@phnx-labs/agents-cli 1.22.114 → 1.22.116

package/dist/lib/terminal/inject.js

@@ -53,6 +53,24 @@ function backendConfirmsDelivery(backend) {
 }
 /** Carriage return — what Enter delivers into a raw PTY/tmux byte stream. */
 const CR = '\r';
+/**
+ * Bracketed-paste framing (DEC mode 2004) — the pty contract for "insert this
+ * verbatim, do not submit". A readline/Ink composer that sees the start marker
+ * buffers every byte up to the end marker, so an embedded newline lands as a
+ * literal newline in the draft instead of submitting the partial line.
+ */
+export const BRACKETED_PASTE_START = '\u001b[200~';
+export const BRACKETED_PASTE_END = '\u001b[201~';
+/**
+ * Only tmux can carry the framing: `send-keys -l` writes the marker bytes
+ * straight to the pty. ghostty simulates keystrokes, vscodium hands a JSON
+ * payload to the extension, and iTerm's AppleScript `write text` cannot encode
+ * a raw ESC byte — so a paste request on those is refused rather than
+ * half-delivered as one submit per line.
+ */
+export function backendCarriesPaste(backend) {
+    return backend === 'tmux';
+}
 // --- tmux -------------------------------------------------------------------
 /**
  * argv for `tmux send-keys` targeting a pane by id. Starts with `tmux` (like the
@@ -191,12 +209,21 @@ export function vscodiumInjectSpec(target, text, opts) {
 export async function injectIntoTerminal(target, text, opts = {}) {
     const enter = opts.enter !== false;
     const combined = opts.combined === true;
+    // Fail loud at the rail boundary: a backend that cannot carry the markers must
+    // not silently deliver the raw text, which submits once per embedded newline.
+    if (opts.paste === true && !backendCarriesPaste(target.backend)) {
+        return {
+            ok: false, confirmed: false, backend: target.backend, writes: 0, started: 0, specs: [],
+            error: `The ${target.backend} rail cannot deliver a bracketed paste — open the session and paste it there.`,
+        };
+    }
+    const payload = opts.paste === true ? `${BRACKETED_PASTE_START}${text}${BRACKETED_PASTE_END}` : text;
     // tmux + AppleScript + editor-CLI backends all run through the engine transport.
     const specs = target.backend === 'tmux'
-        ? tmuxInjectSpecs(target, text, { enter, combined, socket: opts.socket })
+        ? tmuxInjectSpecs(target, payload, { enter, combined, socket: opts.socket })
         : target.backend === 'vscodium'
-            ? [vscodiumInjectSpec(target, text, { enter, combined })]
-            : [appleScriptInjectSpec(target, text, enter, combined)];
+            ? [vscodiumInjectSpec(target, payload, { enter, combined })]
+            : [appleScriptInjectSpec(target, payload, enter, combined)];
     // Discrete writes delivered on the far side. tmux counts its send-keys calls.
     // iterm/vscodium honor `combined` (text+Enter fused into one write). ghostty's
     // coarse keystroke path ignores `combined` (it always emits keystroke + a
@@ -208,7 +235,7 @@ export async function injectIntoTerminal(target, text, opts = {}) {
             : enter && !combined ? 2 : 1;
     const confirmed = backendConfirmsDelivery(target.backend);
     if (opts.dryRun)
-        return { ok: true, confirmed, backend: target.backend, writes, specs };
+        return { ok: true, confirmed, backend: target.backend, writes, started: 0, specs };
     // AppleScript backends: guard on the backend's own availability, but only for a
     // LOCAL run (a remote host is assumed to have the app — its ssh leg reports failure).
     if (target.backend === 'iterm' || target.backend === 'ghostty') {
@@ -216,14 +243,33 @@ export async function injectIntoTerminal(target, text, opts = {}) {
             const backend = target.backend === 'iterm' ? itermBackend : ghosttyBackend;
             const ctx = opts.ctx ?? currentContext();
             if (!backend.isAvailable(ctx)) {
-                return { ok: false, confirmed: false, backend: target.backend, writes: 0, specs, error: `${backend.label} is not available here (platform ${ctx.platform})` };
+                return { ok: false, confirmed: false, backend: target.backend, writes: 0, started: 0, specs, error: `${backend.label} is not available here (platform ${ctx.platform})` };
             }
         }
     }
+    const endMs = opts.deadlineMs === undefined ? undefined : Date.now() + opts.deadlineMs;
+    let sent = 0;
+    let started = 0;
     for (const spec of specs) {
-        const res = await runSpec(spec, opts.host, opts.resolveHost);
-        if (!res.ok)
-            return { ok: false, confirmed: false, backend: target.backend, writes: 0, specs, error: res.error };
+        // Never START a spec the budget can no longer cover. Racing the caller's
+        // promise instead let a write begin AFTER the operator had already been told
+        // the answer timed out.
+        const remaining = endMs === undefined ? undefined : endMs - Date.now();
+        if (remaining !== undefined && remaining <= 0) {
+            return {
+                ok: false, confirmed: false, backend: target.backend, writes: sent, started, specs,
+                error: `injection ran out of budget after ${sent} of ${specs.length} write(s)`,
+            };
+        }
+        started += 1;
+        const res = await runSpec(spec, opts.host, opts.resolveHost, remaining);
+        if (!res.ok) {
+            // `writes` counts specs that COMPLETED; `started` counts specs that began.
+            // The failing spec may have written bytes before dying, so the caller must
+            // branch on `started`, not on `writes`.
+            return { ok: false, confirmed: false, backend: target.backend, writes: sent, started, specs, error: res.error };
+        }
+        sent += 1;
     }
-    return { ok: true, confirmed, backend: target.backend, writes, specs };
+    return { ok: true, confirmed, backend: target.backend, writes, started, specs };
 }

