@phnx-labs/agents-cli 1.22.106 → 1.22.109

package/dist/lib/session/tool-calls.d.ts

@@ -10,7 +10,7 @@ export declare const TOOL_CHANGED_MAX_CALLS = 10000;
 export declare const TOOL_INDEX_LIMIT_ORDINAL: number;
 export declare const TOOL_TEXT_PROCESSING_MAX_BYTES: number;
 export declare const TOOL_SHELL_PARSE_MAX_BYTES: number;
-export declare const TOOL_INDEX_VERSION = 8;
+export declare const TOOL_INDEX_VERSION = 9;
 export type ToolCallOutcome = 'ok' | 'error' | 'unknown';
 export interface IndexedToolCall {
     ordinal: number;

package/dist/lib/session/tool-calls.js

@@ -12,10 +12,12 @@ export const TOOL_CHANGED_MAX_CALLS = 10_000;
 export const TOOL_INDEX_LIMIT_ORDINAL = Number.MAX_SAFE_INTEGER;
 export const TOOL_TEXT_PROCESSING_MAX_BYTES = 64 * 1024;
 export const TOOL_SHELL_PARSE_MAX_BYTES = 64 * 1024;
-// Bumped to 8 for the per-call end timestamp (PHNX-3437): the extractor now
-// records when a call's result arrived, so a re-index re-derives it for rows
-// stored by an older extractor.
-export const TOOL_INDEX_VERSION = 8;
+// Bumped to 9 for Codex tool-outcome classification (PHNX-3761): Codex results
+// arrive as a string or input_text[] rather than an object, so every one used to
+// store as 'unknown' and error rates read 0%. A re-index re-derives outcome for
+// rows stored by an older extractor.
+// (8 added the per-call end timestamp, PHNX-3437.)
+export const TOOL_INDEX_VERSION = 9;
 const BASE64_BLOCK = /(?:[A-Za-z0-9+/]{256,}={0,2})/g;
 const SECRET_FIELD = /(?:token|secret|password|authorization|cookie|api[_-]?key|private[_-]?key)$/i;
 const KNOWN_SECRET_VALUES = knownSecretValuesFromEnv();
@@ -258,9 +260,37 @@ function structuredString(source, name) {
     const value = structuredField(source, name);
     return typeof value === 'string' ? value : undefined;
 }
+// Codex tool results arrive as a plain string or an array of {type:'input_text',
+// text} blocks (never a plain object), so the text lives across the blocks and
+// the only outcome signal is the leading "Script completed"/"Script failed"
+// marker the exec harness prefixes onto the first block.
+function textSegments(value) {
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value)) {
+        return value
+            .map((block) => block && typeof block === 'object' && typeof block.text === 'string'
+            ? block.text
+            : '')
+            .filter((text) => text.length > 0);
+    }
+    return [];
+}
+function codexScriptOutcome(value) {
+    const lead = textSegments(value)[0]?.trimStart();
+    if (!lead)
+        return undefined;
+    if (lead.startsWith('Script failed'))
+        return 'error';
+    if (lead.startsWith('Script completed'))
+        return 'ok';
+    return undefined;
+}
 function resultText(value) {
     if (typeof value === 'string')
         return value;
+    if (Array.isArray(value))
+        return textSegments(value).join('\n');
     const object = resultObject(value);
     if (object) {
         for (const key of ['output', 'stdout', 'content', 'text', 'message']) {
@@ -280,9 +310,14 @@ export function structuredToolResult(value) {
     const structured = resultObject(value);
     const success = structuredField(structured, 'success');
     const isError = success === false || structuredField(structured, 'is_error') === true;
+    const outcome = isError
+        ? 'error'
+        : success === true
+            ? 'ok'
+            : codexScriptOutcome(value) ?? 'unknown';
     return {
         text: resultText(value),
-        outcome: isError ? 'error' : success === true ? 'ok' : 'unknown',
+        outcome,
         exitCode: structuredNumber(structured, 'exit_code'),
         statusCode: structuredNumber(structured, 'status_code'),
         errorCode: structuredString(structured, 'error_code'),

