@phnx-labs/agents-cli 1.22.37 → 1.22.38

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 1.22.38
+
+- Webhook `stateTo` triggers and handlers now fire only on the delivery that actually moved a Linear issue INTO that state, not on every later update while it still sits there. Previously a `stateTo: Plan` handler re-matched on any subsequent `Issue/update` — a label edit, an assignee change, a description touch — because it checked the issue's *current* state instead of the transition, which accumulated 11 duplicate plan comments on one issue. It now additionally requires the delivery's `updatedFrom` to record a state change. (RUSH-2539)
+
+- **A new release home base no longer needs the provisioning profile hand-copied over (RUSH-2541).** `apps/cli/bin/embedded.provisionprofile` became a committed, tracked file in commit `2567004b4` (RUSH-2535), but `release.sh`'s home-base seed step and `signing-home-base-probe.sh`'s preflight both still checked only the home base's own on-disk working tree -- so a legitimately new home base (or one whose local checkout simply predated that commit) still reported "unprovisioned" or died at the sign step with a misleading "generate at developer.apple.com" message, even though `git fetch origin` (which both already run) had the file the whole time. Both now recover the blob from the freshly fetched `origin/<default>` ref when it is absent on disk, and the seed step fails loud with the correct recovery guidance (recover from git history; do not regenerate at Apple's portal) instead of limping forward on a warning. Source: `apps/cli/scripts/release.sh`, `apps/cli/scripts/signing-home-base-probe.sh`, `apps/cli/scripts/build-keychain-helper.sh`.
+
+- **`release.sh`'s home-base provisionprofile recovery no longer dies silently under `set -e` on a freshly bootstrapped checkout (RUSH-2541 follow-up).** The `DEFAULT_BRANCH="$(git symbolic-ref ...)"` assignment added to recover `embedded.provisionprofile` from `origin/<default>` ran under `home_base_wt_snippet`'s own `set -euo pipefail`; `git symbolic-ref` returns non-zero whenever `refs/remotes/origin/HEAD` is unset, which is the normal state of a checkout bootstrapped via `init && remote add && fetch` rather than `clone` -- plausibly a brand-new fleet home base, exactly the box this feature targets. Under `set -e` the bare failing assignment tripped errexit at that line, killing the whole home-base phase with zero output before even the "main" fallback on the next line ran. Guarded with `|| true`, matching the pattern `assert_signing_home_base` already established for the identical anti-pattern. Source: `apps/cli/scripts/release.sh`.
+
+- **Top-level `agents set` is removed — use `agents models set` (RUSH-2579).** `agents set claude@2.1.220 --model opus-5` moves to `agents models set claude@2.1.220 --model opus-5`, unchanged otherwise: same selector forms (`<agent>@<version>`, `<agent>:*`), same `--model`/`--mode` flags, same underlying `run.defaults` store (`agents config get run.<agent@version>.model` still reads it). `agents set` now reports `unknown command`. Source: `apps/cli/src/commands/models.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **BREAKING: `agents share` moved under a new `agents artifacts` group (RUSH-2580).**
+  `artifacts` is the noun and `share` the action on it, so the surface now reads
+  noun-then-action like the rest of the CLI. The whole subtree moved down one
+  level — `agents artifacts share <file>` publishes, and
+  `agents artifacts share list|delete|analytics|join|status|update` are unchanged
+  under it. The two provisioning doors collapsed into one:
+  `agents artifacts setup` replaces both `agents share setup` (flag-driven) and
+  `agents setup share` (the wizard). It runs the wizard only when no endpoint
+  flag is typed on a TTY; type any of `--bundle`/`--worker`/`--bucket`/
+  `--account`/`--token`/`--domain`/`--analytics-token`, or run non-interactively,
+  and it provisions directly with what you named. The top-level `agents share` group and the
+  `agents setup share` subcommand no longer exist; `share` is retired from
+  distance-1 auto-correct, so a stale invocation fails loudly instead of running a
+  neighbouring command. `agents unshare <targets...>` is unchanged and stays
+  top-level. Source: `apps/cli/src/commands/artifacts.ts`,
+  `apps/cli/src/commands/artifacts-setup.ts`, `apps/cli/src/commands/share.ts`,
+  `apps/cli/src/commands/setup.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+### Fixed
+
+- The daemon orphan reaper no longer terminates live agents after a tmux server restart. A missing tmux session is now treated as unknown; helper processes are reaped only when their pane owner is present and confirmed dead, or a harness-specific rule proves their declared spawner exited.
+
+- **`agents browser` stops leaving duplicate and orphan tabs behind (RUSH-2622).**
+  The `about:blank` that a bare `agents browser start` opens is now registered on
+  the task, so `done`/`stop` actually closes it — it never was, which made every
+  bare start leak one tab permanently. `agents browser start --url` now reclaims
+  a tab that an abandoned task is still holding on that exact URL instead of
+  opening a duplicate; a tab held by a live task, or one you opened yourself, is
+  never taken, and the new `--fresh` skips the reclaim entirely. Tasks also carry
+  a `lastActionAt` stamp in `tasks.json` now. Source:
+  `apps/cli/src/lib/browser/service.ts`, `apps/cli/src/lib/browser/types.ts`.
+
 ## 1.22.37
 
