@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/hosts/ready.d.ts

@@ -24,8 +24,6 @@ export declare function probeHost(target: string, os?: string, extraSshArgs?: st
 };
 /** ssh command that prints the remote agents-cli version. Pure/exported. */
 export declare function buildRemoteVersionCommand(os?: string): string;
-/** Remote agents-cli version (PATH-resolved on the remote), or null if not installed. */
-export declare function remoteAgentsVersion(target: string, os?: string, extraSshArgs?: string[]): string | null;
 /** ssh command that installs/upgrades agents-cli to `spec` then `agents setup`.
  * PowerShell has no `tail`/`[ -d ]`/`||`, so the Windows branch uses native
  * equivalents (`Select-Object -Last`, `Test-Path`). Pure/exported. */
@@ -89,7 +87,7 @@ export declare function viewHasAgentVersion(view: string, agent: string, version
 /** Actionable fail-loud message for a missing remote pin (RUSH-2313). */
 export declare function missingPinnedVersionMessage(hostName: string, agent: string, version: string, installed?: string[]): string;
 /** Account eligibility extracted from one device's `agents view --json`. */
-export interface ViewAgentAccountEligibility {
+interface ViewAgentAccountEligibility {
     /** At least one account can launch immediately. */
     signedIn: boolean | undefined;
     /** At least one account can launch immediately or enter the harness login flow. */
@@ -111,7 +109,7 @@ export interface ViewAgentAccountEligibility {
  */
 export declare function viewAgentAccountEligibility(view: string, agent: string, now?: number): ViewAgentAccountEligibility;
 export declare function viewAgentSignedIn(view: string, agent: string): boolean | undefined;
-export interface EnsureReadyOptions {
+interface EnsureReadyOptions {
     agent: string;
     /**
      * Explicit version pin (e.g. `"0.145.0"`). Concrete pins fail loud when the
@@ -143,3 +141,4 @@ export declare function evaluateHostAgentInstall(view: string, opts: EnsureReady
 export declare function ensureHostReady(host: Host, opts: EnsureReadyOptions): {
     warnings: string[];
 };
+export {};

package/dist/lib/hosts/ready.js

@@ -64,14 +64,6 @@ export function buildRemoteVersionCommand(os) {
         ? buildWindowsAgentsCommand({ args: ['--version'] })
         : 'bash -lc "agents --version 2>/dev/null"';
 }
-/** Remote agents-cli version (PATH-resolved on the remote), or null if not installed. */
-export function remoteAgentsVersion(target, os, extraSshArgs = []) {
-    const r = sshExec(target, buildRemoteVersionCommand(os), { timeoutMs: 20000, extraSshArgs });
-    if (r.code !== 0)
-        return null;
-    const v = r.stdout.trim();
-    return v || null;
-}
 /** ssh command that installs/upgrades agents-cli to `spec` then `agents setup`.
  * PowerShell has no `tail`/`[ -d ]`/`||`, so the Windows branch uses native
  * equivalents (`Select-Object -Last`, `Test-Path`). Pure/exported. */

package/dist/lib/hosts/reconcile.d.ts

@@ -12,7 +12,7 @@
  */
 import { type SshExecResult } from '../ssh-exec.js';
 import { type HostTask } from './tasks.js';
-export type RemoteExitState = {
+type RemoteExitState = {
     state: 'running';
 } | {
     state: 'done';
@@ -31,13 +31,6 @@ export type RemoteExitState = {
  */
 export declare function classifyExit(res: Pick<SshExecResult, 'code' | 'stdout' | 'timedOut'>): RemoteExitState;
 export declare function readRemoteExit(target: string, remoteExit: string, timeoutMs?: number, identityFile?: string, remoteShell?: 'posix' | 'powershell'): RemoteExitState;
-/**
- * Async twin of {@link readRemoteExit} for the daemon's heartbeat tick — the ssh
- * read runs on the shared event loop, so it MUST NOT block it with a synchronous
- * `spawnSync('ssh', …)` (PHNX-3695). `sshExecAsync` applies the same
- * timeout/kill-grace bound.
- */
-export declare function readRemoteExitAsync(target: string, remoteExit: string, timeoutMs?: number, identityFile?: string, remoteShell?: 'posix' | 'powershell'): Promise<RemoteExitState>;
 /**
  * Heal one record. Terminal records are immutable (and never re-probed); a
  * `running` record is resolved to completed/failed only when the remote `.exit`
@@ -59,3 +52,4 @@ export declare function reconcileTaskAsync(task: HostTask): Promise<HostTask>;
  */
 export declare function reconcileRunningTasks(tasks: HostTask[]): HostTask[];
 export declare function reachabilityProbeCommand(remoteShell?: 'posix' | 'powershell'): string;
+export {};