package/dist/lib/share/backend.d.ts

@@ -89,6 +89,29 @@ export declare function phoenixIdBaseForDeploy(opts?: {
     baseUrl?: string;
     domain?: string;
 }): string | undefined;
+/**
+ * Managed collaboration backend config to bind on a managed Worker deploy
+ * (PHNX-3835): `PRIX_ARTIFACT_COLLAB_BASE` (the Prix artifact-collaboration API
+ * base) and `ARTIFACT_COLLAB_SERVICE_TOKEN` (the service credential the Worker
+ * sends as `Authorization: Bearer`, NEVER surfaced to the browser). Both are read
+ * from the deploy environment.
+ *
+ * Deliberately dormant-by-default: the two secrets are applied ONLY when BOTH are
+ * present. Until the Prix API counterpart is live an operator leaves them unset,
+ * and the Worker fails `/__collab` closed (404) with the artifact page GET
+ * unaffected. A pure-BYO endpoint never gets them (it has no Phoenix identity).
+ * Unlike `phoenixIdBaseForDeploy` this never throws on absence — collaboration is
+ * additive, not required for a working managed deploy.
+ */
+export declare function collabConfigForDeploy(opts?: {
+    managed?: boolean;
+}, cfg?: {
+    baseUrl?: string;
+    domain?: string;
+}): {
+    collabBase?: string;
+    collabServiceToken?: string;
+};
 /**
  * Pick the principal via the shared selection policy. Signed-in AND no explicit
  * BYO override → managed; otherwise BYO.

package/dist/lib/share/backend.js

@@ -84,6 +84,30 @@ export function phoenixIdBaseForDeploy(opts = {}, cfg) {
     }
     return base;
 }
+/**
+ * Managed collaboration backend config to bind on a managed Worker deploy
+ * (PHNX-3835): `PRIX_ARTIFACT_COLLAB_BASE` (the Prix artifact-collaboration API
+ * base) and `ARTIFACT_COLLAB_SERVICE_TOKEN` (the service credential the Worker
+ * sends as `Authorization: Bearer`, NEVER surfaced to the browser). Both are read
+ * from the deploy environment.
+ *
+ * Deliberately dormant-by-default: the two secrets are applied ONLY when BOTH are
+ * present. Until the Prix API counterpart is live an operator leaves them unset,
+ * and the Worker fails `/__collab` closed (404) with the artifact page GET
+ * unaffected. A pure-BYO endpoint never gets them (it has no Phoenix identity).
+ * Unlike `phoenixIdBaseForDeploy` this never throws on absence — collaboration is
+ * additive, not required for a working managed deploy.
+ */
+export function collabConfigForDeploy(opts = {}, cfg) {
+    const managed = opts.managed === true || (cfg != null && isManagedShareEndpoint(cfg));
+    if (!managed)
+        return {};
+    const base = (process.env.PRIX_ARTIFACT_COLLAB_BASE || '').replace(/\/+$/, '').trim();
+    const token = (process.env.ARTIFACT_COLLAB_SERVICE_TOKEN || '').trim();
+    if (!base || !token)
+        return {};
+    return { collabBase: base, collabServiceToken: token };
+}
 /**
  * The share surface's BYO-override signals: an explicit `--byo`, a
  * caller-supplied static write token, or `AGENTS_SHARE_BACKEND=byo`. Detecting

package/dist/lib/share/provision.d.ts

@@ -64,6 +64,10 @@ export interface UpdateWorkerResult {
 }
 /** Cloudflare `secret_text` name the Worker reads as `env.PHOENIX_ID_BASE`. */
 export declare const WORKER_PHOENIX_ID_BASE_SECRET = "PHOENIX_ID_BASE";
+/** Cloudflare `secret_text` name the Worker reads as `env.PRIX_ARTIFACT_COLLAB_BASE`. */
+export declare const WORKER_COLLAB_BASE_SECRET = "PRIX_ARTIFACT_COLLAB_BASE";
+/** Cloudflare `secret_text` name the Worker reads as `env.ARTIFACT_COLLAB_SERVICE_TOKEN`. */
+export declare const WORKER_COLLAB_SERVICE_TOKEN_SECRET = "ARTIFACT_COLLAB_SERVICE_TOKEN";
 export type UpdateWorkerOpts = ProvisionOptions & {
     force?: boolean;
     /**
@@ -73,6 +77,14 @@ export type UpdateWorkerOpts = ProvisionOptions & {
      * fails loud — do not pass a blank to "skip".
      */
     phoenixIdBase?: string;
+    /**
+     * Managed collaboration backend (PHNX-3835). BOTH must be present to enable
+     * `/__collab`; pass neither to leave the surface disabled (the Worker fails it
+     * closed). The service token rides Cloudflare's Secrets API, never rendered
+     * HTML or browser JS. Applied like `phoenixIdBase` — only when defined.
+     */
+    collabBase?: string;
+    collabServiceToken?: string;
 };
 /**
  * Re-deploy the Worker script against an ALREADY-provisioned endpoint (same

