@andreprado/agentkit 0.1.0-alpha.9 → 0.1.1

package/src/cli/index.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
 
 import { createProject } from "../create-project";
@@ -21,7 +21,9 @@ import {
 import { runEvalsFromCwd, writeEvalFromConversation } from "../runtime/evals";
 import { findAgentKitDocs } from "../runtime/docs";
 import { listCapsuleEnv, setCapsuleEnv, unsetCapsuleEnv } from "../runtime/env";
+import { collectDeployImproveBundle, collectLocalImproveBundle, generateImproveEvals, replayImproveBundle } from "../runtime/improve";
 import { checkAgentSpec, initializeAgentSpec } from "../runtime/spec";
+import { checkDefaultSkillStatus, syncDefaultSkillFiles } from "../runtime/skills";
 import { initializeSyncScaffold, runCapsuleSync } from "../runtime/sync";
 import { runToolFromCwd } from "../runtime/tool-runner";
 import { startAgentDevServer } from "../runtime/dev-server";
@@ -29,6 +31,7 @@ import { inspectAgentCapsule } from "../runtime/inspect";
 import { AgentKitError, isAgentKitError } from "../runtime/errors";
 import { prepareVpsDeploy } from "../runtime/targets/vps/deploy";
 import { parseArgs, isHelpRequested, type ParsedArgs } from "./args";
+import { resolveNewProjectName } from "./new-command";
 import {
   defaultAgentKitDevPort,
   defaultDeployChatAccessTokenName,
@@ -38,16 +41,25 @@ import {
   clearCloudAuth,
   cloudApiRequest,
   readCloudAuth,
+  readCloudAuthForApiUrl,
   readCloudError,
   resolveCloudApiUrl,
   verifyCloudLogin,
   writeCloudAuth,
+  type AccountApiTokenCreateResponse,
+  type AccountApiTokenListResponse,
+  type BillingCheckoutIntentResponse,
+  type BillingCheckoutResponse,
+  type BillingClaimResponse,
+  type BillingPortalResponse,
   type CloudMeResponse,
   type DeployAccessTokenCreateResponse,
   type DeployAccessTokenListResponse,
 } from "./cloud-client";
 import {
   checkDeployReadiness,
+  formatDeployCloudAuthSummary,
+  formatDeployOnlineCapacity,
   formatReadinessError,
   printDeployReadinessReport,
   resolveProjectIdForSecretCommand,
@@ -64,8 +76,13 @@ import {
 } from "./flags";
 import { renderCommandHelp, renderCommandReference, renderHelp } from "./help";
 import { runInheritedCommand, waitForShutdown } from "./process";
+import { handleProviderCommand } from "./commands/provider";
 import { handleChannelsCommand } from "./commands/channels";
+import { handleFeedbackCommand } from "./commands/feedback";
 import { handleKnowledgeCommand } from "./commands/knowledge";
+import { handleTranscribeCommand } from "./commands/transcribe";
+
+const hostedDeployEntitlement = "agentkit_cloud_deploy";
 
 async function main() {
   const args = parseArgs(process.argv.slice(2));
@@ -96,15 +113,18 @@ async function main() {
     throw new Error("Usage: agentkit help [commands]");
   }
 
+  warnIfUnsupportedNode();
+
+  if (args.command === "provider") {
+    await handleProviderCommand(args);
+    return;
+  }
+
   if (args.command === "new") {
-    const [name] = args.positional;
+    const name = await resolveNewProjectName(args.positional);
     const template = String(args.flags.template ?? "blank");
     const shouldInstall = args.flags["no-install"] !== true;
 
-    if (!name) {
-      throw new Error("Missing project name. Usage: agentkit new <name> [--template blank|support|dentista] [--no-install]");
-    }
-
     const result = await createProject({ name, template, cwd: process.cwd() });
     console.log(`Created ${result.name} at ${result.path}`);
 
@@ -123,8 +143,8 @@ async function main() {
       console.log("  npm install");
     }
     console.log("  open this folder in Codex or Claude Code");
-    console.log("  coding agents start at skills/agentkit-capsule/SKILL.md");
-    console.log('  ask: "Develop an appointment and intake agent for an ophthalmology office"');
+    console.log('  ask Codex: "Develop an appointment and intake agent for an ophthalmology office"');
+    console.log("  Codex starts at skills/agentkit-capsule/SKILL.md and treats your request as the brief");
     console.log('  npm run chat -- --message "hello"');
     console.log("  npm run dev");
     console.log("  npm run agentkit -- deploy");
@@ -174,16 +194,25 @@ async function main() {
       throw new Error("Usage: agentkit chat-ui --deploy [--port <number>] [--token-file <path>]");
     }
 
