@phnx-labs/agents-cli 1.22.54 → 1.22.56

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.22.56
+
+- **Scheduled routines claim a durable per-occurrence slot, so a duplicate delivery or a catch-up of the same slot can't double-launch (PHNX-3215).** The forward-timer path keyed its single-fire claim on croner's `currentRun()`, which is the jittered wall-clock fire instant, not the aligned schedule boundary — so two timer callbacks for one occurrence minted different run ids and both launched, and a live fire never collided with its catch-up twin. The scheduler now floors the fire to the aligned `(routine, scheduledFor)` boundary (`fireSlot`/`alignedSlotForFire`), the same derivation catch-up uses, making the atomic slot claim a structural guarantee (SING-15/16, self-overlap SING-13). Source: `cli/src/lib/scheduler.ts`, `cli/src/lib/scheduling/routines.ts`, `cli/src/lib/overdue.ts`.
+
+- **Managed-share Open Graph cards render in Cloudflare instead of failing on every new publish (PHNX-2835).** The Worker upload now carries Yoga and resvg as compiled WebAssembly modules alongside the bundled JavaScript and fonts. The previous single-file bundle decoded the WASM into byte arrays and compiled it at request time; Node accepted that in tests, but Cloudflare workerd forbids runtime WASM code generation, so a new share's lazy `<slug>.png` render failed. A real-workerd regression test now renders and validates the PNG, and a genuine renderer failure returns a diagnostic `500` instead of falling through as a missing cover. Source: `cli/src/lib/share/{worker-template,provision}.ts`.
+
+## 1.22.55
+
+- **Managed shares generate their Open Graph cover server-side (PHNX-2835).** Publishing HTML to `share.agents-cli.sh` no longer launches local Chromium. The Worker lazily renders a deterministic 1200×630 AGI card with Satori and resvg-wasm, bundles Inter and JetBrains Mono, inherits the canonical page's visibility gate, and caches the PNG in R2. BYO endpoints keep their local screenshot fallback. An explicit missing `AGENTS_SHARE_BROWSER` or `PUPPETEER_EXECUTABLE_PATH` now fails loudly instead of silently falling through. Source: `cli/src/lib/share/{capture,publish,worker-template}.ts`.
+
+- **`agents routines status --json` — the daemon-owned scheduler status surface (PHNX-3215).** `routines status` printed human-only scheduler health and upcoming fires with no machine-readable form; the JSON that existed (`routines list --json`) is definition-shaped and does not answer "did this routine fire here, and is one running right now?" The new `--json` emits a `scheduler` block (state, pid, heartbeat age, enabled/total counts) plus a `routines` array where each row carries the routine's single **owner device** (`ownerDevice`, with `ambiguousDevicePin` when `devices:` names more than one), whether it fires here (`runsHere`), the last local fire's outcome and error (`lastStatus`, `failureReason`, `lastRunStartedAt`/`CompletedAt`), and any **in-flight spawn** (`inFlight: { runId, pid, startedAt, triggerKind }`) — surfaced only for a run that is genuinely live on this device (a live local child or a host-placed run), never a provisional pre-spawn claim. The routine set and counts are the schedulable ones (matching plain `routines status`), so the JSON never inflates totals with discoverable-but-unmaterialised project routines. Source: `cli/src/lib/scheduling/routines.ts` (`buildRoutineStatusRows`), `cli/src/commands/routines.ts`.
+
+### Fixed
+
+- Daemon service restarts now replace periodic timers instead of multiplying their tick rate, and a timed-out tick parks until its real work settles instead of overlapping teardown or another tick. Live-session metadata publishing, monitor evaluation, heartbeat/process reconciliation, tmux and browser-task reaping, broker self-heal, and signed webhook ingress now run under the per-service supervisor with measured health and isolated failure handling.
+
+- **`agents view --json` and `agents devices harnesses/accounts --json` no longer leak the internal `'stale'` sentinel in their usage-error fields (PHNX-3348).** Without `--refresh`, a read-only usage lookup on a never-cached account returns the internal `USAGE_NOT_COLLECTED_MARKER` (`'stale'`) — a cache signal, not a message — and the JSON builders emitted it verbatim (as `usageError`, and as `quota.unavailableReason`), contradicting those fields' "human-readable" contract. Both surfaces now normalize through a new shared `usageErrorForDisplay` to a plain-language, actionable string (`Usage not collected yet — run \`agents view --refresh\` to fetch it.`); every genuine, already-human error passes through unchanged, and the human terminal renders were already correct and are untouched. Source: `cli/src/lib/accounting/usage.ts`, `cli/src/commands/view.ts`, `cli/src/lib/view-types.ts`, `cli/src/lib/devices/harness-inventory.ts`.
+
+- **`agents artifacts share open <target>` — open your own published page signed in as the owner, so its inline visibility control is actually usable (PHNX-3370).** The shared page's `Public`/`Unlisted`/… chip is an interactive dropdown only for the signed-in owner, but nothing ever handed a browser the login it needed — the Worker could *redeem* a `phoenix_ticket` cookie yet nothing *minted* one, so opening your own link left the chip a static cue. Now the share Worker mints a short-lived, single-use, self-signed login ticket at `POST /__ticket` (authenticated by the caller's Phoenix bearer — it grants nothing the caller didn't already have, and is domain-separated from the identity cookie so neither can be replayed as the other), and `share open` appends it to your page URL so the browser trades it for the `__share` cookie and the chip becomes a live control. Managed (Phoenix) endpoints only; run `agents artifacts share update` once to redeploy a Worker that predates the mint route. `agents artifacts share visibility <target> <level>` remains the no-browser way to re-scope in place. Source: `cli/src/commands/share.ts`, `cli/src/lib/share/worker-template.ts`.
+
+- **The new human task taxonomy actually applies to existing sessions now.** The traces topic classifier's output changed (Feature work / Bug fixes / Refactor / … in 1.22.54), but `classifyTopic`'s result is cached per-session in `session_topics` keyed by `SESSION_TOPIC_EXTRACTOR_VERSION` — which wasn't bumped, so every already-classified session stayed a cache hit at v1 with its old `Engineering`/`Operations` label and `agents traces sync` kept re-uploading the *old* labels. Bumped the version 1→2 so every session re-classifies with the new taxonomy on the next sync, and the Evals console treemap reflects it. Source: `cli/src/lib/session/db.ts`.
+
+- **`agents view claude` shows live session + week usage bars again on a personal device (RUSH-2392).** A foreground `agents view` at a TTY on a `personal` device now falls through to the interactive Claude login for the usage read — the only credential carrying the `user:profile` scope the usage endpoint needs — so `agents view --refresh` repopulates the session (5h) + week (7d) window for every signed-in account instead of showing `S: █████ unavailable` on idle homes. `3f3554c51` (RUSH-1822) had removed that fallback for *every* caller to stop the daemon's unattended usage/auth-health loops from firing the interactive token at Anthropic and getting the fleet logged out; that guarantee is intact — the read is now gated by `allowInteractiveUsageLogin(role, isTTY)`, so every background caller (daemon usage warm, auth-health probe, watchdog) and every `--json`/piped reader stays setup-token-only and default-closed. #2987's blanket-wording change was treating the symptom; this restores the data. A usage read still never *refreshes* an access token — an expired interactive login reports `expired-credential`. Source: `cli/src/lib/accounting/usage.ts`, `cli/src/commands/view.ts`, `cli/docs/secrets.md`, `cli/docs/specifications.md`.
+
 ## 1.22.54
 
