@phnx-labs/agents-cli 1.22.114 → 1.22.115

package/dist/lib/share/analytics.d.ts

@@ -1,13 +0,0 @@
-/** Cloudflare Web Analytics snippet for a given zone token. */
-export declare function renderBeacon(token: string): string;
-/**
- * Inject the CF Web Analytics beacon into an HTML page. Idempotent: any existing
- * agents-share analytics block is removed first. The snippet is appended before
- * `</body>` when present, otherwise before `</head>`, otherwise prepended to the
- * document so it still loads.
- */
-export declare function injectAnalyticsBeacon(html: string, token: string): string;
-/** True if the share config has a non-empty analytics token. */
-export declare function analyticsEnabled(cfg: {
-    analyticsToken?: string;
-} | undefined | null): boolean;

package/dist/lib/share/analytics.js

@@ -1,45 +0,0 @@
-// Cloudflare Web Analytics injection for `agents artifacts share`.
-//
-// The beacon is cookieless and privacy-first, which matters because a lot of shared
-// content (games, kid-facing pages) should avoid GA4-style tracking. The token is
-// stored in the synced share config and injected into every published HTML page at
-// publish time, so analytics work with zero user effort once setup is complete.
-const BEACON_OPEN = '<!-- agents-share:analytics -->';
-const BEACON_CLOSE = '<!-- /agents-share:analytics -->';
-/** Cloudflare Web Analytics snippet for a given zone token. */
-export function renderBeacon(token) {
-    const payload = JSON.stringify({ token });
-    return (`${BEACON_OPEN}\n` +
-        '<script defer ' +
-        'src="https://static.cloudflareinsights.com/beacon.min.js" ' +
-        `data-cf-beacon='${payload}'></script>\n` +
-        `${BEACON_CLOSE}\n`);
-}
-/** Strip a previously-injected analytics block so re-publishing doesn't duplicate it. */
-function stripPrevious(html) {
-    const re = new RegExp(`${BEACON_OPEN}[\\s\\S]*?${BEACON_CLOSE}\\n?`, 'g');
-    return html.replace(re, '');
-}
-/**
- * Inject the CF Web Analytics beacon into an HTML page. Idempotent: any existing
- * agents-share analytics block is removed first. The snippet is appended before
- * `</body>` when present, otherwise before `</head>`, otherwise prepended to the
- * document so it still loads.
- */
-export function injectAnalyticsBeacon(html, token) {
-    if (!token)
-        return html;
-    const cleaned = stripPrevious(html);
-    const block = renderBeacon(token);
-    const bodyClose = cleaned.search(/<\/body>/i);
-    if (bodyClose !== -1)
-        return cleaned.slice(0, bodyClose) + block + cleaned.slice(bodyClose);
-    const headClose = cleaned.search(/<\/head>/i);
-    if (headClose !== -1)
-        return cleaned.slice(0, headClose) + block + cleaned.slice(headClose);
-    return block + cleaned;
-}
-/** True if the share config has a non-empty analytics token. */
-export function analyticsEnabled(cfg) {
-    return Boolean(cfg?.analyticsToken && cfg.analyticsToken.trim().length > 0);
-}

package/dist/lib/share/backend.d.ts

@@ -1,120 +0,0 @@
-/**
- * ShareBackend — the token-source seam for `agents artifacts share`.
- *
- * Two legitimate principals, picked once at publish time:
- *   - **managed**: the caller is signed in to Phoenix (`readSession()`), no
- *     explicit BYO override. Token is the Phoenix access_token; endpoint is
- *     the already-live `share.getrush.ai`. Zero Cloudflare setup.
- *   - **byo**: the existing static WRITE_TOKEN path (`readShareConfig()` +
- *     `readWriteToken()`). Unchanged for power users / custom domains / fleet
- *     injection of `SHARE_WRITE_TOKEN`.
- *
- * Dispatch is not a fallback: signed-in AND no BYO override → managed;
- * otherwise BYO. Fail loud when neither principal can authenticate.
