@phnx-labs/agents-cli 1.22.42 → 1.22.44

package/dist/lib/sandbox.js

@@ -43,6 +43,14 @@ const ENV_ALLOWLIST = [
     'VISUAL',
     'NO_COLOR',
     'FORCE_COLOR',
+    // GitHub CLI — same host credentials interactive `agents run` already sees.
+    // Without these, a sandboxed monitor `--run` child has no gh auth even when
+    // the daemon user is logged in (RUSH-2860).
+    'GH_TOKEN',
+    'GH_HOST',
+    'GH_ENTERPRISE_TOKEN',
+    'GITHUB_TOKEN',
+    'GH_CONFIG_DIR',
 ];
 /** Tools safe to grant as wildcards (no filesystem access). */
 const SAFE_TOOLS = {
@@ -57,6 +65,32 @@ function tomlString(value) {
     }
     return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
+/**
+ * Absolute path to this host's `gh` config directory (`hosts.yml` + `config.yml`),
+ * or null when the host has never run `gh auth login`. Prefer `GH_CONFIG_DIR` when
+ * the parent already pinned one; otherwise `$XDG_CONFIG_HOME/gh` or `~/.config/gh`.
+ */
+export function resolveHostGhConfigDir() {
+    // Honor an explicit pin only when it actually exists; otherwise fall through
+    // to the default locations so a stale/broken GH_CONFIG_DIR cannot hide a
+    // healthy ~/.config/gh (RUSH-2860).
+    if (process.env.GH_CONFIG_DIR && fs.existsSync(process.env.GH_CONFIG_DIR)) {
+        return process.env.GH_CONFIG_DIR;
+    }
+    const configHome = process.env.XDG_CONFIG_HOME || path.join(resolveRealHome(), '.config');
+    const ghDir = path.join(configHome, 'gh');
+    return fs.existsSync(ghDir) ? ghDir : null;
+}
+/** True when this host holds usable GitHub CLI auth (hosts.yml or a token env). */
+export function hostHasGhAuth() {
+    if (process.env.GH_TOKEN || process.env.GH_ENTERPRISE_TOKEN || process.env.GITHUB_TOKEN) {
+        return true;
+    }
+    const dir = resolveHostGhConfigDir();
+    if (!dir)
+        return false;
+    return fs.existsSync(path.join(dir, 'hosts.yml'));
+}
 /** Build a restricted environment for a sandboxed process, setting HOME to the overlay. */
 export function buildSpawnEnv(overlayHome, extraEnv) {
     const env = {
@@ -68,6 +102,18 @@ export function buildSpawnEnv(overlayHome, extraEnv) {
             env[key] = process.env[key];
         }
     }
+    // Pin GH_CONFIG_DIR at the REAL host config so `gh` does not look under the
+    // disposable overlay HOME (which has no hosts.yml). Same posture as linking
+    // Cursor's auth.json — forward the credentials the daemon user already holds
+    // (RUSH-2860). Always prefer resolveHostGhConfigDir over a stale allowlisted
+    // value; an explicit extraEnv GH_CONFIG_DIR still wins below.
+    const hostGh = resolveHostGhConfigDir();
+    if (hostGh) {
+        env.GH_CONFIG_DIR = hostGh;
+    }
+    else {
+        delete env.GH_CONFIG_DIR;
+    }
     if (extraEnv) {
         Object.assign(env, extraEnv);
     }
@@ -101,11 +147,66 @@ export function prepareJobHome(config) {
     else if (config.agent === 'cursor') {
         generateCursorConfig(overlayHome);
     }
+    // Host tool credentials / setup the overlay HOME would otherwise hide.
