@phnx-labs/agents-cli 1.22.37 → 1.22.39

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## 1.22.39
+
+- **The auto-detected `default` browser profile no longer sits in the fleet-shared `agents.yaml`, which was wedging `agents repos pull user` fleet-wide (RUSH-2161).** `browser` is a central key because named profiles a user creates are real fleet config, but the one `default` entry inside it is machine-local: its `binary` is an OS-specific path and its endpoint is a locally chosen free port. `createProfile`/`updateProfile` have routed that entry to the per-device file since 1.22.38 (`isMachineLocalProfile`), but nothing removed the copy older versions had already written into the shared file, and `serializeCentral` could not — it deletes whole device-scoped KEYS, and `browser` is not one. So the stale entry stayed committed and every box rewrote it with its own browser. Measured across three boxes all running 1.22.38: zion `chrome` + `/Applications/Google Chrome.app/...`, yosemite-s1 `brave` + `/opt/brave.com/brave/brave`, mark-1 the same shape, each with an empty `deviceBrowser`. Because the pull refuses when an incoming change touches a locally modified path, a permanently dirty `agents.yaml` blocked fleet config sync outright — those boxes sat 5, 8 and 79 commits behind, so merged config (a `notify.owner` block, device roles) reached zero machines. A new migration moves the entry into `devices/<machine>/agents.yaml` and deletes it from central, writing the device file first so a crash cannot lose the profile and keeping an existing device entry when one is already there. Central is edited through a YAML `Document`, so the hand-written comments in the committed file survive rather than being flattened by a re-stringify — which would have re-created the same churn. Named profiles are untouched. Source: `apps/cli/src/lib/migrate.ts`, `apps/cli/src/bootstrap.ts`.
+
+- **`agents config set devices.<name>.tmux off` turns the interactive tmux wrap off for one machine (RUSH-2620).** Interactive `agents run` wraps the harness in the shared-socket tmux session so every agent gets an addressable `%pane` — that is what lets `agents sessions --active` tell co-located agents apart and `agents focus` re-attach without forking. Until now the only ways out were per-run (`--raw` / `--no-tmux` / `--disable-tmux`) or the `AGENTS_NO_TMUX=1` env var, so a box whose tmux is broken needed the flag retyped on every launch. The new key is machine-local by design (a broken tmux is a property of one machine): it never enters the fleet-shared `agents.yaml` and is refused for a peer. Unset still means wrap. `agents devices config <name> tmux.enabled off` sets the same key. Source: `apps/cli/src/lib/device-config.ts` (`isTmuxEnabled`), `apps/cli/src/lib/exec.ts` (`shouldWrapInTmux`).
+
+- **`agents devices role <name> worker` marks which boxes agents run on, and `--device auto` follows it.** Roles are fleet-wide (`worker` / `personal`), stored in the shared `fleet.devices.<name>.config.role` block of `~/.agents/agents.yaml`, so a mark set on any box travels with `agents repo push/pull` — the per-device files under `~/.agents/devices/` are written only by the machine they name, so they could never carry a fleet-wide statement about a different box. Marking ANY device `worker` turns automatic placement into an allowlist: `agents run --device auto`, `agents teams add --device auto`, and the AGI EXT launch commands then pick only from the marked workers. A device marked `personal` (a machine you sit at) is never picked automatically, under any mode, and a paired cockpit stays excluded through its existing registry `control` role. When roles leave the pool empty, `--device auto` fails loud naming the fix instead of quietly running on the local machine — through `agents ssh auto` and the `--host auto` passthrough too, not just `agents run`. Nothing marked = today's behavior, every online device. Widen it back with `agents config set auto.pool all`. `agents devices role` with no arguments prints who is marked what and exactly which devices `--device auto` would consider; `agents devices list` tags marked rows and `--json` carries `role` plus an `autoPool` boolean per device. Source: `apps/cli/src/lib/devices/pool.ts`, `apps/cli/src/lib/device-config.ts`, `apps/cli/src/lib/smart-launch.ts`.
+
+## 1.22.38
+
+- Webhook `stateTo` triggers and handlers now fire only on the delivery that actually moved a Linear issue INTO that state, not on every later update while it still sits there. Previously a `stateTo: Plan` handler re-matched on any subsequent `Issue/update` — a label edit, an assignee change, a description touch — because it checked the issue's *current* state instead of the transition, which accumulated 11 duplicate plan comments on one issue. It now additionally requires the delivery's `updatedFrom` to record a state change. (RUSH-2539)
