@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/secrets-client.d.ts

@@ -29,10 +29,6 @@ export interface SecretsContext {
     /** Opaque scope the standalone folds into resolution — the harness name. */
     scope?: string;
 }
-/** Serialize `Map`s the way the server's `decodeWire` expects to receive them. */
-export declare function encodeWire(value: unknown): unknown;
-/** Reconstruct `Map`s from the server's `encodeWire`'d reply. */
-export declare function decodeWire(value: unknown): unknown;
 /** Carries the server's `{code, message}`, or a client-side transport code. */
 export declare class SecretsClientError extends Error {
     readonly code: string;
@@ -54,7 +50,6 @@ export declare function isSecretsClientError(error: unknown, code?: string): err
 /** True when `error` is a {@link SecretsClientError} from the transport itself (the
  * standalone was unreachable/unusable), not a data error it answered with. */
 export declare function isSecretsTransportError(error: unknown): error is SecretsClientError;
-export declare const SECRETS_ITEM_PREFIX = "agents-cli.secrets.";
 /** The raw item holding one bundle key's value. */
 export declare function secretsKeychainItem(bundle: string, key: string): string;
 /** The raw item holding a profile provider's token (`agents-cli.<provider>.token`). */
@@ -157,7 +152,6 @@ export declare function bundleBackendSync(name: string, context?: SecretsContext
 export declare function writeBundle(bundle: SecretsBundle, opts?: WriteBundleOptions, context?: SecretsContext): Promise<void>;
 export declare function writeBundleWithItems(bundle: SecretsBundle, items: Map<string, string>, opts?: WriteBundleOptions, context?: SecretsContext): Promise<void>;
 export declare function writeBundleWithItemsSync(bundle: SecretsBundle, items: Map<string, string>, opts?: WriteBundleOptions, context?: SecretsContext): void;
-export declare function deleteBundle(name: string, context?: SecretsContext): Promise<boolean>;
 export declare function deleteBundleSync(name: string, context?: SecretsContext): boolean;
 /** Rename a bundle: metadata and raw items move together; the source is deleted last. */
 export declare function renameBundle(oldName: string, newName: string, opts?: RenameOptions, context?: SecretsContext): Promise<void>;
@@ -169,13 +163,7 @@ export declare function agentPing(): Promise<{
     reachable: boolean;
     cliVersion?: string;
 }>;
-export declare function agentPingSync(): {
-    reachable: boolean;
-    cliVersion?: string;
-};
 export declare function agentStatus(): Promise<AgentStatusEntry[]>;
-export declare function agentLock(name?: string): Promise<number>;
-export declare function ensureAgentRunning(timeoutMs?: number): Promise<boolean>;
 export declare function getKeychainToken(item: string, context?: KeychainReadContext): Promise<string>;
 export declare function getKeychainTokenSync(item: string, context?: KeychainReadContext): string;
 export declare function setKeychainToken(item: string, value: string, opts?: {
@@ -195,13 +183,10 @@ export declare function listKeychainItems(prefix: string): Promise<string[]>;
  * on such a host no test or probe can reach a real OS keychain.
  */
 export declare function keychainUsesFileFallback(): Promise<boolean>;
-export declare function storeGet(backend: SecretsBackend, item: string): Promise<string>;
 export declare function storeGetSync(backend: SecretsBackend, item: string): string;
-export declare function storeHas(backend: SecretsBackend, item: string): Promise<boolean>;
 export declare function storeHasSync(backend: SecretsBackend, item: string): boolean;
 export declare function storeSet(backend: SecretsBackend, item: string, value: string): Promise<void>;
 export declare function storeSetSync(backend: SecretsBackend, item: string, value: string): void;
-export declare function storeDelete(backend: SecretsBackend, item: string): Promise<boolean>;
 export declare function remoteResolveEnv(target: string, bundle: string, opts?: {
     osLookupName?: string;
 }): Promise<Record<string, string>>;
@@ -226,7 +211,5 @@ export declare function scanUserRcFiles(homeDir?: string, context?: SecretsConte
 export declare function scanUserRcFilesSync(homeDir?: string, context?: SecretsContext): RcSecretFinding[];
 export declare function masterPassphraseInEnv(context?: SecretsContext): Promise<boolean>;
 export declare function masterPassphraseInEnvSync(context?: SecretsContext): boolean;
-/** True for a dynamic-loader or language-interpreter override env var. */
-export declare function isLoaderOrInterpreterEnv(name: string): boolean;
 /** Strip loader/interpreter overrides from an env before it reaches a spawned child. */
 export declare function sanitizeProcessEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/lib/secrets-client.js

