@phnx-labs/agents-cli 1.22.114 → 1.22.116

package/dist/commands/secrets-passthrough.js

@@ -4,7 +4,7 @@ import { buildServeEnv, invocation, resolveSecretsBin, SecretsClientError } from
 import { flagValue } from '../lib/hosts/routing-flag.js';
 import { stripRoutingFlags } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteDevice } from '../lib/ssh-tunnel.js';
-const INSTALL_HINT = 'npm i -g @phnx-labs/secrets-cli';
+import { SECRETS_CLI_INSTALL_HINT } from '../lib/secrets-cli.js';
 /**
  * Rewrite a `--device <name>` (or `-D`) on the forwarded argv to
  * `--host ssh://user@host`, the address grammar `secrets` speaks (PHNX-4090).
@@ -39,7 +39,7 @@ export function registerSecretsCommands(program) {
             if (err instanceof SecretsClientError && err.code === 'SECRETS_BIN_MISSING') {
                 console.error(chalk.red('The standalone `secrets` CLI is not installed.'));
                 console.error(chalk.gray(`Install it, then re-run this command:`));
-                console.error(chalk.cyan(`  ${INSTALL_HINT}`));
+                console.error(chalk.cyan(`  ${SECRETS_CLI_INSTALL_HINT}`));
                 process.exit(1);
             }
             throw err;

package/dist/commands/send.d.ts

@@ -10,10 +10,10 @@
  *
  * Compat: positional text still works (`agents send "hi" --channel … --to …`).
  *
- * `agents notify` is the same delivery path with owner defaults
- * (`send --to owner`) and is deprecated — new callers should use
- * `agents feed post`. Not a second stack. Not agent control — use
- * `agents message` / `agents sessions inject` for running agents.
+ * `send --to owner` is the owner-delivery path; `agents feed post --level
+ * important` records a milestone and broadcasts it through the same sink.
+ * Not a second stack. Not agent control — use `agents message` /
+ * `agents sessions inject` for running agents.
  *
  * Feed / activity are a different plane (record + read); feed.broadcast may
  * call this command as a forward sink.

package/dist/commands/send.js

@@ -9,7 +9,7 @@ function mergeAttachments(opts) {
     const list = [...(opts.attach ?? []), ...(opts.attachment ?? [])];
     return list.length ? list : undefined;
 }
-function toInput(positionalText, opts, ownerMode) {
+function toInput(positionalText, opts) {
     return {
         text: opts.text,
         positionalText,
@@ -20,18 +20,17 @@ function toInput(positionalText, opts, ownerMode) {
         urls: opts.url,
         from: opts.from,
         dryRun: opts.dryRun,
-        ownerMode,
     };
 }
-async function runSend(positionalText, opts, ownerMode) {
+async function runSend(positionalText, opts) {
     const meta = readMeta();
-    let input = toInput(positionalText, opts, ownerMode);
-    // An owner-bound ping (`agents notify`, `agents send --to owner`) goes through
+    let input = toInput(positionalText, opts);
+    // An owner-bound ping (`agents send --to owner`) goes through
     // the SAME composer as an important `feed post` (PHNX-3698): short-shaped body,
     // TEAM-N keys linkified, session crumb as a tappable console URL — instead of a
     // raw dump. A non-owner send (explicit --channel/--to) is delivered verbatim.
     let ownerCompose;
-    if (ownerMode || isOwnerAlias(opts.to)) {
+    if (isOwnerAlias(opts.to)) {
         const flagged = opts.text?.trim() ?? '';
         const positional = (positionalText ?? '').trim();
         const raw = flagged || positional;
@@ -112,9 +111,6 @@ export function registerSendCommand(program) {
       # Attach a local file
       agents send --to owner --text "screenshot" --attach ./out/cover.png
 
-      # Owner alias without the notify verb
-      agents send --to owner --text "wiring test"
-
       # Legacy positional text still works
       agents send "hi" --channel desktop --to local
 
