@phnx-labs/agents-cli 1.22.113 → 1.22.114

package/dist/lib/secrets-policy.d.ts

@@ -4,10 +4,8 @@ import type { AgentId, Meta, NativeAccountRecord } from './types.js';
 import { type DeviceProfile } from './devices/registry.js';
 import { type SharedAuthStatus } from './fleet-shared-state.js';
 import { selfConfiguredDeviceRole } from './device-config.js';
-import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind } from './reserved-stores.js';
-export { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind, };
-/** Filter `names` down to the ones the active resource profile allows for `secrets`. */
-export declare function filterBundleNamesForActiveProfile(names: string[]): string[];
+import { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind } from './reserved-stores.js';
+export { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind, };
 /**
  * `SecretsContext.allowedBundles` for the active resource profile, or
  * `undefined` when no profile is active (full trust — the client's default).
@@ -36,15 +34,13 @@ export declare function assertRemoteBundleFlagsUnsupported(bundleName: string, h
     keysFlag: string;
     allowExpiredFlag: string;
 }): void;
-/** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
-export declare const AUTH_SYNC_PUSH_DEADLINE_MS = 20000;
 export interface AuthSyncDevice {
     name: string;
     reachable: boolean;
     pinned: boolean;
     remoteAuth: SharedAuthStatus | 'unknown';
 }
-export type AuthSyncPlanItem = {
+type AuthSyncPlanItem = {
     action: 'push';
     device: string;
 } | {
@@ -53,7 +49,7 @@ export type AuthSyncPlanItem = {
     reason: string;
 };
 export declare function planAuthBundlePush(localAuthOk: boolean, localIsPublisher: boolean, devices: AuthSyncDevice[]): AuthSyncPlanItem[];
-export interface AuthSyncResult {
+interface AuthSyncResult {
     publisher: string | null;
     stateChanged: boolean;
     pushed: string[];
@@ -66,7 +62,7 @@ export interface AuthSyncResult {
         message: string;
     }>;
 }
-export interface AuthSyncDeps {
+interface AuthSyncDeps {
     inspectLocal?: () => {
         exists: boolean;
         ok: boolean;
@@ -90,7 +86,7 @@ export interface AuthSyncDeps {
  * over `zion`, and zion then skipped every peer as a non-publisher.
  */
 export declare function electPublisher(ready: readonly string[], roleOf: (name: string) => ReturnType<typeof selfConfiguredDeviceRole>): string | null;
-export interface PublishAuthVerdictOptions {
+interface PublishAuthVerdictOptions {
     inspectLocal?: () => {
         exists: boolean;
         ok: boolean;
@@ -98,7 +94,7 @@ export interface PublishAuthVerdictOptions {
     localName?: string;
     userAgentsDir?: string;
 }
-export interface PublishAuthVerdictResult {
+interface PublishAuthVerdictResult {
     device: string;
     status: SharedAuthStatus;
     changed: boolean;
@@ -135,7 +131,7 @@ export interface ReservedSyncPeer {
     /** bundle -> keys the peer already holds at the current fingerprint. Absent ⇒ none known. */
     presentKeys: Record<string, ReadonlySet<string>>;
 }
-export type ReservedSyncPlanItem = {
+type ReservedSyncPlanItem = {
     action: 'push';
     device: string;
     bundle: string;
@@ -160,7 +156,6 @@ export declare function planReservedStoreSync(accounts: ReservedSyncAccount[], p
  * `workerCredential`) is not a sync target.
  */
 export declare function reservedSyncTargets(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): ReservedSyncAccount[];
-export declare function readDeliveryMemo(root?: string): Record<string, string>;
 /**
  * The keys a peer is KNOWN to hold, per bundle, from what we have delivered to it
  * (memo, matched by fingerprint) plus the coarse legacy-`auth` verdict: a peer
@@ -169,7 +164,7 @@ export declare function readDeliveryMemo(root?: string): Record<string, string>;
  * from the memo alone -- which is what makes a newly-added reserved account push.
  */
 export declare function peerPresentKeys(peer: string, accounts: ReservedSyncAccount[], memo: Record<string, string>, legacyAuthReady: boolean): Record<string, ReadonlySet<string>>;
-export interface ReservedStoreSyncResult {
+interface ReservedStoreSyncResult {
     publisher: string | null;
     /** Legacy raw reserved items adopted into their bundle on this box before planning (local repair). */
     adopted: Array<{
@@ -190,7 +185,7 @@ export interface ReservedStoreSyncResult {
         message: string;
     }>;
 }
-export interface ReservedStoreSyncDeps {
+interface ReservedStoreSyncDeps {
     listDevices?: () => DeviceProfile[];
     localName?: string;
     userAgentsDir?: string;
@@ -224,7 +219,7 @@ export interface ReservedStoreSyncDeps {
  * there is no second scheduler. The daemon runs this each tick.
  */
 export declare function syncReservedStores(deps?: ReservedStoreSyncDeps): Promise<ReservedStoreSyncResult>;
-export interface ReconcileWorkerSlotsResult {
+interface ReconcileWorkerSlotsResult {
     provisioned: string[];
     skipped: Array<{
         accountId: string;
@@ -235,7 +230,7 @@ export interface ReconcileWorkerSlotsResult {
         message: string;
     }>;
 }
-export interface ReconcileWorkerSlotsDeps {
+interface ReconcileWorkerSlotsDeps {
     selfRole?: ReturnType<typeof selfConfiguredDeviceRole>;
     readMetaFn?: () => Pick<Meta, 'accounts' | 'deviceAccounts'>;
     hasLocalKey?: (bundle: string, key: string) => boolean;

