@phnx-labs/agents-cli 1.22.120 → 1.22.121

package/dist/lib/reserved-stores.d.ts

@@ -1,49 +1,21 @@
 import type { SecretsBackend } from './secrets-types.js';
 import { type AgentId } from './types.js';
-/** Legacy readable alias for `__claude__`. Not migrated in this track. */
 export declare const AUTH_STORE_ALIAS = "auth";
-/**
- * The reserved `auth` bundle holds per-account Claude setup-tokens for
- * unattended usage/probe and MUST be file-backed (headless, fleet-shareable —
- * credential-management.md invariant 7). The standalone enforces the same
- * rule on its write path (`WRONG_BACKEND`); agents-cli asserts it on every
- * read so a keychain/vault-backed `auth` left over from an older layout fails
- * loud instead of silently being ignored by usage/probe (SEC-GAP-3).
- */
 export declare const AUTH_BUNDLE_BACKEND: SecretsBackend;
 export declare const RESERVED_BUNDLE_NAMES: Set<string>;
 export declare function isReservedBundleName(name: string): boolean;
-/** Thrown when the reserved `auth` bundle is found on the wrong backend. */
 export declare class ReservedBundleWrongBackendError extends Error {
     readonly bundle: string;
     readonly backend: SecretsBackend;
     constructor(bundle: string, backend: SecretsBackend);
 }
-/** Fail loud when the reserved `auth` bundle is on any backend but `file`. */
 export declare function assertReservedAuthBackend(backend: SecretsBackend): void;
-/**
- * True for the wrong-backend refusal in either shape: raised here from a
- * read-side check, or returned by the standalone (`WRONG_BACKEND`) when its
- * own write/resolve guard fired.
- */
 export declare function isReservedBundleBackendError(error: unknown): boolean;
 export declare const RESERVED_STORES: Record<AgentId, string>;
 export declare function reservedStoreName(harness: AgentId): string;
 export declare function isReservedStoreName(name: string): boolean;
 export type StorableCredentialKind = 'setup-token' | 'api-key';
-/**
- * Fail loud at the write boundary: only a setup-token or an API key may enter
- * a reserved store. Rotating OAuth/session credentials stay in their slot on
- * the device that minted them.
- */
 export declare function assertStorableCredentialKind(kind: string, harness?: AgentId): asserts kind is StorableCredentialKind;
-/**
- * Whether the local reserved `auth` bundle exists and is on the expected
- * (file) backend. `ok: true` on a missing bundle — nothing to be wrong about.
- * Read-only status probe (`agents doctor`, `agents fleet apply`); an
- * unreachable standalone is treated the same as "bundle absent" so a
- * diagnostic never crashes over one optional finding.
- */
 export declare function inspectReservedAuthBundle(): {
     exists: boolean;
     backend: SecretsBackend | null;

