@phnx-labs/agents-cli 1.22.29 → 1.22.30

package/dist/lib/account-labels.d.ts

@@ -0,0 +1,24 @@
+import type { AgentId } from './types.js';
+export interface AccountLabel {
+    agent: AgentId;
+    fingerprint: string;
+}
+export interface AccountLabelsDocument {
+    labels: Record<string, AccountLabel>;
+}
+export interface DiscoveredAccount {
+    agent: AgentId;
+    fingerprint: string;
+    display: string;
+    versions: string[];
+    label: string | null;
+}
+export declare function identityFingerprint(agent: string, accountKey: string): string;
+export declare function accountLabelsPath(base?: string): string;
+export declare function readAccountLabels(base?: string): AccountLabelsDocument;
+export declare function nameAccount(label: string, agent: AgentId, fingerprint: string, base?: string): void;
+export declare function renameAccountLabel(oldLabel: string, newLabel: string, base?: string): void;
+export declare function removeAccountLabel(label: string, base?: string): void;
+export declare function labelForFingerprint(agent: AgentId, fingerprint: string, doc?: AccountLabelsDocument): string | null;
+export declare function discoverAccounts(agentIds?: readonly AgentId[]): Promise<DiscoveredAccount[]>;
+export declare function resolveAccountLabel(agent: AgentId, label: string): Promise<string>;

package/dist/lib/account-labels.js

@@ -0,0 +1,72 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'yaml';
+import { atomicWriteFileSync } from './fs-atomic.js';
+import { getUserAgentsDir } from './state.js';
+import { ACCOUNT_INSPECTION_AGENT_IDS } from './agents.js';
+import { collectRunCandidates, pickBalancedCandidate } from './rotate.js';
+function emptyDocument() { return { labels: {} }; }
+export function identityFingerprint(agent, accountKey) { return crypto.createHash('sha256').update(`${agent}\0${accountKey}`).digest('hex'); }
+export function accountLabelsPath(base = getUserAgentsDir()) { return path.join(base, 'accounts.yaml'); }
+export function readAccountLabels(base = getUserAgentsDir()) {
+    const file = accountLabelsPath(base);
+    if (!fs.existsSync(file))
+        return emptyDocument();
+    const value = yaml.parse(fs.readFileSync(file, 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`Account labels corrupted at ${file}: expected a YAML map.`);
+    const doc = value;
+    doc.labels ??= {};
+    return doc;
+}
+function writeAccountLabels(doc, base = getUserAgentsDir()) { const file = accountLabelsPath(base); fs.mkdirSync(path.dirname(file), { recursive: true }); atomicWriteFileSync(file, yaml.stringify(doc)); }
+function assertLabel(label) { if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(label))
+    throw new Error('Label must start with a letter or number and contain only letters, numbers, dot, underscore, or dash.'); }
+export function nameAccount(label, agent, fingerprint, base = getUserAgentsDir()) {
+    assertLabel(label);
+    const doc = readAccountLabels(base);
+    for (const [other, account] of Object.entries(doc.labels))
+        if (other !== label && account.agent === agent && account.fingerprint === fingerprint)
+            throw new Error(`This ${agent} account is already named '${other}'.`);
+    if (doc.labels[label] && (doc.labels[label].agent !== agent || doc.labels[label].fingerprint !== fingerprint))
+        throw new Error(`Account label '${label}' already names another account.`);
+    doc.labels[label] = { agent, fingerprint };
+    writeAccountLabels(doc, base);
+}
+export function renameAccountLabel(oldLabel, newLabel, base = getUserAgentsDir()) { assertLabel(newLabel); const doc = readAccountLabels(base); if (!doc.labels[oldLabel])
+    throw new Error(`Unknown account label '${oldLabel}'.`); if (doc.labels[newLabel])
+    throw new Error(`Account label '${newLabel}' already exists.`); doc.labels[newLabel] = doc.labels[oldLabel]; delete doc.labels[oldLabel]; writeAccountLabels(doc, base); }
+export function removeAccountLabel(label, base = getUserAgentsDir()) { const doc = readAccountLabels(base); if (!doc.labels[label])
+    throw new Error(`Unknown account label '${label}'.`); delete doc.labels[label]; writeAccountLabels(doc, base); }
+export function labelForFingerprint(agent, fingerprint, doc = readAccountLabels()) { return Object.entries(doc.labels).find(([, account]) => account.agent === agent && account.fingerprint === fingerprint)?.[0] ?? null; }
+export async function discoverAccounts(agentIds = ACCOUNT_INSPECTION_AGENT_IDS) {
+    const labels = readAccountLabels();
+    const grouped = new Map();
+    await Promise.all(agentIds.map(async (agent) => {
+        for (const candidate of await collectRunCandidates(agent)) {
+            if (!candidate.signedIn || !candidate.accountKey)
+                continue;
+            const fingerprint = identityFingerprint(agent, candidate.accountKey);
+            const key = `${agent}:${fingerprint}`;
+            const existing = grouped.get(key);
+            if (existing)
+                existing.versions.push(candidate.version);
+            else
+                grouped.set(key, { agent, fingerprint, display: candidate.accountLabel || 'signed-in account', versions: [candidate.version], label: labelForFingerprint(agent, fingerprint, labels) });
+        }
+    }));
+    return [...grouped.values()].sort((a, b) => a.agent.localeCompare(b.agent) || a.display.localeCompare(b.display));
+}
+export async function resolveAccountLabel(agent, label) {
+    const account = readAccountLabels().labels[label];
+    if (!account)
+        throw new Error(`Unknown account label '${label}'.`);
+    if (account.agent !== agent)
+        throw new Error(`Account label '${label}' names a ${account.agent} account, not ${agent}.`);
+    const candidates = (await collectRunCandidates(agent)).filter(candidate => candidate.accountKey && identityFingerprint(agent, candidate.accountKey) === account.fingerprint);
+    const result = pickBalancedCandidate(candidates);
+    if (!result)
+        throw new Error(`No healthy installed ${agent} version is currently signed into account '${label}'.`);
+    return result.picked.version;
+}

