@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/ssh-exec.d.ts

@@ -102,7 +102,7 @@ export declare function controlOpts(): string[];
  * ignored. Pure so the ordering contract is unit-testable. See RUSH-1767.
  */
 export declare function sshConnectOpts(mux: string[], hostKeyOpts?: string[]): string[];
-export interface SshExecOptions {
+interface SshExecOptions {
     /** Piped to the remote command's stdin (never interpolated into the shell). */
     input?: string;
     /** Kill the ssh process after this many ms. */
@@ -146,7 +146,7 @@ export declare function sshExec(target: string, remoteCmd: string, opts?: SshExe
  * down the remote side (RUSH-2114).
  */
 export declare function sshExecAsync(target: string, remoteCmd: string, opts?: SshExecOptions): Promise<SshExecResult>;
-export interface SshExecRawResult {
+interface SshExecRawResult {
     code: number | null;
     stdout: Buffer;
     stderr: Buffer;
@@ -160,7 +160,7 @@ export interface SshExecRawResult {
  * U+FFFD replacement char (which would desync a byte offset from the wire).
  */
 export declare function sshExecRaw(target: string, remoteCmd: string, opts?: SshExecOptions): SshExecRawResult;
-export interface SshExecRawStreamOptions extends SshExecOptions {
+interface SshExecRawStreamOptions extends SshExecOptions {
     onStdout: (chunk: Buffer) => void;
     onStderr?: (chunk: Buffer) => void;
     signal?: AbortSignal;
@@ -173,10 +173,54 @@ export interface SshExecRawStreamOptions extends SshExecOptions {
  * offset-resumed log following where a UTF-8 decode boundary must not shift the
  * byte cursor.
  */
+/** Grace between SIGTERM and SIGKILL for a stream that will not stop. */
+export declare const SSH_STREAM_KILL_GRACE_MS = 3000;
+/** Bytes of a stream's stderr retained; the rest is dropped, with a note. */
+export declare const SSH_STREAM_MAX_STDERR: number;
+export interface SshStreamResult {
+    code: number | null;
+    stderr: Buffer;
+    timedOut: boolean;
+    /** True when the child had to be SIGKILLed after ignoring SIGTERM. */
+    killed: boolean;
+    /** True when stderr was truncated at {@link SSH_STREAM_MAX_STDERR}. */
+    stderrTruncated: boolean;
+}
+/**
+ * Stream one ssh command's stdout, with the args and env a CALLER built.
+ *
+ * This exists because {@link sshExecRawStream} assembles its own ssh args, which
+ * means it cannot carry a device's canonical auth — the askpass shim for a
+ * password-auth box, `-i`/`IdentitiesOnly` for an explicit identity file, or the
+ * managed known-hosts pinning. A caller that has already built those through
+ * `buildSshInvocation` needs a way to run them, and duplicating the transport to
+ * get it would be the worse answer. So this takes `args`/`env` verbatim and adds
+ * only the lifecycle guarantees:
+ *
+ * - **SIGTERM then SIGKILL.** A timeout or abort that only sends SIGTERM leaks a
+ *   child that ignores it — ssh does, mid-handshake — and the promise never
+ *   settles. After {@link SSH_STREAM_KILL_GRACE_MS} the child is SIGKILLed and
+ *   `killed` says so.
+ * - **Bounded stderr.** A peer that writes endlessly to stderr would otherwise
+ *   grow this buffer without limit; it is capped and `stderrTruncated` says so.
+ * - **`onStdout` cannot break the caller's cleanup.** A throw from the consumer
+ *   is captured and re-thrown by the awaiting caller, so a write failure ends the
+ *   transfer instead of escaping as an unhandled error inside a stream event.
+ */
+export declare function sshStreamWithArgs(opts: {
+    args: string[];
+    env?: Record<string, string>;
+    onStdout: (chunk: Buffer) => void;
+    timeoutMs?: number;
+    killGraceMs?: number;
+    maxStderrBytes?: number;
+    signal?: AbortSignal;
+    sshBin?: string;
+}): Promise<SshStreamResult>;
 export declare function sshExecRawStream(target: string, remoteCmd: string, opts: SshExecRawStreamOptions): Promise<Omit<SshExecRawResult, 'stdout'>>;
 /** True if `target` is reachable over ssh (a passwordless `true` succeeds quickly). */
 export declare function sshReachable(target: string, timeoutMs?: number): boolean;
-export interface SshStreamOptions {
+interface SshStreamOptions {
     /**
      * Allocate a remote pseudo-terminal (`ssh -tt`) so an interactive remote
      * command (a picker, a prompt) renders live on the local terminal. Callers
@@ -261,3 +305,4 @@ export declare function saveLocalTerminal(): string | undefined;
  * mode resets.
  */
 export declare function sshStream(target: string, remoteCmd: string, opts?: SshStreamOptions): number;
+export {};

