@phnx-labs/agents-cli 1.22.119 → 1.22.121

package/dist/lib/quick-todo.js

@@ -0,0 +1,243 @@
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+const execFileAsync = promisify(execFile);
+export const QUICK_TODO_MARKER = 'Created from AGI Menu';
+export const TODO_LIST_LIMIT = 6;
+export const UNDO_CREATE_WINDOW_MS = 30_000;
+const CLOCK_SKEW_MS = 5_000;
+export const ADD_PRIORITIES = ['urgent', 'high', 'medium', 'low', 'none'];
+export const TITLE_MIN = 3;
+export const TITLE_MAX = 120;
+export const DESCRIPTION_MAX = 10_000;
+const DAYS = ['sun', 'mon', 'tue', 'wed', 'thu', 'fri', 'sat'];
+const DAY_WORD = /^(today|tomorrow|sun(?:day)?|mon(?:day)?|tue(?:s|sday)?|wed(?:nesday)?|thu(?:rs|rsday)?|fri(?:day)?|sat(?:urday)?)$/i;
+export function localDay(date) {
+    const p = (n) => String(n).padStart(2, '0');
+    return `${date.getFullYear()}-${p(date.getMonth() + 1)}-${p(date.getDate())}`;
+}
+export function resolveDayWord(word, now) {
+    const w = word.toLowerCase();
+    const day = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+    if (w === 'tomorrow')
+        day.setDate(day.getDate() + 1);
+    else if (w !== 'today')
+        day.setDate(day.getDate() + ((DAYS.indexOf(w.slice(0, 3)) - day.getDay() + 7) % 7));
+    return localDay(day);
+}
+const TAG = /^#([\p{L}\p{N}_.-]+)$/u;
+const BANGS = /^!+$/;
+const clean = (token) => token.replace(/[,.;:]+$/, '');
+export function parseQuickTodo(text, now) {
+    let project = null;
+    let due = null;
+    let priority = null;
+    const tokens = text.trim().split(/\s+/).filter(Boolean);
+    let end = tokens.length;
+    while (end > 0) {
+        const t = clean(tokens[end - 1]);
+        if (!(DAY_WORD.test(t) || BANGS.test(t) || TAG.test(t)))
+            break;
+        end--;
+    }
+    const words = [];
+    tokens.forEach((token, i) => {
+        const t = i >= end ? clean(token) : token;
+        const tag = t.match(TAG);
+        if (tag && project === null)
+            project = tag[1];
+        else if (i >= end && DAY_WORD.test(t) && due === null)
+            due = resolveDayWord(t, now);
+        else if (i >= end && BANGS.test(t) && priority === null)
+            priority = t.length >= 2 ? 'urgent' : 'high';
+        else
+            words.push(token);
+    });
+    return { title: words.join(' '), project, due, priority };
+}
+export function linearProjectFor(token, defs) {
+    const def = defs.find((d) => d.name.toLowerCase() === token.toLowerCase() || d.linear?.name?.toLowerCase() === token.toLowerCase());
+    if (!def)
+        return token;
+    if (!def.linear?.name && !def.linear?.projectId) {
+        throw new Error(`Project "${def.name}" has no Linear project; bind one with: agents projects link ${def.name}`);
+    }
+    return def.linear.name ?? def.linear.projectId;
+}
+export const linearExec = async (args) => {
+    try {
+        const { stdout, stderr } = await execFileAsync('linear', args, { timeout: 30_000, maxBuffer: 32 * 1024 * 1024, encoding: 'utf-8' });
+        return { stdout, stderr };
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT') {
+            throw Object.assign(new Error('The linear CLI is not on PATH; install linear-cli and run linear setup.'), { stderr: '' });
+        }
+        throw err;
+    }
+};
+export function linearFailure(err) {
+    const stderr = String(err?.stderr ?? '').trim();
+    const lines = stderr.split('\n').map((l) => l.trim()).filter(Boolean);
+    const line = [...lines].reverse().find((l) => /^Error:/i.test(l)) ?? lines[0];
+    if (line)
+        return line.replace(/^Error:\s*/i, '');
+    if (err?.killed)
+        return 'linear did not answer within 30 s';
+    return err instanceof Error ? err.message : String(err);
+}
+export function toQuickTodo(issue) {
+    return {