package/dist/lib/agents.d.ts

@@ -23,7 +23,18 @@ export declare const GEMINI_HOOKS_MIN_VERSION = "0.26.0";
  * dispatcher) showed up under `agents view`'s "Not Managed by Agents CLI"
  * section, even though the user had nothing to import.
  */
-export declare function findInPath(command: string): string | null;
+interface NativeBinaryResolutionOptions {
+    shimsDir?: string;
+    historyDir?: string;
+}
+/**
+ * Resolve a PATH candidate to the immutable native executable agents-cli may
+ * safely register. An adopted launcher can live outside the shims directory
+ * while resolving back into it; in that case its durable adoption record is
+ * the source of truth for the original executable.
+ */
+export declare function resolveNativeBinaryPath(command: string, candidate: string, options?: NativeBinaryResolutionOptions): string | null;
+export declare function findInPath(command: string, options?: NativeBinaryResolutionOptions): string | null;
 /**
  * Master registry of all supported agents keyed by AgentId.
  *
@@ -289,6 +300,26 @@ export declare function antigravityOsKeyringProbe(platform?: NodeJS.Platform): {
 } | null;
 /** @internal test hook — clear the per-process keyring probe cache. */
 export declare function __resetAntigravityKeychainCacheForTest(): void;
+/**
+ * OpenCode's account identity: the sorted, "+"-joined list of provider ids
+ * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
+ * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
+ * so this join is the closest thing to "which account is this" available — the
+ * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ *
+ * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
+ * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
+ * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
+ * migrations) all three are permanently empty — no migration ever populates
+ * them, and no session has ever written a row. Reading from them instead of
+ * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
+ * uses this function rather than duplicating a sqlite lookup against those
+ * dead tables.
+ *
+ * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
+ * missing, unreadable, or carries no valid credential.
+ */
+export declare function resolveOpenCodeAccountId(base: string): string | undefined;
 /**
  * Whether a Claude version home's credential file is present but carries no
  * token — the "must have a real credential" floor (see