package/dist/lib/ssh-exec.js

@@ -317,6 +317,125 @@ export function sshExecRaw(target, remoteCmd, opts = {}) {
  * offset-resumed log following where a UTF-8 decode boundary must not shift the
  * byte cursor.
  */
+/** Grace between SIGTERM and SIGKILL for a stream that will not stop. */
+export const SSH_STREAM_KILL_GRACE_MS = 3_000;
+/** Bytes of a stream's stderr retained; the rest is dropped, with a note. */
+export const SSH_STREAM_MAX_STDERR = 8 * 1024;
+/**
+ * Stream one ssh command's stdout, with the args and env a CALLER built.
+ *
+ * This exists because {@link sshExecRawStream} assembles its own ssh args, which
+ * means it cannot carry a device's canonical auth — the askpass shim for a
+ * password-auth box, `-i`/`IdentitiesOnly` for an explicit identity file, or the
+ * managed known-hosts pinning. A caller that has already built those through
+ * `buildSshInvocation` needs a way to run them, and duplicating the transport to
+ * get it would be the worse answer. So this takes `args`/`env` verbatim and adds
+ * only the lifecycle guarantees:
+ *
+ * - **SIGTERM then SIGKILL.** A timeout or abort that only sends SIGTERM leaks a
+ *   child that ignores it — ssh does, mid-handshake — and the promise never
+ *   settles. After {@link SSH_STREAM_KILL_GRACE_MS} the child is SIGKILLed and
+ *   `killed` says so.
+ * - **Bounded stderr.** A peer that writes endlessly to stderr would otherwise
+ *   grow this buffer without limit; it is capped and `stderrTruncated` says so.
+ * - **`onStdout` cannot break the caller's cleanup.** A throw from the consumer
+ *   is captured and re-thrown by the awaiting caller, so a write failure ends the
+ *   transfer instead of escaping as an unhandled error inside a stream event.
+ */
+export function sshStreamWithArgs(opts) {
+    const maxStderr = opts.maxStderrBytes ?? SSH_STREAM_MAX_STDERR;
+    const grace = opts.killGraceMs ?? SSH_STREAM_KILL_GRACE_MS;
+    return new Promise((resolve, reject) => {
+        const child = spawn(opts.sshBin ?? 'ssh', opts.args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: opts.env ? { ...process.env, ...opts.env } : process.env,
+            windowsHide: true,
+            // Own process group on POSIX so a kill reaches the whole tree. Killing only
+            // the ssh pid is not enough: a descendant that inherited stdout keeps the
+            // pipe open, `'close'` never fires, and the promise hangs for as long as
+            // that grandchild lives — which defeats the timeout entirely.
+            detached: process.platform !== 'win32',
+        });
+        const stderr = [];
+        let stderrBytes = 0;
+        let stderrTruncated = false;
+        let timedOut = false;
+        let killed = false;
+        let consumerError;
+        let settled = false;
+        let killTimer;
+        /** Signal the whole group where the platform supports it, else just the child. */
+        const signal = (sig) => {
+            try {
+                if (process.platform !== 'win32' && child.pid)
+                    process.kill(-child.pid, sig);
+                else
+                    child.kill(sig);
+            }
+            catch { /* already gone */ }
+        };
+        const escalate = () => {
+            signal('SIGTERM');
+            // Escalation, not a second polite ask: a child still alive after the grace
+            // is one that is not going to honour SIGTERM.
+            killTimer = setTimeout(() => { killed = true; signal('SIGKILL'); }, grace);
+            killTimer.unref?.();
+        };
+        const stop = () => escalate();
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            opts.signal?.removeEventListener('abort', stop);
+            if (consumerError !== undefined) {
+                reject(consumerError);
+                return;
+            }
+            resolve({ code, stderr: Buffer.concat(stderr), timedOut, killed, stderrTruncated });
+        };
+        const timer = opts.timeoutMs
+            ? setTimeout(() => { timedOut = true; escalate(); }, opts.timeoutMs)
+            : null;
+        child.stdout.on('data', (chunk) => {
+            if (consumerError !== undefined)
+                return;
+            try {
+                opts.onStdout(chunk);
+            }
+            catch (error) {
+                // Captured, not thrown: a throw here would surface as an unhandled error
+                // on the stream and skip the caller's cleanup entirely.
+                consumerError = error;
+                escalate();
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            const room = maxStderr - stderrBytes;
+            if (room <= 0) {
+                stderrTruncated = true;
+                return;
+            }
+            if (chunk.length > room) {
+                stderrTruncated = true;
+                stderr.push(chunk.subarray(0, room));
+                stderrBytes = maxStderr;
+                return;
+            }
+            stderr.push(chunk);
+            stderrBytes += chunk.length;
+        });
+        child.once('error', () => finish(null));
+        child.once('close', finish);
+        if (opts.signal?.aborted)
+            escalate();
+        else
+            opts.signal?.addEventListener('abort', stop, { once: true });
+    });
+}
 export function sshExecRawStream(target, remoteCmd, opts) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();

