@phnx-labs/agents-cli 1.22.114 → 1.22.115

package/dist/lib/ssh-exec.js

@@ -317,6 +317,125 @@ export function sshExecRaw(target, remoteCmd, opts = {}) {
  * offset-resumed log following where a UTF-8 decode boundary must not shift the
  * byte cursor.
  */
+/** Grace between SIGTERM and SIGKILL for a stream that will not stop. */
+export const SSH_STREAM_KILL_GRACE_MS = 3_000;
+/** Bytes of a stream's stderr retained; the rest is dropped, with a note. */
+export const SSH_STREAM_MAX_STDERR = 8 * 1024;
+/**
+ * Stream one ssh command's stdout, with the args and env a CALLER built.
+ *
+ * This exists because {@link sshExecRawStream} assembles its own ssh args, which
+ * means it cannot carry a device's canonical auth — the askpass shim for a
+ * password-auth box, `-i`/`IdentitiesOnly` for an explicit identity file, or the
+ * managed known-hosts pinning. A caller that has already built those through
+ * `buildSshInvocation` needs a way to run them, and duplicating the transport to
+ * get it would be the worse answer. So this takes `args`/`env` verbatim and adds
+ * only the lifecycle guarantees:
+ *
+ * - **SIGTERM then SIGKILL.** A timeout or abort that only sends SIGTERM leaks a
+ *   child that ignores it — ssh does, mid-handshake — and the promise never
+ *   settles. After {@link SSH_STREAM_KILL_GRACE_MS} the child is SIGKILLed and
+ *   `killed` says so.
+ * - **Bounded stderr.** A peer that writes endlessly to stderr would otherwise
+ *   grow this buffer without limit; it is capped and `stderrTruncated` says so.
+ * - **`onStdout` cannot break the caller's cleanup.** A throw from the consumer
+ *   is captured and re-thrown by the awaiting caller, so a write failure ends the
+ *   transfer instead of escaping as an unhandled error inside a stream event.
+ */
+export function sshStreamWithArgs(opts) {
+    const maxStderr = opts.maxStderrBytes ?? SSH_STREAM_MAX_STDERR;
+    const grace = opts.killGraceMs ?? SSH_STREAM_KILL_GRACE_MS;
+    return new Promise((resolve, reject) => {
+        const child = spawn(opts.sshBin ?? 'ssh', opts.args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: opts.env ? { ...process.env, ...opts.env } : process.env,
+            windowsHide: true,
+            // Own process group on POSIX so a kill reaches the whole tree. Killing only
+            // the ssh pid is not enough: a descendant that inherited stdout keeps the
+            // pipe open, `'close'` never fires, and the promise hangs for as long as
+            // that grandchild lives — which defeats the timeout entirely.
+            detached: process.platform !== 'win32',
+        });
+        const stderr = [];
+        let stderrBytes = 0;
+        let stderrTruncated = false;
+        let timedOut = false;
+        let killed = false;
+        let consumerError;
+        let settled = false;
+        let killTimer;
+        /** Signal the whole group where the platform supports it, else just the child. */
+        const signal = (sig) => {
+            try {
+                if (process.platform !== 'win32' && child.pid)
+                    process.kill(-child.pid, sig);
+                else
+                    child.kill(sig);
+            }
+            catch { /* already gone */ }
+        };
+        const escalate = () => {
+            signal('SIGTERM');
+            // Escalation, not a second polite ask: a child still alive after the grace
+            // is one that is not going to honour SIGTERM.
+            killTimer = setTimeout(() => { killed = true; signal('SIGKILL'); }, grace);
+            killTimer.unref?.();
+        };
+        const stop = () => escalate();
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            opts.signal?.removeEventListener('abort', stop);
+            if (consumerError !== undefined) {
+                reject(consumerError);
+                return;
+            }
+            resolve({ code, stderr: Buffer.concat(stderr), timedOut, killed, stderrTruncated });
+        };
+        const timer = opts.timeoutMs
+            ? setTimeout(() => { timedOut = true; escalate(); }, opts.timeoutMs)
+            : null;
+        child.stdout.on('data', (chunk) => {
+            if (consumerError !== undefined)
+                return;
+            try {
+                opts.onStdout(chunk);
+            }
+            catch (error) {
+                // Captured, not thrown: a throw here would surface as an unhandled error
+                // on the stream and skip the caller's cleanup entirely.
+                consumerError = error;
+                escalate();
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            const room = maxStderr - stderrBytes;
+            if (room <= 0) {
+                stderrTruncated = true;
+                return;
+            }
+            if (chunk.length > room) {
+                stderrTruncated = true;
+                stderr.push(chunk.subarray(0, room));
+                stderrBytes = maxStderr;
+                return;
+            }
+            stderr.push(chunk);
+            stderrBytes += chunk.length;
+        });
+        child.once('error', () => finish(null));
+        child.once('close', finish);
+        if (opts.signal?.aborted)
+            escalate();
+        else
+            opts.signal?.addEventListener('abort', stop, { once: true });
+    });
+}
 export function sshExecRawStream(target, remoteCmd, opts) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();

