@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/profiles.js

@@ -12,14 +12,13 @@ import * as yaml from 'yaml';
 import { ALL_AGENT_IDS } from './agents.js';
 import { getUserAgentsDir } from './state.js';
 import { deleteKeychainTokenSync, getKeychainTokenSync, hasKeychainTokenSync, isSecretsClientError, isSecretsTransportError, profileKeychainItem, } from './secrets-client.js';
-import { getPreset } from './profiles-presets.js';
 import { MODEL_TIERS, isTierToken } from './model-tiers.js';
 import { addAccount, findAccount, resolveCredentialAccount } from './account-registry.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { listAccountProviders } from './account-provider-registry.js';
 const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]{0,48}$/i;
 /** Get the directory where profile YAML files are stored. */
-export function getProfilesDir() {
+function getProfilesDir() {
     return path.join(getUserAgentsDir(), 'profiles');
 }
 function profilePath(name) {
@@ -640,10 +639,3 @@ export function resolveProfileForRun(name, requestedModel) {
     }
     return resolved;
 }
-/**
- * Look up the preset a profile was created from, if any. Used by
- * `profiles view` to show upstream metadata like signup URLs.
- */
-export function getPresetForProfile(profile) {
-    return profile.preset ? getPreset(profile.preset) : undefined;
-}

package/dist/lib/project-doctor.d.ts

@@ -17,7 +17,7 @@
  */
 import type { ProjectDef } from './projects.js';
 /** A definition that disagrees with the machine it describes. */
-export interface ProjectFinding {
+interface ProjectFinding {
     project: string;
     /** One line naming the disagreement, both sides quoted. */
     message: string;
@@ -34,3 +34,4 @@ export interface ProjectFinding {
  * - they disagree → a finding. This is the case that silently lies.
  */
 export declare function checkRepoSlug(def: ProjectDef, actualRemote: string | undefined): ProjectFinding | undefined;
+export {};

package/dist/lib/project-launch.d.ts

@@ -36,12 +36,12 @@
  */
 import type { AgentId } from './types.js';
 import { pluginInstallDir } from './plugins/plugin-marketplace.js';
-export interface LaunchSyncOptions {
+interface LaunchSyncOptions {
     agent: AgentId;
     version: string;
     cwd: string;
 }
-export interface LaunchSyncResult {
+interface LaunchSyncResult {
     /** Project rules were re-compiled into cwd/AGENTS.md (+ per-agent symlinks). */
     rulesCompiled: boolean;
     /** Number of workspace resource symlinks created or refreshed. */

package/dist/lib/project-probe.d.ts

@@ -13,7 +13,7 @@
  */
 import { type ProjectDef } from './projects.js';
 /** The on-disk state of one workspace repo on one machine. */
-export interface RepoWorkspaceStatus {
+interface RepoWorkspaceStatus {
     /** The probed path, echoed home-relative (re-roots per machine). */
     path: string;
     /** `.git` exists (a directory, or a FILE for a linked worktree). */
@@ -87,8 +87,8 @@ export declare function formatFleetWorkspaces(statuses: HostWorkspaceStatus[]):
  */
 export declare function formatFleetSummary(statuses: HostWorkspaceStatus[]): string;
 /** Severity for a workspace/repo warning on the project card. */
-export type WorkspaceWarningSeverity = 'critical' | 'continue';
-export interface WorkspaceWarning {
+type WorkspaceWarningSeverity = 'critical' | 'continue';
+interface WorkspaceWarning {
     severity: WorkspaceWarningSeverity;
     text: string;
     remediation?: string;
@@ -113,3 +113,4 @@ export interface WorkspaceWarning {
  * Caller decides whether the rows came from `--fleet` or a local probe.
  */
 export declare function workspaceWarnings(statuses: HostWorkspaceStatus[]): WorkspaceWarning[];
+export {};