package/dist/lib/terminal/transport.d.ts

@@ -5,11 +5,21 @@ export interface RunResult {
     ok: boolean;
     error?: string;
 }
-/** Run the spec on this machine: spawn the launcher, resolve when it exits. */
-export declare function runLocal(spec: LaunchSpec): Promise<RunResult>;
+/** Grace between SIGTERM and SIGKILL when a deadline cancels a launcher. */
+export declare const SPEC_KILL_GRACE_MS = 250;
+/**
+ * Run the spec on this machine: spawn the launcher, resolve when it exits.
+ *
+ * `timeoutMs` makes the call genuinely bounded rather than merely raced: the
+ * child is spawned in its OWN process group (`detached`) and the whole group is
+ * signalled on expiry, so a launcher that itself spawned something (osascript →
+ * the app, tmux → the server) cannot keep running after the caller has given up.
+ * Racing the promise alone leaves the process behind (PHNX-3999).
+ */
+export declare function runLocal(spec: LaunchSpec, timeoutMs?: number): Promise<RunResult>;
 /** Serialize a launch argv into a single POSIX-quoted shell command string. */
 export declare function remoteCommand(spec: LaunchSpec): string;
-/** Run the spec on a remote host over SSH. */
-export declare function runRemote(spec: LaunchSpec, target: string): RunResult;
+/** Run the spec on a remote host over SSH. `timeoutMs` bounds the ssh client. */
+export declare function runRemote(spec: LaunchSpec, target: string, timeoutMs?: number): RunResult;
 /** Run a spec locally (no host / 'local') or on a resolved remote host. */
-export declare function runSpec(spec: LaunchSpec, host?: string, resolveHost?: HostResolver): Promise<RunResult>;
+export declare function runSpec(spec: LaunchSpec, host?: string, resolveHost?: HostResolver, timeoutMs?: number): Promise<RunResult>;

