both anchored to the SAME head.
+ * `gh pr view` gives the authoritative current head oid; the check rollup is run
+ * against THAT (not the possibly-staler REST head SHA), and `headSha` is updated
+ * to match, so checks and reviewDecision can never describe two different heads.
+ */
+export async function enrichPr(repo, pr, gh = ghExec) {
+    const { reviewDecision, headRefOid } = await fetchReviewAndHead(repo, pr.number, gh);
+    const head = headRefOid || pr.headSha;
+    const checks = await rollupForSha(repo, head, gh);
+    return { ...pr, headSha: head, checks, reviewDecision };
+}
+/**
+ * Resolve which repositories a run targets, restricted to the project's own
+ * attached repos. Slugs are canonicalized (a renamed repo lists nothing under
+ * its old name — `phnx-labs/agents-cli` → `phnx-labs/agi-cli`). A `--repo` that
+ * is not one of the project's attached repos (raw or canonical) is refused.
+ */
+export async function resolveTargetSlugs(def, repo, gh) {
+    const raw = projectRepoSlugs([def]);
+    // Canonicalize CONCURRENTLY — each `gh repo view` can take up to gh's 30s
+    // timeout, so a sequential walk of N repos would stack N×30s and blow past a
+    // native caller's bounded deadline. Repo count per project is small.
+    const canonPairs = await Promise.all(raw.map(async (slug) => [slug, await canonicalizeRepo(slug, gh)]));
+    const canon = new Map(canonPairs);
+    const canonical = [...new Set(canon.values())];
+    if (!repo)
+        return canonical;
+    const requested = await canonicalizeRepo(repo, gh);
+    const attached = raw.includes(repo) ||
+        canonical.includes(requested) ||
+        [...canon.keys()].some((k) => k === repo);
+    if (!attached) {
+        const list = raw.length ? raw.join(', ') : '(none)';
+        throw new Error(`Repo "${repo}" is not attached to project "${def.name}". Attached repos: ${list}.`);
+    }
+    return [requested];
+}
+/**
+ * Build the full envelope. `number` (which the command requires alongside
+ * `repo`) fetches and enriches exactly that one PR; otherwise every target
+ * repo's open PRs are listed with checks/reviewDecision left null.
+ */
+export async function buildProjectPrs(def, opts = {}, gh = ghExec) {
+    const project = { name: def.name, linearProjectId: def.linear?.projectId ?? null };
+    const slugs = await resolveTargetSlugs(def, opts.repo, gh);
+    // Fetch repos in PARALLEL so a native caller's overall deadline scales with the
+    // slowest repo, not the sum — a serial multi-repo walk of 30s gh calls can blow
+    // past a bounded caller timeout and lose the whole result. Repo count is small
+    // (a project's attached repos), so this is a bounded fan-out, not unbounded.
+    const repositories = await Promise.all(slugs.map(async (slug) => {
+        try {
+            let pullRequests;
+            if (opts.number !== undefined) {
+                const pr = await fetchOnePr(slug, opts.number, gh);
+                pullRequests = [await enrichPr(slug, pr, gh)];
+            }
+            else {
+                pullRequests = await listOpenPrs(slug, gh);
+            }
+            return { slug, pullRequests, error: null };
+        }
+        catch (err) {
+            // A fetch failure is reported, never relabeled as zero open PRs.
+            return { slug, pullRequests: [], error: err instanceof Error ? err.message : String(err) };
+        }
+    }));
+    const partial = repositories.some((r) => r.error !== null);
+    return { project, repositories, partial };
+}

package/dist/lib/github/rest.d.ts

@@ -27,7 +27,7 @@ export interface RollupItem extends StatusCheck {
     link?: string;
 }
 /** PR head identity — the SHA every check query must anchor to. */
-export interface PrHead {
+interface PrHead {
     number: number;
     sha: string;
 }
@@ -62,3 +62,4 @@ export declare function rollupForSha(repo: string, sha: string, gh?: GhExec): Pr
 export declare function pendingCheckSuites(repo: string, sha: string, gh?: GhExec): Promise<number>;
 /** True when gh stderr is the rate-limit outcome the shim should switch to REST on. */
 export declare function isRateLimitError(stderr: string): boolean;
+export {};

