@phnx-labs/agents-cli 1.20.72 → 1.20.74

package/dist/commands/sessions-tail.d.ts

@@ -24,6 +24,7 @@ export declare function tailFile(filePath: string, onLine: (line: string) => voi
  */
 export declare function streamSessionTail(session: SessionMeta, options?: {
     fromStart?: boolean;
+    raw?: boolean;
 }): Promise<void>;
 /** Attach the `tail` subcommand to an existing `sessions` command. */
 export declare function registerSessionsTailCommand(sessionsCmd: Command): void;

package/dist/commands/sessions-tail.js

@@ -3,7 +3,8 @@
  *
  * Implements `agents sessions tail` — position-tracked reader on the session
  * JSONL, driven by an fs.watch on the parent directory. Claude and Codex
- * only for v1 (both use append-only JSONL).
+ * only for v1 (both use append-only JSONL). Output is compact by default;
+ * --json keeps the raw JSONL stream.
  */
 import * as fs from 'fs';
 import * as fsp from 'fs/promises';
@@ -11,6 +12,7 @@ import * as path from 'path';
 import chalk from 'chalk';
 import { discoverSessions, resolveSessionById } from '../lib/session/discover.js';
 import { setHelpSections } from '../lib/help.js';
+import { makeStreamRenderer } from '../lib/session/stream-render.js';
 const TAIL_SUPPORTED = ['claude', 'codex'];
 /** Whether a session's transcript can be live-tailed (append-only JSONL agents). */
 export function isTailable(agent) {
@@ -186,7 +188,7 @@ async function runTail(sessionId, options) {
         }
         session = resolved;
     }
-    await streamSessionTail(session, { fromStart: options.fromStart });
+    await streamSessionTail(session, { fromStart: options.fromStart, raw: options.json });
 }
 /**
  * Live-tail one already-resolved session's transcript to stdout until Ctrl+C.
@@ -194,6 +196,7 @@ async function runTail(sessionId, options) {
  */
 export async function streamSessionTail(session, options = {}) {
     const filePath = session.filePath.split('#')[0];
+    const render = options.raw ? undefined : makeStreamRenderer(session.agent, session.cwd);
     if (process.stderr.isTTY) {
         process.stderr.write(chalk.gray(`Tailing ${session.agent} ${session.shortId} — ${filePath}\n`) +
             chalk.gray('Ctrl+C to stop.\n'));
@@ -204,7 +207,13 @@ export async function streamSessionTail(session, options = {}) {
     process.on('SIGTERM', onSig);
     try {
         await tailFile(filePath, (line) => {
-            process.stdout.write(line + '\n');
+            if (!render) {
+                process.stdout.write(line + '\n');
+                return;
+            }
+            const out = render(line);
+            if (out)
+                process.stdout.write(out + '\n');
         }, ac, { fromStart: options.fromStart });
     }
     finally {
@@ -216,9 +225,10 @@ export async function streamSessionTail(session, options = {}) {
 export function registerSessionsTailCommand(sessionsCmd) {
     const tailCmd = sessionsCmd
         .command('tail [sessionId]')
-        .description('Stream JSONL events from a session file as they are written, one event per line. Long-running: Ctrl+C to stop. Claude and Codex only.')
+        .description('Stream compact live lines from a session file as events are written. Long-running: Ctrl+C to stop. Claude and Codex only.')
         .option('--latest', 'Tail the most recent tailable session (claude or codex)')
-        .option('--from-start', 'Emit the full file first, then follow (default: start at EOF)');
+        .option('--from-start', 'Emit the full file first, then follow (default: start at EOF)')
+        .option('--json', 'Emit raw JSONL events instead of compact live lines');
     setHelpSections(tailCmd, {
         examples: `
       # Follow the most recent active Claude or Codex session
@@ -230,15 +240,16 @@ export function registerSessionsTailCommand(sessionsCmd) {
       # Replay from the beginning, then follow
       agents sessions tail a1b2c3d4 --from-start
 
