@phnx-labs/agents-cli 1.22.114 → 1.22.115

package/dist/commands/sessions-share.js

@@ -1,27 +1,29 @@
 /**
  * `agents sessions share <id>` — publish one session transcript as a link.
  *
- * Composes three pieces that already existed but were never wired together:
- * `renderSessionMarkdownDocument()` (redacted transcript),
- * `renderSessionHtmlDocument()` (self-contained branded page), and
- * `publishFile()` (the R2-backed share Worker). Before this, sharing a session
- * meant three commands and a detour through the external artifacts-cli.
+ * Renders the session locally — `renderSessionMarkdownDocument()` (redacted
+ * transcript) and `renderSessionHtmlDocument()` (self-contained branded page) —
+ * then publishes it through the standalone `artifacts` CLI (`artifacts share`),
+ * the single home for artifact sharing since PHNX-3992. agents-cli holds no
+ * share engine of its own; this command contributes the session-specific
+ * rendering and redaction, and forwards the finished page to `artifacts share`.
  *
- * Unlisted by default, unlike `agents artifacts share`. A transcript carries file
- * paths, command output, error text, and whatever a tool printed — strictly more
- * than a plan does — so it does not belong in the public `/<user>` gallery unless
- * the operator asks for it with `--public`. The URL itself stays world-readable:
- * unlisted is a capability URL, not a secret.
+ * Unlisted by default, unlike `artifacts share` (public by default). A transcript
+ * carries file paths, command output, error text, and whatever a tool printed —
+ * strictly more than a plan does — so it does not belong in the public `/<user>`
+ * gallery unless the operator asks for it with `--public`. The URL itself stays
+ * world-readable: unlisted is a capability URL, not a secret.
  */
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { spawnSync } from 'node:child_process';
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
-import { knownSecretValuesFromEnv } from '../lib/redact.js';
+import { knownSecretValuesFromEnv, redactEmails } from '../lib/redact.js';
 import { discoverSessions } from '../lib/session/discover.js';
 import { renderSessionHtmlDocument } from '../lib/session/share-html.js';
-import { publishFile, redactEmails } from '../lib/share/publish.js';
+import { resolveArtifactsBin, invocation, ArtifactsClientError } from '../lib/artifacts-client.js';
 import { renderSessionMarkdownDocument } from './sessions-render.js';
 import { selectSessions } from './sessions-export.js';
 import { parseAgentFilter } from './sessions.js';
@@ -35,23 +37,33 @@ export function defaultSessionSlug(session) {
     return `session-${session.shortId || session.id}`;
 }
 /**
- * Map the command's flags onto {@link PublishOptions}.
+ * Build the `artifacts share` argv for a session publish.
  *
- * Extracted so the defaults are testable directly. `unlisted` in particular is the
- * security-relevant one — it inverts the parent command's public-by-default
- * behavior, and a test that re-implements this mapping would still pass with it
- * flipped.
+ * Extracted so the mapping is testable directly. The security-relevant default
+ * is `--visibility unlisted` — it inverts `artifacts share`'s public default, and
+ * a test that re-implements this mapping would still pass with it flipped.
  */
-export function buildSharePublishOptions(session, options) {
-    return {
-        slug: options.slug ?? defaultSessionSlug(session),
-        unlisted: options.public !== true,
-        expire: options.expire,
-        force: options.force === true,
-        cover: options.cover !== false,
-        label: options.label,
-        meta: { kind: 'session' },
-    };
+export function buildArtifactsShareArgs(session, options, file) {
+    const args = [
+        'share',
+        file,
+        '--slug',
+        options.slug ?? defaultSessionSlug(session),
+        '--visibility',
+        options.public === true ? 'public' : 'unlisted',
+        '--meta',
+        'kind=session',
+        '--json',
+    ];
+    if (options.expire)
+        args.push('--expire', options.expire);
+    if (options.force === true)
+        args.push('--force');
+    if (options.cover === false)
+        args.push('--no-cover');
+    if (options.label)
+        args.push('--label', options.label);
+    return args;
 }
 export function registerSessionsShareCommand(sessionsCmd) {
     const cmd = sessionsCmd
@@ -59,7 +71,7 @@ export function registerSessionsShareCommand(sessionsCmd) {
         .description('Publish one session as a redacted, self-contained web page and print the link.')
         .option('--public', 'List the page in your public share gallery (default: unlisted capability URL)')
         .option('--slug <slug>', 'URL slug under your namespace (default: session-<shortId>)')
-        .option('--label <text>', 'Display title in the gallery and `agents artifacts share list`')
+        .option('--label <text>', 'Display title in the gallery and `artifacts share list`')
         .option('--expire <spec>', 'Auto-expire window: 30d, 12h, a date, or never (default: 30d)')
         .option('--reasoning <mode>', 'Reasoning visibility: omit, fold, or include', 'omit')
         .option('--force', 'Publish despite the sensitive-content scan flagging the transcript')
@@ -76,22 +88,23 @@ agents sessions share a1b2c3d4 --reasoning fold
 
