@phnx-labs/agents-cli 1.22.119 → 1.22.121

package/dist/lib/onepassword.js

@@ -1,6 +1,3 @@
-/**
- * 1Password CLI (op) integration for importing secrets from vaults.
- */
 import { spawnSync } from 'child_process';
 function runOp(args, input) {
     const result = spawnSync('op', args, {
@@ -56,16 +53,13 @@ function pickBestField(fields) {
         !SKIP_FIELD_LABELS.has(f.label?.toLowerCase() || ''));
     if (dominated.length === 0)
         return null;
-    // Prefer concealed fields (credentials/passwords)
     const concealed = dominated.find((f) => f.type.toLowerCase() === 'concealed');
     if (concealed)
         return concealed;
-    // Then prefer fields labeled credential/password/secret/key/token
     const secretLabels = ['credential', 'password', 'secret', 'key', 'token', 'api_key', 'apikey'];
     const labeled = dominated.find((f) => secretLabels.includes(f.label?.toLowerCase() || ''));
     if (labeled)
         return labeled;
-    // Fall back to first importable field
     return dominated[0];
 }
 /**
@@ -83,12 +77,6 @@ function pickNotes(fields) {
     const value = notes?.value?.trim();
     return value ? value : undefined;
 }
-/**
- * Pure transform from a fetched 1Password item to an importable secret (or the
- * reason it was skipped). Split out of extractSecrets so the field-selection
- * and notes-extraction logic is exercised directly by tests without shelling
- * out to `op`.
- */
 export function itemToSecret(item) {
     const field = pickBestField(item.fields || []);
     if (!field) {

package/dist/lib/open-url.d.ts

@@ -1,4 +1,3 @@
-/** Where a "show the human this" call actually landed. */
 type ShowOutcome = {
     via: 'profile';
     profile: string;
@@ -11,51 +10,14 @@ type ShowOutcome = {
     reason: string;
 };
 interface ShowOptions {
-    /**
-     * Force the OS default handler, ignoring `browser.viewer`. This is the
-     * The programmatic escape hatch, for a caller that must use the user's own
-     * browser regardless of configuration. There is deliberately no CLI flag for
-     * it: `agents config set browser.viewer os` is the user-facing control.
-     */
     osBrowser?: boolean;
-    /** Explicit profile override, ahead of `browser.viewer`. */
     profile?: string;
-    /** Injected opener so the OS branch is testable without spawning anything. */
     spawnOpen?: (cmd: string, args: string[]) => boolean;
 }
-/**
- * Launch a detached opener and report whether it actually started.
- *
- * Detection without blocking, which is the whole trick here. A bare detached
- * `spawn` cannot tell success from "xdg-open is not installed" — it does not
- * throw for a missing binary, it emits `error` asynchronously — so the failure
- * branches of every caller were dead. But `spawnSync` is not the answer either:
- * it waits for the child's whole lifetime, and `devices lease` opens a console
- * and then immediately prompts for a pasted key, so a blocking open would stall
- * that prompt behind the browser.
- *
- * Racing `spawn` against `error` gives both: Node emits `spawn` as soon as the
- * child is successfully created (measured: 1ms, and it does NOT wait for exit),
- * and `error` for ENOENT. We unref on success so the opener outlives us.
- */
 export declare function trySpawn(cmd: string, args: string[]): Promise<boolean>;
-/**
- * Decide the viewer for this call. Exported for its own test — this is the one
- * place the policy lives.
- *
- * Every fall back to the OS handler prints one stderr line naming why. A silent
- * downgrade here is what made the original bug invisible for so long: the user
- * had configured a profile and had no way to see that it was being ignored.
- */
 export declare function resolveViewer(opts?: ShowOptions): Promise<'os' | {
     profile: string;
 }>;
-/** Show a URL to the human at this machine. Never throws. */
 export declare function showUrl(url: string, opts?: ShowOptions): Promise<ShowOutcome>;
-/**
- * Show a local file. Browser-renderable kinds go through {@link showUrl}; every
- * other kind goes to the OS default APP, which for a screenshot or a recording
- * is the right viewer.
- */
 export declare function showFile(filePath: string, opts?: ShowOptions): Promise<ShowOutcome>;
 export {};