package/dist/lib/startup/command-registry.d.ts

@@ -17,15 +17,17 @@ export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
  * name is gone, the spellchecker finds a neighbour, and the CLI runs something
  * the user never asked for instead of saying the command is gone.
  *
- * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
- * under `agents artifacts share` (RUSH-2580). login/logout/budget/bench/mine/
+ * `set` moved under `agents models`/`agents config` (RUSH-2579); `share`,
+ * `unshare`, and the whole `artifacts` group moved OUT to the standalone
+ * `artifacts` CLI (`@phnx-labs/artifacts-cli`, PHNX-3992) — artifact sharing is
+ * no longer an agents-cli surface at all. login/logout/budget/bench/mine/
  * cost/output/profiles/snapshot/cp/resume/roster moved under nested homes
  * (cli-surface-consolidate). `timeline` was removed as a duplicated surface —
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
- * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `audit` nested under
+ * `agents events audit`.
  * `trends` was removed with the insights recipe collapse — the one counter
  * surface is `agents insights mix` (PHNX-3391). `serve` (the
  * read-only local web companion + `--control` anchor) was removed with the

package/dist/lib/startup/command-registry.js

@@ -2,14 +2,14 @@ const LOADED_COMMAND_NAMES = [
     'accounts', 'auth', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
     'permissions', 'mcp', 'clis', 'subagents', 'plugins', 'workflows', 'add', 'use',
     'remove', 'rm', 'purge', 'update', 'prune', 'import', 'registry', 'search', 'install', 'packages',
-    'routines', 'monitors', 'projects', 'run', '_callback', 'open', 'reconnect', 'fork', 'config',
+    'routines', 'monitors', 'projects', 'run', '_callback', 'open', 'fork', 'config',
     'models', 'modes', 'trash', 'restore', 'doctor',
     'route', 'routes', 'harness', 'harnesses', 'secrets', 'menubar', 'sync',
     'refresh-rules', 'factory', 'insights', 'trace', 'reminders',
     'tmux', 'watchdog', 'browser', 'computer', 'logs', 'events',
     'ssh', 'devices', 'fleet', 'repos', 'repo', 'setup', 'uninstall', 'upgrade', 'sessions',
-    'teams', 'cloud', 'message', 'send', 'notify', 'feed',
-    'mailboxes', 'mailbox', 'artifacts', 'webhooks',
+    'teams', 'cloud', 'message', 'send', 'feed',
+    'mailboxes', 'mailbox', 'webhooks',
     'humans', 'daemon', 'traces',
 ];
 const INLINE_COMMAND_NAMES = [
@@ -37,15 +37,17 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
  * name is gone, the spellchecker finds a neighbour, and the CLI runs something
  * the user never asked for instead of saying the command is gone.
  *
- * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
- * under `agents artifacts share` (RUSH-2580). login/logout/budget/bench/mine/
+ * `set` moved under `agents models`/`agents config` (RUSH-2579); `share`,
+ * `unshare`, and the whole `artifacts` group moved OUT to the standalone
+ * `artifacts` CLI (`@phnx-labs/artifacts-cli`, PHNX-3992) — artifact sharing is
+ * no longer an agents-cli surface at all. login/logout/budget/bench/mine/
  * cost/output/profiles/snapshot/cp/resume/roster moved under nested homes
  * (cli-surface-consolidate). `timeline` was removed as a duplicated surface —
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
- * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `audit` nested under
+ * `agents events audit`.
  * `trends` was removed with the insights recipe collapse — the one counter
  * surface is `agents insights mix` (PHNX-3391). `serve` (the
  * read-only local web companion + `--control` anchor) was removed with the
@@ -81,6 +83,7 @@ export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'roster',
     'set',
     'share',
+    'artifacts',
     'timeline',
     'status',
     'tickets',