+        identifier: String(issue.identifier ?? ''),
+        url: issue.url || null,
+        title: String(issue.title ?? ''),
+        project: issue.project?.name || null,
+        due: issue.dueDate || null,
+        priority: typeof issue.priority === 'number' ? issue.priority : 0,
+        state: issue.state?.name ?? '',
+        createdAt: String(issue.createdAt ?? ''),
+        quick: (issue.description ?? '').split('\n').some((l) => l.trim() === QUICK_TODO_MARKER),
+    };
+}
+async function readIssue(id, linear) {
+    return JSON.parse((await linear(['tasks', id, '--json'])).stdout);
+}
+export function addRefusal(title, opts) {
+    const length = [...title].length;
+    if (length === 0)
+        return 'The to-do has no words besides its #project, day and priority.';
+    if (length < TITLE_MIN)
+        return `The title needs at least ${TITLE_MIN} characters.`;
+    if (length > TITLE_MAX)
+        return `The title is ${length} characters; the limit is ${TITLE_MAX}. Put the rest in the description.`;
+    if (opts.description && [...opts.description].length > DESCRIPTION_MAX) {
+        return `The description is over ${DESCRIPTION_MAX.toLocaleString('en-US')} characters.`;
+    }
+    if (opts.due !== undefined) {
+        const m = opts.due.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+        const date = m && new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+        if (!date || localDay(date) !== opts.due)
+            return `Expected a due date like 2026-10-09, got "${opts.due}".`;
+        if (opts.due < localDay(opts.now))
+            return `The due date ${opts.due} is in the past.`;
+    }
+    if (opts.priority !== undefined && !ADD_PRIORITIES.includes(opts.priority)) {
+        return `Expected a priority of ${ADD_PRIORITIES.join(', ')}, got "${opts.priority}".`;
+    }
+    return null;
+}
+export async function addQuickTodo(text, opts, linear = linearExec) {
+    const parsed = parseQuickTodo(text, opts.now);
+    const due = opts.due ?? parsed.due;
+    const priority = opts.priority ?? parsed.priority ?? 'none';
+    const refusal = addRefusal(parsed.title, opts);
+    if (refusal)
+        return { ok: false, todo: null, message: refusal };
+    const description = opts.description?.trim() ? `${opts.description.trim()}\n\n${QUICK_TODO_MARKER}` : QUICK_TODO_MARKER;
+    const token = opts.project ?? parsed.project ?? null;
+    const args = ['create', '--description', description, '--status', 'Todo', '--cycle', 'active',
+        '--skip-milestone', '--priority', priority];
+    try {
+        if (token)
+            args.push('--project', linearProjectFor(token, opts.defs));
+    }
+    catch (err) {
+        return { ok: false, todo: null, message: err.message };
+    }
+    if (due)
+        args.push('--due-date', due);
+    const assignee = opts.assignee?.trim();
+    if (assignee && assignee.toLowerCase() !== 'me')
+        args.push('--assign', assignee);
+    args.push('--', parsed.title);
+    let out;
+    try {
+        out = await linear(args);
+    }
+    catch (err) {
+        return { ok: false, todo: null, message: linearFailure(err) };
+    }
+    const id = out.stdout.match(/^Created ([A-Z][A-Z0-9]*-\d+):/m)?.[1];
+    if (!id) {
+        const error = out.stderr.split('\n').map((l) => l.trim()).reverse().find((l) => /^Error:/i.test(l));
+        return { ok: false, todo: null, message: error ? error.replace(/^Error:\s*/i, '') : 'linear create did not report an issue' };
+    }
+    try {
+        return { ok: true, todo: toQuickTodo(await readIssue(id, linear)), message: `Created ${id}` };
+    }
+    catch (err) {
+        const todo = {
+            identifier: id, url: null, title: parsed.title, project: null, due,
