@phnx-labs/agents-cli 1.22.62 → 1.22.63

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.22.63
+
+- **Managed share endpoint enforces a per-user storage quota, object limit, per-file size cap, and publish rate limit (PHNX-3542).** The managed `share.agents-cli.sh` Worker authenticated any Phoenix ID bearer and then accepted **unbounded** writes into shared R2 — no quota, no rate limit, no size cap — which blocked opening publishing to third parties. Each managed (Phoenix-identity) publish now charges a per-user usage ledger stored in R2 at `__usage/<owner>` (a conditional-put CAS object, mirroring the existing `__views`/`__handles` precedent — no Durable Object, no new binding): free tier is 200 MiB total, 150 canonical pages, 20 MiB per file, and 60 publishes/hour. Enforcement measures the **real request body** (bounded-buffered so a streaming body can't exceed the cap) and rejects on the true size **before any write**, so a spoofed-low declared size can't bypass the caps or destroy an existing page. It **fails loud** — `413` for a file, object-count, or byte-quota overage, `429` (with `Retry-After`) for the rate limit — and refunds bytes + object count on delete and on lazy expiry. Covers/views are server-generated overhead and excluded from the quota. BYO (`WRITE_TOKEN`) publishes write to the operator's own bucket at their own cost and are **unaffected** (a deliberate, documented policy). A `SHARE_PLANS` map is the seam for future paid tiers (billing follow-up PHNX-3569). Source: `cli/src/lib/share/worker-template.ts`.
+
+- Let feed channel sinks customize their delivered body with existing post placeholders, including fail-closed `{ticket}` routing for clickable tracker links in team channels.
+
 ## 1.22.62
 
 - **Owner notifications fan out across the configured normal-severity channels (PHNX-3567).** `agents send --to owner`, deprecated `agents notify`, monitor notifications, and an important feed's owner sink now attempt every addressable entry named by `owner.policy.normal` in `humans.yaml`, instead of silently selecting only the first. Each Rush-backed destination that cannot deliver on a Linux worker forwards its explicit channel and target to a capable Mac, avoiding both shell quoting and policy re-expansion/duplicate sends. Partial failures stay visible while successful channels still deliver; legacy single-channel configs retain their old behavior. Source: `cli/src/lib/humans.ts`, `cli/src/lib/notify.ts`, `cli/src/lib/channels/owner-forward.ts`, `cli/src/lib/feed-broadcast.ts`.