-    const port = parsePort(args.flags.port, "agentkit chat-ui --deploy --port <number>") ?? 4124;
+    const requestedPort = parsePort(args.flags.port, "agentkit chat-ui --deploy --port <number>");
+    const port = requestedPort ?? 4124;
     const tokenFile = parseOptionalStringFlag(
       args.flags["token-file"],
       "token-file",
       "agentkit chat-ui --deploy --token-file <path>",
     );
-    const server = await startDeployChatUiServer(process.cwd(), { port, tokenFile });
+    const server = await startDeployChatUiServer(process.cwd(), {
+      port,
+      tokenFile,
+      autoPort: requestedPort === undefined,
+    });
 
     console.log("AgentKit hosted chat UI running");
     console.log("");
+    if (server.portConflict) {
+      console.log(`Port ${server.portConflict.port} is already used. Started hosted chat UI at ${server.url}.`);
+      console.log("");
+    }
     console.log(`Chat:       ${server.url}`);
     console.log(`Production: ${server.deployUrl}`);
     console.log(`Token:      ${server.tokenSource}`);
@@ -333,10 +362,132 @@ async function main() {
     return;
   }
 
+  if (args.command === "improve") {
+    const [subcommand, bundlePath] = args.positional;
+
+    if (subcommand === "collect") {
+      const since = parseOptionalStringFlag(args.flags.since, "since", 'agentkit improve collect --since "24h"');
+      const conversationId = parseOptionalStringFlag(
+        args.flags["conversation-id"] ?? args.flags.conversation,
+        "conversation id",
+        "agentkit improve collect --conversation-id <id>",
+      );
+      const out = parseOptionalStringFlag(args.flags.out, "out", "agentkit improve collect --out <directory>");
+      const deployState = args.flags.deploy === true ? await requireLocalDeployState() : null;
+      const apiUrl = args.flags.deploy === true ? await resolveCloudApiUrl(args.flags.api) : null;
+      const cloudAuth = apiUrl ? await readCloudAuthForApiUrl(apiUrl) : null;
+      const result = args.flags.deploy === true
+        ? await collectDeployImproveBundle(process.cwd(), {
+            deployId: deployState?.deploy_id ?? "",
+            since,
+            conversationId,
+            out,
+            collector: {
+              ...(cloudAuth && apiUrl && deployState
+                ? {
+                    exportEvidence: (input: { deployId: string; since?: string; conversationId?: string }) =>
+                      fetchDeployImproveEvidence(apiUrl, input),
+                  }
+                : {}),
+              listConversations: () => fetchDeployConversationJson(process.cwd(), "/v1/conversations"),
+              getTrace: (id: string) =>
+                fetchDeployConversationJson(process.cwd(), `/v1/conversations/${encodeURIComponent(id)}/trace`),
+            },
+          })
+        : await collectLocalImproveBundle(process.cwd(), {
+            since,
+            conversationId,
+            out,
+          });
+
+      console.log("Improve bundle collected");
+      console.log(`Source:    ${result.source}`);
+      console.log(`Directory: ${relativePath(result.root, result.directory)}`);
+      console.log(`Bundle:    ${relativePath(result.root, result.bundlePath)}`);
+      console.log(`Report:    ${relativePath(result.root, result.reportPath)}`);
+      console.log(`Traces:    ${result.traceCount}`);
+      console.log("");
+      console.log(`Next:      agentkit improve evals ${relativePath(result.root, result.directory)}`);
+      console.log(`Replay:    agentkit replay ${relativePath(result.root, result.directory)} --against local`);
+      return;
+    }
+
+    if (subcommand === "evals") {
+      if (!bundlePath) {
+        throw new Error("Missing bundle path. Usage: agentkit improve evals <bundle-dir-or-json> [--force]");
+      }
+
+      const result = await generateImproveEvals(process.cwd(), {
+        bundle: bundlePath,
+        force: args.flags.force === true,
+      });
+
+      console.log("Improve evals generated");
+      console.log(`Bundle: ${relativePath(result.root, result.bundlePath)}`);
+      console.log(`Files:  ${result.files.length}`);
+      for (const file of result.files) {
+        console.log(`  ${relativePath(result.root, file)}`);
+      }
+      if (result.skipped.length > 0) {
+        console.log(`Skipped: ${result.skipped.length}`);
+        for (const skipped of result.skipped) {
+          console.log(`  ${skipped.trace_id}: ${skipped.reason}`);
+        }
+      }
+      return;
+    }
+
+    throw new Error("Usage: agentkit improve collect [--deploy] [--since <duration|iso>] [--conversation-id <id>] [--out <directory>] | agentkit improve evals <bundle-dir-or-json> [--force]");
+  }
+
+  if (args.command === "replay") {
+    const [bundlePath] = args.positional;
+
+    if (!bundlePath) {
+      throw new Error("Missing bundle path. Usage: agentkit replay <bundle-dir-or-json> --against local");
+    }
+
+    const against = parseOptionalStringFlag(args.flags.against, "against", "agentkit replay <bundle> --against local") ?? "local";
+
+    if (against !== "local") {
+      throw new Error("Usage: agentkit replay <bundle-dir-or-json> --against local");
+    }
+
+    const result = await replayImproveBundle(process.cwd(), {
+      bundle: bundlePath,
+      against,
+    });
+
+    for (const item of result.results) {
+      console.log(`${item.status.toUpperCase()} ${item.conversation_id} (${item.turns} turns)`);
+      if (item.error) {
+        console.log(`  - ${item.error}`);
+      }
+    }
+
+    console.log("");
+    console.log(`Replay passed: ${result.passed}`);
+    console.log(`Replay failed: ${result.failed}`);
+    console.log(`Replay skipped: ${result.skipped}`);
+
+    if (result.failed > 0) {
+      process.exitCode = 1;
+    }
+
+    return;
+  }
+
   if (args.command === "conversations") {
     const [subcommand, conversationId] = args.positional;
+    const fromDeploy = args.flags.deploy === true;
 