package/dist/lib/terminal/transport.js

@@ -11,30 +11,80 @@
 import { spawn } from 'child_process';
 import { sshExec } from '../ssh-exec.js';
 import { shellQuote } from './quote.js';
-/** Run the spec on this machine: spawn the launcher, resolve when it exits. */
-export function runLocal(spec) {
+/** Grace between SIGTERM and SIGKILL when a deadline cancels a launcher. */
+export const SPEC_KILL_GRACE_MS = 250;
+/**
+ * Run the spec on this machine: spawn the launcher, resolve when it exits.
+ *
+ * `timeoutMs` makes the call genuinely bounded rather than merely raced: the
+ * child is spawned in its OWN process group (`detached`) and the whole group is
+ * signalled on expiry, so a launcher that itself spawned something (osascript →
+ * the app, tmux → the server) cannot keep running after the caller has given up.
+ * Racing the promise alone leaves the process behind (PHNX-3999).
+ */
+export function runLocal(spec, timeoutMs) {
     return new Promise((resolve) => {
-        const child = spawn(spec.argv[0], spec.argv.slice(1), { stdio: 'ignore' });
-        child.on('error', (err) => resolve({ ok: false, error: err.message }));
-        child.on('close', (code) => resolve(code === 0 ? { ok: true } : { ok: false, error: `${spec.argv[0]} exited with code ${code}` }));
+        const child = spawn(spec.argv[0], spec.argv.slice(1), { stdio: 'ignore', detached: !!timeoutMs });
+        let settled = false;
+        let killTimer = null;
+        // NOTE: the pending SIGKILL is deliberately NOT cancelled here. Resolving
+        // the promise is the CALLER giving up; it is not the child exiting. Clearing
+        // the kill timer on the timeout path (which resolves immediately after
+        // arming it) meant a SIGTERM-ignoring child was never killed and simply
+        // survived the bound this function exists to enforce.
+        const done = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            resolve(result);
+        };
+        const signalGroup = (signal) => {
+            try {
+                if (child.pid)
+                    process.kill(timeoutMs ? -child.pid : child.pid, signal);
+            }
+            catch { /* already gone */ }
+        };
+        const timer = timeoutMs
+            ? setTimeout(() => {
+                signalGroup('SIGTERM');
+                killTimer = setTimeout(() => signalGroup('SIGKILL'), SPEC_KILL_GRACE_MS);
+                killTimer.unref?.();
+                done({ ok: false, error: `${spec.argv[0]} did not finish in ${timeoutMs}ms` });
+            }, timeoutMs)
+            : null;
+        // Only the child ACTUALLY exiting retires the pending SIGKILL.
+        const childGone = () => { if (killTimer) {
+            clearTimeout(killTimer);
+            killTimer = null;
+        } };
+        child.on('error', (err) => { childGone(); done({ ok: false, error: err.message }); });
+        child.on('close', (code) => {
+            childGone();
+            done(code === 0 ? { ok: true } : { ok: false, error: `${spec.argv[0]} exited with code ${code}` });
+        });
     });
 }
 /** Serialize a launch argv into a single POSIX-quoted shell command string. */
 export function remoteCommand(spec) {
     return spec.argv.map(shellQuote).join(' ');
 }
-/** Run the spec on a remote host over SSH. */
-export function runRemote(spec, target) {
-    const res = sshExec(target, remoteCommand(spec), { multiplex: true });
+/** Run the spec on a remote host over SSH. `timeoutMs` bounds the ssh client. */
+export function runRemote(spec, target, timeoutMs) {
+    const res = sshExec(target, remoteCommand(spec), { multiplex: !timeoutMs, timeoutMs });
+    if (res.timedOut)
+        return { ok: false, error: `ssh to ${target} did not finish in ${timeoutMs}ms` };
     if (res.code === 0)
         return { ok: true };
     const err = (res.stderr || '').trim();
     return { ok: false, error: err || `ssh exited with code ${res.code}` };
 }
 /** Run a spec locally (no host / 'local') or on a resolved remote host. */
-export async function runSpec(spec, host, resolveHost) {
+export async function runSpec(spec, host, resolveHost, timeoutMs) {
     if (!host || host === 'local')
-        return runLocal(spec);
+        return runLocal(spec, timeoutMs);
     const target = resolveHost ? resolveHost(host) : host;
-    return runRemote(spec, target);
+    return runRemote(spec, target, timeoutMs);
 }

package/dist/lib/traces/backend.d.ts

@@ -6,8 +6,7 @@
  * `traces.agents-cli.sh` Worker. Zero Cloudflare setup.
  *
  * BYO path (future): TRACES_BASE_URL + TRACES_WRITE_TOKEN env vars. Not
- * exposed in the CLI for M1 — follow-on milestone, same pattern as
- * `agents artifacts setup`.
+ * exposed in the CLI for M1 — follow-on milestone.
  */
 export declare const DEFAULT_TRACES_DOMAIN = "traces.agents-cli.sh";
 export interface TracesBackend {