+            priority: Math.max(0, ['none', 'urgent', 'high', 'medium', 'low'].indexOf(priority)), state: 'Todo', createdAt: '', quick: true,
+        };
+        return { ok: true, todo, message: `Created ${id}; reading it back failed: ${linearFailure(err)}` };
+    }
+}
+export async function listQuickTodos(now, linear = linearExec) {
+    const parsed = JSON.parse((await linear(['tasks', '--assignee', 'me', '--status', 'open', '--cycle', 'all', '--all', '--json'])).stdout);
+    const today = localDay(now);
+    const due = (t) => t.due !== null && t.due <= today;
+    const all = (parsed.issues ?? []).map(toQuickTodo).filter((t) => t.quick || due(t));
+    all.sort((a, b) => {
+        if (due(a) !== due(b))
+            return due(a) ? -1 : 1;
+        if (due(a) && a.due !== b.due)
+            return a.due < b.due ? -1 : 1;
+        return b.createdAt.localeCompare(a.createdAt);
+    });
+    return { todos: all.slice(0, TODO_LIST_LIMIT), total: all.length };
+}
+export const DONE_PROOF = 'Checked off in AGI Menu';
+async function readStates(linear) {
+    return JSON.parse((await linear(['states', '--json'])).stdout);
+}
+export async function completeTodo(id, linear = linearExec) {
+    try {
+        const update = await linear(['update', id, '--done', '--proof', DONE_PROOF]);
+        const [raw, states] = await Promise.all([readIssue(id, linear), readStates(linear)]);
+        const todo = toQuickTodo(raw);
+        if (states.find((s) => s.name === todo.state)?.type === 'completed')
+            return { ok: true, todo, message: `${id} marked Done` };
+        const said = update.stdout.trim().split('\n').at(-1) || `${id} is still ${todo.state}`;
+        return { ok: false, todo, message: `Not closed yet: ${said}` };
+    }
+    catch (err) {
+        return { ok: false, todo: null, message: linearFailure(err) };
+    }
+}
+/**
+ * Undo the last menu action on an issue: a completed one goes back to Todo; a
+ * quick to-do still open and created within {@link UNDO_CREATE_WINDOW_MS} is
+ * canceled (moved to the team's canceled state). Anything else is refused, so an
+ * Undo never silently does nothing.
+ */
+export async function undoTodo(id, now, linear = linearExec) {
+    let issue;
+    let states;
+    try {
+        const [raw, read] = await Promise.all([readIssue(id, linear), readStates(linear)]);
+        issue = toQuickTodo(raw);
+        states = read;
+    }
+    catch (err) {
+        return { ok: false, todo: null, message: linearFailure(err) };
+    }
+    const type = states.find((s) => s.name === issue.state)?.type;
+    try {
+        if (type === 'completed') {
+            await linear(['update', id, '--todo']);
+            return { ok: true, todo: toQuickTodo(await readIssue(id, linear)), message: `${id} back to Todo` };
+        }
+        const age = now.getTime() - Date.parse(issue.createdAt);
+        if (issue.quick && type !== 'canceled' && age >= -CLOCK_SKEW_MS && age <= UNDO_CREATE_WINDOW_MS) {
+            const canceled = states.find((s) => s.type === 'canceled')?.name;
+            if (!canceled)
+                return { ok: false, todo: issue, message: 'The team has no canceled state to undo into' };
+            await linear(['update', id, '--status', canceled]);
+            return { ok: true, todo: toQuickTodo(await readIssue(id, linear)), message: `${id} canceled` };
+        }
+    }
+    catch (err) {
+        return { ok: false, todo: issue, message: linearFailure(err) };
+    }
+    return { ok: false, todo: issue, message: `${id} is ${issue.state || 'open'} and was not just created here; change it in Linear` };
+}

package/dist/lib/reconcile-and-repair.d.ts

@@ -1,21 +1,3 @@
-/**
- * Post-reconcile repair — the shared "make it whole" pass `agents sync` runs
- * after its prune+write, so sync is a true superset of the old `doctor --fix`.