+
+- **A new release home base no longer needs the provisioning profile hand-copied over (RUSH-2541).** `apps/cli/bin/embedded.provisionprofile` became a committed, tracked file in commit `2567004b4` (RUSH-2535), but `release.sh`'s home-base seed step and `signing-home-base-probe.sh`'s preflight both still checked only the home base's own on-disk working tree -- so a legitimately new home base (or one whose local checkout simply predated that commit) still reported "unprovisioned" or died at the sign step with a misleading "generate at developer.apple.com" message, even though `git fetch origin` (which both already run) had the file the whole time. Both now recover the blob from the freshly fetched `origin/<default>` ref when it is absent on disk, and the seed step fails loud with the correct recovery guidance (recover from git history; do not regenerate at Apple's portal) instead of limping forward on a warning. Source: `apps/cli/scripts/release.sh`, `apps/cli/scripts/signing-home-base-probe.sh`, `apps/cli/scripts/build-keychain-helper.sh`.
+
+- **`release.sh`'s home-base provisionprofile recovery no longer dies silently under `set -e` on a freshly bootstrapped checkout (RUSH-2541 follow-up).** The `DEFAULT_BRANCH="$(git symbolic-ref ...)"` assignment added to recover `embedded.provisionprofile` from `origin/<default>` ran under `home_base_wt_snippet`'s own `set -euo pipefail`; `git symbolic-ref` returns non-zero whenever `refs/remotes/origin/HEAD` is unset, which is the normal state of a checkout bootstrapped via `init && remote add && fetch` rather than `clone` -- plausibly a brand-new fleet home base, exactly the box this feature targets. Under `set -e` the bare failing assignment tripped errexit at that line, killing the whole home-base phase with zero output before even the "main" fallback on the next line ran. Guarded with `|| true`, matching the pattern `assert_signing_home_base` already established for the identical anti-pattern. Source: `apps/cli/scripts/release.sh`.
+
+- **Top-level `agents set` is removed — use `agents models set` (RUSH-2579).** `agents set claude@2.1.220 --model opus-5` moves to `agents models set claude@2.1.220 --model opus-5`, unchanged otherwise: same selector forms (`<agent>@<version>`, `<agent>:*`), same `--model`/`--mode` flags, same underlying `run.defaults` store (`agents config get run.<agent@version>.model` still reads it). `agents set` now reports `unknown command`. Source: `apps/cli/src/commands/models.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **BREAKING: `agents share` moved under a new `agents artifacts` group (RUSH-2580).**
+  `artifacts` is the noun and `share` the action on it, so the surface now reads
+  noun-then-action like the rest of the CLI. The whole subtree moved down one
+  level — `agents artifacts share <file>` publishes, and
+  `agents artifacts share list|delete|analytics|join|status|update` are unchanged
+  under it. The two provisioning doors collapsed into one:
+  `agents artifacts setup` replaces both `agents share setup` (flag-driven) and
+  `agents setup share` (the wizard). It runs the wizard only when no endpoint
+  flag is typed on a TTY; type any of `--bundle`/`--worker`/`--bucket`/
+  `--account`/`--token`/`--domain`/`--analytics-token`, or run non-interactively,
+  and it provisions directly with what you named. The top-level `agents share` group and the
+  `agents setup share` subcommand no longer exist; `share` is retired from
+  distance-1 auto-correct, so a stale invocation fails loudly instead of running a
+  neighbouring command. `agents unshare <targets...>` is unchanged and stays
+  top-level. Source: `apps/cli/src/commands/artifacts.ts`,
+  `apps/cli/src/commands/artifacts-setup.ts`, `apps/cli/src/commands/share.ts`,
+  `apps/cli/src/commands/setup.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+### Fixed
+
+- The daemon orphan reaper no longer terminates live agents after a tmux server restart. A missing tmux session is now treated as unknown; helper processes are reaped only when their pane owner is present and confirmed dead, or a harness-specific rule proves their declared spawner exited.
+
+- **`agents browser` stops leaving duplicate and orphan tabs behind (RUSH-2622).**
+  The `about:blank` that a bare `agents browser start` opens is now registered on
+  the task, so `done`/`stop` actually closes it — it never was, which made every
+  bare start leak one tab permanently. `agents browser start --url` now reclaims
+  a tab that an abandoned task is still holding on that exact URL instead of
+  opening a duplicate; a tab held by a live task, or one you opened yourself, is
+  never taken, and the new `--fresh` skips the reclaim entirely. Tasks also carry
+  a `lastActionAt` stamp in `tasks.json` now. Source:
+  `apps/cli/src/lib/browser/service.ts`, `apps/cli/src/lib/browser/types.ts`.
+
 ## 1.22.37
 