 - **`agents accounts mint claude` (also `agents auth mint claude`) mints a

package/README.md

@@ -959,6 +959,9 @@ agents browser refs                  # Get interactive element refs
 agents browser click 42              # Click element ref 42
 agents browser type 15 --text "hello"  # Type into element ref 15
 agents browser screenshot            # Smart resizing, token-efficient
+agents browser record start --fps 10 --duration 40
+# Drive the page, then finalize a playable WebM under the task's recordings/ dir.
+agents browser record stop
 agents browser tabs                  # List tabs open for the current task
 agents browser tab focus tab123      # Switch focus to another tab
 agents browser done                  # Close task's tabs when finished
@@ -973,6 +976,11 @@ printf '%s\n' \
   | agents browser stream --task "$AGENTS_BROWSER_TASK"
 ```
 
+Recording resolves ffmpeg automatically. It reuses a usable binary on `PATH` or
+under `~/.agents/.cache`, and when none exists it installs through Homebrew on
+macOS, apt on Debian/Ubuntu, or the available platform package manager. If the
+automatic path cannot run, the error names the exact manual install command.
+
 ### Why this works where Playwright fails
 
 Playwright and Puppeteer spin up fresh browser instances with automation flags. Sites like LinkedIn, Google, and most finance apps detect and block them immediately.
@@ -1156,6 +1164,7 @@ agents routines add daily-digest \
   --prompt "Review yesterday's PRs and summarize key changes"
 
 agents routines list                   # All jobs + next run times
+agents routines status                 # Scheduler health + next fires (add --json for owner device, last fire, last error, in-flight run per routine)
 agents routines run daily-digest       # Test it now, ignore the schedule
 agents routines logs daily-digest      # Last execution — status + report (add --full for raw stdout)
 agents routines runs daily-digest      # Every attempt, including blocked/skipped pre-session runs
@@ -1287,6 +1296,7 @@ agents artifacts share list --scope me                      # just the owner-onl
 agents artifacts share edit fleet --label "Final fleet plan" --meta status=final
 agents artifacts share revisions fleet                      # prior versions kept under a slug
 agents artifacts share visibility fleet me                  # re-scope a published page in place (public|unlisted|me|org)
+agents artifacts share open fleet                           # open your page signed in, so its in-page visibility control is live
 agents artifacts share status                               # show the endpoint
 agents artifacts unshare fleet                              # take a published link (+ its OG cover) down
 ```
@@ -1298,7 +1308,10 @@ Cloudflare account, bucket, or write token — and `share status` / `list` / `re
 / `unshare` talk to that same endpoint. The handle is the local-part of the signed-in
 email (`muqsitnawaz@gmail.com` → `muqsitnawaz`); the page slug is readable plus a
 short view-id. HTML is stored as one object: local images are inlined, `file://` TOC
-links become in-page hashes, so the published page is actually viewable. `--visibility unlisted` (hidden aliases
+links become in-page hashes, so the published page is actually viewable. The managed
+Worker lazily renders and caches the branded 1200×630 Open Graph card at `<slug>.png`,
+so publishing from Linux does not require a local Chromium; BYO endpoints keep the
+local screenshot fallback. `--visibility unlisted` (hidden aliases
 `--unlisted` / `--private`) is a capability URL: GET still works, the gallery hides it,
 and the Worker sends `X-Robots-Tag: noindex`. `--visibility me` is visible only to
 you (the signed-in owner); `--visibility org` is visible to anyone at your email
@@ -1309,7 +1322,11 @@ stranger is redirected to sign in, then 404s). `share visibility <target> <level
 re-scopes an **already-published** page in place — the slug/URL is preserved and the
 body is untouched (a metadata-only change, like `share edit`, so no revision) — so you
 can promote a draft to `public` or pull a link back to `me`/`org` without re-publishing
-(`me`/`org` need a Phoenix session; `org` needs a workspace domain). Sign-in is a
+(`me`/`org` need a Phoenix session; `org` needs a workspace domain). The served page
+also carries an **in-page visibility control** — a chip you can switch right on the page
+— but it is interactive only for the signed-in owner, and a plain link has no login;
+`share open <target>` mints a short-lived, single-use login ticket and opens your page
+with it so the chip becomes a live dropdown. Sign-in is a
 single **Phoenix ID** (Google-only device-code OAuth, `agents auth login`) — see
 [`docs/share.md`](cli/docs/share.md) for the full identity + visibility model.
 **BYO Cloudflare** remains: `setup` reads

