@phnx-labs/agents-cli 1.22.75 → 1.22.76

package/dist/lib/share/config.js

@@ -17,7 +17,16 @@ export const SHARE_TOKEN_ENV_KEY = 'SHARE_WRITE_TOKEN';
 export const DEFAULT_CF_BUNDLE = 'cloudflare';
 export const DEFAULT_WORKER_NAME = 'agents-share';
 export const DEFAULT_BUCKET_NAME = 'agents-share';
-export const DEFAULT_SHARE_DOMAIN = 'share.agents-cli.sh';
+// The Rush product share endpoint (PHNX-3960): share.getrush.ai on the product
+// domain. Publishing prints this host; bound to the `agents-share` Worker in the
+// Phoenix CF account. share.agents-cli.sh + artifacts.prix.dev stay bound as legacy aliases.
+export const DEFAULT_SHARE_DOMAIN = 'share.getrush.ai';
+// Managed hosts still recognized as "the platform endpoint" for backward
+// compatibility. `share.agents-cli.sh` is the pre-PHNX-3960 default: it stays
+// attached to the same Worker, so every link already shared on it keeps
+// resolving, and a persisted config pointing at it is still treated as managed
+// (e.g. for deploy-time PHOENIX_ID_BASE binding). Compared lowercased.
+export const LEGACY_MANAGED_SHARE_DOMAINS = ['share.agents-cli.sh', 'artifacts.prix.dev'];
 /** The write token may be injected ephemerally into fleet/cloud agents. */
 export function readWriteTokenEnv(env = process.env) {
     const token = env[SHARE_TOKEN_ENV_KEY]?.trim();

package/dist/lib/share/delete.d.ts

@@ -31,7 +31,7 @@ export interface ResolvedShareTarget {
 /**
  * Normalize any of the three accepted target forms to the R2 key that publish
  * would have written:
- *   - a full share URL: `https://share.agents-cli.sh/<user>/<slug>`
+ *   - a full share URL: `https://share.getrush.ai/<user>/<slug>`
  *   - `<user>/<slug>`
  *   - a bare `<slug>` — resolved against the caller's own namespace exactly as
  *     `publishToEndpoint` resolves it at publish time (resolveShareUsername +

package/dist/lib/share/delete.js

@@ -13,7 +13,7 @@ import { extractShareHttpError, formatShareHttpErrorDetail } from './http-error.
 /**
  * Normalize any of the three accepted target forms to the R2 key that publish
  * would have written:
- *   - a full share URL: `https://share.agents-cli.sh/<user>/<slug>`
+ *   - a full share URL: `https://share.getrush.ai/<user>/<slug>`
  *   - `<user>/<slug>`
  *   - a bare `<slug>` — resolved against the caller's own namespace exactly as
  *     `publishToEndpoint` resolves it at publish time (resolveShareUsername +

package/dist/lib/share/html.d.ts

@@ -1,5 +1,5 @@
 /**
- * Make an HTML page self-contained enough to view on share.agents-cli.sh.
+ * Make an HTML page self-contained enough to view on share.getrush.ai.
  *
  * Chrome "Save as" (and some renderers) leave `file:///…html#section` TOC
  * links and sibling image paths. Those work on disk and 404 on the share

package/dist/lib/share/html.js

@@ -1,5 +1,5 @@
 /**
- * Make an HTML page self-contained enough to view on share.agents-cli.sh.
+ * Make an HTML page self-contained enough to view on share.getrush.ai.
  *
  * Chrome "Save as" (and some renderers) leave `file:///…html#section` TOC
  * links and sibling image paths. Those work on disk and 404 on the share

package/dist/lib/share/provision.d.ts

@@ -110,6 +110,6 @@ export declare function setWorkerSecret(apiToken: string, accountId: string, wor
 export declare function enableWorkersDev(apiToken: string, accountId: string, workerName: string, opts?: ProvisionOptions): Promise<string>;
 /** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
 export declare function findZoneId(apiToken: string, domain: string, opts?: ProvisionOptions): Promise<string | null>;
-/** Map a custom hostname (e.g. `share.agents-cli.sh`) to the Worker via Workers Custom Domains. */
+/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
 export declare function addCustomDomain(apiToken: string, accountId: string, workerName: string, zoneId: string, hostname: string, opts?: ProvisionOptions): Promise<void>;
 export {};

package/dist/lib/share/provision.js

@@ -219,7 +219,7 @@ export async function enableWorkersDev(apiToken, accountId, workerName, opts = {
 /** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
 export async function findZoneId(apiToken, domain, opts = {}) {
     const request = opts.request ?? defaultCloudflareRequester;
-    // Try the exact name, then the registrable parent (share.agents-cli.sh -> agents-cli.sh).
+    // Try the exact name, then the registrable parent (share.getrush.ai -> getrush.ai).
     const candidates = [domain, domain.split('.').slice(-2).join('.')];
     for (const name of candidates) {
         const zones = await request({
@@ -232,7 +232,7 @@ export async function findZoneId(apiToken, domain, opts = {}) {
     }
     return null;
 }
-/** Map a custom hostname (e.g. `share.agents-cli.sh`) to the Worker via Workers Custom Domains. */
+/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
 export async function addCustomDomain(apiToken, accountId, workerName, zoneId, hostname, opts = {}) {
     const request = opts.request ?? defaultCloudflareRequester;
     try {