     if (subcommand === "list") {
+      if (fromDeploy) {
+        const payload = await fetchDeployConversationJson(process.cwd(), "/v1/conversations");
+        printJson(payload);
+        return;
+      }
+
       const conversations = await listConversationsFromCwd(process.cwd());
 
       if (conversations.length === 0) {
@@ -362,7 +513,16 @@ async function main() {
 
     if (subcommand === "show") {
       if (!conversationId) {
-        throw new Error("Missing conversation id. Usage: agentkit conversations show <conversation-id>");
+        throw new Error("Missing conversation id. Usage: agentkit conversations show <conversation-id> [--deploy]");
+      }
+
+      if (fromDeploy) {
+        const payload = await fetchDeployConversationJson(
+          process.cwd(),
+          `/v1/conversations/${encodeURIComponent(conversationId)}`,
+        );
+        printJson(payload);
+        return;
       }
 
       const conversation = await getConversationFromCwd(process.cwd(), conversationId);
@@ -381,7 +541,16 @@ async function main() {
 
     if (subcommand === "trace") {
       if (!conversationId) {
-        throw new Error("Missing conversation id. Usage: agentkit conversations trace <conversation-id>");
+        throw new Error("Missing conversation id. Usage: agentkit conversations trace <conversation-id> [--deploy]");
+      }
+
+      if (fromDeploy) {
+        const trace = await fetchDeployConversationJson(
+          process.cwd(),
+          `/v1/conversations/${encodeURIComponent(conversationId)}/trace`,
+        );
+        printJson(trace);
+        return;
       }
 
       const trace = await getConversationTraceFromCwd(process.cwd(), conversationId);
@@ -389,7 +558,7 @@ async function main() {
       return;
     }
 
-    throw new Error("Usage: agentkit conversations list | agentkit conversations show <conversation-id> | agentkit conversations trace <conversation-id>");
+    throw new Error("Usage: agentkit conversations list [--deploy] | agentkit conversations show <conversation-id> [--deploy] | agentkit conversations trace <conversation-id> [--deploy]");
   }
 
   if (args.command === "knowledge") {
@@ -397,6 +566,11 @@ async function main() {
     return;
   }
 
+  if (args.command === "feedback") {
+    await handleFeedbackCommand(args);
+    return;
+  }
+
   if (args.command === "sync") {
     const [subcommand] = args.positional;
 
@@ -489,13 +663,15 @@ async function main() {
     const email = verified.me.account?.email;
     console.log(email ? `Logged in to AgentKit Cloud as ${email}.` : "AgentKit Cloud token verified and stored.");
 
-    const hasCloudflareAlpha = (verified.capabilities.capabilities ?? []).some(
-      (capability) => capability.name === "cloudflare_deploy_alpha" && capability.status === "active",
+    const hasHostedDeploy = (verified.capabilities.capabilities ?? []).some(
+      (capability) =>
+        (capability.name === "cloudflare_deploy_alpha" || capability.name === hostedDeployEntitlement) &&
+        capability.status === "active",
     );
     console.log(
-      hasCloudflareAlpha
-        ? "Entitlement: cloudflare_deploy_alpha active."
-        : "Warning: cloudflare_deploy_alpha entitlement was not found for this account.",
+      hasHostedDeploy
+        ? "Entitlement: hosted deploy active."
+        : `Warning: cloudflare_deploy_alpha or ${hostedDeployEntitlement} entitlement was not found for this account.`,
     );
 
     if (process.env.AGENTKIT_CLOUD_API_TOKEN && process.env.AGENTKIT_CLOUD_API_TOKEN !== token) {
@@ -511,6 +687,208 @@ async function main() {
     return;
   }
 
