@phnx-labs/agents-cli 1.22.119 → 1.22.121

package/dist/lib/secrets-types.d.ts

@@ -1,57 +1,26 @@
-/**
- * Wire-shared types for the standalone `secrets` CLI (PHNX-3989).
- *
- * The standalone engine (`@phnx-labs/secrets-cli`, extracted from what used to
- * be `cli/src/lib/secrets/**`) owns every one of these shapes; this module only
- * re-declares them so `secrets-client.ts` and its consumers keep exact static
- * types across the process-client boundary with no runtime dependency on the
- * (now deleted) in-repo engine. Keep byte-for-byte in sync with
- * `secrets-cli/src/schema.ts` / `src/core/bundles.ts` — this is the one seam
- * both sides legitimately re-declare rather than share a package for (see the
- * `secrets-client.ts` docblock).
- */
-/** Supported bundle storage backends. */
 export type SecretsBackend = 'keychain' | 'file' | 'vault';
-/** Supported secret resolution providers for a bundle var. */
 export type SecretProvider = 'keychain' | 'env' | 'file' | 'exec';
-/** A typed reference to a secret: a provider plus a provider-specific value. */
 export interface SecretRef {
     provider: SecretProvider;
     value: string;
 }
-/**
- * A bundle value: either a string (literal or provider-prefixed ref) or an
- * object `{value: string}` used to escape a literal that would otherwise be
- * parsed as a ref (e.g. a URL that happens to start with `env:`).
- */
 export type BundleValue = string | {
     value: string;
 };
-/** Remote (bundle@host) push destination backend. */
 export type RemoteBackend = 'keychain' | 'file';
 declare const SECRET_TYPES: readonly ["api-key", "token", "password", "url", "database-url", "ssh-key", "certificate", "webhook", "note"];
 type SecretType = (typeof SECRET_TYPES)[number];
-/** Per-secret metadata; absent fields are omitted at write time. */
 export interface VarMeta {
     type?: SecretType;
-    /** Future-dated ISO date ('YYYY-MM-DD'). */
     expires?: string;
     note?: string;
 }
-/**
- * Bundle prompt policy. `hold` (default): one Touch ID per hold window (~7d),
- * then silent via the secrets-agent. `always`: prompt every read. `never`: no
- * biometry ACL — least-safe, automation-only.
- */
 export type SecretsPolicy = 'always' | 'hold' | 'never';
-/** A named set of environment variable definitions backed by secret stores. */
 export interface SecretsBundle {
     name: string;
     description?: string;
     allow_exec?: boolean;
-    /** Absent ⇒ `keychain`. */
     backend?: SecretsBackend;
-    /** Absent ⇒ configured default (`hold`). */
     policy?: SecretsPolicy;
     created_at?: string;
     updated_at?: string;
@@ -59,57 +28,35 @@ export interface SecretsBundle {
     vars: Record<string, BundleValue>;
     meta?: Record<string, VarMeta>;
 }
-/** Per-key kind breakdown of an already-resolved bundle. */
 export interface BundleEntryInfo {
     key: string;
     kind: 'literal' | 'keychain' | 'env' | 'file' | 'exec';
-    /** Ref target, or empty for a literal. Never a resolved value. */
     detail: string;
 }
-/** Options for `writeBundle` / `writeBundleWithItems`. */
 export interface WriteBundleOptions {
-    /** Skip evicting the broker-held copy (no-op writers such as `stampLastUsed`). */
     skipBrokerEviction?: boolean;
-    /** Allow writing a reserved `__<harness>__` store. */
     allowReservedStore?: boolean;
 }
-/** Options for `readAndResolveBundleEnv`. */
 export interface ResolveBundleOptions {
     caller?: string;
-    /** Harness type whose unlock may be reused. */
     agent?: string;
-    /** Duration shown in the Touch ID prompt. */
     duration?: string;
-    /** Allow this call to raise an interactive biometric prompt. */
     interactiveUnlock?: boolean;
-    /** Skip the broker fast-path and read from the keychain directly. */
     noAgent?: boolean;
-    /** Resolve only from an already-unlocked broker snapshot; fail before prompting. */
     agentOnly?: boolean;
-    /** Inject only these keys. Errors if any requested key is absent. */
     keys?: string[];
-    /** Skip the per-key expiry gate. */
     allowExpired?: boolean;
