@phnx-labs/agents-cli 1.22.34 → 1.22.35

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.22.35
+
+- **`agents share delete` (alias `agents unshare`) takes down a published page (RUSH-2428).** `agents share` publishes to a public URL with no way to take one down — the Cloudflare Worker already implements an authed `DELETE`, the CLI just never exposed it. The new command accepts a full share URL, `<user>/<slug>`, or a bare `<slug>` (resolved against your own namespace exactly as publish does), takes several targets at once, and by default also deletes the sibling `<slug>.png` OG cover (`--keep-cover` opts out) — without it, republishing over a slug replaced the page but left the old cover screenshot publicly readable, which is what made a real takedown slow. `{"ok":true}` from the Worker is not treated as proof: a follow-up check must resolve 404 before the command reports success, and it errors loudly (non-zero) instead of if it can't verify the object is actually gone. An already-missing target is an error by default; `--if-exists` treats it as a no-op success. Source: `apps/cli/src/lib/share/delete.ts`, `apps/cli/src/commands/share.ts`.
+
+- **Codex `edit` runs can write under the repo's `.agents/` again.** Codex's `workspace-write` sandbox hardcodes any `.agents/` (and `.codex/`) directory as read-only, but agents-cli keeps every git worktree at `<repo>/.agents/worktrees/<slug>` — so a Codex session whose cwd was the repo root hit `EROFS: read-only file system` on any write into a worktree (a build's `dist/`, generated files) and then had to prompt for per-command approval to escalate. Every interactive, headless, and direct-launch Codex path now makes the run's `<repo-root>/.agents` writable: `agents run codex` (and the Windows shim delegate) add it to the `agents-edit` profile's `workspace_roots`, and the adopted POSIX `codex` shim resolves the repo's `.agents` from `$PWD` at run time (worktree-aware) and passes it via Codex's own `--add-dir`. (Routines use a separate overlay-HOME sandbox with their own `allow.dirs` and are unchanged.) Naming the `.agents` directory itself is the only override Codex honors — a nested sub-path makes bwrap refuse the mount. Only an existing `.agents` is added; out-of-workspace and `~/.config` writes stay gated, network unchanged. Source: `apps/cli/src/lib/codex-policy.ts`, `apps/cli/src/lib/project-key.ts`, `apps/cli/src/lib/exec.ts`, `apps/cli/src/lib/shims.ts`.
+
 ## 1.22.34
 
 - **A failed `agents teams add` no longer strands an `agents/<name>` branch that breaks every retry (RUSH-2356).** The worktree was created before the teammate record was persisted and nothing removed it when the add failed, so the next `teams add` with the same `--worktree` name died on `fatal: a branch named 'agents/<name>' already exists` — observed 2026-08-07, forcing three renames before a teammate could be created. Two guarantees now hold. Name uniqueness and the `--after` dependency graph are validated **before** `createWorktree` runs (`AgentManager.validateAddPreconditions`), so a duplicate name, unknown dependency, or cycle never creates a branch at all. A failure **after** the worktree exists — a missing harness CLI, a launch error, a cloud dispatch failure — removes the worktree and its branch before the command exits non-zero, and prints the exact `git worktree remove` / `git branch -D` pair if that teardown itself fails. Teardown is scoped twice over, because deleting a live teammate's worktree would destroy real work: only a worktree that same add created is a candidate, and only when no live teammate claims it (`AgentManager.isWorktreeClaimed`, a raw meta.json scan across every team, counting only non-terminal records). That second check matters because the add can fail *after* the record is durably saved — `spawn()` saves a staged teammate and only then runs the retention pass, which refreshes every sibling and can throw on a distributed one — so a teammate already recorded and waiting on an `--after` dependency keeps its worktree. If we can't prove a worktree is an orphan, it is left in place with the manual removal printed — the claim check **fails closed**, so an unreadable or half-written record answers "claimed" rather than "free": only a genuinely absent record (ENOENT) proves nothing claims the worktree, because the alternative error deletes a running teammate's uncommitted work. The pr-watch fixer path (`reactWithTeammate`) and a partially-failed `createWorktree` (branch ref created, checkout not) run the same guarded teardown — the fixer path matters because it stages its teammate with `--after` when it follows a source teammate, so it can reach the failure branch with a live, durably-recorded, merely-pending teammate already owning the worktree.

