@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/menubar/resolve-version.d.ts

@@ -18,10 +18,6 @@
  * (`downloadMenubarHelperApp`: sha256, codesign, Team, designated-requirement
  * pin, notarization) is unchanged — resolution only chooses the version.
  */
-/** The repo whose releases carry `menubar/v*` tags (same as the download URL). */
-export declare const MENUBAR_RELEASES_API = "https://api.github.com/repos/phnx-labs/agi-cli/releases?per_page=100";
-/** How long a resolved answer is trusted before the release list is re-read. */
-export declare const MENUBAR_RESOLVE_TTL_MS: number;
 /** One release as the resolver sees it — the subset of the GitHub shape it reads. */
 export interface ReleaseCandidate {
     tagName: string;
@@ -29,7 +25,7 @@ export interface ReleaseCandidate {
     draft?: boolean;
     prerelease?: boolean;
 }
-export interface MenubarResolveCache {
+interface MenubarResolveCache {
     /** Epoch ms of the release-list read this answer came from. */
     checkedAt: number;
     /** The newest published helper version at that time (never below the floor then). */
@@ -41,8 +37,6 @@ export interface MenubarResolveCache {
  * pre-release, and carry both the zip and its `.sha256`.
  */
 export declare function pickNewestMenubarVersion(candidates: ReleaseCandidate[], floor: string): string;
-/** Where the resolved answer lives: beside the helper's own download cache. */
-export declare function menubarResolveCachePath(): string;
 export declare function readMenubarResolveCache(file: string): MenubarResolveCache | null;
 /**
  * The cached answer when it is usable offline: at or above the floor, of any
@@ -61,8 +55,6 @@ type FetchLike = (input: string, init?: {
     status: number;
     json(): Promise<unknown>;
 }>;
-/** Read the release list. Unauthenticated: release metadata is public and this runs at most once a day per machine. */
-export declare function fetchMenubarReleaseCandidates(fetchImpl?: FetchLike): Promise<ReleaseCandidate[]>;
 /**
  * The helper version to install now: the newest published build >= floor.
  *

package/dist/lib/menubar/resolve-version.js

@@ -26,9 +26,9 @@ import { helperFloor } from '../helper-versions.js';
 import { getCliVersion } from '../version.js';
 import { MENUBAR_HELPER_ASSET } from './download-menubar.js';
 /** The repo whose releases carry `menubar/v*` tags (same as the download URL). */
-export const MENUBAR_RELEASES_API = 'https://api.github.com/repos/phnx-labs/agi-cli/releases?per_page=100';
+const MENUBAR_RELEASES_API = 'https://api.github.com/repos/phnx-labs/agi-cli/releases?per_page=100';
 /** How long a resolved answer is trusted before the release list is re-read. */
-export const MENUBAR_RESOLVE_TTL_MS = 24 * 60 * 60 * 1000;
+const MENUBAR_RESOLVE_TTL_MS = 24 * 60 * 60 * 1000;
 const TAG = /^menubar\/v(\d+\.\d+\.\d+)$/;
 /**
  * Pure: the newest candidate at or above `floor`, else the floor. A tag must be
@@ -51,7 +51,7 @@ export function pickNewestMenubarVersion(candidates, floor) {
     return best;
 }
 /** Where the resolved answer lives: beside the helper's own download cache. */
-export function menubarResolveCachePath() {
+function menubarResolveCachePath() {
     return path.join(getCacheDir(), 'menubar', 'latest.json');
 }
 export function readMenubarResolveCache(file) {
@@ -84,7 +84,7 @@ export function cachedMenubarVersion(opts = {}) {
     return cache && compareVersions(cache.version, floor) >= 0 ? cache.version : floor;
 }
 /** Read the release list. Unauthenticated: release metadata is public and this runs at most once a day per machine. */
-export async function fetchMenubarReleaseCandidates(fetchImpl = fetch) {
+async function fetchMenubarReleaseCandidates(fetchImpl = fetch) {
     const res = await fetchImpl(MENUBAR_RELEASES_API, {
         headers: {
             Accept: 'application/vnd.github+json',

