@phnx-labs/agents-cli 1.22.34 → 1.22.37

package/dist/lib/share/provision.js

@@ -3,6 +3,7 @@
 // lifecycle, uploads the Worker (with an R2 binding), sets the WRITE_TOKEN secret,
 // enables the free `*.workers.dev` subdomain, and — when the token owns the zone —
 // maps a custom domain.
+import { createHash } from 'node:crypto';
 const CF_API = 'https://api.cloudflare.com/client/v4';
 export const SHARE_LIFECYCLE_RULE_ID = 'agents-share-expire-objects';
 export const SHARE_LIFECYCLE_RETENTION_DAYS = 366;
@@ -95,6 +96,55 @@ export async function deployWorker(apiToken, accountId, workerName, script, buck
         form,
     });
 }
+/** sha256 of the rendered Worker script, so a deployed endpoint can be compared
+ * against the current `worker-template.ts` without redeploying to find out. */
+export function hashWorkerScript(script) {
+    return createHash('sha256').update(script, 'utf8').digest('hex');
+}
+/**
+ * Re-deploy the Worker script against an ALREADY-provisioned endpoint (same
+ * account/worker/bucket `deployWorker` was first called with) and idempotently
+ * no-op when the template hasn't changed.
+ *
+ * Cloudflare's script-upload endpoint (`deployWorker`, above) replaces the
+ * Worker's bindings/secrets wholesale on every call — there is no documented,
+ * reliable way to tell it "keep the existing secret" (the `keep_bindings`
+ * metadata field some third-party guides mention is absent from Cloudflare's
+ * current Multipart upload metadata reference, and the community has reported
+ * it not preventing binding loss even when present:
+ * https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/,
+ * https://community.cloudflare.com/t/upload-worker-module-endpoint-removes-existing-bindings-despite-keep-bindings/766447).
+ * So instead this immediately re-applies WRITE_TOKEN via the documented Secrets
+ * API right after the upload — the same two-call sequence first-time
+ * provisioning already uses (`deployWorker` then `setWorkerSecret`), except
+ * `writeToken` here is the caller's EXISTING token, never a freshly generated
+ * one. Cloudflare's own docs describe exactly this "secrets survive a
+ * subsequent write" contract for the sibling `wrangler versions upload
+ * --secrets-file` flow ("Secrets not included in the file are preserved from
+ * the previous version" —
+ * https://developers.cloudflare.com/workers/configuration/secrets/#upload-secrets-alongside-code);
+ * re-setting the secret to its own value after every deploy gets the same
+ * outcome without depending on an unverified upload-time flag.
+ */
+export async function updateWorker(apiToken, accountId, workerName, bucketName, script, writeToken, previousHash, opts = {}) {
+    const templateHash = hashWorkerScript(script);
+    if (!opts.force && previousHash === templateHash) {
+        return { templateHash, skipped: true };
+    }
+    await deployWorker(apiToken, accountId, workerName, script, bucketName, opts);
+    // Script upload clears bindings/secrets (see JSDoc above). If re-applying
+    // WRITE_TOKEN fails here, the live Worker has no write token — every
+    // `agents share` publish/delete 401s until a re-run of `agents share update`
+    // completes both steps. Surface that explicitly instead of the raw CF error.
+    try {
+        await setWorkerSecret(apiToken, accountId, workerName, writeToken, opts);
+    }
+    catch (e) {
+        const detail = e instanceof Error ? e.message : String(e);
+        throw new Error(`Worker deployed but the write token failed to re-apply — re-run \`agents share update\` to fix this before publishing/deleting anything. (${detail})`);
+    }
+    return { templateHash, skipped: false };
+}
 /** Add/update the WRITE_TOKEN binding using Cloudflare's Workers Secrets API. */
 export async function setWorkerSecret(apiToken, accountId, workerName, writeToken, opts = {}) {
     const request = opts.request ?? defaultCloudflareRequester;