package/dist/commands/feed.d.ts

@@ -20,7 +20,7 @@ import { type OpenBlock } from '../lib/feed/feed.js';
 import { type OutcomeGroup, type SessionOutcomeHint } from '../lib/feed-outcome.js';
 import { filterBlocksForFeed } from '../lib/ask-classifier.js';
 import { type FeedSessionSignal } from '../lib/feed-ranking.js';
-export declare const FEED_POST_HELP = "\nExamples:\n  # Title (subject) + body. Phone broadcasts put title first, body after a\n  # blank line, then a \"Sent from agent/session on host\" footer.\n  agents feed post --title \"CHANGELOG pushed\" \"Watching CI and mac-mini E2E\"\n  agents feed post --title \"Cover ready\" \"render at ./out/cover.png\" --attach ./out/cover.png\n  agents feed post --title \"Ready for review\" \"PR opened, waiting on prix-cloud\" --json\n\n  # Worth interrupting someone over - reaches sinks gated on minLevel: important:\n  agents feed post --title \"npm token expired\" \"Cannot publish the release\" --level important\n\n  # Also raise a local desktop banner on THIS machine (same notifier as run\n  # --notify), on top of any configured broadcast - useful when you are at the box:\n  agents feed post --title \"Build green\" \"all checks passed\" --notify\n\n  # Stuck: opens a needs-you block and always broadcasts at important:\n  agents feed post --title \"Force-push denied\" \"git-guard blocked PR #1749\" --blocked\n  agents feed post --title \"Publish or wait?\" \"npm publish now or after review\" --blocked --option publish --option wait\n  agents feed post --title \"Delete preview env?\" \"stale preview still running\" --blocked --default \"leave it\"\n\n  # Exhaust self-serve FIRST. A block is for what you genuinely cannot do:\n  # a credential only the user holds, a decision only they can make, an\n  # approval only they can give. Not \"should I do the obvious next step?\".\n\n  # Outside a run, pass the session explicitly:\n  agents feed post --title \"Manual note\" \"context for the next agent\" --session 00998b0e-2d15-4d2f-a58b-974a886c9b47\n\nIdentity (session, agent, host, runtime, pid, launchId) is stamped automatically\nand rides the phone footer of feed.broadcast {message}. Domain facts (tickets,\nPRs) are not CLI flags - the ticket is joined from the session index at post\ntime. No em-dashes in title/body - they are scrubbed on the way out.\n\nConfigure where a post is mirrored under feed.broadcast in agents.yaml - see\ndocs/observability.md. A milestone is always recorded, but it does not text\nthe owner when the sink has minLevel: important. Add --level important for a\nphone-worthy successful update. Use --blocked only when work cannot continue.\nThe owner destination comes from humans.yaml; do not duplicate it in agents.yaml.\n";
+export declare const FEED_POST_HELP = "\nExamples:\n  # Title (subject) + body. Phone broadcasts put title first, body after a\n  # blank line, then a \"Sent from agent/session on host\" footer.\n  agents feed post --title \"CHANGELOG pushed\" \"Watching CI and mac-mini E2E\"\n  agents feed post --title \"Cover ready\" \"render at ./out/cover.png\" --attach ./out/cover.png\n  agents feed post --title \"Ready for review\" \"PR opened, waiting on prix-cloud\" --json\n\n  # Worth interrupting someone over - reaches sinks gated on minLevel: important:\n  agents feed post --title \"npm token expired\" \"Cannot publish the release\" --level important\n\n  # Also raise a local desktop banner on THIS machine (same notifier as run\n  # --notify), on top of any configured broadcast - useful when you are at the box:\n  agents feed post --title \"Build green\" \"all checks passed\" --notify\n\n  # Stuck: opens a needs-you block and always broadcasts at important:\n  agents feed post --title \"Force-push denied\" \"git-guard blocked PR #1749\" --blocked\n  agents feed post --title \"Publish or wait?\" \"npm publish now or after review\" --blocked --option publish --option wait\n  agents feed post --title \"Delete preview env?\" \"stale preview still running\" --blocked --default \"leave it\"\n\n  # Exhaust self-serve FIRST. A block is for what you genuinely cannot do:\n  # a credential only the user holds, a decision only they can make, an\n  # approval only they can give. Not \"should I do the obvious next step?\".\n\n  # Outside a run, pass the session explicitly:\n  agents feed post --title \"Manual note\" \"context for the next agent\" --session 00998b0e-2d15-4d2f-a58b-974a886c9b47\n\nIdentity (session, agent, host, runtime, pid, launchId) is stamped automatically\nand rides the phone footer of feed.broadcast {message}. Domain facts (tickets,\nPRs) are not CLI flags - the ticket is joined from the session index at post\ntime. No em-dashes in title/body - they are scrubbed on the way out.\n\nConfigure where a post is mirrored under feed.broadcast in agents.yaml - see\ndocs/observability.md. A channel sink may set message: with placeholders such\nas {message} and {ticket}; a missing placeholder skips that sink. A milestone is always recorded, but it does not text\nthe owner when the sink has minLevel: important. Add --level important for a\nphone-worthy successful update. Use --blocked only when work cannot continue.\nThe owner destination comes from humans.yaml; do not duplicate it in agents.yaml.\n";
 export declare const FEED_NO_FANOUT_ENV = "AGENTS_FEED_LOCAL";
 /** Right-hand masthead summary: `N blocks · M agents`. */
 export declare function formatFeedMastheadRight(blocks: OpenBlock[]): string;

package/dist/commands/feed.js

@@ -57,7 +57,8 @@ PRs) are not CLI flags - the ticket is joined from the session index at post
 time. No em-dashes in title/body - they are scrubbed on the way out.
 