package/dist/lib/harness/exec-config-version.d.ts

@@ -1,8 +1,9 @@
 import type { AgentId } from '../types.js';
-export interface ResolvedConfigVersion {
+interface ResolvedConfigVersion {
     /** The version to pin, or null when unresolved / not installed. */
     version: string | null;
     /** The version home for that version, or null. */
     versionHome: string | null;
 }
 export declare function resolveConfigVersion(agent: AgentId, cwd: string, optionsVersion?: string): ResolvedConfigVersion;
+export {};

package/dist/lib/harness-auth-capabilities.d.ts

@@ -13,16 +13,16 @@
  * working until T4 folds connect into `accounts add`.
  */
 import type { AgentId } from './types.js';
-export type HarnessIdentityKind = 'strong' | 'email' | 'opaque';
+type HarnessIdentityKind = 'strong' | 'email' | 'opaque';
 /**
  * Durable worker credential, or `none` when the harness must log in per box.
  * Codex is both: an API key (portable, bills the API) OR a per-device
  * ChatGPT-plan device-auth login (the plan seat; never stored in the reserved
  * store because it is a rotating session).
  */
-export type HarnessWorkerKind = 'setup-token' | 'none' | `api-key:${string}` | `per-device${'' | `:${string}`}`;
-export type HarnessWorker = HarnessWorkerKind | HarnessWorkerKind[];
-export interface HarnessAuthCapability {
+type HarnessWorkerKind = 'setup-token' | 'none' | `api-key:${string}` | `per-device${'' | `:${string}`}`;
+type HarnessWorker = HarnessWorkerKind | HarnessWorkerKind[];
+interface HarnessAuthCapability {
     /** argv after the harness binary to start native login, or null when there is no finite login command. */
     login: string[] | null;
     /** argv to probe login status, or null when the CLI has no status command. */
@@ -59,3 +59,4 @@ export interface LoginInvocation {
     hint?: string;
 }
 export declare const LOGIN_INVOCATIONS: Partial<Record<AgentId, LoginInvocation>>;
+export {};

package/dist/lib/harness-connection-test.d.ts

@@ -40,7 +40,7 @@ export declare const CONNECTION_TEST_PROMPT = "say alive in one word";
  */
 export declare function classifyConnectionOutput(exitCode: number | null, output: string): ConnectionTestResult;
 /** Options for {@link runHarnessConnectionTest}. */
-export interface ConnectionTestOptions {
+interface ConnectionTestOptions {
     /** Agent-side timeout passed to `agents run --timeout`. Default `60s`. */
     timeout?: string;
     /** Hard wall-clock cap (ms) on the child, above the agent timeout. Default 90s. */
@@ -55,3 +55,4 @@ export interface ConnectionTestOptions {
  * (the request hung).
  */
 export declare function runHarnessConnectionTest(name: string, opts?: ConnectionTestOptions): Promise<ConnectionTestResult>;
+export {};

package/dist/lib/heal.d.ts

@@ -69,8 +69,8 @@ export interface HealResult {
     refreshedPlugins: PluginRefreshResult[];
     skippedPlugins: PluginRefreshSkip[];
 }
-export interface HealOptions {
-    /** 'full' (doctor --fix): fix drift + refresh unknown-baseline plugins.
+interface HealOptions {
+    /** 'full' (agents sync): fix drift + refresh unknown-baseline plugins.
      *  'safe' (daemon): missing + invalid-manifest + unmodified refresh only. */
     mode: 'full' | 'safe';
     /** Resolution cwd. Defaults to the home dir so no project layer is ever
@@ -85,27 +85,10 @@ export interface HealOptions {
 }
 /** True when a heal pass made (or would make) any change at all. */
 export declare function healChangedAnything(r: HealResult): boolean;
-/** One-line summary of a heal pass for daemon logs. */
-export declare function summarizeHeal(r: HealResult): string;
-/**
- * Fire a branded desktop notification when a background heal did something
- * noteworthy. Routed through the MenubarHelper companion (notify-desktop.ts) so
- * it carries the agents-cli mark; clicking opens the runs folder
- * (~/.agents/.history/runs, via the `routines:list` action the companion
- * understands). Best-effort — a missing
- * notifier or no display is swallowed. Silent when the pass auto-fixed everything
- * and nothing needs the operator (no point pinging them for routine self-healing).
- */
-export declare function notifyHeal(r: HealResult): void;
-/**
- * Strip Claude-invalid bare-name `skills`/`commands` fields from every central
- * plugin's SOURCE plugin.json. Unambiguously safe (Claude auto-discovers both
- * from their directories) and the precondition for those plugins loading at all.
- */
-export declare function repairCentralPluginManifests(dryRun?: boolean): ManifestRepairResult[];
 /**
  * Run a heal pass. Repairs the central plugin layer once (manifest + stale
  * refresh), then reconciles every targeted (agent, version) home against its
  * live diff. Returns a full account of what changed (or would, under dryRun).
  */
 export declare function heal(opts: HealOptions): Promise<HealResult>;
+export {};