@@ -49,6 +49,7 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import { findInPath } from './agent-spec/agents.js';
+import { SECRETS_CLI_INSTALL_HINT } from './secrets-cli.js';
 import { getUserAgentsDir } from './state.js';
 /**
  * Wire contract, mirrored from `secrets-cli/src/protocol.ts`. Both sides MUST
@@ -80,7 +81,7 @@ export const SYNC_SERVE_TIMEOUT_MS = 30_000;
 /** Test seam: a hang test plants a never-answering standalone and must not wait 30s. */
 let syncServeTimeoutMs = SYNC_SERVE_TIMEOUT_MS;
 /** Serialize `Map`s the way the server's `decodeWire` expects to receive them. */
-export function encodeWire(value) {
+function encodeWire(value) {
     if (value instanceof Map) {
         return { $map: [...value.entries()].map(([key, item]) => [key, encodeWire(item)]) };
     }
@@ -92,7 +93,7 @@ export function encodeWire(value) {
     return value === undefined ? null : value;
 }
 /** Reconstruct `Map`s from the server's `encodeWire`'d reply. */
-export function decodeWire(value) {
+function decodeWire(value) {
     if (Array.isArray(value))
         return value.map(decodeWire);
     if (value !== null && typeof value === 'object') {
@@ -163,7 +164,7 @@ export function isSecretsTransportError(error) {
 // bundle), so they are declared once here beside the protocol schema rather
 // than re-derived per consumer.
 const SERVICE_PREFIX = 'agents-cli';
-export const SECRETS_ITEM_PREFIX = `${SERVICE_PREFIX}.secrets.`;
+const SECRETS_ITEM_PREFIX = `${SERVICE_PREFIX}.secrets.`;
 /** The raw item holding one bundle key's value. */
 export function secretsKeychainItem(bundle, key) {
     return `${SECRETS_ITEM_PREFIX}${bundle}.${key}`;
@@ -216,8 +217,8 @@ export function resolveSecretsBin() {
     const resolved = explicit && explicit.length > 0 ? explicit : findInPath('secrets');
     if (!resolved) {
         throw new SecretsClientError('SECRETS_BIN_MISSING', 'The standalone `secrets` CLI was not found. Install it with:\n' +
-            '  npm i -g @phnx-labs/secrets-cli\n' +
-            'or point $SECRETS_BIN at its executable.');
+            `  ${SECRETS_CLI_INSTALL_HINT}\n` +
+            'or run `agents setup secrets`.');
     }
     cachedBin = resolved;
     return resolved;
@@ -548,9 +549,6 @@ export function writeBundleWithItems(bundle, items, opts, context) {
 export function writeBundleWithItemsSync(bundle, items, opts, context) {
     secretsRequestSync('bundles.writeBundleWithItems', [bundle, items, opts ?? {}], context);
 }
-export function deleteBundle(name, context) {
-    return secretsRequest('bundles.deleteBundle', [name], context);
-}
 export function deleteBundleSync(name, context) {
     return secretsRequestSync('bundles.deleteBundle', [name], context);
 }
@@ -572,18 +570,9 @@ export function rotateBundleSecretSync(bundle, key, opts, context) {
 export function agentPing() {
     return secretsRequest('agent.agentPing', []);
 }
-export function agentPingSync() {
-    return secretsRequestSync('agent.agentPing', []);
-}
 export function agentStatus() {
     return secretsRequest('agent.agentStatus', []);
 }
-export function agentLock(name) {
-    return secretsRequest('agent.agentLock', name === undefined ? [] : [name]);
-}
-export function ensureAgentRunning(timeoutMs) {
-    return secretsRequest('agent.ensureAgentRunning', timeoutMs === undefined ? [] : [timeoutMs]);
-}
 // index.* (keychain items)
 export function getKeychainToken(item, context) {
     return secretsRequest('index.getKeychainToken', [item, context ?? {}]);
@@ -620,16 +609,9 @@ export function listKeychainItems(prefix) {
 export function keychainUsesFileFallback() {
     return secretsRequest('index.keychainUsesFileFallback', []);
 }
-// store.* (explicit-backend raw item CRUD)
-export function storeGet(backend, item) {
-    return secretsRequest('store.get', [backend, item]);
-}
 export function storeGetSync(backend, item) {
     return secretsRequestSync('store.get', [backend, item]);
 }
-export function storeHas(backend, item) {
-    return secretsRequest('store.has', [backend, item]);
-}
 export function storeHasSync(backend, item) {
     return secretsRequestSync('store.has', [backend, item]);
 }
@@ -639,9 +621,6 @@ export function storeSet(backend, item, value) {
 export function storeSetSync(backend, item, value) {
     secretsRequestSync('store.set', [backend, item, value]);
 }
-export function storeDelete(backend, item) {
-    return secretsRequest('store.delete', [backend, item]);
-}
 // remote.* / push.*
 export function remoteResolveEnv(target, bundle, opts) {
     return secretsRequest('remote.remoteResolveEnv', [target, bundle, opts ?? {}]);
@@ -694,7 +673,7 @@ export function masterPassphraseInEnvSync(context) {
 // (or an inherited shell) can never smuggle a loader/interpreter override into
 // an agent's process.
 /** True for a dynamic-loader or language-interpreter override env var. */
-export function isLoaderOrInterpreterEnv(name) {
+function isLoaderOrInterpreterEnv(name) {
     const upper = name.toUpperCase();
     return (upper.startsWith('LD_') ||
         upper.startsWith('DYLD_') ||

