@andreprado/agentkit 0.1.0-alpha.14 → 0.1.0-alpha.16

package/README.md

@@ -48,6 +48,8 @@ agentkit conversations trace <conversation-id>
 
 Knowledge indexes local `.md`, `.txt`, and `.csv` sources into the capsule database and registers the internal `agentkit_search_knowledge` chat tool when `knowledge` is configured in `agentkit.config.ts`. `agentkit dev` and `agentkit chat` sync configured sources automatically; when embeddings are configured, local semantic search uses a libSQL vector sidecar. Hosted Cloudflare deploys package configured local Knowledge sources and sync them into the project Turso database automatically during `agentkit deploy`; when embeddings are configured, the deploy also creates and populates the hosted Turso vector index.
 
+Every chat run receives dynamic runtime date context: current ISO timestamp, local date, weekday, local date/time, and timezone. Set `timeZone` in `agentkit.config.ts` for scheduling agents so relative dates like "today" and "next Friday" resolve in the right business/user timezone.
+
 ## Deploy Later
 
 ```sh

package/docs/guides/add-channel.md

@@ -87,6 +87,62 @@ agentkit channels buffers clear support-whatsapp <conversation-id>
 agentkit channels buffers retry support-whatsapp <conversation-id>
 ```
 
+## Auto Transcribe Audio
+
+Use `transcription` at the agent level and `audio.mode: "transcribe"` on each channel that should accept voice notes or audio files.
+
+```ts
+export default defineAgent({
+  name: "support-agent",
+  runtime: "edge",
+  provider: { name: "openai", model: "gpt-5.4-mini" },
+  instructions: "./prompts/instructions.md",
+  transcription: {
+    provider: "groq",
+    model: "whisper-large-v3-turbo",
+    secret: "GROQ_API_KEY",
+    language: "pt",
+    limits: {
+      maxDurationSeconds: 180,
+      maxBytes: 20_000_000,
+    },
+  },
+  channels: [
+    telegramChannel({
+      name: "support-telegram",
+      audio: { mode: "transcribe" },
+    }),
+    whatsappChannel({
+      name: "support-whatsapp",
+      provider: "zapster",
+      audio: { mode: "transcribe" },
+    }),
+  ],
+  access: { mode: "public" },
+  storage: { driver: "agentkit" },
+});
+```
+
+Supported transcription providers in V1:
+
+| Provider | Default secret | Supported models |
+| --- | --- | --- |
+| `openai` | `OPENAI_API_KEY` | `gpt-4o-mini-transcribe`, `gpt-4o-transcribe`, `whisper-1` |
+| `groq` | `GROQ_API_KEY` | `whisper-large-v3-turbo`, `whisper-large-v3`, `distil-whisper-large-v3-en` |
+
+Audio transcription is paid by the capsule owner because AgentKit only passes through the configured provider secret. Hosted channel creation automatically requires the transcription secret when a channel enables `audio.mode: "transcribe"`.
+
+Processing order:
+
+1. Provider webhook is validated and deduped.
+2. Channel adapter normalizes the audio metadata.
+3. AgentKit records `audio_received` and enqueues a channel job before acknowledging the webhook.
+4. The retryable channel worker downloads the audio using the channel provider secret.
+5. The transcription adapter sends the file to the configured transcription provider.
+6. The agent receives a text message containing the transcript.
+
+V1 keeps the raw audio in memory for the request path and delivery metadata only records redacted status/error fields. `rawAudioTtlSeconds` is part of the manifest contract for future object-storage retention, but V1 does not persist raw audio by default.
+
 ## Safety Rules
 
 - Never put provider token values in `agentkit.config.ts`.
@@ -94,6 +150,7 @@ agentkit channels buffers retry support-whatsapp <conversation-id>
 - Treat channel webhook URLs as public transport endpoints. Provider validation or the AgentKit website channel token controls authenticity.
 - Keep channels separate from tools. Channels deliver user messages; tools let the agent call external systems.
 - Keep `maxMessages` and `maxChars` bounded so one burst cannot create an oversized prompt or unexpected model spend.
+- Keep `audio.limits` bounded so one voice note cannot create unexpected transcription spend.
 
