Rush CLI 0.2.50

The upgrade channel reads the CDN, not the API (PHNX-3751 slice 3 track 1). rush upgrade and the background upgrade-banner check now fetch https://cdn.getrush.ai/releases/rush-cli/latest.json instead of https://api.prix.dev/api/v1/releases/rush-cli/latest. The manifest is the same R2 object either way; reading it from the artifact host means no future API rename can strand installed CLIs on a 404 the way this one would have. The published install.sh / install.ps1 and the release scripts read the same URL. The API still serves the document at GET /releases/rush-cli/latest.

scripts/upload-release.sh uses the renamed publish verbs. Presign is POST /internal/releases/rush-cli/versions and finalize is PATCH /internal/releases/rush-cli/latest; the dead API_URL constant for the retired multipart /upload endpoint is gone.

rush http examples in the docs use a live path (POST /internal/admin/jobs/catalog-rebuild) rather than the removed /api/v1/admin/regenerate-catalog.

Every Rush Cloud path the CLI calls moved under the org. Projects are /o/{org}/p[/{project}] (a project is addressed by its handle, so the separate ?name= resolve call is gone); agents are /o/{org}/agents, with the catalog at /o/{org}/agents/available; the GitHub installation list is GET /o/{org}/github. The old /api/v1/* spellings 404 against a deployed Rush Cloud from this release's API onward, so 0.2.49 and earlier cannot dispatch against it.

Both hand-built GitHub installation requests are gone. Repo resolution on dispatch and the interactive repo picker call Client.ListGitHubInstallations instead of assembling their own http.Request (AGENTS.md: a command file builds no requests).

Account API calls follow Rush Cloud's PHNX-3751 slice 3 track 2 rename. rush login/rush whoami's server-side validity check now calls GET /me (was /api/v1/auth/me); session refresh reads Supabase config from GET /auth/config (was /api/v1/auth/config); rush connect/accounts/ disconnect now call POST/PATCH/DELETE /me/agent-accounts[/:id] (was /api/v1/cloud-accounts, and the single-key grok/cursor/copilot path merged into the same POST /me/agent-accounts, was /api/v1/cloud-account-tokens); rush agents new's Connections tab calls POST/GET /me/connections[/:id] (was /api/v1/auth/connection-operations[/:id]) and lists connections from GET /me/connections (was /api/v1/auth/connections). No CLI-visible behavior changes — only the wire paths, ahead of the Rush Cloud deploy that retires the old ones.

ListOrgs now calls GET /me, not GET /api/v1/orgs/me (Track 3 → Track 2 hand-off, agreed at review). Track 2's Account rename folds the org-membership read into GET /me's orgs[] (personal-first, same {id,name,slug,kind,role} shape); the CLI's internal/api/orgs.go picks that path up now that both tracks have landed, instead of shipping a call to a route Track 2 already retired.

rush artifacts reads the org store (PHNX-3751 slice 3 Track 5). list and view call /o/{org}/artifacts[/{artifact}], resolved through the same OrgSource as every other cloud verb, so list is now "what my organization has" rather than "what I uploaded".

rush artifacts share sets a visibility instead of minting a share. A share IS an artifact visibility in Rush Cloud now, so the command is a PATCH /o/{org}/artifacts/{artifact} carrying {"visibility": …} and takes --visibility private|org|public (default public). Publishing prints https://share.getrush.ai/a/{slug}-{id}; the slug comes from the title and is ignored on read, so retitling never breaks a link. --visibility private unpublishes and prints the new visibility rather than a link that would 404 for its recipient.

rush login opens the Phoenix approval page in your default browser (PHNX-4053). When this host has a desktop session (macOS, Windows, or a Linux display) the CLI opens the direct approval link itself and says so; the URL and short code still print, so a headless host or approving from a phone works as before. It uses the same opener as rush open.