@ora-ai/cli 0.1.0 → 0.2.0

package/README.md

@@ -36,6 +36,81 @@ key is stored at `~/.config/ora/config.json` (0600) and exchanged for a
 short-lived token on every call — the key itself never travels beyond the
 token exchange.
 
+### Point the CLI at an environment (`--api-url`)
+
+By default the CLI talks to the URL embedded in its spec
+(`https://api.agentfront.sh`). To target staging, a dev cluster, or any
+self-hosted ora, set the API base **once at login** — it's remembered in
+`~/.config/ora/config.json`:
+
+    ora login --api-url https://api.staging.agentfront.sh   # staging
+    ora login --api-url http://api.localhost:8081           # local k3d dev
+
+Precedence for every command: `--api-url` flag > `ORA_API_URL` env >
+`config.json` > the spec's default. So one-off calls can override without
+re-logging-in:
+
+    ora tunnels list --api-url https://api.staging.agentfront.sh
+    ORA_API_URL=https://api.staging.agentfront.sh ora whoami
+
+## Tunnels — expose your localhost to ora (like `ngrok http`)
+
+Let ora's scans and journeys reach a dev site running on your machine.
+One command, prints a working URL, forwards until Ctrl-C:
+
+    ora tunnel 3000
+
+    🚇 ora tunnel — dev-3000
+    forwards   localhost:3000 → 924649e0…
+    url        https://924649e0-….t.agentfront.sh/?ora_token=ora_tt_…
+               only holders of this link reach it — paste it as a journey targetDomain
+    ● connected — Ctrl-C to stop
+    200 GET    / 8ms
+
+The port is chosen here, at connect time — the server can only ask your
+connected CLI to fetch; it never reaches into your machine. Re-running
+`ora tunnel 3000` reuses the same tunnel (and URL): the per-tunnel secret is
+remembered in `~/.config/ora/tunnel-secrets.json` (0600), like ngrok's
+authtoken.
+
+### Access modes (`--access`)
+
+    ora tunnel 3000                       # protected (default): the printed
+                                          # link works; strangers get 404
+    ora tunnel 3000 --access public       # open URL — answer engines can
+                                          # browse/index the dev site
+    ora tunnel 3000 --access private      # no URL; only ora's own scanners
+
+| mode | who reaches `https://<id>.t.<domain>` | use it for |
+|---|---|---|
+| `protected` | holders of the printed link (`?ora_token=…` or an `X-Ora-Tunnel-Token` header) | journeys, sharing with a teammate |
+| `public` | anyone — no credential | letting real answer engines measure the dev site |
+| `private` | nobody — 404; only ora's in-cluster scanners via `tunnel://<id>/` | scan-only workflows |
+
+Everything else answers 404 identically (a private tunnel is
+indistinguishable from a nonexistent one), revoked answers 410, and a tunnel
+whose CLI isn't currently connected answers 502 `TUNNEL_NOT_CONNECTED`.
+
+### Point a run at your tunnel
+
+- **Journey**: create the tunnel `--access public`, then use the hostname as
+  the journey's `targetDomain` — e.g. `924649e0-….t.agentfront.sh`. The
+  agent browses it like any site.
+- **Scan**: `{ "url": "tunnel://<tunnelId>/", "url_kind": "tunnel" }` — works
+  for any access mode, including `private`.
+
+### Manage tunnels
+
+    ora tunnels list             # status-glyph table (● connected ✖ revoked …)
+    ora tunnels get <id>
+    ora tunnels revoke <id>      # kill the live connection, keep the row
+    ora tunnels delete <id>      # revoke + remove the row entirely
+
+Quick local target to test with:
+
+    node -e 'require("http").createServer((q,r)=>{r.writeHead(200,{"content-type":"text/html"});r.end("<h1>it works</h1>")}).listen(3000)'
+    ora tunnel 3000    # then open the printed url
+
 ## Use
 