- *
- * Explicit BYO override (any one is enough):
- *   - `opts.byo === true`
- *   - `opts.writeToken` (a caller-supplied static token, including tests)
- *   - `AGENTS_SHARE_BACKEND=byo`
- */
-import { type PhoenixSession } from '../identity/client.js';
-import { type ShareConfig } from './config.js';
-export type ShareBackendKind = 'managed' | 'byo';
-export interface ShareBackend {
-    kind: ShareBackendKind;
-    /** Public base URL of the share Worker, no trailing slash. */
-    baseUrl: string;
-    /** Bearer sent as `Authorization`. Phoenix access_token or WRITE_TOKEN. */
-    token: string;
-    /** URL namespace prefix (`<namespace>/<slug>`). Phoenix handle (email local-part) or GitHub username. */
-    namespace: string;
-}
-export interface ResolveShareBackendOpts {
-    /** Force the BYO Cloudflare path even when signed in. */
-    byo?: boolean;
-    /** Override the namespace (BYO: GitHub username; ignored on managed — the
-     * worker 403s a Phoenix PUT whose first segment is not the verified handle). */
-    githubUser?: string;
-    /** DI seam — a static write token selects BYO. */
-    writeToken?: string;
-    /** DI seam — persisted BYO endpoint config. */
-    config?: ShareConfig;
-    /** DI seam — override `readSession()`. `null` means signed out. */
-    session?: PhoenixSession | null;
-    /**
-     * When false, BYO may resolve without a WRITE_TOKEN. Public GET routes
-     * (list / revisions / status) don't need one; publish and delete do.
-     * Default true.
-     */
-    requireToken?: boolean;
-}
-/** Env var that forces the BYO path. Value must be exactly `byo`. */
-export declare const SHARE_BACKEND_ENV = "AGENTS_SHARE_BACKEND";
-/** URL-safe namespace: lowercase `[a-z0-9-]+`. Matches the Worker's sanitize.
- *
- * This is URL-safety, not collision-resistance: two values that differ only
- * in case or punctuation share a prefix. */
-export declare function sanitizeShareNamespace(s: string): string;
-/**
- * Public managed-share handle from a verified email.
- *
- * `muqsitnawaz@gmail.com` → `muqsitnawaz`. Plus-tags are dropped
- * (`muqsitnawaz+dev@gmail.com` → `muqsitnawaz`) so the URL stays the
- * account's default name. Empty / missing email → `''` (caller falls
- * back to userId). Must match the Worker `handleFromEmail`.
- */
-export declare function handleFromEmail(email: string | undefined): string;
-/** Managed URL namespace: email handle, else sanitized userId (never empty if either is set). */
-export declare function managedShareHandle(session: Pick<PhoenixSession, 'email' | 'userId'>): string;
-export declare function managedShareBaseUrl(): string;
-/**
- * True when this config is the platform managed endpoint (`share.getrush.ai`, or a
- * legacy alias — `share.agents-cli.sh` / `artifacts.prix.dev` — still bound to the
- * same Worker). The
- * deploy path uses this — not "the caller is signed in" — to decide whether to
- * bind `PHOENIX_ID_BASE` on the Worker.
- */
-export declare function isManagedShareEndpoint(cfg: {
-    baseUrl?: string;
-    domain?: string;
-}): boolean;
-/**
- * Phoenix ID URL to bind on a managed Worker deploy. `undefined` for a
- * pure-BYO Worker (WRITE_TOKEN only). Fail loud if this is a managed deploy
- * but the base is empty — never skip-set a blank secret.
- */
-export declare function phoenixIdBaseForDeploy(opts?: {
-    managed?: boolean;
-}, cfg?: {
-    baseUrl?: string;
-    domain?: string;
-}): string | undefined;
-/**
- * Managed collaboration backend config to bind on a managed Worker deploy
- * (PHNX-3835): `PRIX_ARTIFACT_COLLAB_BASE` (the Prix artifact-collaboration API
- * base) and `ARTIFACT_COLLAB_SERVICE_TOKEN` (the service credential the Worker
- * sends as `Authorization: Bearer`, NEVER surfaced to the browser). Both are read
- * from the deploy environment.