package/dist/lib/secrets-policy.js

@@ -21,7 +21,7 @@ import { getCacheDir, getUserAgentsDir, readMeta } from './state.js';
 import { listNativeAccounts, readSlots } from './account-registry.js';
 import { claudeAccountTokenKey, isClaudeWorkerHomeSeeded, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
 import { configuredDeviceRole, isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
-import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, } from './reserved-stores.js';
+import { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, } from './reserved-stores.js';
 // --- reserved per-harness credential stores (PHNX-3940 / PHNX-3989) --------
 //
 // Re-exported from the leaf module `reserved-stores.ts` rather than declared
@@ -31,7 +31,7 @@ import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDL
 // ReferenceError under real ESM evaluation order, outside vitest's
 // mock-tolerant transform). Keep the public surface unchanged for existing
 // importers of `secrets-policy.js`.
-export { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, };
+export { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, };
 // --- resource-profile -> allowedBundles (CTX-1) -----------------------------
 //
 // A resource profile scopes WHICH bundle names a run may reach. The standalone
@@ -40,7 +40,7 @@ export { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDL
 // every bounded request. Absent (no active profile) means full trust, matching
 // the client's own documented default.
 /** Filter `names` down to the ones the active resource profile allows for `secrets`. */
-export function filterBundleNamesForActiveProfile(names) {
+function filterBundleNamesForActiveProfile(names) {
     return filterNamesForActiveResourceProfile('secrets', names);
 }
 /**
@@ -98,7 +98,7 @@ export function assertRemoteBundleFlagsUnsupported(bundleName, host, opts, flagL
 // async and kill-bounded so it never blocks the daemon event loop.
 // ---------------------------------------------------------------------------
 /** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
-export const AUTH_SYNC_PUSH_DEADLINE_MS = 20_000;
+const AUTH_SYNC_PUSH_DEADLINE_MS = 20_000;
 export function planAuthBundlePush(localAuthOk, localIsPublisher, devices) {
     if (!localAuthOk) {
         return devices.map((device) => ({ action: 'skip', device: device.name, reason: 'no local file-backed auth bundle' }));
@@ -332,7 +332,7 @@ function deliveryMemoPath(root = getCacheDir()) {
 function memoKey(peer, bundle, key) {
     return `${normalizeHost(peer)} ${bundle} ${key}`;
 }
-export function readDeliveryMemo(root) {
+function readDeliveryMemo(root) {
     try {
         const parsed = JSON.parse(fs.readFileSync(deliveryMemoPath(root), 'utf-8'));
         if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))

