@1claw/cli 0.57.0 → 0.58.1

package/dist/bundled-templates/templates/elizaos/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec npx tsx agent.ts
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh npx tsx agent.ts

package/dist/bundled-templates/templates/langchain/Dockerfile

@@ -6,6 +6,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 

package/dist/bundled-templates/templates/langchain/agent.py

@@ -110,6 +110,6 @@ Credentials stay in the host daemon — this container never sees secret values.
 
 
 if __name__ == "__main__":
-    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    port = int(os.environ.get("AGENT_INTERNAL_PORT", "3001"))
     print(f"LangChain agent listening on http://0.0.0.0:{port}")
     app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/langchain/entrypoint.sh

@@ -32,5 +32,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec python agent.py
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh python agent.py

package/dist/bundled-templates/templates/llamaindex/Dockerfile

@@ -6,6 +6,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 

package/dist/bundled-templates/templates/llamaindex/agent.py

@@ -92,6 +92,6 @@ Credentials stay in the host daemon — this container never sees secret values.
 
 
 if __name__ == "__main__":
-    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    port = int(os.environ.get("AGENT_INTERNAL_PORT", "3001"))
     print(f"LlamaIndex agent listening on http://0.0.0.0:{port}")
     app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/llamaindex/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec python agent.py
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh python agent.py

package/dist/bundled-templates/templates/mastra/Dockerfile

@@ -1,11 +1,14 @@
 FROM node:22-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl tini && \
+    curl tini python3 && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY package.json tsconfig.json ./
 RUN npm install --omit=dev 2>/dev/null || npm install
 

package/dist/bundled-templates/templates/mastra/agent.ts

@@ -63,7 +63,7 @@ async function handleChat(message: string): Promise<string> {
   return text;
 }
 
-const PORT = parseInt(process.env.CHAT_UI_PORT ?? "3000", 10);
+const PORT = parseInt(process.env.AGENT_INTERNAL_PORT ?? "3001", 10);
 
 const server = createServer(async (req, res) => {
   if (req.url === "/health" && req.method === "GET") {

package/dist/bundled-templates/templates/mastra/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec npx tsx agent.ts
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh npx tsx agent.ts

package/dist/bundled-templates/templates/openai-agents/Dockerfile

@@ -6,6 +6,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 

package/dist/bundled-templates/templates/openai-agents/agent.py

@@ -93,6 +93,6 @@ Credentials stay in the host daemon — this container never sees secret values.
 
 
 if __name__ == "__main__":
-    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    port = int(os.environ.get("AGENT_INTERNAL_PORT", "3001"))
     print(f"OpenAI Agents SDK agent listening on http://0.0.0.0:{port}")
     app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/openai-agents/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec python agent.py
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh python agent.py

package/dist/bundled-templates/templates/pydantic-ai/Dockerfile

@@ -6,6 +6,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 

package/dist/bundled-templates/templates/pydantic-ai/agent.py

@@ -105,6 +105,6 @@ Credentials stay in the host daemon — this container never sees secret values.
 
 
 if __name__ == "__main__":
-    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    port = int(os.environ.get("AGENT_INTERNAL_PORT", "3001"))
     print(f"Pydantic AI agent listening on http://0.0.0.0:{port}")
     app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/pydantic-ai/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec python agent.py
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh python agent.py

package/dist/bundled-templates/templates/smolagents/Dockerfile

@@ -6,6 +6,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 

package/dist/bundled-templates/templates/smolagents/README.md

@@ -16,7 +16,7 @@ Or with your own API key:
 