package/dist/lib/share/provision.js

@@ -107,6 +107,10 @@ export function hashWorkerScript(script) {
 }
 /** Cloudflare `secret_text` name the Worker reads as `env.PHOENIX_ID_BASE`. */
 export const WORKER_PHOENIX_ID_BASE_SECRET = 'PHOENIX_ID_BASE';
+/** Cloudflare `secret_text` name the Worker reads as `env.PRIX_ARTIFACT_COLLAB_BASE`. */
+export const WORKER_COLLAB_BASE_SECRET = 'PRIX_ARTIFACT_COLLAB_BASE';
+/** Cloudflare `secret_text` name the Worker reads as `env.ARTIFACT_COLLAB_SERVICE_TOKEN`. */
+export const WORKER_COLLAB_SERVICE_TOKEN_SECRET = 'ARTIFACT_COLLAB_SERVICE_TOKEN';
 /**
  * Re-deploy the Worker script against an ALREADY-provisioned endpoint (same
  * account/worker/bucket `deployWorker` was first called with) and idempotently
@@ -145,6 +149,7 @@ export async function updateWorker(apiToken, accountId, workerName, bucketName,
         if (opts.phoenixIdBase !== undefined) {
             await applyPhoenixIdBaseSecret(apiToken, accountId, workerName, opts.phoenixIdBase, opts);
         }
+        await applyCollabSecrets(apiToken, accountId, workerName, opts);
         return { templateHash, skipped: true };
     }
     await deployWorker(apiToken, accountId, workerName, worker, bucketName, opts);
@@ -168,8 +173,33 @@ export async function updateWorker(apiToken, accountId, workerName, bucketName,
             throw new Error(`Worker deployed but PHOENIX_ID_BASE failed to re-apply — Phoenix-bearer publishes will 401 until you re-run \`agents artifacts share update\`. (${detail})`);
         }
     }
+    // The script upload wiped bindings/secrets (see JSDoc above), so re-apply the
+    // collaboration secrets too — but only when the caller provided them. An
+    // ordinary deploy with collaboration still dormant passes neither and the
+    // Worker keeps failing `/__collab` closed.
+    try {
+        await applyCollabSecrets(apiToken, accountId, workerName, opts);
+    }
+    catch (e) {
+        const detail = e instanceof Error ? e.message : String(e);
+        throw new Error(`Worker deployed but the collaboration secrets failed to re-apply — \`/__collab\` stays disabled until you re-run \`agents artifacts share update\`. (${detail})`);
+    }
     return { templateHash, skipped: false };
 }
+/**
+ * Bind the managed collaboration secrets (PHNX-3835) — both or neither. A no-op
+ * when the caller passed neither (collaboration dormant), so a plain managed
+ * deploy never touches them; fails loud on a half-config (one without the other).
+ */
+async function applyCollabSecrets(apiToken, accountId, workerName, opts) {
+    if (opts.collabBase === undefined && opts.collabServiceToken === undefined)
+        return;
+    if (opts.collabBase === undefined || opts.collabServiceToken === undefined) {
+        throw new Error('Managed collaboration needs BOTH PRIX_ARTIFACT_COLLAB_BASE and ARTIFACT_COLLAB_SERVICE_TOKEN — set both or neither.');
+    }
+    await putWorkerSecret(apiToken, accountId, workerName, WORKER_COLLAB_BASE_SECRET, opts.collabBase, opts);
+    await putWorkerSecret(apiToken, accountId, workerName, WORKER_COLLAB_SERVICE_TOKEN_SECRET, opts.collabServiceToken, opts);
+}
 /** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
 export async function putWorkerSecret(apiToken, accountId, workerName, name, text, opts = {}) {
     const request = opts.request ?? defaultCloudflareRequester;

