@phnx-labs/agents-cli 1.22.37 → 1.22.39

package/dist/lib/startup/command-registry.d.ts

@@ -50,7 +50,6 @@ export declare const loadOpen: ModuleLoader;
 export declare const loadReconnect: ModuleLoader;
 export declare const loadFork: ModuleLoader;
 export declare const loadConfig: ModuleLoader;
-export declare const loadSet: ModuleLoader;
 export declare const loadModels: ModuleLoader;
 export declare const loadModes: ModuleLoader;
 export declare const loadPrune: ModuleLoader;
@@ -100,7 +99,7 @@ export declare const loadSend: ModuleLoader;
 export declare const loadFeed: ModuleLoader;
 export declare const loadMailboxes: ModuleLoader;
 export declare const loadServe: ModuleLoader;
-export declare const loadShare: ModuleLoader;
+export declare const loadArtifacts: ModuleLoader;
 export declare const loadAudit: ModuleLoader;
 export declare const loadWebhooks: ModuleLoader;
 export declare const loadHumans: ModuleLoader;
@@ -143,6 +142,15 @@ export declare const COMMAND_LOADERS: Record<string, ModuleLoader[]>;
  * registered command tree so a new command can never drift out of it.
  */
 export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
+/**
+ * Former top-level names that must NOT auto-correct (edit-distance 1) into a
+ * live command. Without this a pruned surface silently misroutes: the typed
+ * name is gone, the spellchecker finds a neighbour, and the CLI runs something
+ * the user never asked for instead of saying the command is gone.
+ *
+ * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
+ * under `agents artifacts share` (RUSH-2580).
+ */
 export declare const RETIRED_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
 /** Whether `name` is a top-level command this CLI registers. See {@link KNOWN_TOP_LEVEL_COMMANDS}. */
 export declare function isKnownTopLevelCommand(name: string): boolean;

package/dist/lib/startup/command-registry.js

@@ -52,7 +52,6 @@ export const loadOpen = async () => (await import('../../commands/open.js')).reg
 export const loadReconnect = async () => (await import('../../commands/reconnect.js')).registerReconnectCommand;
 export const loadFork = async () => (await import('../../commands/fork.js')).registerForkCommand;
 export const loadConfig = async () => (await import('../../commands/config.js')).registerConfigCommand;
-export const loadSet = async () => (await import('../../commands/set.js')).registerSetCommand;
 export const loadModels = async () => (await import('../../commands/models.js')).registerModelsCommand;
 export const loadModes = async () => (await import('../../commands/modes.js')).registerModesCommand;
 export const loadPrune = async () => (await import('../../commands/prune.js')).registerPruneCommand;
@@ -103,7 +102,9 @@ export const loadSend = async () => (await import('../../commands/send.js')).reg
 export const loadFeed = async () => (await import('../../commands/feed.js')).registerFeedCommand;
 export const loadMailboxes = async () => (await import('../../commands/mailboxes.js')).registerMailboxesCommand;
 export const loadServe = async () => (await import('../../commands/serve.js')).registerServeCommand;
-export const loadShare = async () => (await import('../../commands/share.js')).registerShareCommands;
+// Registers the `artifacts` group (with `share` + `setup` under it) AND the
+// top-level `unshare` alias — see commands/artifacts.ts.
+export const loadArtifacts = async () => (await import('../../commands/artifacts.js')).registerArtifactsCommands;
 export const loadAudit = async () => (await import('../../commands/audit.js')).registerAuditCommands;
 export const loadWebhooks = async () => (await import('../../commands/webhook.js')).registerWebhooksCommand;
 export const loadHumans = async () => (await import('../../commands/humans.js')).registerHumansCommands;
@@ -180,7 +181,6 @@ export const COMMAND_LOADERS = {
     reconnect: [loadReconnect],
     fork: [loadFork],
     config: [loadConfig],
-    set: [loadSet],
     models: [loadModels],
     modes: [loadModes],
     trash: [loadTrash],
@@ -246,10 +246,10 @@ export const COMMAND_LOADERS = {
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
     serve: [loadServe],
-    share: [loadShare],
-    // `unshare` is a top-level convenience alias of `share delete` (see
+    artifacts: [loadArtifacts],
+    // `unshare` is a top-level convenience alias of `artifacts share delete` (see
     // commands/share.ts) — same module, registered as its own program.command().
-    unshare: [loadShare],
+    unshare: [loadArtifacts],
     audit: [loadAudit],
     webhooks: [loadWebhooks],
     humans: [loadHumans],
@@ -288,7 +288,16 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
     ...Object.keys(COMMAND_LOADERS),
     ...INLINE_COMMAND_NAMES,
 ]);
-export const RETIRED_TOP_LEVEL_COMMANDS = new Set(['webhook']);
+/**
+ * Former top-level names that must NOT auto-correct (edit-distance 1) into a
+ * live command. Without this a pruned surface silently misroutes: the typed
+ * name is gone, the spellchecker finds a neighbour, and the CLI runs something
+ * the user never asked for instead of saying the command is gone.
+ *
+ * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
+ * under `agents artifacts share` (RUSH-2580).
+ */
+export const RETIRED_TOP_LEVEL_COMMANDS = new Set(['webhook', 'set', 'share']);
 /** Whether `name` is a top-level command this CLI registers. See {@link KNOWN_TOP_LEVEL_COMMANDS}. */
 export function isKnownTopLevelCommand(name) {
     return KNOWN_TOP_LEVEL_COMMANDS.has(name);