package/dist/lib/menubar/snapshot.d.ts

@@ -8,14 +8,20 @@ import type { WatchdogTickResult } from '../watchdog/runner.js';
  * is deliberately NOT claimed here (the registry's cached tailscale flag is
  * documented as stale in both directions — registry.ts isLikelyOnline).
  */
-export interface MenubarDevice {
+interface MenubarDevice {
     name: string;
     platform: string;
+    /**
+     * Physical form factor for a factual hardware icon: `laptop` | `desktop` |
+     * `server` | `unknown` (PHNX-3999). A shared device-scope config fact set
+     * explicitly per device — never inferred from `platform`. `unknown` when unset.
+     */
+    formFactor: string;
     interactive: boolean;
     isLocal: boolean;
     preferred: boolean;
 }
-export interface MenubarSnapshot {
+interface MenubarSnapshot {
     version: 1;
     capturedAt: string;
     /**
@@ -29,11 +35,27 @@ export interface MenubarSnapshot {
     recentSessions: Record<string, unknown>[];
     activeSessions: Record<string, unknown>[];
     devices: MenubarDevice[];
+    /**
+     * AGI Menu preferences (PHNX-3999), keyed by the full `menubar.menu.*` config
+     * name, carrying the EFFECTIVE value — the stored value, else the registered
+     * default. The native menu consumes this from the snapshot it already polls
+     * rather than a second preference-read mechanism. `menubar.menu.defaultProject`
+     * is omitted when unset (it has no default); every other key is always present.
+     * Writes stay one `agents config set/unset <key>` per setting.
+     */
+    menuPreferences: Record<string, unknown>;
     watchdog: {
         enabled: boolean;
         lastTick: Pick<WatchdogTickResult, 'didNudge' | 'counts'> | null;
     };
 }
+/**
+ * The effective AGI Menu preferences map for the snapshot: each `menubar.menu.*`
+ * key's stored value, or its registered default when unset. A key with neither
+ * (only `defaultProject`) is omitted so the native app keeps its own default.
+ */
+export declare function buildMenuPreferences(): Record<string, unknown>;
 export declare function readLastWatchdogTick(stateDir?: string): WatchdogTickResult | null;
 /** One-process read model for AGI Menu's repeating three-minute refresh. */
 export declare function computeMenubarSnapshot(): Promise<MenubarSnapshot>;
+export {};