package/dist/lib/reserved-stores.js

@@ -18,22 +18,12 @@
  */
 import { bundleExistsSync, bundleBackendSync, isSecretsClientError } from './secrets-client.js';
 import { AGENT_IDS } from './types.js';
-/** Legacy readable alias for `__claude__`. Not migrated in this track. */
 export const AUTH_STORE_ALIAS = 'auth';
-/**
- * The reserved `auth` bundle holds per-account Claude setup-tokens for
- * unattended usage/probe and MUST be file-backed (headless, fleet-shareable —
- * credential-management.md invariant 7). The standalone enforces the same
- * rule on its write path (`WRONG_BACKEND`); agents-cli asserts it on every
- * read so a keychain/vault-backed `auth` left over from an older layout fails
- * loud instead of silently being ignored by usage/probe (SEC-GAP-3).
- */
 export const AUTH_BUNDLE_BACKEND = 'file';
 export const RESERVED_BUNDLE_NAMES = new Set([AUTH_STORE_ALIAS]);
 export function isReservedBundleName(name) {
     return RESERVED_BUNDLE_NAMES.has(name.trim().toLowerCase());
 }
-/** Thrown when the reserved `auth` bundle is found on the wrong backend. */
 export class ReservedBundleWrongBackendError extends Error {
     bundle;
     backend;
@@ -46,16 +36,10 @@ export class ReservedBundleWrongBackendError extends Error {
         this.backend = backend;
     }
 }
-/** Fail loud when the reserved `auth` bundle is on any backend but `file`. */
 export function assertReservedAuthBackend(backend) {
     if (backend !== AUTH_BUNDLE_BACKEND)
         throw new ReservedBundleWrongBackendError(AUTH_STORE_ALIAS, backend);
 }
-/**
- * True for the wrong-backend refusal in either shape: raised here from a
- * read-side check, or returned by the standalone (`WRONG_BACKEND`) when its
- * own write/resolve guard fired.
- */
 export function isReservedBundleBackendError(error) {
     return error instanceof ReservedBundleWrongBackendError || isSecretsClientError(error, 'WRONG_BACKEND');
 }
@@ -72,11 +56,7 @@ export function isReservedStoreName(name) {
         return true;
     return AGENT_IDS.some((id) => RESERVED_STORES[id].toLowerCase() === n);
 }
-/**
- * Fail loud at the write boundary: only a setup-token or an API key may enter
- * a reserved store. Rotating OAuth/session credentials stay in their slot on
- * the device that minted them.
- */
+// Only durable setup tokens/API keys are portable; rotating OAuth and session credentials stay device-local.
 export function assertStorableCredentialKind(kind, harness) {
     if (kind === 'setup-token' || kind === 'api-key')
         return;
@@ -96,14 +76,8 @@ function storableCredentialRefusal(kind, harness) {
     const who = harness ?? 'this harness';
     return `${who}: reserved stores accept only a setup-token or an API key, not '${kind}'`;
 }
-/**
- * Whether the local reserved `auth` bundle exists and is on the expected
- * (file) backend. `ok: true` on a missing bundle — nothing to be wrong about.
- * Read-only status probe (`agents doctor`, `agents fleet apply`); an
- * unreachable standalone is treated the same as "bundle absent" so a
- * diagnostic never crashes over one optional finding.
- */
 export function inspectReservedAuthBundle() {
+    // An unreachable standalone secrets service is absent for inspection purposes.
     let exists;
     try {
         exists = bundleExistsSync(AUTH_STORE_ALIAS);

package/dist/lib/resource-aliases.d.ts

@@ -1,13 +1 @@
-/**
- * Normalize a resource's frontmatter `aliases:` value into a clean list.
- *
- * A skill (SKILL.md) or command file may declare `aliases:` — alternate names
- * that {@link resolveResource} matches in addition to the canonical file/dir name
- * (the canonical name always wins a collision). The value is a YAML list or a
- * comma/space-separated string, mirroring the command frontmatter `agents:` field.
- *
- * This lives in its own leaf module so `skills.ts` and `commands.ts` (which parse
- * the frontmatter) and `resources.ts` (which resolves by alias) all share one
- * definition without an import cycle.
- */
 export declare function normalizeAliases(raw: unknown): string[];

package/dist/lib/resource-aliases.js

@@ -1,15 +1,3 @@
-/**
- * Normalize a resource's frontmatter `aliases:` value into a clean list.
- *
- * A skill (SKILL.md) or command file may declare `aliases:` — alternate names
- * that {@link resolveResource} matches in addition to the canonical file/dir name
- * (the canonical name always wins a collision). The value is a YAML list or a
- * comma/space-separated string, mirroring the command frontmatter `agents:` field.
- *
- * This lives in its own leaf module so `skills.ts` and `commands.ts` (which parse
- * the frontmatter) and `resources.ts` (which resolves by alias) all share one
- * definition without an import cycle.
- */
 export function normalizeAliases(raw) {
     const tokens = Array.isArray(raw)
         ? raw