 Configure where a post is mirrored under feed.broadcast in agents.yaml - see
-docs/observability.md. A milestone is always recorded, but it does not text
+docs/observability.md. A channel sink may set message: with placeholders such
+as {message} and {ticket}; a missing placeholder skips that sink. A milestone is always recorded, but it does not text
 the owner when the sink has minLevel: important. Add --level important for a
 phone-worthy successful update. Use --blocked only when work cannot continue.
 The owner destination comes from humans.yaml; do not duplicate it in agents.yaml.

package/dist/lib/feed-broadcast.d.ts

@@ -21,6 +21,13 @@ export interface FeedSinkConfig {
     channel?: string;
     /** Recipient for a `channel` sink. Required unless `channel` is the `owner` alias. */
     to?: string;
+    /**
+     * Optional channel body template. Uses the same placeholders as `command`
+     * argv (`{message}`, `{ticket}`, `{project}`, ...). Defaults to `{message}`.
+     * A missing placeholder skips the sink, which lets a `{ticket}` template
+     * declare that only ticket-backed posts belong in that destination.
+     */
+    message?: string;
     /** Lowest post level that reaches this sink. Defaults to `milestone` (all posts). */
     minLevel?: FeedPostLevel;
 }
@@ -150,6 +157,8 @@ export declare function composeBroadcastMessage(ctx: FeedBroadcastContext): stri
  * would otherwise comment on nothing.
  */
 export declare function renderSinkArgv(template: string[], ctx: FeedBroadcastContext): string[] | undefined;
+/** Render one channel-message template with the same fail-closed placeholder contract as argv. */
+export declare function renderSinkMessage(template: string, ctx: FeedBroadcastContext): string | undefined;
 /**
  * Which sinks this post reaches, in config order. Pure — the dry-run listing and
  * the real fan-out plan through here, so what `--dry-run` shows is what runs.

package/dist/lib/feed-broadcast.js

@@ -324,6 +324,23 @@ export function renderSinkArgv(template, ctx) {
     }
     return argv.length > 0 ? argv : undefined;
 }
+/** Render one channel-message template with the same fail-closed placeholder contract as argv. */
+export function renderSinkMessage(template, ctx) {
+    const vars = templateVars(ctx);
+    let missing = false;
+    const rendered = template.replace(PLACEHOLDER, (whole, key) => {
+        const value = vars[key];
+        if (value === undefined || value === '') {
+            missing = true;
+            return whole;
+        }
+        return value;
+    });
+    if (missing)
+        return undefined;
+    const text = rendered.trim();
+    return text || undefined;
+}
 /**
  * Which sinks this post reaches, in config order. Pure — the dry-run listing and
  * the real fan-out plan through here, so what `--dry-run` shows is what runs.
@@ -350,11 +367,14 @@ export function planFeedBroadcast(config, ctx) {
             // placeholder below).
             if (!isOwnerAlias(channel) && !sink.to?.trim())
                 continue;
+            const text = renderSinkMessage(sink.message ?? '{message}', ctx);
+            if (!text)
+                continue;
             planned.push({
                 name,
                 channel,
                 to: isOwnerAlias(channel) ? undefined : sink.to.trim(),
-                text: composeBroadcastMessage(ctx),
+                text,
             });
             continue;
         }

package/dist/lib/resource-inventory.d.ts

@@ -1,6 +1,6 @@
 /**
  * Resource inventory — the single chokepoint for "what does this agent@version
- * have" (RUSH-2238, parent RUSH-2236; spec: openspec/specs/resource-inventory).
+ * have" (RUSH-2238, parent RUSH-2236). Contract: cli/docs/specifications.md.
  *
  * One API answers four orthogonal questions per (agent, version, kind):
  *

package/dist/lib/resource-inventory.js

@@ -1,6 +1,6 @@
 /**
  * Resource inventory — the single chokepoint for "what does this agent@version
- * have" (RUSH-2238, parent RUSH-2236; spec: openspec/specs/resource-inventory).
+ * have" (RUSH-2238, parent RUSH-2236). Contract: cli/docs/specifications.md.
  *
  * One API answers four orthogonal questions per (agent, version, kind):
  *