package/dist/lib/heal.js

@@ -31,7 +31,6 @@ import { repairPluginManifestFile } from './plugins/plugin-marketplace.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { notifyDesktop } from './menubar/notify-desktop.js';
 // ─── diff → selection mapping ────────────────────────────────────────────────
 // Which ResourceSelection key each healable diff kind writes through. `rules`
 // re-syncs via the whole-memory channel (not name-scoped); `promptcuts` is not
@@ -55,49 +54,13 @@ export function healChangedAnything(r) {
         r.repairedManifests.length > 0 ||
         r.refreshedPlugins.length > 0);
 }
-/** One-line summary of a heal pass for daemon logs. */
-export function summarizeHeal(r) {
-    const parts = [];
-    const healed = totalHealed(r);
-    if (healed > 0)
-        parts.push(`${healed} resource(s) healed`);
-    if (r.repairedManifests.length > 0)
-        parts.push(`${r.repairedManifests.length} manifest(s) repaired`);
-    if (r.refreshedPlugins.length > 0)
-        parts.push(`${r.refreshedPlugins.length} plugin(s) refreshed`);
-    if (r.skippedPlugins.length > 0)
-        parts.push(`${r.skippedPlugins.length} plugin(s) need attention`);
-    return parts.length > 0 ? parts.join(', ') : 'nothing to heal';
-}
-/**
- * Fire a branded desktop notification when a background heal did something
- * noteworthy. Routed through the MenubarHelper companion (notify-desktop.ts) so
- * it carries the agents-cli mark; clicking opens the runs folder
- * (~/.agents/.history/runs, via the `routines:list` action the companion
- * understands). Best-effort — a missing
- * notifier or no display is swallowed. Silent when the pass auto-fixed everything
- * and nothing needs the operator (no point pinging them for routine self-healing).
- */
-export function notifyHeal(r) {
-    const needsAttention = r.skippedPlugins.length;
-    const healed = totalHealed(r) + r.repairedManifests.length + r.refreshedPlugins.length;
-    if (needsAttention === 0 && healed === 0)
-        return;
-    const title = needsAttention > 0
-        ? `${needsAttention} plugin${needsAttention === 1 ? '' : 's'} need attention`
-        : 'agents: auto-healed config gaps';
-    const body = needsAttention > 0
-        ? `${summarizeHeal(r)}. Run: agents sync`
-        : summarizeHeal(r);
-    notifyDesktop({ title, body, action: 'routines:list' });
-}
 // ─── central plugin layer (version-independent, runs once per heal) ──────────
 /**
  * Strip Claude-invalid bare-name `skills`/`commands` fields from every central
  * plugin's SOURCE plugin.json. Unambiguously safe (Claude auto-discovers both
  * from their directories) and the precondition for those plugins loading at all.
  */
-export function repairCentralPluginManifests(dryRun = false) {
+function repairCentralPluginManifests(dryRun = false) {
     const out = [];
     for (const p of discoverPlugins()) {
         const manifestPath = path.join(p.root, '.claude-plugin', 'plugin.json');
@@ -265,7 +228,7 @@ export async function heal(opts) {
     // unattended from the daemon (~30s after start, then every ~6h) — a sweep that
     // walked into an isolated home would quietly refill it with shared commands,
     // skills, hooks, MCP config and permissions. Explicitly NAMED versions
-    // (`agents doctor <agent>@<version> --fix`) are honoured as-is: naming the
+    // (`agents sync <agent>@<version>`) are honoured as-is: naming the
     // version is the operator's consent.
     const sweep = (a) => listInstalledVersions(a).filter((v) => !isVersionIsolated(a, v));
     const targets = opts.agent