package/dist/lib/resource-content-diff.d.ts

@@ -1,31 +1,3 @@
-/**
- * Shared content comparison for the resource-diff engine.
- *
- * `agents doctor` (and the plugin-drift describer) reconcile a version home's
- * copy of a resource against its resolved source by comparing bytes. Two shapes
- * of resource need it: a single file (a command, a rule, a transformed subagent)
- * and a whole directory tree (a skill, a plugin mirror, a copied workflow).
- * Both live here so every kind's differ shares ONE normalize rule, ONE ignore
- * set, and ONE symlink-skip policy instead of re-deriving them (the duplication
- * `doctor-diff.ts`'s `dirsContentMatch` had before PHNX-3504; the parallel
- * `skillDirsMatch` copies in `versions.ts` / `detectors/skills.ts` are a separate
- * follow-up cleanup so this change stays inside the fast-lane CI impact budget).
- *
- * Normalize: CRLF → LF and trim, so a trailing-newline / line-ending difference
- * between two independently-written trees is not reported as content drift. This
- * mirrors the byte compare `diffCommands` / `diffRules` already apply per file.
- */
-/** CRLF → LF and trim, so line-ending / trailing-newline skew is not drift. */
 export declare function normalizeResourceContent(content: string): string;
-/**
- * True when two files exist and their normalized content is identical. A missing
- * or unreadable file on either side is a mismatch (never a silent match).
- */
 export declare function filesContentMatch(a: string, b: string): boolean;
-/**
- * True when two directory trees hold the same set of names and every file under
- * them matches by normalized content. Symlinks and ignored entries are skipped
- * on both sides; a name present on one side only, or a file/dir type mismatch,
- * is a mismatch. An unreadable directory on either side is a mismatch.
- */
 export declare function dirsContentMatch(src: string, dst: string): boolean;

package/dist/lib/resource-content-diff.js

@@ -1,23 +1,5 @@
-/**
- * Shared content comparison for the resource-diff engine.
- *
- * `agents doctor` (and the plugin-drift describer) reconcile a version home's
- * copy of a resource against its resolved source by comparing bytes. Two shapes
- * of resource need it: a single file (a command, a rule, a transformed subagent)
- * and a whole directory tree (a skill, a plugin mirror, a copied workflow).
- * Both live here so every kind's differ shares ONE normalize rule, ONE ignore
- * set, and ONE symlink-skip policy instead of re-deriving them (the duplication
- * `doctor-diff.ts`'s `dirsContentMatch` had before PHNX-3504; the parallel
- * `skillDirsMatch` copies in `versions.ts` / `detectors/skills.ts` are a separate
- * follow-up cleanup so this change stays inside the fast-lane CI impact budget).
- *
- * Normalize: CRLF → LF and trim, so a trailing-newline / line-ending difference
- * between two independently-written trees is not reported as content drift. This
- * mirrors the byte compare `diffCommands` / `diffRules` already apply per file.
- */
 import * as fs from 'fs';
 import * as path from 'path';
-/** OS metadata / local tooling that is never synced into a version home. */
 const RESOURCE_CONTENT_IGNORE = new Set([
     '.DS_Store',
     '.git',
@@ -26,35 +8,26 @@ const RESOURCE_CONTENT_IGNORE = new Set([
     '__pycache__',
     'node_modules',
 ]);
-/** CRLF → LF and trim, so line-ending / trailing-newline skew is not drift. */
 export function normalizeResourceContent(content) {
     return content.replace(/\r\n/g, '\n').trim();
 }
 function readSafe(file) {
     try {
-        return fs.readFileSync(file, 'utf-8');
+        return fs.readFileSync(file);
     }
     catch {
         return null;
     }
 }
-/**
- * True when two files exist and their normalized content is identical. A missing
- * or unreadable file on either side is a mismatch (never a silent match).
- */
 export function filesContentMatch(a, b) {
-    const ac = readSafe(a);
-    const bc = readSafe(b);
-    if (ac == null || bc == null)
+    const ab = readSafe(a);
+    const bb = readSafe(b);
+    if (ab == null || bb == null)
         return false;
-    return normalizeResourceContent(ac) === normalizeResourceContent(bc);
+    if (ab.equals(bb))
+        return true;
+    return normalizeResourceContent(ab.toString('utf-8')) === normalizeResourceContent(bb.toString('utf-8'));
 }
-/**
- * True when two directory trees hold the same set of names and every file under
- * them matches by normalized content. Symlinks and ignored entries are skipped
- * on both sides; a name present on one side only, or a file/dir type mismatch,
- * is a mismatch. An unreadable directory on either side is a mismatch.
- */
 export function dirsContentMatch(src, dst) {
     const srcEntries = (() => {
         try {