 - **`agents.yaml`'s five writers now emit identical bytes, closing the rest of the sync-blocking drift (RUSH-2505).**

package/README.md

@@ -1158,14 +1158,14 @@ Sources: a command's stdout (`--watch` / `--poll`), an HTTP endpoint (`--poll-ht
 
 ```bash
 # Publish an HTML artifact to a public link on your own Cloudflare R2 (~$0).
-agents share setup                                  # once: provision bucket + Worker on your CF
-agents share plan.html --slug fleet --expire 30d    # → https://<base>/fleet
-agents share plan.html --json                       # URL object for plan-render hooks
-agents share status                                 # show the endpoint
-agents unshare fleet                                # take a published link (+ its OG cover) down
+agents artifacts setup                                      # once: provision bucket + Worker on your CF
+agents artifacts share plan.html --slug fleet --expire 30d  # → https://<base>/fleet
+agents artifacts share plan.html --json                     # URL object for plan-render hooks
+agents artifacts share status                               # show the endpoint
+agents unshare fleet                                        # take a published link (+ its OG cover) down
 ```
 
-`agents share` closes the loop: an agent makes work (a plan, a viz, a report),
+`agents artifacts share` closes the loop: an agent makes work (a plan, a viz, a report),
 publishes it, and you open the link to see it. `setup` reads a Cloudflare API token
 from your `cloudflare.com` secrets bundle (or `--token`), creates an R2 bucket, uploads
 a tiny Worker, and enables the free `*.workers.dev` subdomain (or maps `--domain
@@ -1175,12 +1175,12 @@ the Worker (its R2 binding does the put, so the client needs no S3 keys); reads
 this is effectively free.
 
 **Fleet mode:** provision one endpoint, then every fleet / cloud / ephemeral agent
-publishes through it with a shared write token — `agents share join <baseUrl>` uses an
+publishes through it with a shared write token — `agents artifacts share join <baseUrl>` uses an
 existing endpoint with no provisioning. `--expire 30d|12h|<date>` auto-expires a link.
 `--json` emits `{ url, coverUrl, expiresAt }` so plan-render automation can publish the
 rendered HTML and post the returned link without scraping terminal text.
 
-`agents share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
+`agents artifacts share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
 full URL, `<user>/<slug>`, or a bare slug (resolved against your own namespace); several
 targets at once are fine. It also deletes the sibling `<slug>.png` OG cover by default
 (`--keep-cover` opts out) and verifies the page actually 404s before reporting success —

package/dist/bootstrap.js

@@ -254,6 +254,7 @@ Run and dispatch:
   logs [id]                       Show a run's log — host-dispatch task or session; -f to follow
   browser                         Automate a browser — navigate, click, screenshot, console, network
   pty                             Drive interactive terminal programs (REPLs, TUIs) via a persistent PTY session
+  artifacts                       Publish what an agent made (plans, reports, visuals) to a shareable link
 
 Observe (read the fleet — no store merge; aliases point at the real readers):
   feed / inbox                    Needs-you inbox (open blocks waiting on you)
@@ -1094,7 +1095,7 @@ const SETUP_EXEMPT_COMMANDS = new Set(['setup', 'help', 'uninstall']);
 //
 // Skipped for --help/--version (RUSH-2454): pure documentation paths must not
 // load any migration graph. Loaded from migrate-fold.js (leaf: fs + createLink),
-// not migrate.js, so a real command pays only the fold hop unless the v19
+// not migrate.js, so a real command pays only the fold hop unless the v20
 // sentinel is missing and runMigration() is required below.
 if (process.env.AGENTS_SKIP_MIGRATION !== '1' && !helpOrVersionRequested) {
     try {
@@ -1129,7 +1130,7 @@ if (process.env.AGENTS_SKIP_MIGRATION !== '1' && !helpOrVersionRequested) {
         // Bumping the suffix re-runs migrations for every user; binary releases that
         // don't change the schema must NOT re-run (they would destroy user content
         // when migration steps overlap with user-authored paths). See issue #20.
-        const sentinelValue = 'v19';
+        const sentinelValue = 'v20';
         let needRun = true;
         try {
             if (fs.existsSync(sentinel) && fs.readFileSync(sentinel, 'utf-8').trim() === sentinelValue) {