package/dist/lib/secrets-policy.d.ts

@@ -4,10 +4,8 @@ import type { AgentId, Meta, NativeAccountRecord } from './types.js';
 import { type DeviceProfile } from './devices/registry.js';
 import { type SharedAuthStatus } from './fleet-shared-state.js';
 import { selfConfiguredDeviceRole } from './device-config.js';
-import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind } from './reserved-stores.js';
-export { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind, };
-/** Filter `names` down to the ones the active resource profile allows for `secrets`. */
-export declare function filterBundleNamesForActiveProfile(names: string[]): string[];
+import { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind } from './reserved-stores.js';
+export { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, type StorableCredentialKind, };
 /**
  * `SecretsContext.allowedBundles` for the active resource profile, or
  * `undefined` when no profile is active (full trust — the client's default).
@@ -36,15 +34,13 @@ export declare function assertRemoteBundleFlagsUnsupported(bundleName: string, h
     keysFlag: string;
     allowExpiredFlag: string;
 }): void;
-/** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
-export declare const AUTH_SYNC_PUSH_DEADLINE_MS = 20000;
 export interface AuthSyncDevice {
     name: string;
     reachable: boolean;
     pinned: boolean;
     remoteAuth: SharedAuthStatus | 'unknown';
 }
-export type AuthSyncPlanItem = {
+type AuthSyncPlanItem = {
     action: 'push';
     device: string;
 } | {
@@ -53,7 +49,7 @@ export type AuthSyncPlanItem = {
     reason: string;
 };
 export declare function planAuthBundlePush(localAuthOk: boolean, localIsPublisher: boolean, devices: AuthSyncDevice[]): AuthSyncPlanItem[];
-export interface AuthSyncResult {
+interface AuthSyncResult {
     publisher: string | null;
     stateChanged: boolean;
     pushed: string[];
@@ -66,7 +62,7 @@ export interface AuthSyncResult {
         message: string;
     }>;
 }
-export interface AuthSyncDeps {
+interface AuthSyncDeps {
     inspectLocal?: () => {
         exists: boolean;
         ok: boolean;
@@ -90,7 +86,7 @@ export interface AuthSyncDeps {
  * over `zion`, and zion then skipped every peer as a non-publisher.
  */
 export declare function electPublisher(ready: readonly string[], roleOf: (name: string) => ReturnType<typeof selfConfiguredDeviceRole>): string | null;
-export interface PublishAuthVerdictOptions {
+interface PublishAuthVerdictOptions {
     inspectLocal?: () => {
         exists: boolean;
         ok: boolean;
@@ -98,7 +94,7 @@ export interface PublishAuthVerdictOptions {
     localName?: string;
     userAgentsDir?: string;
 }
-export interface PublishAuthVerdictResult {
+interface PublishAuthVerdictResult {
     device: string;
     status: SharedAuthStatus;
     changed: boolean;
@@ -135,7 +131,7 @@ export interface ReservedSyncPeer {
     /** bundle -> keys the peer already holds at the current fingerprint. Absent ⇒ none known. */
     presentKeys: Record<string, ReadonlySet<string>>;
 }
-export type ReservedSyncPlanItem = {
+type ReservedSyncPlanItem = {
     action: 'push';
     device: string;
     bundle: string;
@@ -160,7 +156,6 @@ export declare function planReservedStoreSync(accounts: ReservedSyncAccount[], p
  * `workerCredential`) is not a sync target.
  */
 export declare function reservedSyncTargets(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): ReservedSyncAccount[];
-export declare function readDeliveryMemo(root?: string): Record<string, string>;
 /**
  * The keys a peer is KNOWN to hold, per bundle, from what we have delivered to it
  * (memo, matched by fingerprint) plus the coarse legacy-`auth` verdict: a peer
@@ -169,7 +164,7 @@ export declare function readDeliveryMemo(root?: string): Record<string, string>;
  * from the memo alone -- which is what makes a newly-added reserved account push.
  */
 export declare function peerPresentKeys(peer: string, accounts: ReservedSyncAccount[], memo: Record<string, string>, legacyAuthReady: boolean): Record<string, ReadonlySet<string>>;
-export interface ReservedStoreSyncResult {
+interface ReservedStoreSyncResult {
     publisher: string | null;
     /** Legacy raw reserved items adopted into their bundle on this box before planning (local repair). */
     adopted: Array<{
@@ -190,7 +185,7 @@ export interface ReservedStoreSyncResult {
         message: string;
     }>;
 }
-export interface ReservedStoreSyncDeps {
+interface ReservedStoreSyncDeps {
     listDevices?: () => DeviceProfile[];
     localName?: string;
     userAgentsDir?: string;
@@ -224,7 +219,7 @@ export interface ReservedStoreSyncDeps {
  * there is no second scheduler. The daemon runs this each tick.
  */
 export declare function syncReservedStores(deps?: ReservedStoreSyncDeps): Promise<ReservedStoreSyncResult>;
-export interface ReconcileWorkerSlotsResult {
+interface ReconcileWorkerSlotsResult {
     provisioned: string[];
     skipped: Array<{
         accountId: string;
@@ -235,7 +230,7 @@ export interface ReconcileWorkerSlotsResult {
         message: string;
     }>;
 }
-export interface ReconcileWorkerSlotsDeps {
+interface ReconcileWorkerSlotsDeps {
     selfRole?: ReturnType<typeof selfConfiguredDeviceRole>;
     readMetaFn?: () => Pick<Meta, 'accounts' | 'deviceAccounts'>;
     hasLocalKey?: (bundle: string, key: string) => boolean;