package/dist/lib/share/publish.d.ts

@@ -10,9 +10,25 @@ export interface PublishEndpoint {
 }
 export interface PublishOptions {
     slug?: string;
-    /** e.g. `30d`, `12h`, or an absolute date like `2026-08-01`. */
+    /**
+     * Auto-expire window. Relative (`30d`, `12h`), absolute (`2026-08-01`), or
+     * `never` / `none` / `permanent` for no expiry. When omitted, publishes default
+     * to {@link DEFAULT_SHARE_EXPIRE} so an accidental share decays instead of
+     * living forever (RUSH-2443).
+     */
     expire?: string;
     contentType?: string;
+    /**
+     * Hide this page from the public `/<user>` gallery and `agents share list`
+     * (metadata `visibility=unlisted`). The direct URL is still world-readable —
+     * unlisted, not secret (RUSH-2443). Alias of `--private` on the CLI.
+     */
+    unlisted?: boolean;
+    /**
+     * Bypass the pre-publish sensitive-content scan (emails / credential-shaped
+     * strings). Required when the page intentionally carries those patterns.
+     */
+    force?: boolean;
     /** Generate + attach an OG cover for HTML pages (default true). */
     cover?: boolean;
     /** Inject the Cloudflare Web Analytics beacon (default true for HTML). */
@@ -34,9 +50,32 @@ export interface PublishResult {
     url: string;
     expiresAt?: string;
     coverUrl?: string;
+    /** True when the page was published with `visibility=unlisted`. */
+    unlisted?: boolean;
 }
+/** Default auto-expire for unflagged publishes — accidental links decay (RUSH-2443). */
+export declare const DEFAULT_SHARE_EXPIRE = "30d";
 /** `30d` / `12h` / `2026-08-01` → an absolute ISO timestamp (or undefined). */
 export declare function parseExpire(spec: string | undefined): string | undefined;
+/**
+ * Resolve the publish expiry. Omitted → {@link DEFAULT_SHARE_EXPIRE}. Explicit
+ * `never` / `none` / `permanent` → no expiry. Anything else → {@link parseExpire}.
+ */
+export declare function resolveExpire(spec: string | undefined): string | undefined;
+export type SensitiveHitKind = 'email' | 'credential';
+export interface SensitiveHit {
+    kind: SensitiveHitKind;
+    /** Short redacted sample so the error names *what* was found without dumping it. */
+    sample: string;
+}
+/**
+ * Scan a text body for email addresses and credential-shaped strings. Returns
+ * the first few hits (deduped by kind+sample). Binary / non-text bodies yield
+ * nothing — the gate is for HTML/text reports, not screenshots.
+ */
+export declare function scanShareContent(body: string | Buffer): SensitiveHit[];
+/** Build the refuse message when the pre-publish scan finds sensitive content. */
+export declare function formatSensitiveContentError(hits: SensitiveHit[]): string;
 /** Derive a URL-safe slug from a filename (or pass one through). */
 export declare function slugify(name: string): string;
 /** The project the file belongs to — git repo name, else the cwd's basename. */