package/dist/lib/menubar/snapshot.js

@@ -3,12 +3,31 @@ import * as path from 'path';
 import { buildRoutineListJson } from '../scheduling/routines.js';
 import { backfillActiveRowsFromIndex, isRunningLiveSession, serializeActiveSessionsForJson, serializeSessionsJson } from '../session/active.js';
 import { getConfigValue, loadAutoLaunchPreferences } from '../device-config.js';
+import { MENUBAR_MENU_PROPERTIES } from '../config-keys.js';
+import { migrateMenubarPreferencesFromUserDefaults } from './migrate-prefs.js';
 import { loadDevices } from '../devices/registry.js';
 import { machineId } from '../machine-id.js';
 import { querySessions } from '../session/db.js';
 import { readActiveSessionsCache } from '../session/session-cache.js';
 import { getRuntimeStateDir } from '../state.js';
 import { getCliVersion } from '../version.js';
+/**
+ * The effective AGI Menu preferences map for the snapshot: each `menubar.menu.*`
+ * key's stored value, or its registered default when unset. A key with neither
+ * (only `defaultProject`) is omitted so the native app keeps its own default.
+ */
+export function buildMenuPreferences() {
+    const out = {};
+    for (const prop of MENUBAR_MENU_PROPERTIES) {
+        const name = `menubar.menu.${prop}`;
+        const entry = getConfigValue(name);
+        const value = entry.value !== undefined ? entry.value : entry.spec.defaultValue;
+        if (value === undefined)
+            continue; // unset defaultProject — no default to emit
+        out[name] = value;
+    }
+    return out;
+}
 /**
  * The full registered-device roster for the menu bar, from the local registry
  * file only (no ssh, no stats probe) — as cheap as `buildRoutineListJson()`, so
@@ -26,6 +45,8 @@ async function buildMenubarDevices() {
         .map((name) => ({
         name,
         platform: reg[name].platform,
+        // Shared device-scope fact (readable for any device); `unknown` when unset.
+        formFactor: getConfigValue('formFactor', { device: name }).value ?? 'unknown',
         interactive: name === interactiveHost,
         isLocal: name === self,
         preferred: prefs[name]?.preferred === true,
@@ -41,6 +62,10 @@ export function readLastWatchdogTick(stateDir = path.join(getRuntimeStateDir(),
 }
 /** One-process read model for AGI Menu's repeating three-minute refresh. */
 export async function computeMenubarSnapshot() {
+    // One-shot, sentinel-gated, macOS-only lift of legacy UserDefaults prefs into
+    // config before we read them. After the first run it is a cheap existsSync
+    // no-op; it never throws into the snapshot.
+    migrateMenubarPreferencesFromUserDefaults();
     const [routines, recent, devices] = await Promise.all([
         Promise.resolve(buildRoutineListJson()),
         Promise.resolve(querySessions({ limit: 40, skipExistenceCheck: true })),
@@ -69,6 +94,7 @@ export async function computeMenubarSnapshot() {
         recentSessions: JSON.parse(serializeSessionsJson(recent)),
         activeSessions: serializeActiveSessionsForJson(activeSessions),
         devices,
+        menuPreferences: buildMenuPreferences(),
         watchdog: {
             enabled: getConfigValue('watchdog.enabled').value === true,
             lastTick: (() => {

package/dist/lib/model-tier-overrides.d.ts

@@ -22,8 +22,8 @@
  */
 import type { AgentId } from './types.js';
 import { type ModelTier } from './model-tiers.js';
-export type TierOverrideMap = Partial<Record<ModelTier, string>>;
-export interface TierOverrideEntry {
+type TierOverrideMap = Partial<Record<ModelTier, string>>;
+interface TierOverrideEntry {
     selector: string;
     tiers: TierOverrideMap;
 }
@@ -41,3 +41,4 @@ export declare function listTierOverrides(): TierOverrideEntry[];
 export declare function setTierOverride(selectorInput: string, tierInput: string | ModelTier, model: string): TierOverrideEntry;
 /** Clear one tier (or all tiers when `tierInput` is omitted) for a selector. Returns true if anything changed. */
 export declare function clearTierOverride(selectorInput: string, tierInput?: string): boolean;
+export {};

package/dist/lib/monitors/config.d.ts

@@ -262,5 +262,3 @@ export declare function writeMonitor(config: MonitorConfig): void;
 export declare function deleteMonitor(name: string): boolean;
 /** Enable or disable a monitor by name. */
 export declare function setMonitorEnabled(name: string, enabled: boolean): void;
-/** Check whether a monitor with the given name exists on disk. */
-export declare function monitorExists(name: string): boolean;

package/dist/lib/monitors/config.js

@@ -500,7 +500,3 @@ export function setMonitorEnabled(name, enabled) {
     monitor.enabled = enabled;
     writeMonitor(monitor);
 }
-/** Check whether a monitor with the given name exists on disk. */
-export function monitorExists(name) {
-    return readMonitor(name) !== null;
-}

package/dist/lib/monitors/engine.d.ts

@@ -29,7 +29,7 @@ interface MonitorLivenessLike {
     droughtNotifiedAt?: string;
 }
 /** The fire/no-fire decision for one observation, plus what to persist. */
-export interface FireDecision {
+interface FireDecision {
     fire: boolean;
     /** The value whose de-dupe signature is stored on persist. */
     value: string;