package/dist/lib/open-url.js

@@ -1,41 +1,12 @@
-/**
- * The one place that decides WHERE a URL or file is shown to the human.
- *
- * Two browsers exist on a machine like this: the OS default handler, and the
- * profile `agents browser` drives. They are not interchangeable. The configured
- * profile is where the fleet's logins accumulate — `agents browser profiles
- * logins` lists them — so a page opened there is a page the user is already
- * signed in for, and a login acquired there is inherited by every later agent.
- * The OS handler has none of that.
- *
- * Before this seam existed, `agents browser navigate` honoured the configured
- * profile and nothing else did: `devices lease`, `feedback`, and
- * the browser-session artifact opener each shelled straight to `open`/`xdg-open`,
- * so every one of them landed in whatever the OS handler happened to be. This
- * module replaces all of those call sites; do not add a new raw `open`.
- *
- * Never throws. A viewer that cannot be reached degrades to the OS handler with
- * one stderr line naming the reason, and a total failure returns `via: 'none'`
- * so the caller can print the URL rather than silently doing nothing.
- */
 import { spawn } from 'child_process';
 import * as path from 'path';
 import { pathToFileURL } from 'url';
-/**
- * Extensions a CDP tab renders at least as well as the OS default app.
- *
- * Deliberately narrow. `sessions-list.ts` EXT_KIND covers .png/.jpg/.webp/.pdf/
- * .webm, and for those Preview and QuickTime are the better viewer — routing a
- * screenshot into a browser tab is a downgrade, not a fix.
- */
 const BROWSER_RENDERABLE = new Set(['.html', '.htm', '.svg', '.xhtml']);
 async function osOpen(target, spawnOpen) {
     const candidates = process.platform === 'darwin'
         ? [['open', [target]]]
         : process.platform === 'win32'
-            ? // `start` treats a lone quoted first argument as the window TITLE, so the
-                // empty title placeholder is required before the target. The three copies
-                // of this that predated the seam disagreed on it ('' vs '""').
+            ?
                 [['cmd', ['/c', 'start', '', target]]]
             : [
                 ['xdg-open', [target]],
@@ -52,21 +23,6 @@ async function osOpen(target, spawnOpen) {
     }
     return { via: 'none', reason: 'no working OS opener on this platform' };
 }
-/**
- * Launch a detached opener and report whether it actually started.
- *
- * Detection without blocking, which is the whole trick here. A bare detached
- * `spawn` cannot tell success from "xdg-open is not installed" — it does not
- * throw for a missing binary, it emits `error` asynchronously — so the failure
- * branches of every caller were dead. But `spawnSync` is not the answer either:
- * it waits for the child's whole lifetime, and `devices lease` opens a console
- * and then immediately prompts for a pasted key, so a blocking open would stall
- * that prompt behind the browser.
- *
- * Racing `spawn` against `error` gives both: Node emits `spawn` as soon as the
- * child is successfully created (measured: 1ms, and it does NOT wait for exit),
- * and `error` for ENOENT. We unref on success so the opener outlives us.
- */
 export function trySpawn(cmd, args) {
     return new Promise((resolve) => {
         let settled = false;
@@ -89,24 +45,10 @@ export function trySpawn(cmd, args) {
         }
     });
 }
-/**
- * Decide the viewer for this call. Exported for its own test — this is the one
- * place the policy lives.
- *
- * Every fall back to the OS handler prints one stderr line naming why. A silent
- * downgrade here is what made the original bug invisible for so long: the user
- * had configured a profile and had no way to see that it was being ignored.
- */
 export async function resolveViewer(opts = {}) {
     if (opts.osBrowser)
         return 'os';
     const { getConfigValue } = await import('./device-config.js');
-    // A configured viewer, else the profile agents drive (`browser.profile`) — the
-    // whole point is that a machine with a configured browser stops leaking pages
-    // to the OS handler. Both keys are shared with the standalone `browser` CLI,
-    // whose `show` verb applies exactly this precedence itself; agents-cli resolves
-    // the NAME only to decide viewer-vs-OS, then delegates suitability (Arc/Firefox/
-    // launchable-here) to the engine (PHNX-4101).
     const name = opts.profile
         ?? (getConfigValue('browser.viewer').value || undefined)
         ?? (getConfigValue('browser.profile').value || undefined);
@@ -114,15 +56,10 @@ export async function resolveViewer(opts = {}) {
         return 'os';
     return { profile: name };
 }
-/** Show a URL to the human at this machine. Never throws. */
 export async function showUrl(url, opts = {}) {
     const viewer = await resolveViewer(opts);
     if (viewer === 'os')
         return osOpen(url, opts.spawnOpen);
-    // Delegate to the standalone `browser show`, which opens the URL in the viewer
-    // profile (or `browser.viewer`/`browser.profile`) and owns its own service
-    // lifecycle and viewer-suitability fallbacks. When the engine is not installed,
-    // or the call fails, degrade to the OS handler with one stderr line.
     try {
         const { browserInstalled, runBrowser } = await import('./browser-client.js');
         if (!browserInstalled()) {
@@ -143,11 +80,6 @@ export async function showUrl(url, opts = {}) {
     }
     return osOpen(url, opts.spawnOpen);
 }
-/**
- * Show a local file. Browser-renderable kinds go through {@link showUrl}; every
- * other kind goes to the OS default APP, which for a screenshot or a recording
- * is the right viewer.
- */
 export async function showFile(filePath, opts = {}) {
     if (!BROWSER_RENDERABLE.has(path.extname(filePath).toLowerCase())) {
         return osOpen(filePath, opts.spawnOpen);