package/dist/commands/routines.js

@@ -16,7 +16,7 @@ import { parseAgentVersionSpec, isAgentHardDeprecated, hardDeprecationError, ROU
 import { isCustomHarnessName } from '../lib/profiles.js';
 import { RUN_STRATEGIES, normalizeRunStrategy } from '../lib/accounting/rotate.js';
 import { formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, isCanonicalRoutineSource, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, HOST_STRATEGIES, computeProjectGroupKind, projectGroupKey, projectGroupTitle, projectGroupOrder, normalizeProjects, buildRoutineListJson, fireConditionLabel, nextRunForDisplay, nextRunLabel, localLatestRun, listJobsForDisplay, } from '../lib/scheduling/routines.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, isCanonicalRoutineSource, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, HOST_STRATEGIES, computeProjectGroupKind, projectGroupKey, projectGroupTitle, projectGroupOrder, normalizeProjects, buildRoutineListJson, buildRoutineStatusRows, fireConditionLabel, nextRunForDisplay, nextRunLabel, localLatestRun, listJobsForDisplay, } from '../lib/scheduling/routines.js';
 export { buildRoutineListJson } from '../lib/scheduling/routines.js';
 import { listProjectDefs, isSafeProjectName } from '../lib/projects.js';
 import { evaluateActivationReadinessLive } from '../lib/routine-readiness.js';
@@ -831,6 +831,9 @@ export function registerRoutinesCommands(program) {
 
       # Check whether the scheduler is running
       agents routines status
+
+      # Machine-readable scheduler + per-routine status: owner device, last fire, last error, in-flight run
+      agents routines status --json
     `,
         notes: `
       A routine is a YAML file that schedules an agent invocation. It specifies:
@@ -2148,12 +2151,38 @@ export function registerRoutinesCommands(program) {
     routinesCmd
         .command('status')
         .description('Show scheduler status, enabled routines, and when each one fires next.')
-        .action(() => {
+        .option('--json', 'Emit machine-readable scheduler + per-routine status (owner device, last fire, last error, in-flight run)')
+        .action((options) => {
         try {
             monitorRunningJobs();
         }
         catch { /* best-effort orphan reap */ }
         const status = getDaemonStatus();
+        // The daemon-owned status surface (PHNX-3215): scheduler truth plus, per
+        // routine, its single owner device, last fire outcome + error, and any
+        // in-flight spawn — the fields `list --json` (definition-shaped) does not
+        // carry. Emitted from THIS device, so per-device fields read as this box's.
+        if (options.json) {
+            const rows = buildRoutineStatusRows();
+            writeJson({
+                device: machineId(),
+                scheduler: {
+                    state: status.state,
+                    pid: status.pid,
+                    binaryPath: status.binaryPath,
+                    heartbeat: status.heartbeat
+                        ? {
+                            lastTick: status.heartbeat.lastTick,
+                            ageSec: Math.round((Date.now() - Date.parse(status.heartbeat.lastTick)) / 1000),
+                        }
+                        : null,
+                    enabled: rows.filter((r) => r.enabled).length,
+                    total: rows.length,
+                },
+                routines: rows,
+            });
+            return;
+        }
         console.log(chalk.bold('Scheduler\n'));
         const stateLabel = status.state === 'running'
             ? chalk.green('running')