+    // Cursor already links its own auth above; gh is harness-agnostic and needed
+    // by every sandboxed `--run` that shells out to `gh` (RUSH-2860 — monitor
+    // merge agents saw "not logged into any GitHub hosts" while the daemon user
+    // was fine).
+    //
+    // Deliberately NOT linking the real ~/.agents here. It would put the secrets
+    // master key (.secrets-key) and the encrypted store (.cache/secrets) together
+    // at a predictable path inside the overlay, through a writable symlink, in a
+    // child whose prompt can carry untrusted text from a watched source. The
+    // separate "agents-cli is not set up" defect (state.ts ignores AGENTS_USER_DIR)
+    // gets its own scoped change: RUSH-2954.
+    linkHostGhConfig(overlayHome);
     if (config.allow?.dirs) {
         symlinkAllowedDirs(overlayHome, config.allow.dirs);
     }
     return overlayHome;
 }
+/**
+ * Link this host's `gh` config directory into the disposable overlay so
+ * `$HOME/.config/gh` resolves even when `GH_CONFIG_DIR` is unset. Mirrors
+ * `generateCursorConfig`: same-host credentials, never copied to another box.
+ */
+export function linkHostGhConfig(overlayHome) {
+    const realGhDir = resolveHostGhConfigDir();
+    if (!realGhDir || !fs.existsSync(realGhDir))
+        return;
+    const overlayGhDir = path.join(overlayHome, '.config', 'gh');
+    if (fs.existsSync(overlayGhDir))
+        return;
+    fs.mkdirSync(path.dirname(overlayGhDir), { recursive: true });
+    try {
+        createLink(realGhDir, overlayGhDir);
+    }
+    catch {
+        /* cross-volume or link creation refused: GH_CONFIG_DIR in buildSpawnEnv is the backup */
+    }
+}
+/**
+ * Refuse to launch a sandboxed child when THIS host holds GitHub auth but the
+ * spawn env would hide it. The RUSH-2860 failure mode was silent: the monitor
+ * fire recorded `ok` (spawn succeeded) while every `gh` call inside the child
+ * failed. Prefer forwarding (buildSpawnEnv / linkHostGhConfig); this assert is
+ * the regression tripwire — if forwarding ever regresses, fail loud at spawn
+ * instead of recording a hollow success. No-ops when the host has no gh auth
+ * (jobs that do not need GitHub still run).
+ */
+export function assertSandboxForwardsHostGhAuth(spawnEnv) {
+    if (!hostHasGhAuth())
+        return;
+    if (spawnEnv.GH_TOKEN || spawnEnv.GH_ENTERPRISE_TOKEN || spawnEnv.GITHUB_TOKEN)
+        return;
+    if (spawnEnv.GH_CONFIG_DIR && fs.existsSync(path.join(spawnEnv.GH_CONFIG_DIR, 'hosts.yml')))
+        return;
+    if (spawnEnv.HOME && fs.existsSync(path.join(spawnEnv.HOME, '.config', 'gh', 'hosts.yml')))
+        return;
+    throw new Error("sandbox spawn would hide this host's GitHub auth from the child " +
+        '(no GH_CONFIG_DIR / ~/.config/gh / GH_TOKEN). Refusing to launch — ' +
+        'the agent would record ok then fail every gh call (RUSH-2860).');
+}
 /** Link this host's Cursor login and CLI config into the disposable overlay. */
 export function generateCursorConfig(overlayHome) {
     const realConfigHome = process.env.XDG_CONFIG_HOME || path.join(resolveRealHome(), '.config');