package/dist/lib/share/worker-template.js

@@ -251,21 +251,70 @@ export default {
       // segments deep (an unsupported shape outside the CLI) landing on the same
       // literal revision key.
       const noRevision = !!request.headers.get('x-share-no-revision');
-      if (!noRevision) {
-        const existing = await env.BUCKET.get(path);
-        if (existing) {
-          const existingHeaders = new Headers();
-          if (typeof existing.writeHttpMetadata === 'function') existing.writeHttpMetadata(existingHeaders);
-          const existingContentType = existingHeaders.get('content-type');
-          const revKey = path + '/rev-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8);
-          await env.BUCKET.put(revKey, existing.body, {
-            httpMetadata: existingContentType ? { contentType: existingContentType } : undefined,
-            customMetadata: existing.customMetadata || {},
-          });
+      // PHNX-3542: per-user storage quota + object count + per-file size cap +
+      // publish rate limit, enforced ONLY for a managed Phoenix identity. A BYO
+      // WRITE_TOKEN publish writes to the operator's OWN bucket at their own
+      // cost, so it skips all four — a deliberate, documented policy, NOT a
+      // silent no-op. The current object is needed for BOTH the revision copy and
+      // the charge math, so read it once here; a BYO no-revision publish still
+      // skips the read entirely (nothing consumes it).
+      const needExisting = !noRevision || auth.kind === 'phoenix';
+      const existing = needExisting ? await env.BUCKET.get(path) : null;
+      // Enforcement measures the REAL request body, never a client-declared size.
+      // A spoofed-low content-length must NOT (a) slip an oversized body past the
+      // per-file cap, (b) let real bytes exceed the total quota, or — most
+      // dangerously — (c) reach the destructive revision-copy + canonical
+      // overwrite before the size is known and DESTROY the existing page. So for a
+      // Phoenix write we buffer the body bounded by the plan's per-file cap and
+      // reject on the REAL size BEFORE any write; only then do we copy the
+      // revision and store the buffered bytes. BYO streams unbuffered (uncapped,
+      // its own bucket).
+      let putBody = request.body;
+      if (auth.kind === 'phoenix') {
+        const limits = planLimits((await readUsage(env, auth.owner)).usage.plan);
+        // Fast-reject an HONEST oversized content-length without reading the body.
+        // A dishonest (absent or lied-low) length falls through to the bounded
+        // read below, which measures the truth.
+        const declaredLen = parseInt(request.headers.get('content-length') || '', 10);
+        if (Number.isFinite(declaredLen) && declaredLen > limits.maxFileBytes) {
+          return json({ error: 'file too large', maxBytes: limits.maxFileBytes, gotBytes: declaredLen }, 413);
+        }
+        // readBodyBounded aborts the moment it passes the cap, so a chunked/
+        // streaming body can never buffer more than the cap (+ one chunk).
+        const read = await readBodyBounded(request, limits.maxFileBytes);
+        if (read.oversize) {
+          return json({ error: 'file too large', maxBytes: limits.maxFileBytes, gotBytes: read.size }, 413);
         }
+        const realBytes = read.size;
+        const existingSize = existing && typeof existing.size === 'number' ? existing.size : 0;
+        const newCanonical = !existing;
+        // Keeping a revision retains the old canonical bytes AND adds the new
+        // ones, so storage grows by the full new size. A no-revision or first
+        // publish grows by new minus the bytes it replaces (may be negative on a
+        // shrink; the ledger clamps at >= 0).
+        const charge = (!noRevision && existing) ? realBytes : realBytes - existingSize;
+        const charged = await chargeShareWrite(env, auth, {
+          charge: charge,
+          newCanonical: newCanonical,
+          fileBytes: realBytes,
+          countRate: true,
+        });
+        if (charged.error) return charged.error; // rejected BEFORE any destructive write
+        putBody = read.bytes;
       }
 