package/dist/lib/ssh-tunnel.d.ts

@@ -19,7 +19,7 @@
  */
 import { type ChildProcess } from 'child_process';
 import { type DeviceProfile } from './devices/registry.js';
-export interface StartTunnelOptions {
+interface StartTunnelOptions {
     extraSshArgs?: string[];
 }
 /** Build the ssh argv (after the `ssh` program name) for an `-L` tunnel. Pure.
@@ -37,7 +37,7 @@ export declare function buildTunnelArgs(user: string, host: string, localPort: n
  */
 export declare function startSSHTunnel(user: string, host: string, localPort: number, remotePort: number, opts?: StartTunnelOptions): Promise<ChildProcess>;
 /** One registered device, resolved to everything an ssh invocation needs. */
-export interface ResolvedRemoteDevice {
+interface ResolvedRemoteDevice {
     device: DeviceProfile;
     target: string;
     user: string;
@@ -59,3 +59,4 @@ export declare function resolveRemoteDevice(name: string, opts?: {
     expectPlatform?: DeviceProfile['platform'];
     forWhat?: string;
 }): Promise<ResolvedRemoteDevice>;
+export {};

package/dist/lib/staleness/checkers/permissions.d.ts

@@ -9,8 +9,6 @@
  * counts as stale.
  */
 import type { PermEntry } from '../types.js';
-/** Walk user + system permissions/groups/. First-wins user > system on names. */
-export declare function collectPermissionGroupFiles(): Record<string, string>;
 /** Build the permissions section of the manifest. */
 export declare function buildPermissions(): PermEntry;
 /** True when the stored permissions section no longer matches current state. */

package/dist/lib/staleness/checkers/permissions.js

@@ -14,7 +14,7 @@ import { getUserPermissionsDir, getPermissionsDir } from '../../state.js';
 import { fingerprintFile, isFileStale } from '../fingerprint.js';
 import { getActivePermissionPresetName } from '../../permissions.js';
 /** Walk user + system permissions/groups/. First-wins user > system on names. */
-export function collectPermissionGroupFiles() {
+function collectPermissionGroupFiles() {
     const seen = new Map();
     for (const baseDir of [getUserPermissionsDir(), getPermissionsDir()]) {
         const groupsDir = path.join(baseDir, 'groups');

