@phnx-labs/agents-cli 1.22.120 → 1.22.121

package/dist/lib/account-catalog.js

@@ -20,7 +20,6 @@ import { formatUsageSummary, renderBar, usageErrorForDisplay, viewUsageSummaryOp
 import { padToWidth, stringWidth } from './text/width.js';
 export { applyUsageHonesty };
 import chalk from 'chalk';
-/** Compact usage gauge in the USAGE column — same length as the pre-T3 inline bar. */
 const LISTING_USAGE_BAR_LEN = 5;
 /**
  * Strict "is this home actually connected?" — a live CREDENTIAL in that exact
@@ -59,20 +58,10 @@ export function groupNativeAccountRows(rows) {
     return [...grouped.values()].map(entry => ({ ...entry, versions: [...new Set(entry.versions)].sort() }))
         .sort((a, b) => a.agent.localeCompare(b.agent) || a.display.localeCompare(b.display));
 }
-/** Discover signed-in harness-native identities without copying their auth files. */
 export async function discoverNativeAccounts() {
     const rows = await collectNativeHomeRows();
     return groupNativeAccountRows(rows.map(r => ({ agent: r.agent, version: r.label, accountKey: r.accountKey, email: r.email, signedIn: r.signedIn })));
 }
-/**
- * The provider (durable-credential) accounts read through `secrets`, tolerant of
- * an unreachable standalone. Native OAuth logins never touch `secrets`, so a
- * missing/broken standalone must NOT take down the whole account view — the
- * provider section is simply reported unavailable. Only a TRANSPORT-level
- * failure (missing binary, timeout, non-JSON, spawn error) degrades; a genuine
- * data error still throws so it is never silently swallowed. DIST-1 holds: there
- * is no fallback to an embedded engine, the standalone just could not answer.
- */
 function readProviderRowsTolerant(meta) {
     try {
         const rows = Object.values(readAccountRegistry().accounts)
@@ -81,12 +70,12 @@ function readProviderRowsTolerant(meta) {
         return { rows, error: null };
     }
     catch (err) {
+        // Degrade only standalone-secrets transport failures; data errors fail loud with no embedded fallback.
         if (isSecretsTransportError(err))
             return { rows: [], error: err };
         throw err;
     }
 }
-/** Probe every installed home of every inspectable harness for its native identity. */
 export async function collectNativeHomeRows() {
     const rows = [];
     for (const agent of ALL_AGENT_IDS.filter(supportsAccountInspection)) {
@@ -99,28 +88,17 @@ export async function collectNativeHomeRows() {
                 releaseVersion: readInstallation(agent, label)?.releaseVersion ?? null,
                 accountKey: info.accountKey,
                 email: info.email,
-                // Strict: a live credential in THIS home, not a bare metadata identity.
                 signedIn: isLaunchableSignedIn(agent, home, info),
             });
         }
     }
     return rows;
 }
-/**
- * Fold installed homes + the registry into account-first native rows (pure).
- *
- * Every home carrying an identity contributes an `AccountHome`; the identity is
- * the group key. A registered account (name/id/connect home) is merged onto its
- * identity, and — crucially — a registered account whose identity has NO live
- * home still appears, as `reconnect-needed`, so a stale/expired login is never
- * silently dropped from the list nor shown as connected.
- */
 export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault) {
     const registered = listNativeAccounts(meta);
     const defaults = meta.accounts?.defaults ?? {};
     const groups = new Map();
     const keyOf = (agent, identity) => `${agent}:${identity}`;
-    // Every installed home that carries a resolvable identity seeds a group.
     for (const row of rows) {
         const identity = row.accountKey ?? row.email?.toLowerCase();
         if (!identity)
@@ -131,10 +109,6 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
         group.homes.push({ label: row.label, releaseVersion: row.releaseVersion, signedIn: row.signedIn });
         groups.set(key, group);
     }
-    // A registered account whose identity has no discovered home still belongs in
-    // the catalog — it just has nothing live to connect through yet. Its
-    // `identityKey` is the same value a home row groups on (a raw accountKey, or
-    // an already-lowercased email), so an exact-key check finds the existing group.