package/dist/commands/share.d.ts

@@ -172,6 +172,33 @@ export declare function runShareRevisions(target: string, opts?: {
     session?: PhoenixSession | null;
     fetchListing?: ListingFetchFn;
 }): Promise<ShareRevisionsResult>;
+/** The resolved page URL plus a signed-in-owner URL that carries a one-time
+ * login ticket, so opening it activates the shared page's inline visibility
+ * control (PHNX-3370). */
+export interface ShareOpenResult {
+    /** `<user>/<slug>` key of the target page. */
+    key: string;
+    /** The plain page URL (no ticket). */
+    url: string;
+    /** The page URL with `?phoenix_ticket=<t>` — open THIS to be the owner. */
+    ownerUrl: string;
+}
+/** Mint a one-time login ticket for the signed-in owner and build the URL that
+ * opens their own published page **as the owner**, so the inline visibility
+ * control is live in the browser. Managed backend only — the control is gated on
+ * the Phoenix identity, and BYO (WRITE_TOKEN) endpoints have no per-viewer login.
+ * `target` accepts the same three forms as `visibility`/`unshare` (a full URL,
+ * `<user>/<slug>`, or a bare slug in the caller's namespace). */
+export declare function runShareOpen(target: string, opts?: {
+    githubUser?: string;
+    config?: ShareConfig;
+    session?: PhoenixSession | null;
+    /** DI seam — override the ticket-mint POST. */
+    fetchTicket?: (url: string, bearer: string) => Promise<{
+        status: number;
+        body: string;
+    }>;
+}): Promise<ShareOpenResult>;
 export declare function formatShareRevisions(result: ShareRevisionsResult, json?: boolean): string;
 export declare function formatShareDeleteResult(result: DeleteShareResult, json?: boolean): string;
 interface ShareDeleteCliOpts {