package/dist/lib/scheduling/routines.d.ts

@@ -107,8 +107,14 @@ export interface JobConfig {
     schedule?: string;
     /** Event/webhook fire condition. Optional when `schedule` is set. */
     trigger?: JobTrigger;
-    /** Which agent runs the routine. Optional — omitted for `workflow`/`command` routines. Exactly one of agent/workflow/command must be set. */
-    agent?: AgentId;
+    /**
+     * Which agent runs the routine — a native harness id, or the name of a
+     * custom harness (`agents harness list`), which the runner delegates to
+     * `agents run <name>` the same way workflow jobs are. Optional — omitted
+     * for `workflow`/`command` routines. Exactly one of agent/workflow/command
+     * must be set.
+     */
+    agent?: AgentId | (string & {});
     workflow?: string;
     /**
      * A plain shell command run directly instead of an agent/workflow — no LLM,
@@ -298,16 +304,16 @@ export interface JobConfig {
      * `lib/monitors/config.ts`) — re-gating here was double-gating on the wrong
      * key.
      *
-     * Deliberately narrow: a monitor's `routine` action fires a REAL routine, which
-     * keeps its activation gate, so a routine defined but not activated on this
-     * device is still refused.
+     * Deliberately narrow: a monitor's or webhook handler's `routine` action fires a
+     * REAL routine, which keeps its activation gate, so a routine defined but not
+     * activated on this device is still refused.
      *
      * Runtime-only, enforced at both ends of the schema boundary: `writeJob`
      * strips it, and `readJobFileResult` refuses a definition that carries it
      * (a hand-authored one would otherwise fire on every box regardless of
      * activation, since the daemon's load path never calls `validateJob`).
      */
-    dispatchedBy?: 'monitor';
+    dispatchedBy?: 'monitor' | 'webhook';
 }
 /**
  * Canonical form of a routine's `projects` field: drop non-string and empty
@@ -399,7 +405,7 @@ export declare function resolveJobExecutionContext(config: Pick<JobConfig, 'name
 export interface RunMeta {
     jobName: string;
     runId: string;
-    agent?: AgentId;
+    agent?: AgentId | (string & {});
     /**
      * Resolved agent version this run launched under. Re-pointed to each failover
      * attempt's version as the single-shot chain advances (runner.ts), so it names
@@ -504,10 +510,13 @@ export declare function finalizeRunMeta(meta: RunMeta, status: RunMeta['status']
  * `yosemite-s0` all agree. Every fire path (cron scheduler, webhook,
  * catchup/overdue, manual run) gates on this.
  *
- * A monitor-dispatched job ({@link JobConfig.dispatchedBy} `=== 'monitor'`) skips
+ * A monitor- or webhook-dispatched job ({@link JobConfig.dispatchedBy} set) skips
  * the routine activation manifest: it is not a routine, so its name can never be
  * a member and the lookup could only ever answer "not activated here"
- * (RUSH-2681). Its ownership was already decided by the monitor's `device:` pin.
+ * (RUSH-2681 for monitors; the same hole broke every `run.agent`/`run.workflow`
+ * webhook handler, which the receiver logged as `fired` while the run record read
+ * `skipped` with an empty allowlist). Ownership was already decided upstream — by
+ * the monitor's `device:` pin, or by the one box the webhook was delivered to.
  */
 export declare function jobRunsOnThisDevice(config: Pick<JobConfig, 'name' | 'devices' | 'dispatchedBy'>): boolean;
 /**