package/dist/lib/traces/backend.js

@@ -6,8 +6,7 @@
  * `traces.agents-cli.sh` Worker. Zero Cloudflare setup.
  *
  * BYO path (future): TRACES_BASE_URL + TRACES_WRITE_TOKEN env vars. Not
- * exposed in the CLI for M1 — follow-on milestone, same pattern as
- * `agents artifacts setup`.
+ * exposed in the CLI for M1 — follow-on milestone.
  */
 import { readSession } from '../identity/client.js';
 import { selectStorageBackendKind } from '../storage/selection.js';

package/dist/lib/traces/provision.d.ts

@@ -1,4 +1,4 @@
-import { type CloudflareRequester } from '../share/provision.js';
+import { type CloudflareRequester } from '../cloudflare/provision.js';
 interface ProvisionOptions {
     request?: CloudflareRequester;
 }

package/dist/lib/traces/provision.js

@@ -1,8 +1,8 @@
 // Cloudflare orchestration for the private agents-traces store. The generic
-// request primitives live in share/provision; only the isolated traces resource
+// request primitives live in cloudflare/provision; only the isolated traces resource
 // choices and Worker template belong here.
 import { randomBytes } from 'node:crypto';
-import { addCustomDomain, createBucket, deployWorker, enableWorkersDev, findZoneId, putWorkerSecret, } from '../share/provision.js';
+import { addCustomDomain, createBucket, deployWorker, enableWorkersDev, findZoneId, putWorkerSecret, } from '../cloudflare/provision.js';
 import { DEFAULT_TRACES_DOMAIN } from './backend.js';
 import { renderTracesWorkerScript } from './worker-template.js';
 /** Bind the Phoenix identity base URL used to verify every trace read and write. */

package/dist/lib/types.d.ts

@@ -1142,9 +1142,12 @@ export interface Meta {
         discovery?: Record<string, 'approved' | 'ignored'>;
         ignored?: import('./fleet/types.js').IgnoredDeviceEntry[];
     };
-    /** Artifact share endpoint (Cloudflare R2 + Worker). Set by `agents artifacts
-     * setup`/`join`; syncs fleet-wide via `agents repo push/pull`. The write token
-     * lives in the `share` secrets bundle, not here. */
+    /** Legacy artifact-share endpoint (Cloudflare R2 + Worker), synced fleet-wide
+     * via `agents repo push/pull`. Artifact sharing moved to the standalone
+     * `artifacts` CLI (PHNX-3992), so agents-cli no longer writes this — but
+     * `shareRuntimeEnv` (`lib/share-runtime.ts`) still reads `baseUrl` to decide
+     * whether to inject the `share` bundle's write token into spawned agents. The
+     * write token lives in the `share` secrets bundle, not here. */
     share?: {
         baseUrl?: string;
         accountId?: string;
@@ -1153,9 +1156,8 @@ export interface Meta {
         domain?: string;
         /** Cloudflare Web Analytics token injected into published HTML pages. */
         analyticsToken?: string;
-        /** sha256 of the Worker script deployed at the last provision/update, so
-         * `agents artifacts share status` can tell current vs outdated vs unknown (a config
-         * from before this field existed has no hash — always "unknown"). */
+        /** sha256 of the Worker script deployed at the last provision/update
+         * (legacy; a config from before this field existed has no hash). */
         templateHash?: string;
     };
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.114",
+  "version": "1.22.116",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -16,8 +16,7 @@
   },
   "bin": {
     "agents": "dist/index.js",
-    "ag": "dist/index.js",
-    "browser": "dist/browser.js"
+    "ag": "dist/index.js"
   },
   "files": [
     "dist/**/*.js",