package/dist/commands/artifacts-setup.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
+ * R2 + Worker) that backs `agents artifacts share`.
+ *
+ * One door, two modes, because it replaces two commands that used to be
+ * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
+ * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
+ * with no provisioning flags TYPED it runs the wizard (provision or join, and
+ * offers a Worker update when an endpoint already exists); with any provisioning
+ * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
+ * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
+ * single source of truth for provisioning.
+ *
+ * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
+ *
+ * Idempotent: re-running shows the current endpoint and offers to reconfigure.
+ */
+import type { Command } from 'commander';
+/**
+ * Interactive share setup. Returns true if the user configured (or already had)
+ * an endpoint, false if they skipped. Never throws on user cancel — callers
+ * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
+ */
+export declare function runShareWizard(): Promise<boolean>;
+/** Parsed `agents artifacts setup` options — the retired `agents share setup` flag set. */
+interface ArtifactsSetupOpts {
+    bundle: string;
+    worker: string;
+    bucket: string;
+    account?: string;
+    token?: string;
+    domain?: string;
+    analyticsToken?: string;
+}
+/** The provisioning flags, by their commander option-value keys. */
+declare const PROVISION_FLAGS: readonly ["bundle", "worker", "bucket", "account", "token", "domain", "analyticsToken"];
+/**
+ * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
+ * is driving the old `agents share setup` provisioning path rather than asking
+ * for the wizard.
+ *
+ * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
+ * PRESENCE proves nothing — the question is whether the user typed them, which
+ * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
+ * Reading presence alone would classify `agents artifacts setup --bundle
+ * cloudflare-work` as a wizard run and then silently provision against the
+ * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
+ * have no default, so presence is proof for them.
+ */
+export declare function isDirectProvisionRequest(opts: ArtifactsSetupOpts, wasTyped?: (flag: (typeof PROVISION_FLAGS)[number]) => boolean): boolean;
+/** Register `agents artifacts setup` under the parent `artifacts` command. */
+export declare function registerArtifactsSetupCommand(artifactsCmd: Command): void;
+export {};

package/dist/commands/{setup-share.js → artifacts-setup.js}

@@ -1,13 +1,22 @@
 /**
- * `agents setup share` — interactive wizard to configure the `agents share`
- * endpoint (Cloudflare R2 + Worker). A friendly front door over the existing
- * `agents share setup` (provision) and `agents share join` flows, reusing their
- * exact logic so there is a single source of truth for provisioning.
+ * `agents artifacts setup` — configure the artifact share endpoint (Cloudflare
+ * R2 + Worker) that backs `agents artifacts share`.
+ *
+ * One door, two modes, because it replaces two commands that used to be
+ * separate (RUSH-2580): the interactive wizard formerly at `agents setup share`
+ * and the flag-driven provisioner formerly at `agents share setup`. On a TTY
+ * with no provisioning flags TYPED it runs the wizard (provision or join, and
+ * offers a Worker update when an endpoint already exists); with any provisioning
+ * flag typed, or on a non-TTY, it provisions directly. Both modes call the same
+ * `runShareProvision` / `runShareJoin` in commands/share.ts, so there is a
+ * single source of truth for provisioning.
+ *
+ * "Typed", not "present", is load-bearing — see {@link isDirectProvisionRequest}.
  *
  * Idempotent: re-running shows the current endpoint and offers to reconfigure.
  */
 import chalk from 'chalk';
-import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_WORKER_NAME, readShareConfig, } from '../lib/share/config.js';
+import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_WORKER_NAME, readShareConfig, } from '../lib/share/config.js';
 import { runShareProvision, runShareJoin, runShareUpdate, shareTemplateStatus } from './share.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 /**
@@ -17,8 +26,9 @@ import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
  */
 export async function runShareWizard() {
     if (!isInteractiveTerminal()) {
-        console.error(chalk.red('agents setup share needs an interactive terminal. ' +
-            'Non-interactively, use `agents share setup` (provision) or `agents share join [url]`.'));
+        console.error(chalk.red('The artifact share wizard needs an interactive terminal. ' +
+            'Non-interactively, use `agents artifacts setup --account <id> --token <t>` (provision) ' +
+            'or `agents artifacts share join <baseUrl> --token <t>`.'));
         return false;
     }
     const existing = readShareConfig();
@@ -94,13 +104,49 @@ export async function runShareWizard() {
     await runShareJoin(baseUrl.trim());
     return true;
 }
-/** Register `agents setup share` under the parent `setup` command. */
-export function registerSetupShareCommand(setupCmd) {
-    setupCmd
-        .command('share')
-        .description('Configure the `agents share` endpoint (Cloudflare R2 + Worker) — provision your own or join one.')
-        .action(async () => {
+/** The provisioning flags, by their commander option-value keys. */
+const PROVISION_FLAGS = ['bundle', 'worker', 'bucket', 'account', 'token', 'domain', 'analyticsToken'];
+/**
+ * True when the invocation named a Cloudflare endpoint detail, i.e. the caller
+ * is driving the old `agents share setup` provisioning path rather than asking
+ * for the wizard.
+ *
+ * `--bundle`/`--worker`/`--bucket` carry commander defaults, so their mere
+ * PRESENCE proves nothing — the question is whether the user typed them, which
+ * only `wasTyped` (backed by commander's `getOptionValueSource`) can answer.
+ * Reading presence alone would classify `agents artifacts setup --bundle
+ * cloudflare-work` as a wizard run and then silently provision against the
+ * DEFAULT bundle, i.e. someone else's Cloudflare account. The other four flags
+ * have no default, so presence is proof for them.
+ */
+export function isDirectProvisionRequest(opts, wasTyped = () => false) {
+    if (opts.account || opts.token || opts.domain || opts.analyticsToken)
+        return true;
+    return PROVISION_FLAGS.some((flag) => wasTyped(flag));
+}
+/** Register `agents artifacts setup` under the parent `artifacts` command. */
+export function registerArtifactsSetupCommand(artifactsCmd) {
+    artifactsCmd
+        .command('setup')
+        .description('Provision (or join) the Cloudflare R2 + Worker endpoint that backs `agents artifacts share`.')
+        .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
+        .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
+        .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)
+        .option('--account <id>', 'Cloudflare account id (else read from the bundle / prompt)')
+        .option('--token <t>', 'Cloudflare API token (else read from the --bundle)')
+        .option('--domain <host>', `custom domain to map (default: ${DEFAULT_SHARE_DOMAIN}; workers.dev if zone is not visible)`)
+        .option('--analytics-token <token>', 'Cloudflare Web Analytics token to inject into published HTML pages')
+        .action(async (opts, cmd) => {
         try {
+            // Named endpoint details, or no terminal to prompt on, means provision
+            // directly — the wizard has nothing to ask that was not already given,
+            // and it would provision against its own hardcoded defaults, dropping
+            // whatever the caller named.
+            const wasTyped = (flag) => cmd.getOptionValueSource(flag) === 'cli';
+            if (isDirectProvisionRequest(opts, wasTyped) || !isInteractiveTerminal()) {
+                await runShareProvision(opts);
+                return;
+            }
             await runShareWizard();
         }
         catch (err) {