package/dist/lib/resource-inventory.d.ts

@@ -1,78 +1,27 @@
-/**
- * Resource inventory — the single chokepoint for "what does this agent@version
- * have" (RUSH-2238, parent RUSH-2236). Contract: cli/docs/specifications.md.
- *
- * One API answers four orthogonal questions per (agent, version, kind):
- *
- *   capable   — the agent+version feature flags allow the kind at all
- *   declared  — resources the DotAgents layers (project/user/system/extra)
- *               declare for sync
- *   onDisk    — resources actually installed in the version home filesystem
- *               (the installed-resource truth — NOT agents.yaml tracking data)
- *   wired     — resources the harness native config references so they fire
- *   unmanaged — onDisk − declared (orphans no layer declares anymore)
- *
- * Callers (inspect, doctor, view, sync) MUST come here rather than
- * re-implementing path joins or config parsing per command. Wiring parsing
- * currently covers the settings.json family (claude, droid,
- * muse), Grok hooks.json, and Kimi config.toml via checkVersionHookWiring.
- */
 import type { AgentId } from './types.js';
 import { type HookWiringReport } from './hooks/install.js';
-/** Resource kinds the inventory can report. Only 'hooks' is implemented so far
- *  (RUSH-2238); the remaining kinds land with their follow-up tickets. */
 export type InventoryKind = 'hooks' | 'skills' | 'commands' | 'plugins' | 'mcp';
-/** A reference to one resource in one state (declared / onDisk / wired). */
 export interface ResourceRef {
-    /** Stable install name (script basename without extension for hooks). */
     name: string;
-    /** Declared/onDisk: absolute file path. Wired: the command string the native
-     *  config references. */
     path: string;
-    /** Origin: a layer name for declared ('project' | 'user' | 'system' | extra
-     *  repo alias), 'user'/'project' scope or 'version-home' for onDisk,
-     *  'native-config' for wired. */
     source: string;
-    /** Optional context — e.g. the lifecycle events a wired hook fires on. */
     detail?: string;
 }
 export interface ResourceInventory {
     agent: AgentId;
     version: string;
     kind: InventoryKind;
-    /** Agent+version feature flags allow this kind (version-aware gate). */
     capable: boolean;
-    /** Declared in the DotAgents layers. */
     declared: ResourceRef[];
-    /** Installed on disk in the version home. */
     onDisk: ResourceRef[];
-    /** Referenced by the harness native config (empty when wiringSupported is
-     *  false — the format parser for that harness is not implemented yet). */
     wired: ResourceRef[];
-    /** onDisk − declared: installed orphans no layer declares. */
     unmanaged: ResourceRef[];
-    /** Whether this harness's native wiring was read successfully. When false,
-     *  `wired: []` means "unknown" (unsupported family OR unparseable config),
-     *  NOT "nothing wired". Format-supported but corrupt configs set this false. */
     wiringSupported: boolean;
-    /** Native-format diagnostic retained for doctor; derived in this same pass. */
     wiring?: HookWiringReport;
 }
-/**
- * The single inventory API. Harness-scoped (claude/codex/grok/kimi/droid) —
- * never a model or profile. Throws for kinds without an implementation rather
- * than returning a half-empty report that looks like truth.
- */
 export declare function getResourceInventory(agent: AgentId, version: string, kind: InventoryKind, opts?: {
     cwd?: string;
 }): ResourceInventory;
-/**
- * On-disk hook listing for an explicit home (version home or effective home)
- * plus the project overlay — the one listing `getAgentResources` routes
- * through, so inspect/doctor/view share a single hooks source. Paths resolve
- * through the absolute-hooksDir-safe join (RUSH-2237), so grok/kimi version
- * homes list their real hooks.
- */
 export declare function listOnDiskHooks(agent: AgentId, opts?: {
     home?: string;
     cwd?: string;