package/dist/lib/share/publish.js

@@ -14,6 +14,8 @@ import { resolveGitHubUsername } from '../git.js';
 import { captureCover, OG_WIDTH, OG_HEIGHT, OG_SCALE } from './capture.js';
 import { deriveMeta, injectOgMeta } from './og.js';
 import { injectAnalyticsBeacon } from './analytics.js';
+/** Default auto-expire for unflagged publishes — accidental links decay (RUSH-2443). */
+export const DEFAULT_SHARE_EXPIRE = '30d';
 const UNIT_MS = { s: 1e3, m: 6e4, h: 36e5, d: 864e5, w: 6048e5 };
 /** `30d` / `12h` / `2026-08-01` → an absolute ISO timestamp (or undefined). */
 export function parseExpire(spec) {
@@ -26,7 +28,99 @@ export function parseExpire(spec) {
     const d = new Date(spec);
     if (!Number.isNaN(d.getTime()))
         return d.toISOString();
-    throw new Error(`Bad --expire '${spec}'. Use e.g. 30d, 12h, or an absolute date like 2026-08-01.`);
+    throw new Error(`Bad --expire '${spec}'. Use e.g. 30d, 12h, an absolute date like 2026-08-01, or 'never' for no expiry.`);
+}
+/**
+ * Resolve the publish expiry. Omitted → {@link DEFAULT_SHARE_EXPIRE}. Explicit
+ * `never` / `none` / `permanent` → no expiry. Anything else → {@link parseExpire}.
+ */
+export function resolveExpire(spec) {
+    if (spec === undefined)
+        return parseExpire(DEFAULT_SHARE_EXPIRE);
+    const trimmed = spec.trim().toLowerCase();
+    if (trimmed === 'never' || trimmed === 'none' || trimmed === 'permanent')
+        return undefined;
+    return parseExpire(spec);
+}
+/** Email addresses — the RUSH-2428 incident page carried seven of these. */
+const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+/**
+ * Credential-shaped strings that an agent routinely dumps into reports: GitHub
+ * PATs, OpenAI/Anthropic/etc. API keys, AWS access keys, Slack tokens, and a
+ * generic long `sk-…` / `Bearer …` form. Keep the set tight — false positives
+ * force `--force` and train agents to bypass the gate.
+ */
+const CREDENTIAL_PATTERNS = [
+    { re: /\bghp_[A-Za-z0-9_]{20,}\b/g, label: 'ghp_…' },
+    { re: /\bgho_[A-Za-z0-9_]{20,}\b/g, label: 'gho_…' },
+    { re: /\bghu_[A-Za-z0-9_]{20,}\b/g, label: 'ghu_…' },
+    { re: /\bghs_[A-Za-z0-9_]{20,}\b/g, label: 'ghs_…' },
+    { re: /\bghr_[A-Za-z0-9_]{20,}\b/g, label: 'ghr_…' },
+    { re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, label: 'github_pat_…' },
+    { re: /\bsk-(?:ant|proj|live|test)?[_-]?[A-Za-z0-9]{16,}\b/g, label: 'sk-…' },
+    { re: /\bAKIA[0-9A-Z]{16}\b/g, label: 'AKIA…' },
+    { re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, label: 'xox…' },
+    { re: /\bBearer\s+[A-Za-z0-9._\-+/=]{20,}\b/gi, label: 'Bearer …' },
+];
+function redactSample(raw, max = 12) {
+    if (raw.length <= max)
+        return raw.slice(0, 4) + '…';
+    return raw.slice(0, Math.min(6, max)) + '…';
+}
+/**
+ * Scan a text body for email addresses and credential-shaped strings. Returns
+ * the first few hits (deduped by kind+sample). Binary / non-text bodies yield
+ * nothing — the gate is for HTML/text reports, not screenshots.
+ */
+export function scanShareContent(body) {
+    // Skip clearly-binary content (null bytes in the first 1KB) so a PNG/MP4
+    // publish never false-positives on binary noise.
+    if (Buffer.isBuffer(body)) {
+        const head = body.subarray(0, Math.min(body.length, 1024));
+        if (head.includes(0))
+            return [];
+    }
+    const text = typeof body === 'string' ? body : body.toString('utf8');
+    const hits = [];
+    const seen = new Set();
+    for (const m of text.matchAll(EMAIL_RE)) {
+        const sample = redactSample(m[0]);
+        const key = `email:${sample}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        hits.push({ kind: 'email', sample });
+        if (hits.length >= 5)