package/dist/commands/artifacts.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `agents artifacts` — the group that owns everything an agent publishes for a
+ * human to open: HTML plans, reports, rendered visuals, screenshots.
+ *
+ * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
+ * noun, `share` is the action on it, so the surface reads noun-then-action like
+ * the rest of the CLI:
+ *
+ *   agents artifacts share <file>          publish
+ *   agents artifacts share list|delete|analytics|join|status|update
+ *   agents artifacts setup                 provision (or join) the endpoint
+ *
+ * The subtree itself lives in commands/share.ts (publish + its subcommands) and
+ * commands/artifacts-setup.ts (the provisioning door); this module only assembles
+ * the group, so there is one place that says what `agents artifacts` contains.
+ */
+import type { Command } from 'commander';
+export declare function registerArtifactsCommands(program: Command): void;

package/dist/commands/artifacts.js

@@ -0,0 +1,58 @@
+/**
+ * `agents artifacts` — the group that owns everything an agent publishes for a
+ * human to open: HTML plans, reports, rendered visuals, screenshots.
+ *
+ * RUSH-2580 nested the former top-level `agents share` here. `artifacts` is the
+ * noun, `share` is the action on it, so the surface reads noun-then-action like
+ * the rest of the CLI:
+ *
+ *   agents artifacts share <file>          publish
+ *   agents artifacts share list|delete|analytics|join|status|update
+ *   agents artifacts setup                 provision (or join) the endpoint
+ *
+ * The subtree itself lives in commands/share.ts (publish + its subcommands) and
+ * commands/artifacts-setup.ts (the provisioning door); this module only assembles
+ * the group, so there is one place that says what `agents artifacts` contains.
+ */
+import { setHelpSections } from '../lib/help.js';
+import { registerShareCommands, registerUnshareCommand } from './share.js';
+import { registerArtifactsSetupCommand } from './artifacts-setup.js';
+export function registerArtifactsCommands(program) {
+    const artifactsCmd = program
+        .command('artifacts')
+        .description('Publish agent-made artifacts (plans, reports, visuals) to your own Cloudflare R2 and get a shareable link (~$0).');
+    registerArtifactsSetupCommand(artifactsCmd);
+    registerShareCommands(artifactsCmd);
+    setHelpSections(artifactsCmd, {
+        examples: `
+      # One-time: provision your own endpoint (or join a teammate's)
+      agents artifacts setup
+      agents artifacts share join https://share.agents-cli.sh
+
+      # Publish — auto OG cover, default 30d expiry, shareable link
+      agents artifacts share ./out/plan.html
+
+      # What's live in your namespace, and taking one down
+      agents artifacts share list
+      agents unshare my-plan-a1b2
+
+      # Endpoint health, and pushing a new Worker template to it
+      agents artifacts share status
+      agents artifacts share update
+    `,
+        notes: `
+  agents artifacts share is the publish action; agents artifacts setup is the
+  one-time endpoint provisioning. It runs the interactive wizard only when you
+  type NO endpoint flag on a TTY; type any of --bundle/--worker/--bucket/
+  --account/--token/--domain/--analytics-token, or run non-interactively, and it
+  provisions directly with what you named.
+
+  agents unshare <targets...> stays a top-level alias of
+  agents artifacts share delete.
+
+  Full reference: apps/cli/docs/share.md.
+    `,
+    });
+    // Top-level, deliberately: see registerUnshareCommand in commands/share.ts.
+    registerUnshareCommand(program);
+}