package/dist/lib/agents.js

@@ -21,7 +21,7 @@ import chalk from 'chalk';
 import { execFileShellSpec } from './platform/index.js';
 import { latestFileMtimeMs } from './fs-walk.js';
 import { damerauLevenshtein } from './fuzzy.js';
-import { getCacheDir, getVersionsDir, getShimsDir, getCliVersionCachePath } from './state.js';
+import { getCacheDir, getVersionsDir, getShimsDir, getHistoryDir, getCliVersionCachePath } from './state.js';
 import { resolveVersion, getVersionHomePath, getBinaryPath } from './versions.js';
 import { supports } from './capabilities.js';
 const execFileAsync = promisify(execFile);
@@ -61,20 +61,57 @@ function saveCliVersionCache() {
         /* best-effort cache persist */
     }
 }
+function pathIsWithin(candidate, directory) {
+    const relative = path.relative(directory, candidate);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
 /**
- * Synchronous PATH search -- no subprocess. Returns first matching binary path.
- *
- * Skips our own shims dir (`~/.agents/.cache/shims/`) — those shims are
- * dispatch helpers, not real installs. Counting them as installed produced a
- * false positive where agents with NO real binary on the host (e.g. a
- * never-installed Cursor whose only PATH entry was our `cursor-agent` shim
- * dispatcher) showed up under `agents view`'s "Not Managed by Agents CLI"
- * section, even though the user had nothing to import.
+ * Resolve a PATH candidate to the immutable native executable agents-cli may
+ * safely register. An adopted launcher can live outside the shims directory
+ * while resolving back into it; in that case its durable adoption record is
+ * the source of truth for the original executable.
  */
-export function findInPath(command) {
+export function resolveNativeBinaryPath(command, candidate, options = {}) {
+    const shimsDir = options.shimsDir ?? getShimsDir();
+    const historyDir = options.historyDir ?? getHistoryDir();
+    let canonicalCandidate;
+    try {
+        canonicalCandidate = fs.realpathSync(candidate);
+    }
+    catch {
+        return null;
+    }
+    let canonicalShimsDir = path.resolve(shimsDir);
+    try {
+        canonicalShimsDir = fs.realpathSync(shimsDir);
+    }
+    catch {
+        /* An absent shims dir cannot make an existing native binary invalid. */
+    }
+    if (!pathIsWithin(canonicalCandidate, canonicalShimsDir))
+        return canonicalCandidate;
+    const recordPath = path.join(historyDir, 'adopted-launchers', command);
+    try {
+        const [original] = fs.readFileSync(recordPath, 'utf-8').split(/\r?\n/, 1);
+        if (!original)
+            return null;
+        const canonicalOriginal = fs.realpathSync(original);
+        if (pathIsWithin(canonicalOriginal, canonicalShimsDir))
+            return null;
+        const stat = fs.statSync(canonicalOriginal);
+        if (!stat.isFile())
+            return null;
+        fs.accessSync(canonicalOriginal, fs.constants.X_OK);
+        return canonicalOriginal;
+    }
+    catch {
+        return null;
+    }
+}
+export function findInPath(command, options = {}) {
     const pathEnv = process.env.PATH || '';
     const pathExt = process.platform === 'win32' ? (process.env.PATHEXT || '').split(';') : [''];
-    const shimsDir = getShimsDir();
+    const shimsDir = options.shimsDir ?? getShimsDir();
     for (const dir of pathEnv.split(path.delimiter)) {
         if (!dir)
             continue;
@@ -84,8 +121,11 @@ export function findInPath(command) {
             const full = path.join(dir, command + ext);
             try {
                 const stat = fs.statSync(full);
-                if (stat.isFile())
-                    return full;
+                if (!stat.isFile())
+                    continue;
+                const native = resolveNativeBinaryPath(command, full, options);
+                if (native)
+                    return native;
             }
             catch {
                 /* not in this dir */
@@ -305,9 +345,8 @@ export const AGENTS = {
         // + warns for pre-2.4 installs); the direct `subagents add --agents cursor` path
         // writes unconditionally, same as the other since-gated agents.
         // See transformSubagentForCursor / https://cursor.com/docs/subagents.
-        // interactiveRepl: false — cursor-agent exits immediately with no argv. It requires a
-        // prompt to do anything useful; a bare invocation is not a REPL (RUSH-2185, EXEC-23a).
-        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '2026.1.22' }, rules: { file: '.cursorrules' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: false }, // allowlist: ~/.cursor/cli-config.json
+        // Current cursor-agent builds open their interactive TUI with no argv.
+        capabilities: { hooks: true, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: true, skills: true, commands: true, plugins: true, subagents: { since: '2026.1.22' }, rules: { file: '.cursorrules' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: true }, // allowlist: ~/.cursor/cli-config.json
     },
     opencode: {
         id: 'opencode',
@@ -1602,6 +1641,43 @@ function isValidOpenCodeCredential(value) {
         default: return false;
     }
 }
+/**
+ * OpenCode's account identity: the sorted, "+"-joined list of provider ids
+ * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
+ * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
+ * so this join is the closest thing to "which account is this" available — the
+ * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ *
+ * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
+ * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
+ * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
+ * migrations) all three are permanently empty — no migration ever populates
+ * them, and no session has ever written a row. Reading from them instead of
+ * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
+ * uses this function rather than duplicating a sqlite lookup against those
+ * dead tables.
+ *
+ * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
+ * missing, unreadable, or carries no valid credential.
+ */
+export function resolveOpenCodeAccountId(base) {
+    const authPath = resolveOpenCodeAuthPath(base);
+    if (!authPath)
+        return undefined;
+    try {
+        const data = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
+        if (!data || typeof data !== 'object')
+            return undefined;
+        const providers = Object.entries(data)
+            .filter(([, cred]) => isValidOpenCodeCredential(cred))
+            .map(([id]) => id)
+            .sort();
+        return providers.length ? providers.join('+') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Whether a Muse Code `~/.config/muse/auth.json` document holds any usable
  * access token. Live shape from `muse login` (device OAuth, Muse Code 0.1.0):
@@ -2020,22 +2096,11 @@ export async function getAccountInfo(agentId, home) {
                 // themselves. The user's complaint was the row read "not signed in"
                 // despite a live login; a valid provider entry now shows e.g.
                 // "id:muse-spark" so they can see exactly which provider is configured.
-                const authPath = resolveOpenCodeAuthPath(base);
-                if (!authPath)
-                    return { ...empty, lastActive };
-                const data = JSON.parse(await fs.promises.readFile(authPath, 'utf-8'));
-                if (!data || typeof data !== 'object')
-                    return { ...empty, lastActive };
-                const providers = Object.entries(data)
-                    .filter(([, cred]) => isValidOpenCodeCredential(cred))
-                    .map(([id]) => id)
-                    .sort();
-                if (providers.length === 0)
+                // resolveOpenCodeAccountId is the single source of truth for this join —
+                // session/discover.ts reuses it for the indexed `account` field.
+                const accountId = resolveOpenCodeAccountId(base);
+                if (!accountId)
                     return { ...empty, lastActive };
-                // Provider ids are config keys (e.g. "anthropic", "muse-spark"), not
-                // secrets. Join them into a stable, human-readable account label +
-                // identity key for usage dedup.
-                const accountId = providers.join('+');
                 const accountKey = buildIdentityKey(agentId, [['providers', accountId]]);
                 return { ...empty, signedIn: true, accountId, accountKey, lastActive };
             }