package/dist/commands/share.js

@@ -13,11 +13,12 @@ import { DEFAULT_BUCKET_NAME, DEFAULT_CF_BUNDLE, DEFAULT_SHARE_DOMAIN, DEFAULT_W
 import { addCustomDomain, configureBucketLifecycle, createBucket, deployWorker, enableWorkersDev, findZoneId, hashWorkerScript, putWorkerSecret, updateWorker, WORKER_PHOENIX_ID_BASE_SECRET, setWorkerSecret, } from '../lib/share/provision.js';
 import { publishFile, resolveShareUsername, parseMetaEntries, sanitizeLabel, resolveShareVisibility, scanShareContent, formatSensitiveContentError, SHARE_VISIBILITY_LEVELS, } from '../lib/share/publish.js';
 import { deleteShare, resolveDeleteTarget } from '../lib/share/delete.js';
-import { renderWorkerScript } from '../lib/share/worker-template.js';
+import { renderWorkerBundle } from '../lib/share/worker-template.js';
 import { analyticsEnabled } from '../lib/share/analytics.js';
 import { phoenixIdBaseForDeploy, resolveShareBackend, } from '../lib/share/backend.js';
 import { resolveGitHubUsername } from '../lib/git.js';
 import { setHelpSections } from '../lib/help.js';
+import { showUrl } from '../lib/open-url.js';
 export function formatSharePublishResult(result, json = false) {
     if (json)
         return JSON.stringify(result, null, 2);
@@ -53,7 +54,7 @@ export function formatSharePublishResult(result, json = false) {
 export function shareTemplateStatus(cfg) {
     if (!cfg.templateHash)
         return 'unknown';
-    return cfg.templateHash === hashWorkerScript(renderWorkerScript()) ? 'current' : 'outdated';
+    return cfg.templateHash === hashWorkerScript(renderWorkerBundle().script) ? 'current' : 'outdated';
 }
 export async function runShareEdit(target, opts) {
     // Same public-listing gate as publish: label + every metadata value are
@@ -383,6 +384,49 @@ export async function runShareRevisions(target, opts = {}) {
     }
     return parseShareRevisions(key, res.body);
 }
+/** Mint a one-time login ticket for the signed-in owner and build the URL that
+ * opens their own published page **as the owner**, so the inline visibility
+ * control is live in the browser. Managed backend only — the control is gated on
+ * the Phoenix identity, and BYO (WRITE_TOKEN) endpoints have no per-viewer login.
+ * `target` accepts the same three forms as `visibility`/`unshare` (a full URL,
+ * `<user>/<slug>`, or a bare slug in the caller's namespace). */
+export async function runShareOpen(target, opts = {}) {
+    const backend = resolveShareBackend({
+        githubUser: opts.githubUser,
+        config: opts.config,
+        session: opts.session,
+        requireToken: false,
+    });
+    if (backend.kind !== 'managed') {
+        throw new Error("'agents artifacts share open' needs a managed (Phoenix) endpoint — the page's inline " +
+            "visibility control is gated on your signed-in identity. Run 'agents auth login' first.");
+    }
+    const baseUrl = backend.baseUrl.replace(/\/+$/, '');
+    const { key } = await resolveDeleteTarget(target, { githubUser: backend.namespace });
+    const url = `${baseUrl}/${key}`;
+    const doFetch = opts.fetchTicket ??
+        (async (u, bearer) => {
+            const res = await fetch(u, { method: 'POST', headers: { authorization: `Bearer ${bearer}` } });
+            return { status: res.status, body: await res.text() };
+        });
+    const res = await doFetch(`${baseUrl}/__ticket`, backend.token);
+    if (res.status !== 200) {
+        throw new Error(`Could not mint a login ticket (${res.status}) from ${baseUrl}/__ticket. ` +
+            "The endpoint may predate this feature — run 'agents artifacts share update' to redeploy the Worker.");
+    }
+    let ticket;
+    try {
+        const parsed = JSON.parse(res.body);
+        if (typeof parsed.ticket !== 'string' || !parsed.ticket)
+            throw new Error('no ticket in response');
+        ticket = parsed.ticket;
+    }
+    catch {
+        throw new Error(`Ticket endpoint at ${baseUrl}/__ticket did not return a usable ticket.`);
+    }
+    const ownerUrl = `${url}?phoenix_ticket=${encodeURIComponent(ticket)}`;
+    return { key, url, ownerUrl };
+}
 export function formatShareRevisions(result, json = false) {
     if (json)
         return JSON.stringify(result, null, 2);
@@ -714,6 +758,47 @@ ${SHARE_DELETE_NOTES}
         examples: SHARE_VISIBILITY_EXAMPLES,
         notes: SHARE_VISIBILITY_NOTES,
     });
+    const shareOpenCmd = shareCmd
+        .command('open')
+        .description("Open your own published page in the browser signed in as the owner, so the page's inline visibility control is live. Mints a one-time login ticket and appends it to the URL.")
+        .addArgument(new Argument('<target>', 'the published page: a full URL, <user>/<slug>, or a bare slug in your namespace'))
+        .option('--for-user <user>', 'GitHub username for resolving a bare-slug target (default: resolved from your Phoenix handle)')
+        .option('--no-open', 'print the owner URL instead of opening a browser')
+        .option('--json', 'emit a machine-readable result (includes the ticketed owner URL)')
+        .action(async (target, opts) => {
+        try {
+            const result = await runShareOpen(target, { githubUser: opts.forUser });
+            if (opts.json) {
+                console.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (opts.open === false) {
+                console.log(chalk.green(result.ownerUrl));
+                console.log(chalk.dim('  open this to land on the page as the owner (the visibility chip becomes a control)'));
+                return;
+            }
+            const shown = await showUrl(result.ownerUrl);
+            if (shown.via === 'none') {
+                console.log(chalk.green(result.ownerUrl));
+                console.error(chalk.dim('  could not open a browser — open the URL above yourself'));
+            }
+            else {
+                console.log(chalk.green(`Opened ${result.url} as owner — the visibility chip is now a live control.`));
+            }
+        }
+        catch (e) {
+            console.error(chalk.red(e.message));
+            process.exitCode = 1;
+        }
+    });
+    setHelpSections(shareOpenCmd, {
+        examples: `agents artifacts share open q3-plan               # open your page, signed in, ready to re-scope
+agents artifacts share open octocat/q3-plan
+agents artifacts share open https://share.agents-cli.sh/octocat/q3-plan --no-open`,
+        notes: `The shared page's visibility chip is an interactive control only for the signed-in owner; a plain link has no login, so the chip renders as a static cue. This mints a short-lived, single-use login ticket (self-signed by your share Worker) and opens the page with it, so the chip becomes a dropdown you can switch in place.
+Managed (Phoenix) endpoints only — run 'agents auth login' first. If the mint 501s/404s, your Worker predates the feature: run 'agents artifacts share update' to redeploy it.
+Prefer to change visibility without a browser? Use 'agents artifacts share visibility <target> <level>'.`,
+    });
     shareCmd
         .command('join')
         .description('Use an existing synced share endpoint and write token (no provisioning).')
@@ -1070,7 +1155,8 @@ export async function runShareProvision(opts) {
     const bucketName = opts.bucket;
     const token = generateWriteToken();
     const requestedDomain = cleanHostname(opts.domain) ?? DEFAULT_SHARE_DOMAIN;
-    const script = renderWorkerScript();
+    const worker = renderWorkerBundle();
+    const script = worker.script;
     const spin = ora('Provisioning on Cloudflare…').start();
     try {
         const provisionOpts = opts.request ? { request: opts.request } : {};
@@ -1078,7 +1164,7 @@ export async function runShareProvision(opts) {
         spin.text = `R2 bucket '${bucketName}' ready`;
         await configureBucketLifecycle(apiToken, accountId, bucketName, provisionOpts);
         spin.text = `R2 bucket '${bucketName}' lifecycle ready`;
-        await deployWorker(apiToken, accountId, workerName, script, bucketName, provisionOpts);
+        await deployWorker(apiToken, accountId, workerName, worker, bucketName, provisionOpts);
         spin.text = `Worker '${workerName}' deployed`;
         await setWorkerSecret(apiToken, accountId, workerName, token, provisionOpts);
         spin.text = `Worker '${workerName}' write token set`;
@@ -1145,14 +1231,14 @@ export async function runShareUpdate(opts = {}) {
         throw new Error("Share endpoint has no Cloudflare account id — `agents artifacts share update` cannot call the API. Pass --account <id>, or re-run 'agents artifacts share join'.");
     }
     const writeToken = readWriteToken();
-    const script = renderWorkerScript();
+    const worker = renderWorkerBundle();
     const phoenixIdBase = phoenixIdBaseForDeploy({ managed: opts.managed }, cfg);
     const provisionOpts = {
         ...(opts.request ? { request: opts.request } : {}),
         force: opts.force,
         ...(phoenixIdBase !== undefined ? { phoenixIdBase } : {}),
     };
-    const result = await updateWorker(apiToken, accountId, cfg.workerName, cfg.bucketName, script, writeToken, cfg.templateHash, provisionOpts);
+    const result = await updateWorker(apiToken, accountId, cfg.workerName, cfg.bucketName, worker, writeToken, cfg.templateHash, provisionOpts);
     if (!result.skipped) {
         writeShareConfig({ ...cfg, accountId, templateHash: result.templateHash });
     }