package/dist/lib/monitors/remote.d.ts

@@ -49,7 +49,7 @@ export interface RemoteMonitor {
  * must never blank the guard for the rest of the fleet.
  */
 export declare function parseRemoteMonitors(stdout: string, machine: string): RemoteMonitor[];
-export interface FleetMonitorsResult {
+interface FleetMonitorsResult {
     monitors: RemoteMonitor[];
     /** Target discovery failed before any peer was dialed — the fleet was not
      *  consulted at all, which must not read as "no duplicate anywhere". */
@@ -58,7 +58,7 @@ export interface FleetMonitorsResult {
      *  silently treating "we could not ask" as "there is no duplicate". */
     skipped: string[];
 }
-export interface GatherFleetMonitorsOptions {
+interface GatherFleetMonitorsOptions {
     /** When supplied, the fan-out aborts as soon as any peer returns a monitor with
      *  this behavioral fingerprint. The miss path still waits for every peer so the
      *  guard can prove absence fleet-wide. */
@@ -80,3 +80,4 @@ export interface GatherFleetMonitorsOptions {
  * knowable once every peer has answered.
  */
 export declare function gatherFleetMonitors(options?: GatherFleetMonitorsOptions): Promise<FleetMonitorsResult>;
+export {};

package/dist/lib/monitors/sources/webhook.d.ts

@@ -2,22 +2,9 @@
  * Webhook source evaluator.
  *
  * Webhooks are push-based (an inbound signed HTTP delivery), so the poll-model
- * `evaluate` returns null. When a delivery arrives, the receiver matches it
- * against monitors with `matchWebhook`, which reuses the github/linear matchers
- * from lib/triggers/webhook.ts by projecting the monitor's webhook filters onto a
- * synthesized JobConfig-shaped trigger.
+ * `evaluate` returns null.
  */
-import { type IncomingWebhook } from '../../triggers/webhook.js';
-import type { JobTrigger } from '../../scheduling/routines.js';
-import type { MonitorSource, MonitorConfig } from '../config.js';
+import type { MonitorSource } from '../config.js';
 import type { Observation } from './types.js';
 /** Push-only: nothing to snapshot on a poll tick. */
 export declare function evaluate(_source: MonitorSource): Promise<Observation | null>;
-/** Project a monitor's webhook source onto a JobTrigger for the shared matcher. */
-export declare function monitorTrigger(source: MonitorSource): JobTrigger | null;
-/**
- * True when an incoming webhook matches this monitor's webhook source — reuses
- * the routines matcher (lib/triggers/webhook.ts) so github/linear filter
- * semantics stay in one place.
- */
-export declare function matchWebhook(monitor: MonitorConfig, webhook: IncomingWebhook): boolean;