+  if (args.command === "account") {
+    const [noun, verb, value] = args.positional;
+
+    if (noun !== "token") {
+      throw new Error("Usage: agentkit account token create <name> [--use] [--out <path>] | list | revoke <token-id> [--api <url>]");
+    }
+
+    const apiUrl = await resolveCloudApiUrl(args.flags.api);
+
+    if (verb === "create" && value) {
+      const payload = (await cloudApiRequest(apiUrl, "/v1/account/tokens", {
+        method: "POST",
+        body: JSON.stringify({ name: value }),
+      })) as AccountApiTokenCreateResponse;
+      const token = payload.token;
+
+      if (!token?.token || !token.id) {
+        throw new AgentKitError("account_token_invalid", "AgentKit Cloud returned an invalid account token payload.");
+      }
+
+      const outPath = parseOptionalStringFlag(
+        args.flags.out,
+        "out",
+        "agentkit account token create <name> [--api <url>] [--use] [--out <path>]",
+      );
+
+      if (outPath) {
+        const absolutePath = resolve(process.cwd(), outPath);
+        await writeSecretJson(absolutePath, payload);
+        console.log(`Account token written to ${absolutePath}`);
+      } else {
+        printJson(payload);
+      }
+
+      if (args.flags.use === true) {
+        await writeCloudAuth({ apiUrl, token: token.token });
+        console.log(`Saved ${token.id} as the current AgentKit Cloud login.`);
+      }
+
+      return;
+    }
+
+    if (verb === "list" && !value) {
+      const payload = (await cloudApiRequest(apiUrl, "/v1/account/tokens", {
+        method: "GET",
+      })) as AccountApiTokenListResponse;
+      printJson(payload);
+      return;
+    }
+
+    if (verb === "revoke" && value) {
+      const payload = await cloudApiRequest(apiUrl, `/v1/account/tokens/${encodeURIComponent(value)}/revoke`, {
+        method: "POST",
+      });
+      printJson(payload);
+      return;
+    }
+
+    throw new Error("Usage: agentkit account token create <name> [--use] [--out <path>] | list | revoke <token-id> [--api <url>]");
+  }
+
+  if (args.command === "billing") {
+    const [subcommand, intentId] = args.positional;
+    const apiUrl = await resolveCloudApiUrl(args.flags.api);
+
+    if (subcommand === "checkout") {
+      const slots = parsePositiveIntegerFlag(
+        args.flags.slots,
+        "slots",
+        "agentkit billing checkout --slots <count> [--email <email>] [--api <url>]",
+      );
+      const email = parseOptionalStringFlag(
+        args.flags.email,
+        "email",
+        "agentkit billing checkout --slots <count> --email <email>",
+      );
+      const payload = (await cloudApiRequest(apiUrl, "/v1/billing/checkout", {
+        method: "POST",
+        body: JSON.stringify({
+          slots,
+          ...(email ? { email } : {}),
+        }),
+      })) as BillingCheckoutResponse;
+      const checkoutUrl = payload.checkout?.url;
+      const billingIntentId = payload.billing_intent?.id;
+      const secret = payload.billing_intent?.secret;
+
+      if (!checkoutUrl || !billingIntentId || !secret) {
+        throw new AgentKitError("billing_checkout_invalid", "AgentKit Cloud returned an invalid billing checkout payload.");
+      }
+
+      if (args.flags.json === true) {
+        printJson(payload);
+      } else {
+        console.log("AgentKit Cloud checkout");
+        console.log("");
+        console.log(`URL:    ${checkoutUrl}`);
+        console.log(`Intent: ${billingIntentId}`);
+        console.log(`Secret: ${secret}`);
+        console.log("");
+        console.log(`After payment: agentkit billing claim ${billingIntentId} --secret ${secret} --api ${apiUrl}`);
+      }
+
+      if (args.flags.open === true) {
+        await openLocalUrl(checkoutUrl);
+      }
+
+      return;
+    }
+
+    if (subcommand === "status" && intentId) {
+      const secret = parseRequiredStringFlag(
+        args.flags.secret,
+        "secret",
+        "agentkit billing status <billing-intent-id> --secret <secret> [--api <url>]",
+      );
+      const payload = (await cloudApiRequest(
+        apiUrl,
+        `/v1/billing/checkout-intents/${encodeURIComponent(intentId)}?secret=${encodeURIComponent(secret)}`,
+        { method: "GET" },
+      )) as BillingCheckoutIntentResponse;
+      printJson(payload);
+      return;
+    }
+
+    if (subcommand === "claim" && intentId) {
+      const secret = parseRequiredStringFlag(
+        args.flags.secret,
+        "secret",
+        "agentkit billing claim <billing-intent-id> --secret <secret> [--token-name <name>] [--api <url>]",
+      );
+      const tokenName = parseOptionalStringFlag(
+        args.flags["token-name"],
+        "token-name",
+        "agentkit billing claim <billing-intent-id> --secret <secret> --token-name <name>",
+      );
+      const payload = (await cloudApiRequest(apiUrl, `/v1/billing/checkout-intents/${encodeURIComponent(intentId)}/claim`, {
+        method: "POST",
+        body: JSON.stringify({
+          secret,
+          ...(tokenName ? { token_name: tokenName } : {}),
+        }),
+      })) as BillingClaimResponse;
+      const token = payload.token;
+
+      if (!token?.token || !token.id) {
+        throw new AgentKitError("billing_claim_invalid", "AgentKit Cloud returned an invalid billing claim payload.");
+      }
+
+      await writeCloudAuth({ apiUrl, token: token.token });
+
+      const outPath = parseOptionalStringFlag(
+        args.flags.out,
+        "out",
+        "agentkit billing claim <billing-intent-id> --secret <secret> [--out <path>]",
+      );
+
+      if (outPath) {
+        const absolutePath = resolve(process.cwd(), outPath);
+        await writeSecretJson(absolutePath, payload);
+        console.log(`Account token written to ${absolutePath}`);
+      } else if (args.flags.json === true) {
+        printJson(payload);
+      } else {
+        console.log("AgentKit Cloud account token claimed and saved.");
+        console.log(`Token: ${token.id}`);
+        console.log(`API:   ${apiUrl}`);
+      }
+
+      return;
+    }
+
+    if (subcommand === "portal") {
+      const payload = (await cloudApiRequest(apiUrl, "/v1/billing/portal", {
+        method: "POST",
+        body: JSON.stringify({}),
+      })) as BillingPortalResponse;
+      const portalUrl = payload.portal?.url;
+
+      if (!portalUrl) {
+        throw new AgentKitError("billing_portal_invalid", "AgentKit Cloud returned an invalid billing portal payload.");
+      }
+
+      if (args.flags.json === true) {
+        printJson(payload);
+      } else {
+        console.log("AgentKit Cloud billing portal");
+        console.log(`URL: ${portalUrl}`);
+      }
+
+      if (args.flags.open === true) {
+        await openLocalUrl(portalUrl);
+      }
+
+      return;
+    }
+
+    throw new Error(
+      "Usage: agentkit billing checkout --slots <count> [--email <email>] | status <intent-id> --secret <secret> | claim <intent-id> --secret <secret> | portal [--api <url>]",
+    );
+  }
+
   if (args.command === "deploy") {
     const [deploySubcommand] = args.positional;
 