 ## Verification
 
@@ -124,4 +181,10 @@ The provider webhook secret, token, or origin header does not match the managed
 `channel_limit_exceeded`:
 The channel daily message limit was reached. Website requests return `429`; Telegram and WhatsApp are acknowledged and skipped to avoid provider retry storms.
 
+`transcription_secret_missing`:
+Set the managed transcription secret declared by `agentkit inspect`, for example `OPENAI_API_KEY` or `GROQ_API_KEY`.
+
+`transcription_audio_format_unsupported`:
+The channel delivered an audio format the configured transcription provider does not accept. Telegram voice notes are OGG/Opus and work with Groq in V1; OpenAI accepts MP3, MP4, MPEG, MPGA, M4A, WAV, and WEBM in the AgentKit adapter.
+
 Buffered messages stay in `buffered` delivery state until the quiet window or max wait flushes them into one queued run.

package/docs/guides/channel-security.md

@@ -15,6 +15,7 @@ agentkit inspect
 agentkit channels status <name>
 agentkit channels deliveries show <delivery-id>
 bun test packages/agentkit/src/runtime/channels/adapters.test.ts
+bun test packages/agentkit/src/runtime/transcription.test.ts
 bun test packages/agentkit/src/runtime/deploy.test.ts
 ```
 
@@ -41,9 +42,12 @@ Zapster smoke also requires `ZAPSTER_API_KEY`, `ZAPSTER_INSTANCE_ID`, and `AGENT
 - Validate provider authenticity when the provider supports it.
 - Do not store channel plumbing in the user's Turso database.
 - Do not store raw webhook bodies in delivery records; store a SHA-256 hash.
+- Do not store raw audio in delivery records. V1 audio transcription downloads provider media into memory and stores only redacted metadata and state transitions.
 - Redact bearer tokens, bot tokens, signing secrets, provider API tokens, and phone numbers.
 - Inject only channel-declared secrets into adapter code.
+- Inject transcription secrets only when the deploy manifest declares transcription and the channel uses `audio.mode: "transcribe"`.
 - Prefer acknowledging Telegram/WhatsApp over retry storms when a channel-level limit is exceeded.
+- Keep audio duration and byte limits bounded before provider calls to avoid uncontrolled transcription spend.
 
 ## Minimal Working Example
 
@@ -54,17 +58,42 @@ telegramChannel({
 });
 ```
 
+With audio transcription:
+
+```ts
+export default defineAgent({
+  // ...
+  transcription: {
+    provider: "groq",
+    model: "whisper-large-v3-turbo",
+    secret: "GROQ_API_KEY",
+    limits: {
+      maxDurationSeconds: 180,
+      maxBytes: 20_000_000,
+    },
+  },
+  channels: [
+    telegramChannel({
+      name: "support-telegram",
+      audio: { mode: "transcribe" },
+    }),
+  ],
+});
+```
+
 The config contains secret names only. Hosted responses report:
 
 ```txt
 TELEGRAM_BOT_TOKEN: set
 TELEGRAM_WEBHOOK_SECRET: missing
+GROQ_API_KEY: set
 ```
 
 ## Verification
 
 ```sh
 bun test packages/agentkit/src/runtime/channels/adapters.test.ts
+bun test packages/agentkit/src/runtime/transcription.test.ts
 bun test packages/agentkit/src/runtime/deploy.test.ts
 npm run typecheck
 ```
@@ -79,3 +108,6 @@ Redact it to a stable partial form such as `5511******9999`.
 
