@phnx-labs/agents-cli 1.22.112 → 1.22.114

package/dist/lib/monitors/state.d.ts

@@ -13,7 +13,7 @@
 import { type RunMeta } from '../scheduling/routines.js';
 import type { MonitorEvent } from './config.js';
 /** Persisted last-seen state for one monitor. */
-export interface MonitorState {
+interface MonitorState {
     monitorName: string;
     /** Hash of the last-seen de-dupe signature (see hasChanged). */
     lastHash: string;
@@ -53,12 +53,8 @@ export interface MonitorLiveness {
 }
 /** Per-monitor history root, with the (untrusted) name contained to one segment. */
 export declare function getMonitorHistoryDir(name: string): string;
-/** Directory holding a monitor's fire history. */
-export declare function getMonitorFiresDir(name: string): string;
 /** Read a monitor's last-seen state, or null if it has never been observed. */
 export declare function readState(name: string): MonitorState | null;
-/** Persist a monitor's state atomically (temp file + rename, like writeRunMeta). */
-export declare function writeStateRaw(state: MonitorState): void;
 /**
  * Record a new observation as the monitor's last-seen state, preserving fire
  * bookkeeping. Truncates the stored raw value so a firehose can't bloat disk.
@@ -99,7 +95,7 @@ export declare function recordFireTime(name: string, now: number, windowMs: numb
 /** Write a fire record to fires/<id>/event.json and return the fire id. */
 export declare function writeFireRecord(event: MonitorEvent, meta?: Record<string, unknown>): string;
 /** A single fire history entry (as read back from disk). */
-export interface FireRecord extends MonitorEvent {
+interface FireRecord extends MonitorEvent {
     runId?: string;
     action?: string;
     ok?: boolean;
@@ -132,7 +128,7 @@ export interface FireRecord extends MonitorEvent {
 /** List a monitor's fire history, chronologically ascending. */
 export declare function listFires(name: string): FireRecord[];
 /** The reconciled outcome of one fire, resolved against the run's live status. */
-export interface ReconciledFireOutcome {
+interface ReconciledFireOutcome {
     /** True fire outcome, correcting the frozen `ok` against the run's CURRENT status. */
     ok: boolean;
     /** The run's live terminal status, when a runId is present and resolvable. */
@@ -184,3 +180,4 @@ export declare function evaluatePostcondition(command: string): {
  * so later listings do not re-exec the command.
  */
 export declare function resolveFireOutcome(jobName: string, fire: FireRecord): ReconciledFireOutcome;
+export {};

package/dist/lib/monitors/state.js

@@ -29,7 +29,7 @@ function getLivenessPath(name) {
     return path.join(getMonitorHistoryDir(name), 'liveness.json');
 }
 /** Directory holding a monitor's fire history. */
-export function getMonitorFiresDir(name) {
+function getMonitorFiresDir(name) {
     return path.join(getMonitorHistoryDir(name), 'fires');
 }
 /** Read a monitor's last-seen state, or null if it has never been observed. */
@@ -45,7 +45,7 @@ export function readState(name) {
     }
 }
 /** Persist a monitor's state atomically (temp file + rename, like writeRunMeta). */
-export function writeStateRaw(state) {
+function writeStateRaw(state) {
     ensureAgentsDir();
     const dir = getMonitorHistoryDir(state.monitorName);
     fs.mkdirSync(dir, { recursive: true });

package/dist/lib/notify.d.ts

@@ -2,7 +2,7 @@
  * Owner notifier — the one seam for "ping the human" messages.
  *
  * Every human-facing owner notification (feed urgent-block dispatch, monitor
- * `notify` action, `agents notify`) funnels through the single channel seam:
+ * `notify` action, `agents send --to owner`) funnels through the single channel seam:
  * `lookupTransport(channel, meta).provider.send(text, opts)`. The recipient comes
  * from `humans.yaml` — never a hardcoded chat id — so changing the
  * owner is honoured by every path at once. `notify.transports` picks the actual