-      # Pipe through jq to extract just user messages
-      agents sessions tail --latest | jq 'select(.type == "user")'
+      # Pipe raw events through jq to extract just user messages
+      agents sessions tail --latest --json | jq 'select(.type == "user")'
     `,
         notes: `
       - Only Claude and Codex sessions are tailable — they append JSONL one event per line.
+      - Live tail is compact by default; pass --json for the raw JSONL stream.
       - Gemini, OpenCode, and OpenClaw use formats that rewrite the file or store state elsewhere.
     `,
     });
-    tailCmd.action(async (sessionId, options) => {
-        await runTail(sessionId, options);
+    tailCmd.action(async (sessionId, _options, command) => {
+        await runTail(sessionId, command.optsWithGlobals());
     });
 }

package/dist/commands/sessions.js

@@ -807,6 +807,8 @@ function canonicalSessionsCommand(query, options) {
         a.push('--active');
     if (options.teams)
         a.push('--teams');
+    if (options.routine)
+        a.push('--routine');
     if (options.agent)
         a.push('-a', options.agent);
     for (const h of options.host ?? [])
@@ -941,6 +943,7 @@ async function sessionsAction(query, options) {
     // the browser's window so the flag is honored, not swallowed.
     if (useInteractiveBrowser(options) &&
         !query &&
+        !options.routine &&
         !options.flat &&
         !options.tree &&
         !options.markdown &&
@@ -1038,6 +1041,7 @@ async function sessionsAction(query, options) {
             since,
             until: options.until,
             sortBy,
+            origin: options.routine ? 'routine' : undefined,
         };
         let sessions = await discoverSessions({
             ...scope,
@@ -1164,6 +1168,11 @@ function teamTag(session) {
     const parts = [origin.handle, origin.mode].filter(Boolean).join(' · ');
     return parts ? `[${parts}] ` : '[team] ';
 }
+function originTag(session) {
+    if (session.origin !== 'routine')
+        return '';
+    return `[routine${session.routineName ? ` · ${session.routineName}` : ''}] `;
+}
 /** Adapt a SessionMeta's persisted signals to the badge renderer's shape. */
 function metaSignals(s) {
     return {
@@ -1182,7 +1191,7 @@ function flatSessionRow(session, live, showTicket = false, cols = {}) {
     const agentColor = colorAgent(session.agent);
     const when = formatRelativeTime(session.lastActivity ?? session.timestamp);
     const project = session.project || '-';
-    const tag = teamTag(session);
+    const tag = originTag(session) || teamTag(session);
     const label = session.label;
     const { glyph, preview } = liveGlyphAndPreview(live);
     // A running session's live preview says what the agent is doing now; a
@@ -1220,7 +1229,7 @@ function flatSessionRow(session, live, showTicket = false, cols = {}) {
 function treeSessionRow(session, live) {
     const agentColor = colorAgent(session.agent);
     const when = formatRelativeTime(session.lastActivity ?? session.timestamp);
-    const tag = teamTag(session);
+    const tag = originTag(session) || teamTag(session);
     const label = session.label;
     const { glyph, preview } = liveGlyphAndPreview(live);
     const topic = (preview || (tag ? `${tag}${session.topic ?? ''}` : session.topic)) || '-';
@@ -1592,7 +1601,7 @@ export function formatPickerLabel(s, query, cols = {}) {
     const agentColor = colorAgent(s.agent);
     const when = formatRelativeTime(s.lastActivity ?? s.timestamp);
     const project = s.project || '-';
-    const tag = teamTag(s);
+    const tag = originTag(s) || teamTag(s);
     const label = s.label;
     const topic = tag ? `${tag}${s.topic ?? ''}` : s.topic;
     const versionStr = s.version || '-';
@@ -2197,6 +2206,7 @@ export function registerSessionsCommands(program) {
         .option('--opencode', 'Shorthand for --agent opencode')
         .option('--all', 'Include sessions from every directory (not just current project)')
         .option('--teams', 'Include team-spawned sessions (hidden by default)')
+        .option('--routine', 'Show only sessions archived from routine runs')
         .option('-p, --project <name>', 'Filter by project name (searches across all directories)')
         .option('--since <time>', 'Only sessions newer than this (e.g., 2h, 7d, 4w, or ISO date)')
         .option('--until <time>', 'Only sessions older than this (ISO timestamp)')
@@ -2246,6 +2256,10 @@ export function registerSessionsCommands(program) {
       # Search across every directory, not just this project
       agents sessions "topic" --all
 