 Webhook accepts invalid signatures or origin headers:
 Fix `verifyWebhook` for the adapter before enabling provider setup docs.
+
+Raw audio or transcript provider secret appears in output:
+Stop and add a regression test before changing behavior. Delivery APIs may include transcript text in normalized agent messages after successful transcription, but must never include raw bytes or provider secret values.

package/docs/guides/connect-telegram.md

@@ -27,6 +27,12 @@ TELEGRAM_BOT_TOKEN
 TELEGRAM_WEBHOOK_SECRET
 ```
 
+If Telegram audio transcription is enabled, also set the transcription provider secret declared by `agentkit inspect`, usually:
+
+```txt
+GROQ_API_KEY
+```
+
 ## Files Created Or Edited
 
 - `agentkit.config.ts`: `telegramChannel({ name: "support-telegram" })`.
@@ -66,6 +72,52 @@ telegramChannel({
 })
 ```
 
+## Auto Transcribe Telegram Audio
+
+Telegram voice notes arrive as OGG/Opus. In V1, use Groq for the most obvious Telegram voice-note path because the AgentKit Groq adapter accepts `audio/ogg`.
+
+```ts
+import { defineAgent, telegramChannel } from "@andreprado/agentkit";
+
+export default defineAgent({
+  name: "support-agent",
+  runtime: "edge",
+  provider: { name: "openai", model: "gpt-5.4-mini" },
+  instructions: "./prompts/instructions.md",
+  transcription: {
+    provider: "groq",
+    model: "whisper-large-v3-turbo",
+    secret: "GROQ_API_KEY",
+    language: "pt",
+    limits: {
+      maxDurationSeconds: 180,
+      maxBytes: 20_000_000,
+    },
+  },
+  channels: [
+    telegramChannel({
+      name: "support-telegram",
+      audio: {
+        mode: "transcribe",
+      },
+    }),
+  ],
+  access: { mode: "public" },
+  storage: { driver: "agentkit" },
+});
+```
+
+Processing order:
+
+1. AgentKit validates `X-Telegram-Bot-Api-Secret-Token`.
+2. Telegram `voice` or `audio` payloads become normalized audio messages.
+3. AgentKit records `audio_received` and enqueues a channel job before acknowledging Telegram.
+4. The retryable channel worker calls Telegram `getFile`, downloads the file with `TELEGRAM_BOT_TOKEN`, and does not log the token.
+5. AgentKit sends the audio bytes to the configured transcription provider using the user's managed secret.
+6. The agent run receives a text message with the transcript.
+
+OpenAI transcription can be used for Telegram files that arrive as MP3, MP4, MPEG, MPGA, M4A, WAV, or WEBM. Telegram voice notes are usually OGG/Opus, so they should use Groq in V1 unless the provider payload is converted before it reaches AgentKit.
+
 ## Setup Behavior
 
 `agentkit channels setup support-telegram` is read-only and prints the webhook URL.
@@ -108,3 +160,9 @@ The incoming Telegram secret token does not match `TELEGRAM_WEBHOOK_SECRET`.
 
 `channel_payload_invalid`:
 The update is malformed or is not a supported private text message.
+
+`transcription_secret_missing`:
+Set `GROQ_API_KEY` or the custom secret named in `transcription.secret` as a managed hosted secret.
+
+`transcription_audio_format_unsupported`:
+The configured transcription provider does not accept the Telegram file format. Use Groq for OGG/Opus voice notes in V1.

package/docs/guides/connect-whatsapp-zapster.md

@@ -33,6 +33,18 @@ Optional hardening secret:
 ZAPSTER_WEBHOOK_TOKEN
 ```
 
+If WhatsApp audio transcription is enabled, also set the transcription provider secret declared by `agentkit inspect`, usually:
+
+```txt
+OPENAI_API_KEY
+```
+
+or:
+
+```txt
+GROQ_API_KEY
+```
+
 ## Files Created Or Edited
 
 - `agentkit.config.ts`: `whatsappChannel({ name: "support-whatsapp", provider: "zapster" })`.
@@ -73,6 +85,53 @@ whatsappChannel({
 })
 ```
 