- *
- * Deliberately dormant-by-default: the two secrets are applied ONLY when BOTH are
- * present. Until the Prix API counterpart is live an operator leaves them unset,
- * and the Worker fails `/__collab` closed (404) with the artifact page GET
- * unaffected. A pure-BYO endpoint never gets them (it has no Phoenix identity).
- * Unlike `phoenixIdBaseForDeploy` this never throws on absence — collaboration is
- * additive, not required for a working managed deploy.
- */
-export declare function collabConfigForDeploy(opts?: {
-    managed?: boolean;
-}, cfg?: {
-    baseUrl?: string;
-    domain?: string;
-}): {
-    collabBase?: string;
-    collabServiceToken?: string;
-};
-/**
- * Pick the principal via the shared selection policy. Signed-in AND no explicit
- * BYO override → managed; otherwise BYO.
- */
-export declare function shouldUseManaged(opts?: ResolveShareBackendOpts): boolean;
-export declare function resolveShareBackend(opts?: ResolveShareBackendOpts): ShareBackend;

package/dist/lib/share/backend.js

@@ -1,176 +0,0 @@
-/**
- * ShareBackend — the token-source seam for `agents artifacts share`.
- *
- * Two legitimate principals, picked once at publish time:
- *   - **managed**: the caller is signed in to Phoenix (`readSession()`), no
- *     explicit BYO override. Token is the Phoenix access_token; endpoint is
- *     the already-live `share.getrush.ai`. Zero Cloudflare setup.
- *   - **byo**: the existing static WRITE_TOKEN path (`readShareConfig()` +
- *     `readWriteToken()`). Unchanged for power users / custom domains / fleet
- *     injection of `SHARE_WRITE_TOKEN`.
- *
- * Dispatch is not a fallback: signed-in AND no BYO override → managed;
- * otherwise BYO. Fail loud when neither principal can authenticate.
- *
- * Explicit BYO override (any one is enough):
- *   - `opts.byo === true`
- *   - `opts.writeToken` (a caller-supplied static token, including tests)
- *   - `AGENTS_SHARE_BACKEND=byo`
- */
-import { PHOENIX_ID_BASE, readSession } from '../identity/client.js';
-import { selectStorageBackendKind } from '../storage/selection.js';
-import { DEFAULT_SHARE_DOMAIN, LEGACY_MANAGED_SHARE_DOMAINS, readShareConfig, readWriteToken, readWriteTokenEnv, } from './config.js';
-/** Env var that forces the BYO path. Value must be exactly `byo`. */
-export const SHARE_BACKEND_ENV = 'AGENTS_SHARE_BACKEND';
-/** URL-safe namespace: lowercase `[a-z0-9-]+`. Matches the Worker's sanitize.
- *
- * This is URL-safety, not collision-resistance: two values that differ only
- * in case or punctuation share a prefix. */
-export function sanitizeShareNamespace(s) {
-    return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-}
-/**
- * Public managed-share handle from a verified email.
- *
- * `muqsitnawaz@gmail.com` → `muqsitnawaz`. Plus-tags are dropped
- * (`muqsitnawaz+dev@gmail.com` → `muqsitnawaz`) so the URL stays the
- * account's default name. Empty / missing email → `''` (caller falls
- * back to userId). Must match the Worker `handleFromEmail`.
- */
-export function handleFromEmail(email) {
-    if (!email)
-        return '';
-    const local = email.split('@')[0] ?? '';
-    const beforePlus = local.split('+')[0] ?? local;
-    return sanitizeShareNamespace(beforePlus);
-}
-/** Managed URL namespace: email handle, else sanitized userId (never empty if either is set). */
-export function managedShareHandle(session) {
-    return handleFromEmail(session.email) || sanitizeShareNamespace(session.userId ?? '');
-}
-export function managedShareBaseUrl() {
-    return `https://${DEFAULT_SHARE_DOMAIN}`;
-}
-function shareEndpointHost(value) {
-    return value.replace(/^https?:\/\//i, '').replace(/\/+$/, '').toLowerCase();
-}
-/**
- * True when this config is the platform managed endpoint (`share.getrush.ai`, or a
- * legacy alias — `share.agents-cli.sh` / `artifacts.prix.dev` — still bound to the
- * same Worker). The
- * deploy path uses this — not "the caller is signed in" — to decide whether to
- * bind `PHOENIX_ID_BASE` on the Worker.