package/dist/lib/share/publish.d.ts

@@ -69,8 +69,17 @@ export interface PublishOptions {
     analytics?: boolean;
     /** Override the analytics token from share config. */
     analyticsToken?: string;
-    /** Override the GitHub username used for the URL namespace. */
+    /** Override the GitHub username used for the URL namespace (BYO path). */
     githubUser?: string;
+    /**
+     * Override the managed public handle (PHNX-3547). Managed publishes normally
+     * namespace under the email local-part; when that handle is taken — or a
+     * vanity namespace is wanted — pass an alternate. Sanitized to
+     * `[a-z0-9-]` (max 63 chars, matching the Worker); the Worker binds it with
+     * the same first-writer claim as a derived handle. Ignored on BYO (use
+     * `githubUser` there).
+     */
+    handle?: string;
     /** DI seam for tests — override the persisted share endpoint config. */
     config?: ShareConfig;
     /** DI seam for tests — override the keychain-backed write token. Selects BYO. */
@@ -209,12 +218,15 @@ export declare function resolveShareProvenance(opts?: {
 }): ShareProvenance;
 /**
  * The sharer's avatar URL, stamped so the share bar can show a real profile
- * picture instead of only the initials circle. We key a Gravatar on the SHA-256
- * of the signed-in user's lowercased email (Gravatar resolves either MD5 or
- * SHA-256), with `d=404` so Gravatar returns 404 for a user who has none — the
- * bar's `<img>` onerror then falls back to the initials circle. Only the hash
- * lands in public metadata, never the raw email. Returns '' when signed out
- * (BYO without a Phoenix session), leaving the bar on the initials circle.
+ * picture instead of only the initials circle. A hosted OAuth profile image
+ * already known to identity (PhoenixSession.avatarUrl — captured at login and
+ * refreshed from `/api/v1/auth/me`) wins outright; only when none exists do we
+ * fall back to a Gravatar keyed on the SHA-256 of the signed-in user's
+ * lowercased email (Gravatar resolves either MD5 or SHA-256), with `d=404` so
+ * Gravatar returns 404 for a user who has none — the bar's `<img>` onerror
+ * then falls back to the initials circle. Only the hash lands in public
+ * metadata, never the raw email. Returns '' when signed out (BYO without a
+ * Phoenix session), leaving the bar on the initials circle.
  *
  * `opts.session === null` means "explicitly signed out" (a test seam / BYO) and
  * yields ''; `undefined` reads the real persisted session.
@@ -369,4 +381,8 @@ export declare function resolveShareUsername(opts?: {
 /** Build the R2 object key from a namespace username and a slug part. */
 export declare function buildShareKey(username: string, slugPart: string): string;
 export declare function publishFile(filePath: string, opts?: PublishOptions): Promise<PublishResult>;
+/** Sanitize a caller-chosen managed handle to the Worker's namespace shape.
+ * Returns '' when the result is empty or over the Worker's 63-char cap (the
+ * caller then falls back to the derived handle / errors). */
+export declare function resolveManagedHandle(handle: string | undefined): string;
 export declare function publishToEndpoint(filePath: string, endpoint: PublishEndpoint, opts?: PublishOptions): Promise<PublishResult>;