+## Auto Transcribe WhatsApp Audio
+
+Use `transcription` at the agent level and `audio.mode: "transcribe"` on the Zapster channel.
+
+```ts
+import { defineAgent, whatsappChannel } from "@andreprado/agentkit";
+
+export default defineAgent({
+  name: "support-agent",
+  runtime: "edge",
+  provider: { name: "openai", model: "gpt-5.4-mini" },
+  instructions: "./prompts/instructions.md",
+  transcription: {
+    provider: "openai",
+    model: "gpt-4o-mini-transcribe",
+    secret: "OPENAI_API_KEY",
+    language: "pt",
+    limits: {
+      maxDurationSeconds: 180,
+      maxBytes: 20_000_000,
+    },
+  },
+  channels: [
+    whatsappChannel({
+      name: "support-whatsapp",
+      provider: "zapster",
+      audio: {
+        mode: "transcribe",
+      },
+    }),
+  ],
+  access: { mode: "public" },
+  storage: { driver: "agentkit" },
+});
+```
+
+Processing order:
+
+1. AgentKit validates Zapster origin headers and the optional webhook token.
+2. Zapster audio payloads become normalized audio messages.
+3. AgentKit records `audio_received` and enqueues a channel job before acknowledging Zapster.
+4. The retryable channel worker downloads the media URL from a trusted Zapster HTTPS host using `ZAPSTER_API_KEY`.
+5. AgentKit sends the audio bytes to the configured transcription provider using the user's managed secret.
+6. The agent run receives a text message with the transcript.
+
+Zapster payloads must include a media download URL such as `audio.downloadUrl`, `audio.url`, `audio.mediaUrl`, or the snake_case equivalents. The URL must be HTTPS and hosted by Zapster; AgentKit rejects arbitrary webhook-provided hosts before sending `ZAPSTER_API_KEY`. If Zapster sends only a media ID without a download URL, AgentKit records `channel_audio_download_unavailable` and does not create an agent run for that audio in V1.
+
 ## Setup Behavior
 
 `agentkit channels setup support-whatsapp` prints the stable AgentKit webhook URL. Paste it into Zapster webhook settings.
@@ -125,3 +184,9 @@ Zapster is not sending the expected instance/webhook IDs, or the optional query
 
 `channel_unsupported_message_type` or skipped delivery:
 The inbound WhatsApp event was not supported text. Inspect the delivery record for provider metadata.
+
+`channel_audio_download_unavailable`:
+Zapster sent an audio event without a usable media download URL, or the URL was not an HTTPS Zapster media host. Configure Zapster to include a trusted Zapster media URL in webhook payloads, or add a Zapster media lookup adapter before enabling `audio.mode: "transcribe"`.
+
+`transcription_secret_missing`:
+Set `OPENAI_API_KEY`, `GROQ_API_KEY`, or the custom secret named in `transcription.secret` as a managed hosted secret.

package/docs/guides/run-evals.md

@@ -52,72 +52,120 @@ Do not edit `.agentkit/agentkit.db` by hand.
 Generated smoke eval:
 
 ```ts
-export default {
+import { defineEval } from "@andreprado/agentkit";
+
+export default defineEval({
   name: "smoke",
   input: "Say hello in one short sentence.",
   expect: {
-    contains: "hello",
+    response: {
+      caseInsensitiveContains: "hello",
+      maxLength: 160,
+    },
   },
-};
+});
 ```
 
 Supported assertion types:
 
 ```txt
-contains
-not_contains
-regex
-matches_regex
-persisted_tool_call
+response.contains
+response.containsAll
+response.containsAny
+response.caseInsensitiveContains
+response.notContains
+response.regex
+response.matchesRegex
+response.notRegex
+response.maxLength
+tools.called
+tools.calledOnce
+tools.count
+tools.order
+tools.persisted
+```
+
+Older flat aliases still work, including `contains`, `not_contains`, `regex`, `matches_regex`, and `persisted_tool_call`.
+
+For date-sensitive evals, set top-level `now` to an ISO timestamp with an explicit timezone designator such as `Z` or `-05:00`. AgentKit uses that fixed clock for every turn and tool call in the eval:
+
+```ts
+export default defineEval({
+  name: "appointment relative date",
+  now: "2026-02-04T02:30:00.000Z",
+  input: "What is today's date?",
+  expect: {
+    response: {
+      containsAll: ["2026-02-03", "Tuesday"],
+    },
+  },
+});
 ```
 
