humanish 0.110.0 → 0.110.2

package/dist/actors/local-agent/claude-participant.js

@@ -0,0 +1,243 @@
+// What a Claude Code participant may do on the operator's machine, and the checks that hold it
+// there.
+//
+// The participant reads the screen of the app under test, so any text the app shows is input to a
+// coding agent running on the host. `--allowedTools Read` alone only pre-approves Read: the
+// participant would keep every other tool, the operator's permission mode, hooks, MCP servers and
+// `CLAUDE.md`, the full environment, and Claude Code would save each frame it read under
+// `~/.claude/projects`. Measured on Claude Code 2.1.289 (2026-10-04): with the flags below and a
+// `--settings` that allowed `Bash(*)` and `Read(//**)`, the init message listed Read as the only
+// tool and no MCP server, a Read outside the session folder was denied, and no transcript
+// directory appeared. Without `--restricted` the same session could see the operator's `CLAUDE.md`.
+//
+// Flags are one layer. The stream is the second: every message is checked, and a tool call other
+// than Read inside the session folder stops the participant (claude-session.ts, cli.ts).
+import path from "node:path";
+import { dotenvSetNames } from "../../keys/env-file.js";
+/**
+ * The first release with `--restricted`. The changelog adds it in 2.1.248; `claude --help` of
+ * 2.1.247 does not list it and 2.1.248 lists it with `--tools`, `--strict-mcp-config`,
+ * `--no-session-persistence` and `--permission-mode dontAsk`.
+ */
+export const CLAUDE_CODE_MIN_VERSION = "2.1.248";
+/** The only tool a participant has: Read, for the screenshot humanish writes into its folder. */
+const PARTICIPANT_TOOL = "Read";
+/** The permission mode the participant runs in, and the one its init message must report. */
+const PERMISSION_MODE = "dontAsk";
+/**
+ * The flags that restrict a participant, shared by the session and one-shot paths. Each one was
+ * checked against `claude --help` of 2.1.248 and 2.1.289.
+ */
+export function claudeParticipantFlags(model) {
+    return [
+        // Removes Bash, WebFetch and the other code-running tools, confines file tools to the working
+        // directory, refuses bypassPermissions, and ignores user, project and local settings files,
+        // which is where hooks, permission rules and plugins come from. The operator's `CLAUDE.md`
+        // does not load either (measured on 2.1.289).
+        "--restricted",
+        // Read is the only built-in tool that exists in the session.
+        "--tools",
+        PARTICIPANT_TOOL,
+        // No MCP server loads from any configuration.
+        "--strict-mcp-config",
+        // Anything that would need approval is denied without a prompt.
+        "--permission-mode",
+        PERMISSION_MODE,
+        // No transcript under `~/.claude/projects`, so frames stay in the run folder.
+        "--no-session-persistence",
+        ...(model === undefined ? [] : ["--model", model]),
+    ];
+}
+/**
+ * Names the participant's environment keeps from the host. Measured on Linux: `HOME` alone signs
+ * in a `claude.ai` login, and `PATH` finds `claude`. `USER` and `LOGNAME` name the macOS keychain
+ * account, `CLAUDE_CONFIG_DIR` moves Claude Code's own login and config, and the proxy and CA
+ * names are for hosts that reach the API through a proxy. Everything else is dropped: provider
+ * keys, `GH_TOKEN`, every `--dotenv` name, `ANTHROPIC_API_KEY` and `CLAUDE_CODE_OAUTH_TOKEN`, and
+ * the `CLAUDE_CODE_*` variables of a Claude Code session humanish itself runs inside.
+ */
+export const CLAUDE_PARTICIPANT_ENV_NAMES = [
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "CLAUDE_CONFIG_DIR",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NO_PROXY",
+    "https_proxy",
+    "http_proxy",
+    "no_proxy",
+    "NODE_EXTRA_CA_CERTS",
+];
+/**
+ * The participant's whole environment: the allowlisted names `source` holds, minus any a `--dotenv`
+ * file set. The advisor is a server-side tool Claude Code enables by default on some plans; it is
+ * turned off so the only tool the stream can show is Read.