- *
- * `syncResourcesToVersion` reconciles resource FILES (and, with a caller
- * selection, prunes orphans). It does NOT: fill live-home gaps the staleness
- * manifest can't see, generate/repair the managed hook runtime shims, or re-wire
- * a present-but-unwired hook into settings.json. `doctor --fix` used to do all of
- * that; now sync does, by calling this one routine at the tail of every reconcile.
- * (The destructive stale-CLI purge `doctor --fix` also ran is NOT automatic here
- * — it runs only via the explicit `agents sync --prune-clis`, see `pruneClis`.)
- *
- * Ordering matters: sync's own prune+write happens FIRST (unchanged), THEN this
- * repair pass. Prune stays sync's job; heal only FILLS and FIXES (never deletes),
- * so the two never fight. Pure of stdout — returns a structured report;
- * `renderRepairAfterSync` prints it only when the caller is neither `--json` nor
- * `--quiet`.
- */
 import type { AgentId } from './types.js';
 import { type HealResult } from './heal.js';
 import { type SlotProjection } from './accounts/slots.js';
@@ -24,33 +6,18 @@ import { type RemediateStaleInstallsResult, type FindAgentsCliInstallsOptions }
 interface HookRewireResult {
     agent: AgentId;
     version: string;
-    /** Hooks newly wired into settings.json by this pass. */
     rewired: number;
-    /** Hooks still unwired after re-registering (source/home mismatch). */
     remaining: number;
-    /** Stable failure class; never expose a generated temporary shim pathname. */
     failure?: 'register-failed';
 }
 interface RepairAfterSyncReport {
     heal: HealResult;
     hookRewire: HookRewireResult[];
     hookRuntimeRepair: HookRuntimeRepairReport;
-    /** Only populated on the umbrella (no-agent) path; null otherwise. */
     staleInstallPurge: RemediateStaleInstallsResult | null;
-    /**
-     * Account slots re-projected from their harness's default version home
-     * (PHNX-3940): one entry per slot, with the artifacts pruned because the
-     * source no longer carries them. Errors are per-harness sentences.
-     */
     slotProjection: SlotProjection[];
     slotProjectionErrors: string[];
 }
-/**
- * Test/override hook that scopes the destructive stale-CLI purge to injected
- * paths so it NEVER touches real machine installs. `findAgentsCliInstalls`
- * hard-codes `/usr/local/lib/node_modules` et al. when `globalNodeModulesDirs` is
- * absent, so a purge is unsafe to run unscoped in a test — inject sandbox paths.
- */
 interface PurgeInjection {
     runningRoot?: string;
     runningVersion?: string;
@@ -59,60 +26,15 @@ interface PurgeInjection {
     dryRun?: boolean;
 }
 interface RepairAfterSyncOptions {
-    /** Scope the repair to one agent; omit for the umbrella sweep across all
-     *  installed agents. (The purge is NOT tied to this — see `pruneClis`.) */
     agent?: AgentId;
-    /** The versions of `agent` the sync just reconciled. Passing them scopes
-     *  heal + rewire + runtime-repair to exactly those homes; omitting lets heal
-     *  apply its own non-isolated sweep. */
     versions?: string[];
-    /** Resolution cwd for heal's diff. Defaults to heal's neutral home dir. */
     cwd?: string;
-    /** Run the DESTRUCTIVE machine-wide stale-CLI purge (`fs.rmSync`s other
-     *  agents-cli installs). Default false — the purge is NEVER automatic; it runs
-     *  only on the umbrella (no-agent) path AND only when the caller passed
-     *  `agents sync --prune-clis`. */
     pruneClis?: boolean;
-    /** Scope the purge scan+delete to injected paths (tests only). */
     purgeInjection?: PurgeInjection;
 }
-/**
- * Run the post-reconcile repair pass over the agents/versions a sync just
- * touched: heal live-home gaps (mode 'full', matching the old `doctor --fix`),
- * re-wire hooks the diff-driven heal leaves behind, run one bounded managed-hook
- * runtime repair, and — ONLY when `pruneClis` is set on the umbrella (no-agent)
- * path — purge stale/legacy agents-cli copies. The purge is never automatic.