package/dist/lib/scheduling/routines.js

@@ -14,6 +14,7 @@ import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getP
 import * as os from 'os';
 import { safeJoin, isSafeSegmentName } from '../paths.js';
 import { isSafeProjectName, loadProjectDef, projectBasePath } from '../projects.js';
+import { isCustomHarnessName } from '../profiles.js';
 import { resolveRoutineExecutionContext, } from '../routine-context.js';
 import { atomicWriteFileSync } from '../fs-atomic.js';
 import { ALL_AGENT_IDS, ROUTINE_AGENT_IDS } from '../agents.js';
@@ -351,13 +352,16 @@ export function finalizeRunMeta(meta, status, exitCode, opts) {
  * `yosemite-s0` all agree. Every fire path (cron scheduler, webhook,
  * catchup/overdue, manual run) gates on this.
  *
- * A monitor-dispatched job ({@link JobConfig.dispatchedBy} `=== 'monitor'`) skips
+ * A monitor- or webhook-dispatched job ({@link JobConfig.dispatchedBy} set) skips
  * the routine activation manifest: it is not a routine, so its name can never be
  * a member and the lookup could only ever answer "not activated here"
- * (RUSH-2681). Its ownership was already decided by the monitor's `device:` pin.
+ * (RUSH-2681 for monitors; the same hole broke every `run.agent`/`run.workflow`
+ * webhook handler, which the receiver logged as `fired` while the run record read
+ * `skipped` with an empty allowlist). Ownership was already decided upstream — by
+ * the monitor's `device:` pin, or by the one box the webhook was delivered to.
  */
 export function jobRunsOnThisDevice(config) {
-    if (config.dispatchedBy !== 'monitor') {
+    if (config.dispatchedBy === undefined) {
         const activated = routineEnabledOnThisDevice(config.name);
         if (activated !== null)
             return activated;
@@ -636,7 +640,7 @@ export function readJobFileResult(filePath) {
     // written back (writeJob deletes it), so its presence here means hand-authored
     // state, not drift.
     if (Object.prototype.hasOwnProperty.call(parsed, 'dispatchedBy')) {
-        return { config: null, problem: '`dispatchedBy:` is a runtime-only monitor marker, not a routine field — routine is inert' };
+        return { config: null, problem: '`dispatchedBy:` is a runtime-only monitor/webhook marker, not a routine field — routine is inert' };
     }
     return {
         config: {
@@ -844,13 +848,17 @@ export function validateJob(config) {
     if (config.command !== undefined && (typeof config.command !== 'string' || config.command.trim() === '')) {
         errors.push('command must be a non-empty shell command string');
     }
-    if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent)) {
-        errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}`);
+    if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent) && !isCustomHarnessName(config.agent)) {
+        errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}, or a custom harness (agents harness list)`);
     }
     else if (hasAgent && config.agent && strategy === 'local' &&
-        !ROUTINE_AGENT_IDS.includes(config.agent)) {
+        !ROUTINE_AGENT_IDS.includes(config.agent) &&
+        // A custom harness is exempt from the local-daemon command table: the
+        // runner delegates it to `agents run <name>`, the same path workflow
+        // jobs take, so no ROUTINE_AGENT_COMMANDS template is needed.
+        !isCustomHarnessName(config.agent)) {
         // The local daemon only knows how to build a command for the agents in
-        // ROUTINE_AGENT_IDS (runner.ts's AGENT_COMMANDS table) — anything else is a
+        // ROUTINE_AGENT_IDS (baked from AGENT_COMMANDS in runner.ts) — anything else is a
         // real, installable agent (it passed the ALL_AGENT_IDS check above) but one
         // the daemon can't fire itself, so reject it now instead of accepting the
         // routine and failing at fire time (runner.ts buildJobCommand: "Unsupported

package/dist/lib/secrets/Agents CLI.app/Contents/Info.plist

@@ -8,8 +8,6 @@
   <string>Agents CLI</string>
   <key>CFBundleDisplayName</key>
   <string>Agents CLI</string>
-  <key>CFBundleIconFile</key>
-  <string>AppIcon</string>
   <key>CFBundleExecutable</key>
   <string>Agents CLI</string>
   <key>CFBundlePackageType</key>

package/dist/lib/secrets/Agents CLI.app/Contents/_CodeSignature/CodeResources

@@ -3,21 +3,9 @@
 <plist version="1.0">
 <dict>
 	<key>files</key>
-	<dict>
-		<key>Resources/AppIcon.icns</key>
-		<data>
-		DFq5H08EkhgWIC3UvGMR9B58BZw=
-		</data>
-	</dict>
+	<dict/>
 	<key>files2</key>
 	<dict>
-		<key>Resources/AppIcon.icns</key>
-		<dict>
-			<key>hash2</key>
-			<data>
-			mBSjM6jlvN7J1jQowsvqTl7CHM0pur0e6qsHMuzk5k0=
-			</data>
-		</dict>
 		<key>embedded.provisionprofile</key>
 		<dict>
 			<key>hash2</key>