package/README.md

@@ -1122,6 +1122,7 @@ agents share setup                                  # once: provision bucket + W
 agents share plan.html --slug fleet --expire 30d    # → https://<base>/fleet
 agents share plan.html --json                       # URL object for plan-render hooks
 agents share status                                 # show the endpoint
+agents unshare fleet                                # take a published link (+ its OG cover) down
 ```
 
 `agents share` closes the loop: an agent makes work (a plan, a viz, a report),
@@ -1138,6 +1139,12 @@ publishes through it with a shared write token — `agents share join <baseUrl>`
 existing endpoint with no provisioning. `--expire 30d|12h|<date>` auto-expires a link.
 `--json` emits `{ url, coverUrl, expiresAt }` so plan-render automation can publish the
 rendered HTML and post the returned link without scraping terminal text.
+
+`agents share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
+full URL, `<user>/<slug>`, or a bare slug (resolved against your own namespace); several
+targets at once are fine. It also deletes the sibling `<slug>.png` OG cover by default
+(`--keep-cover` opts out) and verifies the page actually 404s before reporting success —
+the Worker's delete is idempotent, so `{"ok":true}` alone is never proof.
 See [docs/share.md](apps/cli/docs/share.md).
 
 ---

package/dist/commands/share.d.ts

@@ -1,7 +1,24 @@
 import type { Command } from 'commander';
 import { type CloudflareRequester } from '../lib/share/provision.js';
 import { type PublishResult } from '../lib/share/publish.js';
+import { deleteShare, type DeleteShareResult } from '../lib/share/delete.js';
 export declare function formatSharePublishResult(result: PublishResult, json?: boolean): string;
+export declare function formatShareDeleteResult(result: DeleteShareResult, json?: boolean): string;
+interface ShareDeleteCliOpts {
+    keepCover?: boolean;
+    ifExists?: boolean;
+    githubUser?: string;
+    json?: boolean;
+}
+/** Shared handler for `agents share delete <targets...>` and the top-level
+ * `agents unshare <targets...>` alias. Deletes each target independently and
+ * continues past a failed one (rm-style), reporting all results and exiting
+ * non-zero if any target failed to verify as gone.
+ *
+ * `deleteFn` is a DI seam for tests (defaults to the real `deleteShare`) — it is
+ * never exposed as a CLI flag, only used to inject a fake config/checker/deleter
+ * without touching the keychain or a live endpoint. */
+export declare function runShareDelete(targets: string[], opts: ShareDeleteCliOpts, deleteFn?: typeof deleteShare): Promise<void>;
 export declare function registerShareCommands(program: Command): void;
 /** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
  * endpoint config + write token. Shared by `agents share setup` and the unified
@@ -22,3 +39,4 @@ export declare function runShareProvision(opts: {
 export declare function runShareJoin(baseUrl?: string, opts?: {
     token?: string;
 }): Promise<void>;
+export {};

package/dist/commands/share.js

@@ -5,9 +5,11 @@ import chalk from 'chalk';
 import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, generateWriteToken, readCloudflareCreds, readShareConfig, readWriteTokenEnv, readWriteTokenFromBundle, storeWriteToken, writeShareConfig, } from '../lib/share/config.js';
 import { addCustomDomain, configureBucketLifecycle, createBucket, deployWorker, enableWorkersDev, findZoneId, setWorkerSecret, } from '../lib/share/provision.js';
 import { publishFile } from '../lib/share/publish.js';
+import { deleteShare } from '../lib/share/delete.js';
 import { renderWorkerScript } from '../lib/share/worker-template.js';
 import { analyticsEnabled } from '../lib/share/analytics.js';
 import { resolveGitHubUsername } from '../lib/git.js';
+import { setHelpSections } from '../lib/help.js';
 export function formatSharePublishResult(result, json = false) {
     if (json)
         return JSON.stringify(result, null, 2);
@@ -18,6 +20,84 @@ export function formatSharePublishResult(result, json = false) {
         lines.push(chalk.dim(`  expires ${new Date(result.expiresAt).toLocaleString()}`));
     return lines.join('\n');
 }
+export function formatShareDeleteResult(result, json = false) {
+    if (json)
+        return JSON.stringify(result, null, 2);
+    if (result.skipped)
+        return chalk.dim(`skipped — ${result.url} was already gone`);
+    const lines = [chalk.green(`deleted ${result.url}`)];
+    if (result.cover) {
+        lines.push(result.cover.existedBefore
+            ? chalk.dim(`  cover deleted ${result.cover.url}`)
+            : chalk.dim(`  cover (none) ${result.cover.url}`));
+    }
+    return lines.join('\n');
+}
+/** Shared handler for `agents share delete <targets...>` and the top-level
+ * `agents unshare <targets...>` alias. Deletes each target independently and
+ * continues past a failed one (rm-style), reporting all results and exiting
+ * non-zero if any target failed to verify as gone.