package/dist/lib/resource-inventory.js

@@ -1,48 +1,14 @@
-/**
- * Resource inventory — the single chokepoint for "what does this agent@version
- * have" (RUSH-2238, parent RUSH-2236). Contract: cli/docs/specifications.md.
- *
- * One API answers four orthogonal questions per (agent, version, kind):
- *
- *   capable   — the agent+version feature flags allow the kind at all
- *   declared  — resources the DotAgents layers (project/user/system/extra)
- *               declare for sync
- *   onDisk    — resources actually installed in the version home filesystem
- *               (the installed-resource truth — NOT agents.yaml tracking data)
- *   wired     — resources the harness native config references so they fire
- *   unmanaged — onDisk − declared (orphans no layer declares anymore)
- *
- * Callers (inspect, doctor, view, sync) MUST come here rather than
- * re-implementing path joins or config parsing per command. Wiring parsing
- * currently covers the settings.json family (claude, droid,
- * muse), Grok hooks.json, and Kimi config.toml via checkVersionHookWiring.
- */
 import { AGENTS } from './agents.js';
 import { supports } from './capabilities.js';
 import { listResources } from './resources.js';
 import { checkVersionHookWiring, listHooksInVersionHome, listInstalledHooksWithScope, } from './hooks/install.js';
 const IMPLEMENTED_KINDS = ['hooks'];
-/**
- * The single inventory API. Harness-scoped (claude/codex/grok/kimi/droid) —
- * never a model or profile. Throws for kinds without an implementation rather
- * than returning a half-empty report that looks like truth.
- */
 export function getResourceInventory(agent, version, kind, opts = {}) {
     if (!IMPLEMENTED_KINDS.includes(kind)) {
-        // Fail loud at the boundary: the kind is part of the API shape but its
-        // inventory lands with a RUSH-2236 follow-up — a silent empty report would
-        // read as "nothing installed".
         throw new Error(`getResourceInventory: kind '${kind}' is not implemented yet (implemented: ${IMPLEMENTED_KINDS.join(', ')}; tracked under RUSH-2236)`);
     }
     return hooksInventory(agent, version, opts.cwd);
 }
-/**
- * On-disk hook listing for an explicit home (version home or effective home)
- * plus the project overlay — the one listing `getAgentResources` routes
- * through, so inspect/doctor/view share a single hooks source. Paths resolve
- * through the absolute-hooksDir-safe join (RUSH-2237), so grok/kimi version
- * homes list their real hooks.
- */
 export function listOnDiskHooks(agent, opts = {}) {
     return listInstalledHooksWithScope(agent, opts.cwd ?? process.cwd(), { home: opts.home }).map((h) => ({
         name: h.name,
@@ -53,17 +19,11 @@ export function listOnDiskHooks(agent, opts = {}) {
 }
 function hooksInventory(agent, version, cwd) {
     const capable = supports(agent, 'hooks', version).ok;
-    // Declared: the layered DotAgents repos are the declaration surface. Hook
-    // script names carry their extension here ('git-guard.sh'); normalize to the
-    // extension-less install name so declared/onDisk sets compare.
     const declared = listResources('hooks', cwd).map((r) => ({
         name: r.name.replace(/\.[^./]+$/, ''),
         path: r.path,
         source: r.source,
     }));
-    // onDisk / wired need the version home; both are empty for an agent whose
-    // hooks capability is gated off (unknown agents included — AGENTS lookup
-    // would otherwise throw).
     let onDisk = [];
     let wired = [];
     let wiringSupported = false;
@@ -77,13 +37,8 @@ function hooksInventory(agent, version, cwd) {
         }));
         const report = checkVersionHookWiring(agent, version);
         wiring = report;
-        // supported=true means the harness format is known; settingsUnparseable means
-        // we could not trust the file. Only report wired counts when the parse succeeded —
-        // otherwise inspect/doctor would render "wired 0" for corrupt configs (PR #2140 review).
         wiringSupported = report.supported && !report.settingsUnparseable;
         if (wiringSupported) {
-            // One ref per hook, events folded into detail — a hook wired under
-            // PreToolUse AND Stop is one inventory entry, not two.
             const eventsByName = new Map();
             const commandByName = new Map();
             for (const issue of report.wired) {