package/dist/lib/project-pull.d.ts

@@ -37,7 +37,7 @@ export interface ProjectPullResult {
     message?: string;
 }
 /** The wire format this machine emits for the fleet fan-out. Fail-closed on parse. */
-export interface ProjectPullEnvelope {
+interface ProjectPullEnvelope {
     schemaVersion: 1;
     kind: 'project-pull';
     /** The emitting machine's {@link machineId} — verified by the caller. */
@@ -126,3 +126,4 @@ export declare function projectPullComplete(results: ProjectPullResult[]): boole
  * one the caller turns into a non-zero exit.
  */
 export declare function printProjectPullSummary(projectName: string, results: ProjectPullResult[], unavailableDevices: string[], unverifiedDevices?: string[]): void;
+export {};

package/dist/lib/project-resources.d.ts

@@ -1,9 +1,8 @@
 import type { AgentId } from './types.js';
-export interface ProjectResourceSyncResult {
+interface ProjectResourceSyncResult {
     synced: string[];
     skipped: string[];
 }
-export declare function projectAgentRoot(projectRoot: string, agent: AgentId): string;
 export declare function syncProjectResourcesToAgent(agent: AgentId, version: string, projectAgentsDir: string): ProjectResourceSyncResult;
 /**
  * Turn the manifest's managed paths (relative to agentRoot) into anchored,
@@ -52,3 +51,4 @@ export declare function detrackViaGitExclude(repoDir: string, relPath: string):
  * internal "user-owned". Returns null when nothing was skipped.
  */
 export declare function formatKeptProjectResources(skipped: string[]): string | null;
+export {};

package/dist/lib/project-resources.js

@@ -13,7 +13,7 @@ import { syncWorkflowToVersion } from './workflows-registry.js';
 const MANIFEST_FILE = '.agents-managed.json';
 const MANIFEST_VERSION = 1;
 const COPY_IGNORE = new Set(['.DS_Store', '.git', '.gitignore', '.venv', '__pycache__', 'node_modules']);
-export function projectAgentRoot(projectRoot, agent) {
+function projectAgentRoot(projectRoot, agent) {
     return path.join(projectRoot, agentConfigDirName(agent));
 }
 export function syncProjectResourcesToAgent(agent, version, projectAgentsDir) {

package/dist/lib/project-root.d.ts

@@ -81,12 +81,7 @@ export declare function setProjectRoot(rootPath: string): string;
  * home-relative string when under `$HOME`; undefined when `cwd` is not in a repo.
  */
 export declare function inferProjectRoot(cwd: string): Promise<string | undefined>;
-/**
- * Resolve the projects root, auto-inferring and caching on first use. Throws an
- * actionable error when it is neither configured nor inferrable from `cwd`.
- */
-export declare function ensureProjectRoot(cwd: string): Promise<string>;
-export interface ProjectRef {
+interface ProjectRef {
     slug: string;
     worktree?: string;
 }
@@ -126,3 +121,4 @@ export declare function resolveProjectDirs(ref: string, opts: {
     cwd: string;
     extraDirs: string[];
 }>;
+export {};

package/dist/lib/project-root.js

@@ -149,7 +149,7 @@ export async function inferProjectRoot(cwd) {
  * Resolve the projects root, auto-inferring and caching on first use. Throws an
  * actionable error when it is neither configured nor inferrable from `cwd`.
  */
-export async function ensureProjectRoot(cwd) {
+async function ensureProjectRoot(cwd) {
     const existing = getProjectRoot();
     if (existing)
         return existing;

package/dist/lib/project-schedule.d.ts

@@ -32,7 +32,7 @@ import type { LinearMilestone } from './linear-project-counts.js';
 /** How far ahead counts as "due soon" — one sprint's notice. */
 export declare const DUE_SOON_DAYS = 14;
 /** A verdict about the schedule, as a tagged union so `--json` stays stable. */
-export type ProjectVerdict = {
+type ProjectVerdict = {
     kind: 'declared';
     health: string;
 } | {
@@ -73,3 +73,4 @@ export declare function formatVerdict(v: ProjectVerdict): {
     text: string;
     warn: boolean;
 } | undefined;
+export {};