 # A link that does not decay
 agents sessions share a1b2c3d4 --expire never`,
-        notes: `Requires a share endpoint: 'agents artifacts share status' shows it, 'agents artifacts setup'
-provisions one, 'agents artifacts share join <baseUrl>' uses an existing one.
+        notes: `Publishes through the standalone artifacts CLI — install it with
+'npm i -g @phnx-labs/artifacts-cli'. Sign in with
+'artifacts auth login' for the managed endpoint (zero Cloudflare setup), or configure
+your own bucket with 'artifacts share setup' / 'artifacts share join <baseUrl>'.
 
 Unlisted by default — the URL is world-readable but the page stays out of your public
-gallery and out of 'agents artifacts share list'. Pass --public to list it.
+gallery and out of 'artifacts share list'. Pass --public to list it.
 
-Secrets are redacted and the same pre-publish scan as 'agents artifacts share' runs on the
-page, so a transcript carrying emails or credential-shaped strings is refused
-unless you pass --force. --no-redact (the sessions-level flag) disables redaction
-and is a bad idea for anything you publish.
+Secrets are redacted and 'artifacts share' runs its own pre-publish scan on the page,
+so a transcript carrying emails or credential-shaped strings is refused unless you pass
+--force. --no-redact (the sessions-level flag) disables redaction and is a bad idea for
+anything you publish.
 
 Re-running with the same session updates the same URL and keeps the prior version
-as a revision ('agents artifacts share revisions <slug>').
+as a revision ('artifacts share revisions <slug>').
 