- */
-export function isManagedShareEndpoint(cfg) {
-    const managedHosts = new Set([DEFAULT_SHARE_DOMAIN, ...LEGACY_MANAGED_SHARE_DOMAINS].map((h) => h.toLowerCase()));
-    if (cfg.domain && managedHosts.has(shareEndpointHost(cfg.domain)))
-        return true;
-    if (cfg.baseUrl && managedHosts.has(shareEndpointHost(cfg.baseUrl)))
-        return true;
-    return false;
-}
-/**
- * Phoenix ID URL to bind on a managed Worker deploy. `undefined` for a
- * pure-BYO Worker (WRITE_TOKEN only). Fail loud if this is a managed deploy
- * but the base is empty — never skip-set a blank secret.
- */
-export function phoenixIdBaseForDeploy(opts = {}, cfg) {
-    const managed = opts.managed === true || (cfg != null && isManagedShareEndpoint(cfg));
-    if (!managed)
-        return undefined;
-    const base = PHOENIX_ID_BASE.replace(/\/+$/, '').trim();
-    if (!base) {
-        throw new Error('Managed share deploy requires PHOENIX_ID_BASE so the Worker can verify Phoenix bearers. Set the PHOENIX_ID_BASE env var.');
-    }
-    return base;
-}
-/**
- * Managed collaboration backend config to bind on a managed Worker deploy
- * (PHNX-3835): `PRIX_ARTIFACT_COLLAB_BASE` (the Prix artifact-collaboration API
- * base) and `ARTIFACT_COLLAB_SERVICE_TOKEN` (the service credential the Worker
- * sends as `Authorization: Bearer`, NEVER surfaced to the browser). Both are read
- * from the deploy environment.
- *
- * Deliberately dormant-by-default: the two secrets are applied ONLY when BOTH are
- * present. Until the Prix API counterpart is live an operator leaves them unset,
- * and the Worker fails `/__collab` closed (404) with the artifact page GET
- * unaffected. A pure-BYO endpoint never gets them (it has no Phoenix identity).
- * Unlike `phoenixIdBaseForDeploy` this never throws on absence — collaboration is
- * additive, not required for a working managed deploy.
- */
-export function collabConfigForDeploy(opts = {}, cfg) {
-    const managed = opts.managed === true || (cfg != null && isManagedShareEndpoint(cfg));
-    if (!managed)
-        return {};
-    const base = (process.env.PRIX_ARTIFACT_COLLAB_BASE || '').replace(/\/+$/, '').trim();
-    const token = (process.env.ARTIFACT_COLLAB_SERVICE_TOKEN || '').trim();
-    if (!base || !token)
-        return {};
-    return { collabBase: base, collabServiceToken: token };
-}
-/**
- * The share surface's BYO-override signals: an explicit `--byo`, a
- * caller-supplied static write token, or `AGENTS_SHARE_BACKEND=byo`. Detecting
- * WHICH signals count is surface-specific; the managed-vs-BYO decision itself is
- * the shared policy (`selectStorageBackendKind`). A persisted BYO endpoint config
- * is deliberately NOT an override here — a signed-in user with a stale BYO config
- * still publishes to managed unless they opt out explicitly (the product's
- * managed-first contract).
- */
-function shareByoOverride(opts) {
-    if (opts.byo === true)
-        return true;
-    if (opts.writeToken)
-        return true;
-    return (process.env[SHARE_BACKEND_ENV] ?? '').trim().toLowerCase() === 'byo';
-}
-/**
- * Pick the principal via the shared selection policy. Signed-in AND no explicit
- * BYO override → managed; otherwise BYO.