 Every command's `--help` ends with a ready-to-run example (including a request

package/dist/generated/operations.d.ts

@@ -15,6 +15,7 @@ export interface BodyFieldMeta {
     required: boolean;
     kind: "string" | "number" | "boolean" | "object" | "array";
     enum?: string[];
+    description?: string;
     placeholder: string;
 }
 export interface OperationMeta {
@@ -39,7 +40,7 @@ export interface OperationMeta {
 }
 export declare const SPEC: {
     readonly version: "1.0.0";
-    readonly contentHash: "d1aeca5bf5255cdfbdf7836aace5a10fc4242ce23a30dd16761092e8383291b0";
+    readonly contentHash: "65bdf7f72ee8c25653714f60593e05cbeccce8c16fb39785e985383be0f6ad72";
     readonly server: "https://api.agentfront.sh";
     readonly bin: "ora";
 };

package/dist/generated/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/generated/operations.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX,eAAO,MAAM,UAAU,EAAE,aAAa,EAu/DrC,CAAC"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/generated/operations.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX,eAAO,MAAM,UAAU,EAAE,aAAa,EAk9ErC,CAAC"}

package/dist/generated/operations.js

@@ -1,9 +1,9 @@
 // GENERATED by scripts/generate.mjs — DO NOT EDIT.
-// Source: openapi/ora-public.openapi.json (sha256 d1aeca5bf5255cdfbdf7836aace5a10fc4242ce23a30dd16761092e8383291b0)
+// Source: openapi/ora-public.openapi.json (sha256 65bdf7f72ee8c25653714f60593e05cbeccce8c16fb39785e985383be0f6ad72)
 // Regenerate: yarn nx run ora-cli:generate
 export const SPEC = {
     "version": "1.0.0",
-    "contentHash": "d1aeca5bf5255cdfbdf7836aace5a10fc4242ce23a30dd16761092e8383291b0",
+    "contentHash": "65bdf7f72ee8c25653714f60593e05cbeccce8c16fb39785e985383be0f6ad72",
     "server": "https://api.agentfront.sh",
     "bin": "ora"
 };
@@ -210,6 +210,394 @@ export const OPERATIONS = [
             "command": "ora analytics overview"
         }
     },
+    {
+        "id": "benchmarks.create",
+        "commandPath": [
+            "benchmarks",
+            "create"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/benchmarks",
+        "summary": "Create a benchmark and start async task generation (poll get until status 'ready', then launch)",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [],
+        "queryParams": [],
+        "hasBody": true,
+        "bodyRequired": true,
+        "isStream": false,
+        "bodyFields": [
+            {
+                "name": "name",
+                "required": true,
+                "kind": "string",
+                "description": "Display name for the benchmark (≤160 chars).",
+                "placeholder": "tavily-search A/B"
+            },
+            {
+                "name": "description",
+                "required": false,
+                "kind": "string",
+                "description": "Optional longer description shown on the benchmark card.",
+                "placeholder": "<description>"
+            },
+            {
+                "name": "subjectKind",
+                "required": false,
+                "kind": "string",
+                "enum": [
+                    "skill",
+                    "tools",
+                    "addon",
+                    "custom"
+                ],
+                "description": "What the benchmark measures — defaults to 'skill'. See the enum description for each kind's rules.",
+                "placeholder": "addon"
+            },
+            {
+                "name": "skillRef",
+                "required": false,
+                "kind": "string",
+                "description": "The skill under test as '<source>:<id>' — sources: 'custom' (an org-authored skill, id from the skills API), 'builtin' (a starter example), 'git' (a git-imported skill). E.g. 'custom:8c1d…'. REQUIRED iff subjectKind 'skill'; forbidden otherwise.",
+                "placeholder": "<skillRef>"
+            },
+            {
+                "name": "subjectName",
+                "required": false,
+                "kind": "string",
+                "description": "Display name of a NON-skill subject (e.g. 'Tavily search', 'monday.com remote MCP'). Required iff subjectKind ≠ 'skill'; forbidden for 'skill' (the skill's own name is used).",
+                "placeholder": "Tavily search"
+            },
+            {