-    /** `process` projects dotted keys to shell-safe env names; `storage` preserves them. */
     keyMode?: 'process' | 'storage';
-    /** Read a reserved `__<harness>__` store (system readers only). */
     allowReservedStore?: boolean;
 }
-/** Options for `renameBundle`. */
 export interface RenameOptions {
-    /** Overwrite an existing destination bundle. */
     force?: boolean;
 }
-/** Options for `rotateBundleSecret`. */
 export interface RotateOptions {
-    /** New plaintext value to write into the store (replaces the old one). */
     newValue: string;
-    /** When true, drop existing meta for this key. Mutually exclusive with `meta`. */
     clearMeta?: boolean;
-    /** Patch to merge into existing meta. Undefined fields preserve current values. */
     meta?: Partial<VarMeta>;
 }
-/** Reading a keychain-backed item through the standalone. */
 export interface KeychainReadContext {
     agent?: string;
     bundle?: string;
@@ -118,14 +65,8 @@ export interface KeychainReadContext {
     duration?: string;
     defaultPolicy?: 'hold' | 'always' | 'never';
     forceDuration?: boolean;
-    /**
-     * The caller attests the item(s) carry NO biometry ACL — so the read is
-     * silent even when no one is at the screen. Never pass this for an
-     * ACL-protected item.
-     */
     silentNoAcl?: boolean;
 }
-/** One held bundle unlock reported by `agent.agentStatus`. */
 export interface AgentStatusEntry {
     name: string;
     expiresAt: number;
@@ -134,34 +75,15 @@ export interface AgentStatusEntry {
     leaseId?: string;
     keys?: string[];
 }
-/** Options for `pushBundleToHost` / `pushBundleToHostAsync`. */
 export interface PushBundleOptions {
     remoteBackend: RemoteBackend;
-    /** Overwrite a key that already exists on the remote. */
     force?: boolean;
-    /**
-     * Ignored. File-backend export never forwards the passphrase (PHNX-2371);
-     * the remote auto-provisions its own machine-local key. Kept on the options
-     * type so existing callers that passed one still compile.
-     */
     passphrase?: string;
-    /** Label for the audit trail — `export --device` vs `fleet apply`. */
     operation: string;
-    /** Preserve an automation account's permanent prompt-free policy remotely. */
     policyNever?: boolean;
-    /** Permit a human-invoked push to read locally without requiring the agent broker. */
     agentOnly?: boolean;
-    /** Non-secret literals whose bundle value kind must survive the dotenv transport. */
     literalValues?: Record<string, string>;
-    /** Per-SSH-operation deadline. Async daemon callers must set this explicitly. */
     timeoutMs?: number;
-    /**
-     * State root (`SECRETS_HOME`) the remote `secrets` runs under for the whole
-     * push (import, read-back verify, literal restoration); remote-relative, a
-     * leading `~/` resolves against the remote user's home. The client wrapper
-     * fills in the user agents dir (`REMOTE_USER_AGENTS_DIR`) so a push lands
-     * where the receiving agents-cli reads (MIG-1 on both ends).
-     */
     remoteSecretsHome?: string;
 }
 export interface PushBundleResult {
@@ -169,29 +91,20 @@ export interface PushBundleResult {
     host: string;
     bundle: string;
     keyCount: number;
-    /** One line for the caller to render. Never contains a secret value. */
     message: string;
 }
-/** Lightweight listing entry returned by the managed sync transport. */
 export interface RemoteBundleSummary {
     name: string;
     updated_at: string;
 }
-/** Options for `pullBundle` (the `agents sync --secrets` umbrella stage). */
 export interface PullOptions {
     passphrase: string;
-    /** When true, overwrite an existing local bundle. */
     force?: boolean;
 }
-/** One credential-shaped shell-rc export finding. */
 export interface RcSecretFinding {
-    /** Basename of the rc file, e.g. `.zshenv`. */
     file: string;
-    /** 1-based line number of the export. */
     line: number;
-    /** The exported variable name. Never the value. */
     name: string;
-    /** The file-store master passphrase gets called out separately. */
     isMasterPassphrase: boolean;
 }
 export {};

