@phnx-labs/agents-cli 1.22.114 → 1.22.116

package/CHANGELOG.md

@@ -1,5 +1,250 @@
 # Changelog
 
+## 1.22.116
+
+- **`agents feed answer` is bounded, exactly-once, and truthful about delivery
+  (PHNX-3999).** The AGI Menu abandons a reply at 30s; this path used to blow
+  that budget and then report a fabricated receipt.
+  - **Bounded.** The requested attention key names its session, so only that
+    session is reconciled and the optional `gh pr view` enrichment runs only for
+    a key whose generation is a PR review. Previously every active session was
+    enriched — one 15s-bounded `gh` call each — *before* the key was compared.
+    The whole operation now runs under one deadline, and a forwarded answer is
+    raced against it directly rather than trusting the transport's own timer.
+  - **Exact tokens across the hop.** A forwarded answer is POSIX-quoted with the
+    canonical `shellQuote` and run through the canonical `sshExecAsync`, so a
+    multiline answer or one carrying `$`, backticks, quotes or `;` arrives
+    byte-identical instead of being re-parsed by the remote shell.
+  - **Multiline free text.** A multiline answer is delivered into a tmux rail as
+    one bracketed paste (`injectIntoTerminal`'s new `paste` option), so a TUI
+    inserts it verbatim instead of submitting one line at a time. A rail that
+    cannot carry the framing refuses *before* the claim is taken.
+  - **A claim is no longer a resolution.** `recordAnswer` gains a two-phase
+    `pending` mode: the claim locks the item but leaves the block `open` and
+    writes no resolution tombstone, so an unconfirmed delivery can no longer make
+    the request silently vanish from the feed. Only the AGENT's own
+    acknowledgement resolves it — a `consumed`/`continued` receipt promotes the
+    claim through `confirmAnswerResolution`, bound to the generation and attempt
+    it was taken for, so a slow delivery cannot resolve the question the agent
+    has since moved on to. A `queued` receipt never does.
+  - **Truthful, typed outcomes for the operator UI.** `--json` now emits
+    `status` (`delivered` / `already_answered` / `unknown` / `failed`),
+    `delivery` (`receipt` / `unconfirmed` / `failed`), `resolved`, `host`,
+    `attempt`, and the block's **real** `MessageReceipt` — never a synthesized
+    one. `queued` is delivery, never resolution; `dropped`/`expired` read as
+    failures rather than as the furthest-along success. A timeout, a truncated
+    remote reply, or a partly-written keystroke sequence is `unknown` (the claim
+    is kept, so a retry cannot double-send); only a provable non-delivery is
+    `failed`.
+  - **`agents feed answer <key> --check [--attempt <at>]`** is a new read-only
+    reconciliation — the "check delivery" path for an unconfirmed answer. It
+    never claims, routes or resends, and it is bound to the requested generation
+    and attempt, so a stale card can never be resolved by the next question's
+    receipt.
+  - **Stranded claims reconcile.** A claim a kill left with no receipt is adopted
+    and completed only on the mailbox rail, where the whole spool (inbox,
+    processing and consumed) is scanned by block id so the answer is never
+    enqueued twice, and only through a compare-and-swap so two retries cannot
+    both adopt it.
+
+- **AGI Menu: synchronized Headless-runs defaults, Home and device preferences.**
+  Five new `agents config` keys, validated at write time and synced fleet-wide like
+  the existing `menubar.menu.*` set: `menubar.menu.headlessAgent` and
+  `menubar.menu.headlessFallbackAgent` (each a registered agent id — a typo is
+  refused, not stored), `menubar.menu.headlessPlacement`
+  (`auto` | `local` | `interactive` | a device name),
+  `menubar.menu.sessionUpdates`, and `menubar.menu.deviceSort`
+  (`name` | `role` | `load` | `memory` | `disk`).
+- **`agents run --fallback <agent>` now reaches the alternate harness when the
+  primary's accounts are exhausted before the run starts.** Previously that case
+  printed "no healthy account" and exited 1, so a configured alternate never fired
+  for the one situation it exists for; the mid-run handoff also no longer stops at
+  three accounts when an explicit alternate is configured, so every healthy account
+  of the primary is tried before another harness. A signed-out primary still fails
+  loud with the login hint — logging in is the fix there, not a different harness.
+- **`agents menubar snapshot --json` reports each device's role and specs.** Every
+  `devices[]` row gains `role`, `autoEligible` (whether `--device auto` may pick it)
+  and `stats` — cores, total/free memory and disk, load, reachability, and when each
+  was observed. Read from the existing fleet-stats cache, so no fleet probe; `null`
+  for a device never measured, and every unobserved number is `null` rather than `0`.
+- **Session rows carry `confirmedProject`.** The registered project whose root
+  contains the session's working directory, or `null` when the association is not
+  confirmed, on `agents feed watch --json`, `agents sessions watch --json`, and
+  `agents sessions --active --json`. A directory no project definition names — even
+  one that happens to be a git repository — is no longer filed under a project
+  invented from its folder name. The existing `project` field is unchanged.
+- **Session titles exclude shell and control scaffolding.** A harness-generated
+  title that is a `<bash-input>`/`<command-name>`/`<system-reminder>` wrapper, or a
+  bare control command such as `/clear` or `/compact`, is rejected so the row shows
+  the generated title or the user's own first prompt instead. A `/rename` title is
+  still kept verbatim, and the original prompt stays on the row. Existing indexed
+  sessions are re-derived on their next scan.