 ## What's included
 
-- **agent.py** — CodeAgent with example tools (hello_world, list_env_vars)
+- **agent.py** — ToolCallingAgent by default (set `ONECLAW_SMOLAGENTS_CODE_MODE=1` for CodeAgent)
 - **Flask server** on port 3000 with `/chat` and `/health` endpoints
 - **Shroud integration** — LLM calls are routed through Shroud for inspection
 - **MCP server** — started automatically for tool access to 1Claw vault

package/dist/bundled-templates/templates/smolagents/SECURITY.md

@@ -0,0 +1,17 @@
+# smolagents template security
+
+This template defaults to HuggingFace `ToolCallingAgent`, which only invokes
+registered tools. It does **not** execute arbitrary Python.
+
+`CodeAgent` (LLM-generated Python) is available behind
+`ONECLAW_SMOLAGENTS_CODE_MODE=1`. Treat that mode as high-trust / development
+only:
+
+- Run it only inside the 1Claw spawn container (non-root, network-scoped).
+- Do not expose the `/chat` port to the public internet.
+- Route LLM traffic through Shroud (`ONECLAW_LLM_VIA_SHROUD=true`).
+- Never deploy CodeAgent mode on a host that holds production credentials
+  outside the vault.
+
+The 1Claw host injects secrets via the daemon; the container should not
+receive raw API keys.

package/dist/bundled-templates/templates/smolagents/agent.py

@@ -7,13 +7,20 @@ The container never sees raw API keys — they are injected by the host daemon.
 
 import os
 from flask import Flask, request, jsonify
-from smolagents import CodeAgent, tool, OpenAIServerModel
+from smolagents import CodeAgent, ToolCallingAgent, tool, OpenAIServerModel
 
 app = Flask(__name__)
 
 SHROUD_URL = os.environ.get("ONECLAW_SHROUD_URL", "https://shroud.1claw.xyz")
 LLM_VIA_SHROUD = os.environ.get("ONECLAW_LLM_VIA_SHROUD", "").lower() == "true"
 MODEL = os.environ.get("ONECLAW_SHROUD_MODEL", "gpt-4o-mini")
+# CodeAgent executes LLM-generated Python. Off by default; only enable inside
+# an isolated container with a human-set env flag.
+CODE_MODE = os.environ.get("ONECLAW_SMOLAGENTS_CODE_MODE", "").lower() in (
+    "1",
+    "true",
+    "yes",
+)
 
 
 @tool
@@ -44,7 +51,8 @@ def create_agent():
         api_key="shroud-injected",
     )
 
-    return CodeAgent(
+    agent_cls = CodeAgent if CODE_MODE else ToolCallingAgent
+    return agent_cls(
         tools=[hello_world, list_env_vars],
         model=model,
     )
@@ -92,6 +100,6 @@ Credentials stay in the host daemon — this container never sees secret values.
 
 
 if __name__ == "__main__":
-    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    port = int(os.environ.get("AGENT_INTERNAL_PORT", "3001"))
     print(f"smolagents agent listening on http://0.0.0.0:{port}")
     app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/smolagents/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec python agent.py
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh python agent.py

package/dist/bundled-templates/templates/typescript-sdk/Dockerfile

@@ -1,11 +1,14 @@
 FROM node:22-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl tini && \
+    curl tini python3 && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
+COPY shared /app/shared
+RUN chmod +x /app/shared/start-with-chat-ui.sh
+
 COPY package.json tsconfig.json ./
 RUN npm install --omit=dev 2>/dev/null || npm install
 

package/dist/bundled-templates/templates/typescript-sdk/README.md

@@ -5,9 +5,12 @@ Plain TypeScript agent using [@1claw/sdk](https://www.npmjs.com/package/@1claw/s
 ## Quick start
 
 ```bash
+# spawn starts the host daemon automatically (no separate `1claw daemon start` needed)
 1claw spawn typescript-sdk --agent-key ocv_YOUR_KEY
 ```
 
+Key-only `ocv_…` auth is supported — spawn resolves your agent ID via Vault token exchange and stores Shroud credentials in the host daemon. The container routes LLM calls through the daemon `/proxy` endpoint; it never sees raw keys.
+
 ## What's included
 
 - `agent.ts` — TypeScript agent with `@1claw/sdk` client, AI SDK tool calling, and `/chat` + `/health` endpoints

package/dist/bundled-templates/templates/typescript-sdk/agent.ts

@@ -2,10 +2,11 @@
  * Plain TypeScript agent using @1claw/sdk for vault access and signing,
  * with Vercel AI SDK for LLM interaction through Shroud.
  *
- * LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
- * The container never sees raw API keys — they are injected by the host daemon.
+ * LLM calls route through the host daemon's /proxy when ONECLAW_SHROUD_SECRET
+ * is set (spawn/init cloud mode). The container never sees agent or provider keys.
  */
 