-      await env.BUCKET.put(path, request.body, {
+      if (!noRevision && existing) {
+        const existingHeaders = new Headers();
+        if (typeof existing.writeHttpMetadata === 'function') existing.writeHttpMetadata(existingHeaders);
+        const existingContentType = existingHeaders.get('content-type');
+        const revKey = path + '/rev-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8);
+        await env.BUCKET.put(revKey, existing.body, {
+          httpMetadata: existingContentType ? { contentType: existingContentType } : undefined,
+          customMetadata: existing.customMetadata || {},
+        });
+      }
+
+      await env.BUCKET.put(path, putBody, {
         httpMetadata: { contentType },
         customMetadata,
       });
@@ -508,6 +557,22 @@ export default {
       const expiresAt = obj.customMetadata && obj.customMetadata['expires-at'];
       if (expiresAt && Date.now() > Date.parse(expiresAt)) {
         await env.BUCKET.delete(path);
+        // PHNX-3542: expiry is a lazy delete with no auth context. Refund the
+        // stamped owner's quota (bytes + object count) best-effort — a refund
+        // failure must never break serving the 410. A canonical page is 2
+        // segments; covers are excluded (never charged) so refund is safe here
+        // because only canonical pages ever carry an expires-at.
+        const expiredOwner = obj.customMetadata && obj.customMetadata['owner'];
+        if (expiredOwner && !path.endsWith('.png')) {
+          try {
+            await refundShareWrite(env, expiredOwner, {
+              refund: typeof obj.size === 'number' ? obj.size : 0,
+              freeCanonical: path.split('/').filter(Boolean).length === 2,
+            });
+          } catch (e) {
+            // best-effort: serving the expiry 410 must never depend on the refund
+          }
+        }
         return new Response('gone — this link has expired', { status: 410, headers: { 'content-type': 'text/plain' } });
       }
       // Resolve the viewer ONCE — needed both to gate me/org reads AND to decide
@@ -615,7 +680,24 @@ export default {
           return json({ error: 'namespace mismatch', owner: handle || uid }, 403);
         }
       }
+      // PHNX-3542: capture the object's size BEFORE deleting so a managed
+      // Phoenix owner's quota can be refunded. A canonical page (2 segments, not
+      // a .png cover) refunds both bytes and the object count; a retained
+      // revision (3+ segments) refunds bytes only; a server-generated .png cover
+      // was never charged, so it is skipped entirely.
+      let doomed = null;
+      const isCover = path.endsWith('.png');
+      if (auth.kind === 'phoenix' && !isCover && !firstSeg.startsWith('__')) {
+        doomed = typeof env.BUCKET.head === 'function' ? await env.BUCKET.head(path) : await env.BUCKET.get(path);
+      }
       await env.BUCKET.delete(path);
+      if (doomed) {
+        const delSegs = path.split('/').filter(Boolean);
+        await refundShareWrite(env, auth.owner, {
+          refund: typeof doomed.size === 'number' ? doomed.size : 0,
+          freeCanonical: delSegs.length === 2,
+        });
+      }
       return json({ ok: true, deleted: path }, 200);
     }
 
@@ -819,6 +901,23 @@ var PUBLIC_INBOX_DOMAINS = ['gmail.com', 'googlemail.com', 'outlook.com', 'hotma
 var SHARE_COOKIE = '__Host-phoenix_share';
 var SHARE_COOKIE_MAX_AGE = 604800;
 
+// PHNX-3542 — per-user storage limits for the MANAGED share endpoint. The plan
+// map is the seam for future paid tiers: only 'free' is defined today, and a
+// ledger with no plan (or an unknown one) resolves to it via planLimits(). Paid
+// tiers and the write path that sets a user's plan arrive with billing (follow-up
+// PHNX-3569); this is a legitimately-deferred seam, not a stub — 'free' IS
+// enforced. Covers/views are server-generated overhead and excluded from the
+// quota, which counts canonical pages + their retained revisions only.
+var MiB = 1024 * 1024;
+var SHARE_PLANS = {
+  free: { maxBytes: 200 * MiB, maxObjects: 150, maxFileBytes: 20 * MiB, ratePerHour: 60 },
+};
+var DEFAULT_SHARE_PLAN = 'free';
+var RATE_WINDOW_MS = 3600 * 1000; // fixed 1h publish-rate window
+function planLimits(plan) { return SHARE_PLANS[plan] || SHARE_PLANS[DEFAULT_SHARE_PLAN]; }
+function freshUsage() { return { bytes: 0, count: 0, plan: DEFAULT_SHARE_PLAN, rlStart: 0, rlUsed: 0 }; }
+function usageNumber(v, fallback) { return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : fallback; }
+
 // Everything in customMetadata that ISN'T one of the reserved provenance/label
 // keys above — i.e. the caller's own \`--meta key=value\` entries. Surfaced on
 // every read route (listing, revisions) so a value stored with \`--meta
@@ -1313,6 +1412,163 @@ async function writeViews(env, path, count) {
   }
 }
 