@@ -124,47 +120,6 @@ export function registerSendCommand(program) {
         notes: SHARED_NOTES,
     });
     sendCmd.action(async (text, opts) => {
-        await runSend(text, opts, false);
-    });
-    const notifyCmd = program
-        .command('notify [text]')
-        .description('[DEPRECATED] Deliver to the owner (alias of send --to owner). Use "agents feed post" for new code.')
-        .option('--text <text>', 'message body (preferred over positional text)')
-        .option('--channel <name>', 'override owner channel')
-        .option('--to <target>', 'override owner target (or pass a non-owner dest with --channel)')
-        .option('--thread <id>', 'channel thread id / timestamp')
-        .option('--attach <path...>', 'local file attachment path (repeatable)')
-        .option('--attachment <path...>', 'alias of --attach')
-        .option('--url <url...>', 'link or remote media URL to include in the body (repeatable)')
-        .option('--from <who>', 'sender label (mailbox)')
-        .option('--json', 'output JSON')
-        .option('--dry-run', 'resolve + build but do not send');
-    setHelpSections(notifyCmd, {
-        examples: `
-      # Deprecated: prefer "agents feed post --title \"…\" \"…\" --level important"
-      agents notify --text "Build finished — PR #1346 is green"
-      agents notify "legacy positional still works"
-
-      # Override channel for this one ping
-      agents notify --text "fallback" --channel desktop --to local
-
-      agents notify --text "probe" --dry-run --json
-    `,
-        notes: `
-      DEPRECATED. notify ≡ send --to owner and still works, but new callers
-      should use "agents feed post" (record + optional broadcast) instead.
-      Set owner.channels + owner.policy.normal in humans.yaml once per fleet.
-      Every channel listed in the normal policy receives an owner-addressed send.
-
-      Owner sends go through the same composer as "feed post": the body is
-      short-shaped, any TEAM-N key becomes a Linear URL, and the session crumb
-      becomes a tappable https://prix.dev/console/sessions/<id> link.
-
-      ${SHARED_NOTES}
-    `,
-    });
-    notifyCmd.action(async (text, opts) => {
-        console.error(chalk.yellow('Warning: "agents notify" is deprecated. Use "agents feed post" for progress posts that can also reach the owner.'));
-        await runSend(text, opts, true);
+        await runSend(text, opts);
     });
 }

package/dist/commands/sessions-backup-setup.js

@@ -10,7 +10,7 @@
 // the same idempotent `deployWorker`/`createBucket` primitives. Provisioning is
 // idempotent — re-running redeploys the current Worker template in place.
 import chalk from 'chalk';
-import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
+import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/cloudflare/creds.js';
 import { PHOENIX_ID_BASE } from '../lib/identity/client.js';
 import { provisionSessions } from '../lib/session/sync/provision.js';
 import { DEFAULT_SESSIONS_BUCKET_NAME, DEFAULT_SESSIONS_DOMAIN, DEFAULT_SESSIONS_WORKER_NAME, } from '../lib/session/sync/managed-config.js';

package/dist/commands/sessions-picker.d.ts

@@ -153,6 +153,17 @@ export interface SessionPreviewDigest {
     firstError?: string;
     toolHistogram: ReturnType<typeof toolHistogram>;
     test: ReturnType<typeof detectTestResult>;
+    /**
+     * True when this digest was built WITHOUT parsing the transcript (PHNX-3999):
+     * the file exceeded {@link PREVIEW_DIGEST_MAX_PARSE_BYTES} and no cached
+     * digest existed yet. `firstUser`/`lastAssistant` fall back to the already-
+     * indexed `SessionMeta.firstUserMessage`/`lastUserMessage` (cheap, no parse)
+     * rather than being silently empty; every event-derived field (toolCalls,
+     * changedFiles, artifacts, etc.) stays at its zero-value default because it
+     * genuinely was not computed, not because nothing happened.
+     */
+    partial?: boolean;
+    partialReason?: string;
 }
 /** Fold a harness-normalized event stream into the stable preview data model. */
 export declare function buildSessionPreviewDigest(events: SessionEvent[], session: SessionMeta): SessionPreviewDigest;