- */
-export function shouldUseManaged(opts = {}) {
-    return (selectStorageBackendKind({ byoOverride: shareByoOverride(opts), session: opts.session }) ===
-        'managed');
-}
-export function resolveShareBackend(opts = {}) {
-    if (shouldUseManaged(opts)) {
-        const session = opts.session === undefined ? readSession() : opts.session;
-        if (!session) {
-            throw new Error("Not signed in. Run 'agents auth login'.");
-        }
-        return resolveManagedBackend(session);
-    }
-    return resolveByoBackend(opts);
-}
-function resolveManagedBackend(session) {
-    if (!session.access_token) {
-        throw new Error("Not signed in. Run 'agents auth login'.");
-    }
-    const namespace = managedShareHandle(session);
-    if (!namespace) {
-        throw new Error("Signed in but the session has no email or user id. Run 'agents auth login' again.");
-    }
-    return {
-        kind: 'managed',
-        baseUrl: managedShareBaseUrl(),
-        token: session.access_token,
-        namespace,
-    };
-}
-function resolveByoBackend(opts) {
-    const cfg = opts.config ?? readShareConfig();
-    if (!cfg) {
-        throw new Error("Not set up yet. Run 'agents auth login' to publish on the managed endpoint (zero Cloudflare setup), or 'agents artifacts setup' / 'agents artifacts share join' for your own Cloudflare.");
-    }
-    const token = opts.writeToken ??
-        (opts.requireToken === false ? (readWriteTokenEnv() ?? '') : readWriteToken());
-    // Namespace is the GitHub username. An explicit --github-user is sanitized
-    // here; otherwise publish fills it via resolveShareUsername (gh/git config).
-    const namespace = opts.githubUser ? sanitizeShareNamespace(opts.githubUser) : '';
-    return {
-        kind: 'byo',
-        baseUrl: cfg.baseUrl.replace(/\/+$/, ''),
-        token,
-        namespace,
-    };
-}

package/dist/lib/share/capture.d.ts

@@ -1,31 +0,0 @@
-/**
- * Render an HTML file to a 1200×630 PNG — the Open Graph cover for a shared plan.
- *
- * When `agents artifacts share plan.html` runs, we screenshot the plan's own hero and use it
- * as the `og:image`, so the link unfurls into a card in Slack / iMessage / Twitter /
- * Discord. No AI, no central render service: it's a headless screenshot on the
- * publisher's machine, so it works identically for us and for any user, and costs
- * nothing.
- *
- * Browser resolution reuses the repo's own detector (`findFirstInstalledBrowser`,
- * the same auto-pick behind `agents browser`), then falls back to a managed
- * Chromium in the Playwright/Puppeteer caches (present on machines that have done
- * browser automation), then `PUPPETEER_EXECUTABLE_PATH`. If nothing headless-capable
- * is found, `captureCover` returns null and publishing proceeds without a cover —
- * the link still works, it just won't have a preview image.
- */
-/** OG standard card size; captured at OG_SCALE× for retina crispness. */
-export declare const OG_WIDTH = 1200;
-export declare const OG_HEIGHT = 630;
-/** Device scale factor for the capture — the served PNG is OG_WIDTH*OG_SCALE × OG_HEIGHT*OG_SCALE. */
-export declare const OG_SCALE = 2;
-/** Ordered list of candidate Chromium-family binaries to try for headless capture. */
-export declare function candidateBrowsers(): string[];
-/** Newest-first Chromium binaries under the Playwright / Puppeteer download caches. */
-export declare function scanCaches(home?: string, platform?: NodeJS.Platform): string[];
-/**
- * Screenshot `htmlPath`'s top 1200×630 (its hero) to a PNG buffer, or null if no
- * headless-capable browser is available or every candidate fails. Never throws —
- * a cover is a nice-to-have, never a reason to fail a publish.
- */
-export declare function captureCover(htmlPath: string, timeoutMs?: number): Promise<Buffer | null>;

package/dist/lib/share/capture.js

@@ -1,174 +0,0 @@
-/**
- * Render an HTML file to a 1200×630 PNG — the Open Graph cover for a shared plan.