+
+- **Session previews retain details across devices (PHNX-3999).** An exact session
+  ID and owning device use one bounded request, with a durable local copy for
+  offline reading. Reopening unchanged sessions avoids network requests; activity
+  changes invalidate the copy, and failed requests back off without hiding prior
+  content. Concurrent requests coalesce, including failed manual refreshes.
+  SQLite contention, lock waiting, and transport share a 10-second budget.
+- **Large local transcripts show bounded recent details.** Previews reuse the
+  canonical transcript parsers and timeline projection, mark partial history,
+  and report missing transcripts explicitly. Cached timeline data is accepted
+  only for the exact file modification time and size that produced it.
+
+- `agents setup secrets` / `agents clis install secrets` now install Secrets CLI 0.1.5, which accepts the shared Phoenix `--host` address grammar (`ssh://[user@]host`, bare `user@host`/alias; other schemes fail loud) on `secrets` and `secrets hosts pin` (PHNX-4090) — matching the `--host` grammar computer-cli 0.1.5 already ships. Existing installs are unaffected; the canonical pin lives in `cli/src/lib/secrets-cli.ts`.
+
+- **`agents setup` now installs the standalone `term` CLI as a first-class onboarding phase (PHNX-4092).** The PTY engine `agents fleet login` and `agents auth mint` spawn on demand lives in `@phnx-labs/term-cli` (extracted PHNX-4091); a fleet device with it missing failed those flows loud. The onboarding hub gains a `term` phase and an `agents setup term` wizard (with `--install-only` / `--terminal`) that installs the pinned `@phnx-labs/term-cli@0.1.0` — via the system `clis/term.yaml` manifest, else a pinned `npm i -g` — the same way `browser`/`computer`/`secrets` install. `agents setup status` and `--tool term` report its readiness: unlike the other tools `term` has no `status --json` health surface, so presence on PATH is the whole readiness signal (no probe, no configure step). Source: `cli/src/commands/setup-term.ts`, `cli/src/commands/setup.ts`, `cli/src/lib/setup-tool-status.ts`, `cli/src/lib/setup-tool-install.ts`.
+
+- **`browser status` no longer goes blank when one Arc task is stale (PHNX-3999).** A
+  single Arc tab that had been moved to another window or Space — or closed — made
+  `agents browser status` throw, and **every** profile vanished from the listing,
+  including healthy ones with nothing to do with Arc. The refusal to adopt a moved
+  tab is correct and is unchanged: an action still will not drive a tab its task no
+  longer owns. What changed is that read-only `status` no longer inherits the blast
+  radius. An unreadable task is reported with the tab count it owns on disk plus the
+  reason its live tabs could not be read, an unreadable profile is listed with an
+  `unavailable` reason instead of disappearing, and the other profiles are reported
+  normally. `tabs` is absent rather than empty for such a task, so nothing claims a
+  stale tab is live. Source: `cli/src/lib/browser/service.ts`.
+- **`browser status` reads Arc once per pass instead of once per tab (PHNX-3999).** A
+  profile with 28 tasks paid one AppleScript round trip per owned tab, plus one
+  liveness probe per saved Arc runtime while reconnecting, so a cold `status` spent
+  dozens of serialized round trips before printing anything. It now takes a single
+  snapshot and a single liveness probe for the entire pass, shared across every Arc
+  profile, and never contacts Arc at all when no Arc profile is present. Actions are
+  unchanged and still read Arc live per tab. Source: `cli/src/lib/browser/service.ts`.
+
+- **grok signs in through its device-code flow.** `agents accounts add grok`, `agents accounts login grok#<name>`, and the logged-out hint all run `grok login --device-auth`. Bare `grok login` defaults to `--oauth`, the loopback browser flow, which opens whatever browser profile the OS defaults to. The device-code screen prints the URL and code instead, so the human finishes the sign-in in the browser profile they choose — which is what makes it usable over an SSH shell on a worker. Source: `cli/src/lib/harness-auth-capabilities.ts`, `cli/src/lib/signin-badge.ts`.
+
+- **A feed snapshot larger than the reader budget now reaches the reader whole (PHNX-3999).**
+  The daemon's shared feed socket wrote each envelope in one `socket.write` and dropped the
+  reader the moment its unflushed bytes passed 4 MiB — so a healthy Menu or `agents feed
+  watch --json` client attaching to a fleet whose reset exceeded that got 8 KiB of it, no
+  newline, then EOF, and the CLI exited 0 as if the fleet were empty. Each connection now has
+  one ordered writer that streams the snapshot before any live event in 64 KiB chunks paced
+  by the socket's own `'drain'`. A reader is dropped only when it stays more than 4 MiB of
+  live events behind for 2 s, or leaves a chunk unaccepted for 30 s — a burst of peer resets
+  to a healthy reader is never a drop. The client rejects any close it did not ask for,
+  naming a mid-frame truncation, and a throwing consumer fails that same promise instead of
+  escaping as an uncaught exception. Source: `cli/src/lib/feed/hub-server.ts`.
+
+- **Browser setup installs Browser CLI 0.1.5 (PHNX-3999).** New installations
+  include the status fix that reports unavailable Arc tasks without hiding healthy
+  profiles and reads visible Arc tabs once per status request. Existing browser
+  installations are preserved; upgrade them explicitly with
+  `npm install -g @phnx-labs/browser-cli@0.1.5`. (0.1.5 is a clean re-cut of the
+  partially-published 0.1.4; same behavior.)
+