package/dist/lib/secrets-policy.js

@@ -21,7 +21,7 @@ import { getCacheDir, getUserAgentsDir, readMeta } from './state.js';
 import { listNativeAccounts, readSlots } from './account-registry.js';
 import { claudeAccountTokenKey, isClaudeWorkerHomeSeeded, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
 import { configuredDeviceRole, isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
-import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, } from './reserved-stores.js';
+import { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, } from './reserved-stores.js';
 // --- reserved per-harness credential stores (PHNX-3940 / PHNX-3989) --------
 //
 // Re-exported from the leaf module `reserved-stores.ts` rather than declared
@@ -31,7 +31,7 @@ import { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDL
 // ReferenceError under real ESM evaluation order, outside vitest's
 // mock-tolerant transform). Keep the public surface unchanged for existing
 // importers of `secrets-policy.js`.
-export { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, };
+export { AUTH_STORE_ALIAS, AUTH_BUNDLE_BACKEND, RESERVED_BUNDLE_NAMES, isReservedBundleName, ReservedBundleWrongBackendError, assertReservedAuthBackend, isReservedBundleBackendError, RESERVED_STORES, reservedStoreName, isReservedStoreName, assertStorableCredentialKind, inspectReservedAuthBundle, };
 // --- resource-profile -> allowedBundles (CTX-1) -----------------------------
 //
 // A resource profile scopes WHICH bundle names a run may reach. The standalone
@@ -40,7 +40,7 @@ export { AUTH_STORE_ALIAS, AUTH_BUNDLE_NAME, AUTH_BUNDLE_BACKEND, RESERVED_BUNDL
 // every bounded request. Absent (no active profile) means full trust, matching
 // the client's own documented default.
 /** Filter `names` down to the ones the active resource profile allows for `secrets`. */
-export function filterBundleNamesForActiveProfile(names) {
+function filterBundleNamesForActiveProfile(names) {
     return filterNamesForActiveResourceProfile('secrets', names);
 }
 /**
@@ -98,7 +98,7 @@ export function assertRemoteBundleFlagsUnsupported(bundleName, host, opts, flagL
 // async and kill-bounded so it never blocks the daemon event loop.
 // ---------------------------------------------------------------------------
 /** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
-export const AUTH_SYNC_PUSH_DEADLINE_MS = 20_000;
+const AUTH_SYNC_PUSH_DEADLINE_MS = 20_000;
 export function planAuthBundlePush(localAuthOk, localIsPublisher, devices) {
     if (!localAuthOk) {
         return devices.map((device) => ({ action: 'skip', device: device.name, reason: 'no local file-backed auth bundle' }));
@@ -332,7 +332,7 @@ function deliveryMemoPath(root = getCacheDir()) {
 function memoKey(peer, bundle, key) {
     return `${normalizeHost(peer)} ${bundle} ${key}`;
 }
-export function readDeliveryMemo(root) {
+function readDeliveryMemo(root) {
     try {
         const parsed = JSON.parse(fs.readFileSync(deliveryMemoPath(root), 'utf-8'));
         if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))