package/dist/lib/staleness/fingerprint.d.ts

@@ -27,12 +27,5 @@ export declare function isFileStale(stored: Fingerprint, currentPath: string): b
  * sha256 only on stat mismatch.
  */
 export declare function isDirStale(storedDirPath: string, storedFiles: Fingerprint[], currentDirPath: string): boolean;
-/**
- * Walk a directory and return sorted absolute paths of every regular file.
- * No content reads. Uses the same FINGERPRINT_SKIP allowlist as
- * `fingerprintDir` so both produce the same path set (required for the
- * dir-stale path comparison to work).
- */
-export declare function walkDirPaths(dirPath: string): string[];
 /** True if two sorted-or-unsorted name sets differ. */
 export declare function nameSetDiffers(a: string[], b: string[]): boolean;

package/dist/lib/staleness/fingerprint.js

@@ -120,7 +120,7 @@ export function isDirStale(storedDirPath, storedFiles, currentDirPath) {
  * `fingerprintDir` so both produce the same path set (required for the
  * dir-stale path comparison to work).
  */
-export function walkDirPaths(dirPath) {
+function walkDirPaths(dirPath) {
     const results = [];
     function walk(dir) {
         let entries;

package/dist/lib/staleness/prune.d.ts

@@ -55,7 +55,7 @@ import type { SyncManifest } from './types.js';
  */
 export declare const PRUNABLE_KINDS: readonly ["commands", "skills"];
 export type PrunableKind = typeof PRUNABLE_KINDS[number];
-export interface PruneInput {
+interface PruneInput {
     agent: AgentId;
     version: string;
     versionHome: string;
@@ -71,7 +71,7 @@ export interface PruneInput {
      */
     sourceNames: Record<PrunableKind, ReadonlyArray<string>>;
 }
-export interface PruneOutcome {
+interface PruneOutcome {
     /** Names actually removed from the version home, per kind. */
     pruned: Record<PrunableKind, string[]>;
     /**
@@ -86,3 +86,4 @@ export interface PruneOutcome {
  * source, from one agent@version home. Deletes nothing when no manifest exists.
  */
 export declare function pruneRemovedResources(input: PruneInput): PruneOutcome;
+export {};

package/dist/lib/staleness/registry.d.ts

@@ -9,7 +9,7 @@ export type { ResourceWriter, WriteArgs, WriteResult, RemoveArgs, RemoveResult }
 export type { ResourceDetector, DetectArgs } from './detectors/types.js';
 export type { RulesSelection } from './writers/rules.js';
 /** Per-kind selection payload. Most kinds are string[]; rules is special. */
-export type SelectionFor<K extends ResourceKind> = K extends 'rules' ? RulesSelection : string[];
+type SelectionFor<K extends ResourceKind> = K extends 'rules' ? RulesSelection : string[];
 export declare const WRITERS: Record<ResourceKind, Partial<Record<AgentId, ResourceWriter<any>>>>;
 export declare const DETECTORS: Record<ResourceKind, Partial<Record<AgentId, ResourceDetector>>>;
 /**

package/dist/lib/staleness/writers/sources.d.ts

@@ -1,12 +1,4 @@
 import type { AgentId } from '../../types.js';
-export type EnabledExtra = {
-    alias: string;
-    dir: string;
-};
-/** Trusted source bases for content-like kinds. Project layer excluded. */
-export declare function trustedSourceBases(): {
-    dir: string;
-}[];
 /** Every `plugins/<plugin>/skills` dir across trusted source bases, filtered to an optional plugin/agent scope. */
 export declare function pluginSkillDirs(options?: {
     agent?: AgentId;

package/dist/lib/staleness/writers/sources.js

@@ -12,7 +12,7 @@ import * as path from 'path';
 import { getUserAgentsDir, getAgentsDir, getEnabledExtraRepos, getCommandsDir, getSkillsDir, getHooksDir } from '../../state.js';
 import { isSafeSegmentName, safeJoin } from '../../paths.js';
 /** Trusted source bases for content-like kinds. Project layer excluded. */
-export function trustedSourceBases() {
+function trustedSourceBases() {
     return [
         { dir: getUserAgentsDir() },
         { dir: getAgentsDir() },