package/dist/lib/secrets-types.js

@@ -1,16 +1,3 @@
-/**
- * Wire-shared types for the standalone `secrets` CLI (PHNX-3989).
- *
- * The standalone engine (`@phnx-labs/secrets-cli`, extracted from what used to
- * be `cli/src/lib/secrets/**`) owns every one of these shapes; this module only
- * re-declares them so `secrets-client.ts` and its consumers keep exact static
- * types across the process-client boundary with no runtime dependency on the
- * (now deleted) in-repo engine. Keep byte-for-byte in sync with
- * `secrets-cli/src/schema.ts` / `src/core/bundles.ts` — this is the one seam
- * both sides legitimately re-declare rather than share a package for (see the
- * `secrets-client.ts` docblock).
- */
-// --- bundle document ---------------------------------------------------
 const SECRET_TYPES = [
     'api-key',
     'token',

package/dist/lib/self-heal/checks/hook-manifest.js

@@ -1,21 +1,3 @@
-// hook-manifest check — detects manifest hooks whose `script:` resolves to
-// nothing, so they are registered in config but silently never installed.
-//
-// Why this exists. resolveHookScriptPath only resolves a manifest script under
-// <root>/hooks/, and resolveContainedHookPath rejects any candidate escaping
-// that root. A manifest entry pointing anywhere else returns null and the hook
-// is dropped — no error, no warning, no trace in `agents doctor`.
-//
-// That is not hypothetical. main-branch-guard was declared in agents.yaml as
-//   script: rules/subrules/truly-agentic-git-workflow/main-branch-guard.sh
-// which resolves to hooks/rules/subrules/... — a path that does not exist. The
-// guard was authored, tested with a 100+ case suite, and registered, yet
-// reached zero of 25 settings files across three machines. Nothing surfaced it;
-// it was found only after four agent sessions had written into a primary
-// checkout that this exact hook exists to prevent.
-//
-// A guard that silently does not run is worse than a missing one, because the
-// config says it is there. This check turns that silence into a finding.
 import { resultOf } from '../types.js';
 import { parseHookManifest, resolveHookScriptPath } from '../../hooks/install.js';
 export const hookManifestCheck = {
@@ -26,7 +8,6 @@ export const hookManifestCheck = {
         const needsAttention = [];
         let manifest;
         try {
-            // warn:false — this check reports, it does not double-log.
             manifest = parseHookManifest({ warn: false });
         }
         catch (err) {
@@ -37,9 +18,6 @@ export const hookManifestCheck = {
                 continue;
             if (def.enabled === false)
                 continue;
-            // An absolute script (a subrule-composed hook) is used as-is by the
-            // installer, so only relative manifest paths go through the hooks/ root
-            // resolver that can silently return null.
             if (def.script.startsWith('/'))
                 continue;
             if (resolveHookScriptPath(def.script) === null) {
@@ -48,9 +26,6 @@ export const hookManifestCheck = {
                     `an entrypoint there) so the installer can find it.`);
             }
         }
-        // Report only. Repair would mean guessing where the author meant the script
-        // to live, and a wrong guess would wire the wrong file into a PreToolUse
-        // gate. Naming the broken entry is the fix that belongs here.
         return resultOf([], needsAttention);
     },
 };