package/dist/lib/project-status.d.ts

@@ -69,7 +69,7 @@ export declare function rollupSessionsByProject(defs: ProjectDef[], sessions: Ac
  */
 export declare function isDeadStatus(status: string): boolean;
 /** Live vs finished sessions on a project. */
-export interface LiveDeadSplit {
+interface LiveDeadSplit {
     live: number;
     dead: number;
     /** Dead broken out by status, for the card's parenthetical. */
@@ -100,19 +100,6 @@ export declare function formatDeadSummary(split: LiveDeadSplit): string;
 export declare function sortProjectMembers(members: ProjectMember[]): ProjectMember[];
 /** Cap for the members line before it collapses to `+N more`. */
 export declare const MEMBERS_LINE_LIMIT = 6;
-/** Cap for host groups on the multi-line agents roster. */
-export declare const MEMBERS_HOST_LIMIT = 8;
-/**
- * Collapse members into distinct state cells (`agent · status · ticket[@host]`),
- * counting duplicates as `×N`. Pure.
- */
-export declare function collapseMemberCells(members: ProjectMember[], opts?: {
-    includeHostOnCell?: boolean;
-}): Array<{
-    cell: string;
-    n: number;
-    members: number;
-}>;
 /**
  * The `agents` line under `live`: one cell per DISTINCT member state —
  * `claude · running · RUSH-2107 @zion` — with identical cells collapsed to a
@@ -151,8 +138,6 @@ export interface ProjectWarning {
  * nudge (dirty tree, schedule not measurable).
  */
 export declare function warningEmoji(severity: ProjectWarningSeverity): string;
-/** Stable sort: critical first, then continue; stable within a tier. */
-export declare function sortProjectWarnings(warnings: ProjectWarning[]): ProjectWarning[];
 /**
  * Format one or more warning lines for the card footer. Pure (chalk only).
  * Returns empty when there is nothing to say.
@@ -190,3 +175,4 @@ export declare function enrichProjectSignals(def: ProjectDef, windowDays: number
     activityRoot?: string;
     skipRemote?: boolean;
 }): Promise<ProjectRemoteSignals>;
+export {};

package/dist/lib/project-status.js

@@ -171,12 +171,12 @@ export function sortProjectMembers(members) {
 /** Cap for the members line before it collapses to `+N more`. */
 export const MEMBERS_LINE_LIMIT = 6;
 /** Cap for host groups on the multi-line agents roster. */
-export const MEMBERS_HOST_LIMIT = 8;
+const MEMBERS_HOST_LIMIT = 8;
 /**
  * Collapse members into distinct state cells (`agent · status · ticket[@host]`),
  * counting duplicates as `×N`. Pure.
  */
-export function collapseMemberCells(members, opts = {}) {
+function collapseMemberCells(members, opts = {}) {
     const includeHost = opts.includeHostOnCell !== false;
     const counts = new Map();
     for (const m of sortProjectMembers(members)) {
@@ -282,7 +282,7 @@ export function warningEmoji(severity) {
     return severity === 'critical' ? '🔴' : '⚠️';
 }
 /** Stable sort: critical first, then continue; stable within a tier. */
-export function sortProjectWarnings(warnings) {
+function sortProjectWarnings(warnings) {
     const rank = { critical: 0, continue: 1 };
     return [...warnings].sort((a, b) => rank[a.severity] - rank[b.severity] || a.text.localeCompare(b.text));
 }