 - **`agents.yaml`'s five writers now emit identical bytes, closing the rest of the sync-blocking drift (RUSH-2505).**

package/README.md

@@ -1158,14 +1158,14 @@ Sources: a command's stdout (`--watch` / `--poll`), an HTTP endpoint (`--poll-ht
 
 ```bash
 # Publish an HTML artifact to a public link on your own Cloudflare R2 (~$0).
-agents share setup                                  # once: provision bucket + Worker on your CF
-agents share plan.html --slug fleet --expire 30d    # → https://<base>/fleet
-agents share plan.html --json                       # URL object for plan-render hooks
-agents share status                                 # show the endpoint
-agents unshare fleet                                # take a published link (+ its OG cover) down
+agents artifacts setup                                      # once: provision bucket + Worker on your CF
+agents artifacts share plan.html --slug fleet --expire 30d  # → https://<base>/fleet
+agents artifacts share plan.html --json                     # URL object for plan-render hooks
+agents artifacts share status                               # show the endpoint
+agents unshare fleet                                        # take a published link (+ its OG cover) down
 ```
 
-`agents share` closes the loop: an agent makes work (a plan, a viz, a report),
+`agents artifacts share` closes the loop: an agent makes work (a plan, a viz, a report),
 publishes it, and you open the link to see it. `setup` reads a Cloudflare API token
 from your `cloudflare.com` secrets bundle (or `--token`), creates an R2 bucket, uploads
 a tiny Worker, and enables the free `*.workers.dev` subdomain (or maps `--domain
@@ -1175,12 +1175,12 @@ the Worker (its R2 binding does the put, so the client needs no S3 keys); reads
 this is effectively free.
 
 **Fleet mode:** provision one endpoint, then every fleet / cloud / ephemeral agent
-publishes through it with a shared write token — `agents share join <baseUrl>` uses an
+publishes through it with a shared write token — `agents artifacts share join <baseUrl>` uses an
 existing endpoint with no provisioning. `--expire 30d|12h|<date>` auto-expires a link.
 `--json` emits `{ url, coverUrl, expiresAt }` so plan-render automation can publish the
 rendered HTML and post the returned link without scraping terminal text.
 
-`agents share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
+`agents artifacts share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
 full URL, `<user>/<slug>`, or a bare slug (resolved against your own namespace); several
 targets at once are fine. It also deletes the sibling `<slug>.png` OG cover by default
 (`--keep-cover` opts out) and verifies the page actually 404s before reporting success —

package/dist/bootstrap.js

@@ -254,6 +254,7 @@ Run and dispatch:
   logs [id]                       Show a run's log — host-dispatch task or session; -f to follow
   browser                         Automate a browser — navigate, click, screenshot, console, network
   pty                             Drive interactive terminal programs (REPLs, TUIs) via a persistent PTY session
+  artifacts                       Publish what an agent made (plans, reports, visuals) to a shareable link
 
