replicas-cli 0.2.727 → 0.2.729

package/README.md

@@ -45,7 +45,7 @@ Connect to a workspace via SSH.
 Open a workspace in VS Code via Remote SSH. Omit the argument to pick a workspace with the arrow keys and Enter, or pass a name or ID. Names with spaces work with or without quotes.
 
 ### Coding agents
-Use `replicas claude-auth` or `replicas codex-auth` to connect subscription credentials. Gemini CLI and Cursor use API keys configured in Coding Agents settings.
+Use `replicas claude-auth` or `replicas codex-auth` to connect subscription credentials. Cursor uses API keys configured in Coding Agents settings.
 
 ## Configuration
 

package/dist/index.cjs

@@ -7701,9 +7701,7 @@ var AGENT = {
   CLAUDE: "claude",
   CODEX: "codex",
   CURSOR: "cursor",
-  DEEPSEEK: "deepseek",
   FX: "fx",
-  GEMINI: "gemini",
   KIMI: "kimi",
   MUSE: "muse",
   OPENCODE: "opencode",
@@ -7715,7 +7713,6 @@ var VALID_RELAY_SUBAGENT_PROVIDERS = VALID_AGENT_PROVIDERS;
 var VALID_RELAY_BASE_PROVIDERS = [
   AGENT.CLAUDE,
   AGENT.CODEX,
-  AGENT.DEEPSEEK,
   AGENT.OPENCODE,
   AGENT.PI
 ];
@@ -7748,21 +7745,11 @@ var AGENT_PROVIDER_OPTIONS = [
     label: "Cursor",
     description: "Use Cursor for tasks"
   },
-  {
-    value: "deepseek",
-    label: "DeepSeek Harness",
-    description: "Use DeepSeek Harness for tasks"
-  },
   {
     value: "fx",
     label: "fx",
     description: "Use fx for tasks"
   },
-  {
-    value: "gemini",
-    label: "Gemini CLI",
-    description: "Use Gemini CLI for tasks"
-  },
   {
     value: "kimi",
     label: "Kimi Code",
@@ -7795,9 +7782,7 @@ var THINKING_LEVELS_BY_AGENT = {
   claude: [...STANDARD_THINKING_LEVELS, "ultracode"],
   codex: [...STANDARD_THINKING_LEVELS, "ultra"],
   cursor: STANDARD_THINKING_LEVELS,
-  deepseek: STANDARD_THINKING_LEVELS,
   fx: STANDARD_THINKING_LEVELS,
-  gemini: STANDARD_THINKING_LEVELS,
   kimi: STANDARD_THINKING_LEVELS,
   muse: VALID_THINKING_LEVELS.filter((level) => level !== "max" && level !== "ultracode"),
   opencode: STANDARD_THINKING_LEVELS,
@@ -7819,12 +7804,8 @@ function getProviderDisplayName(provider, variant = "short") {
       return "Codex";
     case "cursor":
       return "Cursor";
-    case "deepseek":
-      return variant === "long" ? "DeepSeek Harness" : "DeepSeek";
     case "fx":
       return "fx";
-    case "gemini":
-      return "Gemini";
     case "kimi":
       return variant === "long" ? "Kimi Code" : "Kimi";
     case "muse":
@@ -7880,7 +7861,6 @@ var CREDENTIAL_TYPE = {
   ASTER_API_KEY: "aster_api_key",
   OPENROUTER_API_KEY: "openrouter_api_key",
   AI_GATEWAY_API_KEY: "ai_gateway_api_key",
-  GEMINI_API_KEY: "gemini_api_key",
   MUSE_OAUTH: "muse_oauth",
   MUSE_API_KEY: "muse_api_key"
 };
@@ -7908,16 +7888,9 @@ var AGENT_CREDENTIAL_METHODS_IN_ORDER = {
   [AGENT.CURSOR]: [
     { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.CURSOR_API_KEY }
   ],
-  [AGENT.DEEPSEEK]: [
-    { method: CREDENTIAL_METHOD.OPENROUTER, credentialType: CREDENTIAL_TYPE.OPENROUTER_API_KEY },
-    { method: CREDENTIAL_METHOD.OLLAMA, credentialType: CREDENTIAL_TYPE.OLLAMA }
-  ],
   [AGENT.FX]: [
     { method: CREDENTIAL_METHOD.AI_GATEWAY, credentialType: CREDENTIAL_TYPE.AI_GATEWAY_API_KEY }
   ],
-  [AGENT.GEMINI]: [
-    { method: CREDENTIAL_METHOD.API_KEY, credentialType: CREDENTIAL_TYPE.GEMINI_API_KEY }
-  ],
   [AGENT.KIMI]: [
     { method: CREDENTIAL_METHOD.AI_GATEWAY, credentialType: CREDENTIAL_TYPE.AI_GATEWAY_API_KEY },
     { method: CREDENTIAL_METHOD.OLLAMA, credentialType: CREDENTIAL_TYPE.OLLAMA }
@@ -22540,10 +22513,15 @@ var TEAM_PLAN = PLANS.team;
 var ENTERPRISE_PLAN = PLANS.enterprise;
 