package/dist/lib/monitors/sources/webhook.js

@@ -2,46 +2,9 @@
  * Webhook source evaluator.
  *
  * Webhooks are push-based (an inbound signed HTTP delivery), so the poll-model
- * `evaluate` returns null. When a delivery arrives, the receiver matches it
- * against monitors with `matchWebhook`, which reuses the github/linear matchers
- * from lib/triggers/webhook.ts by projecting the monitor's webhook filters onto a
- * synthesized JobConfig-shaped trigger.
+ * `evaluate` returns null.
  */
-import { jobMatchesWebhook } from '../../triggers/webhook.js';
 /** Push-only: nothing to snapshot on a poll tick. */
 export function evaluate(_source) {
     return Promise.resolve(null);
 }
-/** Project a monitor's webhook source onto a JobTrigger for the shared matcher. */
-export function monitorTrigger(source) {
-    const w = source.webhook;
-    if (!w)
-        return null;
-    if (w.source === 'github') {
-        return {
-            type: 'github_event',
-            event: w.event,
-            ...(w.repo ? { repo: w.repo } : {}),
-            ...(w.branch ? { branch: w.branch } : {}),
-        };
-    }
-    return {
-        type: 'linear_event',
-        event: w.event,
-        ...(w.action ? { action: w.action } : {}),
-        ...(w.teamKey ? { teamKey: w.teamKey } : {}),
-        ...(w.label ? { label: w.label } : {}),
-    };
-}
-/**
- * True when an incoming webhook matches this monitor's webhook source — reuses
- * the routines matcher (lib/triggers/webhook.ts) so github/linear filter
- * semantics stay in one place.
- */
-export function matchWebhook(monitor, webhook) {
-    const trigger = monitorTrigger(monitor.source);
-    if (!trigger)
-        return false;
-    const shim = { name: monitor.name, trigger };
-    return jobMatchesWebhook(shim, webhook);
-}

package/dist/lib/monitors/state.d.ts

@@ -13,7 +13,7 @@
 import { type RunMeta } from '../scheduling/routines.js';
 import type { MonitorEvent } from './config.js';
 /** Persisted last-seen state for one monitor. */
-export interface MonitorState {
+interface MonitorState {
     monitorName: string;
     /** Hash of the last-seen de-dupe signature (see hasChanged). */
     lastHash: string;
@@ -53,12 +53,8 @@ export interface MonitorLiveness {
 }
 /** Per-monitor history root, with the (untrusted) name contained to one segment. */
 export declare function getMonitorHistoryDir(name: string): string;
-/** Directory holding a monitor's fire history. */
-export declare function getMonitorFiresDir(name: string): string;
 /** Read a monitor's last-seen state, or null if it has never been observed. */
 export declare function readState(name: string): MonitorState | null;
-/** Persist a monitor's state atomically (temp file + rename, like writeRunMeta). */
-export declare function writeStateRaw(state: MonitorState): void;
 /**
  * Record a new observation as the monitor's last-seen state, preserving fire
  * bookkeeping. Truncates the stored raw value so a firehose can't bloat disk.
@@ -99,7 +95,7 @@ export declare function recordFireTime(name: string, now: number, windowMs: numb
 /** Write a fire record to fires/<id>/event.json and return the fire id. */
 export declare function writeFireRecord(event: MonitorEvent, meta?: Record<string, unknown>): string;
 /** A single fire history entry (as read back from disk). */
-export interface FireRecord extends MonitorEvent {
+interface FireRecord extends MonitorEvent {
     runId?: string;
     action?: string;
     ok?: boolean;
@@ -132,7 +128,7 @@ export interface FireRecord extends MonitorEvent {
 /** List a monitor's fire history, chronologically ascending. */
 export declare function listFires(name: string): FireRecord[];
 /** The reconciled outcome of one fire, resolved against the run's live status. */
-export interface ReconciledFireOutcome {
+interface ReconciledFireOutcome {
     /** True fire outcome, correcting the frozen `ok` against the run's CURRENT status. */
     ok: boolean;
     /** The run's live terminal status, when a runId is present and resolvable. */
@@ -184,3 +180,4 @@ export declare function evaluatePostcondition(command: string): {
  * so later listings do not re-exec the command.
  */
 export declare function resolveFireOutcome(jobName: string, fire: FireRecord): ReconciledFireOutcome;
+export {};

package/dist/lib/monitors/state.js

@@ -29,7 +29,7 @@ function getLivenessPath(name) {
     return path.join(getMonitorHistoryDir(name), 'liveness.json');
 }
 /** Directory holding a monitor's fire history. */
-export function getMonitorFiresDir(name) {
+function getMonitorFiresDir(name) {
     return path.join(getMonitorHistoryDir(name), 'fires');
 }
 /** Read a monitor's last-seen state, or null if it has never been observed. */
@@ -45,7 +45,7 @@ export function readState(name) {
     }
 }
 /** Persist a monitor's state atomically (temp file + rename, like writeRunMeta). */
-export function writeStateRaw(state) {
+function writeStateRaw(state) {
     ensureAgentsDir();
     const dir = getMonitorHistoryDir(state.monitorName);
     fs.mkdirSync(dir, { recursive: true });