package/dist/lib/state.js

@@ -215,8 +215,8 @@ export function getOptionalUserAgentsDir() {
  * Origin `owner/repo` slug (lowercased, `.git` stripped) of a git checkout, or
  * null when `dir` isn't a git repo / has no origin. Extracts the slug from any
  * remote URL form: `git@host:owner/repo.git`, `https://host/owner/repo.git`,
- * `ssh://git@host/owner/repo`. Sync (mirrors readGitConfigUser in git.ts) so it
- * can be used from the synchronous getProjectAgentsDir walk.
+ * `ssh://git@host/owner/repo`. Sync (uses `execFileSync`, not the async git
+ * helpers) so it can be used from the synchronous getProjectAgentsDir walk.
  */
 function gitOriginSlug(dir) {
     let url;

package/dist/lib/storage/selection.d.ts

@@ -13,8 +13,8 @@
  * covers — those differ (share uses an email-handle namespace with public reads
  * and covers; a traces/sessions adapter uses the userId and differs again). Each
  * surface keeps its own DISCRIMINATED, typed adapter that reads this decision and
- * returns its own `kind`-tagged backend. See `lib/share/backend.ts` and
- * `lib/traces/backend.ts` for the two adapters.
+ * returns its own `kind`-tagged backend. See `lib/traces/backend.ts` for a
+ * concrete adapter.
  */
 import { type PhoenixSession } from '../identity/client.js';
 /** The two legitimate principals any managed-capable surface can resolve to. */

package/dist/lib/storage/selection.js

@@ -13,8 +13,8 @@
  * covers — those differ (share uses an email-handle namespace with public reads
  * and covers; a traces/sessions adapter uses the userId and differs again). Each
  * surface keeps its own DISCRIMINATED, typed adapter that reads this decision and
- * returns its own `kind`-tagged backend. See `lib/share/backend.ts` and
- * `lib/traces/backend.ts` for the two adapters.
+ * returns its own `kind`-tagged backend. See `lib/traces/backend.ts` for a
+ * concrete adapter.
  */
 import { readSession } from '../identity/client.js';
 /**

package/dist/lib/sync-umbrella.d.ts

@@ -15,6 +15,7 @@
  *               arrives with `agents secrets vault unlock`, #366/#367)
  *   reconcile-> refresh({ skipPrompts }) — re-materialize resources into homes
  */
+import type { ResourceSelection } from './installations/versions.js';
 /** The umbrella flags off `agents sync`. */
 export interface UmbrellaFlags {
     repos?: boolean;
@@ -87,6 +88,10 @@ interface RunUmbrellaArgs {
      * `agents sync --json` / fleet fan-out leave stdout as a single JSON object.
      */
     quiet?: boolean;
+    /** Optional resource-only reconcile across installed versions. */
+    selection?: ResourceSelection;
+    /** Explicit consent for selected plugins that add executable surfaces. */
+    allowExecSurfaces?: boolean;
 }
 /**
  * Execute the planned stages in order: repos -> secrets -> reconcile.