package/dist/lib/hosts/reconcile.js

@@ -57,7 +57,7 @@ export function readRemoteExit(target, remoteExit, timeoutMs = 6000, identityFil
  * `spawnSync('ssh', …)` (PHNX-3695). `sshExecAsync` applies the same
  * timeout/kill-grace bound.
  */
-export async function readRemoteExitAsync(target, remoteExit, timeoutMs = 6000, identityFile, remoteShell = 'posix') {
+async function readRemoteExitAsync(target, remoteExit, timeoutMs = 6000, identityFile, remoteShell = 'posix') {
     return classifyExit(await sshExecAsync(target, remoteExitCommand(remoteExit, remoteShell), remoteExitSshOpts(timeoutMs, identityFile)));
 }
 /**

package/dist/lib/hosts/reconnect.d.ts

@@ -34,7 +34,7 @@ export interface ReconnectOutcome {
     /** How long the interactive attach held after the probe returned. */
     heldMs: number;
 }
-export type ReconnectDecision = {
+type ReconnectDecision = {
     action: 'stop';
     code: number;
 } | {
@@ -81,8 +81,6 @@ export type ReconnectTarget = {
     kind: 'launch';
     id: string;
 };
-/** The short form shown to a human. Both kinds are uuid-shaped, so 8 chars reads the same. */
-export declare function targetLabel(target: ReconnectTarget): string;
 /**
  * The command a user can run to re-enter a session after reconnect gives up.
  * The full id is printed on its own line so it remains copyable after a drop.
@@ -124,7 +122,7 @@ export declare function afterInteractiveRemoteExit(opts: {
     notice: string | undefined;
 };
 /** Inputs the launcher has once its interactive stream has returned. */
-export interface ReconnectTargetInputs {
+interface ReconnectTargetInputs {
     agent: string;
     sessionId?: string;
     resolvedId?: string;
@@ -141,13 +139,7 @@ export declare function pickReconnectTarget(inputs: ReconnectTargetInputs): Reco
  * a network drop. No `--attach-only`: focus resumes in place when no pane survived.
  */
 export declare function reattachRemoteCommand(target: ReconnectTarget): string;
-/**
- * Re-attach the live remote pane by driving the peer's `agents sessions focus`.
- * A fast preflight probe decides reachability; only then do we run the
- * interactive attach/resume. Returns the exit code, connected bit, and hold time.
- */
-export declare function reattachRemoteSession(host: Host, target: ReconnectTarget): ReconnectOutcome;
-export interface ReconnectLoopOpts {
+interface ReconnectLoopOpts {
     host: Host;
     target: ReconnectTarget;
     /** Exit code from the initial interactive run (treated as connected). */
@@ -159,3 +151,4 @@ export interface ReconnectLoopOpts {
 }
 /** Drive the reconnect loop from the initial run's outcome to a terminal code. */
 export declare function reconnectInteractiveSession(opts: ReconnectLoopOpts): Promise<number>;
+export {};

package/dist/lib/hosts/reconnect.js

@@ -112,7 +112,7 @@ export function wrapRemoteExitCode(cmd) {
     return `bash -lc ${shellQuote(guarded)}`;
 }
 /** The short form shown to a human. Both kinds are uuid-shaped, so 8 chars reads the same. */
-export function targetLabel(target) {
+function targetLabel(target) {
     return target.id.slice(0, 8);
 }
 /**
@@ -201,7 +201,7 @@ export function reattachRemoteCommand(target) {
  * A fast preflight probe decides reachability; only then do we run the
  * interactive attach/resume. Returns the exit code, connected bit, and hold time.
  */
-export function reattachRemoteSession(host, target) {
+function reattachRemoteSession(host, target) {
     const sshTarget = sshTargetFor(host);
     const extraSshArgs = hostIdentityArgs(host);
     // Fresh (non-multiplexed) reachability probe: only a completed handshake is

package/dist/lib/hosts/registry.d.ts

@@ -30,7 +30,7 @@ export declare function getAllProviders(): HostProvider[];
  * doesn't hold, and lets dispatch callers apply the device-only refusal
  * (password auth) without re-reading the registry.
  */
-export interface ResolvedHost extends Host {
+interface ResolvedHost extends Host {
     device?: DeviceProfile;
     /** True when the host is a synthesized ad-hoc `user@host` / IP / FQDN literal
      * (never registered) rather than a device or overlay/ssh-config match. Lets the