package/dist/lib/notify.d.ts

@@ -2,7 +2,7 @@
  * Owner notifier — the one seam for "ping the human" messages.
  *
  * Every human-facing owner notification (feed urgent-block dispatch, monitor
- * `notify` action, `agents notify`) funnels through the single channel seam:
+ * `notify` action, `agents send --to owner`) funnels through the single channel seam:
  * `lookupTransport(channel, meta).provider.send(text, opts)`. The recipient comes
  * from `humans.yaml` — never a hardcoded chat id — so changing the
  * owner is honoured by every path at once. `notify.transports` picks the actual

package/dist/lib/notify.js

@@ -115,7 +115,7 @@ export async function sendToOwner(text, options = {}) {
             }
         }
         // Echo the exact per-destination body delivered, so a caller (and
-        // `agents notify --dry-run --json`) can see Slack got the labeled-link
+        // `agents send --to owner --dry-run --json`) can see Slack got the labeled-link
         // variant and iMessage the plain one — the observable proof of PHNX-3698.
         deliveries.push({ ...result, body });
     }

package/dist/lib/onepassword.d.ts

@@ -1,11 +1,7 @@
 /**
  * 1Password CLI (op) integration for importing secrets from vaults.
  */
-export interface OpVault {
-    id: string;
-    name: string;
-}
-export interface OpItemSummary {
+interface OpItemSummary {
     id: string;
     title: string;
     category: string;
@@ -24,7 +20,7 @@ export interface OpField {
 export interface OpItem extends OpItemSummary {
     fields: OpField[];
 }
-export interface ImportableSecret {
+interface ImportableSecret {
     envKey: string;
     itemTitle: string;
     fieldLabel: string;
@@ -36,14 +32,11 @@ export interface ImportableSecret {
      */
     description?: string;
 }
-export interface SkippedField {
+interface SkippedField {
     itemTitle: string;
     fieldLabel: string;
     reason: string;
 }
-export declare function assertOpAvailable(): void;
-export declare function listVaults(): OpVault[];
-export declare function listItems(vaultName: string): OpItemSummary[];
 export declare function getItem(itemId: string, vaultName: string): OpItem;
 export declare function toEnvKey(title: string): string;
 export declare function slugify(name: string): string;
@@ -62,7 +55,7 @@ export declare function extractSecrets(items: OpItemSummary[], vaultName: string
     secrets: ImportableSecret[];
     skipped: SkippedField[];
 };
-export interface PasswordItemTemplate {
+interface PasswordItemTemplate {
     title: string;
     category: 'PASSWORD';
     tags: string[];
@@ -75,6 +68,4 @@ export interface PasswordItemTemplate {
     }>;
 }
 export declare function buildPasswordItemTemplate(title: string, value: string): PasswordItemTemplate;
-export declare function itemExistsByTitle(title: string, vaultName: string): boolean;
-export declare function deleteItemByTitle(title: string, vaultName: string): void;
-export declare function createPasswordItem(title: string, value: string, vaultName: string): void;
+export {};