+            return hits;
+    }
+    for (const { re, label } of CREDENTIAL_PATTERNS) {
+        re.lastIndex = 0;
+        const m = re.exec(text);
+        if (!m)
+            continue;
+        const sample = label;
+        const key = `credential:${sample}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        hits.push({ kind: 'credential', sample });
+        if (hits.length >= 5)
+            return hits;
+    }
+    return hits;
+}
+/** Build the refuse message when the pre-publish scan finds sensitive content. */
+export function formatSensitiveContentError(hits) {
+    const kinds = Array.from(new Set(hits.map((h) => h.kind)));
+    const samples = hits.map((h) => h.sample).join(', ');
+    const what = kinds.length === 2
+        ? 'email addresses and credential-shaped strings'
+        : kinds[0] === 'email'
+            ? 'email addresses'
+            : 'credential-shaped strings';
+    return (`Refusing to publish: the file contains ${what} (${samples}). ` +
+        `Shares are world-readable by URL — pass --force to publish anyway, ` +
+        `or --unlisted --expire 12h to bound the blast radius.`);
 }
 /** Derive a URL-safe slug from a filename (or pass one through). */
 export function slugify(name) {
@@ -176,7 +270,8 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     const username = await resolveShareUsername(opts);
     const slugPart = (opts.slug ?? defaultSlug(filePath)).replace(/^\/+/, '');
     const key = buildShareKey(username, slugPart);
-    const expiresAt = parseExpire(opts.expire);
+    const expiresAt = resolveExpire(opts.expire);
+    const unlisted = opts.unlisted === true;
     const pageUrl = `${endpoint.baseUrl.replace(/\/+$/, '')}/${key}`;
     const put = opts.uploader ??
         (async (u, b, h) => {
@@ -187,16 +282,29 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
         const h = { authorization: `Bearer ${endpoint.token}`, 'content-type': contentType };
         if (expiresAt)
             h['x-share-expires-at'] = expiresAt;
+        if (unlisted)
+            h['x-share-visibility'] = 'unlisted';
         return h;
     };
     let body = readFileSync(filePath);
     let coverUrl;
     const isHtml = /\.html?$/i.test(filePath);
+    // Pre-publish scan (RUSH-2443): refuse emails / credential-shaped strings
+    // unless --force. Runs on the raw file before analytics/cover mutation so a
+    // beacon injection never triggers a false positive. Binary media is a no-op.
+    if (opts.force !== true) {
+        const hits = scanShareContent(body);
+        if (hits.length > 0) {
+            throw new Error(formatSensitiveContentError(hits));
+        }
+    }
     // Analytics: cookieless CF Web Analytics beacon, injected for HTML by default.
     if (isHtml && opts.analytics !== false && opts.analyticsToken) {
         body = Buffer.from(injectAnalyticsBeacon(body.toString('utf8'), opts.analyticsToken), 'utf8');
     }
     // Cover: screenshot the page's hero → upload <slug>.png → inject og:image meta.
+    // Unlisted pages still get a cover (the direct URL is the capability), but the
+    // cover inherits visibility=unlisted so it is also omitted from the gallery.
     if (isHtml && opts.cover !== false) {
         const res = await attachOgCover(filePath, body, {
             pngUrl: `${pageUrl}.png`,
@@ -212,5 +320,10 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     if (!r.ok) {
         throw new Error(`Publish failed (${r.status}) for ${pageUrl}. Check the write token, or that 'agents share setup' completed.`);
     }
-    return { url: r.url ?? pageUrl, expiresAt, coverUrl };
+    return {
+        url: r.url ?? pageUrl,
+        expiresAt,
+        coverUrl,
+        ...(unlisted ? { unlisted: true } : {}),
+    };
 }