package/dist/lib/secrets/agent.js

@@ -36,6 +36,7 @@ import { getCliVersion, getCliVersionFresh } from '../version.js';
 import { getCliLaunch } from '../cli-entry.js';
 import { GLOBAL_HARNESS, bundleScopeChain } from './scope.js';
 import { deleteLeaseSession, rehydrateSessions, pruneSessionsOnSleep } from './session-store.js';
+import { serviceManagerRegistrationAllowed } from '../service-manifest.js';
 import { SYNC_GET_CMD, SYNC_PING_CMD, SYNC_LOCK_CMD } from './sync-commands.js';
 import { MAX_LEASE_MS, MIN_LEASE_MS } from './lease.js';
 import { selectLeasedEnv } from './lease.js';
@@ -316,7 +317,11 @@ export function retireLegacySecretsAgentService() {
     const plist = servicePlistPath();
     // Only the real LaunchAgents dir is launchd-managed; a relocated (test) dir
     // has no bootstrapped job, so skip launchctl and just remove the plist.
-    if (!process.env.AGENTS_SECRETS_LAUNCHAGENTS_DIR) {
+    // Also skip launchctl under a redirected HOME: launchctl is per-user-session
+    // and HOME-independent, so a sandboxed process would still talk to the real
+    // launchd (RUSH-2968).
+    const reg = serviceManagerRegistrationAllowed();
+    if (!process.env.AGENTS_SECRETS_LAUNCHAGENTS_DIR && reg.allowed) {
         const uid = process.getuid?.() ?? 0;
         try {
             execFileSync('launchctl', ['bootout', `gui/${uid}/${SERVICE_LABEL}`], { stdio: ['ignore', 'ignore', 'ignore'] });
@@ -328,6 +333,9 @@ export function retireLegacySecretsAgentService() {
             catch { /* not loaded */ }
         }
     }
+    else if (!reg.allowed) {
+        process.stderr.write(`[agents] ${reg.reason}\n`);
+    }
     try {
         fs.unlinkSync(plist);
     }

package/dist/lib/secrets/index.js

@@ -32,7 +32,7 @@ import { windowsBackend, usesFileFallback as windowsUsesFileFallback, importNati
 import { isHeadlessSecretsContext } from './headless.js';
 import { KEYCHAIN_READ_BACKOFF_TTL_MS, clearKeychainReadBackoff, isKeychainReadBackedOff, noteKeychainReadFailure, } from './read-backoff.js';
 import { getKeychainHelperPath } from './install-helper.js';
-import { deriveShortId } from '../session/short-id.js';
+import { deriveShortId } from '../text/short-id.js';
 const SERVICE_PREFIX = 'agents-cli';
 export const SECRETS_ITEM_PREFIX = `${SERVICE_PREFIX}.secrets.`;
 const BUNDLES_ITEM_PREFIX = `${SERVICE_PREFIX}.bundles.`;

package/dist/lib/secrets/list-filter.js

@@ -21,7 +21,7 @@ import { parseCommaSeparatedList } from '../format.js';
 // From the leaf module, NOT discover.js — the latter imports `../sqlite.js`, so
 // reaching through it for one parser would pull node:sqlite into every `agents
 // secrets` invocation and print Node's SQLite ExperimentalWarning on stderr.
-import { parseTimeFilter } from '../session/relative-time.js';
+import { parseTimeFilter } from '../text/relative-time.js';
 import { describeBundle, bundlePolicy, SECRET_TYPES, } from './bundles.js';
 /** Ref kinds a var's value can have, from `describeBundle`. */
 export const REF_KINDS = ['literal', 'keychain', 'env', 'file', 'exec'];

package/dist/lib/service-manifest.d.ts

@@ -27,3 +27,23 @@ export declare function serviceManifestHomeEnv(): {
     HOME: string;
     AGENTS_REAL_HOME: string;
 };
+/**
+ * Whether this process may safely register (or tear down) a service with the
+ * user's real service manager.
+ *
+ * `launchctl` and `systemctl --user` are per-user-session and HOME-independent:
+ * a process running under a redirected HOME still talks to the SAME launchd or
+ * systemd instance as a normal login session. service-manifest.ts namespaces the
+ * job label under a redirected HOME, but that only changes the identifier — the
+ * registration still lands in the real service manager. A hermetic test fork (or
+ * any CLI running under a sandbox HOME) must therefore never touch launchd/
+ * systemd unless it has explicitly opted in.
+ *
+ * `AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1` is the test seam for the
+ * shim/PATH-based tests that intentionally exercise the registration code path
+ * under a redirected HOME. Production code must never set it.
+ */
+export declare function serviceManagerRegistrationAllowed(): {
+    allowed: boolean;
+    reason: string;
+};