package/dist/commands/sessions-picker.js

@@ -8,12 +8,13 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import chalk from 'chalk';
-import { truncate, humanDuration } from '../lib/format.js';
+import { truncate, humanDuration, formatBytes } from '../lib/format.js';
 import { sessionDisplayAgent } from '../lib/session/types.js';
 import { fetchPeerPreviewDigest } from '../lib/session/remote-list.js';
 import { parseSession, sanitizeForTerminal, SNAPSHOT_TODO_TOOLS } from '../lib/session/parse.js';
+import { readSessionTail, readSessionHead } from '../lib/session/tail.js';
 import { safeTeamText } from '../lib/session/team-filter.js';
-import { cleanSessionPrompt, extractSessionTopic, isSyntheticUserMessage } from '../lib/session/prompt.js';
+import { cleanSessionPrompt, extractSessionTopic, isSyntheticUserMessage, firstUserMessageFromEvents } from '../lib/session/prompt.js';
 import { linkPath, linkUrl, relativeToCwd, shortenModel } from '../lib/session/render.js';
 import { linearIssueUrl } from '../lib/session/linear.js';
 import { extractTodoProgress, WORKTREE_RE } from '../lib/session/state.js';
@@ -324,7 +325,14 @@ export function loadSessionPreviewDigest(session) {
             archived.plugins = getSessionPlugins(session.id);
             return { digest: archived, events: [] };
         }
-        return { events: [] };
+        // No file on disk AND no archived digest: a metadata-only row (a Rush
+        // dispatch/audit row, a synthesized attach-only entry, a live session not
+        // yet indexed) with nothing to read (PHNX-3999). Callers that only
+        // destructure `digest` (the picker's "not indexed here" note) are
+        // unaffected; a JSON caller reading `error` gets a truthful reason instead
+        // of a `preview: null` that looks identical to "this session genuinely has
+        // no content yet".
+        return { events: [], error: 'no local transcript for this session (metadata-only entry, no archived digest)' };
     }
     const safe = sanitizeMeta(session);
     let events = [];
@@ -340,9 +348,53 @@ export function loadSessionPreviewDigest(session) {
         fileSize: sourceStamp.size,
     });
     if (!digest) {
-        try {
-            events = parseSession(session.filePath, session.agent);
+        if (sourceStamp.size > PREVIEW_DIGEST_MAX_PARSE_BYTES) {
+            // A full `parseSession` on a cache miss is a synchronous, unbounded
+            // whole-file parse with no time/byte cap of its own (PHNX-3999) — real
+            // 6.3 MiB and 35.7 MiB screenshot-heavy transcripts on this fleet both
+            // lacked a computed digest/timeline, consistent with this path not
+            // finishing in a reasonable request budget for either. `PREVIEW_DIGEST_MAX_PARSE_BYTES`
+            // is deliberately smaller than the daemon's own background-work ceiling
+            // (see that constant's own doc) so this catches both real cases.
+            //
+            // This IS genuinely partial, not empty: rather than parsing nothing,
+            // `readSessionTail` (`tail.ts`) reads only the LAST 128 KiB of the file
+            // (already the live-view's own bounded reader, reused verbatim — no new
+            // parse logic) for a real recent-events window on the two harnesses it
+            // supports (Claude/Codex); event-derived fields below (toolCalls,
+            // toolTags, etc.) reflect that tail window, not the whole session, which
+            // `partialReason` states explicitly.
+            //
+            // `firstUser` is NEVER set from the tail fold: a tail window's "first
+            // user message IN THAT WINDOW" is a mid-session follow-up on any
+            // multi-turn session, not the session's actual original request, and
+            // there is no honest way to tell the two apart from the tail alone.
+            // Falling back to it would silently mislabel a follow-up as the
+            // original ask. Preference order for the CANONICAL original request:
+            // (1) the already-indexed `SessionMeta.firstUserMessage` (zero