package/dist/lib/startup/command-registry.d.ts

@@ -17,15 +17,17 @@ export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
  * name is gone, the spellchecker finds a neighbour, and the CLI runs something
  * the user never asked for instead of saying the command is gone.
  *
- * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
- * under `agents artifacts share` (RUSH-2580). login/logout/budget/bench/mine/
+ * `set` moved under `agents models`/`agents config` (RUSH-2579); `share`,
+ * `unshare`, and the whole `artifacts` group moved OUT to the standalone
+ * `artifacts` CLI (`@phnx-labs/artifacts-cli`, PHNX-3992) — artifact sharing is
+ * no longer an agents-cli surface at all. login/logout/budget/bench/mine/
  * cost/output/profiles/snapshot/cp/resume/roster moved under nested homes
  * (cli-surface-consolidate). `timeline` was removed as a duplicated surface —
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
- * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `audit` nested under
+ * `agents events audit`.
  * `trends` was removed with the insights recipe collapse — the one counter
  * surface is `agents insights mix` (PHNX-3391). `serve` (the
  * read-only local web companion + `--control` anchor) was removed with the

package/dist/lib/startup/command-registry.js

@@ -2,14 +2,14 @@ const LOADED_COMMAND_NAMES = [
     'accounts', 'auth', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
     'permissions', 'mcp', 'clis', 'subagents', 'plugins', 'workflows', 'add', 'use',
     'remove', 'rm', 'purge', 'update', 'prune', 'import', 'registry', 'search', 'install', 'packages',
-    'routines', 'monitors', 'projects', 'run', '_callback', 'open', 'reconnect', 'fork', 'config',
+    'routines', 'monitors', 'projects', 'run', '_callback', 'open', 'fork', 'config',
     'models', 'modes', 'trash', 'restore', 'doctor',
     'route', 'routes', 'harness', 'harnesses', 'secrets', 'menubar', 'sync',
     'refresh-rules', 'factory', 'insights', 'trace', 'reminders',
-    'pty', 'tmux', 'watchdog', 'browser', 'computer', 'logs', 'events',
+    'tmux', 'watchdog', 'browser', 'computer', 'logs', 'events',
     'ssh', 'devices', 'fleet', 'repos', 'repo', 'setup', 'uninstall', 'upgrade', 'sessions',
-    'teams', 'cloud', 'message', 'send', 'notify', 'feed',
-    'mailboxes', 'mailbox', 'artifacts', 'webhooks',
+    'teams', 'cloud', 'message', 'send', 'feed',
+    'mailboxes', 'mailbox', 'webhooks',
     'humans', 'daemon', 'traces',
 ];
 const INLINE_COMMAND_NAMES = [
@@ -37,15 +37,17 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
  * name is gone, the spellchecker finds a neighbour, and the CLI runs something
  * the user never asked for instead of saying the command is gone.
  *
- * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
- * under `agents artifacts share` (RUSH-2580). login/logout/budget/bench/mine/
+ * `set` moved under `agents models`/`agents config` (RUSH-2579); `share`,
+ * `unshare`, and the whole `artifacts` group moved OUT to the standalone
+ * `artifacts` CLI (`@phnx-labs/artifacts-cli`, PHNX-3992) — artifact sharing is
+ * no longer an agents-cli surface at all. login/logout/budget/bench/mine/
  * cost/output/profiles/snapshot/cp/resume/roster moved under nested homes
  * (cli-surface-consolidate). `timeline` was removed as a duplicated surface —
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
- * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `audit` nested under
+ * `agents events audit`.
  * `trends` was removed with the insights recipe collapse — the one counter
  * surface is `agents insights mix` (PHNX-3391). `serve` (the
  * read-only local web companion + `--control` anchor) was removed with the
@@ -81,6 +83,7 @@ export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'roster',
     'set',
     'share',
+    'artifacts',
     'timeline',
     'status',
     'tickets',