package/dist/lib/hosts/remote-cmd.d.ts

@@ -33,7 +33,7 @@ export declare function stripRoutingFlags(args: string[], specs: StripSpec[]): s
  */
 export declare const HOST_ROUTING_SPECS: StripSpec[];
 /** How one `agents run` option behaves when the run is offloaded with `--device`. */
-export type RunOptionForwarding = 
+type RunOptionForwarding = 
 /** Appended to the remote `agents run` argv — same behavior local or remote. */
 'forward'
 /** Refused with an actionable error BEFORE dispatch — never silently dropped. */
@@ -79,7 +79,7 @@ export declare function buildRemoteAgentsInvocation(forwardedArgs: string[], rem
  */
 export declare function posixEnvExports(env?: Record<string, string>): string;
 /** The two remote shell dialects we build commands for. */
-export type RemoteShell = 'posix' | 'powershell';
+type RemoteShell = 'posix' | 'powershell';
 /**
  * Pick the remote shell dialect from a recorded OS/platform string. A Windows
  * host (device-registry `platform: 'windows'`, or an enrolled `HostEntry.os`
@@ -105,7 +105,7 @@ export declare function encodePowershell(script: string): string;
  * back to its script. Used by tests to assert on the built command. */
 export declare function decodePowershell(encoded: string): string;
 /** A single `agents …` invocation to run on a Windows remote. */
-export interface WindowsAgentsCommand {
+interface WindowsAgentsCommand {
     /** `agents` argv (command name NOT included; `agents` is prepended). */
     args: string[];
     /** Env vars scoped to this invocation (POSIX `VAR=val` ↔ PS `$env:VAR=…`). */
@@ -158,12 +158,62 @@ export declare const POWERSHELL_PROGRESS_SILENCE = "$ProgressPreference = 'Silen
  * every remote-JSON boundary regardless of the peer's OS.
  */
 export declare function stripClixml(stdout: string): string;
+/**
+ * Statements that run the Agents CLI on a Windows peer with EXACT argv, leaving the
+ * child's exit code in `$zq`.
+ *
+ * `& agents …` cannot be used, and the reason is not our quoting. On Windows
+ * `agents` is an npm-generated `agents.ps1`, whose body ends in
+ *
+ *     & "node$exe" --no-warnings=… "$basedir/node_modules/@phnx-labs/agents-cli/dist/index.js" $args
+ *
+ * — `$args` splatted into a NATIVE program, which is the PowerShell 5.1 lossy
+ * serializer. So the loss happens INSIDE the user's shim, after our tokens were
+ * already correct: measured on a real peer, `no-such-"menu"-proof` reached the
+ * Agents parser as `no-such-menu-proof`. Quoting harder upstream cannot fix that,
+ * and rewriting a user's npm shim is not ours to do.
+ *
+ * Instead the shim is bypassed the same way `getCliLaunch` (`lib/cli-entry.ts`)
+ * resolves a launch locally: a node-script entry becomes `<node> <entry> …args`.
+ * The entry and runtime are resolved ON THE PEER from the launcher's own location —
+ * the identical two-step the shim itself performs — and executed through .NET with
+ * a `CommandLineToArgvW`-escaped argument string.
+ *
+ * A peer whose `agents` is already a native executable is used directly. A peer
+ * where neither resolves FAILS LOUD: falling back to `& agents` would silently
+ * restore the argument loss, which is worse than an error naming what is missing.
+ *
+ * The entry comes from the package's DECLARED `bin` rather than a literal
+ * `dist/index.js`, so it follows the package instead of needing to be kept in sync
+ * with it.
+ */
+export declare function windowsAgentsInvocation(args: string[], binName?: 'agents' | 'ag'): string;
 export declare function windowsAgentsScript(cmd: WindowsAgentsCommand): string;
 /**
  * Build the `ssh <target> <cmd>` string for one `agents …` invocation on a
- * Windows remote: a `powershell -NoProfile -EncodedCommand <base64>` call. The
+ * Windows remote: a rendered `powershell -NoProfile` call. The
  * Windows counterpart of `bash -lc '<...>'`, shared by every `--device` site.
  */
+/**
+ * Render a PowerShell script as the single command string ssh sends to a Windows
+ * peer, compressing it when that is genuinely shorter.
+ *
+ * The plain route is `-EncodedCommand <base64 of UTF-16LE>`, which inflates the
+ * script by ~2.67x. That matters because OpenSSH-for-Windows caps the whole remote
+ * command far below cmd.exe's 8191 — bisected against a live peer, 2934 characters
+ * succeed and 3102 fail — so a longer script eats the headroom a caller's
+ * arguments, `--remote-cwd` and forwarded env need.
+ *
+ * The alternative is to deflate the UTF-8 script and emit a small fixed bootstrap
+ * that inflates it back. That trades ~2.67x for ~1.33x on the compressible part,
+ * which on scripts of this shape is a large net win. The variable-free bootstrap
+ * uses `-Command` with a base64 payload and leaves stdin available to the child.
+ *
+ * Applied ONLY when the result is actually shorter: for a small script the fixed
+ * bootstrap costs more than it saves, so picking the shorter of the two keeps the
+ * plain form in play for every small caller and is obviously correct either way.
+ */
+export declare function renderPowershellCommand(script: string): string;
 export declare function buildWindowsAgentsCommand(cmd: WindowsAgentsCommand): string;
 /**
  * Build the `ssh <target> <cmd>` string for `agents secrets import` on a Windows
@@ -192,3 +242,4 @@ export declare function buildWindowsStdinImportCommand(bundle: string, opts?: {
     force?: boolean;
     policyNever?: boolean;
 }): string;
+export {};