+      # Show routine-run sessions and open one by routine run id
+      agents sessions --routine --all
+      agents sessions 2026-07-21T10-30-00-000Z
+
       # Export for analysis
       agents sessions --since 30d --limit 200 --json > sessions.json
 
@@ -2262,6 +2276,7 @@ export function registerSessionsCommands(program) {
       - --first and --last are mutually exclusive.
       - A filter flag (--include/--exclude/--first/--last) without --markdown/--json defaults to --markdown output.
       - --cloud sources from Rush Cloud captured runs instead of local disk.
+      - --routine shows only transcripts archived from routine run directories; routine rows also resolve by run id.
       - Without --teams, team-spawned sessions are hidden by default.
     `,
     });

package/dist/commands/setup-mine.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `agents setup mine` — interactive wizard to white-label the CLI under your own
+ * name. Pick a name, choose which features to turn off, and get a personally-
+ * named binary (e.g. `jack`) that runs every agents verb as yours. Delegates the
+ * actual minting to `initBrand` (see mine.ts); the `agents mine` group manages
+ * brands afterward.
+ *
+ * Idempotent: re-running for an existing brand offers to re-mint it.
+ */
+import type { Command } from 'commander';
+/**
+ * Interactive white-label setup. Returns true when a brand exists afterward,
+ * false if the user backed out. Never throws on cancel — the `agents setup` hub
+ * relies on that.
+ */
+export declare function runMineWizard(): Promise<boolean>;
+/** Register `agents setup mine` under the parent `setup` command. */
+export declare function registerSetupMineCommand(setupCmd: Command): void;

package/dist/commands/setup-mine.js

@@ -0,0 +1,106 @@
+/**
+ * `agents setup mine` — interactive wizard to white-label the CLI under your own
+ * name. Pick a name, choose which features to turn off, and get a personally-
+ * named binary (e.g. `jack`) that runs every agents verb as yours. Delegates the
+ * actual minting to `initBrand` (see mine.ts); the `agents mine` group manages
+ * brands afterward.
+ *
+ * Idempotent: re-running for an existing brand offers to re-mint it.
+ */
+import chalk from 'chalk';
+import { initBrand } from './mine.js';
+import { validateBrandName, getBrandConfig } from '../lib/brand.js';
+import { isShimsInPath } from '../lib/shims.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+/**
+ * Optional/heavier top-level commands a brand commonly turns off. Kept short so
+ * the checkbox is scannable — anything can still be toggled later with
+ * `agents mine toggle <name> --disable <cmd>`.
+ */
+const DISABLEABLE_FEATURES = [
+    { name: 'teams', hint: 'coordinate multiple agents on shared work' },
+    { name: 'cloud', hint: 'dispatch agent tasks to the cloud' },
+    { name: 'browser', hint: 'automate a browser' },
+    { name: 'computer', hint: 'drive native desktop apps' },
+    { name: 'secrets', hint: 'keychain-backed env bundles' },
+    { name: 'routines', hint: 'run agents on a cron schedule' },
+    { name: 'monitors', hint: 'event-triggered watchers' },
+    { name: 'wallet', hint: 'payment cards' },
+];
+/**
+ * Interactive white-label setup. Returns true when a brand exists afterward,
+ * false if the user backed out. Never throws on cancel — the `agents setup` hub
+ * relies on that.
+ */
+export async function runMineWizard() {
+    if (!isInteractiveTerminal()) {
+        console.log(chalk.dim('Non-interactive shell. Create a brand directly, e.g.:\n') +
+            chalk.cyan('  agents mine init jack --disable teams cloud'));
+        return false;
+    }
+    const { input, checkbox, confirm } = await import('@inquirer/prompts');
+    console.log(chalk.bold('Make it yours — a personally-named CLI that IS agents-cli.\n'));
+    const name = (await input({
+        message: 'What should your CLI be called? (e.g. jack)',
+        validate: (v) => {
+            const err = validateBrandName(v.trim());
+            return err ?? true;
+        },
+    })).trim();
+    // Existing brand → offer to re-mint rather than error out.
+    let force = false;
+    if (getBrandConfig(name)) {
+        const again = await confirm({
+            message: `Brand "${name}" already exists. Re-mint it?`,
+            default: false,
+        });
+        if (!again) {
+            printNextSteps(name, !isShimsInPath());
+            return true;
+        }
+        force = true;
+    }
+    const disabled = await checkbox({
+        message: `Any features to turn OFF for ${name}? (space to toggle, enter to accept)`,
+        choices: DISABLEABLE_FEATURES.map((f) => ({
+            name: `${f.name}  ${chalk.dim(f.hint)}`,
+            value: f.name,
+        })),
+        required: false,
+    });
+    const { pathWarning } = initBrand(name, { disabledCommands: disabled, force });
+    console.log(chalk.green(`\nMinted ${chalk.bold(name)} — your own agents CLI.`));
+    if (disabled.length > 0) {
+        console.log(chalk.dim(`  turned off: ${disabled.join(', ')}`));
+    }
+    printNextSteps(name, pathWarning);
+    return true;
+}
+function printNextSteps(name, pathWarning) {
+    console.log(chalk.bold('\nTry it:'));
+    console.log('  ' + chalk.cyan(`${name} --help`) + chalk.dim(`         # your CLI, your name`));
+    console.log('  ' + chalk.cyan(`${name} run claude "hello"`));
+    console.log(chalk.dim(`  Manage it later:  agents mine toggle ${name} --disable <cmd>   ·   agents mine list`));
+    if (pathWarning) {
+        console.log(chalk.yellow(`\n  note: the shims dir isn't on your PATH yet — run 'agents setup' or open a new shell.`));
+    }
+}
+/** Register `agents setup mine` under the parent `setup` command. */
+export function registerSetupMineCommand(setupCmd) {
+    setupCmd
+        .command('mine')
+        .description('White-label the CLI — mint your own personally-named binary (e.g. `jack`).')
+        .action(async () => {
+        try {
+            await runMineWizard();
+        }
+        catch (err) {
+            if (isPromptCancelled(err)) {
+                console.log(chalk.yellow('\nCancelled'));
+                return;
+            }
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/setup-share.js