     for (const account of registered) {
         const key = keyOf(account.agent, account.identityKey);
         if (!groups.has(key)) {
@@ -147,11 +121,6 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
         const email = group.email ?? account?.identityLabel ?? null;
         const homes = [...group.homes].sort((a, b) => a.label.localeCompare(b.label));
         const signedIn = homes.some(h => h.signedIn);
-        // The configured per-harness account default is AUTHORITATIVE: when present,
-        // only the matching native account is the default — an explicit default that
-        // names a provider (or a stale name) never invents a native default. Only
-        // when NO account default is configured does the global-default installation
-        // home decide (diagnostic fallback).
         const defaultRef = defaults[group.agent];
         let isDefault;
         if (defaultRef !== undefined) {
@@ -161,13 +130,11 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
             const gd = globalDefault(group.agent);
             isDefault = !!gd && homes.some(h => h.label === gd);
         }
-        // The home is a PER-HOST fact: this box's recorded connect home when it is
-        // actually installed here, else the local home carrying the identity. A home
-        // label recorded on another box is never assumed to exist locally.
         const recordedHome = account ? (meta.deviceAccounts?.homes?.[account.id] ?? null) : null;
         const home = (recordedHome && homes.some(h => h.label === recordedHome))
             ? recordedHome
             : (homes.find(h => h.signedIn)?.label ?? homes[0]?.label ?? null);
+        // Credential presence without a probe is no_evidence, never claimed verification.
         out.push({
             kind: 'native',
             agent: group.agent,
@@ -182,10 +149,6 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
             state: signedIn ? 'connected' : 'reconnect-needed',
             identityLabel: email ?? account?.name ?? group.identityKey,
             provisioning: provisioningFor(group.agent),
-            // A credential is present but nothing has probed or run it here yet — that
-            // is `no_evidence` ("we did not look"), not `unverified` (PHNX-4116). The
-            // real per-box verdict is recomputed in loadAccountCatalog; the display is
-            // a fact (token + run outcomes), never this word.
             verdict: signedIn ? 'no_evidence' : 'missing',
             checkedAt: null,
             devices: [],
@@ -203,7 +166,6 @@ export function buildNativeCatalog(rows, meta, globalDefault = getGlobalDefault)
             }),
         });
     }
-    // Named accounts first, then default, then a stable display order.
     return out.sort((a, b) => a.agent.localeCompare(b.agent)
         || Number(!!b.name) - Number(!!a.name)
         || Number(b.isDefault) - Number(a.isDefault)
@@ -213,18 +175,12 @@ function provisioningFor(agent) {
     return harnessWorkerIsPerDevice(agent) ? 'per-device' : 'portable';
 }
 const TOKEN_FACT_MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
-/** `Sep 16` — the credential file's date, the only mutable part of the token fact. */
 function tokenFileDate(mtimeMs) {
     const d = new Date(mtimeMs);
     return `${TOKEN_FACT_MONTHS[d.getMonth()]} ${d.getDate()}`;
 }
-/**
- * The non-secret scheme prefix of a Claude token — `sk-ant-oat01` for a
- * setup-token, `sk-ant` for another Claude scheme, `token` otherwise. NEVER the
- * secret body: only a fixed, publicly-documented prefix is returned so the fact
- * can be printed and fleet-synced safely (root AGENTS.md §Security).
- */
 function safeTokenPrefix(raw) {
+    // Expose fixed public scheme names only; never return token body bytes.
     const value = raw.trim();
     if (value.startsWith('sk-ant-oat01'))
         return 'sk-ant-oat01';
@@ -249,13 +205,13 @@ export function readTokenFact(agent, dir) {
             const prefix = safeTokenPrefix(fs.readFileSync(oauth, 'utf-8'));
             return `${prefix} (${tokenFileDate(stat.mtimeMs)})`;
         }
-        catch { /* fall through to the native-credential check */ }
+        catch { }
         try {
             const creds = path.join(dir, '.claude', '.credentials.json');
             const stat = fs.statSync(creds);
             return `native login (${tokenFileDate(stat.mtimeMs)})`;
         }
-        catch { /* no credential file */ }
+        catch { }
         return 'no token';
     }
     return credentialPresence(agent, dir).perVersion ? 'credential present' : 'no token';
@@ -282,11 +238,6 @@ export function toProviderRow(account, meta) {
         fix: secretPresent ? null : `agents accounts set-key ${account.name}`,
     };
 }
-/**
- * Wire the real collectors to the pure builder. This is the canonical
- * account-first read model `view.ts` renders: native identities (account +
- * connection first, release/home secondary) plus durable provider credentials.