package/dist/lib/help.d.ts

@@ -6,7 +6,7 @@
  */
 import type { Command } from 'commander';
 /** Description of a named command group rendered as its own section in help output. */
-export interface CommandGroup {
+interface CommandGroup {
     /** Section heading, e.g. 'Bundle commands'. */
     title: string;
     /** Subcommand names (in desired display order) that belong to this group. */
@@ -28,7 +28,7 @@ export declare const FRONT_DOOR_COMMAND_GROUPS: readonly CommandGroup[];
 /** Mark the root program so its help only renders front-door groups + a pointer. */
 export declare function setCompactRootHelp(program: Command): void;
 /** Examples + Notes blocks attached to a command via setHelpSections. */
-export interface HelpSections {
+interface HelpSections {
     examples?: string;
     notes?: string;
 }
@@ -45,3 +45,4 @@ export declare function setHelpSections(cmd: Command, sections: HelpSections): v
 export declare function getHelpSections(cmd: Command): Readonly<HelpSections>;
 /** Apply standardized help formatting to the root command and all subcommands. */
 export declare function applyGlobalHelpConventions(root: Command): void;
+export {};

package/dist/lib/helper-download.d.ts

@@ -81,10 +81,6 @@ export declare function helperAssetUrls(spec: HelperSpec, version: string): {
 /** Extract `TeamIdentifier=XXXX` from `codesign -dv --verbose=4` output (which is
  *  emitted on stderr). Returns null when absent (ad-hoc / unsigned). */
 export declare function parseTeamId(codesignInfo: string): string | null;
-/** Read the bundle's designated requirement string (`codesign -d --requirements -`).
- *  codesign writes it to stdout, but capture both streams so a diagnostic on
- *  stderr can never make the pin-check read empty and falsely pass. */
-export declare function readDesignatedRequirement(appPath: string): string;
 /**
  * Pure predicate (no I/O) behind the DR pin: does the requirement string pin
  * BOTH the expected CFBundleIdentifier and the Developer ID Team? Returns null
@@ -94,14 +90,6 @@ export declare function readDesignatedRequirement(appPath: string): string;
  * + team substring check against the same requirement string).
  */
 export declare function checkDesignatedRequirement(req: string, bundleId: string, teamId: string): string | null;
-/**
- * Verify the bundle's designated requirement pins the expected CFBundleIdentifier
- * AND Developer ID Team. macOS re-validates each new version against this stored
- * requirement to keep an Accessibility grant alive across upgrades; a downloaded
- * bundle whose DR drops either pin would silently revoke that grant on the next
- * paste, so refuse it.
- */
-export declare function verifyDesignatedRequirement(appPath: string, bundleId: string, teamId: string): void;
 /**
  * Verify a helper `.app` bundle is intact, signed by the expected Developer ID
  * Team, (for the menu-bar helper) pinned by its designated requirement, and

package/dist/lib/helper-download.js

@@ -73,7 +73,7 @@ export function parseTeamId(codesignInfo) {
 /** Read the bundle's designated requirement string (`codesign -d --requirements -`).
  *  codesign writes it to stdout, but capture both streams so a diagnostic on
  *  stderr can never make the pin-check read empty and falsely pass. */
-export function readDesignatedRequirement(appPath) {
+function readDesignatedRequirement(appPath) {
     const r = spawnSync('/usr/bin/codesign', ['-d', '--requirements', '-', appPath], { encoding: 'utf8' });
     return `${r.stdout ?? ''}${r.stderr ?? ''}`;
 }
@@ -105,7 +105,7 @@ export function checkDesignatedRequirement(req, bundleId, teamId) {
  * bundle whose DR drops either pin would silently revoke that grant on the next
  * paste, so refuse it.
  */
-export function verifyDesignatedRequirement(appPath, bundleId, teamId) {
+function verifyDesignatedRequirement(appPath, bundleId, teamId) {
     const err = checkDesignatedRequirement(readDesignatedRequirement(appPath), bundleId, teamId);
     if (err)
         throw new Error(err);