package/dist/lib/tmux/orphan-reap.d.ts

@@ -58,12 +58,10 @@
  * - the reaping process itself, its ancestors, pid 1, and every long-lived
  *   agents-cli service ({@link isProtectedAgentsService}) are never candidates.
  * - an UNRELIABLE read of tmux's session state (the query threw, timed out, or
- *   tmux itself never answered) disables tier 1 for that sweep entirely — an
- *   absent map entry proves a session is gone only when the map is known-good.
- *   Distinguishing "tmux answered: no such session" (a completed, if nonzero,
- *   exit — genuinely nothing there) from "tmux did not answer" (a thrown
- *   error/timeout — unknown) is exactly this: a completed process is a real
- *   answer, a rejected promise is not one at all.
+ *   tmux itself never answered) disables tier 1 for that sweep entirely;
+ * - an absent session entry is unknown, even after a reliable read. A tmux
+ *   server restart can produce the same empty snapshot while marked agents
+ *   remain alive, so tier 1 requires a present owner with positive death proof.
  * - tier 2 is anchored on the actual claude EXECUTABLE (argv[0]'s basename),
  *   never a substring match anywhere in the command line, and excludes any
  *   process still structurally part of a LIVE pane leaf's process tree right
@@ -121,7 +119,7 @@ export interface PaneOwner {
     attached: boolean;
 }
 /** Why a process was selected, for human output and tests. */
-export type OrphanReason = 'tmux-session-gone' | 'tmux-agent-exited' | 'detached-helper';
+export type OrphanReason = 'tmux-agent-exited' | 'detached-helper';
 export interface OrphanCandidate {
     pid: number;
     args: string;
@@ -170,16 +168,14 @@ export declare function isProtectedAgentsService(args: string): boolean;
 /**
  * Pure. Select the processes whose owning agent is provably gone.
  *
- * `owners` maps a tmux session name to its liveness; a name ABSENT from the map
- * is a session tmux no longer has, which is the strongest orphan signal there is
- * — but ONLY when `owners` is itself known-complete. `opts.ownersReliable`
- * (default `true`, so existing direct callers/tests keep their prior meaning)
- * says whether the caller actually got a real answer from tmux for every
- * socket it queried. When it is `false` — a query threw, timed out, or tmux
- * itself never answered — tier 1 is skipped entirely for this call: an absent
- * map entry proves nothing when the map itself might be missing entries for
- * sessions tmux never got asked about (RUSH-2521 review — a flaky tick must
- * never fall back to "treat every marked process as orphaned").
+ * `owners` maps a tmux session name to its liveness. An ABSENT name is never
+ * proof that the marked process is orphaned: the tmux server can restart or its
+ * socket can disappear while the pane's process tree is still alive. That exact
+ * state made the daemon classify every live agent as `tmux-session-gone` and
+ * SIGTERM it on startup (RUSH-2603). Tier 1 therefore requires a PRESENT owner
+ * whose pane process is confirmed dead and has no attached client. A reliable
+ * empty map means "nothing proven dead", not "every marked process is dead".
+ * `opts.ownersReliable` still disables tier 1 when any query failed to answer.
  */
 export declare function selectOrphanProcesses(procs: AgentProcess[], owners: Map<string, PaneOwner>, opts: {
     protectedPids: Set<number>;
@@ -281,8 +277,8 @@ export declare function readPaneOwners(socket: string): Promise<PaneOwnersRead>;
  * Reap every helper process whose owning agent has exited.
  *
  * Called from the daemon's periodic tick and from `agents sessions reap`. Panes
- * are read BEFORE processes so a session that disappears mid-scan is treated as
- * gone (reapable) rather than as a live owner.
+ * are read before processes to take one ownership snapshot. A session absent
+ * from that snapshot is unknown and is never sufficient proof for tier 1.
  *
  * `opts.pids` is the test-only process-table scope described on
  * {@link readAgentProcesses} — never set by production callers.