package/dist/lib/state.d.ts

@@ -12,7 +12,7 @@
  *                          teams/agents, trash, backups). Backed up by
  *                          `agents repo push`.
  *   ~/.agents/.cache/    — regenerable runtime data (shims, packages, helpers
- *                          for daemon/pty, terminals, cloud, drive, browser
+ *                          for daemon, terminals, cloud, drive, browser
  *                          chrome-data, logs, companion). Gitignored.
  *
  * Resolution precedence for resources: project > user > system.
@@ -350,8 +350,6 @@ export declare function getHelpersDir(): string;
  * the daemon module is exercised. Never set in production code.
  */
 export declare function getDaemonDir(): string;
-/** Path to PTY server scratch (~/.agents/.cache/helpers/pty/). */
-export declare function getPtyDir(): string;
 /** Path to tmux scratch (~/.agents/.cache/helpers/tmux/) — shared server socket + per-session meta JSONs. */
 export declare function getTmuxDir(): string;
 /** Path to remote-resource auto-pull cache (~/.agents/.cache/.fetch/). */

package/dist/lib/state.js

@@ -12,7 +12,7 @@
  *                          teams/agents, trash, backups). Backed up by
  *                          `agents repo push`.
  *   ~/.agents/.cache/    — regenerable runtime data (shims, packages, helpers
- *                          for daemon/pty, terminals, cloud, drive, browser
+ *                          for daemon, terminals, cloud, drive, browser
  *                          chrome-data, logs, companion). Gitignored.
  *
  * Resolution precedence for resources: project > user > system.
@@ -141,7 +141,6 @@ const COMPANION_CACHE_DIR = path.join(CACHE_DIR, 'companion');
 const BROWSER_RUNTIME_DIR = path.join(CACHE_DIR, 'browser');
 const HELPERS_DIR = path.join(CACHE_DIR, 'helpers');
 const DAEMON_DIR = path.join(HELPERS_DIR, 'daemon');
-const PTY_DIR = path.join(HELPERS_DIR, 'pty');
 const TMUX_DIR = path.join(HELPERS_DIR, 'tmux');
 const FETCH_CACHE_DIR = path.join(CACHE_DIR, '.fetch');
 const CLI_VERSION_CACHE_FILE = path.join(CACHE_DIR, '.cli-version-cache.json');
@@ -216,8 +215,8 @@ export function getOptionalUserAgentsDir() {
  * Origin `owner/repo` slug (lowercased, `.git` stripped) of a git checkout, or
  * null when `dir` isn't a git repo / has no origin. Extracts the slug from any
  * remote URL form: `git@host:owner/repo.git`, `https://host/owner/repo.git`,
- * `ssh://git@host/owner/repo`. Sync (mirrors readGitConfigUser in git.ts) so it
- * can be used from the synchronous getProjectAgentsDir walk.
+ * `ssh://git@host/owner/repo`. Sync (uses `execFileSync`, not the async git
+ * helpers) so it can be used from the synchronous getProjectAgentsDir walk.
  */
 function gitOriginSlug(dir) {
     let url;
@@ -673,8 +672,6 @@ export function getHelpersDir() { return HELPERS_DIR; }
  * the daemon module is exercised. Never set in production code.
  */
 export function getDaemonDir() { return process.env.AGENTS_DAEMON_DIR ?? DAEMON_DIR; }
-/** Path to PTY server scratch (~/.agents/.cache/helpers/pty/). */
-export function getPtyDir() { return PTY_DIR; }
 /** Path to tmux scratch (~/.agents/.cache/helpers/tmux/) — shared server socket + per-session meta JSONs. */
 export function getTmuxDir() { return TMUX_DIR; }
 /** Path to remote-resource auto-pull cache (~/.agents/.cache/.fetch/). */

package/dist/lib/storage/selection.d.ts

@@ -13,8 +13,8 @@
  * covers — those differ (share uses an email-handle namespace with public reads
  * and covers; a traces/sessions adapter uses the userId and differs again). Each
  * surface keeps its own DISCRIMINATED, typed adapter that reads this decision and
- * returns its own `kind`-tagged backend. See `lib/share/backend.ts` and
- * `lib/traces/backend.ts` for the two adapters.
+ * returns its own `kind`-tagged backend. See `lib/traces/backend.ts` for a
+ * concrete adapter.
  */
 import { type PhoenixSession } from '../identity/client.js';
 /** The two legitimate principals any managed-capable surface can resolve to. */