package/dist/lib/pwsh.d.ts

@@ -9,3 +9,36 @@
  * spawns powershell.exe with an argv array).
  */
 export declare function encodePwshBase64(script: string): string;
+/** Single-quote a value for PowerShell's own parser (embedded `'` doubled). */
+export declare function pwshLiteral(value: string): string;
+/**
+ * PowerShell statements that run a NATIVE program with exact argv.
+ *
+ * Windows has no argv array: a process receives ONE string and splits it itself.
+ * PowerShell 5.1 rebuilds that string when it invokes a native program, and its
+ * serializer is lossy — measured on a real peer, an EMPTY argument is dropped and
+ * an embedded `"` is discarded. So the arguments are pre-escaped by the caller to
+ * the `CommandLineToArgvW` rules (`quoteWin32ExecArg`) and handed to .NET as one
+ * `Arguments` string, which `CreateProcess` receives essentially verbatim. No shell
+ * is involved, so no `%VAR%` expansion and no newline sensitivity.
+ *
+ * `UseShellExecute = $false` with no redirection leaves the child on the inherited
+ * handles, which is what lets a binary stdout stream through unchanged.
+ *
+ * `WorkingDirectory` is set explicitly from `(Get-Location).ProviderPath`, and that
+ * is not belt-and-braces: PowerShell's `Set-Location` moves the SHELL's location
+ * without updating the .NET process's OS working directory, so a child launched
+ * through `ProcessStartInfo` would otherwise start in whatever directory the
+ * process began in — silently ignoring a caller's `cwd` (`--remote-cwd`). The
+ * `ProviderPath` form is what yields a real filesystem path rather than a
+ * PowerShell provider path.
+ *
+ * @param fileNameExpr a PowerShell EXPRESSION for the executable (a quoted literal,
+ *   or something like `$__c.Source`) — not a raw path, so a caller that resolved the
+ *   target on the peer can pass its variable.
+ * @param argumentsExpr a PowerShell EXPRESSION producing the argument string —
+ *   `pwshLiteral(line)` for a static one, or a concatenation when part of it is
+ *   only known on the peer (a resolved interpreter entry, say).
+ * @param exitVar variable name for the child, so a caller can chain on it.
+ */
+export declare function pwshNativeExecStatements(fileNameExpr: string, argumentsExpr: string, exitVar?: string): string[];

package/dist/lib/pwsh.js

@@ -11,3 +11,59 @@
 export function encodePwshBase64(script) {
     return Buffer.from(script, 'utf16le').toString('base64');
 }
+/** Single-quote a value for PowerShell's own parser (embedded `'` doubled). */
+export function pwshLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/**
+ * PowerShell statements that run a NATIVE program with exact argv.
+ *
+ * Windows has no argv array: a process receives ONE string and splits it itself.
+ * PowerShell 5.1 rebuilds that string when it invokes a native program, and its
+ * serializer is lossy — measured on a real peer, an EMPTY argument is dropped and
+ * an embedded `"` is discarded. So the arguments are pre-escaped by the caller to
+ * the `CommandLineToArgvW` rules (`quoteWin32ExecArg`) and handed to .NET as one
+ * `Arguments` string, which `CreateProcess` receives essentially verbatim. No shell
+ * is involved, so no `%VAR%` expansion and no newline sensitivity.
+ *
+ * `UseShellExecute = $false` with no redirection leaves the child on the inherited
+ * handles, which is what lets a binary stdout stream through unchanged.
+ *
+ * `WorkingDirectory` is set explicitly from `(Get-Location).ProviderPath`, and that
+ * is not belt-and-braces: PowerShell's `Set-Location` moves the SHELL's location
+ * without updating the .NET process's OS working directory, so a child launched
+ * through `ProcessStartInfo` would otherwise start in whatever directory the
+ * process began in — silently ignoring a caller's `cwd` (`--remote-cwd`). The
+ * `ProviderPath` form is what yields a real filesystem path rather than a
+ * PowerShell provider path.
+ *
+ * @param fileNameExpr a PowerShell EXPRESSION for the executable (a quoted literal,
+ *   or something like `$__c.Source`) — not a raw path, so a caller that resolved the
+ *   target on the peer can pass its variable.
+ * @param argumentsExpr a PowerShell EXPRESSION producing the argument string —
+ *   `pwshLiteral(line)` for a static one, or a concatenation when part of it is
+ *   only known on the peer (a resolved interpreter entry, say).
+ * @param exitVar variable name for the child, so a caller can chain on it.
+ */
+export function pwshNativeExecStatements(fileNameExpr, argumentsExpr, exitVar = '$zp') {
+    // Deliberately terse. The whole script is base64'd into ONE ssh command line,
+    // and OpenSSH-for-Windows caps that far below cmd.exe's 8191 — measured on a
+    // real peer, it fails between ~2.8k and ~4.1k characters. UTF-16LE + base64
+    // inflates by ~2.7x, so every character here costs almost three on the wire.
+    // `System.` is implicit for these types, and `-EA` is the canonical alias.
+    return [
+        `$zi=New-Object Diagnostics.ProcessStartInfo`,
+        `$zi.FileName=${fileNameExpr}`,
+        `$zi.Arguments=${argumentsExpr}`,
+        `$zi.UseShellExecute=$false`,
+        `$zi.WorkingDirectory=(Get-Location).ProviderPath`,
+        // The CALLER sets `$ErrorActionPreference='Stop'` for the whole script, so it
+        // is not repeated here — every character costs ~2.7 on the wire after base64.
+        // The null guard below is what makes a swallowed Start failure impossible to
+        // mistake for success: without it the handle is $null, the code is $null, and
+        // `exit $null` reports 0.
+        `${exitVar}=[Diagnostics.Process]::Start($zi)`,
+        `if($null -eq ${exitVar}){throw "start failed: $($zi.FileName)"}`,
+        `${exitVar}.WaitForExit()`,
+    ];
+}