package/dist/lib/sync-umbrella.js

@@ -53,7 +53,7 @@ export function planUmbrellaStages(f) {
  * reconcile — `agents sync` should make as much current as it can in one pass.
  */
 export async function runUmbrellaSync(args) {
-    const { flags, log, yes, passphrase, quiet = false } = args;
+    const { flags, log, yes, passphrase, quiet = false, selection, allowExecSurfaces = false } = args;
     const plan = planUmbrellaStages(flags);
     const result = { plan, reconciled: false, declined: [], reconciledVersions: [] };
     if (plan.fetchRepos) {
@@ -131,7 +131,13 @@ export async function runUmbrellaSync(args) {
     }
     if (plan.reconcile) {
         const { refresh } = await import('./refresh.js');
-        const refreshed = await refresh({ skipPrompts: yes, quiet });
+        const refreshed = await refresh({
+            skipPrompts: yes,
+            quiet,
+            skipClis: selection !== undefined,
+            selection,
+            allowExecSurfaces,
+        });
         result.reconciled = true;
         result.declined = refreshed.declined;
         result.reconciledVersions = refreshed.reconciled;
@@ -140,14 +146,16 @@ export async function runUmbrellaSync(args) {
         // rather than silently adding them (refresh mode). Soft: a machine without
         // tailscale is a clean no-op, never a sync failure. First-run population is
         // `agents setup` / manual `agents devices sync` (bootstrap).
-        const { runDeviceSync } = await import('./devices/sync.js');
-        const { reconcilePendingSentinels } = await import('./devices/pending.js');
-        const dev = await runDeviceSync({ soft: true, mode: 'refresh' });
-        if (dev.ok)
-            await reconcilePendingSentinels(dev.pending);
-        result.devices = { synced: dev.synced, pending: dev.pending.length, skipped: !dev.ok };
-        if (dev.ok) {
-            log(`devices: ${dev.synced} refreshed${dev.pending.length ? `, ${dev.pending.length} new pending` : ''}`);
+        if (!selection) {
+            const { runDeviceSync } = await import('./devices/sync.js');
+            const { reconcilePendingSentinels } = await import('./devices/pending.js');
+            const dev = await runDeviceSync({ soft: true, mode: 'refresh' });
+            if (dev.ok)
+                await reconcilePendingSentinels(dev.pending);
+            result.devices = { synced: dev.synced, pending: dev.pending.length, skipped: !dev.ok };
+            if (dev.ok) {
+                log(`devices: ${dev.synced} refreshed${dev.pending.length ? `, ${dev.pending.length} new pending` : ''}`);
+            }
         }
     }
     return result;

package/dist/lib/traces/backend.d.ts

@@ -6,8 +6,7 @@
  * `traces.agents-cli.sh` Worker. Zero Cloudflare setup.
  *
  * BYO path (future): TRACES_BASE_URL + TRACES_WRITE_TOKEN env vars. Not
- * exposed in the CLI for M1 — follow-on milestone, same pattern as
- * `agents artifacts setup`.
+ * exposed in the CLI for M1 — follow-on milestone.
  */
 export declare const DEFAULT_TRACES_DOMAIN = "traces.agents-cli.sh";
 export interface TracesBackend {

package/dist/lib/traces/backend.js

@@ -6,8 +6,7 @@
  * `traces.agents-cli.sh` Worker. Zero Cloudflare setup.
  *
  * BYO path (future): TRACES_BASE_URL + TRACES_WRITE_TOKEN env vars. Not
- * exposed in the CLI for M1 — follow-on milestone, same pattern as
- * `agents artifacts setup`.
+ * exposed in the CLI for M1 — follow-on milestone.
  */
 import { readSession } from '../identity/client.js';
 import { selectStorageBackendKind } from '../storage/selection.js';

package/dist/lib/traces/provision.d.ts

@@ -1,4 +1,4 @@
-import { type CloudflareRequester } from '../share/provision.js';
+import { type CloudflareRequester } from '../cloudflare/provision.js';
 interface ProvisionOptions {
     request?: CloudflareRequester;
 }