+ */
+export function claudeParticipantEnv(source) {
+    const fromDotenv = dotenvSetNames(source);
+    const env = { CLAUDE_CODE_DISABLE_ADVISOR_TOOL: "1" };
+    for (const name of CLAUDE_PARTICIPANT_ENV_NAMES) {
+        const value = source[name];
+        if (typeof value === "string" && !fromDotenv.has(name))
+            env[name] = value;
+    }
+    return env;
+}
+/** `2.1.289` from `2.1.289 (Claude Code)`; undefined for anything else. */
+export function parseClaudeCodeVersion(text) {
+    return /^(\d+\.\d+\.\d+)(?:\s|$)/.exec(text.trim())?.[1];
+}
+/** Whether `version` is at or above CLAUDE_CODE_MIN_VERSION. */
+export function admitsClaudeCodeVersion(version) {
+    if (version === undefined)
+        return false;
+    const have = version.split(".").map(Number);
+    const floor = CLAUDE_CODE_MIN_VERSION.split(".").map(Number);
+    for (let index = 0; index < 3; index += 1) {
+        if (have[index] !== floor[index])
+            return have[index] > floor[index];
+    }
+    return true;
+}
+/** The refusal for a Claude Code release below the floor, or one whose version could not be read. */
+export function claudeCodeVersionMessage(version) {
+    return (`Claude Code participants need Claude Code ${CLAUDE_CODE_MIN_VERSION} or newer, the first release with --restricted; ` +
+        `${version === undefined ? "the installed release did not report a version" : `this machine has ${version}`}. ` +
+        "Run `claude update` (or reinstall Claude Code), then retry.");
+}
+/** The participant was stopped because its stream showed something it may not do. */
+export class ClaudeParticipantError extends Error {
+    code;
+    constructor(code, reason) {
+        super(`${code}: ${reason}; the participant was stopped`);
+        this.name = "ClaudeParticipantError";
+        this.code = code;
+    }
+}
+/** A tool name safe to repeat in run evidence: a built-in name, never an MCP server's. */
+const toolLabel = (name) => typeof name === "string" && /^[A-Z][A-Za-z]{1,40}$/.test(name) ? name : "a non-built-in tool";
+/**
+ * Checks every stream-json message from one participant process. `inspect` returns the error the
+ * message proves, or undefined. A `result` counts only after an init message was admitted.
+ */
+export class ClaudeStreamGuard {
+    folders;
+    admitted = false;
+    /** `folders`: the session folder, as given to Claude Code and as resolved on disk. */
+    constructor(folders) {
+        this.folders = folders;
+    }
+    inspect(message) {
+        if (message.type === "system")
+            return this.system(message);
+        if (message.type === "assistant")
+            return this.assistant(message);
+        if (message.type === "control_request") {
+            const request = message.request;
+            // humanish never answers a permission prompt; one arriving means a tool was about to run.
+            if (request?.subtype === "can_use_tool")
+                return refused(`Claude Code asked to run ${toolLabel(request.tool_name)}`);
+            return undefined;
+        }
+        if (message.type === "result") {
+            if (!this.admitted)
+                return new ClaudeParticipantError("HUMANISH_CLAUDE_PARTICIPANT_UNRESTRICTED", "Claude Code answered before it reported its tools");
+            const denials = message.permission_denials;
+            if (Array.isArray(denials) && denials.length > 0) {
+                const first = denials[0];
+                return refused(`Claude Code denied a ${toolLabel(first?.tool_name)} call`);
+            }
+        }
+        return undefined;
+    }
+    system(message) {
+        if (message.subtype === "permission_denied")
+            return refused(`Claude Code denied a ${toolLabel(message.tool_name)} call`);
+        if (message.subtype !== "init")
+            return undefined;
+        const tools = message.tools;
+        if (!Array.isArray(tools) || tools.length !== 1 || tools[0] !== PARTICIPANT_TOOL) {
+            const listed = Array.isArray(tools) ? tools.map(toolLabel).join(", ") : "no tool list";
+            return new ClaudeParticipantError("HUMANISH_CLAUDE_PARTICIPANT_UNRESTRICTED", `Claude Code started with ${listed || "no tools"} where only Read is allowed`);
+        }
+        const servers = message.mcp_servers;
+        if (!Array.isArray(servers) || servers.length !== 0)
+            return new ClaudeParticipantError("HUMANISH_CLAUDE_PARTICIPANT_UNRESTRICTED", "Claude Code started with an MCP server configuration");
+        if (message.permissionMode !== PERMISSION_MODE)
+            return new ClaudeParticipantError("HUMANISH_CLAUDE_PARTICIPANT_UNRESTRICTED", `Claude Code started in permission mode ${typeof message.permissionMode === "string" ? message.permissionMode.slice(0, 40) : "(none)"}`);
+        this.admitted = true;
+        return undefined;
+    }
+    assistant(message) {
+        const inner = message.message;
+        const content = Array.isArray(inner?.content) ? inner.content : [];
+        for (const raw of content) {
+            const block = raw;
+            if (block === null || typeof block !== "object" || typeof block.type !== "string")
+                continue;
+            // tool_use, server_tool_use, mcp_tool_use: anything that names a tool.