package/dist/lib/reconcile-and-repair.d.ts

@@ -21,7 +21,7 @@ import { type HealResult } from './heal.js';
 import { type SlotProjection } from './accounts/slots.js';
 import { type HookRuntimeRepairReport } from './hooks/install.js';
 import { type RemediateStaleInstallsResult, type FindAgentsCliInstallsOptions } from './self-update.js';
-export interface HookRewireResult {
+interface HookRewireResult {
     agent: AgentId;
     version: string;
     /** Hooks newly wired into settings.json by this pass. */
@@ -31,7 +31,7 @@ export interface HookRewireResult {
     /** Stable failure class; never expose a generated temporary shim pathname. */
     failure?: 'register-failed';
 }
-export interface RepairAfterSyncReport {
+interface RepairAfterSyncReport {
     heal: HealResult;
     hookRewire: HookRewireResult[];
     hookRuntimeRepair: HookRuntimeRepairReport;
@@ -51,14 +51,14 @@ export interface RepairAfterSyncReport {
  * hard-codes `/usr/local/lib/node_modules` et al. when `globalNodeModulesDirs` is
  * absent, so a purge is unsafe to run unscoped in a test — inject sandbox paths.
  */
-export interface PurgeInjection {
+interface PurgeInjection {
     runningRoot?: string;
     runningVersion?: string;
     pathEnv?: string;
     findOpts?: FindAgentsCliInstallsOptions;
     dryRun?: boolean;
 }
-export interface RepairAfterSyncOptions {
+interface RepairAfterSyncOptions {
     /** Scope the repair to one agent; omit for the umbrella sweep across all
      *  installed agents. (The purge is NOT tied to this — see `pruneClis`.) */
     agent?: AgentId;
@@ -115,3 +115,4 @@ export declare function repairAfterSyncJson(report: RepairAfterSyncReport): Reco
  * changed, so a clean sync stays quiet.
  */
 export declare function renderRepairAfterSync(report: RepairAfterSyncReport, log?: (s: string) => void): void;
+export {};

package/dist/lib/redact.d.ts

@@ -1,7 +1,13 @@
 /**
  * Shared redaction helpers for text that may be exported or logged.
  */
-/** Remove terminal control sequences from untrusted text before storage or display. */
+/**
+ * Remove terminal control sequences from untrusted text before storage or display.
+ *
+ * A single forward scan, not a regex: an OSC lookup for its terminator (BEL or
+ * ESC-\) is the classic polynomial-backtracking shape, and untrusted text can be
+ * built to trigger it. Each character is visited a bounded number of times here.
+ */
 export declare function sanitizeForTerminal(text: string): string;
 /**
  * Scrub secrets from `text`. Two passes: format-based patterns (above), then a
@@ -17,3 +23,11 @@ export declare function redactSecrets(text: string, knownValues?: readonly strin
  * credential verbatim even when its format matches no pattern.
  */
 export declare function knownSecretValuesFromEnv(env?: NodeJS.ProcessEnv): string[];
+/**
+ * Mask email addresses in already-rendered text. A published page's sensitive-
+ * content scan refuses a body containing an email (`artifacts share` does the
+ * same), and almost every real transcript carries a few — git author addresses,
+ * `gh api user`, a pasted log. Masking them here means the page genuinely does
+ * not carry them, rather than training callers to pass `--force`.
+ */
+export declare function redactEmails(text: string): string;