package/dist/lib/share/worker-template.js

@@ -85,6 +85,7 @@ import jetbrainsMono from '@fontsource/jetbrains-mono/files/jetbrains-mono-latin
 export const hooks = {
   verifyPhoenixToken: defaultVerifyPhoenixToken,
   renderOgCard: renderOgCard,
+  collabFetch: defaultCollabFetch,
 };
 
 export default {
@@ -99,6 +100,19 @@ export default {
     }
 
     const firstSeg = path.split('/').filter(Boolean)[0] || '';
+
+    // Same-origin human collaboration transport (PHNX-3835). Every /__collab/*
+    // verb loads the R2 share object FIRST, re-derives identity/visibility/
+    // provenance server-side, reuses the exact page read gate, then proxies to
+    // the Prix artifact-collaboration API with the service token (never surfaced
+    // to the browser). Routed BEFORE the __-prefix GET 404 guard below because
+    // GET /__collab/context|threads|events are first-class. Fails closed (404)
+    // when the managed backend is unconfigured — BYO has no Phoenix identity, so
+    // managed collaboration correctly does not exist there.
+    if (firstSeg === '__collab') {
+      return handleCollab(request, env, url, path, ctx);
+    }
+
     if ((request.method === 'GET' || request.method === 'HEAD') && firstSeg.startsWith('__')) {
       return new Response('not found', { status: 404, headers: { 'content-type': 'text/plain' } });
     }
@@ -836,6 +850,26 @@ export default {
           freeCanonical: delSegs.length === 2,
         });
       }
+      // PHNX-3835: best-effort purge of the deleted share's collaboration
+      // threads. Object-first gating already makes comments inaccessible the
+      // instant the R2 object is gone (every /__collab request 404s on the
+      // missing object), so this is durable cleanup on the Prix side, never the
+      // security boundary. Fire-and-forget so a purge failure never fails the
+      // delete. Only a managed (Phoenix) canonical page (2 segments, not a
+      // cover, not an internal __-key) can carry collaboration.
+      const collabCfgDel = collabConfig(env);
+      if (
+        collabCfgDel &&
+        auth.kind === 'phoenix' &&
+        !isCover &&
+        !firstSeg.startsWith('__') &&
+        path.split('/').filter(Boolean).length === 2
+      ) {
+        const purgeOwner = (doomed && doomed.customMetadata && doomed.customMetadata.owner) || auth.owner;
+        const purge = purgeCollab(env, collabCfgDel, purgeOwner, path);
+        if (ctx && typeof ctx.waitUntil === 'function') ctx.waitUntil(purge);
+        else await purge;
+      }
       return json({ ok: true, deleted: path }, 200);
     }
 