+ *
+ * `deleteFn` is a DI seam for tests (defaults to the real `deleteShare`) — it is
+ * never exposed as a CLI flag, only used to inject a fake config/checker/deleter
+ * without touching the keychain or a live endpoint. */
+export async function runShareDelete(targets, opts, deleteFn = deleteShare) {
+    const results = [];
+    for (const target of targets) {
+        try {
+            const result = await deleteFn(target, {
+                keepCover: opts.keepCover === true,
+                ifExists: opts.ifExists === true,
+                githubUser: opts.githubUser,
+            });
+            results.push({ target, result });
+            if (!opts.json)
+                console.log(formatShareDeleteResult(result));
+        }
+        catch (e) {
+            results.push({ target, error: e.message });
+            if (!opts.json)
+                console.error(chalk.red(`${target}: ${e.message}`));
+        }
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(results, null, 2));
+    }
+    if (results.some((r) => r.error)) {
+        process.exitCode = 1;
+    }
+}
+function registerShareDeleteOptions(cmd) {
+    return cmd
+        .option('--keep-cover', 'leave the sibling <slug>.png OG cover in place (default: delete it too)')
+        .option('--if-exists', 'treat an already-missing target as a no-op success instead of an error')
+        .option('--github-user <user>', 'GitHub username for resolving a bare-slug target (default: resolved from gh/git config)')
+        .option('--json', 'emit machine-readable results');
+}
+const SHARE_DELETE_EXAMPLES = `
+      # Delete by full URL — also takes down the sibling OG cover
+      agents share delete https://share.agents-cli.sh/octocat/my-plan-a1b2
+
+      # Delete by <user>/<slug>, or a bare slug in your own namespace
+      agents share delete octocat/my-plan-a1b2
+      agents unshare my-plan-a1b2
+
+      # Several at once
+      agents unshare my-plan-a1b2 old-report-9f3c
+
+      # Keep the cover image up (rare — you usually want both gone)
+      agents unshare my-plan-a1b2 --keep-cover
+
+      # Don't error if it's already gone
+      agents unshare my-plan-a1b2 --if-exists
+`;
+const SHARE_DELETE_NOTES = `
+  A follow-up GET is required to resolve 404 before this reports success — the
+  Worker's DELETE is idempotent and returns {"ok":true} even for a key that was
+  never there, so that response alone is never proof of a takedown.
+
+  agents share delete === agents unshare (same command, different name).
+`;
 export function registerShareCommands(program) {
     const shareCmd = program
         .command('share')
@@ -54,6 +134,34 @@ export function registerShareCommands(program) {
             process.exitCode = 1;
         }
     });
+    setHelpSections(shareCmd, {
+        examples: `
+      # Publish an HTML file — gets an auto OG cover + a shareable link
+      agents share ./out/plan.html
+
+      # Custom slug, expiring in 30 days
+      agents share ./out/report.html --slug q3-report --expire 30d
+${SHARE_DELETE_EXAMPLES}
+      # One-time setup (or join an existing endpoint)
+      agents share setup
+      agents share join https://share.agents-cli.sh
+    `,
+        notes: SHARE_DELETE_NOTES,
+    });
+    const shareDeleteCmd = registerShareDeleteOptions(shareCmd
+        .command('delete <targets...>')
+        .description('Take down a published page (and by default its OG cover). Verifies the page 404s before reporting success. Top-level alias: agents unshare.'));
+    setHelpSections(shareDeleteCmd, { examples: SHARE_DELETE_EXAMPLES, notes: SHARE_DELETE_NOTES });
+    shareDeleteCmd.action(async (targets, opts) => {
+        await runShareDelete(targets, opts);
+    });
+    const unshareCmd = registerShareDeleteOptions(program
+        .command('unshare <targets...>')
+        .description('Alias of `agents share delete` — take down a published page (and by default its OG cover).'));
+    setHelpSections(unshareCmd, { examples: SHARE_DELETE_EXAMPLES, notes: SHARE_DELETE_NOTES });
+    unshareCmd.action(async (targets, opts) => {
+        await runShareDelete(targets, opts);
+    });
     shareCmd
         .command('setup')
         .description('One-time: provision an R2 bucket + Worker on your Cloudflare and save the config.')