package/dist/lib/service-manifest.js

@@ -78,3 +78,37 @@ export function serviceManifestHomeEnv() {
     const home = process.env.HOME || os.homedir();
     return { HOME: home, AGENTS_REAL_HOME: process.env.AGENTS_REAL_HOME || home };
 }
+/**
+ * Whether this process may safely register (or tear down) a service with the
+ * user's real service manager.
+ *
+ * `launchctl` and `systemctl --user` are per-user-session and HOME-independent:
+ * a process running under a redirected HOME still talks to the SAME launchd or
+ * systemd instance as a normal login session. service-manifest.ts namespaces the
+ * job label under a redirected HOME, but that only changes the identifier — the
+ * registration still lands in the real service manager. A hermetic test fork (or
+ * any CLI running under a sandbox HOME) must therefore never touch launchd/
+ * systemd unless it has explicitly opted in.
+ *
+ * `AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1` is the test seam for the
+ * shim/PATH-based tests that intentionally exercise the registration code path
+ * under a redirected HOME. Production code must never set it.
+ */
+export function serviceManagerRegistrationAllowed() {
+    const suffix = isolatedHomeSuffix();
+    if (!suffix) {
+        return { allowed: true, reason: 'production HOME: service-manager registration allowed' };
+    }
+    if (process.env.AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME === '1') {
+        return {
+            allowed: true,
+            reason: `test seam AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME allows registration under sandbox-${suffix}`,
+        };
+    }
+    return {
+        allowed: false,
+        reason: `refusing service-manager registration under redirected HOME (sandbox-${suffix}): ` +
+            `launchctl/systemd are per-user-session and HOME-independent, so a sandboxed process ` +
+            `would register in the real service manager (RUSH-2968)`,
+    };
+}