package/dist/lib/storage/selection.js

@@ -13,8 +13,8 @@
  * covers — those differ (share uses an email-handle namespace with public reads
  * and covers; a traces/sessions adapter uses the userId and differs again). Each
  * surface keeps its own DISCRIMINATED, typed adapter that reads this decision and
- * returns its own `kind`-tagged backend. See `lib/share/backend.ts` and
- * `lib/traces/backend.ts` for the two adapters.
+ * returns its own `kind`-tagged backend. See `lib/traces/backend.ts` for a
+ * concrete adapter.
  */
 import { readSession } from '../identity/client.js';
 /**

package/dist/lib/subagents-registry.d.ts

@@ -1,11 +1,11 @@
 import type { AgentId, InstalledSubagent, SubagentFrontmatter } from './types.js';
 /** A path an installed subagent occupies, tagged for removal/trash handling. */
-export interface OccupiedEntry {
+interface OccupiedEntry {
     path: string;
     kind: 'file' | 'dir';
 }
 /** Parsed metadata for one installed subagent (drives the rich listing). */
-export interface SubagentMeta {
+interface SubagentMeta {
     frontmatter: SubagentFrontmatter;
     files: string[];
     /** Primary on-disk path for the listing's `path` field (a file or a dir, per layout). */
@@ -15,7 +15,7 @@ export interface SubagentMeta {
  * The complete on-disk contract for one agent's subagents. Every operation is
  * expressed here so the engine below never branches on the agent id.
  */
-export interface SubagentTarget {
+interface SubagentTarget {
     /** Absolute container dir under a home root (a version home or an agent home). */
     dir(home: string): string;
     /** Materialize central subagent `sub` into container `dir`. Throws on fs error. */
@@ -96,3 +96,4 @@ export declare function trashSubagentFromHome(agent: AgentId, home: string, name
     success: boolean;
     error?: string;
 };
+export {};

package/dist/lib/subagents.d.ts

@@ -151,7 +151,7 @@ export declare function subagentContentMatches(installedDir: string, sourceDir:
  * enumerator so a new agent needs no arm here -- just a registry entry.
  */
 export declare function listSubagentsForAgent(agentId: AgentId, home: string): InstalledSubagent[];
-export interface VersionSubagentDiff {
+interface VersionSubagentDiff {
     agent: AgentId;
     version: string;
     orphans: string[];
@@ -179,3 +179,4 @@ export declare function removeSubagentFromVersion(agent: AgentId, version: strin
     success: boolean;
     error?: string;
 };
+export {};

package/dist/lib/subagents.js

@@ -377,8 +377,9 @@ export function transformSubagentForCodex(subagentDir) {
         throw new Error(`Invalid AGENT.md in ${subagentDir}`);
     }
     const instructions = flattenSubagentInstructions(subagentDir);
-    // Escape TOML multi-line string (""") content — only """ needs escaping.
-    const safeInstructions = instructions.replace(/"""/g, '\\"""');
+    // TOML multi-line basic strings still process backslash escapes, so a literal
+    // backslash (a Windows path, a regex) must be doubled before """ is escaped.
+    const safeInstructions = instructions.replace(/\\/g, '\\\\').replace(/"""/g, '\\"""');
     const safeName = frontmatter.name.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
     const safeDesc = frontmatter.description.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
     let toml = `name = "${safeName}"\n`;