- * Returns a full account; never writes to stdout.
- */
 export declare function repairAfterSync(opts: RepairAfterSyncOptions): Promise<RepairAfterSyncReport>;
-/** True when the repair pass changed (or attempted to change) anything. */
 export declare function repairChangedAnything(report: RepairAfterSyncReport): boolean;
-/**
- * True when the RECONCILE repair left a per-version problem a human must fix — an
- * unresolvable managed hook runtime shim, or a hook that could not be re-wired.
- * These gate a sync's `ok`/exit code (the yosemite-s1 class the old
- * `doctor --fix` surfaced).
- *
- * The machine-wide stale-CLI purge is deliberately EXCLUDED: a purge that could
- * not delete a system-wide install (typically `EACCES` on `/usr/local/...`, which
- * needs sudo) is a hygiene issue unrelated to whether the reconcile succeeded, so
- * it must not flip a fleet peer's `agents sync --json` to `ok: false`. Purge
- * failures stay fully visible — in the JSON `repair.staleInstallPurge.failed` and
- * the rendered `hold`/`manual` lines.
- */
 export declare function repairHadFailures(report: RepairAfterSyncReport): boolean;
-/**
- * Serialize the repair pass for a `--json` sync payload — the machine surface the
- * deleted `doctor --fix --json` used to carry (heal detail + hook rewire + hook
- * runtime repair + the umbrella stale-CLI purge). Attached under the `repair` key
- * so fleet fan-out sees what the reconcile fixed and whether anything still needs
- * a human (mirror `repairHadFailures`).
- */
 export declare function repairAfterSyncJson(report: RepairAfterSyncReport): Record<string, unknown>;
-/**
- * Print the repair pass's human-readable detail. Sync calls this only on the
- * interactive / non-json path; the header is emitted only when something actually
- * changed, so a clean sync stays quiet.
- */
 export declare function renderRepairAfterSync(report: RepairAfterSyncReport, log?: (s: string) => void): void;
 export {};

package/dist/lib/reconcile-and-repair.js

@@ -11,28 +11,14 @@ import * as path from 'path';
 import { fileURLToPath } from 'url';
 const __moduleDirname = path.dirname(fileURLToPath(import.meta.url));
 const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
-// Claude-family agents whose native hook wiring `checkVersionHookWiring` can
-// verify (and `registerHooksToSettings` re-wire).
 const HOOK_WIRING_FIX_AGENTS = ['claude', 'droid'];
-// ─── hook re-wire (files reconciled but not referenced in settings.json) ─────
-/**
- * Re-wire hooks that reconcile as files but are absent from settings.json.
- *
- * heal() only re-syncs resources the diff flags missing/diff; a hook whose file
- * is byte-identical to source but never referenced in settings.json is neither,
- * so heal walks past it. registerHooksToSettings (the same call `agents sync`
- * makes at versions.ts) regenerates the wiring, so run it for any Claude-family
- * version this repair targets that has unwired hooks. Only claude/droid — the
- * set checkVersionHookWiring can verify.
- */
 function rewireUnwiredHooks(agent, versions) {
+    // Repair only missing wiring in the supported set; never delete user hook entries.
     const out = [];
     const agents = agent
         ? (HOOK_WIRING_FIX_AGENTS.includes(agent) ? [agent] : [])
         : HOOK_WIRING_FIX_AGENTS;
     for (const a of agents) {
-        // Explicit versions (the sync's reconcile targets) are honoured as-is; a
-        // sweep excludes isolated copies, mirroring heal().
         const vers = agent && versions && versions.length > 0
             ? versions
             : listInstalledVersions(a).filter((v) => !isVersionIsolated(a, v));
@@ -54,9 +40,6 @@ function rewireUnwiredHooks(agent, versions) {
                 out.push({ agent: a, version, rewired: Math.max(0, need - remaining), remaining });
             }
             catch {
-                // A shim write can fail before the native config writer returns its own
-                // errors. Record the same stable class and keep the repair moving to the
-                // one bounded runtime repair pass below.