+            // extra I/O); (2) failing that, a bounded HEAD read (`readSessionHead`,
+            // `tail.ts` — the mirror of the tail reader, first ~32 KiB from byte 0,
+            // where a session's opening turn always lives) so a row with no indexed
+            // value yet still gets the REAL original request rather than nothing.
+            // Only when neither is available does `firstUser` stay empty —
+            // `partial`/`partialReason` already say why detail is missing, which is
+            // the truthful signal, never a guessed value. The digest is cached
+            // against this stamp so the bound is paid once per transcript version,
+            // not once per call.
+            events = readSessionTail(session.filePath, session.agent);
             digest = buildSessionPreviewDigest(events, safe);
+            if (session.firstUserMessage) {
+                digest.firstUser = session.firstUserMessage;
+            }
+            else {
+                // Reuse the canonical extractor (rejects synthetic/system-injected
+                // turns, unwraps a Grok/Cursor <user_query> wrapper) rather than a
+                // bespoke inline find — the same rules SessionMeta.firstUserMessage
+                // itself was built with.
+                digest.firstUser = firstUserMessageFromEvents(readSessionHead(session.filePath, session.agent)) ?? '';
+            }
+            digest.partial = true;
+            digest.partialReason = `transcript is ${formatBytes(sourceStamp.size)}, over the ${formatBytes(PREVIEW_DIGEST_MAX_PARSE_BYTES)} bounded-parse limit for an uncached preview; digest reflects only the last ~128 KiB (tail) of the transcript, not the whole session`;
             writeSessionPreviewCache({
                 id: session.id,
                 fileMtimeMs: sourceStamp.mtimeMs,
@@ -350,8 +402,20 @@ export function loadSessionPreviewDigest(session) {
                 preview: digest,
             });
         }
-        catch (err) {
-            return { events, error: sanitizeForTerminal(err?.message ?? String(err)) };
+        else {
+            try {
+                events = parseSession(session.filePath, session.agent);
+                digest = buildSessionPreviewDigest(events, safe);
+                writeSessionPreviewCache({
+                    id: session.id,
+                    fileMtimeMs: sourceStamp.mtimeMs,
+                    fileSize: sourceStamp.size,
+                    preview: digest,
+                });
+            }
+            catch (err) {
+                return { events, error: sanitizeForTerminal(err?.message ?? String(err)) };
+            }
         }
     }
     digest.plugins = getSessionPlugins(session.id);
@@ -711,6 +775,23 @@ const DIRS_TOUCHED_MAX = 5;
 // enough to cover any real session's edits, low enough that a runaway rewrite
 // can't bloat the cached JSON. The `changes` counts stay the true totals.
 const CHANGED_FILES_MAX = 200;
+/**
+ * Bound for an uncached `loadSessionPreviewDigest` parse (PHNX-3999).
+ *
+ * Deliberately SMALLER than the daemon's own
+ * `TIMELINE_PASS_MAX_WHOLE_FILE_BYTES` (16 MiB, `timeline-pass.ts`) — that
+ * number bounds BACKGROUND work the daemon tick can afford to spend; this one
+ * bounds a SYNCHRONOUS request an interactive caller (the Menu, with its own
+ * end-to-end latency budget) is actively waiting on. Two real screenshot-heavy
+ * transcripts on this fleet (6.3 MiB and 35.7 MiB) both lacked any computed
+ * digest/timeline — a 16 MiB threshold here would still miss the smaller one.
+ * The exact per-byte cost of `parseSession` is not measured in this change;
+ * 4 MiB is a conservative invariant (well under the 6.3 MiB failure case,
+ * comfortably above ordinary non-screenshot transcript sizes), not a timing
+ * guarantee — verify against real transcripts before relying on a specific
+ * elapsed-time bound.
+ */
+const PREVIEW_DIGEST_MAX_PARSE_BYTES = 4 * 1024 * 1024;
 /** Fold a harness-normalized event stream into the stable preview data model. */
 export function buildSessionPreviewDigest(events, session) {
     let firstUser = '';