package/dist/lib/openclaw-keychain.js

@@ -11,14 +11,9 @@ import { getCliLaunch } from './cli-entry.js';
 function buildAddGenericPasswordArgs(account, item) {
     return ['add-generic-password', '-U', '-a', account, '-s', item, '-w'];
 }
-/**
- * spawnSync options for the bare `-w` keychain write. `input` pipes the value
- * TWICE (bare `-w` prompts enter+confirm; one line fails the confirm and stores
- * an empty secret). `detached: true` runs `security` in a new session with no
- * controlling terminal, so readpassphrase(3) falls back to our piped stdin
- * instead of prompting the user's `/dev/tty` in an interactive shell.
- */
 function buildAddGenericPasswordSpawnOptions(value) {
+    // Bare security -w prompts twice. Pipe the value twice and detach so it reads
+    // stdin instead of prompting on the controlling /dev/tty.
     return {
         input: `${value}\n${value}\n`,
         stdio: ['pipe', 'pipe', 'pipe'],

package/dist/lib/operator.d.ts

@@ -12,15 +12,6 @@ export declare function getOperator(id: string, root?: string): Operator | undef
 export declare function isKnownOperator(id: string, root?: string): boolean;
 export declare function isAdmin(id: string, root?: string): boolean;
 export declare function canPerform(id: string, action: string, root?: string): boolean;
-/** High-consequence blocks require a known operator with explicit merge/deploy/admin rights. */
 export declare function isHighConsequenceAllowed(blockConsequence: string | undefined, operatorId: string, root?: string): boolean;
-/**
- * Prove operator identity for high-consequence answers.
- *
- * Knowing an id listed in operators.yaml is not authentication — any same-user
- * process can pass `--as muqsit`. Require the process environment to claim the
- * same id via AGENTS_OPERATOR_ID (typically injected by `agents secrets` /
- * the human's launch context).
- */
 export declare function verifyOperatorIdentity(claimedId: string | undefined, root?: string): boolean;
 export {};

package/dist/lib/operator.js

@@ -1,27 +1,3 @@
-/**
- * Operator identity registry for multi-human feed controls.
- *
- * The mailbox `from` label is caller-supplied and unverified (same-user-writable).
- * For routine answers that's fine; for high-consequence blocks (merge/deploy/admin)
- * we need a verified operator identity. This module loads a local registry of
- * operators from ~/.agents/operators.yaml and provides the authz check used by
- * `recordAnswer` and `agents message --as`.
- *
- * Registry format (YAML):
- *   operators:
- *     muqsit:
- *       name: Muqsit
- *       admin: true
- *     bisma:
- *       name: Bisma
- *       can:
- *         - merge
- *         - deploy
- *
- * For this release identity is proven by knowing the operator id (local registry
- * membership). A future release can add public-key/totp challenge without changing
- * the call sites.
- */
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
@@ -55,7 +31,6 @@ export function loadOperators(root) {
         }
     }
     catch {
-        // missing or malformed -> empty registry
     }
     return { operators: {} };
 }
@@ -77,7 +52,6 @@ export function canPerform(id, action, root) {
         return true;
     return op.can?.includes(action) ?? false;
 }
-/** High-consequence blocks require a known operator with explicit merge/deploy/admin rights. */
 export function isHighConsequenceAllowed(blockConsequence, operatorId, root) {
     if (!blockConsequence || blockConsequence === 'normal')
         return true;
@@ -87,14 +61,6 @@ export function isHighConsequenceAllowed(blockConsequence, operatorId, root) {
         return true;
     return canPerform(operatorId, blockConsequence, root);
 }
-/**
- * Prove operator identity for high-consequence answers.
- *
- * Knowing an id listed in operators.yaml is not authentication — any same-user
- * process can pass `--as muqsit`. Require the process environment to claim the
- * same id via AGENTS_OPERATOR_ID (typically injected by `agents secrets` /
- * the human's launch context).
- */
 export function verifyOperatorIdentity(claimedId, root) {
     if (!claimedId)
         return false;