package/dist/lib/traces/provision.js

@@ -1,8 +1,8 @@
 // Cloudflare orchestration for the private agents-traces store. The generic
-// request primitives live in share/provision; only the isolated traces resource
+// request primitives live in cloudflare/provision; only the isolated traces resource
 // choices and Worker template belong here.
 import { randomBytes } from 'node:crypto';
-import { addCustomDomain, createBucket, deployWorker, enableWorkersDev, findZoneId, putWorkerSecret, } from '../share/provision.js';
+import { addCustomDomain, createBucket, deployWorker, enableWorkersDev, findZoneId, putWorkerSecret, } from '../cloudflare/provision.js';
 import { DEFAULT_TRACES_DOMAIN } from './backend.js';
 import { renderTracesWorkerScript } from './worker-template.js';
 /** Bind the Phoenix identity base URL used to verify every trace read and write. */

package/dist/lib/types.d.ts

@@ -1142,9 +1142,12 @@ export interface Meta {
         discovery?: Record<string, 'approved' | 'ignored'>;
         ignored?: import('./fleet/types.js').IgnoredDeviceEntry[];
     };
-    /** Artifact share endpoint (Cloudflare R2 + Worker). Set by `agents artifacts
-     * setup`/`join`; syncs fleet-wide via `agents repo push/pull`. The write token
-     * lives in the `share` secrets bundle, not here. */
+    /** Legacy artifact-share endpoint (Cloudflare R2 + Worker), synced fleet-wide
+     * via `agents repo push/pull`. Artifact sharing moved to the standalone
+     * `artifacts` CLI (PHNX-3992), so agents-cli no longer writes this — but
+     * `shareRuntimeEnv` (`lib/share-runtime.ts`) still reads `baseUrl` to decide
+     * whether to inject the `share` bundle's write token into spawned agents. The
+     * write token lives in the `share` secrets bundle, not here. */
     share?: {
         baseUrl?: string;
         accountId?: string;
@@ -1153,9 +1156,8 @@ export interface Meta {
         domain?: string;
         /** Cloudflare Web Analytics token injected into published HTML pages. */
         analyticsToken?: string;
-        /** sha256 of the Worker script deployed at the last provision/update, so
-         * `agents artifacts share status` can tell current vs outdated vs unknown (a config
-         * from before this field existed has no hash — always "unknown"). */
+        /** sha256 of the Worker script deployed at the last provision/update
+         * (legacy; a config from before this field existed has no hash). */
         templateHash?: string;
     };
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.114",
+  "version": "1.22.115",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -16,8 +16,7 @@
   },
   "bin": {
     "agents": "dist/index.js",
-    "ag": "dist/index.js",
-    "browser": "dist/browser.js"
+    "ag": "dist/index.js"
   },
   "files": [
     "dist/**/*.js",

package/dist/commands/artifacts-setup.d.ts

@@ -1,53 +0,0 @@
-/**
- * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
- * R2 + Worker) that backs `agents artifacts share`.
- *
- * One door, two modes, because it replaces two commands that used to be
- * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
- * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
- * with no provisioning flags TYPED it runs the wizard (provision or join, and
- * offers a Worker update when an endpoint already exists); with any provisioning
- * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
- * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
- * single source of truth for provisioning.
- *
- * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
- *
- * Idempotent: re-running shows the current endpoint and offers to reconfigure.
- */
-import type { Command } from 'commander';
-/**
- * Interactive share setup. Returns true if the user configured (or already had)
- * an endpoint, false if they skipped. Never throws on user cancel — callers
- * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
- */
-export declare function runShareWizard(): Promise<boolean>;
-/** Parsed `agents artifacts setup` options — the retired `agents share setup` flag set. */
-interface ArtifactsSetupOpts {
-    bundle: string;
-    worker: string;
-    bucket: string;
-    account?: string;
-    token?: string;
-    domain?: string;
-    analyticsToken?: string;
-}
-/** The provisioning flags, by their commander option-value keys. */
-declare const PROVISION_FLAGS: readonly ["bundle", "worker", "bucket", "account", "token", "domain", "analyticsToken"];
-/**
- * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
- * is driving the old `agents share setup` provisioning path rather than asking
- * for the wizard.
- *
- * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
- * PRESENCE proves nothing — the question is whether the user typed them, which
- * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
- * Reading presence alone would classify `agents artifacts setup --bundle
- * cloudflare-work` as a wizard run and then silently provision against the
- * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
- * have no default, so presence is proof for them.
- */
-export declare function isDirectProvisionRequest(opts: ArtifactsSetupOpts, wasTyped?: (flag: (typeof PROVISION_FLAGS)[number]) => boolean): boolean;
-/** Register `agents artifacts setup` under the parent `artifacts` command. */
-export declare function registerArtifactsSetupCommand(artifactsCmd: Command): void;
-export {};