package/dist/commands/sessions-resume.js

@@ -95,7 +95,6 @@ export function registerSessionsResumeCommand(sessionsCmd) {
       - Attach a live pane without forking: agents sessions focus <id>.
       - This is the ONE verb for getting back in. It detects the state: a live tmux pane is attached, a headless session comes to the foreground, an ended one recovers on its owning device.
       - A UUID/prefix or ag-<agent>-<suffix> alias bypasses the picker. A live alias attaches by name even when the session index cannot attribute it.
-      - Retired spellings still work for one release and print the replacement: sessions attach, sessions go, reconnect.
       - Going the other way (foreground -> background) is 'agents sessions detach <id>'.
       - With no identity selector, space toggles a session, enter confirms, and tab toggles the preview pane.
       - Layout: one tab per session by default. --splits packs session pairs side by side in each tab.

package/dist/commands/sessions-share.d.ts

@@ -1,6 +1,5 @@
 import type { Command } from 'commander';
 import type { SessionMeta } from '../lib/session/types.js';
-import { type PublishOptions } from '../lib/share/publish.js';
 interface ShareOptions {
     public?: boolean;
     slug?: string;
@@ -13,13 +12,12 @@ interface ShareOptions {
 /** `session-<shortId>` — stable per session, so re-sharing updates the same URL. */
 export declare function defaultSessionSlug(session: SessionMeta): string;
 /**
- * Map the command's flags onto {@link PublishOptions}.
+ * Build the `artifacts share` argv for a session publish.
  *
- * Extracted so the defaults are testable directly. `unlisted` in particular is the
- * security-relevant one — it inverts the parent command's public-by-default
- * behavior, and a test that re-implements this mapping would still pass with it
- * flipped.
+ * Extracted so the mapping is testable directly. The security-relevant default
+ * is `--visibility unlisted` — it inverts `artifacts share`'s public default, and
+ * a test that re-implements this mapping would still pass with it flipped.
  */
-export declare function buildSharePublishOptions(session: SessionMeta, options: Pick<ShareOptions, 'public' | 'slug' | 'label' | 'expire' | 'force' | 'cover'>): PublishOptions;
+export declare function buildArtifactsShareArgs(session: SessionMeta, options: Pick<ShareOptions, 'public' | 'slug' | 'label' | 'expire' | 'force' | 'cover'>, file: string): string[];
 export declare function registerSessionsShareCommand(sessionsCmd: Command): void;
 export {};