package/dist/lib/self-heal/checks/hook-runtime.js

@@ -1,8 +1,3 @@
-// hook-runtime check — detects and bounded-repairs agents-managed generated
-// hook shims (~/.agents/.cache/shims/hooks/<name>.sh). A native hook command can
-// look wired while its generated wrapper is missing, non-executable, non-file,
-// or broken — silent breakage. Repair runs at most once per unique path per
-// pass (no retry, no sync recursion); unresolved findings stay needsAttention.
 import { resultOf } from '../types.js';
 import { repairManagedHookRuntimeArtifacts } from '../../hooks/install.js';
 export const hookRuntimeCheck = {

package/dist/lib/self-heal/checks/install-staging.d.ts

@@ -1,4 +1,3 @@
 import type { HealCheck } from '../types.js';
-/** A concurrent upgrade must be long finished before an unattended sweep may touch its staging dir. */
 export declare const STALE_INSTALL_STAGING_AGE_MS: number;
 export declare const installStagingCheck: HealCheck;

package/dist/lib/self-heal/checks/install-staging.js

@@ -1,36 +1,10 @@
-// install-staging check — fleet-wide self-heal for the orphaned npm reify
-// staging dir that dead-ends `agents upgrade` forever (PHNX-3393).
-//
-// `agents upgrade` itself sweeps this orphan proactively before every reify
-// (sweepStaleInstallStaging in self-update.ts), so a box that runs `agents
-// upgrade` regularly never accumulates one. This check exists for the box
-// that does NOT: one that stopped upgrading after the crash that left the
-// orphan behind, so the next manual `agents upgrade` would still hit the same
-// ENOTEMPTY the sweep exists to prevent, and nothing runs `agents upgrade` to
-// trigger that sweep in the meantime. Periodic cadence closes that gap
-// fleet-wide (via the daemon's self-heal service) and on demand via
-// `agents sync`.
-//
-// The age guard is load-bearing: a staging dir can be legitimately mid-write
-// by a CONCURRENT upgrade this instant. Only a dir older than the guard is
-// touched, so an unattended periodic run can never delete a live reify.
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { resultOf } from '../types.js';
 import { resolveRunningPackageRoot } from '../../self-update.js';
 const __installStagingDirname = path.dirname(fileURLToPath(import.meta.url));
-/** A concurrent upgrade must be long finished before an unattended sweep may touch its staging dir. */
 export const STALE_INSTALL_STAGING_AGE_MS = 10 * 60 * 1000;
-/**
- * Find the retire-path staging dir(s) for `packageRoot` older than
- * `maxAgeMs`. Reimplements the same matching self-update.ts's
- * sweepStaleInstallStaging uses, so the age guard can be checked BEFORE
- * anything is deleted — the sweep helper itself removes unconditionally,
- * which is correct for the upgrade hot path (nothing else touches that
- * path while an upgrade you just started is running) but wrong for an
- * unattended periodic sweep that could race a concurrent upgrade.
- */
 function findAgedInstallStaging(packageRoot, maxAgeMs, now) {
     const resolved = path.resolve(packageRoot);
     const dir = path.dirname(resolved);
@@ -54,7 +28,7 @@ function findAgedInstallStaging(packageRoot, maxAgeMs, now) {
             mtimeMs = fs.statSync(full).mtimeMs;
         }
         catch {
-            continue; // vanished between readdir and stat — nothing to sweep
+            continue;
         }
         if (now - mtimeMs >= maxAgeMs)
             aged.push(full);
@@ -71,7 +45,6 @@ export const installStagingCheck = {
             packageRoot = resolveRunningPackageRoot(__installStagingDirname);
         }
         catch {
-            // Not an npm/bun-managed install (source checkout) — nothing to sweep.
             return resultOf([], []);
         }
         const aged = findAgedInstallStaging(packageRoot, STALE_INSTALL_STAGING_AGE_MS, Date.now());

package/dist/lib/self-heal/checks/menubar-helper.js

@@ -1,8 +1,3 @@
-// menubar-helper check — keeps the installed AGI Menu on the newest published
-// build. Discovery + trigger for the helper's auto-update: the daemon runs this
-// on the periodic cadence; the same call runs right after `agents upgrade`.
-// Detect-only under dryRun (what `agents doctor` shows); the repair is the
-// verified download + atomic swap + restart in `updateMenubarHelperIfNewer`.
 import { resultOf } from '../types.js';
 export const menubarHelperCheck = {
     id: 'menubar-helper',