package/dist/lib/secrets-types.d.ts

@@ -29,8 +29,8 @@ export type BundleValue = string | {
 };
 /** Remote (bundle@host) push destination backend. */
 export type RemoteBackend = 'keychain' | 'file';
-export declare const SECRET_TYPES: readonly ["api-key", "token", "password", "url", "database-url", "ssh-key", "certificate", "webhook", "note"];
-export type SecretType = (typeof SECRET_TYPES)[number];
+declare const SECRET_TYPES: readonly ["api-key", "token", "password", "url", "database-url", "ssh-key", "certificate", "webhook", "note"];
+type SecretType = (typeof SECRET_TYPES)[number];
 /** Per-secret metadata; absent fields are omitted at write time. */
 export interface VarMeta {
     type?: SecretType;
@@ -194,3 +194,4 @@ export interface RcSecretFinding {
     /** The file-store master passphrase gets called out separately. */
     isMasterPassphrase: boolean;
 }
+export {};

package/dist/lib/secrets-types.js

@@ -11,7 +11,7 @@
  * `secrets-client.ts` docblock).
  */
 // --- bundle document ---------------------------------------------------
-export const SECRET_TYPES = [
+const SECRET_TYPES = [
     'api-key',
     'token',
     'password',
@@ -22,3 +22,4 @@ export const SECRET_TYPES = [
     'webhook',
     'note',
 ];
+export {};

package/dist/lib/self-heal/checks/install-staging.js

@@ -9,7 +9,7 @@
 // ENOTEMPTY the sweep exists to prevent, and nothing runs `agents upgrade` to
 // trigger that sweep in the meantime. Periodic cadence closes that gap
 // fleet-wide (via the daemon's self-heal service) and on demand via
-// `agents doctor --fix`.
+// `agents sync`.
 //
 // The age guard is load-bearing: a staging dir can be legitimately mid-write
 // by a CONCURRENT upgrade this instant. Only a dir older than the guard is

package/dist/lib/self-heal/registry.d.ts

@@ -1,11 +1,11 @@
 import type { HealCheck, HealCheckId, HealCadence, SelfHealReport } from './types.js';
 export declare const HEAL_CHECKS: HealCheck[];
-export interface SelfHealOptions {
+interface SelfHealOptions {
     /** Restrict to these check ids; omit to run every registered check. */
     checks?: HealCheckId[];
     /** Only run checks whose cadence is in this set (daemon scheduling). */
     cadences?: HealCadence[];
-    /** 'safe' (daemon default) or 'full' (doctor --fix). Default 'safe'. */
+    /** 'safe' (daemon default) or 'full' (agents sync). Default 'safe'. */
     mode?: 'safe' | 'full';
     /** Detect only — never write. Default false. */
     dryRun?: boolean;
@@ -20,3 +20,4 @@ export declare function selfHealChangedAnything(report: SelfHealReport): boolean
 export declare function selfHealNeedsAttention(report: SelfHealReport): boolean;
 /** One-line human summary, e.g. "shims: 2 fixed; path: 1 fixed". */
 export declare function summarizeSelfHeal(report: SelfHealReport): string;
+export {};

package/dist/lib/self-heal/types.d.ts

@@ -2,7 +2,7 @@ export type HealCheckId = 'resources' | 'hook-runtime' | 'hook-manifest' | 'shim
 /** When the daemon schedules a check. */
 export type HealCadence = 'startup' | 'frequent' | 'periodic';
 export interface HealCtx {
-    /** 'safe' = daemon (low-risk only); 'full' = doctor --fix (everything). */
+    /** 'safe' = daemon (low-risk only); 'full' = agents sync (everything). */
     mode: 'safe' | 'full';
     /** Detect only — never write. Powers `agents doctor` (read-only) and previews. */
     dryRun: boolean;