package/dist/lib/hosts/remote-cmd.js

@@ -8,6 +8,9 @@
  * (`sshExec`/`sshStream`); orchestration lives in `passthrough.ts`.
  */
 import { shellQuote } from '../ssh-exec.js';
+import { pwshLiteral, pwshNativeExecStatements } from '../pwsh.js';
+import { quoteWin32ExecArg } from '../platform/exec.js';
+import * as zlib from 'node:zlib';
 /**
  * Remove routing flags (and their values) from a command's args, leaving the
  * rest untouched and in order so they forward verbatim to the remote binary.
@@ -136,8 +139,6 @@ export const RUN_OPTION_FORWARDING = {
     // On a --device dispatch the remote box runs its own run-exit sync, so this
     // flag is never forwarded — it is a local-exit-behavior toggle, not remote.
     traceSync: 'local-only',
-    // Deprecated alias for --device auto; resolved on the launching box before SSH.
-    smart: 'local-only',
     // Broadcast mode (agents run --broadcast) is its own fan-out dispatch — mutually
     // exclusive with --host. All broadcast options are local-only; exec.ts handles them
     // before any SSH dispatch path is reached.
@@ -293,30 +294,146 @@ export function stripClixml(stdout) {
         .replace(/#< CLIXML[^\n]*\r?\n?(?:\s*<Objs\b[\s\S]*?<\/Objs>)*/g, '')
         .trim();
 }
+/**
+ * Statements that run the Agents CLI on a Windows peer with EXACT argv, leaving the
+ * child's exit code in `$zq`.
+ *
+ * `& agents …` cannot be used, and the reason is not our quoting. On Windows
+ * `agents` is an npm-generated `agents.ps1`, whose body ends in
+ *
+ *     & "node$exe" --no-warnings=… "$basedir/node_modules/@phnx-labs/agents-cli/dist/index.js" $args
+ *
+ * — `$args` splatted into a NATIVE program, which is the PowerShell 5.1 lossy
+ * serializer. So the loss happens INSIDE the user's shim, after our tokens were
+ * already correct: measured on a real peer, `no-such-"menu"-proof` reached the
+ * Agents parser as `no-such-menu-proof`. Quoting harder upstream cannot fix that,
+ * and rewriting a user's npm shim is not ours to do.
+ *
+ * Instead the shim is bypassed the same way `getCliLaunch` (`lib/cli-entry.ts`)
+ * resolves a launch locally: a node-script entry becomes `<node> <entry> …args`.
+ * The entry and runtime are resolved ON THE PEER from the launcher's own location —
+ * the identical two-step the shim itself performs — and executed through .NET with
+ * a `CommandLineToArgvW`-escaped argument string.
+ *
+ * A peer whose `agents` is already a native executable is used directly. A peer
+ * where neither resolves FAILS LOUD: falling back to `& agents` would silently
+ * restore the argument loss, which is worse than an error naming what is missing.
+ *
+ * The entry comes from the package's DECLARED `bin` rather than a literal
+ * `dist/index.js`, so it follows the package instead of needing to be kept in sync
+ * with it.
+ */
+export function windowsAgentsInvocation(args, binName = 'agents') {
+    const escaped = pwshLiteral(args.map(quoteWin32ExecArg).join(' '));
+    return [
+        // Set before any resolution: a non-terminating failure below would otherwise
+        // leave the exit code null, and `exit $null` reports 0.
+        `$ErrorActionPreference = 'Stop'`,
+        `$zc = Get-Command ${powershellQuote(binName)} -ErrorAction Stop`,
+        `$ze = $zc.Source`,
+        `$zr = ''`,
+        // A real native executable needs no interpreter prefix. `CommandType` alone is
+        // NOT that test: `Get-Command` reports `Application` for `agents.cmd` too, and
+        // a .cmd launcher re-parses through cmd.exe with the same argument loss as the
+        // .ps1 one — so a cmd-only install must not bypass this either.
+        `if ($zc.CommandType -ne 'Application' -or $ze -match '\\.(cmd|bat)$') {`,
+        `  $zb = Split-Path $ze`,
+        `  $zk = Join-Path $zb 'node_modules\\@phnx-labs\\agents-cli'`,
+        // The package's DECLARED bin, so the entry follows the package rather than a
+        // hand-synced `dist/index.js` literal that would rot on upgrade. One check
+        // covers a missing bin AND the single-string `bin` form (which yields $null).
+        `  $zl = (Get-Content -Raw (Join-Path $zk 'package.json') | ConvertFrom-Json).bin.${binName}`,
+        `  if (-not $zl) { throw "agents package at $zk declares no bin.${binName}" }`,
+        `  $zt = Join-Path $zk $zl`,
+        `  if (-not [IO.File]::Exists($zt)) { throw "agents CLI entry not found at $zt" }`,
+        // The npm shim prefers a node.exe beside itself before PATH; match that.
+        `  $zd = Join-Path $zb 'node.exe'`,
+        `  $ze = if ([IO.File]::Exists($zd)) { $zd } else { 'node' }`,
+        // A Windows path cannot contain `"`, so wrapping is sufficient escaping here.
+        `  $zr = '--no-warnings=ExperimentalWarning "' + $zt + '" '`,
+        `}`,
+        ...pwshNativeExecStatements('$ze', `$zr + ${escaped}`),
+        // Reported through a plain variable rather than by assigning the automatic
+        // $LASTEXITCODE, which nothing set here since no PowerShell command ran.
+        `$zq = $zp.ExitCode`,
+        // Never let an unknown outcome read as success.