package/dist/lib/codex-policy.d.ts

@@ -1,7 +1,15 @@
 export type CodexPolicyMode = 'plan' | 'edit' | 'skip';
 export declare const CODEX_PLAN_PROFILE = "agents-plan";
 export declare const CODEX_EDIT_PROFILE = "agents-edit";
-export declare function codexEditWritableRoots(): string[];
+/**
+ * Writable roots for Codex's `edit` profile: the managed user `.agents` dir, the
+ * baseline toolchain caches, and — when `cwd` is inside a repo — that repo's
+ * `.agents` directory. The last entry is what lets an in-repo build write under
+ * `.agents/worktrees/`; Codex's `workspace-write` sandbox hardcodes `.agents/`
+ * read-only, and naming the directory as an explicit writable root is the only
+ * thing that overrides it (a nested sub-path does not — bwrap refuses the mount).
+ */
+export declare function codexEditWritableRoots(cwd?: string): string[];
 export declare function codexPermissionProfileConfig(mode: Exclude<CodexPolicyMode, 'skip'>, writableRoots?: string[]): string;
 /**
  * Canonical Codex safety policy used by every native launch path.

package/dist/lib/codex-policy.js

@@ -1,12 +1,27 @@
+import * as fs from 'fs';
 import { getUserAgentsDir } from './state.js';
 import { codexDefaultWritableRoots } from './permissions.js';
+import { repoAgentsDirForCwd } from './project-key.js';
 export const CODEX_PLAN_PROFILE = 'agents-plan';
 export const CODEX_EDIT_PROFILE = 'agents-edit';
 function unique(values) {
     return [...new Set(values)];
 }
-export function codexEditWritableRoots() {
-    return unique([getUserAgentsDir(), ...codexDefaultWritableRoots()]);
+/**
+ * Writable roots for Codex's `edit` profile: the managed user `.agents` dir, the
+ * baseline toolchain caches, and — when `cwd` is inside a repo — that repo's
+ * `.agents` directory. The last entry is what lets an in-repo build write under
+ * `.agents/worktrees/`; Codex's `workspace-write` sandbox hardcodes `.agents/`
+ * read-only, and naming the directory as an explicit writable root is the only
+ * thing that overrides it (a nested sub-path does not — bwrap refuses the mount).
+ */
+export function codexEditWritableRoots(cwd) {
+    const repoAgents = repoAgentsDirForCwd(cwd);
+    // Only widen the sandbox for a `.agents` that actually exists — most repos
+    // have none, and there is no point naming a directory that isn't there. (Codex
+    // tolerates a missing writable root, so this is tidiness, not a hard guard.)
+    const repoRoots = repoAgents && fs.existsSync(repoAgents) ? [repoAgents] : [];
+    return unique([getUserAgentsDir(), ...codexDefaultWritableRoots(), ...repoRoots]);
 }
 function inlineWorkspaceRoots(roots) {
     return roots.map((root) => `${JSON.stringify(root)} = true`).join(', ');

package/dist/lib/exec.js

@@ -939,7 +939,7 @@ export function buildExecCommand(options) {
     }
     if (options.agent === 'codex') {
         const policyMode = resolvedMode === 'plan' || resolvedMode === 'skip' ? resolvedMode : 'edit';
-        const writableRoots = [...codexEditWritableRoots(), ...(options.addDirs ?? [])];
+        const writableRoots = [...codexEditWritableRoots(options.cwd ?? process.cwd()), ...(options.addDirs ?? [])];
         cmd.push(...codexPolicyArgs(policyMode, writableRoots));
     }
     else if (resumeSpec && 'subcommand' in resumeSpec) {
@@ -1181,7 +1181,7 @@ export async function execShimPassthrough(agent, rawArgs, cwd, pinnedVersion) {
     // Match the POSIX shim: direct Codex launches default to the safe writable
     // profile, while later user arguments can still override native settings.
     const launchArgs = agent === 'codex'
-        ? ['-c', 'check_for_update_on_startup=false', ...codexPolicyArgs('edit')]
+        ? ['-c', 'check_for_update_on_startup=false', ...codexPolicyArgs('edit', codexEditWritableRoots(cwd))]
         : [];
     // Mint a launch id and export it as AGENT_LAUNCH_ID so the agent's SessionStart
     // hook records the same id — the join key that maps this launch to its exact

package/dist/lib/project-key.d.ts

@@ -31,6 +31,23 @@ export declare function projectKeyFromCwd(cwd?: string | null): string | undefin
  * non-project directory under it into one bogus "project".