package/dist/lib/self-heal/types.js

@@ -10,7 +10,7 @@
 // when `ctx.dryRun`), mirroring the existing resource heal (heal.ts) which computes
 // and applies together. `mode` gates how aggressive a repair may be: 'safe' (the
 // daemon default) fixes only low-risk drift and merely reports risky conditions;
-// 'full' (`agents doctor --fix`) applies everything.
+// 'full' (`agents sync`) applies everything.
 /** Convenience: an all-clear result. */
 export function okResult() {
     return { fixed: [], needsAttention: [], ok: true };

package/dist/lib/self-update.d.ts

@@ -307,7 +307,7 @@ export interface MultiInstallInventoryEntry {
     /** True for the copy that is currently executing. */
     running: boolean;
     /**
-     * True when a bare `agents doctor --fix` deletes this copy (RUSH-2415:
+     * True when a bare `agents sync` deletes this copy (RUSH-2415:
      * npx-cache / unsafe-legacy / pre-1.22.30 with a fixed peer). False for the
      * running copy and for any duplicate --fix will not touch — a healthy
      * >=1.22.30 peer, or a pre-1.22.30 copy with no fixed peer to fall back to;
@@ -317,7 +317,7 @@ export interface MultiInstallInventoryEntry {
 }
 /**
  * The exact shell command that removes the install at `packageRoot` by hand —
- * the remedy for duplicates `doctor --fix` deliberately will not purge
+ * the remedy for duplicates `agents sync` deliberately will not purge
  * (RUSH-2705). `--prefix` pins the target tree no matter which npm binary
  * PATH resolves, mirroring installPackageIntoPrefix.
  */
@@ -347,7 +347,7 @@ export declare function isNpxCacheInstall(packageRoot: string): boolean;
  */
 export declare function isTouchIdStormFixedVersion(version: string): boolean;
 /**
- * Classify discovered installs that doctor --fix / upgrade may delete.
+ * Classify discovered installs that agents sync / upgrade may delete.
  *
  * Never marks the running package root. Auto-purge is limited to copies that
  * cannot be the intended primary install:
@@ -371,7 +371,7 @@ export declare function purgeRemovableAgentsCliInstalls(candidates: RemovableAge
     dryRun?: boolean;
     runningRoot?: string;
 }): PurgeRemovableInstallsResult;
-/** A detected duplicate that `doctor --fix` will not purge (RUSH-2705). */
+/** A detected duplicate that `agents sync` will not purge (RUSH-2705). */
 export interface UnresolvedDuplicateInstall {
     packageRoot: string;
     version: string;
@@ -393,7 +393,7 @@ export interface RemediateStaleInstallsResult extends PurgeRemovableInstallsResu
     unresolved: UnresolvedDuplicateInstall[];
 }
 /**
- * Scan + classify + purge in one call. Used by `agents doctor --fix` and
+ * Scan + classify + purge in one call. Used by `agents sync` and
  * `agents upgrade` so both paths remediate the same set of latent copies.
  */
 export declare function remediateStaleAgentsCliInstalls(opts: {

package/dist/lib/self-update.js

@@ -669,7 +669,7 @@ function withRunningInstall(installs, runningRoot, runningVersion) {
 }
 /**
  * The exact shell command that removes the install at `packageRoot` by hand —
- * the remedy for duplicates `doctor --fix` deliberately will not purge
+ * the remedy for duplicates `agents sync` deliberately will not purge
  * (RUSH-2705). `--prefix` pins the target tree no matter which npm binary
  * PATH resolves, mirroring installPackageIntoPrefix.
  */
@@ -720,7 +720,7 @@ export function buildMultiInstallInventory(runningRoot, runningVersion, installs
 /** True when the package root lives under npm's `_npx` cache (ephemeral runs). */
 export function isNpxCacheInstall(packageRoot) {
     // Split on either separator so a POSIX-shaped path is still recognized when
-    // this runs on Windows (doctor --fix / tests pass forward literal `_npx`
+    // this runs on Windows (agents sync / tests pass forward literal `_npx`
     // paths from other boxes). `path.sep` alone missed `/home/…/_npx/…` on win32.
     const parts = packageRoot.split(/[\\/]/);
     return parts.includes('_npx');
@@ -741,7 +741,7 @@ export function isTouchIdStormFixedVersion(version) {
     return compareVersions(version, TOUCH_ID_STORM_FIXED_SINCE) >= 0;
 }
 /**
- * Classify discovered installs that doctor --fix / upgrade may delete.
+ * Classify discovered installs that agents sync / upgrade may delete.
  *
  * Never marks the running package root. Auto-purge is limited to copies that
  * cannot be the intended primary install:
@@ -866,7 +866,7 @@ export function purgeRemovableAgentsCliInstalls(candidates, opts = {}) {
     return result;
 }
 /**
- * Scan + classify + purge in one call. Used by `agents doctor --fix` and
+ * Scan + classify + purge in one call. Used by `agents sync` and
  * `agents upgrade` so both paths remediate the same set of latent copies.
  */
 export function remediateStaleAgentsCliInstalls(opts) {