- */
 export async function loadAccountCatalog() {
     const meta = readMeta();
     const native = buildNativeCatalog(await collectNativeHomeRows(), meta);
@@ -303,13 +254,9 @@ export async function loadAccountCatalog() {
         const localHome = row.installations.find((home) => home.label === row.home)
             ?? row.installations.find((home) => home.signedIn)
             ?? row.installations[0];
+        // Slot credential truth comes from slotDir and cache key slot:<id>;
+        // version-home state is only the no-slot fallback.
         const slot = row.id ? localSlots[row.id] : undefined;
-        // A slot account's local truth is the SLOT — its own credential file and its
-        // own daemon probe row (keyed `slot:<id>`) — never the version home its label
-        // happens to match. Reading the version home here is what rendered a
-        // signed-in slot MISSING: the slot record held ensureSlot's `unconfigured`
-        // default, the daemon never probed the slot, and `signedIn` came from an
-        // unrelated home.
         const slotSignedIn = slot
             ? await getAccountInfo(row.agent, slot.slotDir)
                 .then((info) => isLaunchableSignedIn(row.agent, slot.slotDir, info))
@@ -325,10 +272,6 @@ export async function loadAccountCatalog() {
             verdict: observation.verdict,
             ...(observation.checkedAt ? { checkedAt: observation.checkedAt } : {}),
         };
-        // Registered accounts join fleet state on their stable id ONLY — two
-        // accounts may share one email label, so a label join would cross-attribute
-        // one account's revoked verdict to the other. The label index exists solely
-        // for unnamed legacy logins, which have no registry id to key on.
         const fromFleet = row.id
             ? (shared.get(`${row.agent}:${row.id}`) ?? [])
             : (shared.get(`label:${row.agent}:${row.identityLabel}`) ?? []);
@@ -342,10 +285,6 @@ export async function loadAccountCatalog() {
         const inv = localHome ? inventoryByHome.get(`${row.agent}:${localHome.label}`) : undefined;
         row.usageSnapshot = inv?.snapshot ?? null;
         row.usageError = inv?.usageError ?? null;
-        // The per-box FACTS (PHNX-4116): the token file on disk and the recorded run
-        // (or probe) outcome — never a verdict word. `cached` is the same row the
-        // observation used (slot key first, then the version-home label), so the
-        // fact and the internal verdict read the same evidence.
         const credentialDir = slot?.slotDir ?? (localHome ? getVersionHomePath(row.agent, localHome.label) : null);
         row.token = readTokenFact(row.agent, credentialDir);
         row.lastAuth = formatAuthFact(cached ?? null);
@@ -363,13 +302,6 @@ export async function loadAccountCatalog() {
         ? { native, provider, secretsUnavailable: { code: error.code, message: error.message } }
         : { native, provider };
 }
-/**
- * The one clear line a read-only surface prints when the provider section could
- * not be read (PHNX-3989) — so a missing/broken standalone is stated plainly
- * while the native rows and the rest of the output still render. Null when the
- * catalog is complete. Printed to stderr by the command so it never corrupts
- * `--json` stdout.
- */
 export function secretsUnavailableNote(catalog) {
     const err = catalog.secretsUnavailable;
     if (!err)
@@ -389,19 +321,11 @@ function providerListEntry(row, harness) {
         checkedAt: null,
         devices: [],
         usage: null,
-        // A durable provider credential is a key, not a run-tracked login: state its
-        // presence as the token fact; there is no per-run auth evidence to render.
         token: row.verdict === 'ready' ? 'api key (present)' : 'no key',
         lastAuth: 'not used on this box yet',
         fix: row.fix,
     };
 }
-/**
- * Unfiltered JSON emits one entry per harness the credential authenticates
- * (same `id`, `kind: 'provider'`, each with its own `harness`), plus one
- * `harness: null` entry for an orphan. A harness filter emits only that
- * harness's entry. The v2 field set is otherwise unchanged.
- */
 function providerJsonEntries(row, harness) {
     if (harness) {
         return row.harnesses.includes(harness) ? [providerListEntry(row, harness)] : [];
@@ -436,13 +360,6 @@ export function accountListJson(native, providers = [], harness) {
         ],
     };
 }
-/**
- * A state worth an operator's attention, rendered at the END of the row.