package/dist/lib/daemon-health.d.ts

@@ -0,0 +1,24 @@
+/** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
+export declare const SUBSYSTEM_SECRETS_BROKER = "secrets-broker";
+export declare const SUBSYSTEM_BROWSER_IPC = "browser-ipc";
+/** One subsystem's health as of the last time it reported in. */
+export interface SubsystemHealth {
+    /** Stable identifier, e.g. 'secrets-broker', 'browser-ipc'. */
+    subsystem: string;
+    /** Most recent error message, or null if it has never failed. */
+    lastError: string | null;
+    /** ISO timestamp of the most recent error, or null. */
+    lastErrorAt: string | null;
+    /** Consecutive failures since the last success (0 when currently healthy). */
+    consecutiveFailures: number;
+    /** ISO timestamp of the most recent success, or null if it has never succeeded. */
+    lastOkAt: string | null;
+}
+/** Record a successful subsystem check-in — clears the failure streak. */
+export declare function recordSubsystemOk(subsystem: string, at?: string): void;
+/** Record a subsystem failure — bumps the consecutive-failure streak. */
+export declare function recordSubsystemError(subsystem: string, error: string, at?: string): void;
+/** Read one subsystem's health record, or null if it has never reported in. */
+export declare function readSubsystemHealth(subsystem: string): SubsystemHealth | null;
+/** Read every subsystem's health record, sorted by subsystem name. */
+export declare function readAllSubsystemHealth(): SubsystemHealth[];