 // ../shared/src/analytics/types.ts
+var credentialAccountSchema = external_exports.object({
+  ownerName: external_exports.string().optional(),
+  email: external_exports.string().optional()
+});
 var agentCredentialSnapshotSchema = external_exports.object({
   method: external_exports.enum(CREDENTIAL_METHOD),
   scope: external_exports.enum(CREDENTIAL_SCOPE),
-  revision: external_exports.string().optional()
+  revision: external_exports.string().optional(),
+  account: credentialAccountSchema.optional()
 });
 function isAuthMethod(value) {
   return typeof value === "string" && Object.values(CREDENTIAL_METHOD).some((method) => method === value);
@@ -22555,7 +22533,7 @@ function isCredentialScope(value) {
 // ../shared/src/workspace-credentials.ts
 var WORKSPACE_CREDENTIAL_PROVIDERS = ["claude", "codex"];
 var workspaceCredentialProviderSchema = external_exports.enum(WORKSPACE_CREDENTIAL_PROVIDERS);
-var workspaceCredentialSelectionSchema = agentCredentialSnapshotSchema.omit({ revision: true });
+var workspaceCredentialSelectionSchema = agentCredentialSnapshotSchema.omit({ revision: true, account: true });
 var createWorkspaceCredentialSchema = workspaceCredentialSelectionSchema.extend({
   provider: external_exports.enum(VALID_CODING_AGENT_PROVIDERS)
 }).refine(({ provider, method }) => agentCredentialMethods(provider).includes(method), {
@@ -22645,7 +22623,6 @@ var OX_ALPHA_MODEL = "stealth/ox-alpha";
 var DEEPSEEK_V4_PRO_MODEL = "deepseek/deepseek-v4-pro-0813";
 var DEEPSEEK_V4_FLASH_MODEL = "deepseek/deepseek-v4-flash-0731";
 var DEFAULT_FX_MODEL = "zai/glm-5.2";
-var DEFAULT_GEMINI_MODEL = "gemini-3.8-flash";
 var DEFAULT_KIMI_MODEL = "moonshotai/kimi-k2.6";
 var MUSE_SPARK_1_3_MODEL = "muse-spark-1.3";
 var DEFAULT_MUSE_MODEL = "muse-spark-1.2";
@@ -22666,12 +22643,6 @@ var OPENROUTER_MODELS = [
   "xiaomi/mimo-v2.5-pro",
   "meta/muse-spark-1.3"
 ];
-function prioritizeDeepseekModels(models) {
-  return [
-    ...models.filter((model) => model.startsWith("deepseek/")),
-    ...models.filter((model) => !model.startsWith("deepseek/"))
-  ];
-}
 function normalizeClaudeModel(model) {
   if (model === "opus" || model === CLAUDE_OPUS_1M_MODEL || model === LEGACY_CLAUDE_OPUS_1M_MODEL) {
     return DEFAULT_CLAUDE_MODEL;
@@ -22751,9 +22722,7 @@ var AGENT_MODELS = {
     CLAUDE_HAIKU_4_5_MODEL,
     "kimi-k2.5"
   ],
-  deepseek: prioritizeDeepseekModels(DEFAULT_OPENROUTER_MODELS),
   fx: [DEFAULT_FX_MODEL],
-  gemini: [DEFAULT_GEMINI_MODEL, "gemini-3.1-pro-preview"],
   kimi: [DEFAULT_KIMI_MODEL],
   muse: [MUSE_SPARK_1_3_MODEL, DEFAULT_MUSE_MODEL],
   opencode: [...DEFAULT_OPENROUTER_MODELS, ...ASTER_MODELS],
@@ -22811,8 +22780,6 @@ var MODEL_LABELS = {
   "xiaomi/mimo-v2.5-pro": "MiMo V2.5 Pro via OpenRouter",
   "moonshotai/kimi-k2.6": "Kimi K2.6 via OpenRouter",
   "moonshotai/kimi-k3": "Kimi K3 via OpenRouter",
-  "gemini-3-flash-preview": "Gemini 3 Flash Preview",
-  "gemini-3.1-pro-preview": "Gemini 3.1 Pro Preview",
   [MUSE_SPARK_1_3_MODEL]: "Muse Spark 1.3",
   [DEFAULT_MUSE_MODEL]: "Muse Spark 1.2",
   "meta/muse-spark-1.3": "Muse Spark 1.3 via OpenRouter",
@@ -22954,6 +22921,8 @@ var CHAT_INTERRUPTED_EVENT_TYPE = "replicas-interrupted";
 var AUTH_FALLBACK_EVENT_TYPE = "auth-fallback";
 function coerceAuthFallbackPayload(payload) {
   const { provider, reason, exhaustedMethod, exhaustedScope, candidateMethod, candidateScope, status, detail } = payload;
+  const exhaustedAccount = credentialAccountSchema.safeParse(payload.exhaustedAccount).data;
+  const candidateAccount = credentialAccountSchema.safeParse(payload.candidateAccount).data;
   if (typeof provider !== "string" || !isValidCodingAgentProvider(provider) || reason !== "rate_limit" && reason !== "out_of_credits" || !isAuthMethod(exhaustedMethod) || !isAuthMethod(candidateMethod) || !isCredentialScope(candidateScope) || status !== "switched" && status !== "failed") {
     return null;
   }
@@ -22962,8 +22931,10 @@ function coerceAuthFallbackPayload(payload) {
     reason,
     exhaustedMethod,
     ...isCredentialScope(exhaustedScope) ? { exhaustedScope } : {},
+    ...exhaustedAccount ? { exhaustedAccount } : {},
     candidateMethod,
     candidateScope,
+    ...candidateAccount ? { candidateAccount } : {},
     status,
     ...typeof detail === "string" && detail ? { detail } : {}
   };
@@ -23774,7 +23745,7 @@ gh pr review 123 --request-changes --body "Changes needed"
 