@@ -18,7 +18,7 @@ import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 export async function runShareWizard() {
     if (!isInteractiveTerminal()) {
         console.error(chalk.red('agents setup share needs an interactive terminal. ' +
-            'Non-interactively, use `agents share setup` (provision) or `agents share join <url>`.'));
+            'Non-interactively, use `agents share setup` (provision) or `agents share join [url]`.'));
         return false;
     }
     const existing = readShareConfig();
@@ -44,7 +44,7 @@ export async function runShareWizard() {
             {
                 name: 'Join an existing endpoint (a teammate already provisioned one)',
                 value: 'join',
-                description: 'Paste the base URL + write token from whoever owns the endpoint.',
+                description: 'Use synced config when present, or paste the base URL + write token from the endpoint owner.',
             },
         ],
     });

package/dist/commands/setup.js

@@ -16,11 +16,12 @@ import { isGitRepo, cloneIntoExisting, pullRepo } from '../lib/git.js';
 import { isPromptCancelled, isInteractiveTerminal } from './utils.js';
 import { AGENTS, agentConfigDirName, getUnmanagedAgentInstalls, countSessionFiles, agentLabel } from '../lib/agents.js';
 import { setGlobalDefault } from '../lib/versions.js';
-import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPath, getPathSetupInstructions } from '../lib/shims.js';
+import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPath, getPathSetupInstructions, assertIsolationBoundary } from '../lib/shims.js';
 import { setHelpSections } from '../lib/help.js';
 import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.js';
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
 import { registerSetupShareCommand, runShareWizard } from './setup-share.js';
+import { registerSetupMineCommand } from './setup-mine.js';
 const HOME = os.homedir();
 /**
  * Import an existing unmanaged agent installation into agents-cli.
@@ -28,6 +29,11 @@ const HOME = os.homedir();
  */
 async function importAgent(agentId, version) {
     const agent = AGENTS[agentId];
+    // setup has its own hand-rolled adoption (rename + symlink inline, rather than
+    // calling switchConfigSymlink), so the primitive gates never see it. Check the
+    // boundary here, before the first mkdirSync — which would otherwise create the
+    // scaffolding this very check reads.
+    assertIsolationBoundary(agentId, 'adopt your existing install');
     const configDir = agent.configDir;
     const versionsDir = getVersionsDir();
     const versionHome = path.join(versionsDir, agentId, version, 'home');
@@ -266,10 +272,11 @@ export function registerSetupCommand(program) {
         .description('First-time setup. Clones a config repo and installs agent CLIs.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|share`.
+    // Capability subcommands: `agents setup browser|computer|share|mine`.
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
     registerSetupShareCommand(setupCmd);
+    registerSetupMineCommand(setupCmd);
     setHelpSections(setupCmd, {
         examples: `
       # First-time setup (clones the system repo into ~/.agents/.system/)