package/dist/lib/secrets-types.d.ts

@@ -29,8 +29,8 @@ export type BundleValue = string | {
 };
 /** Remote (bundle@host) push destination backend. */
 export type RemoteBackend = 'keychain' | 'file';
-export declare const SECRET_TYPES: readonly ["api-key", "token", "password", "url", "database-url", "ssh-key", "certificate", "webhook", "note"];
-export type SecretType = (typeof SECRET_TYPES)[number];
+declare const SECRET_TYPES: readonly ["api-key", "token", "password", "url", "database-url", "ssh-key", "certificate", "webhook", "note"];
+type SecretType = (typeof SECRET_TYPES)[number];
 /** Per-secret metadata; absent fields are omitted at write time. */
 export interface VarMeta {
     type?: SecretType;
@@ -194,3 +194,4 @@ export interface RcSecretFinding {
     /** The file-store master passphrase gets called out separately. */
     isMasterPassphrase: boolean;
 }
+export {};

package/dist/lib/secrets-types.js

@@ -11,7 +11,7 @@
  * `secrets-client.ts` docblock).
  */
 // --- bundle document ---------------------------------------------------
-export const SECRET_TYPES = [
+const SECRET_TYPES = [
     'api-key',
     'token',
     'password',
@@ -22,3 +22,4 @@ export const SECRET_TYPES = [
     'webhook',
     'note',
 ];
+export {};

package/dist/lib/self-heal/checks/install-staging.js

@@ -9,7 +9,7 @@
 // ENOTEMPTY the sweep exists to prevent, and nothing runs `agents upgrade` to
 // trigger that sweep in the meantime. Periodic cadence closes that gap
 // fleet-wide (via the daemon's self-heal service) and on demand via
-// `agents doctor --fix`.
+// `agents sync`.
 //
 // The age guard is load-bearing: a staging dir can be legitimately mid-write
 // by a CONCURRENT upgrade this instant. Only a dir older than the guard is

package/dist/lib/self-heal/registry.d.ts

@@ -1,11 +1,11 @@
 import type { HealCheck, HealCheckId, HealCadence, SelfHealReport } from './types.js';
 export declare const HEAL_CHECKS: HealCheck[];
-export interface SelfHealOptions {
+interface SelfHealOptions {
     /** Restrict to these check ids; omit to run every registered check. */
     checks?: HealCheckId[];
     /** Only run checks whose cadence is in this set (daemon scheduling). */
     cadences?: HealCadence[];
-    /** 'safe' (daemon default) or 'full' (doctor --fix). Default 'safe'. */
+    /** 'safe' (daemon default) or 'full' (agents sync). Default 'safe'. */
     mode?: 'safe' | 'full';
     /** Detect only — never write. Default false. */
     dryRun?: boolean;
@@ -20,3 +20,4 @@ export declare function selfHealChangedAnything(report: SelfHealReport): boolean
 export declare function selfHealNeedsAttention(report: SelfHealReport): boolean;
 /** One-line human summary, e.g. "shims: 2 fixed; path: 1 fixed". */
 export declare function summarizeSelfHeal(report: SelfHealReport): string;
+export {};