- * `live`, `ready`, `unverified` and `per-device` are the ordinary cases: they
- * were on every row of the old table and pushed it past the terminal width
- * without telling anyone anything. They stay in `accounts list --fleet`,
- * `accounts view <name>` and `--json`.
- */
 function verdictNote(verdict) {
     if (verdict === 'rate_limited')
         return chalk.yellow('rate-limited');
@@ -451,22 +368,10 @@ function verdictNote(verdict) {
     }
     return null;
 }
-/**
- * Device coverage, but only when it SPLITS the fleet: some boxes can use the
- * account and some cannot. Full coverage is the ordinary case, and "none of
- * them" is already exactly what the row's state note says, so both render
- * nothing — `accounts list --fleet` is the per-device table.
- */
 export function coverageNote(row, localDevice) {
     const names = [...new Set(row.devices.map((device) => device.device))];
-    // Peers on an older release do not publish slot verdicts, so the only
-    // observation is this box — that is a gap in what we can see, not a gap in
-    // provisioning, so it is not an alarm.
     if (names.length === 1 && names[0] === localDevice)
         return null;
-    // Per-device accounts are provisioned per box; name the boxes it is NOT on
-    // rather than a usable/total fraction — the fraction would hide that each box
-    // is its own account.
     if (row.provisioning === 'per-device') {
         const absent = row.devices.filter((device) => device.verdict === 'missing').map((device) => device.device);
         return absent.length > 0 && absent.length < row.devices.length ? `not on ${absent.join(', ')}` : null;
@@ -478,18 +383,7 @@ export function coverageNote(row, localDevice) {
     return `usable on ${usable} of ${provisioned} boxes`;
 }
 export const OVERVIEW_MAX_USAGE_WINDOWS = 2;
-/**
- * The one line under an account listing. It explains the two marks a row can
- * carry and names where the columns the listing no longer prints — identity,
- * per-device state — still live. Shared with `agents view` so the two surfaces
- * cannot drift.
- */
 export const ACCOUNT_LISTING_LEGEND = '* stale usage · a healthy account carries no state · identity + per-box state: agents accounts list --fleet';
-/**
- * When a usage reading arrived from ANOTHER box's poller over the fleet store,
- * name its origin — `(from zion)` — so the number reads as a synced fact, not a
- * local capture (PHNX-4116). Local captures (statusline/poll) carry no suffix.
- */
 function usageOriginSuffix(snapshot) {
     const poller = snapshot?.freshness?.source === 'sync' ? snapshot.freshness.poller : undefined;
     return poller ? ` ${chalk.gray(`(from ${poller})`)}` : '';
@@ -509,11 +403,6 @@ function usageText(row, maxWindows) {
     const percent = `${row.usage.usedPercent}%${row.usage.stale ? '*' : ''}`;
     return `${renderBar(row.usage.usedPercent, LISTING_USAGE_BAR_LEN)} ${percent}`;
 }
-/**
- * Colour the auth FACT by what it states (PHNX-4116): a recent success is green,
- * a server rejection red, a throttle yellow, and "not used on this box yet" the
- * neutral gray of a fact that carries no alarm.
- */
 export function authFactNote(lastAuth) {
     if (lastAuth.startsWith('last used ok'))
         return chalk.green(lastAuth);
@@ -525,13 +414,7 @@ export function authFactNote(lastAuth) {
 }
 function nativeLine(row, localDevice, maxWindows) {
     return {
-        // A discovered login nobody has named is still identified by what it is:
-        // the row no longer carries an IDENTITY column, so the identity IS the name.
         name: row.name ?? row.identityLabel,
-        // FACTS, in order: the token on disk, what happened when it was last used, a
-        // signed-out flag when there is no credential at all, fleet coverage, then the
-        // repair. The auth fact already carries a throttle/failure with its time, so
-        // there is no separate verdict word (PHNX-4116).