package/dist/lib/summarizer/pass.d.ts

@@ -13,11 +13,7 @@
 import type { ActiveSession } from '../session/active.js';
 import { type SummarizerConfig } from './config.js';
 import { summarize as defaultSummarize } from './summarize.js';
-/** Max sessions summarized per tick — a debounce ceiling on local-model calls. */
-export declare const SUMMARIZER_MAX_PER_TICK = 8;
-/** Narration headlines handed to the model per session — the recent tail, not the history. */
-export declare const SUMMARIZER_STEP_INPUT = 12;
-export interface SummarizerPassOptions {
+interface SummarizerPassOptions {
     now?: number;
     config?: SummarizerConfig;
     /** Live sessions to consider; default = this box's warm local-session cache. */
@@ -34,7 +30,7 @@ export interface SummarizerPassOptions {
     /** Skip the reader-recency gate (tests pass sessions directly). */
     requireReader?: boolean;
 }
-export interface SummarizerPassResult {
+interface SummarizerPassResult {
     disabled: boolean;
     computed: number;
     reused: number;
@@ -45,3 +41,4 @@ export interface SummarizerPassResult {
  * is isolated so one bad transcript can't stall the whole tick.
  */
 export declare function runSummarizerPass(opts?: SummarizerPassOptions): Promise<SummarizerPassResult>;
+export {};

package/dist/lib/summarizer/pass.js

@@ -16,9 +16,9 @@ import { isActiveSessionsJournalReaderRecent, readActiveSessionsCache, } from '.
 import { resolveSummarizerConfig, isSummarizerRunnable } from './config.js';
 import { summarize as defaultSummarize } from './summarize.js';
 /** Max sessions summarized per tick — a debounce ceiling on local-model calls. */
-export const SUMMARIZER_MAX_PER_TICK = 8;
+const SUMMARIZER_MAX_PER_TICK = 8;
 /** Narration headlines handed to the model per session — the recent tail, not the history. */
-export const SUMMARIZER_STEP_INPUT = 12;
+const SUMMARIZER_STEP_INPUT = 12;
 /**
  * Merge model checkpoint TEXTS with any prior stored checkpoints so a line that
  * already existed keeps its original `at`, and only genuinely new lines get

package/dist/lib/summarizer/summarize.d.ts

@@ -13,7 +13,7 @@
  */
 import type { TodoProgress } from '../session/types.js';
 /** Live progress fed to the model alongside the goal-bearing prompt. */
-export interface SummarizeProgress {
+interface SummarizeProgress {
     /** Latest checklist write (TodoWrite / update_plan), when the session has one. */
     todos?: TodoProgress;
     /** Plan markdown from the last ExitPlanMode, when present. */
@@ -29,7 +29,7 @@ export interface SummarizeProgress {
     steps?: string[];
 }
 /** The validated model output. `at` timestamps are stamped by the caller. */
-export interface SummarizeResult {
+interface SummarizeResult {
     goal: string;
     /** Progress checkpoints, newest last (short lines). */
     checkpoints: string[];
@@ -39,7 +39,7 @@ export interface SummarizeResult {
         done: boolean;
     }[];
 }
-export interface SummarizeOptions {
+interface SummarizeOptions {
     baseUrl: string;
     model: string;
     maxTokens?: number;
@@ -73,3 +73,4 @@ export declare function extractJsonObject(text: string): string | undefined;
  * failure (the caller then marks the session `summaryState: 'skipped'`).
  */
 export declare function summarize(prompt: string, progress: SummarizeProgress, opts: SummarizeOptions): Promise<SummarizeResult | undefined>;
+export {};

package/dist/lib/sync-passphrase.d.ts

@@ -5,8 +5,8 @@ export declare const LEGACY_PASSPHRASE_ENV = "AGENTS_SECRETS_PASSPHRASE";
 /** Reset the one-shot warning latches. Tests only — production never re-warns. */
 export declare function resetSyncPassphraseWarnings(): void;
 /** Where a resolved sync passphrase came from, so callers can report honestly. */
-export type SyncPassphraseSource = 'sync-env' | 'legacy-env' | null;
-export interface ResolvedSyncPassphrase {
+type SyncPassphraseSource = 'sync-env' | 'legacy-env' | null;
+interface ResolvedSyncPassphrase {
     value: string | null;
     source: SyncPassphraseSource;
 }
@@ -25,3 +25,4 @@ export declare function resolveSyncPassphraseFromEnv(): ResolvedSyncPassphrase;
 export declare function warnEnvPassphraseReadableOnce(): void;
 /** The message a headless caller shows when no passphrase is available. */
 export declare function missingSyncPassphraseMessage(): string;
+export {};