package/dist/lib/daemon-health.js

@@ -0,0 +1,84 @@
+/**
+ * Per-subsystem health record for the always-on daemon.
+ *
+ * Today a subsystem failure inside `runDaemon()` (daemon.ts) is a single
+ * `log('ERROR', ...)` line that scrolls out of the log file and is never
+ * surfaced anywhere else — `agents daemon status` has no way to answer "is the
+ * secrets broker actually healthy right now?" beyond "the daemon process is
+ * alive". This module gives every subsystem a small persisted record —
+ * {@link SubsystemHealth} — so `agents daemon status` / `agents daemon
+ * services` can report health, not just liveness (RUSH-2354).
+ *
+ * Scheduled routines get this for free once migrated onto `agents routines`
+ * (their run history already carries success/failure — `agents routines
+ * stats`). This module exists for the two subsystems that predate routines
+ * and have no run history of their own: the secrets broker and the browser
+ * IPC server.
+ *
+ * File-backed (one JSON object keyed by subsystem name) rather than in-memory
+ * because `agents daemon status` runs as a SEPARATE process from the daemon —
+ * it must read what the daemon last recorded, not maintain its own state.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getDaemonDir } from './state.js';
+const HEALTH_FILE = 'health.json';
+/** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
+export const SUBSYSTEM_SECRETS_BROKER = 'secrets-broker';
+export const SUBSYSTEM_BROWSER_IPC = 'browser-ipc';
+function getHealthPath() {
+    return path.join(getDaemonDir(), HEALTH_FILE);
+}
+function readAll() {
+    try {
+        const raw = fs.readFileSync(getHealthPath(), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeAll(records) {
+    const healthPath = getHealthPath();
+    fs.mkdirSync(path.dirname(healthPath), { recursive: true });
+    fs.writeFileSync(healthPath, JSON.stringify(records), 'utf-8');
+    try {
+        fs.chmodSync(healthPath, 0o600);
+    }
+    catch { /* best effort */ }
+}
+function blankRecord(subsystem) {
+    return { subsystem, lastError: null, lastErrorAt: null, consecutiveFailures: 0, lastOkAt: null };
+}
+/** Record a successful subsystem check-in — clears the failure streak. */
+export function recordSubsystemOk(subsystem, at = new Date().toISOString()) {
+    const all = readAll();
+    const existing = all[subsystem] ?? blankRecord(subsystem);
+    all[subsystem] = { ...existing, subsystem, consecutiveFailures: 0, lastOkAt: at };
+    writeAll(all);
+}
+/** Record a subsystem failure — bumps the consecutive-failure streak. */
+export function recordSubsystemError(subsystem, error, at = new Date().toISOString()) {
+    const all = readAll();
+    const existing = all[subsystem] ?? blankRecord(subsystem);
+    all[subsystem] = {
+        ...existing,
+        subsystem,
+        lastError: error,
+        lastErrorAt: at,
+        consecutiveFailures: existing.consecutiveFailures + 1,
+    };
+    writeAll(all);
+}
+/** Read one subsystem's health record, or null if it has never reported in. */
+export function readSubsystemHealth(subsystem) {
+    return readAll()[subsystem] ?? null;
+}
+/** Read every subsystem's health record, sorted by subsystem name. */
+export function readAllSubsystemHealth() {
+    return Object.values(readAll()).sort((a, b) => a.subsystem.localeCompare(b.subsystem));
+}