 Multi-turn conversation evals use `turns`:
 
 ```ts
-export default {
+import { defineEval } from "@andreprado/agentkit";
+
+export default defineEval({
   name: "buyer under budget",
   turns: [
     {
       input: "I want a house up to 600k near Pinheiros.",
       expect: {
-        persisted_tool_call: {
-          name: "buscar_imoveis",
-          status: "completed",
-          input: { maxPrice: 600000 },
+        tools: {
+          calledOnce: "buscar_imoveis",
+          persisted: {
+            name: "buscar_imoveis",
+            status: "completed",
+            input: { maxPrice: 600000 },
+          },
         },
       },
     },
     {
       input: "Show me the best two.",
       expect: {
-        contains: ["Pinheiros", "R$"],
+        response: {
+          containsAll: ["Pinheiros", "R$"],
+        },
       },
     },
   ],
-};
+});
 ```
 
-`persisted_tool_call` validates the tool call saved in local SQLite `tool_calls`, not a provider-specific raw response shape. It can be a tool name string or an object with `name`, `input`, `output`, `rendered`, `status`, and/or `visibility`.
+`tools.persisted` validates the tool call saved in local SQLite `tool_calls`, not a provider-specific raw response shape. It can be a tool name string or an object with `name`, `input`, `output`, `rendered`, `status`, and/or `visibility`.
+
+Use `tools.count` for the exact number of persisted calls in that turn, `tools.calledOnce` for exactly one call by name, and `tools.order` for required relative order. `tools.order` allows extra calls before, between, or after the named calls; pair it with `tools.count` when the exact call set matters.
 
 Use response assertions and persisted tool assertions together when internal operational output must not leak:
 
 ```ts
-export default {
+import { defineEval } from "@andreprado/agentkit";
+
+export default defineEval({
   name: "triage lead",
   input: '{"tool":"triage_real_estate_lead","input":{"email":"ada@example.com"}}',
   expect: {
-    not_contains: ["hot", "score"],
-    persisted_tool_call: {
-      name: "triage_real_estate_lead",
-      status: "completed",
-      visibility: "internal",
-      output: { status: "hot" },
+    response: {
+      notContains: ["hot", "score"],
+      notRegex: ["API_KEY|secret|token"],
+    },
+    tools: {
+      calledOnce: "triage_real_estate_lead",
+      persisted: {
+        name: "triage_real_estate_lead",
+        status: "completed",
+        visibility: "internal",
+        output: { status: "hot" },
+      },
     },
   },
-};
+});
 ```
 
-`tool_call` remains accepted as a backwards-compatible alias, but new evals should use `persisted_tool_call`.
+`tool_call` and `persisted_tool_call` remain accepted as backwards-compatible aliases, but new evals should use `tools.persisted`.
 
 Safe external-tool pattern:
 

package/docs/llms-full.txt

@@ -96,7 +96,7 @@ Prefer `env set --stdin` or `--from-env` for local secret values, and prefer `se
 Planned commands described by the contract but not implemented yet:
 
 ```sh
-agentkit eval create-from-conversation <conversation-id>
+agentkit eval from-conversation <conversation-id>
 ```
 
 ## Create And Test A Capsule
@@ -166,6 +166,7 @@ export default defineAgent({
     name: "test",
     model: "fake",
   },
+  timeZone: "America/New_York",
   instructions: "./prompts/instructions.md",
   secrets: [],
   tools: [],
@@ -178,6 +179,8 @@ export default defineAgent({
 });
 ```
 
+`timeZone` is optional and must be an IANA time zone when set. AgentKit injects dynamic runtime context into every chat run: current ISO timestamp, local date, local weekday, local date/time, and timezone. Use `timeZone` for scheduling, appointments, reminders, deadlines, and any prompt behavior that interprets "today", "tomorrow", weekdays, or relative dates. Do not hardcode today's date in `prompts/instructions.md`. If `timeZone` is omitted, AgentKit falls back to `AGENTKIT_TIME_ZONE`, then valid `TZ`, then the runtime default timezone.
+
 Valid runtime values:
 