+        `if ($null -eq $zq) { $zq = 1 }`,
+        // NEWLINE-joined, and that is required rather than stylistic: the caller joins
+        // its parts with `'; '`, which between a closing `}` and `else`/an indented block
+        // would produce invalid PowerShell.
+    ].join('\n');
+}
 export function windowsAgentsScript(cmd) {
     const { args, env, cwd, propagateExit = true, remapExit255 = false } = cmd;
-    const parts = [POWERSHELL_PROGRESS_SILENCE];
+    // `Stop` FIRST, before the env assignments and the Set-Location: a failing
+    // `Set-Location` (a cwd that does not exist on the peer) must abort rather than
+    // continue into the launcher and run the command in the wrong directory.
+    const parts = [POWERSHELL_PROGRESS_SILENCE, `$ErrorActionPreference = 'Stop'`];
     if (env)
         for (const [k, v] of Object.entries(env))
             parts.push(`$env:${k} = ${powershellQuote(v)}`);
     if (cwd)
         parts.push(`Set-Location -LiteralPath ${powershellQuote(cwd)}`);
-    parts.push(`& ${['agents', ...args].map(powershellQuote).join(' ')}`);
+    parts.push(windowsAgentsInvocation(args));
     if (propagateExit) {
         if (remapExit255)
-            parts.push('$agentsExit = $LASTEXITCODE', 'if ($agentsExit -eq 255) { exit 254 }', 'exit $agentsExit');
+            parts.push('if ($zq -eq 255) { exit 254 }', 'exit $zq');
         else
-            parts.push('exit $LASTEXITCODE');
+            parts.push('exit $zq');
     }
     return parts.join('; ');
 }
 /**
  * Build the `ssh <target> <cmd>` string for one `agents …` invocation on a
- * Windows remote: a `powershell -NoProfile -EncodedCommand <base64>` call. The
+ * Windows remote: a rendered `powershell -NoProfile` call. The
  * Windows counterpart of `bash -lc '<...>'`, shared by every `--device` site.
  */
+/**
+ * Render a PowerShell script as the single command string ssh sends to a Windows
+ * peer, compressing it when that is genuinely shorter.
+ *
+ * The plain route is `-EncodedCommand <base64 of UTF-16LE>`, which inflates the
+ * script by ~2.67x. That matters because OpenSSH-for-Windows caps the whole remote
+ * command far below cmd.exe's 8191 — bisected against a live peer, 2934 characters
+ * succeed and 3102 fail — so a longer script eats the headroom a caller's
+ * arguments, `--remote-cwd` and forwarded env need.
+ *
+ * The alternative is to deflate the UTF-8 script and emit a small fixed bootstrap
+ * that inflates it back. That trades ~2.67x for ~1.33x on the compressible part,
+ * which on scripts of this shape is a large net win. The variable-free bootstrap
+ * uses `-Command` with a base64 payload and leaves stdin available to the child.
+ *
+ * Applied ONLY when the result is actually shorter: for a small script the fixed
+ * bootstrap costs more than it saves, so picking the shorter of the two keeps the
+ * plain form in play for every small caller and is obviously correct either way.
+ */
+export function renderPowershellCommand(script) {
+    const plain = `powershell -NoProfile -EncodedCommand ${encodePowershell(script)}`;
+    // Raw DEFLATE (RFC 1951) — what .NET's `DeflateStream` reads. `deflateSync`
+    // would prepend a zlib header that `DeflateStream` rejects.
+    const packed = zlib.deflateRawSync(Buffer.from(script, 'utf-8'), { level: 9 }).toString('base64');
+    // The blob is embedded DIRECTLY in a `-Command` string rather than wrapped in a
+    // second `-EncodedCommand`: routing an already-base64 payload through the encoded
+    // form would inflate it by another 2.67x and cancel most of the compression.
+    //
+    // The bootstrap is deliberately VARIABLE-FREE — one nested expression, no `$`
+    // anywhere. A `$b = …` form is unsafe here: OpenSSH-for-Windows may have
+    // PowerShell as its `DefaultShell`, in which case the outer double-quoted string
+    // is parsed by PowerShell first and `$b` would be expanded before our script ever
+    // runs. With no `$`, no `%`, no backtick and no cmd metacharacter — base64's
+    // alphabet is `A-Za-z0-9+/=` and the rest is ASCII punctuation neither shell
+    // touches inside quotes — the same text survives either default shell. stdin is
+    // untouched by both routes.
+    const bootstrap = 'iex ([IO.StreamReader]::new([IO.Compression.DeflateStream]::new('
+        + `[IO.MemoryStream]::new([Convert]::FromBase64String('${packed}')),`
+        + '[IO.Compression.CompressionMode]::Decompress),[Text.Encoding]::UTF8).ReadToEnd())';
+    const compressed = `powershell -NoProfile -Command "${bootstrap}"`;
+    // Only when genuinely shorter: for a small script the fixed bootstrap costs more
+    // than it saves, so this keeps the plain form in play for every small caller.
+    return compressed.length < plain.length ? compressed : plain;
+}
 export function buildWindowsAgentsCommand(cmd) {
-    return `powershell -NoProfile -EncodedCommand ${encodePowershell(windowsAgentsScript(cmd))}`;
+    return renderPowershellCommand(windowsAgentsScript(cmd));
 }
 /**
  * Build the `ssh <target> <cmd>` string for `agents secrets import` on a Windows