package/dist/lib/session/actor-sidecar.d.ts

@@ -1,5 +1,5 @@
 import { type SessionRunMode } from './types.js';
-export interface SessionActorRecord {
+interface SessionActorRecord {
     sessionId: string;
     /** Resolved actor id (`resolveActor().id`) — the responsible human/agent. */
     actor?: string;
@@ -36,7 +36,7 @@ export interface SessionActorRecord {
  */
 export declare function writeSessionActorRecord(record: SessionActorRecord): void;
 export declare function writeSessionAliasRecord(sessionId: string, alias: string): void;
-export type SessionAliasResolution = {
+type SessionAliasResolution = {
     kind: 'resolved';
     sessionId: string;
 } | {
@@ -56,3 +56,4 @@ export declare function readSessionActorRecord(sessionId: string): SessionActorR
  * yields an empty map.
  */
 export declare function loadSessionActorIndex(): Map<string, SessionActorRecord>;
+export {};

package/dist/lib/session/artifacts.d.ts

@@ -8,8 +8,6 @@
 import type { SessionMeta, SessionArtifact } from './types.js';
 /** Parse a session and return metadata for every file written or edited during it. */
 export declare function discoverArtifacts(meta: SessionMeta): SessionArtifact[];
-/** Refuse to load artifact files larger than this. Returns '' silently above the cap. */
-export declare const ARTIFACT_MAX_BYTES = 50000000;
 /** Read the current contents of an artifact file from disk. Rejects symlinks. */
 export declare function readArtifact(artifact: SessionArtifact): string;
 /** Resolve a user-provided name to an artifact by exact path, basename, or path suffix. */

package/dist/lib/session/artifacts.js

@@ -65,7 +65,7 @@ export function discoverArtifacts(meta) {
     return artifacts;
 }
 /** Refuse to load artifact files larger than this. Returns '' silently above the cap. */
-export const ARTIFACT_MAX_BYTES = 50_000_000;
+const ARTIFACT_MAX_BYTES = 50_000_000;
 /** Read the current contents of an artifact file from disk. Rejects symlinks. */
 export function readArtifact(artifact) {
     const stat = fs.lstatSync(artifact.path);

package/dist/lib/session/bash-command.d.ts

@@ -5,13 +5,7 @@
  * summarize what actually happened instead of printing a wall of shell.
  */
 export type BashCategory = 'vcs' | 'build-test' | 'install' | 'remote' | 'http' | 'media' | 'upscaling' | 'metadata' | 'probe' | 'search' | 'shell' | 'wait' | 'other';
-export interface BashToolInfo {
-    category: BashCategory;
-    signal: 'high' | 'mid' | 'low';
-    action: string;
-    aliases?: string[];
-}
-export interface BashCommandInfo {
+interface BashCommandInfo {
     tool: string;
     category: BashCategory;
     subcommand: string;
@@ -66,3 +60,4 @@ export declare function detectBashMilestone(command: string): {
  * Human-readable category label for renderers.
  */
 export declare function categoryLabel(category: BashCategory): string;
+export {};