+- **Removed `agents devices login` (a.k.a. "fleet login").** The remote device-code login orchestration could not work in the account-slot model — a box may hold several accounts per harness, and a per-box native login has no way to say which account it is signing in. It is gone entirely (not deprecated-and-hidden). Accounts are provisioned from durable worker credentials (`agents accounts add/login <harness>#<name>`); a token-less harness (kimi/antigravity) logs in per box — run the harness on that device and complete its native login. Logged-out hints for per-device harnesses now point at that path instead. Source: `cli/src/commands/ssh.ts`, `cli/src/lib/fleet/auth-sync.ts`, `cli/src/lib/signin-badge.ts`, `cli/src/lib/accounts/add.ts`, `cli/src/lib/auth-mint.ts`.
+
+## 1.22.115
+
+- **Artifact sharing moved out to the standalone `artifacts` CLI (breaking).**
+  `agents artifacts`, `agents artifacts share` (and its `list`/`delete`/`open`/
+  `visibility`/`edit`/`revisions`/`update`/`setup`/`join`/`status`/`analytics`
+  subcommands), and `agents artifacts setup` are removed — artifact sharing now
+  lives entirely in `@phnx-labs/artifacts-cli` (`artifacts share …`,
+  `artifacts auth login`), mirroring the secrets (PHNX-3989) and computer
+  (PHNX-4075) extractions. Install it with `npm i -g @phnx-labs/artifacts-cli`.
+  `agents sessions share <id>` stays — it
+  renders the session locally and now publishes through `artifacts share`, so it
+  needs that CLI installed. `agents traces` and `agents sessions export`/`backup`
+  are unaffected (their own Cloudflare/R2 paths). The ordinary CLI release no
+  longer deploys the managed share Worker (`--deploy-worker` is gone); that deploy
+  moved to artifacts-cli's own release. Source: removed `cli/src/lib/share/` and
+  `cli/src/commands/{artifacts,artifacts-setup,share}.ts`; the generic Cloudflare
+  provisioning primitives `agents traces`/`agents sessions backup` borrowed now
+  live in `cli/src/lib/cloudflare/provision.ts`.
+
+- **Browser tasks and computer runs ride the feed stream, and N readers now cost one
+  connection per peer (PHNX-3999).** `agents feed watch --json` carries a third row
+  kind alongside agents and attention: canonical tool rows for each browser task and
+  computer run, with the driven device, the owning agent session, captures, and — for
+  a still-bound browser task only — the commands that show a tab or close the task.
+  Switching an All/Agents/Browser/Computer filter launches no commands: every row for
+  every tab is already on the one stream. Computer runs are ledger history: they report `live: false` and carry no
+  stop/close affordance, because the process that performed them has exited. Task URLs
+  are redacted (userinfo stripped, credential-shaped query parameters replaced) before
+  they leave the producing machine. Source: `cli/src/lib/feed/tools.ts`,
+  `cli/src/lib/feed/tool-activity.ts`.
+- **One shared fleet feed collector, owned by the daemon (PHNX-3999).** `watchFleetFeed`
+  opened a persistent `ssh <peer> agents feed watch --json --local` per dialable
+  device *per caller*, so three readers on a thirteen-device fleet held thirty-nine
+  ssh children carrying byte-identical NDJSON. The new `feed-stream` daemon service
+  runs exactly one fan-out and serves every reader over a socket; a late reader is
+  brought up to date from held per-scope state with no re-dial, and the fan-out is
+  demand-gated so a box with no reader open holds no peer connections at all.
+  `agents feed watch --json --local` is unchanged — it is the per-machine stream the
+  collector itself subscribes to. Source: `cli/src/lib/feed/hub.ts`,
+  `cli/src/lib/daemon/feed-stream-service.ts`.
+- **The standalone browser and computer engines are read at their real source
+  (PHNX-3999).** The standalone `computer` engine always appends to its own
+  `<cache>/computer/actions/<day>.jsonl`, which never reaches agents-cli's
+  recorder — so a `computer` command run directly was invisible to every
+  agents-cli surface. `agents computer sessions` and the feed now merge that
+  ledger, deduped on `invocationId` (forwarding rewrites `ts`/`pid`, so a
+  timestamp dedupe double-counts), and attribute a record the producer left
+  unidentified to the machine whose ledger it came from instead of `unknown`.
+  Live browser tasks are read from `tasks.json`, so a task that has produced no
+  capture yet now appears — with its real tabs, and a `show`/`close` command that
+  names the host to run it on. Source: `cli/src/lib/computer/sessions-list.ts`,
+  `cli/src/lib/feed/tool-activity.ts`.
+- **Tool setup readiness rides the feed (PHNX-3999).** `reset.setup` and
+  `setup.snapshot` carry each device's browser/computer/secrets readiness from the
+  setup cache, so a Settings surface needs no per-tool polling and no probe of its
+  own. Source: `cli/src/lib/feed/watch.ts`.
+- **A long-offline peer is retired instead of dialed forever (PHNX-3999).** The 60 s
+  backoff cap bounded the delay but not the total work: a box off for a weekend was
+  dialed every 60 s for two days. After ten consecutive failures the re-dial drops to
+  15 minutes, still waking immediately on a device-registry change. Source:
+  `cli/src/lib/session/remote/peer-stream.ts`.
+- **`agents ssh --argv` delivers exact argv tokens (PHNX-3999).** The remote command
+  was assembled by joining tokens with a space, so any token containing a space or a
+  shell metacharacter was destroyed on the way to the peer — `--title "two words"`
+  arrived as two arguments and `a & b` arrived as a backgrounded command. Pass
+  `--argv '["prog","two words","a & b"]'` to deliver each element as exactly one
+  token. The positional form is unchanged and still parsed by the remote shell, so
+  the two are mutually exclusive. On Windows, where a process receives one string
+  and splits it itself, a native target is launched through `System.Diagnostics.Process`