package/dist/lib/tmux/orphan-reap.js

@@ -58,12 +58,10 @@
  * - the reaping process itself, its ancestors, pid 1, and every long-lived
  *   agents-cli service ({@link isProtectedAgentsService}) are never candidates.
  * - an UNRELIABLE read of tmux's session state (the query threw, timed out, or
- *   tmux itself never answered) disables tier 1 for that sweep entirely — an
- *   absent map entry proves a session is gone only when the map is known-good.
- *   Distinguishing "tmux answered: no such session" (a completed, if nonzero,
- *   exit — genuinely nothing there) from "tmux did not answer" (a thrown
- *   error/timeout — unknown) is exactly this: a completed process is a real
- *   answer, a rejected promise is not one at all.
+ *   tmux itself never answered) disables tier 1 for that sweep entirely;
+ * - an absent session entry is unknown, even after a reliable read. A tmux
+ *   server restart can produce the same empty snapshot while marked agents
+ *   remain alive, so tier 1 requires a present owner with positive death proof.
  * - tier 2 is anchored on the actual claude EXECUTABLE (argv[0]'s basename),
  *   never a substring match anywhere in the command line, and excludes any
  *   process still structurally part of a LIVE pane leaf's process tree right
@@ -193,16 +191,14 @@ function livePid(pid) {
 /**
  * Pure. Select the processes whose owning agent is provably gone.
  *
- * `owners` maps a tmux session name to its liveness; a name ABSENT from the map
- * is a session tmux no longer has, which is the strongest orphan signal there is
- * — but ONLY when `owners` is itself known-complete. `opts.ownersReliable`
- * (default `true`, so existing direct callers/tests keep their prior meaning)
- * says whether the caller actually got a real answer from tmux for every
- * socket it queried. When it is `false` — a query threw, timed out, or tmux
- * itself never answered — tier 1 is skipped entirely for this call: an absent
- * map entry proves nothing when the map itself might be missing entries for
- * sessions tmux never got asked about (RUSH-2521 review — a flaky tick must
- * never fall back to "treat every marked process as orphaned").
+ * `owners` maps a tmux session name to its liveness. An ABSENT name is never
+ * proof that the marked process is orphaned: the tmux server can restart or its
+ * socket can disappear while the pane's process tree is still alive. That exact
+ * state made the daemon classify every live agent as `tmux-session-gone` and
+ * SIGTERM it on startup (RUSH-2603). Tier 1 therefore requires a PRESENT owner
+ * whose pane process is confirmed dead and has no attached client. A reliable
+ * empty map means "nothing proven dead", not "every marked process is dead".
+ * `opts.ownersReliable` still disables tier 1 when any query failed to answer.
  */
 export function selectOrphanProcesses(procs, owners, opts) {
     const isAlive = opts.isAlive ?? livePid;
@@ -256,10 +252,8 @@ export function selectOrphanProcesses(procs, owners, opts) {
             if (!p.tmuxSession || !eligible(p))
                 continue;
             const owner = owners.get(p.tmuxSession);
-            if (!owner) {
-                push(p, 'tmux-session-gone');
+            if (!owner)
                 continue;
-            }
             // An attached client or a live agent pane process is a hard exclusion.
             if (owner.attached || owner.agentAlive)
                 continue;
@@ -553,8 +547,8 @@ function describe(c) {
  * Reap every helper process whose owning agent has exited.
  *
  * Called from the daemon's periodic tick and from `agents sessions reap`. Panes
- * are read BEFORE processes so a session that disappears mid-scan is treated as
- * gone (reapable) rather than as a live owner.
+ * are read before processes to take one ownership snapshot. A session absent
+ * from that snapshot is unknown and is never sufficient proof for tier 1.
  *
  * `opts.pids` is the test-only process-table scope described on
  * {@link readAgentProcesses} — never set by production callers.