 ## Media in GitHub workflows
 
-Media delivery is owned by \`references/MEDIA.md\`. Read its GitHub section before adding screenshots, recordings, diagrams, or HTML reports to a pull request, issue, review comment, or commit; it covers public Forge embeds for images and recording previews, organization-only HTML links, and the required **View in Replicas** link.
+Media delivery is owned by \`references/MEDIA.md\`. Read its GitHub section before adding screenshots, recordings, diagrams, or HTML reports to a pull request, issue, review comment, or commit; it covers the public links every image upload prints, recording previews, organization-only HTML links, and the required **View in Replicas** link.
 `;
 var GITHUB_ABILITY = {
   label: "GitHub",
@@ -23985,11 +23956,11 @@ If none of these apply, don't upload.
 
 \`replicas media upload\` is always the first delivery action. When the current task has an external destination, every other delivery step follows only after that command succeeds. For every file:
 
-1. First, run \`replicas media upload\` with the original file. Do not begin any destination upload until the command succeeds. This creates the canonical dashboard copy and prints a chat embed plus a per-file dashboard link. With public access, the printed Forge embed is the chat embed and is also safe to use on GitHub.
+1. First, run \`replicas media upload\` with the original file. Do not begin any destination upload until the command succeeds. This creates the canonical dashboard copy and prints an embed plus a per-file dashboard link. Every image gets a public link, so its printed embed works in chat and on GitHub.
 2. Include the printed embed line in the Replicas chat reply, followed by **View in Canvas** using the matching per-file dashboard URL. HTML uses its printed page link instead of an image embed.
-3. Identify every destination in the task and use its inline representation from the table below. Slack, Linear, and GitLab require an upload of the same original bytes; GitHub uses the public Forge embed.
+3. Identify every destination in the task and use its inline representation from the table below. Slack, Linear, and GitLab require an upload of the same original bytes; GitHub uses the image's printed public embed.
 4. Put the **View in Replicas** dashboard link next to the destination embed as a secondary link.
-5. Check each destination response. If its upload or Forge share fails, say so explicitly and keep the dashboard link; never claim that a dashboard link is an inline embed.
+5. Check each destination response. If its upload or public link fails, say so explicitly and keep the dashboard link; never claim that a dashboard link is an inline embed.
 
 | Destination | Required file delivery | Inline result |
 |---|---|---|
@@ -23997,7 +23968,7 @@ If none of these apply, don't upload.
 | Slack | \`files.getUploadURLExternal\` \u2192 raw-byte POST \u2192 \`files.completeUploadExternal\` | Uploaded file in the channel or thread |
 | Linear | \`fileUpload\` mutation \u2192 presigned upload \u2192 issue/comment mutation | Returned \`assetUrl\` in Markdown |
 | GitLab | Project \`/uploads\` endpoint with the original bytes | Returned GitLab Markdown |
-| GitHub | Replicas public Forge share for an image or recording poster | Printed Forge embed, linked to the recording when needed |
+| GitHub | Printed public embed for an image or recording poster | Printed embed, linked to the recording when needed |
 
 The dashboard link is the subtitle and jump-back path. It is never a substitute for the destination embed.
 