 Observe (read the fleet — no store merge; aliases point at the real readers):
   feed / inbox                    Needs-you inbox (open blocks waiting on you)

package/dist/commands/artifacts-setup.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
+ * R2 + Worker) that backs `agents artifacts share`.
+ *
+ * One door, two modes, because it replaces two commands that used to be
+ * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
+ * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
+ * with no provisioning flags TYPED it runs the wizard (provision or join, and
+ * offers a Worker update when an endpoint already exists); with any provisioning
+ * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
+ * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
+ * single source of truth for provisioning.
+ *
+ * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
+ *
+ * Idempotent: re-running shows the current endpoint and offers to reconfigure.
+ */
+import type { Command } from 'commander';
+/**
+ * Interactive share setup. Returns true if the user configured (or already had)
+ * an endpoint, false if they skipped. Never throws on user cancel — callers
+ * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
+ */
+export declare function runShareWizard(): Promise<boolean>;
+/** Parsed `agents artifacts setup` options — the retired `agents share setup` flag set. */
+interface ArtifactsSetupOpts {
+    bundle: string;
+    worker: string;
+    bucket: string;
+    account?: string;
+    token?: string;
+    domain?: string;
+    analyticsToken?: string;
+}
+/** The provisioning flags, by their commander option-value keys. */
+declare const PROVISION_FLAGS: readonly ["bundle", "worker", "bucket", "account", "token", "domain", "analyticsToken"];
+/**
+ * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
+ * is driving the old `agents share setup` provisioning path rather than asking
+ * for the wizard.
+ *
+ * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
+ * PRESENCE proves nothing — the question is whether the user typed them, which
+ * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
+ * Reading presence alone would classify `agents artifacts setup --bundle
+ * cloudflare-work` as a wizard run and then silently provision against the
+ * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
+ * have no default, so presence is proof for them.
+ */
+export declare function isDirectProvisionRequest(opts: ArtifactsSetupOpts, wasTyped?: (flag: (typeof PROVISION_FLAGS)[number]) => boolean): boolean;
+/** Register `agents artifacts setup` under the parent `artifacts` command. */
+export declare function registerArtifactsSetupCommand(artifactsCmd: Command): void;
+export {};