         notes: [
             chalk.gray(row.token),
             authFactNote(row.lastAuth),
@@ -570,7 +453,6 @@ function pushGroup(out, title, lines, widths, harnessHeadings) {
     }
     out.push('');
 }
-/** Shared text renderer used by both `accounts list` and account-first `view`. */
 export function renderAccountRows(rows, opts) {
     const heading = opts.heading !== false;
     const footer = opts.footer !== false;
@@ -626,9 +508,6 @@ export function renderAccountRows(rows, opts) {
             pushGroup(out, 'Other accounts', orphans, widths, true);
     }
     if (footer) {
-        // "Need you" is an actionable repair, not an unread usage probe. Unverified
-        // (a worker whose token lacks the usage scope) has no fix and must not
-        // inflate the count.
         const count = visibleNative.filter((row) => !!row.fix).length
             + visibleProviders.filter((row) => !!row.fix).length;
         out.push(chalk.gray(`${count} accounts need you · add: agents accounts add <harness>`));
@@ -661,11 +540,6 @@ export function readSharedAccountVerdicts(userAgentsDir) {
     }
     return out;
 }
-/**
- * Devices whose daemon-state file exists but carries no account verdicts —
- * typically an older release that has not started publishing the T3 envelope.
- * The fleet matrix lists them in a coverage note rather than as blank columns.
- */
 export function listDevicesWithoutAccountVerdicts(userAgentsDir) {
     const out = [];
     for (const state of readFleetSharedDeviceStates(userAgentsDir).states) {
@@ -675,26 +549,14 @@ export function listDevicesWithoutAccountVerdicts(userAgentsDir) {
     return out.sort((a, b) => a.localeCompare(b));
 }
 function normalizeAuthVerdict(verdict, signedIn) {
-    // `unconfigured` is the slot record's DEFAULT (ensureSlot), not a probe
-    // result — the daemon never publishes it (probeLocalFleetAuth drops those
-    // rows). So it says nothing about the credential on disk; the live signedIn
-    // read of the slot decides, exactly as it does when no verdict exists at all.
-    // No probe row, or one that says nothing about the credential: a present
-    // credential with no evidence either way is `no_evidence`, never a word that
-    // claims we looked (PHNX-4116).
     if (verdict === 'unconfigured')
         return signedIn ? 'no_evidence' : 'missing';
     if (verdict === 'error')
         return signedIn ? 'no_evidence' : 'missing';
     return verdict ?? (signedIn ? 'no_evidence' : 'missing');
 }
-/**
- * Merge the two writers of the same local truth — the T1 slot store and the
- * daemon's auth-health cache — by NEWEST observation. A naive `??` chain lets
- * an older slot `live` permanently mask a newer daemon `revoked`, so a revoked
- * account would keep rendering LIVE on its own device. Pure.
- */
 export function resolveLocalAccountObservation(slot, cached, signedIn) {
+    // The slot store and daemon cache are concurrent writers; newest timestamp wins.
     const slotAt = slot?.checkedAt ? Date.parse(slot.checkedAt) : null;
     const cachedAt = cached?.checkedAt ?? null;
     const preferSlot = !!slot && (!cached || (slotAt !== null && (cachedAt === null || slotAt >= cachedAt)));
@@ -717,14 +579,6 @@ export function aggregateAccountVerdict(provisioning, devices, localQuota) {
         return 'revoked';
     if (verdicts.includes('expired'))
         return 'expired';
-    // LIMITED comes from the usage snapshot only (PHNX-3940/4051): an account's
-    // quota is one shared identity and `deriveUsageStatusFromSnapshot` already
-    // applies the freshness gate (expired windows -> staleWindows), so a
-    // `last_seen` snapshot whose blocking windows are below 100% is trustworthy
-    // for "not throttled". A remote `rate_limited` (probe 429) never sets STATE;
-    // only the local `QuotaSummary.status` (`rate_limited`/`out_of_credits` via
-    // `applyUsageHonesty`) does. When this box has no usage snapshot at all
-    // (no windows, `usedPercent === null`), the remote `rate_limited` may stand.
     const hasLocalSnapshot = !!localQuota && localQuota.usedPercent !== null && localQuota.usedPercent !== undefined;
     if (!hasLocalSnapshot && verdicts.includes('rate_limited'))
         return 'rate_limited';

package/dist/lib/account-provider-registry.d.ts

@@ -5,23 +5,9 @@ export interface AccountProviderAdapter {
     authKinds: readonly AccountAuthKind[];
     envFor(host: AgentId, kind: AccountAuthKind): string;
     connectionEnvFor(host: AgentId): Record<string, string>;
-    /**
-     * The env var a per-account BASE_URL override should be written to for this
-     * host, or null when the provider has no endpoint env on that host. Derived
-     * from the provider's own connection env so the base-url key lives in one
-     * place instead of being re-guessed by callers.