+                "name": "armConfig",
+                "required": false,
+                "kind": "object",
+                "description": "Frozen per-arm run-payload deltas. Required for subjectKind 'custom' and comparisonMode 'ab_custom'; for 'tools'/'addon' subjects the treatment side is derived when omitted.",
+                "placeholder": "{\"treatment\":{\"addons\":{\"tavily\":{\"secretId\":\"<org-secret-uuid>\"}}}}"
+            },
+            {
+                "name": "comparisonMode",
+                "required": false,
+                "kind": "string",
+                "enum": [
+                    "ab_vs_none",
+                    "ab_custom",
+                    "single"
+                ],
+                "description": "The baseline design — defaults to 'ab_vs_none'. See the enum description for each mode.",
+                "placeholder": "ab_vs_none"
+            },
+            {
+                "name": "baselineLabel",
+                "required": false,
+                "kind": "string",
+                "description": "Baseline arm's display label (e.g. 'REST API'). Required iff comparisonMode 'ab_custom'; forbidden otherwise.",
+                "placeholder": "<baselineLabel>"
+            },
+            {
+                "name": "treatmentLabel",
+                "required": false,
+                "kind": "string",
+                "description": "Treatment arm's display label (e.g. 'Remote MCP'). Required iff comparisonMode 'ab_custom'; forbidden otherwise.",
+                "placeholder": "<treatmentLabel>"
+            },
+            {
+                "name": "taskCount",
+                "required": false,
+                "kind": "number",
+                "description": "How many tasks to auto-generate (1–50, default 5). Runs launched = taskCount × matrix cells × arms (2 arms unless 'single').",
+                "placeholder": "5"
+            },
+            {
+                "name": "matrix",
+                "required": true,
+                "kind": "array",
+                "description": "The (harness, model) cells to fan out over — 1 to 12 cells.",
+                "placeholder": "[{\"harness\":\"claude-code\",\"model\":\"claude-sonnet-5\"},{\"harness\":\"codex\",\"model\":\"gpt-5.5\"}]"
+            },
+            {
+                "name": "promise",
+                "required": false,
+                "kind": "string",
+                "description": "The claim under test, driving task generation and the pre-registered rubrics (e.g. 'Tavily search finds fresher, better-sourced answers than no web access'). Optional for subjectKind 'skill' (omitted → extracted from the skill body); REQUIRED for every other kind.",
+                "placeholder": "Web search via Tavily produces fresher, better-sourced answers than no web access"
+            }
+        ],
+        "watchable": true,
+        "help": {
+            "command": "ora benchmarks create --file run.json --watch",
+            "body": "{\n  \"name\": \"tavily-search A/B\",\n  \"subjectKind\": \"addon\",\n  \"subjectName\": \"Tavily search\",\n  \"promise\": \"Web search via Tavily produces fresher, better-sourced answers than no web access\",\n  \"armConfig\": {\n    \"treatment\": {\n      \"addons\": {\n        \"tavily\": {\n          \"secretId\": \"<org-secret-uuid>\"\n        }\n      }\n    }\n  },\n  \"taskCount\": 5,\n  \"matrix\": [\n    {\n      \"harness\": \"claude-code\",\n      \"model\": \"claude-sonnet-5\"\n    },\n    {\n      \"harness\": \"codex\",\n      \"model\": \"gpt-5.5\"\n    }\n  ]\n}"
+        }
+    },
+    {
+        "id": "benchmarks.delete",
+        "commandPath": [
+            "benchmarks",
+            "delete"
+        ],
+        "method": "delete",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}",
+        "summary": "Delete a benchmark and its tasks/facts (409 while running)",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks delete <id>"
+        }
+    },
+    {
+        "id": "benchmarks.generate",
+        "commandPath": [
+            "benchmarks",
+            "generate"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/generate",
+        "summary": "Regenerate the task corpus (status ready/failed only — wipes existing tasks and their rubrics)",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": true,