package/dist/lib/share/publish.js

@@ -129,18 +129,24 @@ export function resolveShareProvenance(opts = {}) {
 }
 /**
  * The sharer's avatar URL, stamped so the share bar can show a real profile
- * picture instead of only the initials circle. We key a Gravatar on the SHA-256
- * of the signed-in user's lowercased email (Gravatar resolves either MD5 or
- * SHA-256), with `d=404` so Gravatar returns 404 for a user who has none — the
- * bar's `<img>` onerror then falls back to the initials circle. Only the hash
- * lands in public metadata, never the raw email. Returns '' when signed out
- * (BYO without a Phoenix session), leaving the bar on the initials circle.
+ * picture instead of only the initials circle. A hosted OAuth profile image
+ * already known to identity (PhoenixSession.avatarUrl — captured at login and
+ * refreshed from `/api/v1/auth/me`) wins outright; only when none exists do we
+ * fall back to a Gravatar keyed on the SHA-256 of the signed-in user's
+ * lowercased email (Gravatar resolves either MD5 or SHA-256), with `d=404` so
+ * Gravatar returns 404 for a user who has none — the bar's `<img>` onerror
+ * then falls back to the initials circle. Only the hash lands in public
+ * metadata, never the raw email. Returns '' when signed out (BYO without a
+ * Phoenix session), leaving the bar on the initials circle.
  *
  * `opts.session === null` means "explicitly signed out" (a test seam / BYO) and
  * yields ''; `undefined` reads the real persisted session.
  */
 export function resolveShareAvatar(opts = {}) {
     const session = opts.session !== undefined ? opts.session : readSession();
+    const hosted = session?.avatarUrl?.trim();
+    if (hosted && /^https:\/\//i.test(hosted))
+        return hosted;
     const email = session?.email?.trim().toLowerCase();
     if (!email)
         return '';
@@ -553,8 +559,9 @@ export function buildShareKey(username, slugPart) {
 }
 export async function publishFile(filePath, opts = {}) {
     const backend = resolveShareBackend(opts);
+    const managedHandle = backend.kind === 'managed' ? requireManagedHandle(opts.handle) : '';
     const username = backend.kind === 'managed'
-        ? backend.namespace
+        ? managedHandle || backend.namespace
         : await resolveShareUsername({ githubUser: opts.githubUser || backend.namespace || undefined });
     const analyticsToken = opts.analyticsToken ?? (backend.kind === 'byo' ? (opts.config ?? readShareConfig())?.analyticsToken : undefined);
     return publishToEndpoint(filePath, { baseUrl: backend.baseUrl, token: backend.token }, {
@@ -564,8 +571,28 @@ export async function publishFile(filePath, opts = {}) {
         backendKind: backend.kind,
     });
 }
+/** Sanitize a caller-chosen managed handle to the Worker's namespace shape.
+ * Returns '' when the result is empty or over the Worker's 63-char cap (the
+ * caller then falls back to the derived handle / errors). */
+export function resolveManagedHandle(handle) {
+    if (!handle)
+        return '';
+    const sanitized = sanitizeShareNamespace(handle);
+    return sanitized && sanitized.length <= 63 ? sanitized : '';
+}
+function requireManagedHandle(handle) {
+    const resolved = resolveManagedHandle(handle);
+    if (handle && !resolved) {
+        throw new Error(`Invalid --handle '${handle}': must sanitize to 1-63 [a-z0-9-] characters`);
+    }
+    return resolved;
+}
 export async function publishToEndpoint(filePath, endpoint, opts = {}) {
-    const username = await resolveShareUsername(opts);
+    // A managed publish may carry an explicit --handle: it namespaces the URL and
+    // rides the x-share-handle header so the Worker binds the claim to it (a
+    // derived handle is proven by the email; an alternate one must be declared).
+    const managedHandle = opts.backendKind === 'managed' ? requireManagedHandle(opts.handle) : '';
+    const username = managedHandle || (await resolveShareUsername(opts));
     let body = readFileSync(filePath);
     const expiresAt = resolveExpire(opts.expire);
     const visibility = resolveShareVisibility(opts);
@@ -666,6 +693,8 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     assertMetadataSize(metadataPreview);
     const authHeaders = (contentType) => {
         const h = { authorization: `Bearer ${endpoint.token}`, 'content-type': contentType };
+        if (managedHandle)
+            h['x-share-handle'] = managedHandle;
         if (expiresAt)
             h['x-share-expires-at'] = expiresAt;
         h['x-share-visibility'] = visibility;
@@ -748,11 +777,28 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     }
     const r = await put(pageUrl, body, authHeaders(opts.contentType ?? guessContentType(filePath)));
     if (!r.ok) {
-        if (r.status === 409) {
-            throw new Error(`Handle '${username}' is already claimed by another account. The public URL namespace is the email local-part; two Phoenix users cannot share it.`);
+        // 409 has two distinct shapes on the managed Worker: 'handle taken' (the
+        // caller's namespace belongs to another account) and 'publish conflict'
+        // (a concurrent write won the republish race — retry, per PHNX-3547).
+        const httpError = extractShareHttpError({ status: r.status, body: r.body, retryAfter: r.retryAfter });
+        if (r.status === 409 && httpError.serverMessage === 'handle taken' && opts.backendKind === 'managed') {
+            throw new Error(`Handle '${username}' is already claimed by another account. ` +
+                'If you signed in again and got a new account id, republishing with the same email re-binds your handle automatically; ' +
+                'otherwise pick a different public namespace with --handle <name>.');
+        }
+        const detail = formatShareHttpErrorDetail(httpError);
+        // The write-token/setup advice is only meaningful for an auth failure — a
+        // 413 (quota/size) or 429 (rate) rejection has nothing to do with the
+        // token, and 'Check the write token' there is plain wrong (PHNX-3579).
+        // Managed endpoints carry a Phoenix bearer, so the recovery is re-login.
+        let advice = '';
+        if (r.status === 401 || r.status === 403) {
+            advice =
+                opts.backendKind === 'managed'
+                    ? ". Check that you're signed in — run 'agents auth login'."
+                    : ". Check the write token, or that 'agents artifacts setup' completed.";
         }
-        const detail = formatShareHttpErrorDetail(extractShareHttpError({ status: r.status, body: r.body, retryAfter: r.retryAfter }));
-        throw new Error(`Publish failed (${r.status}) for ${pageUrl}${detail}. Check the write token, or that 'agents artifacts setup' completed.`);
+        throw new Error(`Publish failed (${r.status}) for ${pageUrl}${detail}${advice}`);
     }
     // A token-gated page is only reachable WITH its key, so the URL we hand back
     // (and store nowhere) carries it — https://<host>/<user>/<slug>?k=<token>.