-     */
     baseUrlEnvFor(host: AgentId): string | null;
     validate(kind: AccountAuthKind, value: string): void;
 }
 export declare function getAccountProvider(provider: string): AccountProviderAdapter;
-/**
- * Whether a provider account of kind `auth` can authenticate `agent` — i.e. the
- * adapter has an `envFor(agent, auth)` mapping. Used both by the account UI and by
- * the run-candidate pool so a Cursor key never enters Claude's pool and a harness
- * with no provider adapter at all (e.g. kimi, native-login only) yields nothing.
- * A "cannot authenticate" is a clean false; any other error (unknown provider,
- * unsupported kind) is a real bug and re-throws rather than being swallowed.
- */
 export declare function providerAuthenticatesHarness(provider: string, auth: AccountAuthKind, agent: AgentId): boolean;
 export declare function listAccountProviders(): string[];

package/dist/lib/account-provider-registry.js

@@ -54,14 +54,6 @@ export function getAccountProvider(provider) {
         throw new Error(`Unknown account provider '${provider}'. Supported: ${listAccountProviders().join(', ')}.`);
     return adapter;
 }
-/**
- * Whether a provider account of kind `auth` can authenticate `agent` — i.e. the
- * adapter has an `envFor(agent, auth)` mapping. Used both by the account UI and by
- * the run-candidate pool so a Cursor key never enters Claude's pool and a harness
- * with no provider adapter at all (e.g. kimi, native-login only) yields nothing.
- * A "cannot authenticate" is a clean false; any other error (unknown provider,
- * unsupported kind) is a real bug and re-throws rather than being swallowed.
- */
 export function providerAuthenticatesHarness(provider, auth, agent) {
     try {
         getAccountProvider(provider).envFor(agent, auth);

package/dist/lib/account-registry.d.ts

@@ -29,94 +29,29 @@ export type UnifiedAccount = (CredentialAccount & {
 }) | NativeAccount;
 export declare function readAccountRegistry(base?: string): AccountRegistryDocument;
 export declare function findAccount(name: string, doc?: AccountRegistryDocument): CredentialAccount | null;
-/**
- * Effective native accounts: the fleet-shared central store (version-scoped
- * identities) merged with THIS box's own device doc (device-scoped identities).
- * A native login is machine-local — its home follows its scope (PHNX-3315), so
- * a `scope:'device'` identity is read from this box's device doc and never the
- * shared central agents.yaml (which is where its email/identityKey PII used to
- * accumulate). On an id collision the device slice wins.
- */
 export declare function listNativeAccounts(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): NativeAccount[];
-/**
- * The native account registered for one harness login, or null when that login
- * is unnamed. `info` is the login's identity as `getAccountInfo` /
- * `readClaudeHomeConfig` report it; the match key is the same value every
- * catalog and inventory groups a home on — the stable `accountKey`, else the
- * lowercased email. The one lookup behind `agents view`, the device
- * inventories, and the Claude status line.
- */
 export declare function findNativeAccountByIdentity(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, agent: AgentId, info: {
     accountKey?: string | null;
     email?: string | null;
 } | null | undefined): NativeAccount | null;
-/**
- * Resolve one account by name or id across both stores, native first.
- *
- * `doc` is optional and read LAZILY: a native match returns without ever reading
- * the provider bundle registry — so a native view/attach/run never triggers a
- * bundle read, legacy-`accounts.yaml` migration, or a keychain decrypt (which
- * would surface a Touch ID prompt or crash on an undecryptable legacy item). A
- * default-evaluated `doc = readAccountRegistry()` argument would defeat this by
- * running before the body, so callers that only need a native lookup must be
- * able to omit it.
- */
 export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, doc?: AccountRegistryDocument, preferAgent?: AgentId): UnifiedAccount | null;
-/**
- * Split a management selector into its harness and name. `<harness>#<name>`
- * pins the harness; a bare name (or row id) carries none. Native names are
- * unique per harness (PHNX-3887), so a bare name alone can legitimately match a
- * claude row AND a codex row — the selector is how rename/remove say which.