  */
 export declare function repoRootForCwd(dir: string, home?: string): string | undefined;
+/**
+ * The main-repo `.agents` directory for a cwd, or `undefined` when the cwd is
+ * not inside a repo.
+ *
+ * For a worktree cwd (`…/<repo>/.agents/worktrees/<slug>[/sub]`) this resolves
+ * to the PRIMARY repo's `.agents` — the directory that actually holds the
+ * worktrees — so a run started anywhere in the repo can write into any worktree.
+ * For any other in-repo cwd it is `<repo-root>/.agents`.
+ *
+ * The single caller is Codex's `edit`-mode writable-root list: Codex's
+ * `workspace-write` sandbox hardcodes `.agents/` (and `.codex/`) as read-only,
+ * but naming the `.agents` directory itself as an explicit writable root
+ * overrides that — so an in-repo build/test never hits EROFS on a path under
+ * `.agents/worktrees/`. Filesystem-only (no `git` process): reuses the same
+ * worktree-segment fold as {@link projectKeyFromCwd}.
+ */
+export declare function repoAgentsDirForCwd(cwd?: string | null, home?: string): string | undefined;
 /**
  * Resolve the project key for a cwd **on this machine**: the repository it
  * belongs to when there is one (so a monorepo subdir like `<repo>/apps/cli`

package/dist/lib/project-key.js

@@ -61,6 +61,32 @@ export function repoRootForCwd(dir, home = os.homedir()) {
         current = parent;
     }
 }
+/**
+ * The main-repo `.agents` directory for a cwd, or `undefined` when the cwd is
+ * not inside a repo.
+ *
+ * For a worktree cwd (`…/<repo>/.agents/worktrees/<slug>[/sub]`) this resolves
+ * to the PRIMARY repo's `.agents` — the directory that actually holds the
+ * worktrees — so a run started anywhere in the repo can write into any worktree.
+ * For any other in-repo cwd it is `<repo-root>/.agents`.
+ *
+ * The single caller is Codex's `edit`-mode writable-root list: Codex's
+ * `workspace-write` sandbox hardcodes `.agents/` (and `.codex/`) as read-only,
+ * but naming the `.agents` directory itself as an explicit writable root
+ * overrides that — so an in-repo build/test never hits EROFS on a path under
+ * `.agents/worktrees/`. Filesystem-only (no `git` process): reuses the same
+ * worktree-segment fold as {@link projectKeyFromCwd}.
+ */
+export function repoAgentsDirForCwd(cwd, home) {
+    if (!cwd)
+        return undefined;
+    const norm = cwd.replace(/\\/g, '/').replace(/\/+$/, '').trim();
+    if (!norm)
+        return undefined;
+    const wtIdx = norm.indexOf(WORKTREE_SEGMENT);
+    const repoRoot = wtIdx > 0 ? norm.slice(0, wtIdx) : repoRootForCwd(norm, home);
+    return repoRoot ? path.join(repoRoot, '.agents') : undefined;
+}
 /**
  * Resolve the project key for a cwd **on this machine**: the repository it
  * belongs to when there is one (so a monorepo subdir like `<repo>/apps/cli`

package/dist/lib/share/delete.d.ts

@@ -0,0 +1,93 @@
+import { type ShareConfig } from './config.js';
+/** DI seam for tests — override the real HTTP DELETE. */
+export type DeleteFn = (url: string, headers: Record<string, string>) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+/** DI seam for tests — override the real HTTP existence check (HEAD). */
+export type CheckFn = (url: string) => Promise<{
+    status: number;
+}>;
+export interface DeleteEndpoint {
+    baseUrl: string;
+    token: string;
+}
+export interface ResolvedShareTarget {
+    /** R2 object key for the page, `<user>/<slug>`. */
+    key: string;
+    /** R2 object key for the sibling OG cover, `<user>/<slug>.png`. */
+    coverKey: string;
+}
+/**
+ * Normalize any of the three accepted target forms to the R2 key that publish
+ * would have written:
+ *   - a full share URL: `https://share.agents-cli.sh/<user>/<slug>`
+ *   - `<user>/<slug>`
+ *   - a bare `<slug>` — resolved against the caller's own namespace exactly as
+ *     `publishToEndpoint` resolves it at publish time (resolveShareUsername +
+ *     buildShareKey), so a bare slug always targets *your* published page.