-Manage published sessions with 'agents artifacts share list' and
-'agents artifacts share delete <slug>'.`,
+Manage published sessions with 'artifacts share list' and 'artifacts share delete <slug>'.`,
     });
     cmd.action(async (selector, options, command) => {
         const globals = command.optsWithGlobals();
@@ -125,25 +138,60 @@ Manage published sessions with 'agents artifacts share list' and
         });
         // Emails on top of what the renderer masks. Almost every real transcript
         // carries a few — git author addresses, `gh api user`, a pasted log — and
-        // publishToEndpoint refuses a body containing any (RUSH-2428). Masking them
-        // means the published page genuinely does not carry them; the alternative,
-        // telling people to pass --force, would train everyone to bypass the gate
-        // that also catches real credentials.
+        // `artifacts share` refuses a body containing any (its own scan). Masking
+        // them means the published page genuinely does not carry them; the
+        // alternative, telling people to pass --force, trains everyone to bypass the
+        // gate that also catches real credentials.
         //
         // Applied to the RENDERED PAGE, not the Markdown, so the text that is masked
-        // is exactly the text `scanShareContent` will scan. Markdown escaping stands
+        // is exactly the text the publish scan will see. Markdown escaping stands
         // between the two: `foo\@example.com` hides from the pattern in the Markdown
         // and reappears as a live address once marked drops the backslash.
         const page = renderSessionHtmlDocument(session, markdown, { redacted: redact });
         const html = redact ? redactEmails(page) : page;
-        // A real file on disk is what publishFile() takes, and the OG capturer opens
-        // it in a browser. 0600 + a per-run directory keeps the intermediate off a
-        // world-readable /tmp path while it exists.
+        // A real file on disk is what `artifacts share` takes, and its OG capturer
+        // opens it in a browser. 0600 + a per-run directory keeps the intermediate
+        // off a world-readable /tmp path while it exists.
         const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-session-share-'));
         const file = path.join(dir, `${defaultSessionSlug(session)}.html`);
         try {
             fs.writeFileSync(file, html, { mode: 0o600 });
-            const result = await publishFile(file, buildSharePublishOptions(session, options));
+            let bin;
+            try {
+                bin = resolveArtifactsBin();
+            }
+            catch (err) {
+                if (err instanceof ArtifactsClientError) {
+                    process.stderr.write(chalk.red(err.message + '\n'));
+                    process.exitCode = 1;
+                    return;
+                }
+                throw err;
+            }
+            const { command: execCommand, prefix } = invocation(bin);
+            const args = [...prefix, ...buildArtifactsShareArgs(session, options, file)];
+            const proc = spawnSync(execCommand, args, { encoding: 'utf-8' });
+            if (proc.error)
+                throw proc.error;
+            if (proc.status !== 0) {
+                process.stderr.write(proc.stderr || chalk.red(`artifacts share exited ${proc.status ?? 'with no status'}\n`));
+                process.exitCode = proc.status ?? 1;
+                return;
+            }
+            let result;
+            try {
+                result = JSON.parse(proc.stdout);
+            }
+            catch {
+                // A 0 exit with non-JSON stdout (a version-skewed `artifacts` that
+                // printed a banner before the JSON, or one predating `--json` here) must
+                // fail loud with the bytes it actually returned, not an uncaught parse
+                // stack trace — mirroring `secrets-client.ts`'s `parseResponse`.
+                const preview = proc.stdout.trim().slice(0, 200);
+                process.stderr.write(chalk.red(`artifacts share returned a non-JSON response${preview ? `: ${preview}` : ' (empty output)'}\n`));
+                process.exitCode = 1;
+                return;
+            }
             if (globals.json) {
                 process.stdout.write(JSON.stringify({
                     session: session.id,
@@ -154,9 +202,10 @@ Manage published sessions with 'agents artifacts share list' and
                 return;
             }
             process.stdout.write(`${result.url}\n`);
-            const bits = [result.unlisted ? 'unlisted' : 'public', redact ? 'redacted' : chalk.red('NOT redacted')];
+            const visibility = result.visibility ?? (result.unlisted ? 'unlisted' : options.public ? 'public' : 'unlisted');
+            const bits = [visibility, redact ? 'redacted' : chalk.red('NOT redacted')];
             if (result.expiresAt)
-                bits.push(`expires ${result.expiresAt.slice(0, 10)}`);
+                bits.push(`expires ${String(result.expiresAt).slice(0, 10)}`);
             process.stderr.write(chalk.dim(`${bits.join(' · ')}\n`));
         }
         finally {