package/dist/lib/notify.js

@@ -115,7 +115,7 @@ export async function sendToOwner(text, options = {}) {
             }
         }
         // Echo the exact per-destination body delivered, so a caller (and
-        // `agents notify --dry-run --json`) can see Slack got the labeled-link
+        // `agents send --to owner --dry-run --json`) can see Slack got the labeled-link
         // variant and iMessage the plain one — the observable proof of PHNX-3698.
         deliveries.push({ ...result, body });
     }

package/dist/lib/onepassword.d.ts

@@ -1,11 +1,7 @@
 /**
  * 1Password CLI (op) integration for importing secrets from vaults.
  */
-export interface OpVault {
-    id: string;
-    name: string;
-}
-export interface OpItemSummary {
+interface OpItemSummary {
     id: string;
     title: string;
     category: string;
@@ -24,7 +20,7 @@ export interface OpField {
 export interface OpItem extends OpItemSummary {
     fields: OpField[];
 }
-export interface ImportableSecret {
+interface ImportableSecret {
     envKey: string;
     itemTitle: string;
     fieldLabel: string;
@@ -36,14 +32,11 @@ export interface ImportableSecret {
      */
     description?: string;
 }
-export interface SkippedField {
+interface SkippedField {
     itemTitle: string;
     fieldLabel: string;
     reason: string;
 }
-export declare function assertOpAvailable(): void;
-export declare function listVaults(): OpVault[];
-export declare function listItems(vaultName: string): OpItemSummary[];
 export declare function getItem(itemId: string, vaultName: string): OpItem;
 export declare function toEnvKey(title: string): string;
 export declare function slugify(name: string): string;
@@ -62,7 +55,7 @@ export declare function extractSecrets(items: OpItemSummary[], vaultName: string
     secrets: ImportableSecret[];
     skipped: SkippedField[];
 };
-export interface PasswordItemTemplate {
+interface PasswordItemTemplate {
     title: string;
     category: 'PASSWORD';
     tags: string[];
@@ -75,6 +68,4 @@ export interface PasswordItemTemplate {
     }>;
 }
 export declare function buildPasswordItemTemplate(title: string, value: string): PasswordItemTemplate;
-export declare function itemExistsByTitle(title: string, vaultName: string): boolean;
-export declare function deleteItemByTitle(title: string, vaultName: string): void;
-export declare function createPasswordItem(title: string, value: string, vaultName: string): void;
+export {};

package/dist/lib/onepassword.js

@@ -2,9 +2,6 @@
  * 1Password CLI (op) integration for importing secrets from vaults.
  */
 import { spawnSync } from 'child_process';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
 function runOp(args, input) {
     const result = spawnSync('op', args, {
         stdio: [input !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
@@ -27,33 +24,6 @@ function runOp(args, input) {
     }
     return { ok: true, stdout: result.stdout };
 }
-export function assertOpAvailable() {
-    // `op account list` works with both CLI session tokens and the 1Password
-    // desktop biometric integration; `op whoami` fails on the latter.
-    const result = runOp(['account', 'list', '--format=json']);
-    if (!result.ok) {
-        throw new Error(result.error);
-    }
-}
-export function listVaults() {
-    const result = runOp(['vault', 'list', '--format=json']);
-    if (!result.ok)
-        throw new Error(result.error);
-    return JSON.parse(result.stdout);
-}
-export function listItems(vaultName) {
-    const result = runOp(['item', 'list', '--vault', vaultName, '--format=json']);
-    if (!result.ok) {
-        if (result.error.includes('vault') && result.error.includes('not found')) {
-            const vaults = listVaults();
-            const available = vaults.map((v) => v.name).join(', ');
-            throw new Error(`Vault '${vaultName}' not found. Available: ${available || '(none)'}`);
-        }
-        throw new Error(result.error);
-    }
-    const items = JSON.parse(result.stdout);
-    return items || [];
-}
 export function getItem(itemId, vaultName) {
     const result = runOp(['item', 'get', itemId, '--vault', vaultName, '--format=json', '--reveal']);
     if (!result.ok)
@@ -180,37 +150,3 @@ export function buildPasswordItemTemplate(title, value) {
         ],
     };
 }
-export function itemExistsByTitle(title, vaultName) {
-    const result = runOp(['item', 'get', title, '--vault', vaultName, '--format=json']);
-    if (result.ok)
-        return true;
-    if (/isn't an item|not found|no item found/i.test(result.error))
-        return false;
-    throw new Error(result.error);
-}
-export function deleteItemByTitle(title, vaultName) {
-    const result = runOp(['item', 'delete', title, '--vault', vaultName]);
-    if (!result.ok)
-        throw new Error(result.error);
-}
-export function createPasswordItem(title, value, vaultName) {
-    // op item create reads stdin templates only from a real pipe; spawnSync's
-    // input plumbing is detected as empty and op silently ignores the template.
-    // The supported alternative is --template <file>, which works reliably.
-    const template = JSON.stringify(buildPasswordItemTemplate(title, value));
-    const tmpFile = path.join(os.tmpdir(), `agents-op-tpl-${process.pid}-${Date.now()}.json`);
-    fs.writeFileSync(tmpFile, template, { mode: 0o600 });
-    try {
-        const result = runOp(['item', 'create', '--template', tmpFile, '--vault', vaultName]);
-        if (!result.ok)
-            throw new Error(result.error);
-    }
-    finally {
-        try {
-            fs.unlinkSync(tmpFile);
-        }
-        catch {
-            // best-effort cleanup
-        }
-    }
-}