package/dist/lib/daemon-ticks.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Daemon housekeeping ticks — one-shot bodies invoked by system routines.
+ *
+ * RUSH-2353: these were ~15 hardcoded `setInterval` timers inside
+ * `runDaemon()` (daemon.ts) — a parallel, inferior reimplementation of the
+ * routines system (no declaration, no run history, no pause/disable, no
+ * device pin). Each function here is one migrated tick's *body*, unchanged in
+ * behavior, now invoked as a detached one-shot process by a system routine's
+ * `command:` (via the `agents __daemon-tick <name>` entrypoint in index.ts)
+ * instead of an in-process interval closure.
+ *
+ * Overlap protection that used to live in daemon.ts as a per-tick boolean
+ * flag (`watchdogInFlight`, `probingDevices`, ...) is now provided by the
+ * routine runner's launch claim (`withRoutineLaunchClaim` in runner.ts) — two
+ * fires of the same routine name never run concurrently.
+ *
+ * Output goes to `console.log`/`console.error`: each tick runs as a spawned
+ * child of `executeCommandJobDetached`, which redirects the child's stdout to
+ * the run's `stdout.log` — so this doubles as the run's log, readable via
+ * `agents routines runs <name>`.
+ */
+/** ~every 3 min. Mirrors the old WATCHDOG_TICK_MS. */
+export declare function runWatchdogTick(): Promise<void>;
+/**
+ * Device probe: refresh registered devices' reachability and detect newly
+ * appeared tailnet nodes, dropping a sentinel per pending device so the
+ * menu-bar helper can surface "NEW DEVICES -> Register / Ignore". Refresh
+ * mode never auto-registers a newcomer. A machine without tailscale is a
+ * clean no-op. ~every 3 min.
+ */
+export declare function runDeviceProbeTick(): Promise<void>;
+/**
+ * tmux hook reconcile: retrofit the guarded `pane-died` hook onto managed
+ * `agents run` sessions a pre-fix binary left with the old unconditional
+ * hook. Non-destructive: set-hook only, never a kill or detach. ~every 5 min.
+ */
+export declare function runTmuxReconcileTick(): Promise<void>;
+/**
+ * Launch-health self-heal: probe that each agent's DEFAULT version actually
+ * LAUNCHES, and repair a gutted install. Never repoints the global default
+ * (allowDefaultSwitch: false) — a background default switch would be a
+ * silent logout. ~every 6h.
+ */
+export declare function runLaunchHealthTick(): Promise<void>;
+/**
+ * Fleet cache warm: publish THIS host's row for the caches `agents fleet
+ * status` / `agents devices list` read (PUBLISH-OWN / READ-UNION, RUSH-2061).
+ * ~every 3 min.
+ */
+export declare function runFleetCacheWarmTick(): Promise<void>;
+/**
+ * Session-status cache warm (RUSH-2062): publish THIS host's local active
+ * sessions so menubar / Factory / watchdog / CLI share one warm snapshot.
+ * Publish-own only (no cross-host SSH). ~every 3 min.
+ */
+export declare function runSessionCacheWarmTick(): Promise<void>;
+/**
+ * Usage refresh: keep the usage cache the `agents run` router reads
+ * (RUSH-2061, readOnly hot path) fresh, WITHOUT the hot path ever fetching.
+ * This host is the sole writer for its own local accounts. ~every 60s
+ * (USAGE_REFRESH_TICK_MS in usage-refresh.ts — keep in sync).
+ */
+export declare function runUsageRefreshTick(): Promise<void>;
+/**
+ * Auto-dispatch: for any managed project that has opted in (autoDispatch:true
+ * + maxAgents>0 in ~/.agents/factory/projects.json), pick up Linear tickets
+ * delegated to an agent and still in Todo, and dispatch each through
+ * agents-cli's own cloud-provider layer. OFF unless a project opts in; no
+ * opted-in project or no LINEAR_API_KEY is a clean no-op. ~every 3 min.
+ *
+ * Migrated to a routine (RUSH-2353) so it inherits the `devices:` allowlist —
+ * pin with `agents routines devices auto-dispatch --set <one>` to fix the
+ * shared-input double-fire problem this job had hardcoded (every daemon on
+ * the fleet polled the same Linear queue with no coordination).
+ */
+export declare function runAutoDispatchTick(): Promise<void>;
+/** Registry: routine-facing name -> tick body. Keys match the shipped routine YAML names. */
+export declare const DAEMON_TICKS: Record<string, () => Promise<void>>;
+export declare const DAEMON_TICK_ROUTINE_NAMES: readonly string[];
+/** Run one named tick, or throw for an unknown name (fails the routine run loud). */
+export declare function runDaemonTick(name: string): Promise<void>;