package/dist/lib/origin-machine.d.ts

@@ -1,18 +1,2 @@
-/**
- * Resolve which machine a session transcript originated on.
- *
- * Cross-machine sync mirrors a remote transcript to
- * `backups/<agent>/<machine>/<subdir>/…`. Every other transcript is a live-home
- * file on this box, so the origin is the local machine id.
- *
- * Kept in a leaf module (no session/db imports) so both discovery and the
- * sessions DB upsert path can stamp `machine` without circular deps.
- */
-/** Local machine id, cached for the process lifetime. */
 export declare function localMachineId(): string;
-/**
- * The machine a discovered session originated on.
- * When the path sits under the agent's backups root, the first segment below it
- * is the origin machine id; otherwise it's the local machine.
- */
 export declare function machineForSessionFile(filePath: string, agent: string): string;

package/dist/lib/origin-machine.js

@@ -1,26 +1,10 @@
-/**
- * Resolve which machine a session transcript originated on.
- *
- * Cross-machine sync mirrors a remote transcript to
- * `backups/<agent>/<machine>/<subdir>/…`. Every other transcript is a live-home
- * file on this box, so the origin is the local machine id.
- *
- * Kept in a leaf module (no session/db imports) so both discovery and the
- * sessions DB upsert path can stamp `machine` without circular deps.
- */
 import * as path from 'path';
 import { getHistoryDir } from './state.js';
 import { machineId } from './machine-id.js';
 let _localMachineId;
-/** Local machine id, cached for the process lifetime. */
 export function localMachineId() {
     return (_localMachineId ??= machineId());
 }
-/**
- * The machine a discovered session originated on.
- * When the path sits under the agent's backups root, the first segment below it
- * is the origin machine id; otherwise it's the local machine.
- */
 export function machineForSessionFile(filePath, agent) {
     if (!filePath)
         return localMachineId();

package/dist/lib/output/git-output.d.ts

@@ -1,64 +1,33 @@
-/** Commit tally for one author email. */
 interface AuthorCommits {
     author: string;
     commits: number;
 }
-/** The shipped-work rollup for a window. */
 interface GitOutputSummary {
     reposScanned: number;
     commits: number;
     byAuthor: AuthorCommits[];
     prsOpened: number;
     prsMerged: number;
-    /**
-     * Deduped commit SHAs authored by us in the window. Carried so `--all-hosts`
-     * can UNION across machines — a repo cloned on several boxes exposes the same
-     * commits to `git log` on each, so summing counts would multi-count.
-     */
     commitShas: string[];
-    /** false when `gh` is missing/unauthed — PR counts are then 0 and not trustworthy. */
     ghAvailable: boolean;
-    /** Author emails counted as "ours". */
     authors: string[];
-    /** gh logins queried for PRs. */
     logins: string[];
     sinceIso: string;
 }
 interface GitOutputOptions {
-    /** Root scanned for git repos (e.g. ~/src). */
     reposDir: string;
-    /** Window start, epoch ms. */
     sinceMs: number;
-    /** Restrict commit authorship to these emails; default: identities discovered from git config. */
     authors?: string[];
-    /** gh logins to search PRs for; default: the current `gh api user` login. */
     logins?: string[];
-    /** Repo discovery depth below reposDir (default 4 — covers ~/src/host/org/repo). */
     maxDepth?: number;
-    /** Query PRs via gh (default true). */
     includePrs?: boolean;
 }
-/**
- * Find git repositories under `root` up to `maxDepth` levels deep. A directory
- * with a `.git` entry is a repo and is NOT descended into (so nested worktrees
- * / submodules don't double-count).
- */
 export declare function findGitRepos(root: string, maxDepth?: number): string[];
-/**
- * Count commits by our authors across all repos, deduped by SHA (so the same
- * commit reachable via multiple repo clones/worktrees on this machine — or, at
- * the fleet layer, across machines — is counted once), tallied per email.
- */
 export declare function collectCommits(repos: string[], sinceIso: string, authors: string[]): Promise<{
     total: number;
     byAuthor: AuthorCommits[];
     shas: string[];
 }>;
-/** Format an epoch-ms as a YYYY-MM-DD date (UTC), for gh's date-range search. */
 export declare function toSearchDate(ms: number): string;
-/**
- * Collect the full shipped-work summary for a window: commits (across accounts)
- * plus PRs opened/merged.
- */
 export declare function collectGitOutput(options: GitOutputOptions): Promise<GitOutputSummary>;
 export {};