package/dist/lib/session/bundle.d.ts

@@ -19,7 +19,6 @@
  */
 import { type SyncAgentSpec } from './sync/agents.js';
 export declare const BUNDLE_KIND = "agents-session-bundle";
-export declare const BUNDLE_VERSION = 1;
 /** First line of a bundle: what it is and how the bodies are encoded. */
 export interface BundleHeader {
     kind: typeof BUNDLE_KIND;
@@ -71,7 +70,7 @@ export interface FileToExport {
     absPath: string;
     label?: string;
 }
-export interface BuildRecordOpts {
+interface BuildRecordOpts {
     /** Scrub secrets from the body before hashing/sealing (default-on at the command layer). */
     redact: boolean;
     /** Non-null → seal each body with this key; null → plaintext bodies. */
@@ -85,8 +84,6 @@ export interface BuildRecordOpts {
 }
 /** Look up the sync spec for an agent id (undefined → agent not sync-representable). */
 export declare function specForAgent(agentId: string): SyncAgentSpec | undefined;
-/** True when an agent's sessions can be represented in a bundle (has a sync spec). */
-export declare function isExportableAgent(agentId: string): boolean;
 /**
  * Read one file and turn it into a bundle record. The hash and size are always
  * computed over the PLAINTEXT (post-redaction) body, so they equal what lands on
@@ -128,7 +125,7 @@ export interface ImportPlanItem {
     targetPath: string;
     status: ImportStatus;
 }
-export interface PlanImportOpts {
+interface PlanImportOpts {
     /** Key to open encrypted record bodies (null → only plaintext bodies readable). */
     decryptKey: Buffer | null;
 }
@@ -152,7 +149,7 @@ export interface WriteResult {
     /** Records for agents with no sync spec. */
     unknown: number;
 }
-export interface WriteImportOpts {
+interface WriteImportOpts {
     overwrite: boolean;
     decryptKey: Buffer | null;
 }
@@ -162,3 +159,4 @@ export interface WriteImportOpts {
  * are counted and skipped.
  */
 export declare function writeImport(plan: ImportPlanItem[], opts: WriteImportOpts): WriteResult;
+export {};

package/dist/lib/session/bundle.js

@@ -24,7 +24,7 @@ import { SYNC_AGENTS, mirrorPath } from './sync/agents.js';
 import { redactSecrets } from '../redact.js';
 import { encryptTranscript, decryptTranscriptBody } from './sync/transcript-crypto.js';
 export const BUNDLE_KIND = 'agents-session-bundle';
-export const BUNDLE_VERSION = 1;
+const BUNDLE_VERSION = 1;
 /** SHA-256 of a file body, used for the bundle's dedup/conflict check on import. */
 function hashContent(content) {
     return crypto.createHash('sha256').update(content).digest('hex');
@@ -33,10 +33,6 @@ function hashContent(content) {
 export function specForAgent(agentId) {
     return SYNC_AGENTS.find(s => s.id === agentId);
 }
-/** True when an agent's sessions can be represented in a bundle (has a sync spec). */
-export function isExportableAgent(agentId) {
-    return specForAgent(agentId) !== undefined;
-}
 /**
  * Read one file and turn it into a bundle record. The hash and size are always
  * computed over the PLAINTEXT (post-redaction) body, so they equal what lands on

package/dist/lib/session/cloud.d.ts

@@ -10,8 +10,6 @@
  *   GET /api/v1/cloud-runs/:id/session.jsonl → raw captured jsonl
  */
 import type { SessionMeta } from './types.js';
-export declare function assertContained(candidate: string, rootDir: string): string;
-export declare function validateCloudExecutionId(executionId: string): string;
 /**
  * List cloud executions the user has captured sessions for. Includes
  * completed + needs_review + failed; an empty session_path means capture
@@ -28,5 +26,3 @@ export declare function discoverCloudSessions(options?: {
 export declare function ensureCloudSessionCached(executionId: string, destPath?: string): Promise<string>;
 /** True if filePath points into the cloud session cache dir. */
 export declare function isCloudSessionPath(filePath: string): boolean;
-/** Extract execution_id from a cloud cache path. */
-export declare function executionIdFromCloudPath(filePath: string): string | null;