package/dist/commands/{setup-share.js → artifacts-setup.js}

@@ -1,13 +1,22 @@
 /**
- * `agents setup share` — interactive wizard to configure the `agents share`
- * endpoint (Cloudflare R2 + Worker). A friendly front door over the existing
- * `agents share setup` (provision) and `agents share join` flows, reusing their
- * exact logic so there is a single source of truth for provisioning.
+ * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
+ * R2 + Worker) that backs `agents artifacts share`.
+ *
+ * One door, two modes, because it replaces two commands that used to be
+ * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
+ * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
+ * with no provisioning flags TYPED it runs the wizard (provision or join, and
+ * offers a Worker update when an endpoint already exists); with any provisioning
+ * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
+ * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
+ * single source of truth for provisioning.
+ *
+ * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
  *
  * Idempotent: re-running shows the current endpoint and offers to reconfigure.
  */
 import chalk from 'chalk';
-import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_WORKER_NAME, readShareConfig, } from '../lib/share/config.js';
+import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, readShareConfig, } from '../lib/share/config.js';
 import { runShareProvision, runShareJoin, runShareUpdate, shareTemplateStatus } from './share.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 /**
@@ -17,8 +26,9 @@ import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
  */
 export async function runShareWizard() {
     if (!isInteractiveTerminal()) {
-        console.error(chalk.red('agents setup share needs an interactive terminal. ' +
-            'Non-interactively, use `agents share setup` (provision) or `agents share join [url]`.'));
+        console.error(chalk.red('The artifact share wizard needs an interactive terminal. ' +
+            'Non-interactively, use `agents artifacts setup --account <id> --token <t>` (provision) ' +
+            'or `agents artifacts share join <baseUrl> --token <t>`.'));
         return false;
     }
     const existing = readShareConfig();
@@ -94,13 +104,49 @@ export async function runShareWizard() {
     await runShareJoin(baseUrl.trim());
     return true;
 }
-/** Register `agents setup share` under the parent `setup` command. */
-export function registerSetupShareCommand(setupCmd) {
-    setupCmd
-        .command('share')
-        .description('Configure the `agents share` endpoint (Cloudflare R2 + Worker) — provision your own or join one.')
-        .action(async () => {
+/** The provisioning flags, by their commander option-value keys. */
+const PROVISION_FLAGS = ['bundle', 'worker', 'bucket', 'account', 'token', 'domain', 'analyticsToken'];
+/**
+ * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
+ * is driving the old `agents share setup` provisioning path rather than asking
+ * for the wizard.
+ *
+ * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
+ * PRESENCE proves nothing — the question is whether the user typed them, which
+ * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
+ * Reading presence alone would classify `agents artifacts setup --bundle
+ * cloudflare-work` as a wizard run and then silently provision against the
+ * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
+ * have no default, so presence is proof for them.
+ */
+export function isDirectProvisionRequest(opts, wasTyped = () => false) {
+    if (opts.account || opts.token || opts.domain || opts.analyticsToken)
+        return true;
+    return PROVISION_FLAGS.some((flag) => wasTyped(flag));
+}
+/** Register `agents artifacts setup` under the parent `artifacts` command. */
+export function registerArtifactsSetupCommand(artifactsCmd) {
+    artifactsCmd
+        .command('setup')
+        .description('Provision (or join) the Cloudflare R2 + Worker endpoint that backs `agents artifacts share`.')
+        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
+        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
+        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
+        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
+        .option('--token <t>', 'Cloudflare API token (else read from the --bundle)')
+        .option('--domain <host>', `custom domain to map (default: ${DEFAULT_SHARE_DOMAIN}; workers.dev if zone is not visible)`)
+        .option('--analytics-token <token>', 'Cloudflare Web Analytics token to inject into published HTML pages')
+        .action(async (opts, cmd) => {
         try {
+            // Named endpoint details, or no terminal to prompt on, means provision
+            // directly — the wizard has nothing to ask that was not already given,
+            // and it would provision against its own hardcoded defaults, dropping
+            // whatever the caller named.
+            const wasTyped = (flag) => cmd.getOptionValueSource(flag) === 'cli';
+            if (isDirectProvisionRequest(opts, wasTyped) || !isInteractiveTerminal()) {
+                await runShareProvision(opts);
+                return;
+            }
             await runShareWizard();
         }
         catch (err) {

package/dist/commands/artifacts.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `agents artifacts` — the group that owns everything an agent publishes for a
+ * human to open: HTML plans, reports, rendered visuals, screenshots.
+ *
+ * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
+ * noun, `share` is the action on it, so the surface reads noun-then-action like
+ * the rest of the CLI:
+ *
+ *   agents artifacts share <file>          publish
+ *   agents artifacts share list|delete|analytics|join|status|update
+ *   agents artifacts setup                 provision (or join) the endpoint
+ *
+ * The subtree itself lives in commands/share.ts (publish + its subcommands) and
+ * commands/artifacts-setup.ts (the provisioning door); this module only assembles
+ * the group, so there is one place that says what `agents artifacts` contains.
+ */
+import type { Command } from 'commander';
+export declare function registerArtifactsCommands(program: Command): void;