package/dist/lib/resource-patterns.d.ts

@@ -1,42 +1,10 @@
-/**
- * Resource selection patterns for agents.yaml versions: entries.
- *
- * Pattern syntax: [!]source:name
- *   "system:*"     — all resources from ~/.agents/.system/
- *   "user:*"       — all resources from ~/.agents/
- *   "rush:*"       — all resources from ~/.agents-rush/  (extra repo alias)
- *   "project:*"    — all resources from .agents/ in the project root
- *   "user:foo"     — specifically the resource named "foo" from ~/.agents/
- *   "!user:temp"   — exclude "temp" from the user repo
- *
- * Evaluation rule: union all inclusions, then subtract all exclusions.
- */
 interface ParsedPattern {
     negate: boolean;
     source: string;
     name: string;
 }
 export declare function parsePattern(p: string): ParsedPattern;
-/** Returns true if the string is a legacy plain name with no source: prefix. */
 export declare function isLegacyName(p: string): boolean;
-/**
- * Expand a list of patterns against an available name→source map.
- * Returns the union of matching names with exclusions subtracted.
- *
- * Supports comma-grouped names to avoid repeating the source prefix:
- *   "system:brain-scan,mq"  →  includes brain-scan and mq from system
- *   "!user:temp,draft"      →  excludes temp and draft from user
- *
- * Note: in YAML flow sequences ([...]) a comma inside a pattern requires
- * quoting ("system:brain-scan,mq"). Block-style items and yaml.stringify
- * output handle this automatically.
- */
 export declare function expandPatterns(patterns: string[], available: Map<string, string>): string[];
-/**
- * Build the default pattern list for a resource type.
- * Order: system → user → alias1 → alias2 → ... → project (base-to-override).
- * @param extraAliases  Alias names of enabled extra repos, in insertion order.
- * @param includeProject  Whether to append "project:*". False for hooks (security).
- */
 export declare function defaultPatterns(extraAliases?: string[], includeProject?: boolean): string[];
 export {};