package/dist/commands/sessions.js

@@ -64,12 +64,9 @@ import { registerSessionsResumeCommand } from './sessions-resume.js';
 import { registerSessionsForkCommand } from './fork.js';
 import { registerSessionsBookmarkCommand } from './sessions-bookmark.js';
 import { isBookmarked, listBookmarks } from '../lib/session/bookmarks.js';
-import { registerGoCommand } from './go.js';
 import { registerFocusCommand } from './focus.js';
-import { registerReconnectCommand } from './reconnect.js';
 import { registerDetachCommand } from './detach.js';
 import { registerSessionsStopCommand } from './sessions-stop.js';
-import { registerAttachCommand } from './attach.js';
 import { registerSessionsInjectCommand } from './sessions-inject.js';
 import { registerSessionsExportCommand } from './sessions-export.js';
 import { registerSessionsRenderCommand } from './sessions-render.js';
@@ -3963,7 +3960,7 @@ async function resumeOnOwnerIfRemote(session) {
 export async function resumeSessionInPlace(session) {
     // This function is the LOCAL takeover, and every caller is responsible for
     // routing a peer-owned session before it gets here (the picker above,
-    // `agents sessions resume`, `sessions attach`). Reaching it with one anyway means a
+    // `agents sessions resume`). Reaching it with one anyway means a
     // caller skipped that step, so refuse rather than start the harness against
     // state this box does not have — the `fs.existsSync(session.cwd)` fallback
     // just below is exactly how that used to pass unnoticed, quietly swapping in
@@ -5317,7 +5314,6 @@ export function registerSessionsCommands(program) {
         resume <id> --attach-only  attach only; never fork a copy
         resume                  multi-select history -> open tabs
         detach <id>             the other direction: interactive -> headless
-        (retired, still working for one release: sessions attach, sessions go, reconnect)
       - The interactive listing and every live-status flag fold in your other online machines automatically (live over SSH, no sync) — each row is labelled by host, this machine first. Use --local to skip the fan-out; single-id lookups stay local.
       - --all is not a device flag: it widens historical directory and time filters. Fleet collection is already the default. A status flag (--working/--idle/--waiting/--orphan/--crashed/--closed/--abandoned/--queued/--unknown) implies --active; combine status flags for a union.
       - --version <version> requires --agent and is equivalent to --agent <agent@version>.
@@ -5408,12 +5404,9 @@ export function registerSessionsCommands(program) {
     registerSessionsResumeCommand(sessionsCmd);
     registerSessionsForkCommand(sessionsCmd);
     registerSessionsBookmarkCommand(sessionsCmd);
-    registerGoCommand(sessionsCmd);
     registerFocusCommand(sessionsCmd);
-    registerReconnectCommand(sessionsCmd);
     registerDetachCommand(sessionsCmd);
     registerSessionsStopCommand(sessionsCmd);
-    registerAttachCommand(sessionsCmd);
     registerSessionsInjectCommand(sessionsCmd);
     registerSessionsExportCommand(sessionsCmd);
     registerSessionsRenderCommand(sessionsCmd);

package/dist/commands/setup-browser.js

@@ -7,6 +7,7 @@
  * Idempotent: re-running shows the current default profile and offers to change
  * the pinned browser or re-point the device default.
  */
+import { openSetupTerminal } from './setup-terminal.js';
 import chalk from 'chalk';
 import { setConfigValue } from '../lib/device-config.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
@@ -14,6 +15,8 @@ import { DEFAULT_BROWSER_PROFILE_NAME, getAutoDetectedProfile, createProfile, fi
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { defaultBrowserChoice } from './setup-preferences.js';
+import { installSetupTool } from '../lib/setup-tool-install.js';
+import { refreshToolSetup } from '../lib/setup-tool-status.js';
 const INSTALL_HINT = 'Install one of: Google Chrome, Brave, Microsoft Edge, Chromium, Comet, or Arc, then re-run `agents setup browser`.\n' +
     '(This wizard picks a Chromium-family browser. An installed Firefox is not auto-picked here; its profiles are ' +
     'discovered from profiles.ini and selected with `agents browser use firefox-<name>`. Safari is not supported.)';
@@ -116,9 +119,22 @@ export function registerSetupBrowserCommand(setupCmd) {
     setupCmd
         .command('browser')
         .description('Set up `agents browser` — detect an installed browser and create the default profile.')
-        .action(async () => {
+        .option('--install-only', 'Install the standalone Browser CLI without changing profiles or starting a browser')
+        .option('--terminal [backend]', 'Open interactive setup in a detected or selected terminal')
+        .action(async (options) => {
         try {
-            await runBrowserWizard();
+            if (options.terminal !== undefined) {
+                await openSetupTerminal('browser', options.terminal, options.installOnly);
+                return;
+            }
+            if (options.installOnly) {
+                if (!(await installSetupTool('browser')))
+                    process.exitCode = 1;
+                return;
+            }
+            if (!(await runBrowserWizard()))
+                process.exitCode = 1;
+            await refreshToolSetup('browser');
         }
         catch (err) {
             if (isPromptCancelled(err)) {