+            if (!block.type.endsWith("tool_use"))
+                continue;
+            if (block.type !== "tool_use" || block.name !== PARTICIPANT_TOOL)
+                return refused(`the participant called ${toolLabel(block.name)}`);
+            const file = block.input?.file_path;
+            if (typeof file !== "string" || !this.inside(file))
+                return refused("the participant tried to Read a file outside its session folder");
+        }
+        return undefined;
+    }
+    inside(file) {
+        // Claude Code expands a leading `~` to the home directory; path.resolve would keep it literal.
+        if (file.startsWith("~"))
+            return false;
+        return this.folders.some((folder) => {
+            const relative = path.relative(folder, path.resolve(folder, file));
+            return (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+        });
+    }
+}
+const refused = (reason) => new ClaudeParticipantError("HUMANISH_CLAUDE_PARTICIPANT_TOOL_REFUSED", reason);
+/**
+ * Claude Code names a transcript folder after the session's working directory with every
+ * character but letters and digits replaced by `-`, so `/tmp/humanish-claude-session-AbC123`
+ * becomes `-tmp-humanish-claude-session-AbC123`. The suffix is mkdtemp's six characters. A name
+ * with any other character was not made that way and is not counted.
+ */
+const TRANSCRIPT_NAME = /^[A-Za-z0-9-]*-humanish-(?:claude-session|local-agent)-[A-Za-z0-9]{6}$/;
+/**
+ * A folder path the printed command may quote: printable ASCII. Terminal output transliterates
+ * other characters, and a curly quote turned into `'` would end the quoting early.
+ */
+const QUOTABLE_PATH = /^[\x20-\x7e]+$/;
+const shellQuoted = (text) => `'${text.replaceAll("'", `'\\''`)}'`;
+/** Lists leftover participant transcripts. Reads folder names only, never their contents. */
+export async function leftoverClaudeTranscripts(env, home, list) {
+    const directory = path.join(env.CLAUDE_CONFIG_DIR ?? path.join(home, ".claude"), "projects");
+    let entries;
+    try {
+        entries = await list(directory);
+    }
+    catch (error) {
+        const code = error.code;
+        // No projects folder means Claude Code never saved a session here.
+        if (code === "ENOENT")
+            return { directory, names: [] };
+        return { directory, unreadable: typeof code === "string" ? code : "unknown error" };
+    }
+    const names = entries.filter((name) => TRANSCRIPT_NAME.test(name)).sort();
+    return {
+        directory,
+        names,
+        // Exact quoted paths: a glob would also match names doctor did not count.
+        ...(names.length === 0 || !QUOTABLE_PATH.test(directory)
+            ? {}
+            : {
+                removeCommand: `rm -rf -- ${names.map((name) => shellQuoted(path.join(directory, name))).join(" ")}`,
+            }),
+    };
+}

package/dist/actors/local-agent/claude-session.d.ts

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import type { CuaProvider, CuaTurn } from "../computer-use/loop.js";
 import type { ReasoningEffort } from "../reasoning-effort.js";
+import { ClaudeParticipantError, type ClaudeParticipantErrorCode } from "./claude-participant.js";
 type JsonObject = Record<string, unknown>;
 /** The transport, injected so tests drive a fake session with no CLI and no spend. */
 export interface ClaudeStreamTransport {
@@ -11,6 +12,8 @@ export interface ClaudeStreamTransport {
      */
     turn(message: JsonObject, timeoutMs: number, signal?: AbortSignal): Promise<JsonObject>;
     close(): void;
+    /** The first refusal the stream guard raised, if any. */
+    refusal?(): ClaudeParticipantError | undefined;
 }
 export interface ClaudeSessionOptions {
     /** Absent = spawn `claude`. Injected in tests. */
@@ -22,14 +25,24 @@ export interface ClaudeSessionOptions {
     timeoutMs?: number;
     /** Scratch root for the session's working directory (the screenshots it is allowed to Read). */
     workRoot?: string;
-    /** Extra arguments, e.g. a model override. Tests never pass any. */
+    /** Injected in tests to see the argv and environment the child gets. */
     spawnFn?: typeof spawn;
+    /** Where the participant's few environment names come from. Absent = process.env. */
+    env?: Readonly<Record<string, string | undefined>>;
 }
 export interface ClaudeSession {
     provider: CuaProvider;
-    /** Ends the process and removes its scratch directory. The run owns the lifetime, not the provider. */
-    close(): Promise<void>;
+    /**
+     * Ends the process and removes its scratch directory. The run owns the lifetime, not the
+     * provider. `refusal` is a stream refusal no turn reported, such as a forbidden call after the
+     * last turn ended or was given up; it fails the run.
+     */
+    close(): Promise<{
+        refusal?: ClaudeParticipantErrorCode;
+    }>;
 }
+/** The argv of the session process: stream-json both ways, then the restricting flags. */
+export declare function claudeSessionArgs(model?: string): string[];
 /** The message shape Claude Code reads on stdin in stream-json mode. */
 export declare function userMessage(text: string): JsonObject;
 /**

package/dist/actors/local-agent/claude-session.js

@@ -11,19 +11,21 @@
 // stream-json --output-format stream-json --verbose` is a bidirectional session over stdio. One
 // NDJSON `user` message in, a stream of `system` / `assistant` / `result` messages out, then it
 // waits for the next `user` message with the conversation intact. Two messages, one session id,
-// and a codeword given in the first turn was recalled in the second. `--allowedTools Read` keeps
-// the bound the one-shot version had: it looks at a picture, and that is all it can do.
+// and a codeword given in the first turn was recalled in the second. The process runs with the
+// flags and environment in claude-participant.ts, and every message it writes passes the stream
+// guard there: a tool call other than Read inside the session folder stops it.
 //
 // What this is not: a change to the loop, the executor, the trace, or the Observer. Only where
 // the next action comes from.
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtemp, rm, unlink, writeFile } from "node:fs/promises";
+import { mkdtemp, realpath, rm, unlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { ComputerUseProviderError } from "../computer-use/provider-error.js";
 import { declaredOutcomeOf, parseAgentJson, promptFor, toCuaActions, LOCAL_AGENT_CAPABILITIES, } from "./cli.js";
+import { ClaudeParticipantError, ClaudeStreamGuard, claudeParticipantEnv, claudeParticipantFlags, } from "./claude-participant.js";
 /** How long Claude Code may take to acknowledge an interrupt before the session is ended. */
 const INTERRUPT_RECEIPT_TIMEOUT_MS = 5_000;
 /** Results can no longer be paired with the turns that asked for them. */
@@ -72,10 +74,10 @@ function waitForTurn(waiting, id, timeoutMs, signal, onGiveUp) {
  * NDJSON over the child's stdio. Each user message carries a fresh `uuid`, and a `result` goes
  * only to the turn whose uuid it names. A turn given up on is interrupted with a control request,
  * and the next user message waits for the interrupt's receipt, so its `cancel_queued` cancels an
- * abandoned message still in the queue but never the message sent after it. Every other message
- * is a progress line and is ignored.
+ * abandoned message still in the queue but never the message sent after it. Every message passes
+ * `guard` first; one it refuses ends the session and kills the process.
  */
-function stdioClaudeTransport(child) {
+function stdioClaudeTransport(child, guard) {
     const rl = readline.createInterface({ input: child.stdout });
     const waiting = new Map();
     // Given-up turns whose result may still arrive; it must reach nobody.
@@ -85,6 +87,9 @@ function stdioClaudeTransport(child) {
     let interrupts = 0;
     let stderrTail = "";
     let ended;
+    // The first refusal outranks every other ending: a forbidden line in the same stdout chunk as a
+    // result, or as a line that desynchronized the session, is read before the waiting turn resumes.
+    let refused;
     const write = (message) => {
         child.stdin.write(`${JSON.stringify(message)}\n`);
     };
@@ -171,6 +176,16 @@ function stdioClaudeTransport(child) {
         catch {
             return; // never a reason to end a run
         }
+        const refusal = guard.inspect(message);
+        if (refusal !== undefined) {
+            // The refusal is recorded before the kill, so the exit it causes cannot replace it. SIGKILL:
+            // a tool the flags somehow allowed may already be running.
+            refused ??= refusal;
+            end(refusal);
+            child.kill("SIGKILL");
+            stop();
+            return;
+        }
         if (message.type === "result") {
             deliver(message);
         }
@@ -197,24 +212,47 @@ function stdioClaudeTransport(child) {
     return {
         async turn(message, timeoutMs, signal) {
             if (ended !== undefined)
-                throw ended;
+                throw refused ?? ended;
             await acknowledged;
             if (ended !== undefined)
-                throw ended;
+                throw refused ?? ended;
             if (signal?.aborted)
                 throw new Error("run stopped");
             const id = randomUUID();
             const result = waitForTurn(waiting, id, timeoutMs, signal, () => abandon(id));
             write({ ...message, uuid: id });
-            return result;
+            let answer;
+            try {
+                answer = await result;
+            }
+            catch (error) {
+                throw refused ?? error;
+            }
+            if (refused !== undefined)
+                throw refused;
+            return answer;
         },
         close() {
             end(new Error("Claude Code session closed"));
             stop();
         },
+        refusal: () => refused,
     };
 }
 const CLAUDE_SESSION_CAPABILITIES = LOCAL_AGENT_CAPABILITIES;
+/** The argv of the session process: stream-json both ways, then the restricting flags. */
+export function claudeSessionArgs(model) {
+    return [
+        "-p",
+        "--input-format",
+        "stream-json",
+        "--output-format",
+        "stream-json",
+        // Required for stream-json output in -p mode; it is what makes each message visible.
+        "--verbose",
+        ...claudeParticipantFlags(model),
+    ];
+}
 /** The message shape Claude Code reads on stdin in stream-json mode. */
 export function userMessage(text) {
     return { type: "user", message: { role: "user", content: [{ type: "text", text }] } };
@@ -228,27 +266,23 @@ export async function startClaudeSession(options = {}) {
     const timeoutMs = options.timeoutMs ?? 180_000;
     const effort = options.reasoningEffort ?? "low";
     const work = await mkdtemp(path.join(options.workRoot ?? tmpdir(), "humanish-claude-session-"));
+    // The folder as given to Claude Code and as resolved on disk (macOS /var is /private/var).
+    const folders = [work, await realpath(work).catch(() => work)];
     let child;
     let transport = options.transport;
     if (transport === undefined) {
         const spawnFn = options.spawnFn ?? spawn;
-        child = spawnFn("claude", [
-            "-p",
-            "--input-format",
-            "stream-json",
-            "--output-format",
-            "stream-json",
-            // Required for stream-json output in -p mode; it is what makes the per-turn `result` visible.
-            "--verbose",
-            // Read is the only tool it needs (the screenshot) and the only one it gets.
-            "--allowedTools",
-            "Read",
-            ...(options.model === undefined ? [] : ["--model", options.model]),
-        ], { cwd: work, stdio: ["pipe", "pipe", "pipe"] });
-        transport = stdioClaudeTransport(child);
+        child = spawnFn("claude", claudeSessionArgs(options.model), {
+            cwd: work,
+            env: claudeParticipantEnv(options.env ?? process.env),
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        transport = stdioClaudeTransport(child, new ClaudeStreamGuard(folders));
     }
     let turnIndex = 0;
     let previousShot;
+    // Whether a turn already failed with the stream's refusal, so close does not report it twice.