@@ -24027,8 +23998,8 @@ Names are normalized to hyphen-case (spaces become hyphens, e.g. \`Login page\`
 
 For each media file, the CLI prints an embed line and a dashboard link:
 
-1. Default and organization access print \`Replicas chat embed: ![filename](<api-url>)\`; this authenticated URL renders inline in Replicas chat **only** \u2014 see below.
-2. Public access (\`--access public\` or \`--share\`) prints \`![filename](<public-url>)\` as the Forge embed instead. This is the public, stable bearer URL to paste into GitHub when sharing is authorized.
+1. Images always print \`![filename](<public-url>)\`. This public, stable link works in Replicas chat, GitHub, and anywhere else Markdown images render. No flag is needed.
+2. Video and audio print \`Replicas chat embed: ![filename](<api-url>)\` by default; this authenticated URL renders inline in Replicas chat **only** \u2014 see below. \`--access public\` prints a public embed instead.
 3. \`View in Replicas: <deep-link>\` is a per-file dashboard URL of the form \`https://app.replicas.dev/workspaces/<workspace-id>?media=<media-id>\` that opens directly to that specific file.
 
 Match each "View in Replicas" line to the embed line directly above it \u2014 that's the deep link for that file.
@@ -24043,13 +24014,13 @@ replicas media upload recap.html --name "Visual recap" --access organization
 
 The printed \`Forge link (organization only)\` opens a dedicated page. Signed-in organization members go straight to it; signed-out members sign in and return to the page.
 
-Use public access only when the media must render without Replicas authentication:
+Video and audio stay private unless they must play without Replicas sign-in; then pass \`--access public\` (alias \`--share\`):
 
 \`\`\`bash
-replicas media upload screenshot.png --name "Login page" --access public
+replicas media upload demo.mp4 --name "Checkout demo" --access public
 \`\`\`
 
-\`--share\` remains an alias for \`--access public\`. Public access prints the raw \`Forge embed\` Markdown instead of the authenticated chat-only embed for image, video, or audio media, backed by an opt-in bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. HTML pages only support organization access. Use \`replicas media share <media-id>\` to rotate a public media URL and \`replicas media revoke <media-id>\` to revoke it.
+Public links are unguessable bearer URLs: anyone with the link can view the file until it is rotated or revoked. HTML pages only support organization access. Reuse the link printed at upload. \`replicas media share <media-id>\` issues a new link and breaks the old one everywhere it is embedded, and \`replicas media revoke <media-id>\` removes public access.
 
 Permanently delete an upload with \`replicas media delete <media-id>\`. The backend only permits deletion when the media belongs to the current workspace; media from another workspace returns not found.
 
@@ -24057,14 +24028,14 @@ Permanently delete an upload with \`replicas media delete <media-id>\`. The back
 
 | URL | What it is | Where it's allowed |
 |---|---|---|
-| \`https://api.replicas.dev/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
+| \`https://api.replicas.dev/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect printed for private video, audio, and HTML \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
 | \`https://replicas.dev/organizations/<organization-id>/media/<media-id>\` | Organization-only page printed by \`--access organization\` | Pull requests and other places where every viewer belongs to the Replicas organization. |
-| \`https://api.replicas.dev/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | The Replicas chat reply and GitHub embeds, for image, video, or audio media. |
+| \`https://api.replicas.dev/v1/media/public/<id>/<token>\` | Public bearer URL printed for every image, and for video or audio with \`--access public\` | The Replicas chat reply and GitHub embeds. |
 | \`https://app.replicas.dev/workspaces/<workspace-id>?media=<media-id>\` | Authenticated dashboard deep link that opens the media file in the workspace | Everywhere external: Slack, GitHub, GitLab, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
 
-The \`api.replicas.dev/v1/media/<id>\` URL is **not public**. It's an authenticated redirect that only resolves to a presigned download when the Replicas chat session token is present. Anywhere else (Slack, Linear, GitHub, a browser tab the user opens directly, a customer copy-pasting from chat) it returns \`{"error":"Missing authorization token"}\` and renders as a broken image.
+The \`api.replicas.dev/v1/media/<id>\` URL is **not public**. Image uploads never print it; if you have one for an image from an older upload, run \`replicas media share <media-id>\` to get a public link. It's an authenticated redirect that only resolves to a presigned download when the Replicas chat session token is present. Anywhere else (Slack, Linear, GitHub, a browser tab the user opens directly, a customer copy-pasting from chat) it returns \`{"error":"Missing authorization token"}\` and renders as a broken image.
 