package/dist/lib/session/cloud.js

@@ -57,7 +57,7 @@ function agentToFormat(agent) {
         return 'opencode';
     return null;
 }
-export function assertContained(candidate, rootDir) {
+function assertContained(candidate, rootDir) {
     const root = path.resolve(rootDir);
     const resolved = path.resolve(root, candidate);
     if (!resolved.startsWith(root + path.sep)) {
@@ -65,7 +65,7 @@ export function assertContained(candidate, rootDir) {
     }
     return resolved;
 }
-export function validateCloudExecutionId(executionId) {
+function validateCloudExecutionId(executionId) {
     if (!CLOUD_EXECUTION_ID_RE.test(executionId)) {
         throw new Error(`Invalid cloud execution_id: ${JSON.stringify(executionId)}`);
     }
@@ -145,16 +145,3 @@ export function isCloudSessionPath(filePath) {
     const resolved = path.resolve(filePath);
     return resolved.startsWith(root + path.sep);
 }
-/** Extract execution_id from a cloud cache path. */
-export function executionIdFromCloudPath(filePath) {
-    if (!isCloudSessionPath(filePath))
-        return null;
-    const rel = path.relative(CLOUD_CACHE_DIR, filePath);
-    const parts = rel.split(path.sep);
-    try {
-        return parts[0] ? validateCloudExecutionId(parts[0]) : null;
-    }
-    catch {
-        return null;
-    }
-}

package/dist/lib/session/detached.d.ts

@@ -1,6 +1,6 @@
 /** A session's foreground/background presence. */
 export type Presence = 'attached' | 'background' | 'parked';
-export interface DetachRecord {
+interface DetachRecord {
     sessionId: string;
     agent: string;
     cwd?: string;
@@ -28,3 +28,4 @@ export declare function isHeadlessAlive(rec: DetachRecord): boolean;
  *   - record + pid exited   -> `parked` (the run finished; transcript is durable)
  */
 export declare function presenceFromStore(sessionId: string): Presence | undefined;
+export {};

package/dist/lib/session/detached.js

@@ -1,6 +1,6 @@
 /**
  * Detached-session store — the record `agents sessions detach` writes and both
- * `agents sessions attach` and the active-session scan read to know an agent is
+ * `agents sessions resume` and the active-session scan read to know an agent is
  * "backgrounded": running headless with no terminal, continuing its task
  * unattended.
  *
@@ -14,7 +14,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { getSystemAgentsDir } from '../state.js';
-import { captureProcessStartTime } from '../pty-server.js';
+import { captureProcessStartTime } from '../platform/process.js';
 function detachedDir() {
     return path.join(getSystemAgentsDir(), 'detached');
 }

package/dist/lib/session/digest.d.ts

@@ -13,7 +13,6 @@ export interface FileChange {
     path: string;
     op: FileOp;
 }
-export declare const READ_TOOLS: Set<string>;
 export declare const WRITE_TOOLS: Set<string>;
 export declare const EDIT_TOOLS: Set<string>;
 /**
@@ -51,7 +50,7 @@ export declare function toolHistogram(toolCounts: Record<string, number>, top?:
  * only surfaces repeatable tools.
  */
 export declare function bashToolCounts(events: SessionEvent[]): Record<string, number>;
-export interface TestResult {
+interface TestResult {
     runner: string;
     passed?: number;
     failed?: number;
@@ -64,3 +63,4 @@ export interface TestResult {
  * (tool_use) with the next tool_result's output. Returns undefined if none ran.
  */
 export declare function detectTestResult(events: SessionEvent[]): TestResult | undefined;
+export {};

package/dist/lib/session/digest.js

@@ -10,7 +10,7 @@
 import { bucketKey, classifyBashCommand } from './bash-command.js';
 // Tool vocab mirrors parse.ts / render.ts so classification matches what those
 // modules already recognize across Claude/Codex/others.
-export const READ_TOOLS = new Set(['Read', 'read_file', 'view_file', 'cat_file', 'get_file']);
+const READ_TOOLS = new Set(['Read', 'read_file', 'view_file', 'cat_file', 'get_file']);
 export const WRITE_TOOLS = new Set(['Write', 'write_file', 'create_file', 'Create']);
 export const EDIT_TOOLS = new Set(['Edit', 'edit_file', 'replace', 'patch', 'MultiEdit', 'apply_patch']);
 /**