package/dist/lib/self-heal/types.d.ts

@@ -2,7 +2,7 @@ export type HealCheckId = 'resources' | 'hook-runtime' | 'hook-manifest' | 'shim
 /** When the daemon schedules a check. */
 export type HealCadence = 'startup' | 'frequent' | 'periodic';
 export interface HealCtx {
-    /** 'safe' = daemon (low-risk only); 'full' = doctor --fix (everything). */
+    /** 'safe' = daemon (low-risk only); 'full' = agents sync (everything). */
     mode: 'safe' | 'full';
     /** Detect only — never write. Powers `agents doctor` (read-only) and previews. */
     dryRun: boolean;

package/dist/lib/self-heal/types.js

@@ -10,7 +10,7 @@
 // when `ctx.dryRun`), mirroring the existing resource heal (heal.ts) which computes
 // and applies together. `mode` gates how aggressive a repair may be: 'safe' (the
 // daemon default) fixes only low-risk drift and merely reports risky conditions;
-// 'full' (`agents doctor --fix`) applies everything.
+// 'full' (`agents sync`) applies everything.
 /** Convenience: an all-clear result. */
 export function okResult() {
     return { fixed: [], needsAttention: [], ok: true };

package/dist/lib/self-update.d.ts

@@ -307,7 +307,7 @@ export interface MultiInstallInventoryEntry {
     /** True for the copy that is currently executing. */
     running: boolean;
     /**
-     * True when a bare `agents doctor --fix` deletes this copy (RUSH-2415:
+     * True when a bare `agents sync` deletes this copy (RUSH-2415:
      * npx-cache / unsafe-legacy / pre-1.22.30 with a fixed peer). False for the
      * running copy and for any duplicate --fix will not touch — a healthy
      * >=1.22.30 peer, or a pre-1.22.30 copy with no fixed peer to fall back to;
@@ -317,7 +317,7 @@ export interface MultiInstallInventoryEntry {
 }
 /**
  * The exact shell command that removes the install at `packageRoot` by hand —
- * the remedy for duplicates `doctor --fix` deliberately will not purge
+ * the remedy for duplicates `agents sync` deliberately will not purge
  * (RUSH-2705). `--prefix` pins the target tree no matter which npm binary
  * PATH resolves, mirroring installPackageIntoPrefix.
  */
@@ -347,7 +347,7 @@ export declare function isNpxCacheInstall(packageRoot: string): boolean;
  */
 export declare function isTouchIdStormFixedVersion(version: string): boolean;
 /**
- * Classify discovered installs that doctor --fix / upgrade may delete.
+ * Classify discovered installs that agents sync / upgrade may delete.
  *
  * Never marks the running package root. Auto-purge is limited to copies that
  * cannot be the intended primary install:
@@ -371,7 +371,7 @@ export declare function purgeRemovableAgentsCliInstalls(candidates: RemovableAge
     dryRun?: boolean;
     runningRoot?: string;
 }): PurgeRemovableInstallsResult;
-/** A detected duplicate that `doctor --fix` will not purge (RUSH-2705). */
+/** A detected duplicate that `agents sync` will not purge (RUSH-2705). */
 export interface UnresolvedDuplicateInstall {
     packageRoot: string;
     version: string;
@@ -393,7 +393,7 @@ export interface RemediateStaleInstallsResult extends PurgeRemovableInstallsResu
     unresolved: UnresolvedDuplicateInstall[];
 }
 /**
- * Scan + classify + purge in one call. Used by `agents doctor --fix` and
+ * Scan + classify + purge in one call. Used by `agents sync` and
  * `agents upgrade` so both paths remediate the same set of latent copies.
  */
 export declare function remediateStaleAgentsCliInstalls(opts: {