package/dist/lib/output/git-output.js

@@ -1,25 +1,10 @@
-/**
- * Git / GitHub "output" collector — the shipped-work half of `agents insights output`.
- *
- * `agents insights cost` answers "what did we burn?"; this answers "what did we ship?".
- * It counts commits (across every author identity, so multi-account totals stay
- * correct regardless of which `gh` login is active) and PRs opened / merged in a
- * time window. Pure `git`/`gh` over child_process — no server, no telemetry,
- * mirroring the offline spirit of the cost rollup.
- */
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 const execFileAsync = promisify(execFile);
-/** Directory names never descended into during repo discovery. */
 const SKIP_DIRS = new Set(['node_modules', '.git', '.agents', '.worktrees', 'dist', 'build', '.next', '.cache']);
-/**
- * Find git repositories under `root` up to `maxDepth` levels deep. A directory
- * with a `.git` entry is a repo and is NOT descended into (so nested worktrees
- * / submodules don't double-count).
- */
 export function findGitRepos(root, maxDepth = 4) {
     const repos = [];
     const walk = (dir, depth) => {
@@ -28,11 +13,11 @@ export function findGitRepos(root, maxDepth = 4) {
             entries = fs.readdirSync(dir, { withFileTypes: true });
         }
         catch {
-            return; // unreadable dir — skip
+            return;
         }
         if (entries.some(e => e.name === '.git')) {
             repos.push(dir);
-            return; // don't descend into a repo
+            return;
         }
         if (depth >= maxDepth)
             return;
@@ -45,7 +30,6 @@ export function findGitRepos(root, maxDepth = 4) {
     walk(root, 0);
     return repos;
 }
-/** git log for one repo (SHA + author email per commit), tolerant of empty/broken repos. */
 async function repoLog(repoDir, sinceIso) {
     try {
         const { stdout } = await execFileAsync('git', ['-C', repoDir, 'log', '--all', '--no-merges', `--since=${sinceIso}`, '--pretty=format:%H%x09%ae'], { maxBuffer: 64 * 1024 * 1024 });
@@ -59,13 +43,9 @@ async function repoLog(repoDir, sinceIso) {
         return refs;
     }
     catch {
-        return []; // no commits yet / not a real repo / detached weirdness
+        return [];
     }
 }
-/**
- * Discover the user's own author emails so commit counts exclude teammates.
- * Union of `git config --global user.email` and each repo's local `user.email`.
- */
 async function discoverAuthorEmails(repos) {
     const emails = new Set();
     try {
@@ -75,7 +55,6 @@ async function discoverAuthorEmails(repos) {
             emails.add(e.toLowerCase());
     }
     catch {
-        /* no global identity */
     }
     await Promise.all(repos.map(async (repo) => {
         try {
@@ -85,16 +64,10 @@ async function discoverAuthorEmails(repos) {
                 emails.add(e.toLowerCase());
         }
         catch {
-            /* repo has no local identity */
         }
     }));
     return [...emails];
 }
-/**
- * Count commits by our authors across all repos, deduped by SHA (so the same
- * commit reachable via multiple repo clones/worktrees on this machine — or, at
- * the fleet layer, across machines — is counted once), tallied per email.
- */
 export async function collectCommits(repos, sinceIso, authors) {
     const ours = new Set(authors.map(a => a.toLowerCase()));
     const tally = new Map();
@@ -106,7 +79,7 @@ export async function collectCommits(repos, sinceIso, authors) {
             if (ours.size > 0 && !ours.has(key))
                 continue;
             if (seen.has(sha))
-                continue; // same commit seen via another clone/ref
+                continue;
             seen.add(sha);
             tally.set(key, (tally.get(key) ?? 0) + 1);
         }
@@ -116,7 +89,6 @@ export async function collectCommits(repos, sinceIso, authors) {
         .sort((a, b) => b.commits - a.commits);
     return { total: seen.size, byAuthor, shas: [...seen] };
 }
-/** Resolve the current gh login, or null if gh is unavailable/unauthed. */
 async function currentGhLogin() {
     try {
         const { stdout } = await execFileAsync('gh', ['api', 'user', '--jq', '.login']);
@@ -127,7 +99,6 @@ async function currentGhLogin() {
         return null;
     }
 }
-/** Count PRs matching a gh search query (author + date), returning null on failure. */
 async function ghSearchCount(args) {
     try {
         const { stdout } = await execFileAsync('gh', [...args, '--limit', '1000', '--json', 'number'], {
@@ -140,11 +111,6 @@ async function ghSearchCount(args) {
         return null;
     }
 }
-/**
- * Count PRs opened and merged in the window across the given logins. `gh search
- * prs` searches all of GitHub, so one authed gh can cover multiple accounts'
- * logins. Returns ghAvailable=false if gh can't be reached at all.
- */
 async function collectPrs(logins, sinceDate) {
     let resolved = logins;
     if (resolved.length === 0) {
@@ -170,14 +136,9 @@ async function collectPrs(logins, sinceDate) {
     }
     return { opened, merged, logins: resolved, ghAvailable: anyOk };
 }
-/** Format an epoch-ms as a YYYY-MM-DD date (UTC), for gh's date-range search. */
 export function toSearchDate(ms) {
     return new Date(ms).toISOString().slice(0, 10);
 }
-/**
- * Collect the full shipped-work summary for a window: commits (across accounts)
- * plus PRs opened/merged.
- */
 export async function collectGitOutput(options) {
     const reposDir = options.reposDir.replace(/^~(?=$|\/)/, os.homedir());
     const sinceIso = new Date(options.sinceMs).toISOString();