package/dist/commands/setup-computer.js

@@ -8,12 +8,15 @@
  * this wizard chains them with the permission hand-holding a fresh machine needs.
  * Idempotent: re-running re-installs the current helper and re-checks trust.
  */
+import { openSetupTerminal } from './setup-terminal.js';
 import os from 'node:os';
-import { execFileSync, spawnSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import chalk from 'chalk';
 import { installComputerHelperMacLocal, activateComputerHelperMacLocal, probeComputerTrust, } from './computer.js';
 import { resolveComputerBin, ComputerClientError } from '../lib/computer-client.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+import { installSetupTool } from '../lib/setup-tool-install.js';
+import { refreshToolSetup } from '../lib/setup-tool-status.js';
 const ACCESSIBILITY_PANE = 'x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility';
 const SCREEN_PANE = 'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -43,9 +46,7 @@ export async function runComputerWizard() {
     catch (error) {
         if (!(error instanceof ComputerClientError) || error.code !== 'COMPUTER_BIN_MISSING')
             throw error;
-        console.log('Installing @phnx-labs/computer-cli@0.1.2…');
-        const installed = spawnSync('npm', ['install', '-g', '@phnx-labs/computer-cli@0.1.2'], { stdio: 'inherit' });
-        if (installed.status !== 0)
+        if (!(await installSetupTool('computer')))
             return false;
         try {
             resolveComputerBin();
@@ -136,9 +137,22 @@ export function registerSetupComputerCommand(setupCmd) {
     setupCmd
         .command('computer')
         .description('Set up `agents computer` (macOS) — install the signed helper and grant control permissions.')
-        .action(async () => {
+        .option('--install-only', 'Install the standalone Computer CLI without starting the helper or changing permissions')
+        .option('--terminal [backend]', 'Open interactive setup in a detected or selected terminal')
+        .action(async (options) => {
         try {
-            await runComputerWizard();
+            if (options.terminal !== undefined) {
+                await openSetupTerminal('computer', options.terminal, options.installOnly);
+                return;
+            }
+            if (options.installOnly) {
+                if (!(await installSetupTool('computer')))
+                    process.exitCode = 1;
+                return;
+            }
+            if (!(await runComputerWizard()))
+                process.exitCode = 1;
+            await refreshToolSetup('computer');
         }
         catch (err) {
             if (isPromptCancelled(err)) {