package/dist/commands/artifacts-setup.d.ts

@@ -1,53 +0,0 @@
-/**
- * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
- * R2 + Worker) that backs `agents artifacts share`.
- *
- * One door, two modes, because it replaces two commands that used to be
- * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
- * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
- * with no provisioning flags TYPED it runs the wizard (provision or join, and
- * offers a Worker update when an endpoint already exists); with any provisioning
- * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
- * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
- * single source of truth for provisioning.
- *
- * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
- *
- * Idempotent: re-running shows the current endpoint and offers to reconfigure.
- */
-import type { Command } from 'commander';
-/**
- * Interactive share setup. Returns true if the user configured (or already had)
- * an endpoint, false if they skipped. Never throws on user cancel — callers
- * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
- */
-export declare function runShareWizard(): Promise<boolean>;
-/** Parsed `agents artifacts setup` options — the retired `agents share setup` flag set. */
-interface ArtifactsSetupOpts {
-    bundle: string;
-    worker: string;
-    bucket: string;
-    account?: string;
-    token?: string;
-    domain?: string;
-    analyticsToken?: string;
-}
-/** The provisioning flags, by their commander option-value keys. */
-declare const PROVISION_FLAGS: readonly ["bundle", "worker", "bucket", "account", "token", "domain", "analyticsToken"];
-/**
- * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
- * is driving the old `agents share setup` provisioning path rather than asking
- * for the wizard.
- *
- * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
- * PRESENCE proves nothing — the question is whether the user typed them, which
- * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
- * Reading presence alone would classify `agents artifacts setup --bundle
- * cloudflare-work` as a wizard run and then silently provision against the
- * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
- * have no default, so presence is proof for them.
- */
-export declare function isDirectProvisionRequest(opts: ArtifactsSetupOpts, wasTyped?: (flag: (typeof PROVISION_FLAGS)[number]) => boolean): boolean;
-/** Register `agents artifacts setup` under the parent `artifacts` command. */
-export declare function registerArtifactsSetupCommand(artifactsCmd: Command): void;
-export {};