package/dist/commands/sessions-share.js

@@ -1,27 +1,29 @@
 /**
  * `agents sessions share <id>` — publish one session transcript as a link.
  *
- * Composes three pieces that already existed but were never wired together:
- * `renderSessionMarkdownDocument()` (redacted transcript),
- * `renderSessionHtmlDocument()` (self-contained branded page), and
- * `publishFile()` (the R2-backed share Worker). Before this, sharing a session
- * meant three commands and a detour through the external artifacts-cli.
+ * Renders the session locally — `renderSessionMarkdownDocument()` (redacted
+ * transcript) and `renderSessionHtmlDocument()` (self-contained branded page) —
+ * then publishes it through the standalone `artifacts` CLI (`artifacts share`),
+ * the single home for artifact sharing since PHNX-3992. agents-cli holds no
+ * share engine of its own; this command contributes the session-specific
+ * rendering and redaction, and forwards the finished page to `artifacts share`.
  *
- * Unlisted by default, unlike `agents artifacts share`. A transcript carries file
- * paths, command output, error text, and whatever a tool printed — strictly more
- * than a plan does — so it does not belong in the public `/<user>` gallery unless
- * the operator asks for it with `--public`. The URL itself stays world-readable:
- * unlisted is a capability URL, not a secret.
+ * Unlisted by default, unlike `artifacts share` (public by default). A transcript
+ * carries file paths, command output, error text, and whatever a tool printed —
+ * strictly more than a plan does — so it does not belong in the public `/<user>`
+ * gallery unless the operator asks for it with `--public`. The URL itself stays
+ * world-readable: unlisted is a capability URL, not a secret.
  */
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { spawnSync } from 'node:child_process';
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
-import { knownSecretValuesFromEnv } from '../lib/redact.js';
+import { knownSecretValuesFromEnv, redactEmails } from '../lib/redact.js';
 import { discoverSessions } from '../lib/session/discover.js';
 import { renderSessionHtmlDocument } from '../lib/session/share-html.js';
-import { publishFile, redactEmails } from '../lib/share/publish.js';
+import { resolveArtifactsBin, invocation, ArtifactsClientError } from '../lib/artifacts-client.js';
 import { renderSessionMarkdownDocument } from './sessions-render.js';
 import { selectSessions } from './sessions-export.js';
 import { parseAgentFilter } from './sessions.js';
@@ -35,23 +37,33 @@ export function defaultSessionSlug(session) {
     return `session-${session.shortId || session.id}`;
 }
 /**
- * Map the command's flags onto {@link PublishOptions}.
+ * Build the `artifacts share` argv for a session publish.
  *
- * Extracted so the defaults are testable directly. `unlisted` in particular is the
- * security-relevant one — it inverts the parent command's public-by-default
- * behavior, and a test that re-implements this mapping would still pass with it
- * flipped.
+ * Extracted so the mapping is testable directly. The security-relevant default
+ * is `--visibility unlisted` — it inverts `artifacts share`'s public default, and
+ * a test that re-implements this mapping would still pass with it flipped.
  */
-export function buildSharePublishOptions(session, options) {
-    return {
-        slug: options.slug ?? defaultSessionSlug(session),
-        unlisted: options.public !== true,
-        expire: options.expire,
-        force: options.force === true,
-        cover: options.cover !== false,
-        label: options.label,
-        meta: { kind: 'session' },
-    };
+export function buildArtifactsShareArgs(session, options, file) {
+    const args = [
+        'share',
+        file,
+        '--slug',
+        options.slug ?? defaultSessionSlug(session),
+        '--visibility',
+        options.public === true ? 'public' : 'unlisted',
+        '--meta',
+        'kind=session',
+        '--json',
+    ];
+    if (options.expire)
+        args.push('--expire', options.expire);
+    if (options.force === true)
+        args.push('--force');
+    if (options.cover === false)
+        args.push('--no-cover');
+    if (options.label)
+        args.push('--label', options.label);
+    return args;
 }
 export function registerSessionsShareCommand(sessionsCmd) {
     const cmd = sessionsCmd
@@ -59,7 +71,7 @@ export function registerSessionsShareCommand(sessionsCmd) {
         .description('Publish one session as a redacted, self-contained web page and print the link.')
         .option('--public', 'List the page in your public share gallery (default: unlisted capability URL)')
         .option('--slug <slug>', 'URL slug under your namespace (default: session-<shortId>)')
-        .option('--label <text>', 'Display title in the gallery and `agents artifacts share list`')
+        .option('--label <text>', 'Display title in the gallery and `artifacts share list`')
         .option('--expire <spec>', 'Auto-expire window: 30d, 12h, a date, or never (default: 30d)')
         .option('--reasoning <mode>', 'Reasoning visibility: omit, fold, or include', 'omit')
         .option('--force', 'Publish despite the sensitive-content scan flagging the transcript')
@@ -76,22 +88,23 @@ agents sessions share a1b2c3d4 --reasoning fold
 
 # A link that does not decay
 agents sessions share a1b2c3d4 --expire never`,
-        notes: `Requires a share endpoint: 'agents artifacts share status' shows it, 'agents artifacts setup'
-provisions one, 'agents artifacts share join <baseUrl>' uses an existing one.
+        notes: `Publishes through the standalone artifacts CLI — install it with
+'npm i -g @phnx-labs/artifacts-cli'. Sign in with
+'artifacts auth login' for the managed endpoint (zero Cloudflare setup), or configure
+your own bucket with 'artifacts share setup' / 'artifacts share join <baseUrl>'.
 
 Unlisted by default — the URL is world-readable but the page stays out of your public
-gallery and out of 'agents artifacts share list'. Pass --public to list it.
+gallery and out of 'artifacts share list'. Pass --public to list it.
 