+  with a `CommandLineToArgvW`-escaped argument string and a script or `.cmd`
+  launcher is invoked with a splatted array — PowerShell 5.1's own native
+  serializer drops an empty argument and eats embedded quotes. The Agents CLI itself
+  is launched through its package's declared entry rather than the npm `agents.ps1`
+  shim, because that shim splats its own `$args` into native `node.exe` and lost the
+  arguments one layer deeper — a quoted device name reached the parser unquoted. The
+  fleet-provenance
+  prefix is composed around the quoted argv rather than inside it; quoting it twice
+  broke any actor value containing a space or a quote. Source:
+  `cli/src/lib/devices/connect.ts`.
+- **`agents browser show <path> --device <host>` views a capture held on another
+  machine (PHNX-3999).** The file is fetched into a private local path (0600 inside a
+  0700 dir), bounded as it streams so an oversized file is refused rather than
+  transferred, and then opened with the normal local viewer — nothing is opened on
+  the remote box. `--device` here names where the FILE is; it requires an absolute
+  path and is refused together with a URL. Transport uses the device's canonical
+  auth, so a password-auth box and an explicit identity file both work, and the read
+  is platform-correct: POSIX gets `cat`, while Windows gets a .NET binary stream
+  because `cat` there is a text reader that corrupts a capture. Source:
+  `cli/src/commands/browser.ts`.
+- **Setup from the menu uses a real terminal.** `agents setup browser|computer|secrets --terminal` hands interactive onboarding to the existing terminal engine and reports launch errors. Installation and readiness remain separate; only explicit checks run health probes, and concurrent checks share one probe.
+
+- **AGI Menu 1.5.0 adds tool sessions and Setup.** The menu separates Agents, Browser and Computer activity, shows browser controls and recorded computer captures, and reports installation and readiness for Browser, Computer and Secrets CLI. It consumes the shared daemon feed without periodic tool subprocesses. The helper floor selects the signed and notarized `menubar/v1.5.0` release.
+
+- **Daemon startup preserves surviving local browsers (PHNX-3999).** The startup
+  reaper keeps a live local browser's runtime and task records when its previous
+  daemon has exited. Dead process records and stale SSH tunnels are handled
+  separately. Ownership changes only after an identity-checked reattach succeeds,
+  preserving the original launch metadata. Reconnection requires an existing
+  debugging port: `--remote-debugging-pipe` handles belong to the original service
+  process and cannot transfer to a replacement daemon. Coordinate release of an
+  active pipe-connected browser before restarting its daemon.
+- **Browser setup selects standalone Browser CLI 0.1.3.** The default package for
+  `agents setup browser --install-only` now includes the browser preservation and
+  task-restoration fixes. Existing installations and configured CLI manifests
+  retain their current behavior.
+
+- **BREAKING — deprecated command shims are deleted; every surface has one spelling.** The hidden and warned aliases that kept "still works this release" paths alive are gone, not tombstoned: a script that still calls one now gets commander's `unknown command` / `unknown option` and exits non-zero. Removed → replacement: `agents notify` → `agents send --to owner` (or `agents feed post --level important` for a milestone that should reach the owner; a `feed.broadcast` sink that spawned `agents notify "{message}"` becomes `channel: owner`); `agents doctor --fix` → `agents sync <agent>@all` (doctor is diagnose-only); `agents accounts connect|name|label|attach|detach|switch|set-default` and the hidden `agents accounts mint` / `agents auth mint` → `agents accounts add <harness> [name]`, `agents accounts login <harness>#<name>`, `agents accounts default <harness> [name]`, `agents accounts rename`, and `agents run <harness>#<name>` (accounts select by name; installation bindings are gone); `agents sessions go` → `agents sessions resume --attach-only`; `agents sessions attach` and `agents reconnect` / `agents sessions reconnect` → `agents sessions resume [id]`; `agents repo refresh` → `agents sync`; `agents mcp register` → `agents sync --mcp`; `agents memory sync` → `agents sync --memory`; `agents plugins sync <name>` → `agents sync --plugin <name>`; `agents skills info` → `agents skills view`; `agents run --smart` → `agents run --device auto`; `agents events --audit` → `agents events audit` or `--include ops`; `agents devices prefer|unprefer <name>` → `agents devices config <name> auto-launch.preferred on|--unset`; `agents devices set-interactive [name]` → `agents config set interactive.host <name>` (or `agents devices config <name> interactive.host <name>`); `agents devices configure|note|set <name>` → `agents devices config <name> <key> <value>`. `agents devices enable|disable <name>` stay as first-class, visible sugar over `auto-launch.enabled` (no deprecation notice). Folding `mcp register` into `agents sync` also closed a gap in the replacement: sync's reconcile stage skipped every HTTP MCP server declared in `agents.yaml` (`refresh.ts` `continue`d on `transport: http`) while the removed command registered it — it now registers HTTP servers through the same `registerMcpToTargets` path (`codex mcp add <name> --url <url>`), and the yaml-resource writer's Codex arm no longer silently no-ops on HTTP either (`installMcpViaCodex`). Source: `cli/src/commands/send.ts`, `doctor.ts`, `accounts.ts`, `auth.ts`, `go.ts`, `sessions.ts`, `repo.ts`, `mcp.ts`, `memory.ts`, `plugins.ts`, `skills.ts`, `exec.ts`, `events.ts`, `ssh.ts`, `cli/src/lib/smart-launch.ts`.
+
 ## 1.22.114
 