package/dist/lib/redact.js

@@ -47,12 +47,103 @@ const SECRET_PATTERNS = [
     [/(https?:\/\/)[^/\s:@]+:[^@\s/]+@/gi, '$1[REDACTED]@'],
     [/\b([A-Z0-9_]*(?:TOKEN|KEY|SECRET|PASSWORD)[A-Z0-9_]*)=("[^"]*"|'[^']*'|\S+)/gi, '$1=[REDACTED]'],
 ];
-const TERMINAL_ESCAPE_REGEX = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x9d[^\x07\x9c]*(?:\x07|\x9c)|\x1b\[[0-?]*[ -/]*[@-~]|\x9b[0-?]*[ -/]*[@-~]|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g;
-/** Remove terminal control sequences from untrusted text before storage or display. */
+const ESC = 0x1b;
+const BEL = 0x07;
+const CSI_8BIT = 0x9b;
+const OSC_8BIT = 0x9d;
+const ST_8BIT = 0x9c;
+/** C0 controls (minus \t \n \r), DEL, and the C1 range. */
+function isControlByte(c) {
+    return (c <= 0x08) || c === 0x0b || c === 0x0c || (c >= 0x0e && c <= 0x1f) || (c >= 0x7f && c <= 0x9f);
+}
+/** End (exclusive) of a CSI parameter/intermediate/final run starting at `i`, or `i` when unterminated. */
+function csiEnd(text, i) {
+    let j = i;
+    while (j < text.length && text.charCodeAt(j) >= 0x30 && text.charCodeAt(j) <= 0x3f)
+        j++;
+    while (j < text.length && text.charCodeAt(j) >= 0x20 && text.charCodeAt(j) <= 0x2f)
+        j++;
+    if (j < text.length && text.charCodeAt(j) >= 0x40 && text.charCodeAt(j) <= 0x7e)
+        return j + 1;
+    return i;
+}
+/**
+ * Remove terminal control sequences from untrusted text before storage or display.
+ *
+ * A single forward scan, not a regex: an OSC lookup for its terminator (BEL or
+ * ESC-\) is the classic polynomial-backtracking shape, and untrusted text can be
+ * built to trigger it. Each character is visited a bounded number of times here.
+ */
 export function sanitizeForTerminal(text) {
     if (!text)
         return text;
-    return text.replace(TERMINAL_ESCAPE_REGEX, '');
+    let out = '';
+    let i = 0;
+    const n = text.length;
+    // Once an 8-bit OSC scan reaches the end without a terminator, no later one can find one either.
+    let noOsc8Terminator = false;
+    while (i < n) {
+        const c = text.charCodeAt(i);
+        if (c === ESC && i + 1 < n) {
+            const next = text.charCodeAt(i + 1);
+            if (next === 0x5d) {
+                // OSC: runs to BEL or ESC-\. Any other ESC aborts the sequence, so the
+                // scan never re-covers ground a later OSC start could claim.
+                let j = i + 2;
+                while (j < n && text.charCodeAt(j) !== BEL && text.charCodeAt(j) !== ESC)
+                    j++;
+                if (j < n && text.charCodeAt(j) === BEL) {
+                    i = j + 1;
+                    continue;
+                }
+                if (j + 1 < n && text.charCodeAt(j) === ESC && text.charCodeAt(j + 1) === 0x5c) {
+                    i = j + 2;
+                    continue;
+                }
+                i += 2;
+                continue;
+            }
+            if (next === 0x5b) {
+                const end = csiEnd(text, i + 2);
+                if (end > i + 2) {
+                    i = end;
+                    continue;
+                }
+                i += 2;
+                continue;
+            }
+            if (next >= 0x40 && next <= 0x5f) {
+                i += 2;
+                continue;
+            }
+            i += 1;
+            continue;
+        }
+        if (c === OSC_8BIT && !noOsc8Terminator) {
+            let j = i + 1;
+            while (j < n && text.charCodeAt(j) !== BEL && text.charCodeAt(j) !== ST_8BIT)
+                j++;
+            if (j < n) {
+                i = j + 1;
+                continue;
+            }
+            noOsc8Terminator = true;
+            i += 1;
+            continue;
+        }
+        if (c === CSI_8BIT) {
+            const end = csiEnd(text, i + 1);
+            i = end > i + 1 ? end : i + 1;
+            continue;
+        }
+        if (isControlByte(c)) {
+            i += 1;
+            continue;
+        }
+        out += text[i];
+        i += 1;
+    }
+    return out;
 }
 /** Env vars whose NAME marks their VALUE as a credential worth masking literally. */
 const SECRET_ENV_NAME = /(?:TOKEN|KEY|SECRET|PASSWORD)/i;
@@ -94,3 +185,14 @@ export function knownSecretValuesFromEnv(env = process.env) {
     }
     return out;
 }
+const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+/**
+ * Mask email addresses in already-rendered text. A published page's sensitive-
+ * content scan refuses a body containing an email (`artifacts share` does the
+ * same), and almost every real transcript carries a few — git author addresses,
+ * `gh api user`, a pasted log. Masking them here means the page genuinely does
+ * not carry them, rather than training callers to pass `--force`.
+ */
+export function redactEmails(text) {
+    return text.replace(EMAIL_RE, '[EMAIL]');
+}