 This rule has no exceptions:
 - \u274C Never paste it in a Slack message \u2014 upload the actual bytes via the 3-step \`files.getUploadURLExternal\` \u2192 POST bytes \u2192 \`files.completeUploadExternal\` flow instead (see below).
@@ -24098,12 +24069,12 @@ After (or alongside) the embeds, include a \`[View in Canvas](<deep-link>)\` hyp
 
 After \`replicas media upload\` succeeds, external delivery has two required follow-up steps for every file:
 
-1. **Use the destination's inline representation:** upload the raw bytes to Slack, Linear, or GitLab; embed a public Forge share on GitHub.
+1. **Use the destination's inline representation:** upload the raw bytes to Slack, Linear, or GitLab; embed the image's printed public link on GitHub.
 2. **Link the Replicas dashboard deep link** (\`?media=<id>\` form) so the user can jump straight to the file in the workspace.
 
 A dashboard link alone is not enough. An embed without the dashboard link is not enough. Do both.
 
-Slack, Linear, and GitLab receive the original bytes through their native upload APIs. GitHub uses a Replicas public Forge share for screenshots and recording previews.
+Slack, Linear, and GitLab receive the original bytes through their native upload APIs. GitHub uses the printed public link for screenshots and recording previews.
 
 ### Slack \u2014 embed natively via the 3-step external file upload flow
 
@@ -24204,19 +24175,17 @@ The same flow works for issue bodies (use \`issueCreate\` / \`issueUpdate\` with
 
 Never paste the \`api.replicas.dev/v1/media/<id>\` URL into a Linear body or comment \u2014 it will render as a broken image to anyone outside your Replicas chat.
 
-### GitHub: inline images and recording previews via Forge
-
-Replicas authenticates GitHub with GitHub App tokens, which native GitHub CLI attachment uploads do not support. Do not use \`gh --attach\` for media. Use a public Forge share for images in PR descriptions, issues, and comments.
+### GitHub: inline images and recording previews
 
-Create a public share only for a public repository or after explicit consent to publish media from a private repository. If sharing is not authorized, keep the media private and include its **View in Replicas** link, explaining that inline GitHub images require a public share.
+Replicas authenticates GitHub with GitHub App tokens, which GitHub's attachment upload rejects, so \`gh --attach\` does not work. Use the public link every image upload prints, in public and private repositories alike, for PR descriptions, issues, and comments.
 
-1. Upload the image with public access. This creates both the Replicas dashboard copy and the Forge share:
+1. Upload the image:
 
 \`\`\`bash
-replicas media upload /tmp/screenshot.png --name "PR screenshot" --access public
+replicas media upload /tmp/screenshot.png --name "PR screenshot"
 \`\`\`
 
-2. Copy the printed \`![filename](<public-url>)\` Forge embed into the body file, followed by the matching **View in Replicas** link. Use the printed public URL verbatim; never use a local file path, the authenticated API URL, or an expiring storage URL.
+2. Copy the printed \`![filename](<public-url>)\` line verbatim into the body file, followed by the matching **View in Replicas** link. Never use a local file path, a \`/v1/media/<id>\` URL, a Linear \`assetUrl\`, or an expiring storage URL.
 3. Create or update the PR using the body file:
 
 \`\`\`bash
@@ -24225,13 +24194,13 @@ gh pr edit 456 --body-file /tmp/pr-body.md
 gh pr comment 456 --body-file /tmp/comment.md
 \`\`\`
 
-GitHub does not reliably render external videos as inline players. For a recording preview, upload the MP4 normally, generate a poster with \`ffmpeg -i /tmp/demo.mp4 -frames:v 1 /tmp/demo-poster.png\`, upload the poster with \`--access public\`, and link its Forge embed to the recording's **View in Replicas** URL:
+Videos stay private, and GitHub does not play external videos inline. Upload the MP4 normally, generate a poster with \`ffmpeg -i /tmp/demo.mp4 -frames:v 1 /tmp/demo-poster.png\`, upload the poster like any image, and link its printed embed to the recording's **View in Replicas** URL:
 
 \`\`\`markdown
 [![Demo recording](<public-poster-url>)](<recording-dashboard-url>)
 \`\`\`
 
-Public forge shares are unauthenticated bearer capabilities. Revoke with \`replicas media revoke <media-id>\` **only** when the user asks or the media should intentionally stop rendering; never as routine post-task cleanup, since revoking breaks every embed already posted on the PR.
+Public links are unauthenticated bearer capabilities. Revoke with \`replicas media revoke <media-id>\` **only** when the user asks or the media should intentionally stop rendering; never as routine post-task cleanup, since revoking breaks every embed already posted on the PR.
 
 For a self-contained HTML report, upload it with \`--access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. GitHub cannot render the page inline, so use the normal link rather than image syntax. HTML pages cannot be shared publicly.
 