package/dist/lib/open-url.d.ts

@@ -1,5 +1,5 @@
 /** Where a "show the human this" call actually landed. */
-export type ShowOutcome = {
+type ShowOutcome = {
     via: 'profile';
     profile: string;
     tabId?: string;
@@ -10,7 +10,7 @@ export type ShowOutcome = {
     via: 'none';
     reason: string;
 };
-export interface ShowOptions {
+interface ShowOptions {
     /**
      * Force the OS default handler, ignoring `browser.viewer`. This is the
      * The programmatic escape hatch, for a caller that must use the user's own
@@ -58,3 +58,4 @@ export declare function showUrl(url: string, opts?: ShowOptions): Promise<ShowOu
  * is the right viewer.
  */
 export declare function showFile(filePath: string, opts?: ShowOptions): Promise<ShowOutcome>;
+export {};

package/dist/lib/openclaw-keychain.d.ts

@@ -1,18 +1,10 @@
 import { type SpawnSyncOptions } from 'child_process';
-export declare const OPENCLAW_KEYCHAIN_ACCOUNT = "openclaw";
-export declare const OPENCLAW_KEYCHAIN_PROVIDER = "agents_keychain";
-export declare const OPENCLAW_KEYCHAIN_ENV_SERVICES: Record<string, string>;
-export interface OpenClawSecretRef {
-    source: 'exec';
-    provider: string;
-    id: string;
-}
-export interface OpenClawKeychainMigrationOptions {
+interface OpenClawKeychainMigrationOptions {
     account?: string;
     provider?: string;
     agentsBin?: string;
 }
-export interface OpenClawKeychainMigrationResult {
+interface OpenClawKeychainMigrationResult {
     services: Array<{
         envKey: string;
         service: string;
@@ -35,17 +27,12 @@ export declare function buildOpenClawKeychainStoreInvocation(service: string, va
         detached: boolean;
     };
 };
-export declare function storeOpenClawKeychainServices(services: Array<{
-    service: string;
-    value: string;
-}>, account?: string): void;
-export declare function readOpenClawKeychainService(service: string, account?: string): string;
-export interface OpenClawExecResolverRequest {
+interface OpenClawExecResolverRequest {
     protocolVersion?: number;
     provider?: string;
     ids?: unknown;
 }
-export interface OpenClawExecResolverResponse {
+interface OpenClawExecResolverResponse {
     protocolVersion: 1;
     values: Record<string, string>;
     errors?: Record<string, {