package/dist/lib/session/active.d.ts

@@ -59,7 +59,7 @@ export declare function attributedSetLostPids(prev: Set<number>, next: Set<numbe
  * the same pid-reuse guard {@link isPidAlive} uses elsewhere.
  */
 export declare function filterCachedUnattributed(sessions: ActiveSession[], attributed: Set<number>, alive: (pid: number, startedAtMs?: number) => boolean): ActiveSession[];
-export type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
+type ActiveContext = 'terminal' | 'teams' | 'cloud' | 'headless';
 /** The SessionMeta fields the live-row backfill reads — the enrichment a running process cannot report. */
 export type BackfillMeta = Pick<SessionMeta, 'version' | 'timestamp' | 'label' | 'ticketId' | 'prUrl' | 'prNumber' | 'origin' | 'routineName'>;
 export declare function backfillActiveRowsFromMeta(sessions: ActiveSession[], metaById: Map<string, BackfillMeta>): void;
@@ -335,7 +335,7 @@ export interface ActiveSession {
     paneId?: string;
 }
 export declare function activeStatusFromCloudStatus(status: CloudTaskStatus): ActiveStatus;
-export interface ActiveQueryOptions {
+interface ActiveQueryOptions {
     /** Skip the `ps` scan for ad-hoc headless agents. */
     skipHeadless?: boolean;
     /**
@@ -359,14 +359,6 @@ export interface ActiveQueryOptions {
 export declare class TmuxDiscoveryDegradedError extends Error {
     constructor(message: string);
 }
-/**
- * A live process can only borrow an indexed session file if that transcript
- * has been touched recently enough to plausibly belong to the process. This is
- * deliberately wider than ACTIVE_MTIME_WINDOW_MS: an inactive-but-live CLI can
- * be idle for longer than 2 minutes, but it must not attach to a weeks-old
- * transcript just because a GUI app service with the same basename is alive.
- */
-export declare const ACTIVE_SESSION_STALE_MS: number;
 /**
  * A session whose transcript hasn't been written in this long is ABANDONED /
  * dangling — the framework can no longer treat it as live work, whether its PID
@@ -420,8 +412,6 @@ export declare function resolveNamesToSessionIds(sessionNames: string[], deps: {
  * the start time can't be read, we keep the existence answer.
  */
 export declare function isPidAlive(pid: number, startedAtMs?: number): boolean;
-/** Test seam: drop the Claude session-file path memo. */
-export declare function clearClaudeSessionFileCacheForTest(): void;
 /**
  * Resolve a Claude transcript for `cwd` across the given project roots, newest
  * mtime winning when the same id/cwd resolves in more than one version home
@@ -553,8 +543,6 @@ export declare function listTeamsActive(opts?: {
 }): Promise<ActiveSession[]>;
 /** Live editor-terminal agents across every IDE window. */
 export declare function listTerminalsActive(): Promise<ActiveSession[]>;
-/** Cloud tasks still in a non-terminal state. `tasks.db` may not exist; that's fine. */
-export declare function listCloudActive(): ActiveSession[];
 interface ProcRow {
     pid: number;
     ppid: number;
@@ -628,7 +616,7 @@ export declare function foldSubordinateAgents(candidates: AgentCandidate[], ppid
  */
 export declare function listUnattributedActive(attributed: Set<number>): Promise<ActiveSession[]>;
 /** One tmux pane's resolved agent identity for the authoritative source. */
-export interface PaneIdentity {
+interface PaneIdentity {
     agent: string;
     /** Exact session id when resolvable (launch registry, or the hook join). */
     sessionId?: string;
@@ -679,7 +667,7 @@ export declare function listTmuxAgentSessions(): Promise<ActiveSession[]>;
  */
 export declare function getActiveSessions(opts?: ActiveQueryOptions): Promise<ActiveSession[]>;
 /** Local discovery sources probed by {@link describeActiveDiscoveryHealth}. */
-export interface ActiveDiscoveryHealth {
+interface ActiveDiscoveryHealth {
     /** Sources that failed on the probe (currently only `'tmux'`). Empty = nothing degraded locally. */
     degradedSources: string[];
 }

package/dist/lib/session/active.js

@@ -262,7 +262,7 @@ export class TmuxDiscoveryDegradedError extends Error {
  * be idle for longer than 2 minutes, but it must not attach to a weeks-old
  * transcript just because a GUI app service with the same basename is alive.
  */
-export const ACTIVE_SESSION_STALE_MS = 24 * 60 * 60_000;
+const ACTIVE_SESSION_STALE_MS = 24 * 60 * 60_000;
 /**
  * A session whose transcript hasn't been written in this long is ABANDONED /
  * dangling — the framework can no longer treat it as live work, whether its PID
@@ -541,10 +541,6 @@ function claudeProjectDirName(cwd) {
  */
 const CLAUDE_SESSION_FILE_CACHE_MAX = 256;
 const claudeSessionFileCache = new Map();
-/** Test seam: drop the Claude session-file path memo. */
-export function clearClaudeSessionFileCacheForTest() {
-    claudeSessionFileCache.clear();
-}
 /**
  * Locate the active Claude session file for a process. If we know the session
  * UUID (from terminal env or team parent), prefer the exact match. Otherwise
@@ -1094,7 +1090,7 @@ export async function listTerminalsActive() {
     });
 }
 /** Cloud tasks still in a non-terminal state. `tasks.db` may not exist; that's fine. */
-export function listCloudActive() {
+function listCloudActive() {
     let tasks;
     try {
         tasks = listActiveTasks();

package/dist/lib/session/cloud.js

@@ -13,7 +13,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import * as yaml from 'yaml';
-import { deriveShortId } from './short-id.js';
+import { deriveShortId } from '../text/short-id.js';
 import { getCacheDir } from '../state.js';
 const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');