@@ -519,7 +897,7 @@ async function main() {
         parseOptionalStringFlag(args.flags.message ?? args.flags.smoke, "message", 'agentkit deploy smoke --message "hello"') ??
         "hello";
       const state = await requireLocalDeployState();
-      const token = await readDeployAccessTokenForSmoke(process.cwd(), state);
+      const token = await readDeployAccessTokenForHostedRequest(process.cwd());
       await runDeploySmoke({
         deployUrl: requireDeployUrl(state),
         message,
@@ -574,14 +952,16 @@ async function main() {
       return;
     }
 
+    let readinessReport: Awaited<ReturnType<typeof checkDeployReadiness>> | null = null;
+
     if (!args.flags["dry-run"] && !args.flags["local-wrangler"]) {
-      const report = await checkDeployReadiness({
+      readinessReport = await checkDeployReadiness({
         apiUrl: await resolveCloudApiUrl(args.flags.api),
         requireLogin: !anonymous,
       });
 
-      if (!report.ok) {
-        printDeployReadinessReport(report);
+      if (!readinessReport.ok) {
+        printDeployReadinessReport(readinessReport);
         throw new AgentKitError(
           "deploy_readiness_failed",
           "Fix deploy readiness failures before running agentkit deploy.",
@@ -607,10 +987,10 @@ async function main() {
     }
 
     const apiUrl = await resolveCloudApiUrl(args.flags.api);
-    const auth = await readCloudAuth();
+    const auth = anonymous ? null : await readCloudAuthForApiUrl(apiUrl);
     const deploy = await deployBuildToAgentKitCloud(result, {
       apiUrl,
-      apiToken: auth?.token,
+      apiToken: anonymous ? null : auth?.token,
       anonymous: anonymous || !auth?.token,
     });
     const statePath = await writeLocalDeployState(result.root, deploy);
@@ -618,7 +998,7 @@ async function main() {
       apiUrl,
       root: result.root,
       deployId: deploy.deploy.id,
-      skip: anonymous || !auth?.token || deploy.deploy.access.mode === "public",
+      skip: anonymous || !auth?.token,
     });
 
     console.log("");
@@ -627,11 +1007,12 @@ async function main() {
     console.log(`Project:   ${deploy.project.id}`);
     console.log(`Deploy:    ${deploy.deploy.id}`);
     console.log(`State:     ${statePath}`);
+    printDeployCloudSummary(readinessReport);
 
     if (chatAccess?.status === "ready") {
       console.log(`Chat auth: ${relativePath(process.cwd(), chatAccess.path)}`);
     } else if (chatAccess?.status === "skipped") {
-      console.log("Chat auth: public or anonymous deploy; no local chat token was created.");
+      console.log("Chat auth: anonymous deploy; no local chat token was created.");
     } else if (chatAccess?.status === "failed") {
       console.log(`Chat auth: could not create local chat token. ${formatReadinessError(chatAccess.error)}`);
       console.log(`Run:       agentkit access token create ${defaultDeployChatAccessTokenName} --out ${defaultDeployChatAccessTokenPath}`);
@@ -654,13 +1035,21 @@ async function main() {
             : undefined,
       });
     }
+    printDeployProductionHandoff({
+      deployUrl: deploy.deploy.url,
+      statePath,
+      chatAccess,
+      databaseSchemaPath: result.tursoSchemaPath,
+      readinessReport,
+      smokeMessage,
+    });
     return;
   }
 
   if (args.command === "secret") {
     const [subcommand, name, ...valueParts] = args.positional;
-    const projectId = await resolveProjectIdForSecretCommand(process.cwd());
     const apiUrl = await resolveCloudApiUrl(args.flags.api);
+    const projectId = await resolveProjectIdForSecretCommand(process.cwd(), apiUrl);
 
     if (subcommand === "list") {
       const payload = await cloudApiRequest(apiUrl, `/v1/projects/${encodeURIComponent(projectId)}/secrets`, {
@@ -763,6 +1152,121 @@ async function main() {
     return;
   }
 