package/dist/commands/browser.js

@@ -699,6 +699,7 @@ function registerTaskCommands(browser) {
         .option(TASK_OPTION_FLAG, 'Task name (auto-generated if omitted)')
         .option('-e, --endpoint <name>', 'Endpoint preset (defaults to the profile\'s default)')
         .option('-u, --url <url>', 'Open URL in first tab')
+        .option('--fresh', 'Always open a new tab, skipping the reclaim of a tab an abandoned task is holding on that URL')
         .option('--no-skills', 'Skip auto-discovery of site-specific SKILL.md from ~/.agents/skills/browser/domain-skills/')
         .option('--record', 'Start recording right after the tab opens (shorthand for `agents browser record start` as a follow-up)')
         .option('--fps <n>', 'Recording frames per second (with --record; 1–30, default 5)', (v) => parseInt(v, 10))
@@ -791,6 +792,7 @@ function registerTaskCommands(browser) {
             url: opts.url,
             endpoint: opts.endpoint,
             skipDomainSkill: opts.skills === false,
+            fresh: opts.fresh === true,
             // Forward the caller's identity: the browser daemon is shared, so it
             // cannot resolve who/which-run called `start`. `resolveActor()` runs
             // here in the CLI (the caller's process); `$AGENT_LAUNCH_ID` is the

package/dist/commands/config.js

@@ -41,12 +41,17 @@ function parseValue(key, parsed, raw) {
             return raw.trim();
         case 'usage':
             return raw.trim();
+        case 'auto':
+            return raw.trim();
         case 'browser':
             return raw.trim();
         case 'project':
             return raw.trim();
         case 'device': {
-            switch (parsed.property) {
+            const property = parsed.property;
+            switch (property) {
+                case 'role':
+                    return raw.trim();
                 case 'max-agents':
                     if (!/^\d+$/.test(raw.trim())) {
                         throw new Error(`Config key '${key}' expects an integer, got '${raw}'.`);
@@ -55,6 +60,7 @@ function parseValue(key, parsed, raw) {
                 case 'scheduler':
                 case 'daemon':
                 case 'watchdog':
+                case 'tmux':
                 case 'browser.remote-control':
                     return parseBool(raw, key);
                 case 'notes':
@@ -62,6 +68,13 @@ function parseValue(key, parsed, raw) {
                 case 'browser.profile':
                     return raw.trim();
             }
+            // A device property with no arm above used to fall out of the switch and
+            // return `undefined`, so the write failed downstream with "expects a
+            // boolean, got undefined" instead of naming the real gap. The `never`
+            // binding makes adding a DeviceConfigProperty without a parse rule a
+            // compile error rather than a runtime mystery.
+            const unhandled = property;
+            throw new Error(`Config key '${key}' has no parse rule for device property '${String(unhandled)}'.`);
         }
     }
 }
@@ -93,6 +106,10 @@ function setConfig(parsed, value) {
             setConfigValue('usage.primary-host', value);
             return;
         }
+        case 'auto': {
+            setConfigValue('auto.pool', value);
+            return;
+        }
         case 'browser': {
             // Device-local default lives in the central fleet.devices.<name>.config
             // block (same store `agents devices config` / getConfigValue use). Bare
@@ -137,6 +154,11 @@ function unsetConfig(parsed) {
             unsetConfigValue('usage.primary-host');
             return had;
         }
+        case 'auto': {
+            const had = getConfigValue('auto.pool').value !== undefined;
+            unsetConfigValue('auto.pool');
+            return had;
+        }
         case 'browser': {
             const target = parsed.device ? { device: parsed.device } : undefined;
             const had = getConfigValue('browser.profile', target).value !== undefined;
@@ -173,6 +195,8 @@ function getConfig(parsed) {
             return getConfigValue('interactive.host').value;
         case 'usage':
             return getConfigValue('usage.primary-host').value;
+        case 'auto':
+            return getConfigValue('auto.pool').value;
         case 'browser': {
             return getConfigValue('browser.profile', parsed.device ? { device: parsed.device } : undefined).value;
         }
@@ -231,6 +255,9 @@ function* listCentralConfigEntries() {
     if (meta.config?.usagePrimaryHost !== undefined) {
         yield { key: 'usage.primary-host', value: meta.config.usagePrimaryHost, hint: 'config.usagePrimaryHost' };
     }
+    if (meta.config?.autoPool !== undefined) {
+        yield { key: 'auto.pool', value: meta.config.autoPool, hint: 'config.autoPool' };
+    }
     if (meta.projectRoot !== undefined) {
         yield { key: 'project.root', value: meta.projectRoot, hint: 'devices.<self>.projectRoot' };
     }
@@ -262,6 +289,9 @@ function* listDeviceConfigEntries(device) {
             case 'watchdog.enabled':
                 key = `${prefix}watchdog`;
                 break;
+            case 'tmux.enabled':
+                key = `${prefix}tmux`;
+                break;
             case 'browser.remote-control':
                 key = `${prefix}browser.remote-control`;
                 break;