                 out.push({ agent: a, version, rewired: 0, remaining: need, failure: 'register-failed' });
             }
         }
@@ -66,8 +49,6 @@ function rewireUnwiredHooks(agent, versions) {
 function runtimeRepairFilter(agent, versions) {
     if (!agent)
         return undefined;
-    // A single concrete target narrows to that version. Broad selectors (@all,
-    // agent-only) still make one bounded repair pass for that harness.
     return {
         agent,
         ...(versions && versions.length === 1 ? { version: versions[0] } : {}),
@@ -83,7 +64,6 @@ function purgeStaleAgentsCliCopies(injection) {
     let runningRoot = injection?.runningRoot;
     if (!runningRoot) {
         try {
-            // resolveRunningPackageRoot walks up until package.json names this package.
             runningRoot = resolveRunningPackageRoot(__moduleDirname);
         }
         catch {
@@ -98,38 +78,21 @@ function purgeStaleAgentsCliCopies(injection) {
         ...(injection?.dryRun ? { dryRun: injection.dryRun } : {}),
     });
 }
-// ─── public entrypoint ────────────────────────────────────────────────────────
-/**
- * Run the post-reconcile repair pass over the agents/versions a sync just
- * touched: heal live-home gaps (mode 'full', matching the old `doctor --fix`),
- * re-wire hooks the diff-driven heal leaves behind, run one bounded managed-hook
- * runtime repair, and — ONLY when `pruneClis` is set on the umbrella (no-agent)
- * path — purge stale/legacy agents-cli copies. The purge is never automatic.
- * Returns a full account; never writes to stdout.
- */
 export async function repairAfterSync(opts) {
+    // Reconcile canonical resources before targeted fill/fix repairs.
     const healResult = await heal({
         mode: 'full',
         agent: opts.agent,
         versions: opts.agent ? opts.versions : undefined,
         ...(opts.cwd ? { cwd: opts.cwd } : {}),
     });
-    // Re-wire hooks the diff-driven heal leaves behind (present file, not wired).
     const hookRewire = rewireUnwiredHooks(opts.agent, opts.versions);
-    // One inspect→generate→verify pass after resource + native-wiring repair have
-    // settled. This routine never calls sync/register and never retries.
     const hookRuntimeRepair = repairManagedHookRuntimeArtifacts({
         filter: runtimeRepairFilter(opts.agent, opts.versions),
     });
-    // The stale-CLI purge is DESTRUCTIVE and NEVER automatic: it runs only on the
-    // umbrella (no-agent) path AND only when the caller opted in via
-    // `agents sync --prune-clis`. Drift-fixers above always run; this does not.
     const staleInstallPurge = (!opts.agent && opts.pruneClis === true)
         ? purgeStaleAgentsCliCopies(opts.purgeInjection)
         : null;
-    // Account slots follow the version home (PHNX-3940). `agents accounts add`
-    // projects a slot once; without this every later sync would update the
-    // version home and leave each slot on the resources it was cloned with.
     const slotProjection = [];
     const slotProjectionErrors = [];
     const slotAgents = opts.agent ? [opts.agent] : ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0);
@@ -153,7 +116,6 @@ export async function repairAfterSync(opts) {
         invalidateDoctorOverviewCache();
     return report;
 }
-/** True when the repair pass changed (or attempted to change) anything. */
 export function repairChangedAnything(report) {
     return (healChangedAnything(report.heal) ||
         report.hookRewire.some((r) => r.rewired > 0 || r.remaining > 0 || r.failure !== undefined) ||
@@ -163,30 +125,11 @@ export function repairChangedAnything(report) {
         report.slotProjection.length > 0 ||
         report.slotProjectionErrors.length > 0);
 }
-/**
- * True when the RECONCILE repair left a per-version problem a human must fix — an
- * unresolvable managed hook runtime shim, or a hook that could not be re-wired.