package/dist/lib/refresh-coordinator.d.ts

@@ -1,5 +1,5 @@
 export declare function setRefreshLockRootForTest(root: string | null): string | null;
-export interface RefreshLeaseOptions<T> {
+interface RefreshLeaseOptions<T> {
     scope: string;
     key: string;
     /**
@@ -22,3 +22,4 @@ export interface RefreshLeaseOptions<T> {
  * async provider request is in flight.
  */
 export declare function withRefreshLease<T>(options: RefreshLeaseOptions<T>): Promise<T>;
+export {};

package/dist/lib/refresh.d.ts

@@ -6,11 +6,11 @@
  * The reconcile stage behind `agents sync` (the umbrella `--local` path calls
  * this; see sync-umbrella.ts) and any other caller that needs to re-derive local
  * state from declared configuration. Does NOT do any git operations — that lives
- * in `agents repo pull`. (Also still reachable via the deprecated, hidden
- * `agents repo refresh` alias.)
+ * in `agents repo pull`.
  */
 import type { AgentId } from './types.js';
-export interface RefreshOptions {
+import { type ResourceSelection } from './installations/versions.js';
+interface RefreshOptions {
     /** Limit operations to a single agent (claude/codex/etc). Default: all installed. */
     agentFilter?: AgentId;
     /** Auto-sync everything and skip interactive prompts. */
@@ -22,6 +22,10 @@ export interface RefreshOptions {
      * (`agents sync --json` / fleet fan-out) so stdout stays a single JSON object.
      */
     quiet?: boolean;
+    /** Limit reconciliation to the requested resource kinds/names. */
+    selection?: ResourceSelection;
+    /** Explicit consent for selected plugins that add executable surfaces. */
+    allowExecSurfaces?: boolean;
 }
 /**
  * Re-materialize local state from declared configuration: install CLI versions,
@@ -37,7 +41,7 @@ export interface RefreshOptions {
  * visible only on the interactive path — `agents sync --yes` and the
  * `--device all` fan-out reported a clean sync (RUSH-2700).
  */
-export interface RefreshResult {
+interface RefreshResult {
     /** User-facing sentences, one per refused resource, prefixed with the agent. */
     declined: string[];
     /**
@@ -51,3 +55,4 @@ export interface RefreshResult {
     }>;
 }
 export declare function refresh(options?: RefreshOptions): Promise<RefreshResult>;
+export {};