+        "help": {
+            "command": "ora benchmarks generate <id> --watch"
+        }
+    },
+    {
+        "id": "benchmarks.get",
+        "commandPath": [
+            "benchmarks",
+            "get"
+        ],
+        "method": "get",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}",
+        "summary": "Benchmark detail: status to poll, tasks + rubrics, per-run facts, live aggregate + verdict",
+        "scope": "benchmarks:read",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks get 1f7e4d1c-4b2a-4f3e-9d8c-5a6b7c8d9e0f"
+        }
+    },
+    {
+        "id": "benchmarks.launch",
+        "commandPath": [
+            "benchmarks",
+            "launch"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/launch",
+        "summary": "Launch: fan out task × matrix-cell × arm runs (async — poll get until status 'completed')",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": true,
+        "help": {
+            "command": "ora benchmarks launch <id> --watch"
+        }
+    },
+    {
+        "id": "benchmarks.list",
+        "commandPath": [
+            "benchmarks",
+            "list"
+        ],
+        "method": "get",
+        "pathTemplate": "/experiment/v1/benchmarks",
+        "summary": "List the org's benchmarks (id, status, verdict, subject)",
+        "scope": "benchmarks:read",
+        "product": "experiment",
+        "pathParams": [],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks list"
+        }
+    },
+    {
+        "id": "benchmarks.publish",
+        "commandPath": [
+            "benchmarks",
+            "publish"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/publish",
+        "summary": "Publish a completed benchmark to the anonymous public catalog (idempotent slug upsert)",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": true,
+        "bodyRequired": true,
+        "isStream": false,
+        "bodyFields": [
+            {
+                "name": "slug",
+                "required": false,
+                "kind": "string",
+                "description": "Public catalog URL slug (lowercase [a-z0-9-], ≤80). Omitted → the benchmark's own generated slug. 409 benchmark_slug_taken if another published benchmark holds it.",
+                "placeholder": "tavily-search-ab"
+            }
+        ],
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks publish 1f7e4d1c-4b2a-4f3e-9d8c-5a6b7c8d9e0f --file run.json",
+            "body": "{\n  \"slug\": \"tavily-search-ab\"\n}"
+        }
+    },
+    {
+        "id": "benchmarks.regrade",
+        "commandPath": [
+            "benchmarks",
+            "regrade"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/regrade",
+        "summary": "Clear and re-run judge-panel grading (rubrics + blind pairwise) for a completed benchmark",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": true,
+        "help": {
+            "command": "ora benchmarks regrade <id> --watch"
+        }
+    },
+    {
+        "id": "benchmarks.stream",
+        "commandPath": [
+            "benchmarks",
+            "stream"
+        ],
+        "method": "get",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/stream",
+        "summary": "Live SSE stream: status transitions, per-run facts, grading, publish state (terminal status closes it)",
+        "scope": "benchmarks:read",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": true,
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks stream 1f7e4d1c-4b2a-4f3e-9d8c-5a6b7c8d9e0f"
+        }
+    },
+    {
+        "id": "benchmarks.unpublish",
+        "commandPath": [
+            "benchmarks",
+            "unpublish"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/unpublish",
+        "summary": "Remove a benchmark from the public catalog (data kept; re-publish any time)",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks unpublish <id>"
+        }
+    },
+    {
+        "id": "benchmarks.updateTask",
+        "commandPath": [
+            "benchmarks",
+            "update-task"
+        ],
+        "method": "put",
+        "pathTemplate": "/experiment/v1/benchmarks/{id}/tasks/{taskId}",
+        "summary": "Edit a generated task's prompt before launch (status 'ready' only)",
+        "scope": "benchmarks:write",
+        "product": "experiment",