+  if (args.command === "transcribe") {
+    await handleTranscribeCommand(args);
+    return;
+  }
+
+  if (args.command === "skills") {
+    const [subcommand] = args.positional;
+    const root = await findAgentCapsuleRoot(process.cwd());
+
+    if (subcommand === "status") {
+      const status = await checkDefaultSkillStatus(root);
+      printSkillStatus(status);
+      if (status.status !== "current") {
+        process.exitCode = 1;
+      }
+      return;
+    }
+
+    if (subcommand === "sync") {
+      const result = await syncDefaultSkillFiles(root);
+      console.log(`Synced ${result.files.length} AgentKit skill files.`);
+      console.log("Status: current");
+      return;
+    }
+
+    throw new Error("Usage: agentkit skills status | agentkit skills sync");
+  }
+
+  if (args.command === "integrations") {
+    const [subcommand, provider] = args.positional;
+
+    if (provider !== undefined && provider !== "composio") {
+      throw new Error("Usage: agentkit integrations status | connect composio [--toolkit <slug>] [--callback-url <url>] [--api <url>]");
+    }
+
+    const state = await requireLocalDeployState();
+    const apiUrl = await resolveCloudApiUrl(args.flags.api);
+
+    if (subcommand === "status") {
+      const toolkit = parseOptionalStringFlag(
+        args.flags.toolkit,
+        "toolkit",
+        "agentkit integrations status --toolkit <slug>",
+      );
+      const payload = await cloudApiRequest(
+        apiUrl,
+        `/v1/deploys/${encodeURIComponent(state.deploy_id)}/integrations/composio/status${
+          toolkit ? `?toolkit=${encodeURIComponent(toolkit)}` : ""
+        }`,
+        { method: "GET" },
+      );
+      printJson(payload);
+      return;
+    }
+
+    if (subcommand === "connect" && provider === "composio") {
+      const toolkit = parseOptionalStringFlag(
+        args.flags.toolkit,
+        "toolkit",
+        "agentkit integrations connect composio --toolkit <slug>",
+      );
+      const callbackUrl = parseOptionalStringFlag(
+        args.flags["callback-url"],
+        "callback-url",
+        "agentkit integrations connect composio --callback-url <url>",
+      );
+      const payload = (await cloudApiRequest(
+        apiUrl,
+        `/v1/deploys/${encodeURIComponent(state.deploy_id)}/integrations/composio/connect-link`,
+        {
+          method: "POST",
+          body: JSON.stringify({
+            ...(toolkit ? { toolkit } : {}),
+            ...(callbackUrl ? { callback_url: callbackUrl } : {}),
+          }),
+        },
+      )) as {
+        connect_link?: {
+          toolkit?: string;
+          user_id?: string;
+          redirect_url?: string;
+          expires_at?: string;
+          connected_account_id?: string;
+          auth_config_source?: string;
+        };
+      };
+
+      const link = payload.connect_link;
+
+      if (!link?.redirect_url) {
+        throw new AgentKitError("integration_response_invalid", "AgentKit Cloud returned an invalid Composio connect-link payload.");
+      }
+
+      console.log("Composio connect link");
+      console.log(`Toolkit: ${link.toolkit ?? toolkit ?? "unknown"}`);
+      console.log(`User:    ${link.user_id ?? "unknown"}`);
+      if (link.auth_config_source) {
+        console.log(`Auth:    ${link.auth_config_source}`);
+      }
+      console.log(`URL:     ${link.redirect_url}`);
+
+      if (link.expires_at) {
+        console.log(`Expires: ${link.expires_at}`);
+      }
+
+      if (link.connected_account_id) {
+        console.log(`Account: ${link.connected_account_id}`);
+      }
+
+      return;
+    }
+
+    throw new Error("Usage: agentkit integrations status | connect composio [--toolkit <slug>] [--callback-url <url>] [--api <url>]");
+  }
+
   if (args.command === "env") {
     const [subcommand, name, ...valueParts] = args.positional;
     const root = await findAgentCapsuleRoot(process.cwd());
@@ -885,7 +1389,7 @@ Rules:
 - Edit the agent contract in agentkit.config.ts.
 - Add TypeScript tools under tools/.
 - Keep the first useful version runnable with test/fake unless the owner has already chosen a real provider.
-- Before testing real conversation behavior, ask the owner to choose OpenRouter, OpenAI, Anthropic, or another supported provider. Do not choose for them.
+- Before testing real conversation behavior, ask the owner to choose OpenRouter, OpenAI, Anthropic, OpenCode Zen, OpenCode Go, or another supported provider. Do not choose for them.