package/dist/commands/view.d.ts

@@ -11,6 +11,7 @@ import { accountDisplayLabel } from '../lib/agents.js';
 import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
 import type { FormatUsageSummaryOpts, UsageInfo } from '../lib/accounting/usage.js';
+import { type ConfiguredDeviceRole } from '../lib/device-config.js';
 import type { ResourceSection, ViewJsonAgent } from '../lib/view-types.js';
 export type { ResourceItemJson, ResourceSection, SyncState, VersionResourcesJson, ViewJsonAgent, ViewJsonVersion } from '../lib/view-types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
@@ -68,6 +69,13 @@ export declare function descriptionForPrefix(desc: string | undefined, prefix: s
  * host is missing is flagged rather than silently listed as runnable.
  */
 export declare function renderHarnessBlocks(harnesses: ProfileSummary[], installedHosts: Set<AgentId>, showPaths: boolean, byokMap?: Map<string, ByokUsageResult>): void;
+/**
+ * The USAGE-READ-2 decision, isolated from its runtime inputs so it can be
+ * tested directly: a usage read may fall through to the interactive OAuth login
+ * ONLY for a foreground human render on a `personal` device. Both conditions are
+ * required — role alone is not sufficient.
+ */
+export declare function allowInteractiveUsageLogin(role: ConfiguredDeviceRole | undefined, isTTY: boolean): boolean;
 /** Build the set of resource sections to include in `--json` from the
  *  `--resources` / `--detailed` flags, plus (in --json mode) the per-section
  *  boolean filters (`--skills` etc.) that plain `--json` historically ignored. */

package/dist/commands/view.js

@@ -8,7 +8,8 @@ import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getUnmanag
 import { ambientClaudeToken, loginHint } from '../lib/signin-badge.js';
 import { machineId } from '../lib/machine-id.js';
 import { authCacheKey, readAuthHealthCache } from '../lib/auth-health.js';
-import { agentReportsUsage, classifyUsageErrorKind, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageBenignState, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
+import { agentReportsUsage, classifyUsageErrorKind, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageBenignState, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, usageErrorForDisplay, } from '../lib/accounting/usage.js';
+import { selfConfiguredDeviceRole } from '../lib/device-config.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, isVersionIsolated, getIsolatedDefault, } from '../lib/installations/versions.js';
 import { ensureVersionedAliasCurrent, removeShim, } from '../lib/installations/shims.js';
@@ -316,6 +317,29 @@ function renderHostClisSection(cwd) {
         console.log(`  ${chalk.red('error')}      ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
     }
 }
+/**
+ * The USAGE-READ-2 decision, isolated from its runtime inputs so it can be
+ * tested directly: a usage read may fall through to the interactive OAuth login
+ * ONLY for a foreground human render on a `personal` device. Both conditions are
+ * required — role alone is not sufficient.
+ */
+export function allowInteractiveUsageLogin(role, isTTY) {
+    return role === 'personal' && isTTY === true;
+}
+/**
+ * Whether this `agents view` invocation may fall through to the interactive
+ * OAuth login for a usage read (USAGE-READ-2). True only for a foreground human
+ * render on a `personal` device: the interactive login is the sole credential
+ * carrying the `user:profile` scope the usage endpoint needs, and a human
+ * running one command is not the unattended-loop revocation risk RUSH-1822
+ * fixed. The `--json` path never reaches these render functions (it returns
+ * early via `collectAgentsJson`), and a non-TTY (piped/scripted) run is excluded
+ * here too, so a machine reader can never silently acquire the interactive
+ * credential — role alone is not sufficient.
+ */
+function usageAllowInteractiveLogin() {
+    return allowInteractiveUsageLogin(selfConfiguredDeviceRole(), process.stdout.isTTY === true);
+}
 async function showInstalledVersions(filterAgentId, viewOpts) {
     const spinnerText = filterAgentId
         ? `Checking ${agentLabel(filterAgentId)} agents...`
@@ -422,7 +446,10 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             cliVersion,
             info,
         })),
-    ], { forceRefresh: viewOpts?.forceRefresh });
+    ], {
+        forceRefresh: viewOpts?.forceRefresh,
+        allowInteractiveLogin: usageAllowInteractiveLogin(),
+    });
     spinner.stop();
     console.log(chalk.bold('Installed Agent CLIs\n'));
     const mergeCanonical = (info) => {
@@ -930,7 +957,7 @@ async function showAgentResources(agentId, requestedVersion, filter) {
             home,
             cliVersion: version,
             info: accountInfo,
-        });
+        }, { allowInteractiveLogin: usageAllowInteractiveLogin() });
         const accountLabel = accountColumnLabel(accountInfo);
         const emailStr = accountLabel ? chalk.cyan(`  ${accountLabel}`) : '';
         const status = chalk.green(version);
@@ -1273,7 +1300,7 @@ export async function collectAgentsJson(filterAgentId, resourceSections, opts) {
             plan: info.plan,
             usageStatus: info.usageStatus,
             overageCredits: info.overageCredits,
-            usageError: usageInfo?.error ?? null,
+            usageError: usageErrorForDisplay(usageInfo?.error),
             windows: snapshot
                 ? snapshot.windows.map((w) => ({
                     key: w.key,