package/dist/lib/self-heal/checks/path.js

@@ -1,10 +1,3 @@
-// path check — ensures the shims dir is on PATH. On POSIX it appends to the shell
-// rc file; on Windows it registers on the user PATH (registry). addShimsToPath is a
-// no-op when already present, so this is idempotent. Formerly an interactive prompt
-// in index.ts fired on every new shell; here the daemon does it once, silently.
-//
-// Caveat: an already-open shell won't pick up the new rc/PATH entry until it reloads
-// — but new shells will, so the recurring prompt stops.
 import { resultOf } from '../types.js';
 import { isShimsInPath, addShimsToPath, listAgentsWithNonIsolatedInstalledVersions } from '../../installations/shims.js';
 export const pathCheck = {
@@ -23,8 +16,6 @@ export const pathCheck = {
             return resultOf([`added shims to PATH (${r.location ?? r.rcFile ?? 'PATH'})`], []);
         }
         if (r.success && r.alreadyPresent) {
-            // Present in the rc file but not in THIS process's PATH — a reload issue,
-            // not something to fix again. Report quietly.
             return resultOf([], [`shims dir in ${r.rcFile ?? 'rc file'} but not loaded — open a new terminal`]);
         }
         return resultOf([], [`could not add shims to PATH: ${r.error ?? 'unknown'}`]);

package/dist/lib/self-heal/checks/resources.js

@@ -1,14 +1,9 @@
-// resources check — reconciles each installed version's home against the DotAgents
-// definitions (commands, skills, hooks, rules, mcp, plugins). This is a thin adapter
-// over the existing, battle-tested heal() engine (lib/heal.ts) — no behavior change;
-// it just re-expresses heal()'s result in the unified CheckResult shape.
 import { resultOf } from '../types.js';
 export const resourcesCheck = {
     id: 'resources',
     title: 'Resource sync (commands, skills, hooks, rules, plugins)',
     cadence: 'periodic',
     async run(ctx) {
-        // Lazy import so the (heavy) heal graph only loads when this check actually runs.
         const { heal } = await import('../../heal.js');
         const result = await heal({ mode: ctx.mode, dryRun: ctx.dryRun });
         const fixed = [];

package/dist/lib/self-heal/checks/shadowing.js

@@ -1,8 +1,3 @@
-// shadowing check — when a harness's own launcher shadows our shim on PATH, adopt
-// it (symlink-only, reversible) so version management wins regardless of PATH order.
-// A REAL native binary is never moved — it's surfaced as needsAttention so the
-// interactive layer can inform the user once. POSIX-only (the launcher convention
-// and PATH-order problem are POSIX; Windows resolves via the registry PATH).
 import { resultOf } from '../types.js';
 import { AGENTS } from '../../agents.js';
 import { getPathShadowingExecutable, adoptShadowingLauncher, listAgentsWithNonIsolatedInstalledVersions, } from '../../installations/shims.js';
@@ -15,29 +10,20 @@ export const shadowingCheck = {
     async run(ctx) {
         const fixed = [];
         const needsAttention = [];
-        // Isolated-only agents are skipped outright. Adoption repoints the user's OWN
-        // launcher (e.g. the npm symlink ~/.npm-global/bin/codex) at our shim — the most
-        // invasive thing self-heal does, and the exact opposite of what `--isolated`
-        // promises. The `getGlobalDefault` guard below already blocked this in practice,
-        // since an isolated install never sets a default; but that made the boundary
-        // depend on an invariant enforced elsewhere. Any path that pins a default from
-        // an isolated copy would silently re-arm the adoption. Gate on the installs
-        // themselves so it cannot happen regardless of how a default got recorded.
         for (const agent of listAgentsWithNonIsolatedInstalledVersions()) {
             if (!getGlobalDefault(agent))
-                continue; // only default agents, like the interactive flow
+                continue;
             const cmd = AGENTS[agent].cliCommand;
             const shadowedBy = getPathShadowingExecutable(agent);
             if (!shadowedBy)
                 continue;
             if (ctx.dryRun) {
-                // Classify without mutating: adoption only ever touches a symlink.
                 let isSymlink = false;
                 try {
                     const fs = await import('node:fs');
                     isSymlink = fs.lstatSync(shadowedBy).isSymbolicLink();
                 }
-                catch { /* treat as real binary */ }
+                catch { }
                 if (isSymlink)
                     fixed.push(`${cmd} launcher (${shadowedBy})`);
                 else