package/dist/lib/self-update.js

@@ -669,7 +669,7 @@ function withRunningInstall(installs, runningRoot, runningVersion) {
 }
 /**
  * The exact shell command that removes the install at `packageRoot` by hand —
- * the remedy for duplicates `doctor --fix` deliberately will not purge
+ * the remedy for duplicates `agents sync` deliberately will not purge
  * (RUSH-2705). `--prefix` pins the target tree no matter which npm binary
  * PATH resolves, mirroring installPackageIntoPrefix.
  */
@@ -720,7 +720,7 @@ export function buildMultiInstallInventory(runningRoot, runningVersion, installs
 /** True when the package root lives under npm's `_npx` cache (ephemeral runs). */
 export function isNpxCacheInstall(packageRoot) {
     // Split on either separator so a POSIX-shaped path is still recognized when
-    // this runs on Windows (doctor --fix / tests pass forward literal `_npx`
+    // this runs on Windows (agents sync / tests pass forward literal `_npx`
     // paths from other boxes). `path.sep` alone missed `/home/…/_npx/…` on win32.
     const parts = packageRoot.split(/[\\/]/);
     return parts.includes('_npx');
@@ -741,7 +741,7 @@ export function isTouchIdStormFixedVersion(version) {
     return compareVersions(version, TOUCH_ID_STORM_FIXED_SINCE) >= 0;
 }
 /**
- * Classify discovered installs that doctor --fix / upgrade may delete.
+ * Classify discovered installs that agents sync / upgrade may delete.
  *
  * Never marks the running package root. Auto-purge is limited to copies that
  * cannot be the intended primary install:
@@ -866,7 +866,7 @@ export function purgeRemovableAgentsCliInstalls(candidates, opts = {}) {
     return result;
 }
 /**
- * Scan + classify + purge in one call. Used by `agents doctor --fix` and
+ * Scan + classify + purge in one call. Used by `agents sync` and
  * `agents upgrade` so both paths remediate the same set of latent copies.
  */
 export function remediateStaleAgentsCliInstalls(opts) {

package/dist/lib/session/actor-sidecar.d.ts

@@ -1,5 +1,5 @@
 import { type SessionRunMode } from './types.js';
-export interface SessionActorRecord {
+interface SessionActorRecord {
     sessionId: string;
     /** Resolved actor id (`resolveActor().id`) — the responsible human/agent. */
     actor?: string;
@@ -36,7 +36,7 @@ export interface SessionActorRecord {
  */
 export declare function writeSessionActorRecord(record: SessionActorRecord): void;
 export declare function writeSessionAliasRecord(sessionId: string, alias: string): void;
-export type SessionAliasResolution = {
+type SessionAliasResolution = {
     kind: 'resolved';
     sessionId: string;
 } | {
@@ -56,3 +56,4 @@ export declare function readSessionActorRecord(sessionId: string): SessionActorR
  * yields an empty map.
  */
 export declare function loadSessionActorIndex(): Map<string, SessionActorRecord>;
+export {};

package/dist/lib/session/artifacts.d.ts

@@ -8,8 +8,6 @@
 import type { SessionMeta, SessionArtifact } from './types.js';
 /** Parse a session and return metadata for every file written or edited during it. */
 export declare function discoverArtifacts(meta: SessionMeta): SessionArtifact[];
-/** Refuse to load artifact files larger than this. Returns '' silently above the cap. */
-export declare const ARTIFACT_MAX_BYTES = 50000000;
 /** Read the current contents of an artifact file from disk. Rejects symlinks. */
 export declare function readArtifact(artifact: SessionArtifact): string;
 /** Resolve a user-provided name to an artifact by exact path, basename, or path suffix. */

package/dist/lib/session/artifacts.js

@@ -65,7 +65,7 @@ export function discoverArtifacts(meta) {
     return artifacts;
 }
 /** Refuse to load artifact files larger than this. Returns '' silently above the cap. */
-export const ARTIFACT_MAX_BYTES = 50_000_000;
+const ARTIFACT_MAX_BYTES = 50_000_000;
 /** Read the current contents of an artifact file from disk. Rejects symlinks. */
 export function readArtifact(artifact) {
     const stat = fs.lstatSync(artifact.path);

package/dist/lib/session/bash-command.d.ts

@@ -5,13 +5,7 @@
  * summarize what actually happened instead of printing a wall of shell.
  */
 export type BashCategory = 'vcs' | 'build-test' | 'install' | 'remote' | 'http' | 'media' | 'upscaling' | 'metadata' | 'probe' | 'search' | 'shell' | 'wait' | 'other';
-export interface BashToolInfo {
-    category: BashCategory;
-    signal: 'high' | 'mid' | 'low';
-    action: string;
-    aliases?: string[];
-}
-export interface BashCommandInfo {
+interface BashCommandInfo {
     tool: string;
     category: BashCategory;
     subcommand: string;
@@ -66,3 +60,4 @@ export declare function detectBashMilestone(command: string): {
  * Human-readable category label for renderers.
  */
 export declare function categoryLabel(category: BashCategory): string;
+export {};