package/dist/lib/accounting/usage.d.ts

@@ -108,6 +108,18 @@ export type UsageBenignState = 'no-recent-usage';
  * is unchanged; callers that already compare against `'stale'` keep working.
  */
 export declare const USAGE_NOT_COLLECTED_MARKER = "stale";
+/**
+ * Human-facing form of a `UsageInfo.error` for a machine/JSON consumer
+ * (`agents view --json`'s `usageError`). Every error string this module
+ * constructs is already a full human sentence EXCEPT the internal
+ * {@link USAGE_NOT_COLLECTED_MARKER} (`'stale'`) sentinel, which a read-only
+ * lookup returns for a never-cached account when `--refresh` was not passed. That
+ * value is an internal cache signal, not an error message, and leaking it verbatim
+ * contradicts the field's "human-readable" contract (PHNX-3348). Map it to a
+ * plain-language, actionable string and pass every genuine error through
+ * unchanged. Returns `null` when there is no error.
+ */
+export declare function usageErrorForDisplay(error: string | null | undefined): string | null;
 /**
  * Shared error-classification + 429 backoff for a networked usage fetch whose
  * only signal is an HTTP status (or none at all, on a network failure) —
@@ -212,6 +224,16 @@ interface UsageOptions {
      * setup-token, or `<home>/.claude/.credentials.json` only.
      */
     fileOnly?: boolean;
+    /**
+     * When true, a read that finds no file-based setup-token MAY fall through to
+     * Claude Code's interactive OAuth login (the only credential carrying
+     * `user:profile`, which `/api/oauth/usage` requires). OFF by default and set
+     * ONLY by a foreground human `agents view` on a `personal` device (see
+     * USAGE-READ-2). Every background caller — daemon usage warm, auth-health
+     * probe, watchdog — leaves it unset, preserving the RUSH-1822 guarantee that
+     * an unattended loop never transmits the interactive login to Anthropic.
+     */
+    allowInteractiveLogin?: boolean;
 }
 /** Canonical input for a single usage fetch operation. */
 export interface UsageFetchInput {
@@ -308,6 +330,14 @@ export declare const USAGE_FETCH_CONCURRENCY = 3;
 export interface UsageLookupOptions {
     forceRefresh?: boolean;
     fileOnly?: boolean;
+    /**
+     * Permit a foreground personal-device usage read to fall through to the
+     * interactive login when no setup-token exists (USAGE-READ-2). Set ONLY by
+     * `agents view` when `selfConfiguredDeviceRole() === 'personal'` and the
+     * output is a human TTY (not `--json`). Threads into `getClaudeUsageInfo` →
+     * `loadClaudeOauth`. Unset for every other lookup.
+     */
+    allowInteractiveLogin?: boolean;
 }
 export declare function getUsageInfoByIdentity(inputs: UsageIdentityInput[], opts?: UsageLookupOptions): Promise<{
     canonicalByUsageKey: Map<string, AccountInfo>;
@@ -610,6 +640,7 @@ export declare function normalizeDroidWindows(data: DroidBillingLimitsResponse):
 export declare function loadClaudeOauth(home?: string, opts?: {
     accessTokenCache?: boolean;
     fileOnly?: boolean;
+    allowInteractiveLogin?: boolean;
 }): Promise<ClaudeOauthCredentials | null>;
 /**
  * Save Claude OAuth credentials to the system keychain/keyring.