package/dist/commands/share.d.ts

@@ -1,4 +1,7 @@
 import type { Command } from 'commander';
+import { type CloudflareRequester } from '../lib/share/provision.js';
+import { type PublishResult } from '../lib/share/publish.js';
+export declare function formatSharePublishResult(result: PublishResult, json?: boolean): string;
 export declare function registerShareCommands(program: Command): void;
 /** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
  * endpoint config + write token. Shared by `agents share setup` and the unified
@@ -10,8 +13,12 @@ export declare function runShareProvision(opts: {
     account?: string;
     token?: string;
     domain?: string;
+    analyticsToken?: string;
+    request?: CloudflareRequester;
 }): Promise<void>;
 /** Join an existing share endpoint (no provisioning): prompt for the endpoint
  * details + write token and persist them. Shared by `agents share join` and the
  * unified `agents setup share` wizard. */
-export declare function runShareJoin(baseUrl: string): Promise<void>;
+export declare function runShareJoin(baseUrl?: string, opts?: {
+    token?: string;
+}): Promise<void>;

package/dist/commands/share.js

@@ -2,18 +2,33 @@
 // Worker, and get a shareable link (~$0). See apps/cli/docs/share.md.
 import { existsSync } from 'node:fs';
 import chalk from 'chalk';
-import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_WORKER_NAME, generateWriteToken, readCloudflareCreds, readShareConfig, storeWriteToken, writeShareConfig, } from '../lib/share/config.js';
-import { addCustomDomain, createBucket, deployWorker, enableWorkersDev, findZoneId, } from '../lib/share/provision.js';
+import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, generateWriteToken, readCloudflareCreds, readShareConfig, readWriteTokenEnv, readWriteTokenFromBundle, storeWriteToken, writeShareConfig, } from '../lib/share/config.js';
+import { addCustomDomain, configureBucketLifecycle, createBucket, deployWorker, enableWorkersDev, findZoneId, setWorkerSecret, } from '../lib/share/provision.js';
 import { publishFile } from '../lib/share/publish.js';
 import { renderWorkerScript } from '../lib/share/worker-template.js';
+import { analyticsEnabled } from '../lib/share/analytics.js';
+import { resolveGitHubUsername } from '../lib/git.js';
+export function formatSharePublishResult(result, json = false) {
+    if (json)
+        return JSON.stringify(result, null, 2);
+    const lines = [chalk.green(result.url)];
+    if (result.coverUrl)
+        lines.push(chalk.dim(`  cover ${result.coverUrl}`));
+    if (result.expiresAt)
+        lines.push(chalk.dim(`  expires ${new Date(result.expiresAt).toLocaleString()}`));
+    return lines.join('\n');
+}
 export function registerShareCommands(program) {
     const shareCmd = program
         .command('share')
         .description('Publish an HTML file to your own Cloudflare R2 and get a shareable link (~$0).')
         .argument('[file]', 'file to publish (HTML or any static asset)')
-        .option('--slug <slug>', 'custom URL slug (default: <project>-<feature>-<hash>)')
+        .option('--slug <slug>', 'custom URL slug under your namespace (default: <project>-<feature>-<hash>)')
+        .option('--github-user <user>', 'GitHub username for the share namespace (default: resolved from gh/git config)')
         .option('--expire <spec>', 'auto-expire, e.g. 30d, 12h, or 2026-08-01')
         .option('--no-cover', 'skip the OG preview image (HTML pages get one by default)')
+        .option('--no-analytics', 'skip injecting the Cloudflare Web Analytics beacon')
+        .option('--json', 'emit machine-readable publish result for plan-render hooks and scripts')
         .action(async (file, opts) => {
         if (!file) {
             shareCmd.help();
@@ -27,14 +42,12 @@ export function registerShareCommands(program) {
         try {
             const { url, expiresAt, coverUrl } = await publishFile(file, {