package/dist/lib/hosts/remote-cmd.test-fixture.d.ts

@@ -0,0 +1,2 @@
+/** The script behind either render route. Throws if the command is neither. */
+export declare function decodeRenderedPowershell(command: string): string;

package/dist/lib/hosts/remote-cmd.test-fixture.js

@@ -0,0 +1,22 @@
+/**
+ * Test-only decoder for a rendered remote PowerShell command.
+ *
+ * `renderPowershellCommand` emits whichever of two representations is shorter: the
+ * plain `-EncodedCommand <base64 UTF-16LE>`, or a `-Command` bootstrap carrying a
+ * deflated UTF-8 payload. Tests assert on the SCRIPT, not the representation, so
+ * every suite needs both — and four copies of that parsing is exactly how one of
+ * them silently stops decoding the form it was meant to check.
+ *
+ * Named `*.test-fixture.ts` after the existing `daemon.test-fixture.ts`.
+ */
+import * as zlib from 'node:zlib';
+/** The script behind either render route. Throws if the command is neither. */
+export function decodeRenderedPowershell(command) {
+    const encoded = /-EncodedCommand (\S+)\s*$/.exec(command);
+    if (encoded)
+        return Buffer.from(encoded[1], 'base64').toString('utf16le');
+    const packed = /FromBase64String\('([A-Za-z0-9+/=]+)'\)/.exec(command);
+    if (!packed)
+        throw new Error(`not a rendered PowerShell command: ${command}`);
+    return zlib.inflateRawSync(Buffer.from(packed[1], 'base64')).toString('utf-8');
+}