@@ -2147,5 +2181,244 @@ async function authorizeWrite(request, env) {
   }
   return { error: json({ error: 'unauthorized' }, 401) };
 }
+
+// ---- Same-origin human collaboration transport (PHNX-3835) ----
+//
+// The Worker is the trust boundary for collaboration exactly as it is for the
+// page GET. For every /__collab/* request it:
+//   1. loads the R2 share object FIRST (object-first) and 404s if absent — share
+//      existence is never enumerable, and a deleted share drops its comments the
+//      instant the object is gone (no separate revocation step);
+//   2. re-derives share identity, current revision (etag), owner, visibility,
+//      org domain, and producer provenance SERVER-SIDE from R2 metadata, ignoring
+//      anything the browser supplied (the 'share' field is a LOOKUP key only,
+//      never trusted as identity);
+//   3. reuses the EXACT page read gate (me/org identity gate + private token
+//      gate), mapping any denial to 404 so an out-of-scope viewer cannot tell the
+//      share exists; every WRITE additionally requires a verified signed-in
+//      Phoenix human;
+//   4. proxies to the Prix artifact-collaboration API with the service token in
+//      Authorization (never surfaced to the browser) plus trusted X-Artifact-* /
+//      X-Phoenix-* headers, streaming SSE through without buffering.
+//
+// Missing PRIX_ARTIFACT_COLLAB_BASE or ARTIFACT_COLLAB_SERVICE_TOKEN disables the
+// whole surface (404) without touching artifact page GET.
+
+var COLLAB_VISIBILITIES = ['public', 'unlisted', 'private', 'me', 'org'];
+
+// The managed collaboration backend, or null when unconfigured. Both the base
+// URL and the service token must be present; either missing fails the whole
+// surface closed.
+function collabConfig(env) {
+  const base = typeof env.PRIX_ARTIFACT_COLLAB_BASE === 'string' ? env.PRIX_ARTIFACT_COLLAB_BASE.replace(/\\/+$/, '').trim() : '';
+  const token = typeof env.ARTIFACT_COLLAB_SERVICE_TOKEN === 'string' ? env.ARTIFACT_COLLAB_SERVICE_TOKEN : '';
+  if (!base || !token) return null;
+  return { base: base, token: token };
+}
+
+// No collaboration response may be cached (visibility can downgrade on any
+// request), and every collab body is JSON unless overridden (SSE).
+function collabHeaders(extra) {
+  const h = new Headers(extra || {});
+  if (!h.has('content-type')) h.set('content-type', 'application/json');
+  h.set('cache-control', 'no-store');
+  return h;
+}
+
+function collabError(message, status) {
+  return new Response(JSON.stringify({ error: message }), { status: status, headers: collabHeaders() });
+}
+
+// A collab denial is ALWAYS a 404 — never a 302 login bounce or a 401 for a read
+// — so an out-of-scope viewer cannot enumerate share existence.
+function collabNotFound() {
+  return collabError('not found', 404);
+}
+
+// The page READ gate, reused verbatim for collaboration reads/subscriptions but
+// with every denial normalized to 404. Returns null when the read is allowed.
+async function collabReadGate(request, url, obj, identity) {
+  const visibility = (obj.customMetadata && obj.customMetadata.visibility) || 'public';
+  // Unknown visibility fails closed.
+  if (COLLAB_VISIBILITIES.indexOf(visibility) === -1) return collabNotFound();
+  if (isIdentityGated(visibility)) {
+    // me/org: require a matching identity; a missing/wrong viewer 404s (never the
+    // page GET's 302 login bounce, which is meaningless to a fetch()).
+    if (!identity || !viewerMayRead(visibility, obj.customMetadata, identity)) return collabNotFound();
+    return null;
+  }
+  if (visibility === 'private') {
+    // private: require the viewer token, exactly as the page GET does.
+    const denied = await gateTokenRead(request, url, obj, identity);
+    if (denied) return collabNotFound();
+    return null;
+  }
+  return null; // public | unlisted — readable when the object exists
+}
+
+// Map a browser /__collab sub-route to the Prix artifact-collaboration route +
+// method. Returns null for any unsupported shape (fail loud, never a wrong path).
+// Only the cursor rides through as a query param; the browser's own \`share\`
+// param is dropped (Prix derives identity from the trusted header, not the path).
+function collabTarget(rest, method, url) {
+  if (rest.length === 1 && rest[0] === 'context' && method === 'GET') {
+    return { path: '/context', search: '', sse: false };
+  }
+  if (rest.length === 1 && rest[0] === 'threads') {
+    if (method === 'GET') {
+      const after = url.searchParams.get('after');
+      return { path: '/threads', search: after ? '?after=' + encodeURIComponent(after) : '', sse: false };
+    }
+    if (method === 'POST') return { path: '/threads', search: '', sse: false };
+  }
+  if (rest.length === 2 && rest[0] === 'threads' && method === 'PATCH') {
+    return { path: '/threads/' + encodeURIComponent(rest[1]), search: '', sse: false };
+  }
+  if (rest.length === 3 && rest[0] === 'threads' && rest[2] === 'replies' && method === 'POST') {
+    return { path: '/threads/' + encodeURIComponent(rest[1]) + '/replies', search: '', sse: false };
+  }
+  if (rest.length === 2 && rest[0] === 'comments' && method === 'PATCH') {
+    return { path: '/comments/' + encodeURIComponent(rest[1]), search: '', sse: false };
+  }
+  if (rest.length === 1 && rest[0] === 'events' && method === 'GET') {
+    return { path: '/events', search: '', sse: true };
+  }
+  return null;
+}
+
+async function handleCollab(request, env, url, path, ctx) {
+  const cfg = collabConfig(env);
+  // Fail closed: no managed backend → the surface does not exist.
+  if (!cfg) return collabNotFound();
+
+  const segs = path.split('/').filter(Boolean); // ['__collab', ...]
+  const rest = segs.slice(1);
+  const method = request.method;
+
+  // Resolve the share path. GET carries it in ?share=, mutations in the JSON
+  // body — read that body ONCE here so \`share\` extraction and verbatim upstream
+  // forwarding share a single read.
+  const isMutation = method === 'POST' || method === 'PATCH';
+  let sharePath = '';