 - **`agents projects prs <project>` — every open PR across a project's repos (PHNX-3999).** Reads the whole open PR board (drafts included, no author filter) straight from GitHub over REST, paginated, for the project's own attached repos only — unlike `projects status`, whose `openPrs` only carries PRs the fleet's sessions opened. `--repo <owner/repo>` restricts to one attached repo; `--repo … --number <n>` lazily enriches exactly that PR with its head-SHA checks and reviewDecision. A per-repo fetch failure is reported and marks the result partial, never relabeled as zero open PRs. Source: `cli/src/lib/github/project-prs.ts`, `cli/src/commands/projects.ts`.

package/README.md

@@ -53,7 +53,7 @@ agents setup status                    # readiness for browser, computer, fleet,
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed trace sync (`agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, term, fleet, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 The command surface teaches setup through `agents setup` and group-level `--help`.
 The durable system model starts at [`cli/docs/README.md`](cli/docs/README.md).
@@ -943,8 +943,8 @@ agents plugins add hivemind@https://github.com/activeloopai/hivemind.git
 agents plugins add ./my-plugin
 
 # Apply to one agent (default version) or all supported
-agents plugins sync rush-toolkit claude
-agents plugins sync rush-toolkit
+agents sync --plugin rush-toolkit claude
+agents sync --plugin rush-toolkit
 ```
 
 A plugin is a directory with a manifest:
@@ -972,7 +972,7 @@ agents plugins add hivemind@https://github.com/activeloopai/hivemind.git \
   --allow-exec-surfaces
 
 # Same gate on re-sync (e.g., after upstream updates)
-agents plugins sync hivemind claude --allow-exec-surfaces
+agents sync --plugin hivemind claude --allow-exec-surfaces
 ```
 
 Skills, commands, and subagents are declarative and never trip the gate. The gate is per-plugin, per-install: consenting to hivemind doesn't grant blanket exec-surface trust to anything else.
@@ -1150,7 +1150,7 @@ agents browser profiles create cloud \
 