package/dist/commands/artifacts-setup.js

@@ -1,161 +0,0 @@
-/**
- * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
- * R2 + Worker) that backs `agents artifacts share`.
- *
- * One door, two modes, because it replaces two commands that used to be
- * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
- * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
- * with no provisioning flags TYPED it runs the wizard (provision or join, and
- * offers a Worker update when an endpoint already exists); with any provisioning
- * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
- * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
- * single source of truth for provisioning.
- *
- * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
- *
- * Idempotent: re-running shows the current endpoint and offers to reconfigure.
- */
-import chalk from 'chalk';
-import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, readShareConfig, } from '../lib/share/config.js';
-import { runShareProvision, runShareJoin, runShareUpdate, shareTemplateStatus } from './share.js';
-import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-/**
- * Interactive share setup. Returns true if the user configured (or already had)
- * an endpoint, false if they skipped. Never throws on user cancel — callers
- * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
- */
-export async function runShareWizard() {
-    if (!isInteractiveTerminal()) {
-        console.error(chalk.red('The artifact share wizard needs an interactive terminal. ' +
-            'Non-interactively, use `agents artifacts setup --account <id> --token <t>` (provision) ' +
-            'or `agents artifacts share join <baseUrl> --token <t>`.'));
-        return false;
-    }
-    const existing = readShareConfig();
-    if (existing) {
-        console.log(chalk.dim(`Share is already configured → ${chalk.green(existing.baseUrl)}`));
-        console.log(chalk.dim(`  worker ${existing.workerName} · bucket ${existing.bucketName} · account ${existing.accountId}`));
-        const templateStatus = shareTemplateStatus(existing);
-        console.log(chalk.dim(`  template ${templateStatus}`));
-        const { select } = await import('@inquirer/prompts');
-        const action = await select({
-            message: 'Share is already configured. What do you want to do?',
-            choices: [
-                { name: 'Keep as is', value: 'keep' },
-                {
-                    name: 'Update the deployed Worker to the latest template',
-                    value: 'update',
-                    description: templateStatus === 'current'
-                        ? 'Already current — this re-deploys anyway and refreshes the token in place.'
-                        : 'Re-deploys the Worker script on your existing endpoint (same account/worker/bucket, same write token).',
-                },
-                {
-                    name: 'Reconfigure from scratch (provision or join again)',
-                    value: 'reconfigure',
-                },
-            ],
-            default: templateStatus === 'outdated' || templateStatus === 'unknown' ? 'update' : 'keep',
-        });
-        if (action === 'keep') {
-            console.log(chalk.dim('Keeping the current endpoint.'));
-            return true;
-        }
-        if (action === 'update') {
-            // When the template is already current, the description below promises a
-            // re-deploy anyway — force it, or runShareUpdate's own no-op would silently
-            // contradict what was just said.
-            const result = await runShareUpdate({ force: templateStatus === 'current' });
-            console.log(result.updated
-                ? chalk.green(`Worker '${result.workerName}' updated → template ${result.templateHash.slice(0, 12)}…`)
-                : chalk.dim(`Worker '${result.workerName}' already matches the current template — no-op.`));
-            return true;
-        }
-        // action === 'reconfigure' — fall through to the provision/join flow below.
-    }
-    const { select } = await import('@inquirer/prompts');
-    const mode = await select({
-        message: 'How do you want to publish shared links?',
-        choices: [
-            {
-                name: 'Provision my own (Cloudflare R2 + Worker)',
-                value: 'provision',
-                description: 'One-time: creates a bucket + Worker on your Cloudflare account (~$0). Needs a Cloudflare API token.',
-            },
-            {
-                name: 'Join an existing endpoint (a teammate already provisioned one)',