 ```txt
@@ -473,6 +476,7 @@ Tool runtime rules:
 - tools that need SQL use canonical `ctx.db`; `ctx.database` and `ctx.storage.sql` are supported aliases;
 - tools can use `ctx.db.batch([...])` for atomic writes; local tools can also use `ctx.db.transaction(async (tx) => ...)`;
 - tools can inspect `ctx.runtime` with `{ environment, invocation, target, database }`;
+- tools can use `ctx.clock` for the same runtime clock injected into the agent prompt, including `now`, `isoTimestamp`, `timeZone`, `localDate`, `localWeekday`, and `localDateTime`;
 - tools must not import local database drivers or Node-only APIs. Use AgentKit runtime services instead.
 
 ## Database Tools And Dual Storage
@@ -717,14 +721,25 @@ npm run eval
 Supported assertion types:
 
 ```txt
-contains
-not_contains
-regex
-matches_regex
-persisted_tool_call
-```
-
-`persisted_tool_call` validates the tool call saved in local SQLite `tool_calls`, not a provider-specific raw response shape. It can be a tool name string or an object with `name`, `input`, `output`, `status`, and/or `visibility`. `tool_call` remains accepted as a backwards-compatible alias.
+response.contains
+response.containsAll
+response.containsAny
+response.caseInsensitiveContains
+response.notContains
+response.regex
+response.matchesRegex
+response.notRegex
+response.maxLength
+tools.called
+tools.calledOnce
+tools.count
+tools.order
+tools.persisted
+```
+
+Import `defineEval` from `@andreprado/agentkit` when writing new evals. `tools.persisted` validates the tool call saved in local SQLite `tool_calls`, not a provider-specific raw response shape. It can be a tool name string or an object with `name`, `input`, `output`, `rendered`, `status`, and/or `visibility`. `tool_call` and `persisted_tool_call` remain accepted as backwards-compatible aliases, but new evals should use `tools.persisted`.
+
+For date-sensitive evals, set top-level `now` to an ISO timestamp with an explicit timezone designator such as `Z` or `-05:00`. AgentKit uses that fixed clock for every turn and tool call in the eval so "today", "tomorrow", and weekdays remain deterministic while normal chat continues to use the real current date.
 
 Evals run the normal capsule tools. If a tool would write externally, delete, charge money, send email, or call a real customer system, make its `execute` implementation branch on `ctx.runtime.environment === "eval"` and return deterministic non-destructive output for eval runs. Do not invent an eval-only mock API; keep the behavior inside the registered tool contract unless AgentKit adds a first-class mock facility later.
 

package/docs/llms.txt

@@ -71,6 +71,8 @@ UI testing is part of the handoff. For local UI testing, run `agentkit dev`, ope
 
 `test/fake` is deterministic and validates scaffold, direct tool calls, and fake-provider evals. It does not validate natural conversation quality. Before claiming real conversation behavior has been tested, ask the owner which provider to use: OpenRouter, OpenAI, Anthropic, or another supported provider. Do not choose for them.
 
+AgentKit injects the current ISO timestamp, local date, weekday, local date/time, and timezone dynamically into every chat run. Set `timeZone` in `agentkit.config.ts` for scheduling agents so "today", "tomorrow", and weekdays resolve in the business/user timezone; otherwise AgentKit falls back to `AGENTKIT_TIME_ZONE`, valid `TZ`, then the runtime default. Do not hardcode today's date in prompts.
+
 Current local endpoints from `agentkit dev`:
 