+import { request as httpRequest } from "node:http";
 import { createServer } from "node:http";
 import { OneclawClient } from "@1claw/sdk";
 import { createOpenAI } from "@ai-sdk/openai";
@@ -15,7 +16,12 @@ import { z } from "zod";
 const SHROUD_URL = process.env.ONECLAW_SHROUD_URL ?? "https://shroud.1claw.xyz";
 const LLM_VIA_SHROUD = process.env.ONECLAW_LLM_VIA_SHROUD === "true";
 const MODEL = process.env.ONECLAW_SHROUD_MODEL ?? "gpt-4o-mini";
-const PORT = parseInt(process.env.CHAT_UI_PORT ?? "3000", 10);
+const PORT = parseInt(process.env.AGENT_INTERNAL_PORT ?? "3001", 10);
+const DAEMON_SOCKET = process.env.ONECLAW_DAEMON_SOCKET ?? "/run/1claw/daemon.sock";
+const SECRET_PREFIX = process.env.ONECLAW_SECRET_PREFIX ?? "";
+const SHROUD_SECRET = process.env.ONECLAW_SHROUD_SECRET ?? "";
+const SHROUD_API_KEY_SECRET = process.env.ONECLAW_SHROUD_API_KEY_SECRET ?? "";
+const SHROUD_PROVIDER = process.env.ONECLAW_SHROUD_PROVIDER ?? "openai";
 
 const conversationHistory: { role: "user" | "assistant"; content: string }[] = [];
 
@@ -25,9 +31,144 @@ const claw = new OneclawClient({
   baseUrl: process.env.ONECLAW_BASE_URL ?? "https://api.1claw.xyz",
 });
 