@@ -24241,7 +24210,7 @@ Do **not** commit screenshots to the repo, use placeholder URLs, expose the auth
 
 GitLab supports native project Markdown uploads. For a GitLab destination, always upload the media to Replicas first, then POST the same original file to the repository's \`/projects/:id/uploads\` API using the workspace GitLab credential. Insert the returned \`markdown\` value into the merge request body or comment and include the Replicas dashboard link. Image uploads render inline; MP4, MOV, and WebM uploads render as inline video players.
 
-Do not use a Replicas public forge share for GitLab when the native project upload succeeds; native uploads preserve project access controls.
+Do not use a Replicas public link for GitLab when the native project upload succeeds; native uploads preserve project access controls.
 
 ## Recording defaults
 
@@ -24283,7 +24252,7 @@ replicas media upload chart-a.svg chart-b.svg --name "Latency chart" --name "Err
 - \`--kind <image|video|audio|html>\` \u2014 override auto-detection
 - \`--name <name>\`: required display name shown in the dashboard, one per file in order
 - \`--session-id <id>\` \u2014 associate the upload with a specific session
-- \`--access organization|public\`: create an organization-only link, or a public bearer URL for non-HTML media
+- \`--access organization|public\`: for video, audio, and HTML, create an organization-only link or a public bearer URL (video and audio only). Images are always public
 - \`--share\`: alias for \`--access public\`; not supported for HTML
 `;
 var MEDIA_ABILITY = {
@@ -25819,165 +25788,6 @@ function parseCursorEvents(events) {
   return messages;
 }
 