package/dist/lib/hosts/session-index.d.ts

@@ -18,7 +18,7 @@
  */
 import type { SessionMeta } from '../session/types.js';
 import { type HostTask } from './tasks.js';
-export interface HostSessionContext {
+interface HostSessionContext {
     /** Local directory the `agents run --device` was invoked from. */
     cwd: string;
     /** Prompt the run was launched with, used for the session topic. */
@@ -53,7 +53,7 @@ export declare function registerHostSession(task: HostTask, ctx: HostSessionCont
  * missing/unreadable mirror or absent marker yields null, never an exception.
  */
 export declare function captureRemoteSessionId(task: HostTask): HostTask | null;
-export interface InteractiveHostSessionContext {
+interface InteractiveHostSessionContext {
     cwd: string;
     host: string;
     agent: string;
@@ -68,3 +68,4 @@ export interface InteractiveHostSessionContext {
  * surface and resume it by id.
  */
 export declare function registerInteractiveHostSession(ctx: InteractiveHostSessionContext): void;
+export {};

package/dist/lib/hosts/ssh-config.d.ts

@@ -19,11 +19,9 @@ export declare function parseSshConfigHosts(content: string): string[];
 export declare function parseKnownHosts(content: string): string[];
 /** `Host` names from ~/.ssh/config, following `Include` globs (best-effort). */
 export declare function listSshConfigHosts(): string[];
-/** Hostnames recorded in ~/.ssh/known_hosts (hashed entries skipped). */
-export declare function listKnownHosts(): string[];
 /** True if `name` is a concrete `Host` stanza in ssh config. */
 export declare function isSshConfigHost(name: string): boolean;
-export interface SshGResult {
+interface SshGResult {
     hostname?: string;
     user?: string;
     port?: string;
@@ -35,3 +33,4 @@ export interface SshGResult {
  * to decide whether a name is actually configured.
  */
 export declare function sshResolve(name: string): SshGResult | undefined;
+export {};

package/dist/lib/hosts/ssh-config.js

@@ -12,7 +12,6 @@ import { spawnSync } from 'child_process';
 import { assertValidSshTarget } from '../ssh-exec.js';
 const SSH_DIR = path.join(os.homedir(), '.ssh');
 const SSH_CONFIG = path.join(SSH_DIR, 'config');
-const KNOWN_HOSTS = path.join(SSH_DIR, 'known_hosts');
 /**
  * Parse `Host` stanza names from ssh config text. Wildcard/negated patterns
  * (`*`, `?`, `!`) are skipped — they're match rules, not concrete hosts.
@@ -110,15 +109,6 @@ function globMaybe(pattern) {
         return [];
     }
 }
-/** Hostnames recorded in ~/.ssh/known_hosts (hashed entries skipped). */
-export function listKnownHosts() {
-    try {
-        return parseKnownHosts(fs.readFileSync(KNOWN_HOSTS, 'utf-8'));
-    }
-    catch {
-        return [];
-    }
-}
 /** True if `name` is a concrete `Host` stanza in ssh config. */
 export function isSshConfigHost(name) {
     return listSshConfigHosts().includes(name);

package/dist/lib/humans.d.ts

@@ -1,6 +1,4 @@
 import type { HumansConfig, HumanOwner } from './types.js';
-export declare const HUMANS_VERSION: 1;
-export declare const HUMANS_HEADER = "# humans.yaml \u2014 owner identity and notification channels\n# Managed by agents-cli. See: agents humans --help\n";
 /**
  * Read and parse humans.yaml. Returns null when the file does not exist or
  * is not a valid v1 config — never throws.

package/dist/lib/humans.js

@@ -10,8 +10,8 @@
 import * as fs from 'fs';
 import * as yaml from 'yaml';
 import { getHumansFilePath } from './state.js';
-export const HUMANS_VERSION = 1;
-export const HUMANS_HEADER = `# humans.yaml — owner identity and notification channels
+const HUMANS_VERSION = 1;
+const HUMANS_HEADER = `# humans.yaml — owner identity and notification channels
 # Managed by agents-cli. See: agents humans --help
 `;
 /**