- * These gate a sync's `ok`/exit code (the yosemite-s1 class the old
- * `doctor --fix` surfaced).
- *
- * The machine-wide stale-CLI purge is deliberately EXCLUDED: a purge that could
- * not delete a system-wide install (typically `EACCES` on `/usr/local/...`, which
- * needs sudo) is a hygiene issue unrelated to whether the reconcile succeeded, so
- * it must not flip a fleet peer's `agents sync --json` to `ok: false`. Purge
- * failures stay fully visible — in the JSON `repair.staleInstallPurge.failed` and
- * the rendered `hold`/`manual` lines.
- */
 export function repairHadFailures(report) {
+    // Stale-install purge failures are reported separately, not as reconcile failure status.
     return (report.hookRewire.some((r) => r.failure !== undefined) ||
         report.hookRuntimeRepair.needsAttention.length > 0);
 }
-/**
- * Serialize the repair pass for a `--json` sync payload — the machine surface the
- * deleted `doctor --fix --json` used to carry (heal detail + hook rewire + hook
- * runtime repair + the umbrella stale-CLI purge). Attached under the `repair` key
- * so fleet fan-out sees what the reconcile fixed and whether anything still needs
- * a human (mirror `repairHadFailures`).
- */
 export function repairAfterSyncJson(report) {
     return {
         heal: report.heal,
@@ -198,7 +141,6 @@ export function repairAfterSyncJson(report) {
         hadFailures: repairHadFailures(report),
     };
 }
-// ─── rendering (human output; sync calls this only when !json && !quiet) ─────
 function renderHealText(result, log) {
     for (const r of result.repairedManifests) {
         log(`  ${chalk.green('repair')}  plugin ${chalk.bold(r.plugin)} ${chalk.gray(`— dropped invalid ${r.droppedFields.join(', ')} field`)}`);
@@ -272,11 +214,6 @@ function renderStaleInstallPurgeText(purge, log) {
         log(`         ${chalk.bold(u.manualRemoveCommand)}`);
     }
 }
-/**
- * Print the repair pass's human-readable detail. Sync calls this only on the
- * interactive / non-json path; the header is emitted only when something actually
- * changed, so a clean sync stays quiet.
- */
 export function renderRepairAfterSync(report, log = (s) => console.log(s)) {
     if (!repairChangedAnything(report))
         return;

package/dist/lib/redact.d.ts

@@ -1,33 +1,4 @@
-/**
- * Shared redaction helpers for text that may be exported or logged.
- */
-/**
- * Remove terminal control sequences from untrusted text before storage or display.
- *
- * A single forward scan, not a regex: an OSC lookup for its terminator (BEL or
- * ESC-\) is the classic polynomial-backtracking shape, and untrusted text can be
- * built to trigger it. Each character is visited a bounded number of times here.
- */
 export declare function sanitizeForTerminal(text: string): string;
-/**
- * Scrub secrets from `text`. Two passes: format-based patterns (above), then a
- * value-aware pass that masks any `knownValues` verbatim — a credential we
- * already hold in hand leaks regardless of its format, so an exact-value match
- * catches tokens the regexes don't recognize.
- */
 export declare function redactSecrets(text: string, knownValues?: readonly string[]): string;
-/**
- * Secret values already present in the environment (e.g. an injected secrets
- * bundle), selected by secret-shaped var NAME. These are the "known" values fed
- * to {@link redactSecrets} so an exported transcript can't leak a live
- * credential verbatim even when its format matches no pattern.
- */
 export declare function knownSecretValuesFromEnv(env?: NodeJS.ProcessEnv): string[];
-/**
- * Mask email addresses in already-rendered text. A published page's sensitive-
- * content scan refuses a body containing an email (`artifacts share` does the
- * same), and almost every real transcript carries a few — git author addresses,
- * `gh api user`, a pasted log. Masking them here means the page genuinely does
- * not carry them, rather than training callers to pass `--force`.
- */
 export declare function redactEmails(text: string): string;