- */
 export declare function parseAccountSelector(input: string): {
     agent?: AgentId;
     name: string;
 };
-/**
- * Refuse a bare name that native rows in several harnesses share. A
- * harness-qualified selector (`agent` set) never hits this — uniqueness is
- * per harness. Ids are unique so they never collide either. Shared by
- * rename/remove/view so the message stays one string.
- */
 export declare function assertUnambiguousNativeAccount(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, name: string, agent?: AgentId): void;
-/**
- * Validate a native account NAME (charset + per-harness uniqueness) WITHOUT a
- * known identity — the pre-flight `agents accounts add` runs before it
- * installs a home and drives a login, so a bad/colliding name fails before any
- * side effect instead of orphaning a freshly-minted home (PHNX-3940).
- */
 export declare function assertNativeAccountNameAvailable(name: string, agent: AgentId): void;
 export declare function addNativeAccount(name: string, agent: AgentId, identityKey: string, identityLabel: string | undefined, scope: 'version' | 'device'): NativeAccount;
-/** Create or replace the version-independent label for one native identity. */
 export declare function labelNativeAccount(agent: AgentId, identityKey: string, identityLabel: string | undefined, label: string | undefined, scope: 'version' | 'device'): NativeAccount;
-/**
- * This box's recorded home LABEL for an account, or null.
- * Reads the leftover device-scoped `homes` map so legacy `acct-*` installation
- * labels still resolve (T5/T7); spawn-time HOME is {@link readSlots}[id].slotDir.
- */
 export declare function nativeAccountHome(accountId: string, meta: Pick<Meta, 'deviceAccounts'>): string | null;
-/**
- * Set the per-harness default account by NAME only when none is configured
- * (PHNX-3940). Never overrides an existing choice — a first connect selecting a
- * default is a convenience, not a takeover. Returns whether it set the default.
- *
- * The check-then-write is performed INSIDE the `updateMeta` callback so two
- * concurrent callers (concurrent Promises or back-to-back calls on an async
- * boundary) cannot both observe "no default" and then both set themselves. Only
- * the first write wins; the second callback sees the first's write and returns
- * the current state unchanged.
- */
 export declare function setDefaultAccountIfAbsent(agent: AgentId, name: string): boolean;
 export declare function bindAccount(nameOrId: string, target: string, preferAgent?: AgentId): UnifiedAccount;
 export declare function unbindAccount(nameOrId: string, target: string, preferAgent?: AgentId): void;
-/** Every target bound to `accountId`: this box's device-doc bindings merged over
- * the fleet-shared central bindings (PHNX-3315). */
 export declare function accountBindings(accountId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): string[];
 interface AccountSelection {
     id: string;
     source: 'explicit' | 'binding' | 'default';
 }
-/** Explicit selection wins over a configured per-harness default. */
 export declare function resolveAccountSelection(explicit: string | undefined, agent: AgentId, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, opts?: {
     useDefault?: boolean;
     target?: string;
@@ -126,22 +61,13 @@ interface AddAccountOptions {
 }
 export declare function addAccount(name: string, provider: string, auth: AccountAuthKind, secret: string, base?: string, opts?: AddAccountOptions): CredentialAccount;
 export declare function setAccountSecret(name: string, secret: string, base?: string): void;
-/**
- * `oldSelector` is a bare name, a row id, or `<harness>#<name>`. A native row
- * carries its harness, so the new name only has to be free within THAT harness
- * (PHNX-3887 / PHNX-3988): renaming codex's `cxicloud` to `icloud` is fine
- * while claude's `icloud` stays untouched. Provider accounts have no harness
- * and stay globally unique.
- */
 export declare function renameAccount(oldSelector: string, newName: string, base?: string): void;
-/** `selector` is a bare name, a row id, or `<harness>#<name>` (see {@link renameAccount}). */
 export declare function removeAccount(selector: string, base?: string): void;
 export declare function inspectAccount(name: string, base?: string): CredentialAccount & {
     secretPresent: boolean;
     policy: 'never';
 };
 export declare function resolveCredentialAccount(name: string, host: AgentId, expectedProvider?: string, base?: string): ResolvedCredentialAccount;
-/** The account a spawn should launch under, classified for the exec path. */
 export type SpawnAccount = {
     kind: 'provider';
     id: string;