package/dist/commands/artifacts.js

@@ -0,0 +1,58 @@
+/**
+ * `agents artifacts` — the group that owns everything an agent publishes for a
+ * human to open: HTML plans, reports, rendered visuals, screenshots.
+ *
+ * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
+ * noun, `share` is the action on it, so the surface reads noun-then-action like
+ * the rest of the CLI:
+ *
+ *   agents artifacts share <file>          publish
+ *   agents artifacts share list|delete|analytics|join|status|update
+ *   agents artifacts setup                 provision (or join) the endpoint
+ *
+ * The subtree itself lives in commands/share.ts (publish + its subcommands) and
+ * commands/artifacts-setup.ts (the provisioning door); this module only assembles
+ * the group, so there is one place that says what `agents artifacts` contains.
+ */
+import { setHelpSections } from '../lib/help.js';
+import { registerShareCommands, registerUnshareCommand } from './share.js';
+import { registerArtifactsSetupCommand } from './artifacts-setup.js';
+export function registerArtifactsCommands(program) {
+    const artifactsCmd = program
+        .command('artifacts')
+        .description('Publish agent-made artifacts (plans, reports, visuals) to your own Cloudflare R2 and get a shareable link (~$0).');
+    registerArtifactsSetupCommand(artifactsCmd);
+    registerShareCommands(artifactsCmd);
+    setHelpSections(artifactsCmd, {
+        examples: `
+      # One-time: provision your own endpoint (or join a teammate's)
+      agents artifacts setup
+      agents artifacts share join https://share.agents-cli.sh
+
+      # Publish — auto OG cover, default 30d expiry, shareable link
+      agents artifacts share ./out/plan.html
+
+      # What's live in your namespace, and taking one down
+      agents artifacts share list
+      agents unshare my-plan-a1b2
+
+      # Endpoint health, and pushing a new Worker template to it
+      agents artifacts share status
+      agents artifacts share update
+    `,
+        notes: `
+  agents artifacts share is the publish action; agents artifacts setup is the
+  one-time endpoint provisioning. It runs the interactive wizard only when you
+  type NO endpoint flag on a TTY; type any of --bundle/--worker/--bucket/
+  --account/--token/--domain/--analytics-token, or run non-interactively, and it
+  provisions directly with what you named.
+
+  agents unshare <targets...> stays a top-level alias of
+  agents artifacts share delete.
+
+  Full reference: apps/cli/docs/share.md.
+    `,
+    });
+    // Top-level, deliberately: see registerUnshareCommand in commands/share.ts.
+    registerUnshareCommand(program);
+}

package/dist/commands/browser.js

@@ -699,6 +699,7 @@ function registerTaskCommands(browser) {
         .option(TASK_OPTION_FLAG, 'Task name (auto-generated if omitted)')
         .option('-e, --endpoint <name>', 'Endpoint preset (defaults to the profile\'s default)')
         .option('-u, --url <url>', 'Open URL in first tab')
+        .option('--fresh', 'Always open a new tab, skipping the reclaim of a tab an abandoned task is holding on that URL')
         .option('--no-skills', 'Skip auto-discovery of site-specific SKILL.md from ~/.agents/skills/browser/domain-skills/')
         .option('--record', 'Start recording right after the tab opens (shorthand for `agents browser record start` as a follow-up)')
         .option('--fps <n>', 'Recording frames per second (with --record; 1–30, default 5)', (v) => parseInt(v, 10))
@@ -791,6 +792,7 @@ function registerTaskCommands(browser) {
             url: opts.url,
             endpoint: opts.endpoint,
             skipDomainSkill: opts.skills === false,
+            fresh: opts.fresh === true,
             // Forward the caller's identity: the browser daemon is shared, so it
             // cannot resolve who/which-run called `start`. `resolveActor()` runs
             // here in the CLI (the caller's process); `$AGENT_LAUNCH_ID` is the

package/dist/commands/exec.js

@@ -2699,7 +2699,7 @@ export function registerRunCommand(program) {
         // Profile carries provider auth; secrets bundles carry user-defined
         // values; --env is the per-invocation override. The share token is
         // best-effort: if it is not already in env or an unlocked bundle, unrelated
-        // runs keep working, and `agents share` itself still fails loudly on use.
+        // runs keep working, and `agents artifacts share` itself still fails loudly on use.
         const hasOverrides = profileEnv || accountEnv || autoShareEnv || options.secrets.length > 0 || userEnv;
         const env = hasOverrides
             ? { ...(profileEnv ?? {}), ...(accountEnv ?? {}), ...(autoShareEnv ?? {}), ...secretsEnv, ...(userEnv ?? {}) }