package/dist/lib/share/worker-template.js

@@ -7,7 +7,12 @@
 //   - GET  /<username>/<slug>  — public; streams the object from R2, 410s (and lazily
 //     deletes) once its expiry has passed. A bucket lifecycle rule is the durable
 //     sweeper; this is the immediate gate.
-//   - GET  /<username>         — public gallery of that user's shares.
+//   - GET  /<username>         — public gallery of that user's shares (HTML).
+//   - GET  /<username>?format=json — public machine-readable listing of that user's
+//     ACTIVE shares (`agents share list`). Same single-segment path as the HTML
+//     gallery and gated on the SAME "does <username>/ hold any object" check, so it
+//     only intercepts a genuine namespace — a legacy flat slug with ?format=json
+//     still serves its real content, never a fake empty listing.
 //   - GET  /<slug>             — backward-compat flat slug (legacy shares before
 //     per-user namespaces).
 //
@@ -35,22 +40,41 @@ export default {
         return json({ error: 'unauthorized' }, 401);
       }
       const expiresAt = request.headers.get('x-share-expires-at') || '';
+      // 'unlisted' hides the page from the public gallery + JSON listing while
+      // keeping the direct URL world-readable (capability URL, not secret).
+      const visibility = (request.headers.get('x-share-visibility') || '').toLowerCase();
       const contentType = request.headers.get('content-type') || 'text/html; charset=utf-8';
+      const customMetadata = {};
+      if (expiresAt) customMetadata['expires-at'] = expiresAt;
+      if (visibility === 'unlisted') customMetadata['visibility'] = 'unlisted';
       await env.BUCKET.put(path, request.body, {
         httpMetadata: { contentType },
-        customMetadata: expiresAt ? { 'expires-at': expiresAt } : {},
+        customMetadata,
       });
-      return json({ ok: true, url: url.origin + '/' + path, expiresAt: expiresAt || null }, 200);
+      return json({ ok: true, url: url.origin + '/' + path, expiresAt: expiresAt || null, unlisted: visibility === 'unlisted' }, 200);
     }
 
     if (request.method === 'GET' || request.method === 'HEAD') {
-      // Single-segment path may be a user gallery OR a legacy flat slug.
+      // Single-segment path may be a user gallery/listing OR a legacy flat slug.
+      // The disambiguator is whether the <seg>/ prefix holds any object: only a
+      // genuine per-user namespace does. BOTH the HTML gallery and the
+      // machine-readable listing gate on it, so ?format=json on a legacy flat
+      // slug (an object stored at the bare key, before per-user namespaces) does
+      // NOT hijack it into a fake empty listing — it falls through to the object
+      // GET below and serves its real content, exactly as before.
       const segments = path.split('/').filter(Boolean);
       if (segments.length === 1) {
         const list = await env.BUCKET.list({ prefix: segments[0] + '/', limit: 1 });
-        if (list.objects && list.objects.length > 0) {
-          return renderGallery(env.BUCKET, url.origin, segments[0], request.method);
+        const isNamespace = list.objects && list.objects.length > 0;
+        if (isNamespace) {
+          return url.searchParams.get('format') === 'json'
+            ? renderListing(env.BUCKET, url.origin, segments[0], request.method)
+            : renderGallery(env.BUCKET, url.origin, segments[0], request.method);
         }
+        // Not a namespace: fall through. A legacy flat-slug object resolves to its
+        // real content; anything else 404s (an empty/nonexistent namespace, which
+        // agents share list reads as "nothing published" via the template-hash
+        // signal rather than a missing route).
       }
 
       const obj = await env.BUCKET.get(path);
@@ -90,6 +114,8 @@ async function renderGallery(bucket, origin, user, method) {
 
   const activeObjects = objects.filter(o => {
     if (o.key.endsWith('.png')) return false;
+    // Unlisted pages are reachable by direct URL only — never on the gallery.
+    if (o.customMetadata && o.customMetadata.visibility === 'unlisted') return false;
     const expiresAt = o.customMetadata && o.customMetadata['expires-at'];
     return !(expiresAt && Date.now() > Date.parse(expiresAt));
   });
@@ -124,6 +150,45 @@ async function renderGallery(bucket, origin, user, method) {
   return new Response(html, { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'public, max-age=60' } });
 }
 