package/dist/lib/overdue.d.ts

@@ -1,44 +1,9 @@
-/**
- * Overdue routine detection.
- *
- * When the daemon was not running (laptop off, reboot, daemon crash) at the
- * time a job was supposed to fire, the missed schedule is lost — croner only
- * schedules forward from "now." This module compares each enabled job's
- * most-recent expected fire time (from its cron expression) with the start
- * time of its most-recent recorded run; jobs whose latest run is older than
- * their most-recent expected fire are flagged as overdue.
- *
- * Surfaced two ways: a desktop notification on daemon startup, and a
- * `agents routines catchup` command that runs them on demand.
- */
 import { type JobConfig } from './scheduling/routines.js';
 export interface OverdueJob {
     name: string;
-    /** Most recent expected fire time per the cron expression. */
     expectedAt: Date;
-    /** Start time of the most recent recorded run, or null if never run. */
     lastRanAt: Date | null;
 }
-/**
- * When a routine started existing, and therefore the earliest fire it can
- * sensibly be judged against.
- *
- * `createdAt` is stamped by `writeJob`. Routines written before that field
- * existed have none, so the file's own mtime stands in — it is the closest
- * honest answer available on disk, and it only ever moves the floor later,
- * never earlier, so it cannot manufacture a false "overdue".
- *
- * Returns null when neither is available, which leaves the routine unfloored
- * (previous behaviour) rather than silently skipping it.
- */
 export declare function routineEffectiveStart(job: JobConfig, now?: Date): Date | null;
-/** Return every enabled, recurring job whose most recent expected fire was
- *  missed. One-shot jobs are excluded — they fire at most once. */
 export declare function detectOverdueJobs(now?: Date): OverdueJob[];
-/**
- * Fire a branded desktop notification listing the overdue jobs. Routed through
- * the MenubarHelper companion (notify-desktop.ts) so it carries the agents-cli
- * mark; clicking opens the runs folder (~/.agents/.history/runs). Best-effort —
- * a missing notifier or absent display is swallowed and never crashes the daemon.
- */
 export declare function notifyOverdue(jobs: OverdueJob[]): void;