-                value: 'join',
-                description: 'Use synced config when present, or paste the base URL + write token from the endpoint owner.',
-            },
-        ],
-    });
-    if (mode === 'provision') {
-        await runShareProvision({
-            bundle: DEFAULT_CF_BUNDLE,
-            worker: DEFAULT_WORKER_NAME,
-            bucket: DEFAULT_BUCKET_NAME,
-        });
-        return true;
-    }
-    const { input } = await import('@inquirer/prompts');
-    const baseUrl = await input({
-        message: 'Endpoint base URL (e.g. https://share.getrush.ai)',
-        validate: (v) => (v.trim().startsWith('http') ? true : 'Enter the full https:// URL of the endpoint.'),
-    });
-    await runShareJoin(baseUrl.trim());
-    return true;
-}
-/** The provisioning flags, by their commander option-value keys. */
-const PROVISION_FLAGS = ['bundle', 'worker', 'bucket', 'account', 'token', 'domain', 'analyticsToken'];
-/**
- * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
- * is driving the old `agents share setup` provisioning path rather than asking
- * for the wizard.
- *
- * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
- * PRESENCE proves nothing — the question is whether the user typed them, which
- * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
- * Reading presence alone would classify `agents artifacts setup --bundle
- * cloudflare-work` as a wizard run and then silently provision against the
- * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
- * have no default, so presence is proof for them.
- */
-export function isDirectProvisionRequest(opts, wasTyped = () => false) {
-    if (opts.account || opts.token || opts.domain || opts.analyticsToken)
-        return true;
-    return PROVISION_FLAGS.some((flag) => wasTyped(flag));
-}
-/** Register `agents artifacts setup` under the parent `artifacts` command. */
-export function registerArtifactsSetupCommand(artifactsCmd) {
-    artifactsCmd
-        .command('setup')
-        .description('Provision (or join) the Cloudflare R2 + Worker endpoint that backs `agents artifacts share`.')
-        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
-        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
-        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
-        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
-        .option('--token <t>', 'Cloudflare API token (else read from the --bundle)')
-        .option('--domain <host>', `custom domain to map (default: ${DEFAULT_SHARE_DOMAIN}; workers.dev if zone is not visible)`)
-        .option('--analytics-token <token>', 'Cloudflare Web Analytics token to inject into published HTML pages')
-        .action(async (opts, cmd) => {
-        try {
-            // Named endpoint details, or no terminal to prompt on, means provision
-            // directly — the wizard has nothing to ask that was not already given,
-            // and it would provision against its own hardcoded defaults, dropping
-            // whatever the caller named.
-            const wasTyped = (flag) => cmd.getOptionValueSource(flag) === 'cli';
-            if (isDirectProvisionRequest(opts, wasTyped) || !isInteractiveTerminal()) {
-                await runShareProvision(opts);
-                return;
-            }
-            await runShareWizard();
-        }
-        catch (err) {
-            if (isPromptCancelled(err)) {
-                console.log(chalk.yellow('\nCancelled'));
-                return;
-            }
-            console.error(chalk.red(err.message));
-            process.exitCode = 1;
-        }
-    });
-}

package/dist/commands/artifacts.d.ts

@@ -1,18 +0,0 @@
-/**
- * `agents artifacts` — the group that owns everything an agent publishes for a
- * human to open: HTML plans, reports, rendered visuals, screenshots.
- *
- * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
- * noun, `share` is the action on it, so the surface reads noun-then-action like
- * the rest of the CLI:
- *
- *   agents artifacts share <file>          publish
- *   agents artifacts share list|delete|analytics|join|status|update
- *   agents artifacts setup                 provision (or join) the endpoint
- *
- * The subtree itself lives in commands/share.ts (publish + its subcommands) and
- * commands/artifacts-setup.ts (the provisioning door); this module only assembles
- * the group, so there is one place that says what `agents artifacts` contains.
- */
-import type { Command } from 'commander';
-export declare function registerArtifactsCommands(program: Command): void;