- *
- * When `agents artifacts share plan.html` runs, we screenshot the plan's own hero and use it
- * as the `og:image`, so the link unfurls into a card in Slack / iMessage / Twitter /
- * Discord. No AI, no central render service: it's a headless screenshot on the
- * publisher's machine, so it works identically for us and for any user, and costs
- * nothing.
- *
- * Browser resolution reuses the repo's own detector (`findFirstInstalledBrowser`,
- * the same auto-pick behind `agents browser`), then falls back to a managed
- * Chromium in the Playwright/Puppeteer caches (present on machines that have done
- * browser automation), then `PUPPETEER_EXECUTABLE_PATH`. If nothing headless-capable
- * is found, `captureCover` returns null and publishing proceeds without a cover —
- * the link still works, it just won't have a preview image.
- */
-import { execFile } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { findFirstInstalledBrowser } from '../browser/chrome.js';
-/** OG standard card size; captured at OG_SCALE× for retina crispness. */
-export const OG_WIDTH = 1200;
-export const OG_HEIGHT = 630;
-/** Device scale factor for the capture — the served PNG is OG_WIDTH*OG_SCALE × OG_HEIGHT*OG_SCALE. */
-export const OG_SCALE = 2;
-// Installed browsers that are poor `--headless` hosts (they hang instead of
-// capturing). We still let a managed Chromium or an explicit override handle those
-// machines; we just don't burn a timeout probing these. (Only members of the
-// browser detector's `BrowserType` are meaningful here; Comet is the real case.)
-const BAD_HEADLESS_TYPES = new Set(['comet']);
-/** Ordered list of candidate Chromium-family binaries to try for headless capture. */
-export function candidateBrowsers() {
-    const out = [];
-    const push = (p) => {
-        if (p && fs.existsSync(p) && !out.includes(p))
-            out.push(p);
-    };
-    // 1) Explicit overrides are contracts, not hints. A typo must fail at the
-    // boundary instead of silently falling through to an unrelated browser.
-    for (const name of ['PUPPETEER_EXECUTABLE_PATH', 'AGENTS_SHARE_BROWSER']) {
-        const value = process.env[name]?.trim();
-        if (!value)
-            continue;
-        if (!fs.existsSync(value)) {
-            throw new Error(`${name} points to a browser that does not exist: ${value}`);
-        }
-        push(value);
-    }
-    // 2) Managed Chromium in the Playwright / Puppeteer caches — purpose-built for
-    //    headless, so it's the most reliable capture host when present.
-    for (const bin of scanCaches())
-        push(bin);
-    // 3) The repo's own auto-pick (Chrome → Brave → Edge → Chromium by platform),
-    //    skipping browsers known to be poor headless hosts so we don't eat a timeout.
-    try {
-        const pick = findFirstInstalledBrowser();
-        if (pick && !BAD_HEADLESS_TYPES.has(pick.browserType))
-            push(pick.binary);
-    }
-    catch {
-        // detector is best-effort
-    }
-    return out;
-}
-/** Newest-first Chromium binaries under the Playwright / Puppeteer download caches. */
-export function scanCaches(home = os.homedir(), platform = os.platform()) {
-    const roots = platform === 'darwin'
-        ? [
-            path.join(home, 'Library/Caches/ms-playwright'),
-            path.join(home, '.cache/ms-playwright'),
-            path.join(home, '.cache/puppeteer/chrome'),
-        ]
-        : [path.join(home, '.cache/ms-playwright'), path.join(home, '.cache/puppeteer/chrome')];
-    const rel = platform === 'darwin'
-        ? [
-            'chrome-mac/Chromium.app/Contents/MacOS/Chromium',
-            'chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
-            'chrome-mac-x64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
-            // Playwright's newer headless-shell packages (chromium_headless_shell-*) —
-            // a raw binary, not an .app bundle.