package/dist/lib/self-heal/checks/shims.js

@@ -1,7 +1,3 @@
-// shims check — keeps the dispatch shims and versioned aliases current, and clears
-// pre-split legacy shim files. Formerly done in the interactive index.ts startup
-// (which PRINTED "Updated <cli> shim" on every run); here it runs silently in the
-// background so the shim schema settles without user-facing churn.
 import { resultOf } from '../types.js';
 import { AGENTS } from '../../agents.js';
 import { createShim, ensureShimCurrent, ensureVersionedAliasCurrent, isShimCurrent, isVersionedAliasCurrent, removeShim, shimExists, shimPointsAtLiveInstall, removeLegacyUserShim, listAgentsWithInstalledVersions, listAgentsWithNonIsolatedInstalledVersions, listShimFileNames, pruneOrphanedCommandShim, } from '../../installations/shims.js';
@@ -22,9 +18,6 @@ export const shimsCheck = {
                     fixed.push(`${cmd} shim`);
                 }
                 else if (!shimPointsAtLiveInstall(agent)) {
-                    // Schema is current but the baked AGENTS_BIN points at a different, removed
-                    // install (dev build, old npm-global, rotated version dir). ensureShimCurrent
-                    // would no-op on a schema-current shim, so force a rewrite to the current install.
                     if (!ctx.dryRun)
                         createShim(agent);
                     fixed.push(`${cmd} shim (repointed to current install)`);
@@ -42,16 +35,9 @@ export const shimsCheck = {
                     fixed.push(`${cmd}@${version} alias`);
                 }
             }
-            // Pre-split ~/.agents/shims/<cli> files cause false-positive shadow hits.
             if (!ctx.dryRun && removeLegacyUserShim(agent))
                 fixed.push(`removed legacy ${cmd} shim`);
         }
-        // Prune orphaned legacy command shims (browser/sessions/… left by a removed
-        // install) whose baked AGENTS_BIN is dead — the current source never
-        // regenerates them, and they either die with exit 127 or shadow the real
-        // package bin on PATH. Only removes shims whose target install is gone — plus
-        // the legacy `secrets` shim regardless: it re-enters `agents secrets`, which is
-        // a passthrough to the standalone binary since PHNX-3989, so it can only recurse.
         if (!ctx.dryRun) {
             for (const name of listShimFileNames()) {
                 if (pruneOrphanedCommandShim(name))

package/dist/lib/self-heal/child.d.ts

@@ -0,0 +1,12 @@
+export declare const SELF_HEAL_CHILD_CMD = "__self-heal-run";
+export declare const SELF_HEAL_CANCEL_MSG = "self-heal:cancel";
+export declare function selfHealCancelMessage(): {
+    type: typeof SELF_HEAL_CANCEL_MSG;
+};
+export interface SelfHealChildSummary {
+    v: 1;
+    changed: boolean;
+    needsAttention: boolean;
+    summary: string;
+}
+export declare function runSelfHealChild(): Promise<number>;