 - Keep local secrets in .env only.
 - Do not commit or print secret values.
 - Do not edit .agentkit/ directly.
@@ -925,6 +1429,103 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function warnIfUnsupportedNode(): void {
+  const major = majorNodeVersion(process.versions.node);
+
+  if (major !== null && major < 24) {
+    console.warn(
+      `Warning: @andreprado/agentkit requires Node >=24; current Node is ${process.versions.node}. Use Node 24+ before relying on local runtime or deploy commands.`,
+    );
+  }
+}
+
+function majorNodeVersion(version: string): number | null {
+  const [major] = version.split(".");
+  const parsed = Number(major);
+  return Number.isInteger(parsed) ? parsed : null;
+}
+
+function printDeployProductionHandoff(input: {
+  deployUrl: string;
+  statePath: string;
+  chatAccess: Awaited<ReturnType<typeof ensureDeployChatAccessToken>>;
+  databaseSchemaPath: string | null;
+  readinessReport: Awaited<ReturnType<typeof checkDeployReadiness>> | null;
+  smokeMessage?: string;
+}): void {
+  const context = input.readinessReport?.context;
+  const userSecrets = context?.userManagedSecrets ?? [];
+  const managedSecrets = context?.agentKitManagedSecrets ?? [];
+  const composio = context?.integrations.managedComposio;
+
+  console.log("");
+  console.log("Production handoff");
+  console.log(`URL:          ${input.deployUrl}`);
+  console.log(`UI:           npm run agentkit -- chat-ui --deploy`);
+  console.log(`State:        ${input.statePath}`);
+  console.log(
+    `Secrets:      ${
+      userSecrets.length > 0
+        ? `user-managed set (${userSecrets.join(", ")})`
+        : "no user-managed hosted secrets required"
+    }${managedSecrets.length > 0 ? `; AgentKit-managed: ${managedSecrets.join(", ")}` : ""}`,
+  );
+  console.log(
+    `Database:     ${
+      input.databaseSchemaPath
+        ? `AgentKit-managed; schema artifact ${input.databaseSchemaPath}`
+        : "AgentKit-managed; no application schema artifact"
+    }`,
+  );
+
+  if (composio?.enabled) {
+    console.log(`Integrations: managed Composio configured for ${composio.toolkits.join(", ")}`);
+    for (const toolkit of composio.toolkits) {
+      console.log(`Connect:      npm run agentkit -- integrations connect composio --toolkit ${toolkit}`);
+    }
+  } else {
+    console.log("Integrations: none configured");
+  }
+
+  if (input.smokeMessage) {
+    console.log(`Smoke:        verified with ${JSON.stringify(input.smokeMessage)}`);
+  } else {
+    console.log('Smoke:        not run; next check: npm run agentkit -- deploy smoke --message "hello"');
+  }
+
+  if (input.chatAccess.status === "ready") {
+    console.log(`Chat token:   ${relativePath(process.cwd(), input.chatAccess.path)}`);
+  } else if (input.chatAccess.status === "skipped") {
+    console.log("Chat token:   not created for anonymous deploy");
+  } else {
+    console.log(`Chat token:   failed; run npm run agentkit -- access token create ${defaultDeployChatAccessTokenName} --out ${defaultDeployChatAccessTokenPath}`);
+  }
+
+  const nextCommand = composio?.enabled && composio.toolkits.length > 0
+    ? `npm run agentkit -- integrations connect composio --toolkit ${composio.toolkits[0]}`
+    : "npm run agentkit -- chat-ui --deploy";
+  console.log(`Next:         ${nextCommand}`);
+}
+
+function printDeployCloudSummary(report: Awaited<ReturnType<typeof checkDeployReadiness>> | null): void {
+  if (!report) {
+    return;
+  }
+
+  const authSummary = formatDeployCloudAuthSummary(report);
+
+  if (authSummary) {
+    console.log(`Account:   ${authSummary.account}`);
+    console.log(`Auth:      ${authSummary.source}`);
+  }
+
+  const capacitySummary = formatDeployOnlineCapacity(report, "before deploy");
+
+  if (capacitySummary) {
+    console.log(`Capacity:  ${capacitySummary}`);
+  }
+}
+
 async function ensureDeployChatAccessToken(options: {
   apiUrl: string;
   root: string;
@@ -949,9 +1550,12 @@ async function ensureDeployChatAccessToken(options: {
         `/v1/deploys/${encodeURIComponent(options.deployId)}/access-tokens`,
         { method: "GET" },
       )) as DeployAccessTokenListResponse;
-      const stillExists = (listed.access_tokens ?? []).some((token) => token.id === existing.id);
+      const stillUsable = (listed.access_tokens ?? []).some(
+        (token) => token.id === existing.id && deployAccessTokenMetadataIsUsable(token),
+      );
 