+// --- PHNX-3542 per-user usage ledger (R2 conditional-put CAS) ---------------
+// The ledger is a single R2 object at __usage/<owner> holding the running
+// { bytes, count, plan, rlStart, rlUsed } for one user. It mirrors the __views /
+// __handles precedent: a __-prefixed key, GET-blocked and outside every gallery/
+// listing/revision prefix. R2 has no atomic increment, so mutations use a
+// read → mutate → conditional-put loop (onlyIf.etagMatches), the same primitive
+// the PATCH metadata-edit path already relies on.
+function usageKey(owner) { return '__usage/' + sanitizeNamespace(owner); }
+
+async function readUsage(env, owner) {
+  const obj = await env.BUCKET.get(usageKey(owner));
+  if (!obj) return { etag: null, usage: freshUsage() };
+  let usage = freshUsage();
+  try {
+    const raw = typeof obj.text === 'function' ? await obj.text() : '';
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object') {
+      usage = {
+        bytes: usageNumber(parsed.bytes, 0),
+        count: usageNumber(parsed.count, 0),
+        plan: typeof parsed.plan === 'string' ? parsed.plan : DEFAULT_SHARE_PLAN,
+        rlStart: usageNumber(parsed.rlStart, 0),
+        rlUsed: usageNumber(parsed.rlUsed, 0),
+      };
+    }
+  } catch (e) {
+    // Malformed ledger — treat as fresh zero but KEEP the etag so the next CAS
+    // put overwrites the corrupt object rather than looping against it forever.
+  }
+  return { etag: obj.etag || null, usage: usage };
+}
+
+async function writeUsageCas(env, owner, prevEtag, usage) {
+  const body = JSON.stringify(usage);
+  const opts = { httpMetadata: { contentType: 'application/json' } };
+  if (prevEtag) {
+    // Existing object: conditional put. R2 returns null when the etag no longer
+    // matches (a concurrent writer won the race) → report failure so the caller
+    // re-reads and retries.
+    opts.onlyIf = { etagMatches: prevEtag };
+    const res = await env.BUCKET.put(usageKey(owner), body, opts);
+    return res !== null;
+  }
+  // Fresh key: plain create. Neither R2 nor the test harness exposes a
+  // conditional-create predicate, so the only race is two simultaneous
+  // first-creates of the same owner's ledger — a benign, one-time bounded loss.
+  await env.BUCKET.put(usageKey(owner), body, opts);
+  return true;
+}
+
+// CAS retry loop. fn(usage) returns { reject: Response } to fail loud without
+// committing, or { commit: usage, result } to persist and return result. On CAS
+// contention it re-reads and retries; exhausting the retries fails loud with 503.
+async function withUsage(env, owner, fn) {
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const state = await readUsage(env, owner);
+    const outcome = fn(state.usage);
+    if (outcome.reject) return outcome.reject;
+    const ok = await writeUsageCas(env, owner, state.etag, outcome.commit);
+    if (ok) return outcome.result;
+  }
+  return json({ error: 'usage ledger contended, retry' }, 503);
+}
+
+function rateLimited(retryAfterSec, ratePerHour) {
+  return new Response(
+    JSON.stringify({ error: 'rate limit: too many publishes, retry later', retryAfterSec: retryAfterSec, ratePerHour: ratePerHour }),
+    { status: 429, headers: { 'content-type': 'application/json', 'retry-after': String(retryAfterSec) } },
+  );
+}
+
+// Charge one authed PUT against the owner's ledger. Rate → per-file cap → object
+// count → byte quota, each failing loud (429 / 413) before anything is written.
+// Returns { error: Response } on any rejection, else { limits } (the resolved
+// plan limits, reused by the post-write real-size reconcile). Managed only: the
+// caller guards on auth.kind === 'phoenix'.
+async function chargeShareWrite(env, auth, params) {
+  const now = Date.now();
+  const out = await withUsage(env, auth.owner, function (usage) {
+    const limits = planLimits(usage.plan);
+    // Rate limit — only a user-initiated page PUT counts (countRate). A fixed 1h
+    // window: reset when the window has rolled over, otherwise reject at the cap.
+    if (params.countRate) {
+      if (now - usage.rlStart >= RATE_WINDOW_MS) { usage.rlStart = now; usage.rlUsed = 0; }
+      if (usage.rlUsed >= limits.ratePerHour) {
+        const retryAfterSec = Math.max(1, Math.ceil((usage.rlStart + RATE_WINDOW_MS - now) / 1000));