package/dist/lib/self-heal/child.js

@@ -0,0 +1,23 @@
+export const SELF_HEAL_CHILD_CMD = '__self-heal-run';
+export const SELF_HEAL_CANCEL_MSG = 'self-heal:cancel';
+export function selfHealCancelMessage() {
+    return { type: SELF_HEAL_CANCEL_MSG };
+}
+export async function runSelfHealChild() {
+    process.on('message', (msg) => {
+        if (msg && typeof msg === 'object' && msg.type === SELF_HEAL_CANCEL_MSG) {
+            process.exit(0);
+        }
+    });
+    process.on('disconnect', () => process.exit(0));
+    const { runSelfHeal, selfHealChangedAnything, selfHealNeedsAttention, summarizeSelfHeal } = await import('./registry.js');
+    const report = await runSelfHeal({ mode: 'safe' });
+    const summary = {
+        v: 1,
+        changed: selfHealChangedAnything(report),
+        needsAttention: selfHealNeedsAttention(report),
+        summary: summarizeSelfHeal(report),
+    };
+    process.stdout.write(JSON.stringify(summary));
+    return 0;
+}

package/dist/lib/self-heal/registry.d.ts

@@ -1,23 +1,14 @@
 import type { HealCheck, HealCheckId, HealCadence, SelfHealReport } from './types.js';
 export declare const HEAL_CHECKS: HealCheck[];
 interface SelfHealOptions {
-    /** Restrict to these check ids; omit to run every registered check. */
     checks?: HealCheckId[];
-    /** Only run checks whose cadence is in this set (daemon scheduling). */
     cadences?: HealCadence[];
-    /** 'safe' (daemon default) or 'full' (agents sync). Default 'safe'. */
     mode?: 'safe' | 'full';
-    /** Detect only — never write. Default false. */
     dryRun?: boolean;
-    /** Override the platform gate (tests). Default process.platform. */
     platform?: NodeJS.Platform;
 }
-/** Run the selected checks, isolating per-check failures. */
 export declare function runSelfHeal(opts?: SelfHealOptions): Promise<SelfHealReport>;
-/** True if any check repaired something (for daemon logging / notification). */
 export declare function selfHealChangedAnything(report: SelfHealReport): boolean;
-/** True if any check surfaced something a human should look at. */
 export declare function selfHealNeedsAttention(report: SelfHealReport): boolean;
-/** One-line human summary, e.g. "shims: 2 fixed; path: 1 fixed". */
 export declare function summarizeSelfHeal(report: SelfHealReport): string;
 export {};

package/dist/lib/self-heal/registry.js

@@ -1,9 +1,3 @@
-// The self-heal registry + runner.
-//
-// One ordered list of HealChecks; one runner that executes the requested subset,
-// isolating failures (one check throwing never aborts the rest) and aggregating a
-// SelfHealReport. Both front doors — the daemon (by cadence) and `agents doctor`
-// (all, or by id) — call runSelfHeal.
 import { resourcesCheck } from './checks/resources.js';
 import { hookRuntimeCheck } from './checks/hook-runtime.js';
 import { hookManifestCheck } from './checks/hook-manifest.js';
@@ -12,23 +6,16 @@ import { shadowingCheck } from './checks/shadowing.js';
 import { pathCheck } from './checks/path.js';
 import { installStagingCheck } from './checks/install-staging.js';
 import { menubarHelperCheck } from './checks/menubar-helper.js';
-// Order matters: cheap structural fixes (shims, shadow adoption, PATH, generated
-// hook wrappers) before the heavier resource reconciliation, so a freshly-
-// repaired shim is in place first.
 export const HEAL_CHECKS = [
     shimsCheck,
     shadowingCheck,
     pathCheck,
     hookRuntimeCheck,
-    // Detect-only, after the runtime shim repair: a shim can be healthy while the
-    // manifest entry that should have produced it resolves nowhere.
     hookManifestCheck,
     resourcesCheck,
     installStagingCheck,
-    // Last and network-touching: the menu-bar helper's auto-update (macOS only).
     menubarHelperCheck,
 ];
-/** Run the selected checks, isolating per-check failures. */
 export async function runSelfHeal(opts = {}) {
     const platform = opts.platform ?? process.platform;
     const ctx = { mode: opts.mode ?? 'safe', dryRun: opts.dryRun ?? false };
@@ -53,15 +40,12 @@ export async function runSelfHeal(opts = {}) {
     }
     return { checks: reports };
 }
-/** True if any check repaired something (for daemon logging / notification). */
 export function selfHealChangedAnything(report) {
     return report.checks.some((c) => (c.result?.fixed.length ?? 0) > 0);
 }
-/** True if any check surfaced something a human should look at. */
 export function selfHealNeedsAttention(report) {
     return report.checks.some((c) => (c.result?.needsAttention.length ?? 0) > 0 || Boolean(c.error));
 }
-/** One-line human summary, e.g. "shims: 2 fixed; path: 1 fixed". */
 export function summarizeSelfHeal(report) {
     const parts = [];
     for (const c of report.checks) {