package/dist/commands/setup-secrets.js

@@ -7,6 +7,7 @@
  * `agents clis install secrets` (system `clis/secrets.yaml`) then a pinned
  * `npm i -g`. Users do not set extra env vars.
  */
+import { openSetupTerminal } from './setup-terminal.js';
 import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -14,7 +15,12 @@ import { spawnSync } from 'node:child_process';
 import { getHistoryDir } from '../lib/state.js';
 import { resolveSecretsBin, invocation, SecretsClientError, _resetSecretsClientForTest } from '../lib/secrets-client.js';
 import { installCli, resolveCliManifest } from '../lib/cli-resources.js';
-export const SECRETS_CLI_PACKAGE = '@phnx-labs/secrets-cli@0.1.4';
+import { SECRETS_CLI_SPEC } from '../lib/secrets-cli.js';
+import { refreshToolSetup } from '../lib/setup-tool-status.js';
+import { execFileShellSpec } from '../lib/platform/exec.js';
+// Re-exported for back-compat; the canonical pin lives in `secrets-cli.ts` so a
+// version bump touches ONE place (PHNX-3989 consolidation).
+export const SECRETS_CLI_PACKAGE = SECRETS_CLI_SPEC;
 export const INSTALL_HINT = `agents clis install secrets   # or: npm i -g ${SECRETS_CLI_PACKAGE}`;
 export function setupSecretsPrefsPath() {
     return path.join(getHistoryDir(), 'setup', 'secrets.json');
@@ -56,7 +62,8 @@ export function installSecretsCli() {
             console.error(chalk.gray(result.error));
     }
     console.log(chalk.gray(`Installing ${SECRETS_CLI_PACKAGE}…`));
-    const r = spawnSync('npm', ['install', '-g', SECRETS_CLI_PACKAGE], { stdio: 'inherit' });
+    const npm = execFileShellSpec('npm', ['install', '-g', SECRETS_CLI_PACKAGE]);
+    const r = spawnSync(npm.command, npm.args, { stdio: 'inherit', shell: npm.shell });
     _resetSecretsClientForTest();
     if (r.error) {
         console.error(chalk.red(`npm install failed: ${r.error.message}`));
@@ -93,8 +100,21 @@ export function registerSetupSecretsCommand(setupCmd) {
     setupCmd
         .command('secrets')
         .description('Install the standalone `secrets` CLI if missing, then run its `secrets migrate` onboarding.')
-        .action(async () => {
-        if (!(await runSecretsSetupWizard()))
+        .option('--install-only', 'Install the standalone Secrets CLI without migrating or unlocking secrets')
+        .option('--terminal [backend]', 'Open interactive setup in a detected or selected terminal')
+        .action(async (options) => {
+        if (options.terminal !== undefined) {
+            try {
+                await openSetupTerminal('secrets', options.terminal, options.installOnly);
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : String(error));
+                process.exitCode = 1;
+            }
+            return;
+        }
+        if (!(options.installOnly ? installSecretsCli() : await runSecretsSetupWizard()))
             process.exitCode = 1;
+        await refreshToolSetup('secrets');
     });
 }

package/dist/commands/setup-terminal.d.ts

@@ -0,0 +1,3 @@
+import type { SetupTool } from '../lib/setup-tool-status.js';
+/** The GUI starts a terminal; the terminal child owns wizard completion. */
+export declare function openSetupTerminal(tool: SetupTool, terminal: boolean | string, installOnly?: boolean): Promise<void>;

package/dist/commands/setup-terminal.js

@@ -0,0 +1,22 @@
+import os from 'node:os';
+import { currentContext, openRunInTerminal, parseTerminalFlag } from '../lib/terminal/index.js';
+/** The GUI starts a terminal; the terminal child owns wizard completion. */
+export async function openSetupTerminal(tool, terminal, installOnly = false) {
+    if (installOnly)
+        throw new Error('--terminal and --install-only are separate setup modes.');
+    const parsed = parseTerminalFlag(terminal);
+    if (parsed.error)
+        throw new Error(parsed.error);
+    const { readActiveSessionsCache } = await import('../lib/session/session-cache.js');
+    const sessions = parsed.backend ? [] : (readActiveSessionsCache('local')?.sessions ?? []).map(({ host, lastActivityMs, startedAtMs }) => ({ host, lastActivityMs, startedAtMs }));
+    const result = await openRunInTerminal({
+        argv: ['setup', tool],
+        forced: parsed.backend,
+        cwd: os.homedir(),
+        sessions,
+        ctx: currentContext(),
+    });
+    if (!result.ok)
+        throw new Error(result.error ?? 'Could not open a terminal for setup.');
+    console.log(result.description ?? 'Setup opened in a terminal.');
+}