package/dist/lib/resource-patterns.js

@@ -1,16 +1,3 @@
-/**
- * Resource selection patterns for agents.yaml versions: entries.
- *
- * Pattern syntax: [!]source:name
- *   "system:*"     — all resources from ~/.agents/.system/
- *   "user:*"       — all resources from ~/.agents/
- *   "rush:*"       — all resources from ~/.agents-rush/  (extra repo alias)
- *   "project:*"    — all resources from .agents/ in the project root
- *   "user:foo"     — specifically the resource named "foo" from ~/.agents/
- *   "!user:temp"   — exclude "temp" from the user repo
- *
- * Evaluation rule: union all inclusions, then subtract all exclusions.
- */
 export function parsePattern(p) {
     const negate = p.startsWith('!');
     const raw = negate ? p.slice(1) : p;
@@ -20,22 +7,9 @@ export function parsePattern(p) {
     }
     return { negate, source: raw.slice(0, colon), name: raw.slice(colon + 1) };
 }
-/** Returns true if the string is a legacy plain name with no source: prefix. */
 export function isLegacyName(p) {
     return !p.startsWith('!') && !p.includes(':');
 }
-/**
- * Expand a list of patterns against an available name→source map.
- * Returns the union of matching names with exclusions subtracted.
- *
- * Supports comma-grouped names to avoid repeating the source prefix:
- *   "system:brain-scan,mq"  →  includes brain-scan and mq from system
- *   "!user:temp,draft"      →  excludes temp and draft from user
- *
- * Note: in YAML flow sequences ([...]) a comma inside a pattern requires
- * quoting ("system:brain-scan,mq"). Block-style items and yaml.stringify
- * output handle this automatically.
- */
 export function expandPatterns(patterns, available) {
     const included = new Set();
     const excluded = new Set();
@@ -43,7 +17,6 @@ export function expandPatterns(patterns, available) {
         try {
             const { negate, source, name } = parsePattern(p);
             const target = negate ? excluded : included;
-            // Comma-grouped names: "system:brain-scan,mq" → ['brain-scan', 'mq']
             const names = name === '*' ? ['*'] : name.split(',').map(n => n.trim()).filter(Boolean);
             for (const n of names) {
                 if (n === '*') {
@@ -59,17 +32,10 @@ export function expandPatterns(patterns, available) {
             }
         }
         catch {
-            // Skip malformed patterns
         }
     }
     return [...included].filter(n => !excluded.has(n));
 }
-/**
- * Build the default pattern list for a resource type.
- * Order: system → user → alias1 → alias2 → ... → project (base-to-override).
- * @param extraAliases  Alias names of enabled extra repos, in insertion order.
- * @param includeProject  Whether to append "project:*". False for hooks (security).
- */
 export function defaultPatterns(extraAliases = [], includeProject = true) {
     const patterns = ['system:*', 'user:*'];
     for (const alias of extraAliases) {

package/dist/lib/resource-profiles.d.ts

@@ -1,10 +1,3 @@
-/**
- * Top-level resource profiles.
- *
- * These are distinct from model-provider run profiles in lib/profiles.ts. A
- * resource profile is a global mode switch stored in agents.yaml that filters
- * the resolved DotAgents resource view and secrets bundles.
- */
 import type { ResourceProfilePreset } from './types.js';
 export type ProfiledResourceKind = 'commands' | 'skills' | 'hooks' | 'subagents' | 'plugins' | 'workflows' | 'permissions' | 'mcp' | 'memory' | 'secrets';
 interface ActiveResourceProfile {

package/dist/lib/resource-profiles.js

@@ -1,10 +1,3 @@
-/**
- * Top-level resource profiles.
- *
- * These are distinct from model-provider run profiles in lib/profiles.ts. A
- * resource profile is a global mode switch stored in agents.yaml that filters
- * the resolved DotAgents resource view and secrets bundles.
- */
 import { readMeta, updateMeta } from './state.js';
 import { brandProfileName } from './brand.js';
 const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]{0,48}$/i;
@@ -18,10 +11,6 @@ function getResourceProfilePreset(name) {
     return readMeta().profiles?.presets?.[name] ?? null;
 }
 function getActiveResourceProfileName() {
-    // A white-label brand pins its own profile; when running under a brand
-    // (AGENTS_BRAND set) that preset wins over the global `profiles.active`, so
-    // every resource filter that keys off the active profile becomes brand-scoped.
-    // See lib/brand.ts.
     const branded = brandProfileName();
     if (branded)
         return branded;