                 slug: opts.slug,
+                githubUser: opts.githubUser,
                 expire: opts.expire,
                 cover: opts.cover,
+                analytics: opts.analytics,
             });
-            console.log(chalk.green(url));
-            if (coverUrl)
-                console.log(chalk.dim(`  cover ${coverUrl}`));
-            if (expiresAt)
-                console.log(chalk.dim(`  expires ${new Date(expiresAt).toLocaleString()}`));
+            console.log(formatSharePublishResult({ url, expiresAt, coverUrl }, Boolean(opts.json)));
         }
         catch (e) {
             console.error(chalk.red(e.message));
@@ -49,7 +62,8 @@ export function registerShareCommands(program) {
         .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
         .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
         .option('--token <t>', 'Cloudflare API token (else read from the --bundle)')
-        .option('--domain <host>', 'also map a custom domain (e.g. share.agents-cli.sh) if the token owns the zone')
+        .option('--domain <host>', `custom domain to map (default: ${DEFAULT_SHARE_DOMAIN}; workers.dev if zone is not visible)`)
+        .option('--analytics-token <token>', 'Cloudflare Web Analytics token to inject into published HTML pages')
         .action(async (opts) => {
         try {
             await runShareProvision(opts);
@@ -61,11 +75,12 @@ export function registerShareCommands(program) {
     });
     shareCmd
         .command('join')
-        .description('Use an existing share endpoint (no provisioning) — pass the base URL and paste the write token.')
-        .argument('<baseUrl>', 'base URL of the endpoint, e.g. https://share.agents-cli.sh')
-        .action(async (baseUrl) => {
+        .description('Use an existing synced share endpoint and write token (no provisioning).')
+        .argument('[baseUrl]', 'base URL of the endpoint, e.g. https://share.agents-cli.sh')
+        .option('--token <token>', 'write token (else SHARE_WRITE_TOKEN env, existing bundle, or prompt)')
+        .action(async (baseUrl, opts) => {
         try {
-            await runShareJoin(baseUrl);
+            await runShareJoin(baseUrl, opts);
         }
         catch (e) {
             console.error(chalk.red(e.message));
@@ -74,8 +89,8 @@ export function registerShareCommands(program) {
     });
     shareCmd
         .command('status')
-        .description('Show the configured share endpoint.')
-        .action(() => {
+        .description('Show the configured share endpoint and namespace.')
+        .action(async () => {
         const cfg = readShareConfig();
         if (!cfg) {
             console.log(chalk.dim("Not configured. Run 'agents share setup' or 'agents share join'."));
@@ -83,6 +98,34 @@ export function registerShareCommands(program) {
         }
         console.log(`${chalk.bold('endpoint')}  ${chalk.green(cfg.baseUrl)}`);
         console.log(chalk.dim(`worker ${cfg.workerName} · bucket ${cfg.bucketName} · account ${cfg.accountId}`));
+        const user = await resolveGitHubUsername();
+        console.log(`${chalk.bold('namespace')} ${user ? chalk.cyan(`${cfg.baseUrl}/${user}`) : chalk.yellow('unknown — set gh auth or github.user')}`);
+        console.log(`${chalk.bold('analytics')} ${analyticsEnabled(cfg) ? chalk.green('enabled') : chalk.dim('not configured')}`);
+    });
+    shareCmd
+        .command('analytics')
+        .description('Show the Cloudflare Web Analytics status for this share endpoint.')
+        .action(async () => {
+        const cfg = readShareConfig();
+        if (!cfg) {
+            console.log(chalk.dim("Not configured. Run 'agents share setup' or 'agents share join'."));
+            return;
+        }
+        if (!analyticsEnabled(cfg)) {
+            console.log(chalk.yellow('Cloudflare Web Analytics is not configured.'));