package/dist/commands/setup.d.ts

@@ -31,7 +31,7 @@ export declare function ensureInitialized(program: Command): Promise<void>;
  * wizard. Never throws — a cancel or an optional wizard's error just skips the
  * rest and lets core setup complete.
  */
-type SetupPhase = 'browser' | 'computer' | 'share' | 'secrets' | 'accounts' | 'fleet' | 'watchdog' | 'preferences';
+type SetupPhase = 'browser' | 'computer' | 'secrets' | 'accounts' | 'fleet' | 'watchdog' | 'preferences';
 type SetupStatusState = 'ready' | 'missing' | 'n/a';
 interface SetupStatusRow {
     phase: 'core' | SetupPhase;

package/dist/commands/setup.js

@@ -20,7 +20,6 @@ import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPat
 import { setHelpSections } from '../lib/help.js';
 import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.js';
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
-import { runShareWizard } from './artifacts-setup.js';
 import { registerSetupMineCommand } from './setup-mine.js';
 import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
@@ -34,10 +33,10 @@ import { runPreferencesStep } from './setup-preferences.js';
 import { getConfiguredDefaultProfileName, getProfile, getAutoDetectedProfile, isProfileLaunchableHere } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
 import { probeComputerTrust } from './computer.js';
-import { readShareConfig } from '../lib/share/config.js';
 import { loadDevices } from '../lib/devices/registry.js';
 import { getConfigValue } from '../lib/device-config.js';
 import { setupSecretsPrefsPath } from './setup-secrets.js';
+import { SETUP_TOOLS, getCachedToolSetup, refreshToolSetup } from '../lib/setup-tool-status.js';
 const HOME = os.homedir();
 /**
  * Import an existing unmanaged agent installation into agents-cli.
@@ -280,7 +279,6 @@ export async function getSetupStatus() {
     const coreReady = isGitRepo(getAgentsDir());
     const secretsReady = fs.existsSync(setupSecretsPrefsPath());
     const minted = hasMintedSetupToken();
-    const shareConfig = readShareConfig();
     const watchdogEnabled = getConfigValue('watchdog.enabled').value === true;
     const interactiveHost = getConfigValue('interactive.host').value;
     const defaultBrowser = getConfigValue('browser.profile').value;
@@ -291,7 +289,6 @@ export async function getSetupStatus() {
         { phase: 'secrets', state: secretsReady ? 'ready' : 'missing', detail: secretsReady ? 'defaults chosen' : 'defaults not chosen' },
         { phase: 'accounts', state: minted.ready ? 'ready' : 'missing', detail: minted.detail },
         { phase: 'fleet', state: Object.keys(devices).length ? 'ready' : 'missing', detail: Object.keys(devices).length ? `${Object.keys(devices).length} device${Object.keys(devices).length === 1 ? '' : 's'} registered` : 'no devices registered' },
-        { phase: 'share', state: shareConfig ? 'ready' : 'missing', detail: shareConfig?.baseUrl ?? 'endpoint not configured' },
         { phase: 'watchdog', state: watchdogEnabled ? 'ready' : 'missing', detail: watchdogEnabled ? 'enabled on this device' : 'disabled on this device' },
         { phase: 'preferences', state: interactiveHost || defaultBrowser ? 'ready' : 'missing', detail: [interactiveHost && `host ${interactiveHost}`, defaultBrowser && `browser ${defaultBrowser}`].filter(Boolean).join(' · ') || 'interactive host and browser unset' },
     ];
@@ -309,8 +306,6 @@ async function runSetupPhase(phase) {
         await runBrowserWizard();
     else if (phase === 'computer')
         await runComputerWizard();
-    else if (phase === 'share')
-        await runShareWizard();
     else if (phase === 'secrets')
         await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
     else if (phase === 'accounts')
@@ -372,8 +367,8 @@ export function registerSetupCommand(program) {
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
     // Capability subcommands: `agents setup browser|computer|mine|secrets|accounts|fleet|alias|beta`.
-    // Share/artifact publishing is set up by `agents artifacts setup` (RUSH-2580);
-    // the hub below still offers it as a phase via runShareWizard.
+    // Artifact publishing is no longer set up here — it lives in the standalone
+    // `artifacts` CLI (`artifacts share setup`/`join`, PHNX-3992).
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
     registerSetupMineCommand(setupCmd);
@@ -404,9 +399,25 @@ export function registerSetupCommand(program) {
     `,
     });
     setupCmd.command('status')
-        .description('Show setup readiness for core, browser, computer, secrets, accounts, fleet, share, watchdog, and preferences.')
+        .description('Show setup readiness for core, browser, computer, secrets, accounts, fleet, watchdog, and preferences.')
         .option('--json', 'print machine-readable JSON')
+        .option('--tool <name>', 'Read cached standalone tool status: browser, computer, secrets, or all')
+        .option('--refresh', 'Explicitly refresh only the selected standalone tool health checks')
         .action(async (options) => {
+        if (options.tool || options.refresh) {
+            const selected = options.tool ?? 'all';
+            if (selected !== 'all' && !SETUP_TOOLS.includes(selected))
+                throw new Error('Unknown tool. Choose browser, computer, secrets, or all.');
+            const rows = options.refresh
+                ? await refreshToolSetup(selected)
+                : getCachedToolSetup().filter((row) => selected === 'all' || row.tool === selected);
+            if (options.json)
+                console.log(JSON.stringify(rows));
+            else
+                for (const row of rows)
+                    console.log(`${row.tool}: ${row.installed === false ? 'not installed' : row.readiness} · ${row.detail}`);
+            return;
+        }
         const rows = await getSetupStatus();
         if (options.json)
             console.log(JSON.stringify(rows, null, 2));
@@ -443,7 +454,6 @@ export function registerSetupCommand(program) {
       Capability setup can also be run any time on its own:
         agents setup browser    # detect a browser + create the default profile
         agents setup computer    # install the signed macOS helper + grant permissions
-        agents artifacts setup   # provision or join a Cloudflare share endpoint
         agents setup secrets     # choose secrets backend/policy defaults + import
         agents setup accounts    # mint a Claude setup-token for unattended usage/probe
         agents setup fleet       # discover Tailscale devices + configure SSH access