-Secrets are redacted and the same pre-publish scan as 'agents artifacts share' runs on the
-page, so a transcript carrying emails or credential-shaped strings is refused
-unless you pass --force. --no-redact (the sessions-level flag) disables redaction
-and is a bad idea for anything you publish.
+Secrets are redacted and 'artifacts share' runs its own pre-publish scan on the page,
+so a transcript carrying emails or credential-shaped strings is refused unless you pass
+--force. --no-redact (the sessions-level flag) disables redaction and is a bad idea for
+anything you publish.
 
 Re-running with the same session updates the same URL and keeps the prior version
-as a revision ('agents artifacts share revisions <slug>').
+as a revision ('artifacts share revisions <slug>').
 
-Manage published sessions with 'agents artifacts share list' and
-'agents artifacts share delete <slug>'.`,
+Manage published sessions with 'artifacts share list' and 'artifacts share delete <slug>'.`,
     });
     cmd.action(async (selector, options, command) => {
         const globals = command.optsWithGlobals();
@@ -125,25 +138,60 @@ Manage published sessions with 'agents artifacts share list' and
         });
         // Emails on top of what the renderer masks. Almost every real transcript
         // carries a few — git author addresses, `gh api user`, a pasted log — and
-        // publishToEndpoint refuses a body containing any (RUSH-2428). Masking them
-        // means the published page genuinely does not carry them; the alternative,
-        // telling people to pass --force, would train everyone to bypass the gate
-        // that also catches real credentials.
+        // `artifacts share` refuses a body containing any (its own scan). Masking
+        // them means the published page genuinely does not carry them; the
+        // alternative, telling people to pass --force, trains everyone to bypass the
+        // gate that also catches real credentials.
         //
         // Applied to the RENDERED PAGE, not the Markdown, so the text that is masked
-        // is exactly the text `scanShareContent` will scan. Markdown escaping stands
+        // is exactly the text the publish scan will see. Markdown escaping stands
         // between the two: `foo\@example.com` hides from the pattern in the Markdown
         // and reappears as a live address once marked drops the backslash.
         const page = renderSessionHtmlDocument(session, markdown, { redacted: redact });
         const html = redact ? redactEmails(page) : page;
-        // A real file on disk is what publishFile() takes, and the OG capturer opens
-        // it in a browser. 0600 + a per-run directory keeps the intermediate off a
-        // world-readable /tmp path while it exists.
+        // A real file on disk is what `artifacts share` takes, and its OG capturer
+        // opens it in a browser. 0600 + a per-run directory keeps the intermediate
+        // off a world-readable /tmp path while it exists.
         const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-session-share-'));
         const file = path.join(dir, `${defaultSessionSlug(session)}.html`);
         try {
             fs.writeFileSync(file, html, { mode: 0o600 });
-            const result = await publishFile(file, buildSharePublishOptions(session, options));
+            let bin;
+            try {
+                bin = resolveArtifactsBin();
+            }
+            catch (err) {
+                if (err instanceof ArtifactsClientError) {
+                    process.stderr.write(chalk.red(err.message + '\n'));
+                    process.exitCode = 1;
+                    return;
+                }
+                throw err;
+            }
+            const { command: execCommand, prefix } = invocation(bin);
+            const args = [...prefix, ...buildArtifactsShareArgs(session, options, file)];
+            const proc = spawnSync(execCommand, args, { encoding: 'utf-8' });
+            if (proc.error)
+                throw proc.error;
+            if (proc.status !== 0) {
+                process.stderr.write(proc.stderr || chalk.red(`artifacts share exited ${proc.status ?? 'with no status'}\n`));
+                process.exitCode = proc.status ?? 1;
+                return;
+            }
+            let result;
+            try {
+                result = JSON.parse(proc.stdout);
+            }
+            catch {
+                // A 0 exit with non-JSON stdout (a version-skewed `artifacts` that
+                // printed a banner before the JSON, or one predating `--json` here) must
+                // fail loud with the bytes it actually returned, not an uncaught parse
+                // stack trace — mirroring `secrets-client.ts`'s `parseResponse`.
+                const preview = proc.stdout.trim().slice(0, 200);
+                process.stderr.write(chalk.red(`artifacts share returned a non-JSON response${preview ? `: ${preview}` : ' (empty output)'}\n`));
+                process.exitCode = 1;
+                return;
+            }
             if (globals.json) {
                 process.stdout.write(JSON.stringify({
                     session: session.id,
@@ -154,9 +202,10 @@ Manage published sessions with 'agents artifacts share list' and
                 return;
             }
             process.stdout.write(`${result.url}\n`);
-            const bits = [result.unlisted ? 'unlisted' : 'public', redact ? 'redacted' : chalk.red('NOT redacted')];
+            const visibility = result.visibility ?? (result.unlisted ? 'unlisted' : options.public ? 'public' : 'unlisted');
+            const bits = [visibility, redact ? 'redacted' : chalk.red('NOT redacted')];
             if (result.expiresAt)
-                bits.push(`expires ${result.expiresAt.slice(0, 10)}`);
+                bits.push(`expires ${String(result.expiresAt).slice(0, 10)}`);
             process.stderr.write(chalk.dim(`${bits.join(' · ')}\n`));
         }
         finally {