 ## Sign in
 
-Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. Signing in unlocks the hosted surfaces: **team spaces** (`agents auth space`) and **managed sharing** — `agents artifacts share` and `agents traces sync` publish to our storage with **zero Cloudflare setup**, and a signed-in `agents artifacts share` is **private by default** (`me`, owner-only) unless you pass `--visibility org`/`public`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind these hosted surfaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
+Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. Signing in unlocks the hosted surfaces: **team spaces** (`agents auth space`) and **managed trace sync** — `agents traces sync` publishes to our storage with **zero Cloudflare setup**. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind these hosted surfaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
 
 ```bash
 agents auth login                        # shows a code, opens a Phoenix-branded page
@@ -1242,9 +1242,9 @@ is the only way a provider credential crosses machines.
 
 Selection order for a run is explicit `--account` / `<harness>#<name>`, then
 `accounts default` for that harness, then the harness's native/balanced behavior.
-The hidden `connect` / `name` / `label` / `mint` / `attach` / `detach` /
-`switch` / `set-default` verbs are still accepted this release and print their
-replacement (`add` / `login` / `default` / `run <harness>#<name>`).
+The `connect` / `name` / `label` / `mint` / `attach` / `detach` / `switch` /
+`set-default` verbs are deleted; use `add` / `login` / `default` /
+`run <harness>#<name>` instead.
 
 ---
 
@@ -1281,7 +1281,7 @@ Merge order: profile env < `--secrets` < `--env K=V`. A missing keychain item ab
 ### Cross-machine sync
 
 Secrets are provided by the standalone [`@phnx-labs/secrets-cli`](https://github.com/phnx-labs/secrets-cli)
-engine (`agents setup secrets` checks whether it's installed). Its `push`/`pull`
+engine (`agents setup secrets` installs it if missing). Its `push`/`pull`
 verbs move a bundle between machines by encrypting it and round-tripping it
 through `api.prix.dev` — no copy-paste, no `.env` files emailed to yourself:
 
@@ -1446,99 +1446,19 @@ Sources: a command's stdout (`--watch` / `--poll`), an HTTP endpoint (`--poll-ht
 
 ## Share
 
+Publishing an agent's HTML output to a shareable link now lives in the standalone
+`artifacts` CLI (`@phnx-labs/artifacts-cli`), not in `agents`. The `agents artifacts`
+command group was removed (PHNX-3992), the same split as secrets (PHNX-3989) and
+computer (PHNX-4075). Sign in and publish with it directly:
+
 ```bash
-# Signed in? Just publish — no Cloudflare setup.
-agents auth login
-agents artifacts share plan.html --visibility unlisted      # → https://share.agents-cli.sh/<handle>/<slug>-<id>
-agents artifacts share secret.html --protected              # → https://share.agents-cli.sh/<handle>/<slug>-<id>?k=<token>
-
-# Or provision your own Cloudflare R2 (~$0).
-agents artifacts setup                                      # once: provision bucket + Worker on your CF
-agents traces setup                                         # provision the private traces Worker + R2 bucket
-agents artifacts share plan.html --slug fleet --expire 30d  # → https://<base>/fleet
-agents artifacts share plan.html --label "Q3 fleet plan" --meta kind=plan   # human title + structured metadata
-agents artifacts share plan.html --json                     # URL object for plan-render hooks
-agents artifacts share list --agent claude                  # public gallery, filterable
-agents artifacts share list --meta kind=plan                # exact, repeatable metadata filters
-agents artifacts share list --all                           # include hidden unlisted/private/me/org pages
-agents artifacts share list --scope me                      # just the owner-only pages
-agents artifacts share edit fleet --label "Final fleet plan" --meta status=final
-agents artifacts share revisions fleet                      # prior versions kept under a slug
-agents artifacts share visibility fleet me                  # re-scope a published page in place (public|unlisted|me|org)
-agents artifacts share open fleet                           # open your page signed in, so its in-page visibility control is live
-agents artifacts share status                               # show the endpoint
-agents artifacts unshare fleet                              # take a published link (+ its OG cover) down
-```
-
-`agents artifacts share` closes the loop: an agent makes work (a plan, a viz, a report),
-publishes it, and you open the link to see it. **Signed-in users** publish to the
-already-live managed endpoint (`share.agents-cli.sh/<handle>/…`) with the Phoenix session — no
-Cloudflare account, bucket, or write token — and `share status` / `list` / `revisions`
-/ `unshare` talk to that same endpoint. The handle is the local-part of the signed-in
-email (`muqsitnawaz@gmail.com` → `muqsitnawaz`); the page slug is readable plus a
-short view-id. HTML is stored as one object: local images are inlined, `file://` TOC
-links become in-page hashes, so the published page is actually viewable. The managed
-Worker lazily renders and caches the branded 1200×630 Open Graph card at `<slug>.png`,
-so publishing from Linux does not require a local Chromium; BYO endpoints keep the
-local screenshot fallback. `--visibility unlisted` (hidden aliases
-`--unlisted` / `--private`) is a capability URL: GET still works, the gallery hides it,
-and the Worker sends `X-Robots-Tag: noindex`. `--protected` (`--visibility private`)
-is token-gated: the published URL carries a secret `?k=` key (`Authorization: Bearer`
-is accepted too) and GET returns 404 without it — treat the whole link as a secret.
-`--visibility me` is visible only to
-you (the signed-in owner); `--visibility org` is visible to anyone at your email
-**domain** — derived from your own address, so it needs a **workspace** Google
-account and is refused on a public-inbox domain (`gmail.com`, `outlook.com`,
-`icloud.com`, …). Both need a Phoenix session and are identity-gated at read time (a
-stranger is redirected to sign in, then 404s). `share visibility <target> <level>`
-re-scopes an **already-published** page in place — the slug/URL is preserved and the
-body is untouched (a metadata-only change, like `share edit`, so no revision) — so you
-can promote a draft to `public` or pull a link back to `me`/`org` without re-publishing
-(`me`/`org` need a Phoenix session; `org` needs a workspace domain). The served page
-also carries an **in-page visibility control** — a chip you can switch right on the page
-— but it is interactive only for the signed-in owner, and a plain link has no login;
-`share open <target>` mints a short-lived, single-use login ticket and opens your page
-with it so the chip becomes a live dropdown. Sign-in is a
-single **Phoenix ID** (Google-only device-code OAuth, `agents auth login`) — see
-[`docs/share.md`](cli/docs/share.md) for the full identity + visibility model.
-**BYO Cloudflare** remains: `setup` reads
-a Cloudflare API token from your `cloudflare.com` secrets bundle (or `--token`), creates
-an R2 bucket, uploads a tiny Worker, and enables the free `*.workers.dev` subdomain (or
-maps `--domain share.example.com` when the token owns the zone). Writes are bearer-gated
-**through** the Worker (Phoenix bearer or static `WRITE_TOKEN`); public and unlisted
-reads are **public** so a link outlives the agent, while `--protected` token-gates
-reads on BYO too. R2 has zero egress + a 10 GB free tier, so BYO is still
-effectively free.
-
-**Fleet mode:** provision one endpoint, then every fleet / cloud / ephemeral agent
-publishes through it with a shared write token — `agents artifacts share join <baseUrl>` uses an
-existing endpoint with no provisioning. `--expire 30d|12h|<date>` auto-expires a link.
-`--json` emits `{ url, coverUrl, expiresAt, visibility, unlisted?, label, labelSource }` so plan-render automation can
-publish the rendered HTML and post the returned link without scraping terminal text.
-
-**Every share carries provenance and a title.** Agent/session/host/repo/date are
-captured automatically from the exec env and git — never invented, only sent when
-present. `--label`/`--title` names a share (else one is derived from the HTML
-`<title>`, frontmatter, or filename, with a nudge — never a blocking prompt); `--meta
-key=value` attaches structured metadata (`kind`, `project`, `ticket`, `status`, ...).
-`agents artifacts share list --agent <name> | --session <id> | --label-contains <substr>
-| --meta <key=value>` filters by provenance, title, or exact structured metadata, so
-the listing is a real "what have I shared" gallery, not just slugs. By default it mirrors
-the public gallery; `--scope unlisted|me|org` (or `--all`) includes your hidden pages and
-marks each row with its visibility so you can tell public from private at a glance.
-`agents artifacts share edit <slug>` changes only the label/arbitrary metadata in place:
-the URL, exact body, HTTP metadata, publication time, visibility, expiry, provenance,
-cover, and revision history stay unchanged.
-Republishing an existing slug keeps the prior version as a revision by default
-(`--no-revision` to skip); `agents artifacts share revisions <slug>` shows the retained
-history, newest first.
-
-`agents artifacts share delete <targets...>` (alias `agents artifacts unshare`) takes a page down — pass a
-full URL, `<user>/<slug>`, or a bare slug (resolved against your own namespace); several
-targets at once are fine. It also deletes the sibling `<slug>.png` OG cover by default
-(`--keep-cover` opts out) and verifies the page actually 404s before reporting success —
-the Worker's delete is idempotent, so `{"ok":true}` alone is never proof.
-See the publication boundary in [observability](cli/docs/observability.md).
+artifacts auth login       # Phoenix ID device-code sign-in
+artifacts share plan.html  # publish the HTML and print the link
+```
+
+`agents sessions share <id>` stays in this CLI: it renders a session transcript to
+HTML locally, then shells out to `artifacts share` to publish it, so a conversation
+becomes a shareable link the same way any other artifact does.
 