package/dist/commands/exec.js

@@ -557,7 +557,7 @@ export function registerRunCommand(program) {
         .option('--terminal [backend]', "Open this run in a real terminal tab instead of here. Without a value the terminal is detected from your live sessions (`agents sessions --active` host), so it lands where you already work — Ghostty for a Ghostty user, iTerm for an iTerm user. Name one to force it: iterm | ghostty | terminal | tmux | vscodium-agent. This is how the menu bar's New Session opens.")
         .option('--verbose', 'Show detailed execution logs')
         .option('--raw', 'Interactive runs on macOS/Linux launch inside a shared tmux session (for %pane addressing + re-attach). Pass --raw to spawn the agent directly instead. Also disabled by AGENTS_NO_TMUX=1.')
-        .option('--no-tmux', 'Spawn the agent directly instead of wrapping it in the shared tmux session. Same effect as --raw / AGENTS_NO_TMUX=1. Use this to see the agent\'s full startup output when a launch is failing.')
+        .option('--no-tmux', 'Spawn the agent directly instead of wrapping it in the shared tmux session. Same effect as --raw / AGENTS_NO_TMUX=1. Use this to see the agent\'s full startup output when a launch is failing; to turn the wrap off for every run on this machine, set `agents config set devices.<name>.tmux off`.')
         .option('--disable-tmux', 'Alias for --no-tmux.')
         .option('--timeout <duration>', 'Kill the agent after this duration (e.g., 30m, 1h, 2h30m)')
         .option('--fallback <agents>', 'Comma-separated agents to try on rate-limit failure. Each entry accepts an optional @version pin (e.g., codex@0.116.0,antigravity). The primary runs first; if it exits with a rate-limit error, the next agent picks up via /continue handoff.')
@@ -2699,7 +2699,7 @@ export function registerRunCommand(program) {
         // Profile carries provider auth; secrets bundles carry user-defined
         // values; --env is the per-invocation override. The share token is
         // best-effort: if it is not already in env or an unlocked bundle, unrelated
-        // runs keep working, and `agents share` itself still fails loudly on use.
+        // runs keep working, and `agents artifacts share` itself still fails loudly on use.
         const hasOverrides = profileEnv || accountEnv || autoShareEnv || options.secrets.length > 0 || userEnv;
         const env = hasOverrides
             ? { ...(profileEnv ?? {}), ...(accountEnv ?? {}), ...(autoShareEnv ?? {}), ...secretsEnv, ...(userEnv ?? {}) }