package/dist/lib/self-heal/types.d.ts

@@ -1,41 +1,29 @@
 export type HealCheckId = 'resources' | 'hook-runtime' | 'hook-manifest' | 'shims' | 'shadowing' | 'path' | 'install-staging' | 'menubar-helper';
-/** When the daemon schedules a check. */
 export type HealCadence = 'startup' | 'frequent' | 'periodic';
 export interface HealCtx {
-    /** 'safe' = daemon (low-risk only); 'full' = agents sync (everything). */
     mode: 'safe' | 'full';
-    /** Detect only — never write. Powers `agents doctor` (read-only) and previews. */
     dryRun: boolean;
 }
-/** Outcome of one check. `ok` means nothing was wrong. */
 export interface CheckResult {
-    /** Things repaired (or, under dryRun, that WOULD be repaired). Human-readable. */
     fixed: string[];
-    /** Detected but not auto-fixed: unfixable, or risky-in-safe-mode. Human-readable. */
     needsAttention: string[];
-    /** True iff detect found nothing wrong (fixed and needsAttention both empty). */
     ok: boolean;
 }
 export interface HealCheck {
     id: HealCheckId;
     title: string;
-    /** Restrict to these platforms; omit to run on all. */
     platforms?: NodeJS.Platform[];
     cadence: HealCadence;
-    /** Detect + (repair unless dryRun). Must be headless (no TTY/prompt) and idempotent. */
     run(ctx: HealCtx): Promise<CheckResult>;
 }
 export interface CheckReport {
     id: HealCheckId;
     title: string;
     result: CheckResult | null;
-    /** Set when the check itself threw (isolated — one check failing never aborts the run). */
     error?: string;
 }
 export interface SelfHealReport {
     checks: CheckReport[];
 }
-/** Convenience: an all-clear result. */
 export declare function okResult(): CheckResult;
-/** Build a CheckResult from collected fixes/attention items (ok iff both empty). */
 export declare function resultOf(fixed: string[], needsAttention: string[]): CheckResult;

package/dist/lib/self-heal/types.js

@@ -1,21 +1,6 @@
-// Unified self-heal subsystem — shared shapes.
-//
-// agents-cli had ~37 separate repair routines scattered across the daemon, every
-// CLI startup, and a handful of commands, each hand-rolling detect+fix on its own
-// trigger. This subsystem gives every repairable class of problem ONE shape — a
-// HealCheck — driven by ONE runner, hosted behind TWO front doors (the daemon,
-// on tiered schedules, and `agents doctor`, on demand).
-//
-// A check's `run()` both detects and repairs in a single pass (repair is skipped
-// when `ctx.dryRun`), mirroring the existing resource heal (heal.ts) which computes
-// and applies together. `mode` gates how aggressive a repair may be: 'safe' (the
-// daemon default) fixes only low-risk drift and merely reports risky conditions;
-// 'full' (`agents sync`) applies everything.
-/** Convenience: an all-clear result. */
 export function okResult() {
     return { fixed: [], needsAttention: [], ok: true };
 }
-/** Build a CheckResult from collected fixes/attention items (ok iff both empty). */
 export function resultOf(fixed, needsAttention) {
     return { fixed, needsAttention, ok: fixed.length === 0 && needsAttention.length === 0 };
 }