package/dist/lib/onepassword.js

@@ -2,9 +2,6 @@
  * 1Password CLI (op) integration for importing secrets from vaults.
  */
 import { spawnSync } from 'child_process';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
 function runOp(args, input) {
     const result = spawnSync('op', args, {
         stdio: [input !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
@@ -27,33 +24,6 @@ function runOp(args, input) {
     }
     return { ok: true, stdout: result.stdout };
 }
-export function assertOpAvailable() {
-    // `op account list` works with both CLI session tokens and the 1Password
-    // desktop biometric integration; `op whoami` fails on the latter.
-    const result = runOp(['account', 'list', '--format=json']);
-    if (!result.ok) {
-        throw new Error(result.error);
-    }
-}
-export function listVaults() {
-    const result = runOp(['vault', 'list', '--format=json']);
-    if (!result.ok)
-        throw new Error(result.error);
-    return JSON.parse(result.stdout);
-}
-export function listItems(vaultName) {
-    const result = runOp(['item', 'list', '--vault', vaultName, '--format=json']);
-    if (!result.ok) {
-        if (result.error.includes('vault') && result.error.includes('not found')) {
-            const vaults = listVaults();
-            const available = vaults.map((v) => v.name).join(', ');
-            throw new Error(`Vault '${vaultName}' not found. Available: ${available || '(none)'}`);
-        }
-        throw new Error(result.error);
-    }
-    const items = JSON.parse(result.stdout);
-    return items || [];
-}
 export function getItem(itemId, vaultName) {
     const result = runOp(['item', 'get', itemId, '--vault', vaultName, '--format=json', '--reveal']);
     if (!result.ok)
@@ -180,37 +150,3 @@ export function buildPasswordItemTemplate(title, value) {
         ],
     };
 }
-export function itemExistsByTitle(title, vaultName) {
-    const result = runOp(['item', 'get', title, '--vault', vaultName, '--format=json']);
-    if (result.ok)
-        return true;
-    if (/isn't an item|not found|no item found/i.test(result.error))
-        return false;
-    throw new Error(result.error);
-}
-export function deleteItemByTitle(title, vaultName) {
-    const result = runOp(['item', 'delete', title, '--vault', vaultName]);
-    if (!result.ok)
-        throw new Error(result.error);
-}
-export function createPasswordItem(title, value, vaultName) {
-    // op item create reads stdin templates only from a real pipe; spawnSync's
-    // input plumbing is detected as empty and op silently ignores the template.
-    // The supported alternative is --template <file>, which works reliably.
-    const template = JSON.stringify(buildPasswordItemTemplate(title, value));
-    const tmpFile = path.join(os.tmpdir(), `agents-op-tpl-${process.pid}-${Date.now()}.json`);
-    fs.writeFileSync(tmpFile, template, { mode: 0o600 });
-    try {
-        const result = runOp(['item', 'create', '--template', tmpFile, '--vault', vaultName]);
-        if (!result.ok)
-            throw new Error(result.error);
-    }
-    finally {
-        try {
-            fs.unlinkSync(tmpFile);
-        }
-        catch {
-            // best-effort cleanup
-        }
-    }
-}

package/dist/lib/open-url.d.ts

@@ -1,5 +1,5 @@
 /** Where a "show the human this" call actually landed. */
-export type ShowOutcome = {
+type ShowOutcome = {
     via: 'profile';
     profile: string;
     tabId?: string;
@@ -10,7 +10,7 @@ export type ShowOutcome = {
     via: 'none';
     reason: string;
 };
-export interface ShowOptions {
+interface ShowOptions {
     /**
      * Force the OS default handler, ignoring `browser.viewer`. This is the
      * The programmatic escape hatch, for a caller that must use the user's own
@@ -58,3 +58,4 @@ export declare function showUrl(url: string, opts?: ShowOptions): Promise<ShowOu
  * is the right viewer.
  */
 export declare function showFile(filePath: string, opts?: ShowOptions): Promise<ShowOutcome>;
+export {};