package/dist/lib/openclaw-keychain.js

@@ -1,4 +1,3 @@
-import { execFileSync, spawnSync } from 'child_process';
 import { getCliLaunch } from './cli-entry.js';
 /**
  * argv for writing a bare (non-`agents-cli.`) keychain item via
@@ -27,9 +26,9 @@ function buildAddGenericPasswordSpawnOptions(value) {
         detached: true,
     };
 }
-export const OPENCLAW_KEYCHAIN_ACCOUNT = 'openclaw';
-export const OPENCLAW_KEYCHAIN_PROVIDER = 'agents_keychain';
-export const OPENCLAW_KEYCHAIN_ENV_SERVICES = {
+const OPENCLAW_KEYCHAIN_ACCOUNT = 'openclaw';
+const OPENCLAW_KEYCHAIN_PROVIDER = 'agents_keychain';
+const OPENCLAW_KEYCHAIN_ENV_SERVICES = {
     OPENROUTER_API_KEY: 'openrouter-api-key',
     LINEAR_API_KEY: 'linear-api-key',
     GRAFANA_API_KEY: 'grafana-api-key',
@@ -213,35 +212,6 @@ export function buildOpenClawKeychainStoreInvocation(service, value, account = O
         options: buildAddGenericPasswordSpawnOptions(value),
     };
 }
-export function storeOpenClawKeychainServices(services, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
-    if (process.platform !== 'darwin') {
-        throw new Error('OpenClaw Keychain migration must run on macOS.');
-    }
-    for (const { service, value } of services) {
-        const write = buildOpenClawKeychainStoreInvocation(service, value, account);
-        const result = spawnSync(write.command, write.args, write.options);
-        if (result.status !== 0) {
-            const msg = result.stderr?.toString().trim();
-            throw new Error(msg || `Failed to write OpenClaw Keychain service '${service}'.`);
-        }
-    }
-}
-function stripSecurityTrailingNewline(value) {
-    return value.replace(/\r?\n$/, '');
-}
-export function readOpenClawKeychainService(service, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$/.test(service)) {
-        throw new Error(`Invalid OpenClaw Keychain service id '${service}'.`);
-    }
-    if (process.platform !== 'darwin') {
-        throw new Error('OpenClaw Keychain resolver must run on macOS.');
-    }
-    const value = execFileSync('/usr/bin/security', ['find-generic-password', '-s', service, '-a', account, '-w'], {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    return stripSecurityTrailingNewline(value);
-}
 export function resolveOpenClawKeychainRequest(request, lookup) {
     const ids = Array.isArray(request.ids) ? request.ids.filter((id) => typeof id === 'string') : [];
     const values = {};

package/dist/lib/operator.d.ts

@@ -4,10 +4,9 @@ export interface Operator {
     admin?: boolean;
     can?: string[];
 }
-export interface OperatorRegistry {
+interface OperatorRegistry {
     operators: Record<string, Operator>;
 }
-export declare function getOperatorsPath(root?: string): string;
 export declare function loadOperators(root?: string): OperatorRegistry;
 export declare function getOperator(id: string, root?: string): Operator | undefined;
 export declare function isKnownOperator(id: string, root?: string): boolean;
@@ -24,3 +23,4 @@ export declare function isHighConsequenceAllowed(blockConsequence: string | unde
  * the human's launch context).
  */
 export declare function verifyOperatorIdentity(claimedId: string | undefined, root?: string): boolean;
+export {};

package/dist/lib/operator.js

@@ -27,7 +27,7 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { getUserAgentsDir } from './state.js';
 const OPERATORS_FILE = 'operators.yaml';
-export function getOperatorsPath(root) {
+function getOperatorsPath(root) {
     return path.join(root ?? getUserAgentsDir(), OPERATORS_FILE);
 }
 export function loadOperators(root) {