package/dist/lib/tmux/session.js

@@ -211,9 +211,10 @@ export async function killAll(socket) {
 export async function reapDeadTmuxPanes(socket, opts = {}) {
     const sock = socket ?? getDefaultSocketPath();
     const result = { reaped: 0, sessions: [], details: [], processes: 0, processDetails: [], warnings: [] };
-    // The process sweep runs even with no server on this socket: a torn-down
-    // server (`killAll` unlinks the socket) is the strongest orphan signal there
-    // is, and skipping it here would strand exactly those leftovers forever.
+    // The process sweep may run with no server, but an absent session is not
+    // evidence that a still-live marked process is orphaned. Tier 1 only acts on
+    // a present pane owner confirmed dead; tier 2 independently verifies its
+    // declared spawner pid (RUSH-2603).
     // `opts.pids` is a test-only process-table scope (see `readAgentProcesses`)
     // — production callers never set it.
     const { reapOrphanAgentProcesses } = await import('./orphan-reap.js');

package/dist/lib/triggers/handlers.js

@@ -226,6 +226,16 @@ export function handlerMatchesWebhook(handler, webhook) {
             const current = data?.state?.name;
             if (current !== handler.stateTo)
                 return false;
+            // RUSH-2539: `stateTo` is a TRANSITION predicate, not a current-state one.
+            // Linear carries the prior value of each changed field in `updatedFrom`, so a
+            // real state change has `updatedFrom.state` (this codebase's shape) or
+            // `updatedFrom.stateId` (Linear's scalar). With neither, this Issue/update
+            // touched something else (label, assignee, description) while the issue merely
+            // still sits in `stateTo` — matching there re-fires on every later edit
+            // (RUSH-1459 accumulated 11 duplicate plan comments).
+            const updatedTo = webhook.payload.updatedFrom;
+            if (!updatedTo || (updatedTo.state === undefined && updatedTo.stateId === undefined))
+                return false;
         }
         if (handler.stateFrom) {
             const updatedFrom = webhook.payload.updatedFrom;

package/dist/lib/triggers/webhook.js

@@ -155,6 +155,16 @@ function linearTriggerMatches(trigger, webhook) {
         const current = data?.state?.name;
         if (current !== trigger.stateTo)
             return false;
+        // RUSH-2539: `stateTo` is a TRANSITION predicate, not a current-state one.
+        // Linear carries the prior value of each changed field in `updatedFrom`, so a
+        // real state change has `updatedFrom.state` (this codebase's shape) or
+        // `updatedFrom.stateId` (Linear's scalar). With neither, this Issue/update
+        // touched something else while the issue merely still sits in `stateTo` —
+        // matching there re-fires on every later edit (RUSH-1459 got 11 duplicate
+        // plan comments).
+        const updatedTo = webhook.payload.updatedFrom;
+        if (!updatedTo || (updatedTo.state === undefined && updatedTo.stateId === undefined))
+            return false;
     }
     if (trigger.stateFrom) {
         const updatedFrom = webhook.payload.updatedFrom;

package/dist/lib/types.d.ts

@@ -995,7 +995,7 @@ export interface Meta {
      * Full shape in `lib/fleet/types.ts` (FleetManifest).
      */
     fleet?: import('./fleet/types.js').FleetManifest;
-    /** `agents share` endpoint (Cloudflare R2 + Worker). Set by `agents share
+    /** Artifact share endpoint (Cloudflare R2 + Worker). Set by `agents artifacts
      * setup`/`join`; syncs fleet-wide via `agents repo push/pull`. The write token
      * lives in the `share` secrets bundle, not here. */
     share?: {
@@ -1007,7 +1007,7 @@ export interface Meta {
         /** Cloudflare Web Analytics token injected into published HTML pages. */
         analyticsToken?: string;
         /** sha256 of the Worker script deployed at the last provision/update, so
-         * `agents share status` can tell current vs outdated vs unknown (a config
+         * `agents artifacts share status` can tell current vs outdated vs unknown (a config
          * from before this field existed has no hash — always "unknown"). */
         templateHash?: string;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.37",
+  "version": "1.22.39",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",

package/dist/commands/set.d.ts

@@ -1,15 +0,0 @@
-/**
- * `agents set` — ergonomic top-level setter for per-agent/version run defaults.
- *
- * `agents set claude@2.1.220 --model opus-5` pins the default model (and/or
- * mode) that `agents run` uses for that agent version. It reads and writes the
- * same store as `agents config set run.<agent@version>.*` (agents.yaml -> run.defaults), so the
- * two stay consistent — `set` is just the short front door.
- *
- *   agents set                          # list every configured default
- *   agents set claude@2.1.220           # show the default for one version
- *   agents set claude@2.1.220 --model opus-5
- *   agents set 'claude:*' --mode auto --model opus
- */
-import type { Command } from 'commander';
-export declare function registerSetCommand(program: Command): void;