 ```txt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andreprado/agentkit",
-  "version": "0.1.0-alpha.14",
+  "version": "0.1.0-alpha.16",
   "private": false,
   "type": "module",
   "repository": {

package/src/cli/cloud-client.ts

@@ -39,12 +39,24 @@ export type CloudLimitsResponse = {
   };
 };
 
+export type CloudProjectResolveResponse = {
+  project?: {
+    id?: string;
+    name?: string;
+    owner_state?: "anonymous" | "claimed";
+  };
+};
+
 export type DeployAccessTokenCreateResponse = {
   access_token?: {
     id?: string;
     deploy_id?: string;
+    account_id?: string;
     name?: string;
     token?: string;
+    created_at?: string;
+    expires_at?: string;
+    last_used_at?: string;
   };
 };
 
@@ -52,7 +64,11 @@ export type DeployAccessTokenListResponse = {
   access_tokens?: Array<{
     id?: string;
     deploy_id?: string;
+    account_id?: string;
     name?: string;
+    created_at?: string;
+    expires_at?: string;
+    last_used_at?: string;
   }>;
 };
 
@@ -94,6 +110,16 @@ export async function readCloudAuth(): Promise<CloudAuthConfig | null> {
   return null;
 }
 
+export async function readCloudAuthForApiUrl(apiUrl: string): Promise<CloudAuthConfig | null> {
+  const auth = await readCloudAuth();
+
+  if (auth?.source === "file" && !cloudAuthMatchesApiUrl(auth, apiUrl)) {
+    return null;
+  }
+
+  return auth;
+}
+
 export async function writeCloudAuth(config: CloudAuthConfig): Promise<void> {
   await mkdir(join(homedir(), ".agentkit"), { recursive: true });
   await writeFile(cloudAuthPath(), `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
@@ -156,11 +182,8 @@ export async function cloudPost<T>(apiUrl: string, path: string, body: unknown):
 
 export async function cloudFetch(apiUrl: string, path: string, init: RequestInit = {}): Promise<Response> {
   const headers = new Headers(init.headers);
-  const auth = await readCloudAuth();
-  const apiToken =
-    auth?.source === "file" && !cloudAuthMatchesApiUrl(auth, apiUrl)
-      ? undefined
-      : auth?.token;
+  const auth = await readCloudAuthForApiUrl(apiUrl);
+  const apiToken = auth?.token;
 
   if (apiToken && !headers.has("Authorization")) {
     headers.set("Authorization", `Bearer ${apiToken}`);
@@ -177,12 +200,9 @@ function cloudAuthMatchesApiUrl(auth: CloudAuthConfig, apiUrl: string): boolean
 }
 
 export async function cloudApiRequest(apiUrl: string, path: string, init: RequestInit): Promise<unknown> {
-  const auth = await readCloudAuth();
+  const auth = await readCloudAuthForApiUrl(apiUrl);
   const headers = new Headers(init.headers);
-  const apiToken =
-    auth?.source === "file" && !cloudAuthMatchesApiUrl(auth, apiUrl)
-      ? undefined
-      : auth?.token;
+  const apiToken = auth?.token;
 
   if (!headers.has("Content-Type") && init.body !== undefined) {
     headers.set("Content-Type", "application/json");

package/src/cli/commands/channels.ts

@@ -20,6 +20,7 @@ type CloudChannel = {
   webhook_url: string;
   required_secrets: Array<{ name: string; status: string }>;
   buffer?: AgentChannel["buffer"];
+  audio?: AgentChannel["audio"];
 };
 
 type CloudDelivery = {
@@ -386,6 +387,7 @@ async function createHostedChannel(
     secrets: localChannel?.secrets ?? defaultChannelSecretsForCli(type, provider),
     ...(localChannel?.limits ? { limits: channelLimitsForApi(localChannel.limits) } : {}),
     ...(localChannel?.buffer ? { buffer: localChannel.buffer } : {}),
+    ...(localChannel?.audio ? { audio: localChannel.audio } : {}),
   };
 
   return cloudPost<{ channel: CloudChannel }>(