 ---
 
@@ -1777,7 +1697,7 @@ Claude Code, Codex CLI, Antigravity, Grok Build, and others each have their own
 
 ### Is it free?
 
-Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` unlocks the hosted surfaces — team spaces (`agents auth space`) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync`, no Cloudflare setup); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
+Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` unlocks the hosted surfaces — team spaces (`agents auth space`) and managed trace sync (`agents traces sync`, no Cloudflare setup); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
 
 ### Is this like `nvm` / `mise` / `asdf` for AI agents?
 

package/dist/cli/command-registry.js

@@ -49,7 +49,6 @@ const loadMonitors = async () => (await import('../commands/monitors.js')).regis
 const loadProjects = async () => (await import('../commands/projects.js')).registerProjectsCommands;
 export const loadRun = async () => (await import('../commands/exec.js')).registerRunCommand;
 const loadOpen = async () => (await import('../commands/open.js')).registerOpenCommand;
-const loadReconnect = async () => (await import('../commands/reconnect.js')).registerReconnectCommand;
 const loadFork = async () => (await import('../commands/fork.js')).registerForkCommand;
 const loadConfig = async () => (await import('../commands/config.js')).registerConfigCommand;
 const loadModels = async () => (await import('../commands/models.js')).registerModelsCommand;
@@ -89,8 +88,6 @@ const loadMessage = async () => (await import('../commands/message.js')).registe
 const loadSend = async () => (await import('../commands/send.js')).registerSendCommand;
 const loadFeed = async () => (await import('../commands/feed.js')).registerFeedCommand;
 const loadMailboxes = async () => (await import('../commands/mailboxes.js')).registerMailboxesCommand;
-// Registers the `artifacts` group (`share` + `setup` + nested `unshare`).
-const loadArtifacts = async () => (await import('../commands/artifacts.js')).registerArtifactsCommands;
 const loadWebhooks = async () => (await import('../commands/webhook.js')).registerWebhooksCommand;
 const loadHumans = async () => (await import('../commands/humans.js')).registerHumansCommands;
 const loadAccounts = async () => (await import('../commands/accounts.js')).registerAccountsCommand;
@@ -108,7 +105,6 @@ export const loadReminders = async () => (await import('../commands/reminders.js
 // `roster` was a sessions --active alias — removed; use sessions --active.
 export const LAZY_COMMAND_NAMES = new Set([
     'sessions',
-    'reconnect',
     'teams',
     'cloud',
     'message',
@@ -165,7 +161,6 @@ export const COMMAND_LOADERS = {
     // tokens must lazy-load the same module so either resolves. See commands/open.ts.
     _callback: [loadOpen],
     open: [loadOpen],
-    reconnect: [loadReconnect],
     fork: [loadFork],
     config: [loadConfig],
     models: [loadModels],
@@ -210,11 +205,9 @@ export const COMMAND_LOADERS = {
     cloud: [loadCloud],
     message: [loadMessage],
     send: [loadSend],
-    notify: [loadSend],
     feed: [loadFeed],
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
-    artifacts: [loadArtifacts],
     webhooks: [loadWebhooks],
     humans: [loadHumans],
     daemon: [loadDaemon],