package/dist/lib/session/fork.d.ts

@@ -15,13 +15,13 @@
  */
 import type { SessionMeta } from './types.js';
 /** File-change tally as `sessions preview --json` serializes it (digest.changes). */
-export interface ForkRecapChanges {
+interface ForkRecapChanges {
     created: number;
     modified: number;
     deleted: number;
 }
 /** Everything the recap seed is built from — resolved cross-fleet before launch. */
-export interface ForkRecapInput {
+interface ForkRecapInput {
     /** Source harness id — the sibling launches the same one. */
     agent: string;
     /** Display label for the source (label → topic → short id, resolved by the caller). */
@@ -57,3 +57,4 @@ export declare function forkLabelFor(session: Pick<SessionMeta, 'label' | 'gener
  * orchestration in `commands/fork.ts` stays the only side-effecting layer.
  */
 export declare function buildForkRecap(input: ForkRecapInput): string;
+export {};

package/dist/lib/session/highlights.d.ts

@@ -30,7 +30,7 @@ export declare function isSkillInvocation(e: SessionEvent): boolean;
  * `args.skill` (or `args.name`). Sorted by count desc, then name.
  */
 export declare function extractSkills(events: SessionEvent[]): SkillUse[];
-export interface SlashCommandUse {
+interface SlashCommandUse {
     /** WITH the leading slash, e.g. `/recap`, `/code:commit` — matches SessionEvent.slashCommand's shape. */
     name: string;
     count: number;
@@ -43,7 +43,7 @@ export interface SlashCommandUse {
  * count desc, then name.
  */
 export declare function extractSlashCommands(events: SessionEvent[]): SlashCommandUse[];
-export interface HookUse {
+interface HookUse {
     /** Hook name as configured, e.g. `SessionStart:startup`. */
     name: string;
     /** Lifecycle event, e.g. `SessionStart`. */
@@ -60,8 +60,8 @@ export interface HookUse {
  * Sorted by count desc, then name.
  */
 export declare function extractHooks(events: SessionEvent[]): HookUse[];
-export type LinkKind = 'linear' | 'jira' | 'github' | 'gitlab' | 'other';
-export interface SessionLink {
+type LinkKind = 'linear' | 'jira' | 'github' | 'gitlab' | 'other';
+interface SessionLink {
     kind: LinkKind;
     url: string;
     /** Short display label: `RUSH-2076`, `PR#1755`, `owner/repo#123`, host. */
@@ -113,7 +113,7 @@ export declare function harnessTracksBackgroundShells(agent: SessionAgentId): bo
  * matching events while streaming instead of re-reading the transcript.
  */
 export declare function isBackgroundShellStart(e: SessionEvent): boolean;
-export interface BackgroundShell {
+interface BackgroundShell {
     /** The command line as invoked, trimmed for display. */
     command: string;
     timestamp: string;
@@ -148,3 +148,4 @@ export declare function extractBackgroundShells(events: SessionEvent[]): Backgro
  * different answer; do not "unify" them.
  */
 export declare function isSubAgentTool(tool: string, command: string): boolean;
+export {};

package/dist/lib/session/hook-sessions.d.ts

@@ -39,7 +39,7 @@ export declare function recordCompletedLaunch(binding: PidSessionEntry | undefin
  * collision (pid reuse, or a launch id lingering from a since-dead process).
  */
 export declare function loadHookSessionIndex(): HookSessionIndex;
-export interface ResolveOpts {
+interface ResolveOpts {
     pid: number;
     kind: string;
     launchId?: string;
@@ -60,3 +60,4 @@ export declare function resolveHookSessionRecord(index: HookSessionIndex, opts:
 /** The session id alone — see {@link resolveHookSessionRecord} for the full record
  *  (which also carries the SessionStart `ts` used to stamp `startedAtMs`). */
 export declare function resolveHookSessionId(index: HookSessionIndex, opts: ResolveOpts): string | undefined;
+export {};