-const openai = LLM_VIA_SHROUD
-  ? createOpenAI({ baseURL: `${SHROUD_URL}/v1`, apiKey: "shroud-injected" })
-  : null;
+function daemonRequest(
+  method: string,
+  path: string,
+  body?: unknown,
+): Promise<{ status: number; body: Record<string, unknown> | null }> {
+  return new Promise((resolve, reject) => {
+    const payload = body ? JSON.stringify(body) : undefined;
+    const req = httpRequest(
+      {
+        socketPath: DAEMON_SOCKET,
+        path,
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          ...(SECRET_PREFIX ? { "X-Secret-Prefix": SECRET_PREFIX } : {}),
+          ...(payload ? { "Content-Length": Buffer.byteLength(payload) } : {}),
+        },
+        timeout: 120_000,
+      },
+      (res) => {
+        const chunks: Buffer[] = [];
+        res.on("data", (c) => chunks.push(c as Buffer));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          let parsed: Record<string, unknown> | null = null;
+          try {
+            parsed = text ? (JSON.parse(text) as Record<string, unknown>) : null;
+          } catch {
+            parsed = { raw: text };
+          }
+          resolve({ status: res.statusCode ?? 0, body: parsed });
+        });
+      },
+    );
+    req.on("error", reject);
+    req.on("timeout", () => req.destroy(new Error("daemon request timed out")));
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+/** Route outbound LLM HTTP through the host daemon (injects X-Shroud-Agent-Key). */
+async function proxyViaDaemon(url: string, init?: RequestInit): Promise<Response> {
+  if (!SHROUD_SECRET) {
+    throw new Error(
+      "Shroud is enabled but ONECLAW_SHROUD_SECRET is missing. Re-run spawn with --agent-key ocv_... so the daemon can inject credentials.",
+    );
+  }
+
+  const headers: Record<string, string> = {};
+  if (init?.headers) {
+    const h = init.headers;
+    if (h instanceof Headers) {
+      h.forEach((v, k) => {
+        headers[k] = v;
+      });
+    } else if (Array.isArray(h)) {
+      for (const [k, v] of h) headers[k] = v;
+    } else {
+      Object.assign(headers, h as Record<string, string>);
+    }
+  }
+  delete headers.authorization;
+  delete headers.Authorization;
+  headers["X-Shroud-Provider"] = headers["X-Shroud-Provider"] ?? SHROUD_PROVIDER;
+
+  let body: string | undefined;
+  if (typeof init?.body === "string") {
+    body = init.body;
+  } else if (init?.body != null) {
+    body = String(init.body);
+  }
+
+  const proxyBody: Record<string, unknown> = {
+    secretName: SHROUD_SECRET,
+    url,
+    method: init?.method ?? "GET",
+    headers,
+    body,
+  };
+  if (SHROUD_API_KEY_SECRET) {
+    proxyBody.injectSecrets = [SHROUD_API_KEY_SECRET];
+  }
+
+  const r = await daemonRequest("POST", "/proxy", proxyBody);
+  if (r.status !== 200) {
+    const detail =
+      (r.body && (r.body.error as string)) ||
+      (r.body ? JSON.stringify(r.body) : "unknown daemon error");
+    throw new Error(`Daemon proxy failed (${r.status}): ${detail}`);
+  }
+
+  const upstreamStatus = (r.body?.status as number) ?? 502;
+  const upstreamBody =
+    typeof r.body?.body === "string"
+      ? r.body.body
+      : JSON.stringify(r.body?.body ?? {});
+
+  let errorMessage: string | undefined;
+  if (upstreamStatus >= 400) {
+    try {
+      const parsed = JSON.parse(upstreamBody) as {
+        error?: string | { message?: string };
+        message?: string;
+      };
+      if (typeof parsed.error === "string") {
+        errorMessage = parsed.error;
+      } else if (parsed.error && typeof parsed.error.message === "string") {
+        errorMessage = parsed.error.message;
+      } else if (typeof parsed.message === "string") {
+        errorMessage = parsed.message;
+      }
+    } catch {
+      errorMessage = upstreamBody.slice(0, 400);
+    }
+  }
+
+  if (errorMessage) {
+    throw new Error(errorMessage);
+  }
+
+  const responseHeaders = (r.body?.headers as Record<string, string>) ?? {
+    "Content-Type": "application/json",
+  };
+  return new Response(upstreamBody, {
+    status: upstreamStatus,
+    headers: responseHeaders,
+  });
+}
+
+const openai =
+  LLM_VIA_SHROUD && SHROUD_SECRET
+    ? createOpenAI({
+        baseURL: `${SHROUD_URL.replace(/\/+$/, "")}/v1`,
+        apiKey: "daemon-injected",
+        fetch: proxyViaDaemon as typeof fetch,
+      })
+    : null;
 
 const listSecretsTool = tool({
   description: "List secrets in the 1Claw vault (names only, no values)",
@@ -37,12 +178,14 @@ const listSecretsTool = tool({
       const vaultId = process.env.ONECLAW_VAULT_ID;
       if (!vaultId) return "No vault configured.";
       const resp = await claw.secrets.list(vaultId, prefix);
-      const secrets = (resp as any).data?.secrets ?? [];
+      const secrets = (resp as { data?: { secrets?: Array<{ path: string; type?: string }> } })
+        .data?.secrets ?? [];
       return secrets.length
-        ? secrets.map((s: any) => `  ${s.path} (${s.type ?? "generic"})`).join("\n")
+        ? secrets.map((s) => `  ${s.path} (${s.type ?? "generic"})`).join("\n")
         : "No secrets found.";
-    } catch (e: any) {
-      return `Error: ${e.message}`;
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return `Error: ${msg}`;
     }
   },
 });
@@ -61,7 +204,7 @@ const envTool = tool({
 
 async function handleChat(message: string): Promise<string> {
   if (!openai) {
-    return "No LLM configured. Use --llm-api-key or enable Token Billing.";
+    return "No LLM configured. Re-run spawn with --agent-key ocv_... (and optional --llm-api-key). The host daemon injects Shroud credentials.";
   }
 