-      if (stillExists) {
+      if (stillUsable) {
+        await chmod(path, 0o600);
         return { status: "ready", path, tokenId: existing.id, created: false };
       }
     }
@@ -977,6 +1581,15 @@ async function ensureDeployChatAccessToken(options: {
   }
 }
 
+function deployAccessTokenMetadataIsUsable(token: { expires_at?: string }): boolean {
+  if (!token.expires_at) {
+    return true;
+  }
+
+  const expiresAtMs = Date.parse(token.expires_at);
+  return Number.isFinite(expiresAtMs) && expiresAtMs > Date.now();
+}
+
 async function readDeployAccessTokenFile(path: string): Promise<{ id?: string; deploy_id?: string } | null> {
   try {
     const parsed = JSON.parse(await readFile(path, "utf8")) as DeployAccessTokenCreateResponse;
@@ -989,6 +1602,7 @@ async function readDeployAccessTokenFile(path: string): Promise<{ id?: string; d
 async function writeSecretJson(path: string, value: unknown): Promise<void> {
   await mkdir(dirname(path), { recursive: true });
   await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  await chmod(path, 0o600);
 }
 
 async function requireLocalDeployState(): Promise<LocalDeployState> {
@@ -1009,11 +1623,7 @@ function requireDeployUrl(state: Pick<LocalDeployState, "deploy_id" | "url">): s
   return state.url;
 }
 
-async function readDeployAccessTokenForSmoke(cwd: string, state: LocalDeployState): Promise<string | undefined> {
-  if (state.access?.mode === "public") {
-    return undefined;
-  }
-
+async function readDeployAccessTokenForHostedRequest(cwd: string): Promise<string> {
   const root = await findAgentCapsuleRoot(cwd);
   return readDeployAccessTokenForUi(join(root, defaultDeployChatAccessTokenPath));
 }
@@ -1060,10 +1670,90 @@ async function runDeploySmoke(input: { deployUrl: string; message: string; token
   }
 }
 
+async function fetchDeployConversationJson(cwd: string, path: string): Promise<unknown> {
+  const state = await requireLocalDeployState();
+  const deployUrl = requireDeployUrl(state);
+  const token = await readDeployAccessTokenForHostedRequest(cwd);
+  const headers = new Headers();
+
+  headers.set("Authorization", `Bearer ${token}`);
+
+  let response: Response;
+
+  try {
+    response = await fetch(new URL(path, deployUrl).href, {
+      method: "GET",
+      headers,
+    });
+  } catch (error) {
+    throw new AgentKitError(
+      "deploy_conversation_request_failed",
+      `Could not read hosted conversation data: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+
+  const payload = await response.json().catch(() => null);
+
+  if (!response.ok) {
+    throw new AgentKitError("deploy_conversation_request_failed", readCloudError(payload, response.status));
+  }
+
+  return payload;
+}
+
+async function fetchDeployImproveEvidence(
+  apiUrl: string,
+  input: { deployId: string; since?: string; conversationId?: string },
+): Promise<unknown | null> {
+  try {
+    return await cloudApiRequest(apiUrl, `/v1/deploys/${encodeURIComponent(input.deployId)}/improve/export`, {
+      method: "POST",
+      body: JSON.stringify({
+        status: "all",
+        ...(input.since ? { since: input.since } : {}),
+        ...(input.conversationId ? { conversation_id: input.conversationId } : {}),
+      }),
+    });
+  } catch (error) {
+    if (
+      isAgentKitError(error) &&
+      (error.code === "improve_evidence_store_not_configured" || error.code === "not_found")
+    ) {
+      return null;
+    }
+
+    throw error;
+  }
+}
+
 function printJson(value: unknown): void {
   console.log(JSON.stringify(value, null, 2));
 }
 
+function printSkillStatus(status: Awaited<ReturnType<typeof checkDefaultSkillStatus>>): void {
+  console.log("AgentKit skills");
+  console.log(`Status: ${status.status}`);
+  console.log(`Checked: ${status.checked}`);
+
+  if (status.missing.length > 0) {
+    console.log(`Missing: ${status.missing.length}`);
+    for (const file of status.missing.slice(0, 10)) {
+      console.log(`  ${file}`);
+    }
+  }
+
+  if (status.outdated.length > 0) {
+    console.log(`Outdated: ${status.outdated.length}`);
+    for (const file of status.outdated.slice(0, 10)) {
+      console.log(`  ${file}`);
+    }
+  }
+
+  if (status.status !== "current") {
+    console.log("Run: npm run agentkit -- skills sync");
+  }
+}
+
 async function printJsonOrWrite(value: unknown, outFlag: string | boolean | undefined, usage: string): Promise<void> {
   const outPath = parseOptionalStringFlag(outFlag, "out", usage);
 
@@ -1077,6 +1767,20 @@ async function printJsonOrWrite(value: unknown, outFlag: string | boolean | unde
   console.log(`Deploy access token written to ${absolutePath}`);
 }
 
+function parsePositiveIntegerFlag(value: string | boolean | undefined, name: string, usage: string): number {
+  if (typeof value !== "string") {
+    throw new Error(`Missing ${name}. Usage: ${usage}`);
+  }
+
+  const parsed = Number(value);
+
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`Invalid ${name}. Usage: ${usage}`);
+  }
+
+  return parsed;
+}
+
 function relativePath(root: string, path: string): string {
   const output = relative(root, path);
   return output.startsWith("..") ? path : output || ".";
@@ -1272,5 +1976,6 @@ main().catch((error: unknown) => {
   const message = error instanceof Error ? error.message : String(error);
   const prefix = isAgentKitError(error) ? `agentkit ${error.code}` : "agentkit";
   console.error(`${prefix}: ${message}`);
+  console.error("Feedback draft: agentkit feedback create --about last-run --kind bug --summary <text>");
   process.exitCode = 1;
 });