package/dist/commands/accounts.d.ts

@@ -1,45 +1,7 @@
 import type { Command } from 'commander';
 import type { AgentId } from '../lib/types.js';
-import { collectRunCandidates, type RotateCandidate } from '../lib/accounting/rotate.js';
-import { type Profile } from '../lib/profiles.js';
 import { type NativeAccountCatalogRow, type ProviderAccountCatalogRow } from '../lib/account-catalog.js';
 import { type UnifiedAccount } from '../lib/account-registry.js';
-export declare function nativeIdentityFromSource(raw: string): Promise<{
-    agent: AgentId;
-    version: string;
-    identityKey: string;
-    identityLabel?: string;
-    scope: 'version' | 'device';
-}>;
-type AttachTarget = {
-    kind: 'installation';
-    agent: AgentId;
-    version: string;
-} | {
-    kind: 'device-agent';
-    agent: AgentId;
-} | {
-    kind: 'profile';
-    profile: Profile;
-};
-/**
- * Classify + validate an attach target, rejecting a typo BEFORE any binding is
- * written: it must be an existing custom-harness profile, an installed
- * `agent@version`, or a known harness id.
- */
-export declare function classifyAttachTarget(target: string): AttachTarget;
-/**
- * Persist the attached setup-token to a per-version `.oauth_token` file so an
- * INTERACTIVE Claude launch on a keychain-less Linux worker can authenticate from it.
- * Headless runs inject the token via `buildExecEnv`. Since PHNX-3502 an interactive
- * launch on a worker-role device ALSO injects it through `claudeAdapter.applyExecConfigEnv`
- * (only a headed `personal`/`desktop` device defers to its per-version native login), and
- * the shim's Linux fallback (`claudeAdapter.shimConfigEnvBash`) reads exactly this file —
- * so writing it is what makes a freshly-attached setup-token visible to that shim fallback
- * on a worker. macOS keeps the credential in the keychain, so `resolveClaudeSetupToken`
- * returns null there and this is a no-op off Linux.
- */
-export declare function writeClaudeInteractiveOauthToken(target: AttachTarget, targetAgent: AgentId, email?: string): void;
 export declare function parseBundleKey(raw: string): {
     bundle: string;
     key: string;
@@ -49,52 +11,17 @@ export declare function renderAccountList(native: NativeAccountCatalogRow[], pro
     harness?: AgentId;
     localDevice?: string;
 }): string;
-/** One labelable signed-in identity, folded across every version it is signed into. */
-export interface LabelIdentity {
-    identityKey: string;
-    email: string | null;
-    versions: string[];
-    isDefault: boolean;
-}
-/**
- * Fold signed-in run candidates into distinct identities — the unit a label
- * binds to. The same account signed into several versions is ONE row, so a
- * multi-version single-account harness never demands a selector. Candidates
- * with no stable identity (no accountKey, no email) are dropped: there is
- * nothing durable for a label to bind to. Default-version identity first.
- */
-export declare function groupLabelIdentities(candidates: Pick<RotateCandidate, 'version' | 'email' | 'accountKey'>[], defaultVersion: string | null): LabelIdentity[];
-export type LabelSelection = {
-    kind: 'selected';
-    identity: LabelIdentity;
-} | {
-    kind: 'ambiguous';
-    identities: LabelIdentity[];
-};
-/**
- * Resolve which signed-in login a bare-harness `accounts label` call means.
- * `collect` is injectable (the `resolveRunVersion` pattern) so tests drive the
- * real selection path against fixture candidates.
- */
-export declare function resolveLabelIdentity(agent: AgentId, accountSelector: string | undefined, collect?: typeof collectRunCandidates): Promise<LabelSelection>;
-/**
- * Body of `accounts label`, exported with the injectable candidate collector
- * so tests exercise everything but the TTY prompt itself.
- */
-export declare function runAccountsLabel(source: string, label: string | undefined, opts: {
-    account?: string;
-}, collect?: typeof collectRunCandidates): Promise<void>;
-/** Named accounts that `set-default` / `switch` can pin for this harness. */
+/** Named accounts that `accounts default` can pin for this harness. */
 export declare function listSwitchableAccounts(agent: AgentId): Promise<UnifiedAccount[]>;
 /**
- * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
+ * Pin the per-harness default — the `accounts default` write path.
  * Provider accounts must authenticate the harness; native accounts must belong to it.
  */
 export declare function setDefaultAccount(agentRaw: string, name: string): {
     agent: AgentId;
     account: UnifiedAccount;
 };
-export declare function runAccountsSwitch(harness: string, accountName: string | undefined, opts: {
+export declare function runAccountsDefault(harness: string, accountName: string | undefined, opts: {
     json: boolean;
 }): Promise<void>;
 /**
@@ -118,4 +45,3 @@ export declare function resolveLogoutTarget(target: string): Promise<{
     version: string;
 }>;
 export declare function registerAccountsCommand(program: Command): void;
-export {};