-            'chrome-headless-shell-mac-arm64/chrome-headless-shell',
-            'chrome-headless-shell-mac-x64/chrome-headless-shell',
-        ]
-        : [
-            'chrome-linux/chrome',
-            'chrome-linux64/chrome',
-            'chrome-headless-shell-linux64/chrome-headless-shell',
-        ];
-    const found = [];
-    for (const root of roots) {
-        let entries;
-        try {
-            entries = fs.readdirSync(root).sort().reverse(); // newest version dir first
-        }
-        catch {
-            continue;
-        }
-        for (const e of entries) {
-            for (const r of rel) {
-                const p = path.join(root, e, r);
-                if (fs.existsSync(p))
-                    found.push(p);
-            }
-        }
-    }
-    return found;
-}
-/**
- * Screenshot `htmlPath`'s top 1200×630 (its hero) to a PNG buffer, or null if no
- * headless-capable browser is available or every candidate fails. Never throws —
- * a cover is a nice-to-have, never a reason to fail a publish.
- */
-export async function captureCover(htmlPath, timeoutMs = 15_000) {
-    const abs = path.resolve(htmlPath);
-    if (!fs.existsSync(abs))
-        return null;
-    const fileUrl = `file://${abs.split('/').map(encodeURIComponent).join('/')}`;
-    const candidates = candidateBrowsers();
-    if (candidates.length === 0) {
-        // A silently-dropped cover reads as "the CLI decided this page needs none",
-        // when in fact no headless browser was found. Say so and point at the escape
-        // hatch instead of leaving the publish coverless with no explanation.
-        process.stderr.write('[agents artifacts share] no headless browser found for the OG cover — install Chrome/Chromium ' +
-            'or set AGENTS_SHARE_BROWSER=/path/to/chrome. Publishing without a preview image.\n');
-        return null;
-    }
-    let lastFailure = '';
-    for (const bin of candidates) {
-        const outPng = path.join(os.tmpdir(), `agents-share-cover-${process.pid}-${Date.now()}.png`);
-        const userDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-share-chrome-'));
-        try {
-            await new Promise((resolve, reject) => {
-                execFile(bin, [
-                    '--headless=new',
-                    '--disable-gpu',
-                    '--hide-scrollbars',
-                    '--no-first-run',
-                    '--no-default-browser-check',
-                    `--force-device-scale-factor=${OG_SCALE}`,
-                    // Bound page JS (count-up animations etc.) so the shot fires promptly
-                    // instead of waiting on long-running timers.
-                    '--virtual-time-budget=8000',
-                    `--window-size=${OG_WIDTH},${OG_HEIGHT}`,
-                    `--user-data-dir=${userDir}`,
-                    `--screenshot=${outPng}`,
-                    fileUrl,
-                ], { timeout: timeoutMs }, (err) => (err ? reject(err) : resolve()));
-            });
-            if (fs.existsSync(outPng)) {
-                const buf = fs.readFileSync(outPng);
-                // A valid PNG starts with the 8-byte signature; guard against 0-byte writes.
-                if (buf.length > 8 && buf[0] === 0x89 && buf[1] === 0x50)
-                    return buf;
-                lastFailure = `${path.basename(bin)}: produced no valid PNG`;
-            }
-            else {
-                lastFailure = `${path.basename(bin)}: no screenshot written`;
-            }
-        }
-        catch (err) {
-            lastFailure = `${path.basename(bin)}: ${err.message}`;
-        }
-        finally {
-            fs.rmSync(outPng, { force: true });
-            fs.rmSync(userDir, { recursive: true, force: true });
-        }
-    }
-    // Every candidate ran but none yielded a cover — surface the last reason so a
-    // missing preview card is diagnosable (timeout, crash, bad binary) rather than silent.