package/dist/lib/session/bundle.d.ts

@@ -19,7 +19,6 @@
  */
 import { type SyncAgentSpec } from './sync/agents.js';
 export declare const BUNDLE_KIND = "agents-session-bundle";
-export declare const BUNDLE_VERSION = 1;
 /** First line of a bundle: what it is and how the bodies are encoded. */
 export interface BundleHeader {
     kind: typeof BUNDLE_KIND;
@@ -71,7 +70,7 @@ export interface FileToExport {
     absPath: string;
     label?: string;
 }
-export interface BuildRecordOpts {
+interface BuildRecordOpts {
     /** Scrub secrets from the body before hashing/sealing (default-on at the command layer). */
     redact: boolean;
     /** Non-null → seal each body with this key; null → plaintext bodies. */
@@ -85,8 +84,6 @@ export interface BuildRecordOpts {
 }
 /** Look up the sync spec for an agent id (undefined → agent not sync-representable). */
 export declare function specForAgent(agentId: string): SyncAgentSpec | undefined;
-/** True when an agent's sessions can be represented in a bundle (has a sync spec). */
-export declare function isExportableAgent(agentId: string): boolean;
 /**
  * Read one file and turn it into a bundle record. The hash and size are always
  * computed over the PLAINTEXT (post-redaction) body, so they equal what lands on
@@ -128,7 +125,7 @@ export interface ImportPlanItem {
     targetPath: string;
     status: ImportStatus;
 }
-export interface PlanImportOpts {
+interface PlanImportOpts {
     /** Key to open encrypted record bodies (null → only plaintext bodies readable). */
     decryptKey: Buffer | null;
 }
@@ -152,7 +149,7 @@ export interface WriteResult {
     /** Records for agents with no sync spec. */
     unknown: number;
 }
-export interface WriteImportOpts {
+interface WriteImportOpts {
     overwrite: boolean;
     decryptKey: Buffer | null;
 }
@@ -162,3 +159,4 @@ export interface WriteImportOpts {
  * are counted and skipped.
  */
 export declare function writeImport(plan: ImportPlanItem[], opts: WriteImportOpts): WriteResult;
+export {};

package/dist/lib/session/bundle.js

@@ -24,7 +24,7 @@ import { SYNC_AGENTS, mirrorPath } from './sync/agents.js';
 import { redactSecrets } from '../redact.js';
 import { encryptTranscript, decryptTranscriptBody } from './sync/transcript-crypto.js';
 export const BUNDLE_KIND = 'agents-session-bundle';
-export const BUNDLE_VERSION = 1;
+const BUNDLE_VERSION = 1;
 /** SHA-256 of a file body, used for the bundle's dedup/conflict check on import. */
 function hashContent(content) {
     return crypto.createHash('sha256').update(content).digest('hex');
@@ -33,10 +33,6 @@ function hashContent(content) {
 export function specForAgent(agentId) {
     return SYNC_AGENTS.find(s => s.id === agentId);
 }
-/** True when an agent's sessions can be represented in a bundle (has a sync spec). */
-export function isExportableAgent(agentId) {
-    return specForAgent(agentId) !== undefined;
-}
 /**
  * Read one file and turn it into a bundle record. The hash and size are always
  * computed over the PLAINTEXT (post-redaction) body, so they equal what lands on

package/dist/lib/session/cloud.d.ts

@@ -10,8 +10,6 @@
  *   GET /api/v1/cloud-runs/:id/session.jsonl → raw captured jsonl
  */
 import type { SessionMeta } from './types.js';
-export declare function assertContained(candidate: string, rootDir: string): string;
-export declare function validateCloudExecutionId(executionId: string): string;
 /**
  * List cloud executions the user has captured sessions for. Includes
  * completed + needs_review + failed; an empty session_path means capture
@@ -28,5 +26,3 @@ export declare function discoverCloudSessions(options?: {
 export declare function ensureCloudSessionCached(executionId: string, destPath?: string): Promise<string>;
 /** True if filePath points into the cloud session cache dir. */
 export declare function isCloudSessionPath(filePath: string): boolean;
-/** Extract execution_id from a cloud cache path. */
-export declare function executionIdFromCloudPath(filePath: string): string | null;