+async function renderListing(bucket, origin, user, method) {
+  const objects = [];
+  let cursor;
+  do {
+    const list = await bucket.list({ prefix: user + '/', limit: 1000, cursor, include: ['httpMetadata', 'customMetadata'] });
+    objects.push(...(list.objects || []));
+    cursor = list.truncated ? list.cursor : undefined;
+  } while (cursor);
+
+  const now = Date.now();
+  const items = objects
+    .filter(o => {
+      // Mirror the gallery: hide sibling .png OG covers, expired pages, and
+      // unlisted pages — the listing is the machine-readable public surface.
+      if (o.key.endsWith('.png')) return false;
+      if (o.customMetadata && o.customMetadata.visibility === 'unlisted') return false;
+      const expiresAt = o.customMetadata && o.customMetadata['expires-at'];
+      return !(expiresAt && now > Date.parse(expiresAt));
+    })
+    .map(o => ({
+      slug: o.key.slice(o.key.indexOf('/') + 1),
+      url: origin + '/' + o.key,
+      size: typeof o.size === 'number' ? o.size : 0,
+      contentType: (o.httpMetadata && o.httpMetadata.contentType) || null,
+      publishedAt: new Date(o.uploaded).toISOString(),
+      expiresAt: (o.customMetadata && o.customMetadata['expires-at']) || null,
+    }));
+  // Newest first, so the human table and any script reads the freshest share top.
+  items.sort((a, b) => (a.publishedAt < b.publishedAt ? 1 : a.publishedAt > b.publishedAt ? -1 : 0));
+
+  if (method === 'HEAD') {
+    return new Response(null, { status: 200, headers: { 'content-type': 'application/json; charset=utf-8' } });
+  }
+  return new Response(JSON.stringify({ user, count: items.length, objects: items }), {
+    status: 200,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'public, max-age=30' },
+  });
+}
+
 function escapeHtml(s) {
   return String(s)
     .replace(/&/g, '&amp;')

package/dist/lib/shims.d.ts

@@ -77,7 +77,7 @@ export interface ConflictInfo {
  *         top-level entry add/remove — deep edits to plugin contents won't
  *         trigger auto-resync, run `agents sync` for that.
  */
-export declare const SHIM_SCHEMA_VERSION = 29;
+export declare const SHIM_SCHEMA_VERSION = 30;
 /**
  * Generate the full bash shim script for the given agent. The returned string
  * is written to ~/.agents/shims/{cliCommand} and made executable.
@@ -159,8 +159,22 @@ export declare function removeShim(agent: AgentId): boolean;
  *        alias failed with "not installed" whenever the binary was staged into
  *        the versioned home (installer run with GROK_HOME set, or grok
  *        self-update under the shim).
- */
-export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 15;
+ *  v16 — RUSH-2459: two compounding grok binary-resolution bugs fixed. (1) The
+ *        "exact version match" grep ran against `ls`'s FULL PATH output, and
+ *        the versioned home's own path always contains the version string
+ *        (.../versions/grok/<version>/...), so it matched every candidate
+ *        unconditionally and silently degraded to "whatever ls sorts first" —
+ *        now matched against each candidate's basename instead. (2) When no
+ *        filename genuinely carries the version, the fallback no longer
+ *        trusts whatever sorts first: it rejects any grok-* candidate under
+ *        1MB (real grok binaries are ~100MB+; a stray wrapper/alias script is
+ *        a few hundred bytes) and prefers the most recently modified
+ *        survivor. On yosemite-s0 both bugs fired together: a stale, unrelated
+ *        grok-0.2.118-* file — a 99-byte wrapper that exec'd cursor-agent —
+ *        sorted alphabetically before the real self-updated grok binary and
+ *        was silently launched instead.
+ */
+export declare const VERSIONED_ALIAS_SCHEMA_VERSION = 16;
 /**
  * Agents whose config directory can be relocated by an environment variable
  * (the per-agent `managedEnv` block in `generateVersionedAliasScript` below).