package/dist/lib/resources/types.d.ts

@@ -1,73 +1,24 @@
-/**
- * Unified resource system types.
- *
- * Resources merge from three layers: system → user → project
- * - Union: All resources from all layers are combined
- * - Override on name conflict: Higher layer wins (project > user > system)
- */
 import type { AgentId } from '../types.js';
 export type { AgentId };
-/** Resource origin. Precedence (highest first): project > user > plugin > system. */
 export type Layer = 'system' | 'user' | 'project' | 'plugin';
 export type ResourceKind = 'command' | 'hook' | 'skill' | 'rule' | 'mcp' | 'permission' | 'subagent' | 'workflow' | 'memory' | 'plugin';
-/** A resolved resource with its origin layer. */
 export interface ResolvedItem<T> {
     name: string;
     item: T;
     layer: Layer;
     path: string;
 }
-/**
- * Resource handler interface.
- *
- * Each resource type (commands, hooks, skills, etc.) implements this interface
- * to provide consistent list/resolve/sync behavior across all agent types.
- */
 export interface ResourceHandler<T> {
     readonly kind: ResourceKind;
-    /**
-     * List all resources across layers, with higher layer winning on name conflict.
-     * Returns a union of all resources, deduplicated by name.
-     */
     listAll(agent: AgentId, cwd?: string): ResolvedItem<T>[];
-    /**
-     * Resolve a single resource by name.
-     * Returns the winning layer's version, or null if not found.
-     */
     resolve(agent: AgentId, name: string, cwd?: string): ResolvedItem<T> | null;
-    /**
-     * Sync resolved resources to the agent's version home directory.
-     * Copies/transforms resources as needed for the agent's expected format.
-     */
     sync(agent: AgentId, versionHome: string, cwd?: string): void;
-    /**
-     * Get the file format this resource uses for a given agent.
-     */
     format(agent: AgentId): 'md' | 'toml' | 'json' | 'yaml';
-    /**
-     * Get the target directory name in the agent's version home.
-     */
     targetDir(agent: AgentId): string;
-    /**
-     * For resources that modify config files (MCP, permissions),
-     * return the config file path. Returns null if not applicable.
-     */
     configPath?(agent: AgentId, versionHome: string): string | null;
-    /**
-     * Compute content hash for a resource item (for change detection).
-     * Used by diff() to detect modifications without full content comparison.
-     * Optional — handlers that don't implement this fall back to full sync.
-     */
     hash?(item: T): string;
-    /**
-     * Compare source layers vs synced target to detect drift.
-     * Returns list of resources that differ (added, modified, removed).
-     * Enables incremental sync and "X resources out of sync" status.
-     * Optional — handlers that don't implement this always report "unknown".
-     */
     diff?(agent: AgentId, versionHome: string, cwd?: string): ResourceDiff[];
 }
-/** Result of comparing source vs target for a single resource. */
 export interface ResourceDiff {
     name: string;
     status: 'added' | 'modified' | 'removed';
@@ -75,7 +26,6 @@ export interface ResourceDiff {
     sourceHash: string | null;
     targetHash: string | null;
 }
-/** Helper to get layer directories for resource resolution. */
 export interface LayerDirs {
     system: string;
     user: string;

package/dist/lib/resources/types.js

@@ -1,8 +1 @@
-/**
- * Unified resource system types.
- *
- * Resources merge from three layers: system → user → project
- * - Union: All resources from all layers are combined
- * - Override on name conflict: Higher layer wins (project > user > system)
- */
 export {};

package/dist/lib/resources/workflows.d.ts

@@ -1,10 +1,3 @@
-/**
- * Workflows resource handler.
- *
- * Workflows are directory bundles with a WORKFLOW.md containing YAML frontmatter.
- * They optionally contain subagents/, skills/, and plugins/ subdirectories.
- * Resolution order (docs/07-entrypoints): project > user > plugin > extra > system.
- */
 import type { AgentId, ResolvedItem, ResourceHandler } from './types.js';
 interface WorkflowItem {
     name: string;