package/dist/commands/artifacts-setup.js

@@ -1,161 +0,0 @@
-/**
- * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
- * R2 + Worker) that backs `agents artifacts share`.
- *
- * One door, two modes, because it replaces two commands that used to be
- * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
- * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
- * with no provisioning flags TYPED it runs the wizard (provision or join, and
- * offers a Worker update when an endpoint already exists); with any provisioning
- * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
- * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
- * single source of truth for provisioning.
- *
- * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
- *
- * Idempotent: re-running shows the current endpoint and offers to reconfigure.
- */
-import chalk from 'chalk';
-import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, readShareConfig, } from '../lib/share/config.js';
-import { runShareProvision, runShareJoin, runShareUpdate, shareTemplateStatus } from './share.js';
-import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-/**
- * Interactive share setup. Returns true if the user configured (or already had)
- * an endpoint, false if they skipped. Never throws on user cancel — callers
- * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
- */
-export async function runShareWizard() {
-    if (!isInteractiveTerminal()) {
-        console.error(chalk.red('The artifact share wizard needs an interactive terminal. ' +
-            'Non-interactively, use `agents artifacts setup --account <id> --token <t>` (provision) ' +
-            'or `agents artifacts share join <baseUrl> --token <t>`.'));
-        return false;
-    }
-    const existing = readShareConfig();
-    if (existing) {
-        console.log(chalk.dim(`Share is already configured → ${chalk.green(existing.baseUrl)}`));
-        console.log(chalk.dim(`  worker ${existing.workerName} · bucket ${existing.bucketName} · account ${existing.accountId}`));
-        const templateStatus = shareTemplateStatus(existing);
-        console.log(chalk.dim(`  template ${templateStatus}`));
-        const { select } = await import('@inquirer/prompts');
-        const action = await select({
-            message: 'Share is already configured. What do you want to do?',
-            choices: [
-                { name: 'Keep as is', value: 'keep' },
-                {
-                    name: 'Update the deployed Worker to the latest template',
-                    value: 'update',
-                    description: templateStatus === 'current'
-                        ? 'Already current — this re-deploys anyway and refreshes the token in place.'
-                        : 'Re-deploys the Worker script on your existing endpoint (same account/worker/bucket, same write token).',
-                },
-                {
-                    name: 'Reconfigure from scratch (provision or join again)',
-                    value: 'reconfigure',
-                },
-            ],
-            default: templateStatus === 'outdated' || templateStatus === 'unknown' ? 'update' : 'keep',
-        });
-        if (action === 'keep') {
-            console.log(chalk.dim('Keeping the current endpoint.'));
-            return true;
-        }
-        if (action === 'update') {
-            // When the template is already current, the description below promises a
-            // re-deploy anyway — force it, or runShareUpdate's own no-op would silently
-            // contradict what was just said.
-            const result = await runShareUpdate({ force: templateStatus === 'current' });
-            console.log(result.updated
-                ? chalk.green(`Worker '${result.workerName}' updated → template ${result.templateHash.slice(0, 12)}…`)
-                : chalk.dim(`Worker '${result.workerName}' already matches the current template — no-op.`));
-            return true;
-        }
-        // action === 'reconfigure' — fall through to the provision/join flow below.
-    }
-    const { select } = await import('@inquirer/prompts');
-    const mode = await select({
-        message: 'How do you want to publish shared links?',
-        choices: [
-            {
-                name: 'Provision my own (Cloudflare R2 + Worker)',
-                value: 'provision',
-                description: 'One-time: creates a bucket + Worker on your Cloudflare account (~$0). Needs a Cloudflare API token.',
-            },
-            {
-                name: 'Join an existing endpoint (a teammate already provisioned one)',
-                value: 'join',
-                description: 'Use synced config when present, or paste the base URL + write token from the endpoint owner.',
-            },
-        ],
-    });
-    if (mode === 'provision') {
-        await runShareProvision({
-            bundle: DEFAULT_CF_BUNDLE,
-            worker: DEFAULT_WORKER_NAME,
-            bucket: DEFAULT_BUCKET_NAME,
-        });
-        return true;
-    }
-    const { input } = await import('@inquirer/prompts');
-    const baseUrl = await input({
-        message: 'Endpoint base URL (e.g. https://share.getrush.ai)',
-        validate: (v) => (v.trim().startsWith('http') ? true : 'Enter the full https:// URL of the endpoint.'),
-    });
-    await runShareJoin(baseUrl.trim());
-    return true;
-}
-/** The provisioning flags, by their commander option-value keys. */
-const PROVISION_FLAGS = ['bundle', 'worker', 'bucket', 'account', 'token', 'domain', 'analyticsToken'];
-/**
- * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
- * is driving the old `agents share setup` provisioning path rather than asking
- * for the wizard.
- *
- * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
- * PRESENCE proves nothing — the question is whether the user typed them, which
- * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
- * Reading presence alone would classify `agents artifacts setup --bundle
- * cloudflare-work` as a wizard run and then silently provision against the
- * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
- * have no default, so presence is proof for them.
- */
-export function isDirectProvisionRequest(opts, wasTyped = () => false) {
-    if (opts.account || opts.token || opts.domain || opts.analyticsToken)
-        return true;
-    return PROVISION_FLAGS.some((flag) => wasTyped(flag));
-}
-/** Register `agents artifacts setup` under the parent `artifacts` command. */
-export function registerArtifactsSetupCommand(artifactsCmd) {
-    artifactsCmd
-        .command('setup')
-        .description('Provision (or join) the Cloudflare R2 + Worker endpoint that backs `agents artifacts share`.')
-        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
-        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
-        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
-        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
-        .option('--token <t>', 'Cloudflare API token (else read from the --bundle)')
-        .option('--domain <host>', `custom domain to map (default: ${DEFAULT_SHARE_DOMAIN}; workers.dev if zone is not visible)`)
-        .option('--analytics-token <token>', 'Cloudflare Web Analytics token to inject into published HTML pages')
-        .action(async (opts, cmd) => {
-        try {
-            // Named endpoint details, or no terminal to prompt on, means provision
-            // directly — the wizard has nothing to ask that was not already given,
-            // and it would provision against its own hardcoded defaults, dropping
-            // whatever the caller named.
-            const wasTyped = (flag) => cmd.getOptionValueSource(flag) === 'cli';
-            if (isDirectProvisionRequest(opts, wasTyped) || !isInteractiveTerminal()) {
-                await runShareProvision(opts);
-                return;
-            }
-            await runShareWizard();
-        }
-        catch (err) {
-            if (isPromptCancelled(err)) {
-                console.log(chalk.yellow('\nCancelled'));
-                return;
-            }
-            console.error(chalk.red(err.message));
-            process.exitCode = 1;
-        }
-    });
-}