package/dist/commands/set.js

@@ -1,79 +0,0 @@
-/**
- * `agents set` — ergonomic top-level setter for per-agent/version run defaults.
- *
- * `agents set claude@2.1.220 --model opus-5` pins the default model (and/or
- * mode) that `agents run` uses for that agent version. It reads and writes the
- * same store as `agents config set run.<agent@version>.*` (agents.yaml -> run.defaults), so the
- * two stay consistent — `set` is just the short front door.
- *
- *   agents set                          # list every configured default
- *   agents set claude@2.1.220           # show the default for one version
- *   agents set claude@2.1.220 --model opus-5
- *   agents set 'claude:*' --mode auto --model opus
- */
-import chalk from 'chalk';
-import { setHelpSections } from '../lib/help.js';
-import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
-export function registerSetCommand(program) {
-    const set = program
-        .command('set [selector]')
-        .description('Set the default model/mode an agent version uses for `agents run`')
-        .option('--model <model>', 'Default model or model alias, forwarded via --model')
-        .option('--mode <mode>', "Default mode: plan, edit, auto, skip. 'full' accepted as alias for skip.")
-        .action((selector, options) => {
-        try {
-            const hasFlags = options.model !== undefined || options.mode !== undefined;
-            if (!selector) {
-                if (hasFlags) {
-                    throw new Error('Selector is required when passing --model/--mode. Example: agents set claude@2.1.220 --model opus-5');
-                }
-                const entries = listRunDefaults();
-                if (entries.length === 0) {
-                    console.log(chalk.gray('No agent defaults configured.'));
-                    console.log(chalk.gray('Set one with: agents set claude@2.1.220 --model opus-5'));
-                    return;
-                }
-                console.log(chalk.bold('Agent Defaults\n'));
-                for (const entry of entries) {
-                    console.log(`  ${formatRunDefaultEntry(entry)}`);
-                }
-                return;
-            }
-            if (!hasFlags) {
-                const parsed = parseRunDefaultSelector(selector);
-                const entry = listRunDefaults().find((e) => e.selector === parsed.selector);
-                if (!entry || (!entry.defaults.mode && !entry.defaults.model)) {
-                    console.log(chalk.gray(`No default set for ${parsed.selector}.`));
-                    console.log(chalk.gray(`Set one with: agents set ${selector} --model <model>`));
-                    return;
-                }
-                console.log(`  ${formatRunDefaultEntry(entry)}`);
-                return;
-            }
-            const entry = setRunDefault(selector, {
-                ...(options.mode !== undefined ? { mode: options.mode } : {}),
-                ...(options.model !== undefined ? { model: options.model } : {}),
-            });
-            console.log(chalk.green('Set default:'));
-            console.log(`  ${formatRunDefaultEntry(entry)}`);
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    setHelpSections(set, {
-        examples: `
-      agents set claude@2.1.220 --model opus-5
-      agents set 'claude:*' --mode auto --model opus
-      agents set claude@2.1.220
-      agents set
-    `,
-        notes: `
-      Selectors use <agent>@<version> or <agent>:<version>; * matches all versions.
-      Exact selectors override wildcard selectors field by field.
-      Writes the same store as 'agents config set run.<agent@version>.*'. Explicit flags on
-      'agents run' always win over configured defaults.
-    `,
-    });
-}

package/dist/commands/setup-share.d.ts

@@ -1,17 +0,0 @@
-/**
- * `agents setup share` — interactive wizard to configure the `agents share`
- * endpoint (Cloudflare R2 + Worker). A friendly front door over the existing
- * `agents share setup` (provision) and `agents share join` flows, reusing their
- * exact logic so there is a single source of truth for provisioning.
- *
- * Idempotent: re-running shows the current endpoint and offers to reconfigure.
- */
-import type { Command } from 'commander';
-/**
- * Interactive share setup. Returns true if the user configured (or already had)
- * an endpoint, false if they skipped. Never throws on user cancel — callers
- * (the `agents setup` hub) rely on that to keep the fresh-machine flow going.
- */
-export declare function runShareWizard(): Promise<boolean>;
-/** Register `agents setup share` under the parent `setup` command. */
-export declare function registerSetupShareCommand(setupCmd: Command): void;