package/dist/commands/models.js

@@ -16,6 +16,8 @@ import { setTierOverride, clearTierOverride, listTierOverrides } from '../lib/mo
 import { getModelPricing } from '../lib/pricing/index.js';
 import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/width.js';
 import { wrapJoined } from './inspect.js';
+import { setHelpSections } from '../lib/help.js';
+import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
 const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid', 'pi'];
 /**
  * Agents that don't necessarily install under ~/.agents/versions (cursor ships
@@ -75,6 +77,71 @@ export function registerModelsCommand(program) {
             console.log(chalk.gray('  Permission modes (--mode plan|edit|auto|skip): `agents modes <agent>`'));
         }
     });
+    // `models set` — the ergonomic setter for per-agent/version run defaults. It
+    // reads and writes the same store as `agents config set run.<agent@version>.*`
+    // (agents.yaml -> run.defaults), so the two stay consistent — `set` is just the
+    // short front door, nested here because `models` owns model/mode concerns.
+    const set = models
+        .command('set [selector]')
+        .description('Set the default model/mode an agent version uses for `agents run`')
+        .option('--model <model>', 'Default model or model alias, forwarded via --model')
+        .option('--mode <mode>', "Default mode: plan, edit, auto, skip. 'full' accepted as alias for skip.")
+        .action((selector, options) => {
+        try {
+            const hasFlags = options.model !== undefined || options.mode !== undefined;
+            if (!selector) {
+                if (hasFlags) {
+                    throw new Error('Selector is required when passing --model/--mode. Example: agents models set claude@2.1.220 --model opus-5');
+                }
+                const entries = listRunDefaults();
+                if (entries.length === 0) {
+                    console.log(chalk.gray('No agent defaults configured.'));
+                    console.log(chalk.gray('Set one with: agents models set claude@2.1.220 --model opus-5'));
+                    return;
+                }
+                console.log(chalk.bold('Agent Defaults\n'));
+                for (const entry of entries) {
+                    console.log(`  ${formatRunDefaultEntry(entry)}`);
+                }
+                return;
+            }
+            if (!hasFlags) {
+                const parsed = parseRunDefaultSelector(selector);
+                const entry = listRunDefaults().find((e) => e.selector === parsed.selector);
+                if (!entry || (!entry.defaults.mode && !entry.defaults.model)) {
+                    console.log(chalk.gray(`No default set for ${parsed.selector}.`));
+                    console.log(chalk.gray(`Set one with: agents models set ${selector} --model <model>`));
+                    return;
+                }
+                console.log(`  ${formatRunDefaultEntry(entry)}`);
+                return;
+            }
+            const entry = setRunDefault(selector, {
+                ...(options.mode !== undefined ? { mode: options.mode } : {}),
+                ...(options.model !== undefined ? { model: options.model } : {}),
+            });
+            console.log(chalk.green('Set default:'));
+            console.log(`  ${formatRunDefaultEntry(entry)}`);
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    setHelpSections(set, {
+        examples: `
+      agents models set claude@2.1.220 --model opus-5
+      agents models set 'claude:*' --mode auto --model opus
+      agents models set claude@2.1.220
+      agents models set
+    `,
+        notes: `
+      Selectors use <agent>@<version> or <agent>:<version>; * matches all versions.
+      Exact selectors override wildcard selectors field by field.
+      Writes the same store as 'agents config set run.<agent@version>.*'. Explicit flags on
+      'agents run' always win over configured defaults.
+    `,
+    });
     // Override subcommands. These WRITE agents.yaml so the user never hand-edits it;
     // resolution is exact `<agent>@<version>` over `<agent>` over the auto guess.
     const tierDeprecation = chalk.yellow('Deprecation: `agents models tier` is replaced by `agents config set run.<agent@version>.tier.<tier>`.');