-// ../shared/src/display-message/parsers/deepseek-parser.ts
-function parseArguments(value) {
-  if (typeof value !== "string") return void 0;
-  const parsed = safeJsonParse(value, value);
-  return isRecord(parsed) ? parsed : stringifyDisplayValue(parsed);
-}
-function getDeepseekAssistantMessageText(event, blockType) {
-  if (!isRecord(event) || event.type !== "assistant/message" || !isRecord(event.data) || !isRecord(event.data.message) || !Array.isArray(event.data.message.content)) return "";
-  return event.data.message.content.flatMap((block) => isRecord(block) && block.type === blockType && typeof block.text === "string" ? [block.text] : []).join("");
-}
-function parseDeepseekEvents(events) {
-  const messages = [];
-  for (const source of events) {
-    if (source.type === "event_msg" && source.payload.type === "user_message") {
-      if (typeof source.payload.message === "string" && source.payload.message.trim()) {
-        const messageId = source.payload[USER_MESSAGE_ID_PAYLOAD_KEY];
-        messages.push({
-          id: typeof messageId === "string" ? messageId : `deepseek-user-${source.timestamp}`,
-          type: "user",
-          content: source.payload.message,
-          timestamp: source.timestamp
-        });
-      }
-      continue;
-    }
-    if (source.type === "deepseek-error") {
-      messages.push({
-        id: `deepseek-error-${source.timestamp}`,
-        type: "error",
-        message: typeof source.payload.message === "string" ? source.payload.message : "DeepSeek Harness failed",
-        timestamp: source.timestamp
-      });
-      continue;
-    }
-    if (source.type === "deepseek-input-request") {
-      const requestId = typeof source.payload.requestId === "string" ? source.payload.requestId : `deepseek-input-${source.timestamp}`;
-      if (source.payload.kind === "approval") {
-        upsertDisplayMessage(messages, createCallDisplayMessage({
-          id: requestId,
-          server: "deepseek",
-          tool: typeof source.payload.toolName === "string" ? source.payload.toolName : "approval",
-          input: typeof source.payload.reason === "string" ? source.payload.reason : void 0,
-          status: "in_progress",
-          timestamp: source.timestamp,
-          inputRequest: {
-            requestId,
-            status: "pending",
-            options: [
-              { id: "deny", label: "Deny", variant: "secondary" },
-              { id: "allow", label: "Allow once", variant: "primary" }
-            ]
-          }
-        }));
-      } else {
-        const questions = Array.isArray(source.payload.questions) ? source.payload.questions : [];
-        upsertDisplayMessage(messages, createCallDisplayMessage({
-          id: requestId,
-          server: "deepseek",
-          tool: "ask_user",
-          status: "in_progress",
-          timestamp: source.timestamp,
-          inputRequest: {
-            requestId,
-            status: "pending",
-            questions: questions.flatMap((question) => {
-              if (!isRecord(question) || typeof question.id !== "string" || typeof question.question !== "string") return [];
-              const options = Array.isArray(question.options) ? question.options : [];
-              return [{
-                id: question.id,
-                prompt: question.question,
-                multiSelect: question.multiSelect === true,
-                options: options.flatMap((option) => isRecord(option) && typeof option.label === "string" ? [{ id: `${question.id}:${option.label}`, label: option.label, ...typeof option.description === "string" ? { description: option.description } : {} }] : [])
-              }];
-            })
-          }
-        }));
-      }
-      continue;
-    }
-    if (source.type === "deepseek-input-resolved") {
-      const requestId = typeof source.payload.requestId === "string" ? source.payload.requestId : "";
-      const existing = messages.find((message) => message.type === "tool_call" && message.inputRequest?.requestId === requestId);
-      if (existing?.type === "tool_call" && existing.inputRequest) {
-        existing.inputRequest.status = source.payload.status === "aborted" ? "aborted" : "resolved";
-        existing.status = source.payload.status === "aborted" ? "failed" : "completed";
-      }
-      continue;
-    }
-    if (source.type === "deepseek-jobs" && Array.isArray(source.payload.jobs)) {
-      for (const job of source.payload.jobs) {
-        if (!isRecord(job) || typeof job.id !== "string") continue;
-        const existing = messages.find((message) => message.type === "background_task" && message.taskId === job.id);
-        const status = normalizeBackgroundTaskStatus(job.status);
-        const next = {
-          id: existing?.id ?? `deepseek-job-${job.id}`,
-          type: "background_task",
-          taskId: job.id,
-          status,
-          description: typeof job.label === "string" ? job.label : void 0,
-          taskType: typeof job.kind === "string" ? job.kind : void 0,
-          error: status === "failed" && typeof job.detail === "string" ? job.detail : void 0,
-          timestamp: existing?.timestamp ?? source.timestamp
-        };
-        if (existing?.type === "background_task") Object.assign(existing, next);
-        else messages.push(next);
-      }
-      continue;
-    }
-    if (source.type !== "deepseek-session-event" || !isRecord(source.payload.event)) continue;
-    const event = source.payload.event;
-    const data = isRecord(event.data) ? event.data : {};
-    const seq = typeof event.seq === "number" ? event.seq : source.timestamp;
-    if (event.type === "assistant/message") {
-      const content = getDeepseekAssistantMessageText(event, "text");
-      const reasoning = getDeepseekAssistantMessageText(event, "reasoning");
-      if (reasoning.trim()) messages.push({ id: `deepseek-reasoning-${seq}`, type: "reasoning", content: reasoning, status: "completed", timestamp: source.timestamp });
-      if (content.trim()) messages.push({ id: `deepseek-assistant-${seq}`, type: "agent", content, timestamp: source.timestamp });
-      continue;
-    }
-    if (event.type === "tool/call") {
-      const callId = typeof data.callId === "string" ? data.callId : String(seq);
-      upsertDisplayMessage(messages, createCallDisplayMessage({
-        id: `deepseek-tool-${callId}`,
-        server: "deepseek",
-        tool: typeof data.name === "string" ? data.name : "tool",
-        input: parseArguments(data.arguments),
-        status: "in_progress",
-        timestamp: source.timestamp
-      }));
-      continue;
-    }
-    if (event.type === "tool/result") {
-      const message = isRecord(data.message) ? data.message : {};