+            console.log(chalk.dim("Re-run setup with --analytics-token <token> or add analyticsToken to agents.yaml share:."));
+            return;
+        }
+        const dashboard = cfg.domain
+            ? `https://dash.cloudflare.com/${cfg.accountId}/web-analytics/${cfg.domain}`
+            : `https://dash.cloudflare.com/${cfg.accountId}/web-analytics`;
+        console.log(`${chalk.bold('analytics')}  ${chalk.green('enabled')}`);
+        console.log(`${chalk.bold('token')}    ${chalk.dim(cfg.analyticsToken.slice(0, 8) + '…')}`);
+        console.log(`${chalk.bold('dashboard')} ${chalk.cyan(dashboard)}`);
+        const user = await resolveGitHubUsername();
+        if (user) {
+            console.log(chalk.dim(`Per-page breakdown is available under Paths in the dashboard (filter by /${user}/).`));
+        }
     });
 }
 /** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
@@ -101,29 +144,35 @@ export async function runShareProvision(opts) {
     const workerName = opts.worker;
     const bucketName = opts.bucket;
     const token = generateWriteToken();
+    const requestedDomain = cleanHostname(opts.domain) ?? DEFAULT_SHARE_DOMAIN;
     const spin = ora('Provisioning on Cloudflare…').start();
     try {
-        await createBucket(apiToken, accountId, bucketName);
+        const provisionOpts = opts.request ? { request: opts.request } : {};
+        await createBucket(apiToken, accountId, bucketName, provisionOpts);
         spin.text = `R2 bucket '${bucketName}' ready`;
-        await deployWorker(apiToken, accountId, workerName, renderWorkerScript(), bucketName, token);
+        await configureBucketLifecycle(apiToken, accountId, bucketName, provisionOpts);
+        spin.text = `R2 bucket '${bucketName}' lifecycle ready`;
+        await deployWorker(apiToken, accountId, workerName, renderWorkerScript(), bucketName, provisionOpts);
         spin.text = `Worker '${workerName}' deployed`;
-        const subdomain = await enableWorkersDev(apiToken, accountId, workerName);
+        await setWorkerSecret(apiToken, accountId, workerName, token, provisionOpts);
+        spin.text = `Worker '${workerName}' write token set`;
+        const subdomain = await enableWorkersDev(apiToken, accountId, workerName, provisionOpts);
         let baseUrl = `https://${workerName}.${subdomain}.workers.dev`;
         let domain;
-        if (opts.domain) {
-            spin.text = `Mapping ${opts.domain}…`;
-            const zoneId = await findZoneId(apiToken, opts.domain);
+        if (requestedDomain) {
+            spin.text = `Mapping ${requestedDomain}…`;
+            const zoneId = await findZoneId(apiToken, requestedDomain, provisionOpts);
             if (zoneId) {
-                await addCustomDomain(apiToken, accountId, workerName, zoneId, opts.domain);
-                baseUrl = `https://${opts.domain}`;
-                domain = opts.domain;
+                await addCustomDomain(apiToken, accountId, workerName, zoneId, requestedDomain, provisionOpts);
+                baseUrl = `https://${requestedDomain}`;
+                domain = requestedDomain;
             }
             else {
-                spin.warn(`Zone for ${opts.domain} not visible to this token — staying on workers.dev`);
+                spin.warn(`Zone for ${requestedDomain} not visible to this token — staying on workers.dev`);
             }
         }
         spin.succeed('Provisioned');
-        const cfg = { baseUrl, accountId, workerName, bucketName, domain };
+        const cfg = { baseUrl, accountId, workerName, bucketName, domain, analyticsToken: opts.analyticsToken };
         writeShareConfig(cfg);
         storeWriteToken(token);
         console.log(chalk.green(`\nShare endpoint ready → ${chalk.bold(baseUrl)}`));
@@ -135,22 +184,58 @@ export async function runShareProvision(opts) {
         throw e;
     }
 }