package/dist/commands/artifacts.d.ts

@@ -1,18 +0,0 @@
-/**
- * `agents artifacts` — the group that owns everything an agent publishes for a
- * human to open: HTML plans, reports, rendered visuals, screenshots.
- *
- * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
- * noun, `share` is the action on it, so the surface reads noun-then-action like
- * the rest of the CLI:
- *
- *   agents artifacts share <file>          publish
- *   agents artifacts share list|delete|analytics|join|status|update
- *   agents artifacts setup                 provision (or join) the endpoint
- *
- * The subtree itself lives in commands/share.ts (publish + its subcommands) and
- * commands/artifacts-setup.ts (the provisioning door); this module only assembles
- * the group, so there is one place that says what `agents artifacts` contains.
- */
-import type { Command } from 'commander';
-export declare function registerArtifactsCommands(program: Command): void;

package/dist/commands/artifacts.js

@@ -1,58 +0,0 @@
-/**
- * `agents artifacts` — the group that owns everything an agent publishes for a
- * human to open: HTML plans, reports, rendered visuals, screenshots.
- *
- * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
- * noun, `share` is the action on it, so the surface reads noun-then-action like
- * the rest of the CLI:
- *
- *   agents artifacts share <file>          publish
- *   agents artifacts share list|delete|analytics|join|status|update
- *   agents artifacts setup                 provision (or join) the endpoint
- *
- * The subtree itself lives in commands/share.ts (publish + its subcommands) and
- * commands/artifacts-setup.ts (the provisioning door); this module only assembles
- * the group, so there is one place that says what `agents artifacts` contains.
- */
-import { setHelpSections } from '../lib/help.js';
-import { registerShareCommands, registerUnshareCommand } from './share.js';
-import { registerArtifactsSetupCommand } from './artifacts-setup.js';
-export function registerArtifactsCommands(program) {
-    const artifactsCmd = program
-        .command('artifacts')
-        .description('Publish agent-made artifacts (plans, reports, visuals) to a shareable link — managed if signed in, otherwise your Cloudflare R2.');
-    registerArtifactsSetupCommand(artifactsCmd);
-    registerShareCommands(artifactsCmd);
-    setHelpSections(artifactsCmd, {
-        examples: `
-      # Signed in? Just publish — no Cloudflare setup
-      agents auth login
-      agents artifacts share ./out/plan.html
-
-      # Or provision your own Cloudflare endpoint (or join a teammate's)
-      agents artifacts setup
-      agents artifacts share join https://share.getrush.ai
-
-      # What's live in your namespace, and taking one down
-      agents artifacts share list
-      agents artifacts unshare my-plan-a1b2
-
-      # Endpoint health, and pushing a new Worker template to it
-      agents artifacts share status
-      agents artifacts share update
-    `,
-        notes: `
-  agents artifacts share is the publish action; agents artifacts setup is the
-  one-time endpoint provisioning. It runs the interactive wizard only when you
-  type NO endpoint flag on a TTY; type any of --bundle/--worker/--bucket/
-  --account/--token/--domain/--analytics-token, or run non-interactively, and it
-  provisions directly with what you named.
-
-  agents artifacts unshare <targets...> is the nested alias of
-  agents artifacts share delete. Top-level \`agents unshare\` is gone.
-
-  Architecture: cli/docs/observability.md.
-    `,
-    });
-    registerUnshareCommand(artifactsCmd);
-}

package/dist/commands/attach.d.ts

@@ -1,12 +0,0 @@
-/**
- * `agents sessions attach <id>` — bring a backgrounded (or parked) agent session
- * back to the foreground: stop its headless continuation, then resume it
- * interactively in this terminal. The resume is version-pinned native resume
- * (claude/codex) or a `/continue` replay (others) — the same session, full
- * history, the exact inverse of `agents sessions detach`.
- */
-import type { Command } from 'commander';
-import type { SessionMeta } from '../lib/session/types.js';
-export declare function registerAttachCommand(program: Command): void;
-export declare function attachAction(id: string): Promise<void>;
-export declare function attachRecoveryArgs(session: Pick<SessionMeta, 'id'>): string[];