package/dist/lib/output/git-output.d.ts

@@ -1,10 +1,10 @@
 /** Commit tally for one author email. */
-export interface AuthorCommits {
+interface AuthorCommits {
     author: string;
     commits: number;
 }
 /** The shipped-work rollup for a window. */
-export interface GitOutputSummary {
+interface GitOutputSummary {
     reposScanned: number;
     commits: number;
     byAuthor: AuthorCommits[];
@@ -24,7 +24,7 @@ export interface GitOutputSummary {
     logins: string[];
     sinceIso: string;
 }
-export interface GitOutputOptions {
+interface GitOutputOptions {
     /** Root scanned for git repos (e.g. ~/src). */
     reposDir: string;
     /** Window start, epoch ms. */
@@ -54,17 +54,6 @@ export declare function collectCommits(repos: string[], sinceIso: string, author
     byAuthor: AuthorCommits[];
     shas: string[];
 }>;
-/**
- * Count PRs opened and merged in the window across the given logins. `gh search
- * prs` searches all of GitHub, so one authed gh can cover multiple accounts'
- * logins. Returns ghAvailable=false if gh can't be reached at all.
- */
-export declare function collectPrs(logins: string[], sinceDate: string): Promise<{
-    opened: number;
-    merged: number;
-    logins: string[];
-    ghAvailable: boolean;
-}>;
 /** Format an epoch-ms as a YYYY-MM-DD date (UTC), for gh's date-range search. */
 export declare function toSearchDate(ms: number): string;
 /**
@@ -72,3 +61,4 @@ export declare function toSearchDate(ms: number): string;
  * plus PRs opened/merged.
  */
 export declare function collectGitOutput(options: GitOutputOptions): Promise<GitOutputSummary>;
+export {};

package/dist/lib/output/git-output.js

@@ -145,7 +145,7 @@ async function ghSearchCount(args) {
  * prs` searches all of GitHub, so one authed gh can cover multiple accounts'
  * logins. Returns ghAvailable=false if gh can't be reached at all.
  */
-export async function collectPrs(logins, sinceDate) {
+async function collectPrs(logins, sinceDate) {
     let resolved = logins;
     if (resolved.length === 0) {
         const login = await currentGhLogin();

package/dist/lib/owner-message.d.ts

@@ -1,24 +1,5 @@
-/**
- * Compose an owner-bound phone ping through the SAME shaper `agents feed post`
- * uses, so `agents notify` / `agents send --to owner` stop shipping a raw body
- * dump (PHNX-3698).
- *
- * Before this, an owner send delivered the body verbatim: a long wall of prose,
- * a `TEAM-N` key iMessage renders as dead text, and no way back to the session.
- * Routing the body through {@link composeBroadcastMessage} makes an owner ping
- * identical to an important feed post of the same event — short-shaped body,
- * every ticket key linkified to its Linear URL, and the current session's
- * `…/console/sessions/<id>` page as a tappable crumb.
- *
- * The session/agent/host are resolved the same way a feed post resolves them
- * ({@link resolvePostIdentity} — the pid-registry / env walk), so a `notify`
- * run inside an agent session inherits that session with no flag. Outside a
- * session (a human at a shell) identity is undefined: the ping still gets
- * short-shaping and ticket linkification, just no session crumb.
- */
-import { type FeedBroadcastContext } from './feed-broadcast.js';
 import type { SinkMessageFormat } from './sink-format.js';
-export interface OwnerMessageOptions {
+interface OwnerMessageOptions {
     /** Scannable subject line, when the caller has one (feed post does; notify does not). */
     title?: string;
     /** Explicit session id (`--session`); otherwise resolved from the run environment. */
@@ -31,14 +12,6 @@ export interface OwnerMessageOptions {
      */
     format?: SinkMessageFormat;
 }
-/**
- * Resolve the run identity into the broadcast context an owner ping is built
- * from — the shared shape a `feed post` uses. Pure except for the identity/index
- * reads that {@link resolvePostIdentity} / {@link getSessionById} already perform
- * for feed posts. Built ONCE so the owner fan-out can render it in more than one
- * format (Slack vs iMessage) without re-walking the pid registry per destination.
- */
-export declare function ownerMessageContext(rawText: string, opts?: OwnerMessageOptions): FeedBroadcastContext;
 /**
  * Shape a raw owner-send body into the composed broadcast message. `format`
  * decides how links surface — `plain` (default) for iMessage / owner-scoped rush,
@@ -47,9 +20,10 @@ export declare function ownerMessageContext(rawText: string, opts?: OwnerMessage
 export declare function composeOwnerMessage(rawText: string, opts?: OwnerMessageOptions): string;
 /**
  * A per-format composer bound to ONE resolved context — the shape the owner
- * fan-out wants (PHNX-3698). `agents notify` / `agents send --to owner` build
+ * fan-out wants (PHNX-3698). `agents send --to owner` build
  * this once, use `compose('plain')` for the envelope's display body, and hand
  * `compose` to `sendToOwner` so each policy destination re-renders in its own
  * format without re-walking the pid registry.
  */
 export declare function ownerMessageComposer(rawText: string, opts?: OwnerMessageOptions): (format: SinkMessageFormat) => string;
+export {};