-    process.stderr.write(`[agents artifacts share] OG cover capture failed (${lastFailure || 'unknown error'}) — ` +
-        'publishing without a preview image. Set AGENTS_SHARE_BROWSER to override.\n');
-    return null;
-}

package/dist/lib/share/config.d.ts

@@ -1,72 +0,0 @@
-export interface ShareConfig {
-    /** Public base, e.g. `https://share.getrush.ai` or `https://agent-share.<acct>.workers.dev`. */
-    baseUrl: string;
-    accountId: string;
-    workerName: string;
-    bucketName: string;
-    /** Custom domain when mapped (e.g. `share.getrush.ai`). */
-    domain?: string;
-    /** Cloudflare Web Analytics token injected into published HTML pages. */
-    analyticsToken?: string;
-    /** sha256 of the Worker script deployed at the last provision/update. Absent
-     * on any config written before this field existed — treat that as "unknown",
-     * never as "outdated" (there is nothing to compare against). */
-    templateHash?: string;
-}
-export declare const SHARE_BUNDLE = "share";
-export declare const SHARE_TOKEN_KEY = "WRITE_TOKEN";
-export declare const SHARE_TOKEN_ENV_KEY = "SHARE_WRITE_TOKEN";
-export declare const DEFAULT_CF_BUNDLE = "cloudflare";
-export declare const DEFAULT_WORKER_NAME = "agents-share";
-export declare const DEFAULT_BUCKET_NAME = "agents-share";
-export declare const DEFAULT_SHARE_DOMAIN = "share.getrush.ai";
-export declare const LEGACY_MANAGED_SHARE_DOMAINS: readonly ["share.agents-cli.sh", "artifacts.prix.dev"];
-/** The write token may be injected ephemerally into fleet/cloud agents. */
-export declare function readWriteTokenEnv(env?: NodeJS.ProcessEnv): string | null;
-/**
- * Read the persisted endpoint config, or null if there is no `share.baseUrl`.
- *
- * Publish talks only to `baseUrl` with `WRITE_TOKEN`. `accountId` / worker /
- * bucket are provisioning metadata for `setup`/`update`. Requiring all four
- * (and treating `accountId: ""` as missing) made `status` and publish both
- * report "not set up" on an endpoint that still worked — RUSH-2837.
- */
-export declare function readShareConfig(): ShareConfig | null;
-/** Persist the endpoint config to `agents.yaml` (syncs across the fleet).
- * Empty strings never overwrite a previously stored value and are not written
- * back as `accountId: ""` (that form made {@link readShareConfig} return null
- * under the old all-fields-required check, and it is still useless). */
-export declare function writeShareConfig(cfg: ShareConfig): void;
-/** A fresh 32-byte hex write token. */
-export declare function generateWriteToken(): string;
-/** Persist the raw write token into the `share` secrets bundle (keychain-backed,
- * fleet-injectable). Mirrors the add-key sequence in `commands/secrets.ts`. */
-export declare function storeWriteToken(token: string): void;
-/** Read the raw write token from the `share` secrets bundle. */
-export declare function readWriteTokenFromBundle(): string;
-/** Read the raw write token from injected env first, then the local bundle.
- * Throws with an actionable message if absent (run setup/join first). */
-export declare function readWriteToken(): string;
-/** Best-effort runtime env for spawned agents. Never throws AND never prompts.
- *
- * Auto-injecting the share write token on every `agents run` is a background
- * convenience, NOT a user-initiated secret access — so it MUST NOT raise a Touch
- * ID sheet (SEC-13: an agent launch never pops biometry on its own). This was the
- * per-run prompt storm: `share` is a keychain bundle that is rarely broker-held,
- * so an interactive read here spawned the helper and popped Touch ID on EVERY
- * launch. The read is now always `agentOnly` — it resolves the token only from the
- * injected env or an already-held / no-ACL bundle, and silently returns undefined
- * otherwise (the caller runs without auto-share; the agent can still publish via
- * its own `agents artifacts share`). To get zero-friction auto-share with no prompt: unlock
- * once (`agents secrets unlock share`) or make it no-ACL (`agents secrets policy
- * share never`). */
-export declare function shareRuntimeEnv(): Record<string, string> | undefined;
-/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
- * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
-export declare function readCloudflareCreds(bundle?: string, override?: {
-    apiToken?: string;
-    accountId?: string;
-}): {
-    apiToken: string;
-    accountId: string;
-};