package/dist/lib/accounting/usage.js

@@ -173,6 +173,25 @@ export const USAGE_BENIGN_STATE = Symbol('usageBenignState');
  * is unchanged; callers that already compare against `'stale'` keep working.
  */
 export const USAGE_NOT_COLLECTED_MARKER = 'stale';
+/**
+ * Human-facing form of a `UsageInfo.error` for a machine/JSON consumer
+ * (`agents view --json`'s `usageError`). Every error string this module
+ * constructs is already a full human sentence EXCEPT the internal
+ * {@link USAGE_NOT_COLLECTED_MARKER} (`'stale'`) sentinel, which a read-only
+ * lookup returns for a never-cached account when `--refresh` was not passed. That
+ * value is an internal cache signal, not an error message, and leaking it verbatim
+ * contradicts the field's "human-readable" contract (PHNX-3348). Map it to a
+ * plain-language, actionable string and pass every genuine error through
+ * unchanged. Returns `null` when there is no error.
+ */
+export function usageErrorForDisplay(error) {
+    if (!error)
+        return null;
+    if (error === USAGE_NOT_COLLECTED_MARKER) {
+        return 'Usage not collected yet — run `agents view --refresh` to fetch it.';
+    }
+    return error;
+}
 /**
  * Shared error-classification + 429 backoff for a networked usage fetch whose
  * only signal is an HTTP status (or none at all, on a network failure) —
@@ -395,6 +414,7 @@ export async function getUsageInfoForIdentity(input, opts) {
             cliVersion: input.cliVersion,
             organizationId: input.info.organizationId,
             fileOnly: opts?.fileOnly,
+            allowInteractiveLogin: opts?.allowInteractiveLogin,
         });
     }
     const cached = readClaudeUsageCache(usageKey);
@@ -416,14 +436,16 @@ export async function getUsageInfoForIdentity(input, opts) {
         return { snapshot: null, error: USAGE_NOT_COLLECTED_MARKER };
     }
     // Explicit refresh: block on the shared device collector.
-    return fetchLiveUsageDeduped(input, usageKey, cached, opts?.fileOnly === true);
+    return fetchLiveUsageDeduped(input, usageKey, cached, opts?.fileOnly === true, {
+        allowInteractiveLogin: opts?.allowInteractiveLogin === true,
+    });
 }
 /**
  * Single-flight live usage fetch per usage key. Concurrent callers (view +
  * rotation, or two rows sharing an account) await the same promise rather than
  * opening duplicate HTTP requests that then time out and pile up.
  */
-async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly) {
+async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly, opts) {
     const existing = inFlightLiveFetches.get(usageKey);
     if (existing)
         return existing;
@@ -446,6 +468,7 @@ async function fetchLiveUsageDeduped(input, usageKey, cached, fileOnly) {
                 // throttled account cannot park the whole provider (RUSH-3036).
                 usageScope: usageKey,
                 fileOnly,
+                allowInteractiveLogin: opts?.allowInteractiveLogin === true,
             });
             if (usage.snapshot) {
                 if (!usage.snapshot.capturedAt || usage.snapshot.capturedAt.getTime() <= previousCapturedAt) {
@@ -822,9 +845,17 @@ async function getClaudeUsageInfo(options) {
         // the interactive login (reading that ACL-bound token and firing it at the
         // usage API is what got it revoked — RUSH-1822). No setup-token => null =>
         // "usage pending". fileOnly additionally forbids the ACL keychain path.
+        //
+        // allowInteractiveLogin is the one sanctioned exception (USAGE-READ-1/2): a
+        // foreground human `agents view` on a `personal` device MAY fall through to
+        // the interactive login when no setup-token exists, because that login is the
+        // only credential carrying the `user:profile` scope the usage endpoint
+        // requires (the setup-token is user:inference → 403, RUSH-2392). It is unset
+        // for every background caller, so the RUSH-1822 guarantee is untouched there.
         const oauth = await loadClaudeOauth(options?.home, {
             accessTokenCache: true,
             fileOnly: options?.fileOnly === true,
+            allowInteractiveLogin: options?.allowInteractiveLogin === true,
         });
         if (!oauth?.accessToken) {
             // NOT the shared no-credential message: "sign in" is not a remedy here.
@@ -1515,7 +1546,7 @@ export async function loadClaudeOauth(home, opts) {
             // the source of truth if it has actually been revoked.
             return { accessToken: setupToken };
         }
-        // No provisioned setup-token: a read-only usage/health probe MUST NOT fall
+        // No provisioned setup-token. A read-only usage/health probe MUST NOT fall
         // through to Claude Code's interactive login credential. The daemon's usage
         // (~60s) and auth-health (~3min) warms would otherwise read the ACL-bound
         // OAuth token and transmit it to api.anthropic.com/api/oauth/usage — an
@@ -1525,7 +1556,17 @@ export async function loadClaudeOauth(home, opts) {
         // (docs/secrets.md). Report unprovisioned (-> probe
         // token 'missing' -> auth-health 'unconfigured', benign for rotation); seed a
         // setup-token via the mint-auth path to restore usage/probe for the account.
-        return null;
+        //
+        // The single sanctioned exception (USAGE-READ-1/2): a foreground human
+        // `agents view` on a `personal` device sets allowInteractiveLogin, and only
+        // then do we fall through to the interactive-login read below — the one
+        // credential carrying `user:profile`, which the usage endpoint requires. This
+        // is a human running one command, not an unattended loop, so it is not the
+        // revocation risk RUSH-1822 fixed. Every background caller leaves the flag
+        // unset and still returns null here.
+        if (opts?.allowInteractiveLogin !== true) {
+            return null;
+        }
     }
     // Full-credential callers (isClaudeAuthValid -> getClaudeAccessToken)
     // legitimately read the interactive login to run/refresh Claude. Rush Cloud

package/dist/lib/browser/cdp.d.ts

@@ -3,7 +3,7 @@ export interface CDPPipeTransport {
     read: Readable;
     write: Writable;
 }
-type EventHandler = (params: Record<string, unknown>) => void;
+type EventHandler = (params: Record<string, unknown>, sessionId?: string) => void;
 export declare function registerPipeTransport(transport: CDPPipeTransport): string;
 export declare class CDPClient {
     private ws;

package/dist/lib/browser/cdp.js

@@ -146,7 +146,7 @@ export class CDPClient {
             const handlers = this.eventHandlers.get(msg.method);
             if (handlers) {
                 for (const handler of handlers) {
-                    handler(msg.params || {});
+                    handler(msg.params || {}, msg.sessionId);
                 }
             }
         }