package/dist/lib/owner-message.js

@@ -1,6 +1,6 @@
 /**
  * Compose an owner-bound phone ping through the SAME shaper `agents feed post`
- * uses, so `agents notify` / `agents send --to owner` stop shipping a raw body
+ * uses, so `agents send --to owner` stop shipping a raw body
  * dump (PHNX-3698).
  *
  * Before this, an owner send delivered the body verbatim: a long wall of prose,
@@ -27,7 +27,7 @@ import { linearIssueUrl } from './session/linear.js';
  * for feed posts. Built ONCE so the owner fan-out can render it in more than one
  * format (Slack vs iMessage) without re-walking the pid registry per destination.
  */
-export function ownerMessageContext(rawText, opts = {}) {
+function ownerMessageContext(rawText, opts = {}) {
     const identity = resolvePostIdentity({ sessionId: opts.sessionId });
     // A footer crumb that would 404 (an 8-char short id) is upgraded to the full
     // indexed id so the console URL resolves; a full/native id passes through.
@@ -53,7 +53,7 @@ export function composeOwnerMessage(rawText, opts = {}) {
 }
 /**
  * A per-format composer bound to ONE resolved context — the shape the owner
- * fan-out wants (PHNX-3698). `agents notify` / `agents send --to owner` build
+ * fan-out wants (PHNX-3698). `agents send --to owner` build
  * this once, use `compose('plain')` for the envelope's display body, and hand
  * `compose` to `sendToOwner` so each policy destination re-renders in its own
  * format without re-walking the pid registry.

package/dist/lib/packages/output-home.d.ts

@@ -1,7 +1,6 @@
 /** The three harness homes a portable schema-v3 package can be materialized into. */
 export declare const PORTABLE_HARNESSES: readonly ["claude", "codex", "opencode"];
-export type PortableHarness = (typeof PORTABLE_HARNESSES)[number];
-export declare function isPortableHarness(value: string): value is PortableHarness;
+type PortableHarness = (typeof PORTABLE_HARNESSES)[number];
 /** Thrown for a bad front-door argument (harness / version / output home). Never `process.exit`. */
 export declare class MaterializeGuardError extends Error {
     constructor(message: string);
@@ -10,8 +9,6 @@ export declare class MaterializeGuardError extends Error {
 export declare function assertPortableHarness(harness: string): PortableHarness;
 /** Reject a non-exact harness version (empty, malformed, or `@latest`). */
 export declare function assertExactHarnessVersion(version: string): string;
-/** True when `raw` still contains a `..` segment after splitting on both separators. */
-export declare function outputHomeHasDotDot(raw: string): boolean;
 /**
  * Resolve `--output-home` to an absolute path, refusing a target that climbs out
  * of cwd (relative), uses a `..` segment, IS the live home root, or targets (or
@@ -37,3 +34,4 @@ export declare function outputHomeHasDotDot(raw: string): boolean;
  * `materializeAgentPackage`, so a direct (non-CLI) caller is protected too.
  */
 export declare function resolveOutputHome(raw: string, cwd?: string, home?: string): string;
+export {};

package/dist/lib/packages/output-home.js

@@ -34,7 +34,7 @@ import { assertWithin, realpathExistingPrefix } from '../paths.js';
 import { VERSION_RE } from '../agent-spec/primitives.js';
 /** The three harness homes a portable schema-v3 package can be materialized into. */
 export const PORTABLE_HARNESSES = ['claude', 'codex', 'opencode'];
-export function isPortableHarness(value) {
+function isPortableHarness(value) {
     return PORTABLE_HARNESSES.includes(value);
 }
 /** Thrown for a bad front-door argument (harness / version / output home). Never `process.exit`. */
@@ -59,7 +59,7 @@ export function assertExactHarnessVersion(version) {
     return version;
 }
 /** True when `raw` still contains a `..` segment after splitting on both separators. */
-export function outputHomeHasDotDot(raw) {
+function outputHomeHasDotDot(raw) {
     return raw.split(/[\\/]/).includes('..');
 }
 /**