+function cleanHostname(domain) {
+    const raw = domain?.trim().replace(/\/+$/, '');
+    if (!raw)
+        return undefined;
+    try {
+        const url = new URL(raw.includes('://') ? raw : `https://${raw}`);
+        return url.hostname || undefined;
+    }
+    catch {
+        return raw;
+    }
+}
 /** Join an existing share endpoint (no provisioning): prompt for the endpoint
  * details + write token and persist them. Shared by `agents share join` and the
  * unified `agents setup share` wizard. */
-export async function runShareJoin(baseUrl) {
+export async function runShareJoin(baseUrl, opts = {}) {
     const { password, input } = await import('@inquirer/prompts');
-    const clean = baseUrl.replace(/\/+$/, '');
-    const workerName = await input({ message: 'Worker name', default: DEFAULT_WORKER_NAME });
-    const bucketName = await input({ message: 'Bucket name', default: DEFAULT_BUCKET_NAME });
-    const accountId = await input({ message: 'Cloudflare account id' });
-    const token = await password({ message: 'Write token (from the endpoint owner)', mask: true });
+    const existing = readShareConfig();
+    const clean = baseUrl?.replace(/\/+$/, '');
+    if (!clean && !existing) {
+        throw new Error("No synced share endpoint found. Pull config first with 'agents repo pull', or pass the endpoint URL: agents share join <baseUrl>.");
+    }
+    let cfg;
+    if (existing && (!clean || clean === existing.baseUrl)) {
+        cfg = existing;
+    }
+    else {
+        if (!clean)
+            throw new Error('Share endpoint URL is required.');
+        const workerName = await input({ message: 'Worker name', default: DEFAULT_WORKER_NAME });
+        const bucketName = await input({ message: 'Bucket name', default: DEFAULT_BUCKET_NAME });
+        const accountId = await input({ message: 'Cloudflare account id' });
+        const domain = clean.startsWith('https://') && !clean.includes('.workers.dev')
+            ? clean.replace(/^https:\/\//, '')
+            : undefined;
+        cfg = { baseUrl: clean, accountId, workerName, bucketName, domain };
+    }
+    let token = opts.token?.trim() || readWriteTokenEnv() || '';
+    if (!token) {
+        try {
+            token = readWriteTokenFromBundle();
+        }
+        catch {
+            token = '';
+        }
+    }
+    if (!token) {
+        token = await password({ message: 'Write token (from the endpoint owner)', mask: true });
+    }
     if (!token)
         throw new Error('A write token is required to join.');
-    const domain = clean.startsWith('https://') && !clean.includes('.workers.dev')
-        ? clean.replace(/^https:\/\//, '')
-        : undefined;
-    writeShareConfig({ baseUrl: clean, accountId, workerName, bucketName, domain });
+    writeShareConfig(cfg);
     storeWriteToken(token);
-    console.log(chalk.green(`Joined ${chalk.bold(clean)} — publish with `) + chalk.cyan('agents share <file>'));
+    console.log(chalk.green(`Joined ${chalk.bold(cfg.baseUrl)} — publish with `) + chalk.cyan('agents share <file>'));
 }

package/dist/commands/ssh.d.ts

@@ -10,5 +10,14 @@
  * rsync / `agents sessions --host` resolve the same logical names.
  */
 import type { Command } from 'commander';
+import { type CrabboxBox } from '../lib/crabbox/cli.js';
+/**
+ * Live "Leased boxes" section for `agents devices` (F4, RUSH-1923), computed
+ * from `crabboxList()` — these are ephemeral crabbox leases, NEVER written into
+ * the device registry. Returns [] when crabbox is unavailable / has no creds /
+ * reports no boxes, so the section is simply omitted. `nowSecs` is injected so
+ * the row formatting is deterministic in tests.
+ */
+export declare function renderLeasedBoxesSection(boxes: CrabboxBox[], nowSecs: number): string[];
 /** Register both `agents ssh` and `agents devices`. */
 export declare function registerSshCommands(program: Command): void;