+    let refusalReported = false;
     // A turn that delivered no result of its own spent tokens that no delivered turn reports. Its
     // late result is discarded rather than added to another turn, so the usage stays unknown.
     let usageIncomplete = false;
@@ -287,6 +321,11 @@ export async function startClaudeSession(options = {}) {
             }
             catch (error) {
                 usageIncomplete = true;
+                // A refused stream keeps its code: the run fails with it.
+                if (error instanceof ClaudeParticipantError) {
+                    refusalReported = true;
+                    throw error;
+                }
                 if (error instanceof ClaudeSessionDesyncError) {
                     // The stream no longer pairs results with turns, so no later turn can trust it.
                     throw new ComputerUseProviderError("protocol_error", {
@@ -310,6 +349,8 @@ export async function startClaudeSession(options = {}) {
             transport?.close();
             child?.kill();
             await rm(work, { recursive: true, force: true }).catch(() => undefined);
+            const late = refusalReported ? undefined : transport?.refusal?.();
+            return late === undefined ? {} : { refusal: late.code };
         },
     };
 }

package/dist/actors/local-agent/cli.d.ts

@@ -39,8 +39,11 @@ export interface SpawnResult {
 }
 export type SpawnLike = (bin: string, args: readonly string[], options: {
     cwd: string;
+    env: NodeJS.ProcessEnv;
     timeoutMs: number;
     signal?: AbortSignal;
+    /** Called with each complete stdout line; returning true kills the process at once. */
+    onLine?: (line: string) => boolean;
 }) => Promise<SpawnResult>;
 export interface LocalAgentProviderOptions {
     /** Only Claude Code runs one-shot; hosted Codex runs as an app-server participant. */
@@ -57,6 +60,8 @@ export interface LocalAgentProviderOptions {
     spawnFn?: SpawnLike;
     /** Scratch root for the screenshot and schema handed to the CLI. */
     workRoot?: string;
+    /** Where the participant's few environment names come from. Absent = process.env. */
+    env?: Readonly<Record<string, string | undefined>>;
 }
 export declare const LOCAL_AGENT_CAPABILITIES: ActorCapabilities;
 /** The turn prompt for Claude Code: the instructions, the screenshot to read, and the reply shape. */
@@ -82,8 +87,12 @@ export interface DetectedLocalAgent extends LocalAgentDescriptor {
     authStatus: "authenticated" | "unauthenticated" | "unknown";
     /** Known Codex login billing class. Absent when the status text is not one of the pinned shapes. */
     billing?: "account-unknown" | "api";
+    /** Claude Code's `--version` release. Absent for Codex and when the output is not a version. */
+    version?: string;
 }
 export interface DetectLocalAgentsOptions {
+    /** Probe only this agent: a readiness check has no reason to run the other CLI. */
+    only?: LocalAgentId;
     /** Injected for tests: resolves a binary name to a path, or undefined. */
     which?: (bin: string) => Promise<string | undefined>;
     /** Injected for tests: does this path exist? */
@@ -112,6 +121,14 @@ export declare function checkHostedCodexCompatibility(binPath: string, options?:
 export declare function detectLocalAgents(options?: DetectLocalAgentsOptions): Promise<DetectedLocalAgent[]>;
 /** Doctor's row when neither Codex nor Claude Code is installed. */
 export declare const NO_LOCAL_AGENT_MESSAGE = "no local coding agent found. openai-computer-use needs OPENAI_API_KEY; local-agent needs Codex or Claude Code installed and signed in. Hosted desktops also need E2B_API_KEY.";
+/** Whether a signed-in agent can still not run participants here: an old Claude Code. */
+export declare function localAgentVersionRefusal(agent: DetectedLocalAgent): string | undefined;
+/**
+ * Whether an installed agent can run participants here: it reports signed in under the
+ * participant's environment, and a Claude Code is at or above the floor. Doctor's rows decide their
+ * status from this, so a row whose message says the agent cannot run participants is never "ok".
+ */
+export declare function localAgentReady(agent: DetectedLocalAgent): boolean;
 /** Doctor's row for one installed agent, in the register the other rows use. */
 export declare function localAgentDoctorMessage(agent: DetectedLocalAgent): string;
 export {};