package/dist/commands/setup.js

@@ -20,7 +20,7 @@ import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPat
 import { setHelpSections } from '../lib/help.js';
 import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.js';
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
-import { registerSetupShareCommand, runShareWizard } from './setup-share.js';
+import { runShareWizard } from './artifacts-setup.js';
 import { registerSetupMineCommand } from './setup-mine.js';
 import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
@@ -355,10 +355,11 @@ export function registerSetupCommand(program) {
         .description('Set up agents-cli, or re-open the capability onboarding hub.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|share|mine|secrets|fleet`.
+    // Capability subcommands: `agents setup browser|computer|mine|secrets|fleet`.
+    // Share/artifact publishing is set up by `agents artifacts setup` (RUSH-2580);
+    // the hub below still offers it as a phase via runShareWizard.
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
-    registerSetupShareCommand(setupCmd);
     registerSetupMineCommand(setupCmd);
     registerSetupSecretsCommand(setupCmd);
     registerSetupFleetCommand(setupCmd);
@@ -386,7 +387,6 @@ export function registerSetupCommand(program) {
       # Set up a specific capability on its own
       agents setup browser
       agents setup computer
-      agents setup share
       agents setup secrets
       agents setup fleet
       agents setup watchdog
@@ -401,7 +401,7 @@ export function registerSetupCommand(program) {
       Capability setup can also be run any time on its own:
         agents setup browser    # detect a browser + create the default profile
         agents setup computer    # install the signed macOS helper + grant permissions
-        agents setup share       # provision or join a Cloudflare share endpoint
+        agents artifacts setup   # provision or join a Cloudflare share endpoint
         agents setup secrets     # choose secrets backend/policy defaults + import
         agents setup fleet       # discover Tailscale devices + configure SSH access
         agents setup watchdog    # choose which devices run the daemon watchdog pass

package/dist/commands/share.d.ts

@@ -57,8 +57,8 @@ interface ShareDeleteCliOpts {
     githubUser?: string;
     json?: boolean;
 }
-/** Shared handler for `agents share delete <targets...>` and the top-level
- * `agents unshare <targets...>` alias. Deletes each target independently and
+/** Shared handler for `agents artifacts share delete <targets...>` and the
+ * top-level `agents unshare <targets...>` alias. Deletes each target independently and
  * continues past a failed one (rm-style), reporting all results and exiting
  * non-zero if any target failed to verify as gone.
  *
@@ -66,10 +66,23 @@ interface ShareDeleteCliOpts {
  * never exposed as a CLI flag, only used to inject a fake config/checker/deleter
  * without touching the keychain or a live endpoint. */
 export declare function runShareDelete(targets: string[], opts: ShareDeleteCliOpts, deleteFn?: typeof deleteShare): Promise<void>;
-export declare function registerShareCommands(program: Command): void;
+/**
+ * Register the `share` subtree under its parent group — `agents artifacts share`
+ * (see commands/artifacts.ts). The top-level `agents unshare` alias is a sibling
+ * registration on the ROOT program, so it is {@link registerUnshareCommand}, not
+ * part of this subtree.
+ */
+export declare function registerShareCommands(artifactsCmd: Command): void;
+/**
+ * Register the top-level `agents unshare <targets...>` alias of
+ * `agents artifacts share delete`. It takes the ROOT program (not the artifacts
+ * group) because it is deliberately a top-level convenience verb — taking a page
+ * down is the one artifact action typed often enough to keep at the root.
+ */
+export declare function registerUnshareCommand(program: Command): void;
 /** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
- * endpoint config + write token. Shared by `agents share setup` and the unified
- * `agents setup share` wizard. */
+ * endpoint config + write token. Shared by both modes of `agents artifacts setup`
+ * (the flag-driven provision and the interactive wizard). */
 export declare function runShareProvision(opts: {
     bundle: string;
     worker: string;
@@ -101,8 +114,8 @@ export declare function runShareUpdate(opts?: {
     request?: CloudflareRequester;
 }): Promise<ShareUpdateResult>;
 /** Join an existing share endpoint (no provisioning): prompt for the endpoint
- * details + write token and persist them. Shared by `agents share join` and the
- * unified `agents setup share` wizard. */
+ * details + write token and persist them. Shared by `agents artifacts share join`
+ * and the `agents artifacts setup` wizard. */
 export declare function runShareJoin(baseUrl?: string, opts?: {
     token?: string;
 }): Promise<void>;