package/dist/commands/skills.js

@@ -511,14 +511,6 @@ Examples:
         const output = lines.join('\n');
         printWithPager(output, lines.length);
     });
-    // Deprecated alias for 'view'
-    skillsCmd
-        .command('info [name]', { hidden: true })
-        .action(async (name) => {
-        console.log(chalk.yellow('Deprecated: Use "agents skills view" instead of "agents skills info"\n'));
-        // Re-execute view command logic
-        await skillsCmd.commands.find((c) => c.name() === 'view')?.parseAsync(['view', ...(name ? [name] : [])], { from: 'user' });
-    });
 }
 /**
  * Build the row data for `agents skills list`. Each row = one central skill

package/dist/commands/ssh.d.ts

@@ -83,5 +83,11 @@ export interface HarnessInventoryOpts {
  */
 export declare function collectFleetHarnesses(opts: HarnessInventoryOpts): Promise<HostHarnessResult[]>;
 export declare function runDevicesAccounts(opts: HarnessInventoryOpts): Promise<void>;
+/**
+ * Parse `--argv`'s JSON array, or report exactly what was wrong and return
+ * undefined. Fails loud rather than coercing: a caller that meant to pass argv
+ * and typo'd the JSON must not silently get shell-string semantics instead.
+ */
+export declare function parseArgvJson(raw: string, log?: (line: string) => void): string[] | undefined;
 /** Register both `agents ssh` and `agents devices`. */
 export declare function registerSshCommands(program: Command): void;