+  let bodyText = '';
+  if (isMutation) {
+    bodyText = await request.text();
+    let parsed;
+    try { parsed = JSON.parse(bodyText || '{}'); } catch { return collabError('body must be JSON', 400); }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return collabError('body must be a JSON object', 400);
+    sharePath = typeof parsed.share === 'string' ? parsed.share : '';
+  } else {
+    sharePath = url.searchParams.get('share') || '';
+  }
+  sharePath = String(sharePath).replace(/^\\/+/, '');
+  const shareFirst = sharePath.split('/').filter(Boolean)[0] || '';
+  // Never let a collab lookup reach an internal __-key or an empty share.
+  if (!sharePath || shareFirst.startsWith('__')) return collabNotFound();
+
+  // OBJECT-FIRST: load the share before deriving anything. A missing share
+  // (never provisioned, or just deleted) 404s.
+  const obj = await env.BUCKET.get(sharePath);
+  if (!obj) return collabNotFound();
+
+  // Re-derive identity SERVER-SIDE and apply the page read gate. Collab clients
+  // authenticate with the Bearer or the __share cookie, never a ?phoenix_ticket=
+  // (that is a page-navigation param the CLI appends when OPENING a page). So we
+  // use only the resolved identity and ignore any redirect outcome — a 302 login
+  // bounce is meaningless to a fetch(). If a ticket were present it would be
+  // redeemed (and, being single-use, consumed) here but its cookie discarded, so
+  // the request falls through as anonymous — the fail-safe (more restrictive)
+  // direction, never an escalation.
+  const viewer = await resolveViewer(request, env, url);
+  const identity = viewer.identity || null;
+  const readDenied = await collabReadGate(request, url, obj, identity);
+  if (readDenied) return readDenied;
+
+  // Every write requires a verified signed-in Phoenix human, ON TOP of the read
+  // gate (public/unlisted readers may read anonymously but never write).
+  if (isMutation && (!identity || !identity.userId)) {
+    return collabError('sign in with Phoenix to comment', 401);
+  }
+
+  const target = collabTarget(rest, method, url);
+  if (!target) return collabError('unsupported collaboration route', 404);
+
+  // Trusted, server-derived values. owner + NUL + normalized path → a stable
+  // share id; the raw private access token is NEVER used as identity.
+  const meta = obj.customMetadata || {};
+  const visibility = meta.visibility || 'public';
+  const owner = meta.owner || '';
+  const shareId = await sha256Hex(owner + '\\u0000' + sharePath);
+  const revision = obj.etag || '';
+
+  const headers = new Headers();
+  headers.set('authorization', 'Bearer ' + cfg.token);
+  headers.set('x-artifact-share-id', shareId);
+  if (revision) headers.set('x-artifact-revision', revision);
+  headers.set('x-artifact-visibility', visibility);
+  if (owner) headers.set('x-artifact-owner-id', owner);
+  if (meta.org_domain) headers.set('x-artifact-org-domain', meta.org_domain);
+  if (identity && identity.userId) headers.set('x-phoenix-actor-id', identity.userId);
+  if (identity && identity.email) headers.set('x-phoenix-actor-email', identity.email);
+  // Preserve existing R2 producer provenance (RUSH-2683) so Prix can attribute a
+  // comment thread to the run that made the artifact.
+  if (meta.agent) headers.set('x-artifact-agent', meta.agent);
+  if (meta.session) headers.set('x-artifact-session', meta.session);
+  if (meta.host) headers.set('x-artifact-host', meta.host);
+  if (meta.repo) headers.set('x-artifact-repo', meta.repo);
+  // Idempotency + resumable-SSE headers ride through unchanged.
+  const idem = request.headers.get('idempotency-key');
+  if (idem) headers.set('idempotency-key', idem);
+  const lastEvent = request.headers.get('last-event-id');
+  if (lastEvent) headers.set('last-event-id', lastEvent);
+  if (target.sse) headers.set('accept', 'text/event-stream');
+  else if (isMutation) headers.set('content-type', 'application/json');
+
+  const init = { method: method, headers: headers };
+  if (isMutation) init.body = bodyText;
+  // Propagate a client disconnect to the upstream fetch (SSE cancel).
+  if (request.signal) init.signal = request.signal;
+
+  let upstream;
+  try {
+    upstream = await hooks.collabFetch(new Request(cfg.base + '/v1/artifact-collaboration' + target.path + target.search, init));
+  } catch (e) {
+    return collabError('collaboration backend unavailable', 502);
+  }
+
+  // Forward Prix status + body. Never echo the service token; every collab
+  // response is no-store. SSE streams through unbuffered — event IDs and content
+  // type ride the bytes, and disabling proxy buffering keeps the stream live.
+  const ct = upstream.headers.get('content-type');
+  const outHeaders = collabHeaders();
+  if (target.sse) {
+    outHeaders.set('content-type', ct || 'text/event-stream');
+    outHeaders.set('x-accel-buffering', 'no');
+  } else if (ct) {
+    outHeaders.set('content-type', ct);
+  }
+  return new Response(upstream.body, { status: upstream.status, headers: outHeaders });
+}
+
+// Best-effort authenticated purge of a deleted share's collaboration threads.
+// Swallows every error — a purge failure must never fail the share delete, and
+// object-first gating already made the comments inaccessible.
+async function purgeCollab(env, cfg, owner, sharePath) {
+  try {
+    const shareId = await sha256Hex((owner || '') + '\\u0000' + sharePath);
+    const headers = new Headers();
+    headers.set('authorization', 'Bearer ' + cfg.token);
+    headers.set('x-artifact-share-id', shareId);
+    await hooks.collabFetch(new Request(cfg.base + '/v1/artifact-collaboration/purge', { method: 'POST', headers: headers }));
+  } catch (e) {
+    // best-effort: a purge failure must never fail the share delete
+  }
+}
+
+// The real upstream hop to Prix. Overridable in tests (like verifyPhoenixToken)
+// so the generated Worker's derivation/gating is exercised against a simulated
+// backend without a live network.
+async function defaultCollabFetch(request) {
+  return fetch(request);
+}
 `;
 }