package/dist/commands/sessions.d.ts

@@ -1,13 +1,13 @@
 import { type Command } from 'commander';
 import { type ProjectDef } from '../lib/projects.js';
-import type { SessionAgentId, SessionMeta, ViewMode } from '../lib/session/types.js';
+import type { SessionAgentId, SessionEvent, SessionMeta, ViewMode } from '../lib/session/types.js';
 import { type ActiveSession } from '../lib/session/active.js';
 export { activeSessionProjectKey, backfillActiveRowsFromIndex, backfillActiveRowsFromMeta, isRunningLiveSession, serializeActiveSessionsForJson, serializeSessionsJson, type BackfillMeta } from '../lib/session/active.js';
 import { loadLocalActiveSessions } from '../lib/session/session-cache.js';
 import { gatherRemoteList, runOnPeer } from '../lib/session/remote-list.js';
 import { type RemoteAgentsJsonParseResult } from '../lib/remote-agents-json.js';
 import { type RunMeta } from '../lib/scheduling/routines.js';
-import { type PickedSession } from './sessions-picker.js';
+import { type PickedSession, type SessionPreviewDigest } from './sessions-picker.js';
 import { type ComputerRunRow } from '../lib/computer/sessions-list.js';
 import { type ToolSearchEnvelope, type ToolProgramCountEnvelope } from '../lib/session/tool-index.js';
 interface SessionFilterOptions {
@@ -466,6 +466,23 @@ export declare function printRoutineDrilldown(drill: RoutineDrilldown, liveIndex
     hiddenCount?: number;
     hiddenUnmanaged?: number;
 }): void;
+export interface SessionDetailMessage {
+    role: 'user' | 'assistant';
+    text: string;
+    at: string | null;
+}
+export declare function buildSessionDetailBlock(session: SessionMeta, digest: SessionPreviewDigest | undefined, events: SessionEvent[], sourceStamp?: {
+    fileMtimeMs: number;
+    fileSize: number;
+}): {
+    request: unknown;
+    timeline: unknown;
+    files: unknown;
+    messages: SessionDetailMessage[];
+    sourceRevision: string | null;
+    partial: boolean;
+    reason: string | null;
+};
 /** Resolve a session by id/query globally and print its compact preview (no pager).
  * Backs `--preview` — the fast path for the "peek before resume" hot loop. */
 export declare function renderSessionPreview(query: string, scope: {
@@ -474,6 +491,8 @@ export declare function renderSessionPreview(query: string, scope: {
     local?: boolean;
     hosts?: string[];
     json?: boolean;
+    refresh?: boolean;
+    revision?: string;
 }): Promise<void>;
 /**
  * The one-line live status banner shown above a session preview: the glyph, the