+        "pathParams": [
+            {
+                "name": "id"
+            },
+            {
+                "name": "taskId"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": true,
+        "bodyRequired": true,
+        "isStream": false,
+        "bodyFields": [
+            {
+                "name": "prompt",
+                "required": true,
+                "kind": "string",
+                "description": "The replacement task prompt, dispatched verbatim as each run's intent. Editable only while the benchmark is 'ready' (pre-launch).",
+                "placeholder": "Research the three largest EU battery-storage tenders announced this quarter and cite each source."
+            }
+        ],
+        "watchable": false,
+        "help": {
+            "command": "ora benchmarks update-task 1f7e4d1c-4b2a-4f3e-9d8c-5a6b7c8d9e0f 8a9b0c1d-2e3f-4a5b-8c7d-6e5f4a3b2c1d --file run.json",
+            "body": "{\n  \"prompt\": \"Research the three largest EU battery-storage tenders announced this quarter and cite each source.\"\n}"
+        }
+    },
     {
         "id": "domains.add",
         "commandPath": [
@@ -587,6 +975,93 @@ export const OPERATIONS = [
             "command": "ora experiment runs trajectory <id>"
         }
     },
+    {
+        "id": "experiment.secrets.create",
+        "commandPath": [
+            "experiment",
+            "secrets",
+            "create"
+        ],
+        "method": "post",
+        "pathTemplate": "/experiment/v1/secrets",
+        "summary": "Create an org secret (encrypted at rest; the value is never readable back through this surface)",
+        "scope": "secrets:write",
+        "product": "platform",
+        "pathParams": [],
+        "queryParams": [],
+        "hasBody": true,
+        "bodyRequired": true,
+        "isStream": false,
+        "bodyFields": [
+            {
+                "name": "name",
+                "required": true,
+                "kind": "string",
+                "description": "Secret name (letters, numbers, '.', '_', '-') — how add-on configs and env bindings will refer to it in the UI; the wire references use the returned id.",
+                "placeholder": "MONDAY_API_KEY"
+            },
+            {
+                "name": "value",
+                "required": true,
+                "kind": "string",
+                "description": "The secret value (an API token, key, …). Encrypted at rest; NEVER echoed back by any read this surface offers — reads return metadata only.",
+                "placeholder": "<the token — never logged, never echoed>"
+            }
+        ],
+        "watchable": false,
+        "help": {
+            "command": "ora experiment secrets create --file run.json",
+            "body": "{\n  \"name\": \"MONDAY_API_KEY\",\n  \"value\": \"<the token — never logged, never echoed>\"\n}"
+        }
+    },
+    {
+        "id": "experiment.secrets.delete",
+        "commandPath": [
+            "experiment",
+            "secrets",
+            "delete"
+        ],
+        "method": "delete",
+        "pathTemplate": "/experiment/v1/secrets/{id}",
+        "summary": "Delete an org secret (runs already launched keep nothing; future boot-fetches fail closed)",
+        "scope": "secrets:write",
+        "product": "platform",
+        "pathParams": [
+            {
+                "name": "id"
+            }
+        ],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": false,
+        "help": {
+            "command": "ora experiment secrets delete <id>"
+        }
+    },
+    {
+        "id": "experiment.secrets.list",
+        "commandPath": [
+            "experiment",
+            "secrets",
+            "list"
+        ],
+        "method": "get",
+        "pathTemplate": "/experiment/v1/secrets",
+        "summary": "List the org's secrets (metadata only — ids for armConfig/envBindings references)",
+        "scope": "secrets:read",
+        "product": "platform",
+        "pathParams": [],
+        "queryParams": [],
+        "hasBody": false,
+        "bodyRequired": false,
+        "isStream": false,
+        "watchable": false,
+        "help": {
+            "command": "ora experiment secrets list"
+        }
+    },
     {
         "id": "intents.addPrompt",
         "commandPath": [