package/dist/lib/import.d.ts

@@ -17,12 +17,12 @@
  * true.
  */
 import type { AgentId } from './types.js';
-export interface ImportConfigResult {
+interface ImportConfigResult {
     success: boolean;
     skipped?: boolean;
     error?: string;
 }
-export interface ImportBinaryResult {
+interface ImportBinaryResult {
     success: boolean;
     skipped?: boolean;
     error?: string;
@@ -60,7 +60,7 @@ export declare function finalizeImport(agentId: AgentId, version: string): void;
  * farm from the AGENTS registry, which keeps the function pure and avoids
  * fragile coupling in test setups that stub `lib/agents.ts`.
  */
-export interface AgentBinarySpec {
+interface AgentBinarySpec {
     /** Agent id used in the marker package.json (`agents-{agentId}-{version}`). */
     agentId: string;
     /** npm package name (e.g. `openclaw`) — used as the `node_modules/<name>` dir. */
@@ -136,3 +136,4 @@ export declare function seedIsolatedConfigFromLocal(agentId: AgentId, version: s
     skippedRuntime: string[];
     error?: string;
 };
+export {};

package/dist/lib/installations/installation-lock.d.ts

@@ -1,6 +1,4 @@
 import { type FileLockOptions } from '../fs-atomic.js';
 import { type AgentId } from '../types.js';
 export declare function installationLockTarget(agent: AgentId, label: string): string;
-export declare const INSTALLATION_LOCK_STALE_MS: number;
-export declare const INSTALLATION_LOCK_ACQUIRE_TIMEOUT_MS: number;
 export declare const INSTALLATION_LOCK_OPTIONS: Required<FileLockOptions>;

package/dist/lib/installations/installation-lock.js

@@ -20,8 +20,8 @@ export function installationLockTarget(agent, label) {
     ensureLockTarget(target, '', 0o700);
     return target;
 }
-export const INSTALLATION_LOCK_STALE_MS = 10 * 60_000;
-export const INSTALLATION_LOCK_ACQUIRE_TIMEOUT_MS = 5 * 60_000;
+const INSTALLATION_LOCK_STALE_MS = 10 * 60_000;
+const INSTALLATION_LOCK_ACQUIRE_TIMEOUT_MS = 5 * 60_000;
 export const INSTALLATION_LOCK_OPTIONS = {
     staleMs: INSTALLATION_LOCK_STALE_MS,
     acquireTimeoutMs: INSTALLATION_LOCK_ACQUIRE_TIMEOUT_MS,

package/dist/lib/installations/launch-gate.d.ts

@@ -44,15 +44,6 @@ import type { AgentId } from '../types.js';
  * work here serializes launches against each other unnecessarily.
  */
 export declare function withLaunchGate<T>(agent: AgentId, label: string, fn: () => T): Promise<T>;
-/**
- * Acquire the per-installation update lock, register a launch lease for
- * `pid`, then release. For a caller that already has its own pid before the
- * risky operation (the native shim's `$$`, exec-replaced so the pid is
- * final) — a Node caller that spawns a child should use {@link withLaunchGate}
- * around the spawn itself instead, since here the process already exists by
- * the time the lock is acquired.
- */
-export declare function acquireLaunchGate(agent: AgentId, label: string, pid: number): Promise<() => void>;
 /** Keep a live launcher's lease until its operation ends, without holding the lock. */
 export declare function withInstallationLease<T>(agent: AgentId, label: string, fn: () => Promise<T>): Promise<T>;
 /**

package/dist/lib/installations/launch-gate.js

@@ -91,7 +91,7 @@ export async function withLaunchGate(agent, label, fn) {
  * around the spawn itself instead, since here the process already exists by
  * the time the lock is acquired.
  */
-export async function acquireLaunchGate(agent, label, pid) {
+async function acquireLaunchGate(agent, label, pid) {
     return withLaunchGate(agent, label, () => recordLaunchLease(agent, label, pid));
 }
 /** Keep a live launcher's lease until its operation ends, without holding the lock. */

package/dist/lib/installations/migrate.d.ts

@@ -45,17 +45,6 @@ export declare function migrateRoutineDeviceToDevices(routinesDir?: string): voi
  * Idempotent: a file with only `cwd` (already migrated) is skipped.
  */
 export declare function migrateRoutineRemoteCwdToCwd(routinesDir?: string): void;
-/**
- * Pause every currently-active routine whose execution context no longer
- * resolves ready (RUSH-2290). An agent/workflow routine with no project/cwd, a
- * missing directory, or a non-portable path used to fire and fail every tick —
- * the mass auth_failed / untrusted-home storm this ticket exists to stop. After
- * the fold, such a routine is deactivated on THIS device (only), preventing it
- * from being scheduled until `agents routines doctor --all --fix` (or a repair +
- * `resume`) makes it ready. Never materializes a device manifest that does not
- * yet exist, and never touches command routines (they run in the target home).
- */
-export declare function pauseUnreadyEnabledRoutines(): void;
 /**
  * Fold the legacy watchdog enable sentinel into the `watchdog.enabled` config.
  *