   conversationHistory.push({ role: "user", content: message });
@@ -84,7 +227,12 @@ const server = createServer(async (req, res) => {
   if (req.url === "/health" && req.method === "GET") {
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(
-      JSON.stringify({ status: "ok", framework: "typescript-sdk", llm_wired: LLM_VIA_SHROUD }),
+      JSON.stringify({
+        status: "ok",
+        framework: "typescript-sdk",
+        llm_wired: LLM_VIA_SHROUD && !!SHROUD_SECRET,
+        daemon_socket: DAEMON_SOCKET,
+      }),
     );
     return;
   }
@@ -92,7 +240,7 @@ const server = createServer(async (req, res) => {
   if (req.url === "/chat" && req.method === "POST") {
     const chunks: Buffer[] = [];
     for await (const chunk of req) chunks.push(chunk as Buffer);
-    const body = JSON.parse(Buffer.concat(chunks).toString());
+    const body = JSON.parse(Buffer.concat(chunks).toString()) as { message?: string };
     const message = (body.message ?? "").trim();
 
     if (!message) {
@@ -105,9 +253,10 @@ const server = createServer(async (req, res) => {
       const response = await handleChat(message);
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ response, framework: "typescript-sdk" }));
-    } catch (e: any) {
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e);
       res.writeHead(500, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: e.message }));
+      res.end(JSON.stringify({ error: msg }));
     }
     return;
   }

package/dist/bundled-templates/templates/typescript-sdk/entrypoint.sh

@@ -30,5 +30,5 @@ if [ -S "$DAEMON_SOCKET" ]; then
     fi
 fi
 
-echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
-exec npx tsx agent.ts
+# Chat UI starts in start-with-chat-ui.sh
+exec /app/shared/start-with-chat-ui.sh npx tsx agent.ts

package/dist/src/commands/agent.js

@@ -1738,4 +1738,62 @@ accountsCommand
     }
 });
 registerAgentBindingCommands(agentCommand);
+const automationAgentCommand = agentCommand
+    .command("automation")
+    .description("Agent-scoped automation commands (requires agent JWT)");
+automationAgentCommand
+    .command("create <agent-id> <name>")
+    .description("Create a simple automation for the calling agent (manual/webhook; log/notify/memory/wait steps)")
+    .option("--trigger <type>", "manual or webhook", "manual")
+    .option("--workflow <json-or-file>", "Workflow spec JSON or @file path", '{"steps":[{"type":"log","message":"hello"}]}')
+    .option("--auto-trigger", "Trigger immediately after create (manual only)")
+    .option("--token <jwt>", "Agent JWT (or set ONECLAW_AGENT_TOKEN)")
+    .option("--api-key <key>", "Agent API key to exchange (or ONECLAW_AGENT_API_KEY)")
+    .option("--json", "Output as JSON")
+    .action(async (agentId, name, opts) => {
+    try {
+        let agentToken = opts.token ?? process.env.ONECLAW_AGENT_TOKEN ?? "";
+        if (!agentToken) {
+            const apiKey = opts.apiKey ?? process.env.ONECLAW_AGENT_API_KEY ?? "";
+            if (!apiKey) {
+                throw new Error("Provide --token, ONECLAW_AGENT_TOKEN, --api-key, or ONECLAW_AGENT_API_KEY");
+            }
+            const exchanged = await api("/auth/agent-token", {
+                method: "POST",
+                body: { agent_id: agentId, api_key: apiKey },
+                token: undefined,
+            });
+            agentToken = exchanged.access_token;
+        }
+        let workflowSpec;
+        if (opts.workflow.startsWith("@")) {
+            workflowSpec = JSON.parse(readFileSync(opts.workflow.slice(1), "utf8"));
+        }
+        else {
+            workflowSpec = JSON.parse(opts.workflow);
+        }
+        const result = await api(`/agents/${agentId}/automations`, {
+            method: "POST",
+            token: agentToken,
+            body: {
+                name,
+                trigger_type: opts.trigger,
+                workflow_spec: workflowSpec,
+                auto_trigger: Boolean(opts.autoTrigger),
+            },
+        });
+        const automation = (result.automation ?? result);
+        if (opts.json) {
+            printJson(automation);
+            return;
+        }
+        printSuccess(`Agent automation created: ${String(automation.name ?? name)} (${String(automation.id ?? "")})`);
+        if (typeof result.webhook_url === "string") {
+            printKeyValue([["Webhook URL", result.webhook_url]]);
+        }
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
 //# sourceMappingURL=agent.js.map