+ *
+ * The URL and `<user>/<slug>` forms are taken as already the exact key a prior
+ * publish produced (no re-sanitizing) — only the bare-slug form runs through
+ * `buildShareKey`, because that's the one case where the slug hasn't already
+ * been normalized by a publish.
+ */
+export declare function resolveDeleteTarget(target: string, opts?: {
+    githubUser?: string;
+}): Promise<ResolvedShareTarget>;
+export interface DeleteObjectResult {
+    key: string;
+    url: string;
+    /** Whether the object resolved (non-404) before the DELETE was issued. */
+    existedBefore: boolean;
+    /** Whether the Worker's DELETE call itself reported ok. */
+    deleted: boolean;
+    /** The postcondition: a follow-up check resolved 404 after the DELETE. */
+    verified404: boolean;
+}
+/**
+ * Delete one R2 object behind the share Worker and assert the postcondition.
+ * `{"ok":true}` from the Worker is not evidence a page came down — R2 delete is
+ * idempotent, so a DELETE on a key that was never there also returns `ok:true`.
+ * This checks existence before (so callers can tell "deleted" from "was never
+ * there") and re-checks after (so callers can tell "deleted" from "still public").
+ */
+export declare function deleteObject(endpoint: DeleteEndpoint, key: string, opts?: {
+    deleter?: DeleteFn;
+    checker?: CheckFn;
+}): Promise<DeleteObjectResult>;
+export interface DeleteShareOptions {
+    /** Skip deleting the sibling `<slug>.png` OG cover (default: delete it too). */
+    keepCover?: boolean;
+    /** Treat an already-missing target as a no-op success instead of an error
+     * (mirrors SQL's `DROP ... IF EXISTS`). Default: missing target is an error. */
+    ifExists?: boolean;
+    /** Override the GitHub username used to resolve a bare-slug target. */
+    githubUser?: string;
+    /** DI seam for tests — override the persisted share endpoint config. */
+    config?: ShareConfig;
+    /** DI seam for tests — override the keychain-backed write token. */
+    writeToken?: string;
+    /** DI seam for tests — override the real HTTP DELETE. */
+    deleter?: DeleteFn;
+    /** DI seam for tests — override the real HTTP existence check. */
+    checker?: CheckFn;
+}
+export interface DeleteShareResult {
+    key: string;
+    url: string;
+    existedBefore: boolean;
+    verified404: boolean;
+    /** True when `ifExists` was set and the target was already gone — nothing ran. */
+    skipped?: boolean;
+    cover?: {
+        key: string;
+        url: string;
+        existedBefore: boolean;
+        verified404: boolean;
+    };
+}
+/** Delete one share target (page + by default its OG cover) and verify both
+ * are gone. Throws on an unverified takedown — never reports success for an
+ * object that still resolves. */
+export declare function deleteShare(target: string, opts?: DeleteShareOptions): Promise<DeleteShareResult>;

package/dist/lib/share/delete.js

@@ -0,0 +1,127 @@
+// The delete path for `agents share delete` / `agents unshare` — an authed DELETE
+// to the Worker, which already implements it (worker-template.ts). Mirrors
+// publish.ts: pure target-resolution logic is exported for tests, the network
+// calls (a status check + a delete) sit behind an injectable DI seam.
+//
+// The Worker's R2 delete is idempotent — DELETE on a key that never existed still
+// returns `{"ok":true}` — so `{"ok":true}` alone is never proof of a takedown.
+// Every delete here is followed by a status check that must observe 404 before
+// the operation is reported as successful.
+import { readShareConfig, readWriteToken } from './config.js';
+import { buildShareKey, resolveShareUsername } from './publish.js';
+/**
+ * Normalize any of the three accepted target forms to the R2 key that publish
+ * would have written:
+ *   - a full share URL: `https://share.agents-cli.sh/<user>/<slug>`
+ *   - `<user>/<slug>`
+ *   - a bare `<slug>` — resolved against the caller's own namespace exactly as
+ *     `publishToEndpoint` resolves it at publish time (resolveShareUsername +
+ *     buildShareKey), so a bare slug always targets *your* published page.
+ *
+ * The URL and `<user>/<slug>` forms are taken as already the exact key a prior
+ * publish produced (no re-sanitizing) — only the bare-slug form runs through
+ * `buildShareKey`, because that's the one case where the slug hasn't already
+ * been normalized by a publish.
+ */
+export async function resolveDeleteTarget(target, opts = {}) {
+    const trimmed = target.trim();
+    if (!trimmed)
+        throw new Error('Share target is empty.');
+    let key;
+    if (/^https?:\/\//i.test(trimmed)) {
+        const url = new URL(trimmed);
+        const segments = url.pathname
+            .replace(/^\/+|\/+$/g, '')
+            .split('/')
+            .filter(Boolean)
+            .map(decodeURIComponent);
+        if (segments.length < 2) {
+            throw new Error(`Not a share page URL (expected .../<user>/<slug>): ${trimmed}`);
+        }
+        key = segments.slice(0, 2).join('/');
+    }
+    else if (trimmed.includes('/')) {
+        const segments = trimmed.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+        if (segments.length !== 2) {
+            throw new Error(`Expected <user>/<slug>, got: ${trimmed}`);
+        }
+        key = segments.join('/');
+    }
+    else {
+        const username = await resolveShareUsername(opts);
+        key = buildShareKey(username, trimmed);
+    }
+    return { key, coverKey: `${key}.png` };
+}
+async function defaultCheck(url) {
+    const res = await fetch(url, { method: 'HEAD' });
+    return { status: res.status };
+}
+async function defaultDelete(url, headers) {
+    const res = await fetch(url, { method: 'DELETE', headers });
+    return { ok: res.ok, status: res.status };
+}
+/**
+ * Delete one R2 object behind the share Worker and assert the postcondition.
+ * `{"ok":true}` from the Worker is not evidence a page came down — R2 delete is
+ * idempotent, so a DELETE on a key that was never there also returns `ok:true`.
+ * This checks existence before (so callers can tell "deleted" from "was never
+ * there") and re-checks after (so callers can tell "deleted" from "still public").
+ */
+export async function deleteObject(endpoint, key, opts = {}) {
+    const url = `${endpoint.baseUrl.replace(/\/+$/, '')}/${key}`;
+    const check = opts.checker ?? defaultCheck;
+    const del = opts.deleter ?? defaultDelete;
+    const before = await check(url);
+    const existedBefore = before.status !== 404;
+    const r = await del(url, { authorization: `Bearer ${endpoint.token}` });
+    if (!r.ok) {
+        throw new Error(`Delete failed (${r.status}) for ${url}. Check the write token, or that 'agents share setup' completed.`);
+    }
+    const after = await check(url);
+    const verified404 = after.status === 404;
+    return { key, url, existedBefore, deleted: r.ok, verified404 };
+}
+/** Delete one share target (page + by default its OG cover) and verify both
+ * are gone. Throws on an unverified takedown — never reports success for an
+ * object that still resolves. */
+export async function deleteShare(target, opts = {}) {
+    const cfg = opts.config ?? readShareConfig();
+    if (!cfg) {
+        throw new Error("Not set up yet. Run 'agents share setup' (provision your own endpoint) or 'agents share join' (use an existing one).");
+    }
+    const token = opts.writeToken ?? readWriteToken();
+    const resolved = await resolveDeleteTarget(target, { githubUser: opts.githubUser });
+    const endpoint = { baseUrl: cfg.baseUrl, token };
+    const page = await deleteObject(endpoint, resolved.key, { deleter: opts.deleter, checker: opts.checker });
+    if (!page.existedBefore) {
+        if (opts.ifExists) {
+            return { key: page.key, url: page.url, existedBefore: false, verified404: page.verified404, skipped: true };
+        }
+        throw new Error(`Nothing to delete — ${page.url} was already not found. Pass --if-exists to treat this as a no-op instead of an error.`);
+    }
+    if (!page.verified404) {
+        throw new Error(`Delete reported success but ${page.url} still resolves — takedown NOT verified. Retry, or investigate the Worker/R2 directly.`);
+    }
+    const result = {
+        key: page.key,
+        url: page.url,
+        existedBefore: page.existedBefore,
+        verified404: page.verified404,
+    };
+    if (!opts.keepCover) {
+        const cover = await deleteObject(endpoint, resolved.coverKey, { deleter: opts.deleter, checker: opts.checker });
+        result.cover = {
+            key: cover.key,
+            url: cover.url,
+            existedBefore: cover.existedBefore,
+            verified404: cover.verified404,
+        };
+        // A missing cover is normal (non-HTML publishes, or --no-cover at publish
+        // time never made one) — only a cover that existed and is still up is a bug.
+        if (cover.existedBefore && !cover.verified404) {
+            throw new Error(`Cover delete reported success but ${cover.url} still resolves — takedown NOT verified. Retry, or pass --keep-cover and delete it manually.`);
+        }
+    }
+    return result;
+}

package/dist/lib/shims.js

@@ -236,6 +236,43 @@ function codexShimLaunchArgs() {
         ...codexPolicyArgs('edit'),
     ].map(shellQuote).join(' ');
 }
+/**
+ * The `exec` tail for a generated shim. For most agents this is a plain
+ * `exec "$BINARY"<launchArgs> "$@"`.
+ *
+ * Codex is special: its `workspace-write` sandbox hardcodes any `.agents/` (and
+ * `.codex/`) directory read-only, but agents-cli keeps every worktree at
+ * `<repo>/.agents/worktrees/<slug>`, so an in-repo build under a static
+ * shim would hit `EROFS`. The `agents run codex` path fixes this by adding
+ * `<repo>/.agents` to the profile's `workspace_roots` (see codexEditWritableRoots
+ * / repoAgentsDirForCwd), but a static shim has no cwd at generation time. So the
+ * shim resolves the repo's `.agents` from `$PWD` at RUN time — worktree-aware,
+ * mirroring repoAgentsDirForCwd — and passes it via Codex's own `--add-dir`
+ * (verified to compose with the `agents-edit` profile). The resolution is inline
+ * bash because the shim is the launch hot path and must not spawn Node to compute
+ * one directory. `--add-dir` is added only when the resolved `.agents` exists.
+ */
+function shimExecTail(agent, launchArgs) {
+    if (agent !== 'codex')
+        return `exec "$BINARY"${launchArgs} "$@"`;
+    return `_repo_agents=""
+case "$PWD" in
+  */.agents/worktrees/*) _repo_agents="\${PWD%%/.agents/worktrees/*}/.agents" ;;
+  *)
+    _d="$PWD"
+    # Stop before $HOME so a dotfiles repo at $HOME is not treated as the project
+    # root (mirrors repoRootForCwd's home exclusion in project-key.ts).
+    while [ -n "$_d" ] && [ "$_d" != "/" ] && [ "$_d" != "$HOME" ]; do
+      if [ -e "$_d/.git" ]; then _repo_agents="$_d/.agents"; break; fi
+      _d=$(dirname "$_d")
+    done
+    ;;
+esac
+if [ -n "$_repo_agents" ] && [ -d "$_repo_agents" ]; then
+  exec "$BINARY"${launchArgs} --add-dir "$_repo_agents" "$@"
+fi
+exec "$BINARY"${launchArgs} "$@"`;
+}
 function getAgentsBinForGeneratedShim() {
     return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'index.js');
 }
@@ -707,7 +744,7 @@ if [ "\$LAUNCH_SKIP" = "0" ]; then
   "\$AGENTS_BIN" sync --agent "\$AGENT" --agent-version "\$VERSION" --launch --cwd "\$PWD" --quiet 2>/dev/null || true
 fi
 
-exec "$BINARY"${launchArgs} "$@"
+${shimExecTail(agent, launchArgs)}
 `;
 }
 /**
@@ -1094,7 +1131,7 @@ if [ -z "$BINARY" ] || [ ! -x "$BINARY" ]; then
 fi
 ${managedEnv}
 
-exec "$BINARY"${launchArgs} "$@"
+${shimExecTail(agent, launchArgs)}
 `;
 }
 /**

package/dist/lib/startup/command-registry.js

@@ -268,6 +268,9 @@ export const COMMAND_LOADERS = {
     mailbox: [loadMailboxes],
     serve: [loadServe],
     share: [loadShare],
+    // `unshare` is a top-level convenience alias of `share delete` (see
+    // commands/share.ts) — same module, registered as its own program.command().
+    unshare: [loadShare],
     audit: [loadAudit],
     webhook: [loadWebhook],
     funnel: [loadFunnel],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.34",
+  "version": "1.22.35",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",