package/dist/lib/helper-versions.d.ts

@@ -29,7 +29,7 @@
 /** The helpers that have their own release train. */
 export type HelperName = 'menubar';
 /** One helper's release identity. */
-export interface HelperRelease {
+interface HelperRelease {
     /** Tag prefix — the release is `<tagPrefix>/v<version>`. */
     tagPrefix: string;
     /**
@@ -57,3 +57,4 @@ export declare const HELPER_RELEASES: Readonly<Record<HelperName, HelperRelease>
 export declare function helperTag(helper: HelperName, version: string): string;
 /** The floor build for one helper — the version used when nothing resolves higher. */
 export declare function helperFloor(helper: HelperName): string;
+export {};

package/dist/lib/helper-versions.js

@@ -41,7 +41,7 @@
  * it would claim a distribution responsibility agents-cli no longer has.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.3.0' },
+    menubar: { tagPrefix: 'menubar', floor: '1.4.0' },
 };
 /** The release tag for one helper at one version, e.g. `menubar/v1.0.0`. */
 export function helperTag(helper, version) {

package/dist/lib/hooks/install.d.ts

@@ -29,7 +29,7 @@ export declare function toPortableCommand(absPath: string, home?: string, sep?:
  */
 export declare function deduplicateVersionHookCommands(commands: string[], activeVersionHome: string): string[];
 import type { AgentId, HookCacheConfig, HookMatches, InstalledHook, ManifestHook } from '../types.js';
-export type HookEntry = {
+type HookEntry = {
     name: string;
     scriptPath: string;
     dataFile?: string;
@@ -64,15 +64,6 @@ export declare function inspectDuplicateVersionHooks(cwd?: string): DuplicateVer
  * `foo.yaml`. On basename collision, the top-level file wins over a nested one.
  */
 export declare function listHookEntriesFromDir(dir: string): HookEntry[];
-/**
- * Check if a hook exists for an agent.
- */
-export declare function hookExists(agentId: AgentId, hookName: string): boolean;
-/**
- * Check if installed hook content matches source hook content.
- * Compares both script file and data file (if present).
- */
-export declare function hookContentMatches(agentId: AgentId, hookName: string, sourceEntry: HookEntry): boolean;
 /**
  * Hooks dir for an agent under an arbitrary home (version home or effective
  * home). An agent whose `hooksDir` is configured absolute under `$HOME` (grok,
@@ -111,7 +102,7 @@ export interface HookWiringIssue {
     command: string;
 }
 /** A generated, agents-managed hook wrapper and the inputs needed to recreate it. */
-export interface ManagedHookRuntimeArtifact {
+interface ManagedHookRuntimeArtifact {
     agent: AgentId;
     version: string;
     name: string;
@@ -171,7 +162,7 @@ export interface HookRuntimeRepairAttempt {
 }
 /**
  * Result of one bounded repair pass over agents-managed generated hook shims.
- * Shared by self-heal and doctor --fix; additive types for the doctor track.
+ * Shared by self-heal and agents sync; additive types for the doctor track.
  */
 export interface HookRuntimeRepairReport {
     /** Broken artifacts found before any write (inspect-only snapshot). */
@@ -184,7 +175,7 @@ export interface HookRuntimeRepairReport {
     /** Human-readable lines for CheckResult.needsAttention — stable wording. */
     needsAttention: string[];
 }
-export interface RepairManagedHookRuntimeOptions {
+interface RepairManagedHookRuntimeOptions {
     /** Detect only — never write. Default false. */
     dryRun?: boolean;
     filter?: {
@@ -193,19 +184,6 @@ export interface RepairManagedHookRuntimeOptions {
     };
     platform?: NodeJS.Platform;
 }
-/**
- * Regenerate one known-broken wrapper and prove the result is usable. Callers
- * provide a snapshot from inspectBrokenManagedHookRuntimeArtifacts; this never
- * loops or retries and returns a stable error for the current pass.
- *
- * Generation is delegated to generateHookShim (idempotent — preserves mtime when
- * content already matches). This path never calls registerHooksToSettings,