package/dist/commands/models.js

@@ -16,6 +16,8 @@ import { setTierOverride, clearTierOverride, listTierOverrides } from '../lib/mo
 import { getModelPricing } from '../lib/pricing/index.js';
 import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/width.js';
 import { wrapJoined } from './inspect.js';
+import { setHelpSections } from '../lib/help.js';
+import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
 const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid', 'pi'];
 /**
  * Agents that don't necessarily install under ~/.agents/versions (cursor ships
@@ -75,6 +77,71 @@ export function registerModelsCommand(program) {
             console.log(chalk.gray('  Permission modes (--mode plan|edit|auto|skip): `agents modes <agent>`'));
         }
     });
+    // `models set` — the ergonomic setter for per-agent/version run defaults. It
+    // reads and writes the same store as `agents config set run.<agent@version>.*`
+    // (agents.yaml -> run.defaults), so the two stay consistent — `set` is just the
+    // short front door, nested here because `models` owns model/mode concerns.
+    const set = models
+        .command('set [selector]')
+        .description('Set the default model/mode an agent version uses for `agents run`')
+        .option('--model <model>', 'Default model or model alias, forwarded via --model')
+        .option('--mode <mode>', "Default mode: plan, edit, auto, skip. 'full' accepted as alias for skip.")
+        .action((selector, options) => {
+        try {
+            const hasFlags = options.model !== undefined || options.mode !== undefined;
+            if (!selector) {
+                if (hasFlags) {
+                    throw new Error('Selector is required when passing --model/--mode. Example: agents models set claude@2.1.220 --model opus-5');
+                }
+                const entries = listRunDefaults();
+                if (entries.length === 0) {
+                    console.log(chalk.gray('No agent defaults configured.'));
+                    console.log(chalk.gray('Set one with: agents models set claude@2.1.220 --model opus-5'));
+                    return;
+                }
+                console.log(chalk.bold('Agent Defaults\n'));
+                for (const entry of entries) {
+                    console.log(`  ${formatRunDefaultEntry(entry)}`);
+                }
+                return;
+            }
+            if (!hasFlags) {
+                const parsed = parseRunDefaultSelector(selector);
+                const entry = listRunDefaults().find((e) => e.selector === parsed.selector);
+                if (!entry || (!entry.defaults.mode && !entry.defaults.model)) {
+                    console.log(chalk.gray(`No default set for ${parsed.selector}.`));
+                    console.log(chalk.gray(`Set one with: agents models set ${selector} --model <model>`));
+                    return;
+                }
+                console.log(`  ${formatRunDefaultEntry(entry)}`);
+                return;
+            }
+            const entry = setRunDefault(selector, {
+                ...(options.mode !== undefined ? { mode: options.mode } : {}),
+                ...(options.model !== undefined ? { model: options.model } : {}),
+            });
+            console.log(chalk.green('Set default:'));
+            console.log(`  ${formatRunDefaultEntry(entry)}`);
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    setHelpSections(set, {
+        examples: `
+      agents models set claude@2.1.220 --model opus-5
+      agents models set 'claude:*' --mode auto --model opus
+      agents models set claude@2.1.220
+      agents models set
+    `,
+        notes: `
+      Selectors use <agent>@<version> or <agent>:<version>; * matches all versions.
+      Exact selectors override wildcard selectors field by field.
+      Writes the same store as 'agents config set run.<agent@version>.*'. Explicit flags on
+      'agents run' always win over configured defaults.
+    `,
+    });
     // Override subcommands. These WRITE agents.yaml so the user never hand-edits it;
     // resolution is exact `<agent>@<version>` over `<agent>` over the auto guess.
     const tierDeprecation = chalk.yellow('Deprecation: `agents models tier` is replaced by `agents config set run.<agent@version>.tier.<tier>`.');

package/dist/commands/setup.js

@@ -20,7 +20,7 @@ import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPat
 import { setHelpSections } from '../lib/help.js';
 import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.js';
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
-import { registerSetupShareCommand, runShareWizard } from './setup-share.js';
+import { runShareWizard } from './artifacts-setup.js';
 import { registerSetupMineCommand } from './setup-mine.js';
 import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
@@ -355,10 +355,11 @@ export function registerSetupCommand(program) {
         .description('Set up agents-cli, or re-open the capability onboarding hub.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|share|mine|secrets|fleet`.
+    // Capability subcommands: `agents setup browser|computer|mine|secrets|fleet`.
+    // Share/artifact publishing is set up by `agents artifacts setup` (RUSH-2580);
+    // the hub below still offers it as a phase via runShareWizard.
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
-    registerSetupShareCommand(setupCmd);
     registerSetupMineCommand(setupCmd);
     registerSetupSecretsCommand(setupCmd);
     registerSetupFleetCommand(setupCmd);
@@ -386,7 +387,6 @@ export function registerSetupCommand(program) {
       # Set up a specific capability on its own
       agents setup browser
       agents setup computer
-      agents setup share
       agents setup secrets
       agents setup fleet
       agents setup watchdog
@@ -401,7 +401,7 @@ export function registerSetupCommand(program) {
       Capability setup can also be run any time on its own:
         agents setup browser    # detect a browser + create the default profile
         agents setup computer    # install the signed macOS helper + grant permissions
-        agents setup share       # provision or join a Cloudflare share endpoint
+        agents artifacts setup   # provision or join a Cloudflare share endpoint
         agents setup secrets     # choose secrets backend/policy defaults + import
         agents setup fleet       # discover Tailscale devices + configure SSH access
         agents setup watchdog    # choose which devices run the daemon watchdog pass