package/dist/lib/terminal/engine.js

@@ -1,6 +1,8 @@
 import { BACKENDS } from './backends/index.js';
 import { planLayouts } from './policy.js';
 import { runSpec } from './transport.js';
+import { homeRemainder, remoteCdPrefix } from '../project-root.js';
+import { sshExec } from '../ssh-exec.js';
 const DEFAULT_STAGGER_MS = 400;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /** The concrete launch command for a request (pure — no side effects). */
@@ -21,7 +23,17 @@ export async function openSurface(req, opts = {}) {
         // Both can throw: specForRequest on an unknown backend, runSpec when the
         // SSH transport rejects an invalid --device target. Keep them inside the
         // catch so a bad request degrades to a per-surface failure, never a throw.
-        const spec = specForRequest(req);
+        let resolved = req;
+        if (req.host && req.host !== 'local' && homeRemainder(req.cwd) !== null) {
+            const target = opts.resolveHost ? opts.resolveHost(req.host) : req.host;
+            const result = sshExec(target, remoteCdPrefix(req.cwd) + 'pwd -P', { multiplex: true });
+            const cwd = result.stdout.replace(/\r?\n$/, '');
+            if (result.code !== 0 || !cwd.startsWith('/') || /[\r\n]/.test(cwd)) {
+                throw new Error(`Cannot resolve directory ${req.cwd} on ${req.host}: ${(result.stderr || '').trim() || 'no absolute working directory returned'}`);
+            }
+            resolved = { ...req, cwd };
+        }
+        const spec = specForRequest(resolved);
         const res = await runSpec(spec, req.host, opts.resolveHost);
         return { ok: res.ok, request: req, error: res.error };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.106",
+  "version": "1.22.109",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",