- * installHooks, or any sync routine.
- */
-export declare function repairManagedHookRuntimeArtifact(artifact: ManagedHookRuntimeArtifact, platform?: NodeJS.Platform): {
-    repaired: boolean;
-    reason?: string;
-};
 /**
  * Bounded repair of all broken agents-managed generated hook shims.
  *
@@ -234,7 +212,7 @@ export declare function repairManagedHookRuntimeArtifacts(opts?: RepairManagedHo
  * resolveHookCommand performs, so it never mutates the version home.
  */
 export declare function checkVersionHookWiring(agent: AgentId, version: string): HookWiringReport;
-export interface VersionHookDiff {
+interface VersionHookDiff {
     agent: AgentId;
     version: string;
     toAdd: string[];
@@ -246,13 +224,6 @@ export interface VersionHookDiff {
  * Compare a version home's hooks against central. Returns the reconciliation diff.
  */
 export declare function diffVersionHooks(agent: AgentId, version: string): VersionHookDiff;
-/**
- * Install a single hook from central into a specific version home.
- */
-export declare function installHookToVersion(agent: AgentId, version: string, hookName: string): {
-    success: boolean;
-    error?: string;
-};
 /**
  * Remove a single hook (script + data file) from a specific version home.
  * Soft-deletes to ~/.agents/.trash/hooks/.
@@ -285,10 +256,6 @@ export declare function getHookInfo(name: string): {
     content: string;
 } | null;
 export declare function discoverHooksFromRepo(repoPath: string): string[];
-/**
- * Get the source hook entry from repo.
- */
-export declare function getSourceHookEntry(repoPath: string, hookName: string): HookEntry | null;
 /**
  * Install hooks to central ~/.agents/hooks/ directory.
  * Shims will symlink this to per-agent directories for synced agents.
@@ -353,15 +320,6 @@ export declare function selectHookManifest(manifest: Record<string, ManifestHook
  * installed hook names and the source hook script paths.
  */
 export declare function unmanagedHookNames(installedHookNames: string[], sourceHookScripts: string[]): string[];
-/**
- * Every hook script path across the resolved SOURCE roots — user
- * (`~/.agents/hooks`), system (`~/.agents/.system/hooks`), and each enabled
- * extra repo's `hooks/` — grouped the same way sync materializes them
- * ({@link listHookEntriesFromDir}, which also descends one-level event-group
- * dirs). This is the set an installed hook must be absent from to count as an
- * orphan.
- */
-export declare function listResolvedSourceHookScripts(): string[];
 /**
  * The orphan hooks (see {@link unmanagedHookNames}) sitting in one version home:
  * installed hook files whose name matches no file in any configured source root.
@@ -397,7 +355,7 @@ export declare function computeCodexHookTrustHash(eventKeyLabel: string, command
  * global shims. The materializer sets this so materialization stays isolated
  * (PHNX-3838); every normal caller leaves it unset and keeps the sweep.
  */
-export interface RegisterHooksOptions {
+interface RegisterHooksOptions {
     skipGlobalShimSweep?: boolean;
 }
 export declare function registerHooksToSettings(agentId: AgentId, versionHome: string, hookManifest?: Record<string, ManifestHook>, agentsDirOverride?: string, options?: RegisterHooksOptions): {
@@ -432,7 +390,7 @@ export declare function hookRegistrationTargets(agentId: AgentId, home: string):
  * entries removed.
  */
 export declare function pruneVersionHomeHookEntriesFromSettings(settingsPath: string, agent: AgentId, removedVersion: string): number;
-export interface InstallSessionTrackerHookResult {
+interface InstallSessionTrackerHookResult {
     installed: boolean;
     error?: string;
 }
@@ -450,3 +408,4 @@ export declare function installSessionTrackerHook(agent: AgentId, version?: stri
  * `syncResourcesToVersion`). Best-effort: failures are returned, not thrown.
  */
 export declare function installSessionTrackerHookSync(agent: AgentId, version?: string, home?: string): InstallSessionTrackerHookResult;
+export {};