package/dist/lib/perf/db.d.ts

@@ -9,7 +9,6 @@ import type { AggregateOptions, PerfAggregateRow } from './types.js';
 export type { AggregateOptions, PerfAggregateRow, PerfPhaseStat, PerfSample } from './types.js';
 export { recordSample, shortSessionId, resolveSpoolPath } from './spool.js';
 export { percentile } from '../percentile.js';
-export declare const PERF_SCHEMA_VERSION = 1;
 export declare const DEFAULT_RETENTION_DAYS = 30;
 /** Test seam — redirect the warehouse path (like AGENTS_EVENTS_PATH). */
 export declare function _resetPerfDbForTest(overridePath?: string | null): void;
@@ -26,4 +25,3 @@ export declare function drainSpool(db?: Database.Database): number;
 export declare function aggregateSamples(opts?: AggregateOptions): PerfAggregateRow[];
 export declare function perfDbPath(): string;
 export declare function perfSpoolPath(): string;
-export declare function ensurePerfDir(): string;

package/dist/lib/perf/db.js

@@ -7,7 +7,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import Database from '../sqlite.js';
-import { getPerfDbPath, getPerfDir } from '../state.js';
+import { getPerfDbPath } from '../state.js';
 import { localMachineId } from '../origin-machine.js';
 import { resolveProjectKey } from '../project-key.js';
 import { percentile } from '../percentile.js';
@@ -39,7 +39,7 @@ function parsePhases(metaJson) {
 }
 export { recordSample, shortSessionId, resolveSpoolPath } from './spool.js';
 export { percentile } from '../percentile.js';
-export const PERF_SCHEMA_VERSION = 1;
+const PERF_SCHEMA_VERSION = 1;
 export const DEFAULT_RETENTION_DAYS = 30;
 const SCHEMA = `
 CREATE TABLE IF NOT EXISTS samples (
@@ -365,8 +365,3 @@ export function perfDbPath() {
 export function perfSpoolPath() {
     return resolveSpoolPath();
 }
-export function ensurePerfDir() {
-    const dir = process.env.AGENTS_PERF_DIR || (_dbPath ? path.dirname(_dbPath) : getPerfDir());
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    return dir;
-}

package/dist/lib/permissions-registry.d.ts

@@ -19,7 +19,7 @@ export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
  */
 export declare function stripJsonComments(content: string): string;
 /** The complete permissions contract for one agent. */
-export interface PermissionTarget {
+interface PermissionTarget {
     /** Permissions file under a HOME root (a version home, or the real HOME). */
     home(home: string): string;
     /** Permissions file for a project checkout, when the harness reads one. */
@@ -55,11 +55,10 @@ export interface PermissionTarget {
  * `capableAgents('allowlist')` — pinned by `permissions-registry.test.ts`.
  */
 export declare const PERMISSION_TARGETS: Partial<Record<AgentId, PermissionTarget>>;
-/** The registry entry for `agent`, or undefined when it stores no permissions. */
-export declare function permissionTarget(agent: AgentId): PermissionTarget | undefined;
 /**
  * Read `agent`'s permissions from `home` (a version home or the real HOME) and
  * project them to canonical form. `scope: 'project'` reads the repo-local file
  * for the harnesses that have one, and returns null for those that do not.
  */
 export declare function readCanonicalPermissions(agent: AgentId, scope?: 'user' | 'project', cwd?: string, home?: string): PermissionSet | null;
+export {};

package/dist/lib/permissions-registry.js

@@ -630,10 +630,6 @@ function kimiPatternToCanonical(pattern) {
     }
     return canonicalRule(lowerTool, arg);
 }
-/** The registry entry for `agent`, or undefined when it stores no permissions. */
-export function permissionTarget(agent) {
-    return PERMISSION_TARGETS[agent];
-}
 /**
  * Read `agent`'s permissions from `home` (a version home or the real HOME) and
  * project them to canonical form. `scope: 'project'` reads the repo-local file