package/dist/lib/openclaw-keychain.d.ts

@@ -1,18 +1,10 @@
 import { type SpawnSyncOptions } from 'child_process';
-export declare const OPENCLAW_KEYCHAIN_ACCOUNT = "openclaw";
-export declare const OPENCLAW_KEYCHAIN_PROVIDER = "agents_keychain";
-export declare const OPENCLAW_KEYCHAIN_ENV_SERVICES: Record<string, string>;
-export interface OpenClawSecretRef {
-    source: 'exec';
-    provider: string;
-    id: string;
-}
-export interface OpenClawKeychainMigrationOptions {
+interface OpenClawKeychainMigrationOptions {
     account?: string;
     provider?: string;
     agentsBin?: string;
 }
-export interface OpenClawKeychainMigrationResult {
+interface OpenClawKeychainMigrationResult {
     services: Array<{
         envKey: string;
         service: string;
@@ -35,17 +27,12 @@ export declare function buildOpenClawKeychainStoreInvocation(service: string, va
         detached: boolean;
     };
 };
-export declare function storeOpenClawKeychainServices(services: Array<{
-    service: string;
-    value: string;
-}>, account?: string): void;
-export declare function readOpenClawKeychainService(service: string, account?: string): string;
-export interface OpenClawExecResolverRequest {
+interface OpenClawExecResolverRequest {
     protocolVersion?: number;
     provider?: string;
     ids?: unknown;
 }
-export interface OpenClawExecResolverResponse {
+interface OpenClawExecResolverResponse {
     protocolVersion: 1;
     values: Record<string, string>;
     errors?: Record<string, {

package/dist/lib/openclaw-keychain.js

@@ -1,4 +1,3 @@
-import { execFileSync, spawnSync } from 'child_process';
 import { getCliLaunch } from './cli-entry.js';
 /**
  * argv for writing a bare (non-`agents-cli.`) keychain item via
@@ -27,9 +26,9 @@ function buildAddGenericPasswordSpawnOptions(value) {
         detached: true,
     };
 }
-export const OPENCLAW_KEYCHAIN_ACCOUNT = 'openclaw';
-export const OPENCLAW_KEYCHAIN_PROVIDER = 'agents_keychain';
-export const OPENCLAW_KEYCHAIN_ENV_SERVICES = {
+const OPENCLAW_KEYCHAIN_ACCOUNT = 'openclaw';
+const OPENCLAW_KEYCHAIN_PROVIDER = 'agents_keychain';
+const OPENCLAW_KEYCHAIN_ENV_SERVICES = {
     OPENROUTER_API_KEY: 'openrouter-api-key',
     LINEAR_API_KEY: 'linear-api-key',
     GRAFANA_API_KEY: 'grafana-api-key',
@@ -213,35 +212,6 @@ export function buildOpenClawKeychainStoreInvocation(service, value, account = O
         options: buildAddGenericPasswordSpawnOptions(value),
     };
 }
-export function storeOpenClawKeychainServices(services, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
-    if (process.platform !== 'darwin') {
-        throw new Error('OpenClaw Keychain migration must run on macOS.');
-    }
-    for (const { service, value } of services) {
-        const write = buildOpenClawKeychainStoreInvocation(service, value, account);
-        const result = spawnSync(write.command, write.args, write.options);
-        if (result.status !== 0) {
-            const msg = result.stderr?.toString().trim();
-            throw new Error(msg || `Failed to write OpenClaw Keychain service '${service}'.`);
-        }
-    }
-}
-function stripSecurityTrailingNewline(value) {
-    return value.replace(/\r?\n$/, '');
-}
-export function readOpenClawKeychainService(service, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$/.test(service)) {
-        throw new Error(`Invalid OpenClaw Keychain service id '${service}'.`);
-    }
-    if (process.platform !== 'darwin') {
-        throw new Error('OpenClaw Keychain resolver must run on macOS.');
-    }
-    const value = execFileSync('/usr/bin/security', ['find-generic-password', '-s', service, '-a', account, '-w'], {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    return stripSecurityTrailingNewline(value);
-}
 export function resolveOpenClawKeychainRequest(request, lookup) {
     const ids = Array.isArray(request.ids) ? request.ids.filter((id) => typeof id === 'string') : [];
     const values = {};