+        return { reject: rateLimited(retryAfterSec, limits.ratePerHour) };
+      }
+      usage.rlUsed += 1;
+    }
+    // Per-file size cap.
+    if (typeof params.fileBytes === 'number' && params.fileBytes > limits.maxFileBytes) {
+      return { reject: json({ error: 'file too large', maxBytes: limits.maxFileBytes, gotBytes: params.fileBytes }, 413) };
+    }
+    // Object (canonical page) count.
+    if (params.newCanonical) {
+      if (usage.count + 1 > limits.maxObjects) {
+        return { reject: json({ error: 'artifact limit reached', maxObjects: limits.maxObjects }, 413) };
+      }
+      usage.count += 1;
+    }
+    // Total byte quota. charge may be negative on a shrink — clamp at >= 0.
+    if (usage.bytes + params.charge > limits.maxBytes) {
+      return { reject: json({ error: 'storage limit reached', maxBytes: limits.maxBytes, usedBytes: usage.bytes }, 413) };
+    }
+    usage.bytes = Math.max(0, usage.bytes + params.charge);
+    return { commit: usage, result: { limits: limits } };
+  });
+  if (out instanceof Response) return { error: out };
+  return { limits: out.limits };
+}
+
+// Read a request body fully into memory, BOUNDED: abort the moment it exceeds
+// maxBytes, so a chunked/streaming body can never buffer more than the cap (plus
+// one in-flight chunk) and OOM the Worker. Returns { oversize: true, size } once
+// the cap is passed (size is a lower bound, >= cap), else { bytes, size } with
+// the exact bytes. A body-less request yields an empty buffer. This is what lets
+// enforcement key on the REAL size instead of a spoofable declared header.
+async function readBodyBounded(request, maxBytes) {
+  if (!request.body || typeof request.body.getReader !== 'function') {
+    const buf = await request.arrayBuffer();
+    const bytes = new Uint8Array(buf);
+    if (bytes.byteLength > maxBytes) return { oversize: true, size: bytes.byteLength };
+    return { bytes: bytes, size: bytes.byteLength };
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const step = await reader.read();
+    if (step.done) break;
+    const chunk = step.value;
+    size += chunk.byteLength;
+    if (size > maxBytes) {
+      try { await reader.cancel(); } catch (e) { /* best-effort */ }
+      return { oversize: true, size: size };
+    }
+    chunks.push(chunk);
+  }
+  const out = new Uint8Array(size);
+  let offset = 0;
+  for (let i = 0; i < chunks.length; i++) { out.set(chunks[i], offset); offset += chunks[i].byteLength; }
+  return { bytes: out, size: size };
+}
+
+// Refund on DELETE / expiry. Never rejects, never creates a ledger: if the owner
+// was never charged (no __usage object) it is a pure no-op.
+async function refundShareWrite(env, owner, params) {
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const state = await readUsage(env, owner);
+    if (!state.etag) return; // no ledger — owner never charged, nothing to refund
+    state.usage.bytes = Math.max(0, state.usage.bytes - (params.refund || 0));
+    if (params.freeCanonical) state.usage.count = Math.max(0, state.usage.count - 1);
+    if (await writeUsageCas(env, owner, state.etag, state.usage)) return;
+  }
+}
+
 function viewerMayRead(visibility, meta, identity) {
   if (visibility === 'me') {
     const owner = meta && meta.owner;

package/dist/lib/types.d.ts

@@ -929,7 +929,9 @@ export interface Meta {
     /**
      * `agents feed post` fan-out. `broadcast` maps a sink name to either an argv
      * template (`command:`, run for each post) or an in-process channel delivery
-     * (`channel:`, the same registry `agents send`/`agents notify` use), so
+     * (`channel:`, the same registry `agents send`/`agents notify` use). Channel
+     * sinks may set `message:` with feed placeholders; a missing placeholder
+     * skips that sink, so `{ticket}` cleanly gates a tracker-specific channel. Thus
      * mirroring to a tracker, a messaging CLI, or a channel provider is the
      * operator's config rather than an integration compiled into this CLI. When
      * this is unset/empty, an important-level post falls back to `notify.owner`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.62",
+  "version": "1.22.63",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",