-      const messageSource = isRecord(message.source) ? message.source : {};
-      const result = Array.isArray(message.content) && isRecord(message.content[0]) ? message.content[0] : {};
-      const callId = typeof messageSource.callId === "string" ? messageSource.callId : typeof data.callId === "string" ? data.callId : String(seq);
-      const existing = messages.find((message2) => message2.id === `deepseek-tool-${callId}` && message2.type === "tool_call");
-      if (existing?.type === "tool_call") {
-        existing.output = stringifyDisplayValue(result.content ?? data.result);
-        existing.status = result.isError === true || data.isError === true ? "failed" : "completed";
-      }
-      continue;
-    }
-    if (event.type === "todo/write" && Array.isArray(data.items)) {
-      messages.push({
-        id: `deepseek-todo-${seq}`,
-        type: "todo_list",
-        items: data.items.flatMap((item) => {
-          if (!isRecord(item) || typeof item.content !== "string") return [];
-          const itemStatus = item.status === "in_progress" || item.status === "completed" ? item.status : "pending";
-          return [{ text: item.content, completed: itemStatus === "completed", itemStatus }];
-        }),
-        timestamp: source.timestamp
-      });
-    }
-  }
-  return messages;
-}
-
 // ../shared/src/display-message/parsers/acp-parser.ts
 var FX_CONTEXT_DIAGNOSTIC = /^\[context\] skill catalog omitted .*?(?:\r?\n|$)/;
 function getAcpTextChunk(update, kind) {
@@ -27172,18 +26982,12 @@ function parseAgentEvents(events, agentType) {
   if (agentType === "cursor") {
     return parseCursorEvents(events);
   }
-  if (agentType === "deepseek") {
-    return parseDeepseekEvents(events);
-  }
   if (agentType === "fx") {
     return parseFxEvents(events);
   }
   if (agentType === "kimi") {
     return parseAcpEvents(events, "kimi");
   }
-  if (agentType === "gemini") {
-    return parseAcpEvents(events, "gemini");
-  }
   if (agentType === "muse") {
     return parseMuseEvents(events);
   }
@@ -27457,7 +27261,7 @@ var headlessFilesystemAgentResultSchema = external_exports.object({
 });
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.727";
+var CLI_VERSION = "0.2.729";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -31536,38 +31340,41 @@ async function mediaUploadCommand(filePaths, options) {
   if (publicAccess && kinds.some((kind) => !isPublicMediaKind(kind))) {
     throw new Error("HTML pages only support organization access. Use --access organization.");
   }
+  const shared = kinds.map((kind) => publicAccess || kind === MEDIA_KIND.IMAGE);
   const results = await Promise.allSettled(
     filePaths.map((filePath, i) => uploadOne(filePath, names[i], kinds[i], options))
   );
-  const shareResults = publicAccess ? await Promise.allSettled(
+  const shareResults = await Promise.allSettled(
     results.map(
-      (result) => result.status === "fulfilled" ? shareMedia(result.value.media.id) : Promise.resolve(null)
+      (result, i) => result.status === "fulfilled" && shared[i] ? shareMedia(result.value.media.id) : Promise.resolve(null)
     )
-  ) : [];
+  );
   const config3 = readAgentConfig();
   const failures = [];
   for (let i = 0; i < results.length; i++) {
     const result = results[i];
     if (result.status === "fulfilled") {
       const { fileName, media } = result.value;
-      const shareResult = publicAccess ? shareResults[i] : void 0;
+      const shareResult = shareResults[i];
       const publicUrl = shareResult?.status === "fulfilled" ? shareResult.value ?? void 0 : void 0;
-      if (publicAccess) {
+      if (shared[i]) {
         if (!publicUrl) {
-          const error51 = shareResult?.status === "rejected" ? shareResult.reason : new Error("Missing public share URL");
+          const reason = shareResult?.status === "rejected" ? shareResult.reason : new Error("Missing public share URL");
           failures.push({
             filePath: filePaths[i],
             operation: "share",
-            error: error51 instanceof Error ? error51 : new Error(String(error51))
+            error: new Error(
+              `${reason instanceof Error ? reason.message : String(reason)}. Uploaded as ${media.id}; retry with \`replicas media share ${media.id}\``
+            )
           });
         }
       }
       if (media.kind === MEDIA_KIND.HTML) {
         console.log(`HTML page: [${fileName}](${MONOLITH_URL}/v1/media/${media.id})`);
-      } else if (!publicAccess || publicUrl) {
+      } else if (!shared[i] || publicUrl) {
         console.log(formatMediaEmbed(fileName, media.id, publicUrl));
       }
-      if (options.access === "organization") {
+      if (options.access === "organization" && !shared[i]) {
         console.log(
           `Forge link (organization only): [View ${options.name?.[i] ?? fileName}](${getOrganizationMediaUrl(media.organization_id, media.id)})`
         );
@@ -31608,7 +31415,7 @@ async function mediaListCommand(options) {
   const query = qs.toString() ? `?${qs.toString()}` : "";
   const { media } = await agentFetch(`/v1/engine/media${query}`);
   for (const m of media) {
-    console.log(`${MONOLITH_URL}/v1/media/${m.id}	${m.kind}	${m.size}	${m.created_at}`);
+    console.log(`${m.id}	${m.kind}	${m.display_name ?? ""}	${m.size}	${m.created_at}`);
   }
 }
 
@@ -33181,7 +32988,7 @@ if (isAgentMode()) {
     "Required human-facing display name shown in the dashboard. Pass one --name per file, in order.",
     (value, previous) => [...previous, value],
     []
-  ).option("--access <access>", "Link access: organization (sign-in required) or public (non-HTML bearer URL)").option("--share", "Alias for --access public; not supported for HTML").action(async (files, options) => {
+  ).option("--access <access>", "Link access for video, audio, and HTML: organization (sign-in required) or public (video and audio only). Images always get a public link").option("--share", "Alias for --access public; not supported for HTML").action(async (files, options) => {
     try {
       await mediaUploadCommand(files, options);
     } catch (error51) {
@@ -33193,7 +33000,7 @@ if (isAgentMode()) {
       process.exit(1);
     }
   });
-  media.command("share <mediaId>").description("Create or rotate a public forge URL for uploaded image, video, or audio media").action(async (mediaId) => {
+  media.command("share <mediaId>").description("Rotate an image's public forge URL, or create one for video or audio media").action(async (mediaId) => {
     try {
       await mediaShareCommand(mediaId);
     } catch (error51) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.727",
+  "version": "0.2.729",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {