@orchagent/cli 0.2.21 → 0.2.22

package/dist/commands/publish.js

@@ -69,10 +69,15 @@ function registerPublishCommand(program) {
         .option('--private', 'Make agent private (deprecated: now the default)')
         .option('--profile <name>', 'Use API key from named profile')
         .option('--dry-run', 'Show what would be published without making changes')
+        .option('--skills <skills>', 'Default skills (comma-separated, e.g., org/skill@v1,org/other@v1)')
+        .option('--skills-locked', 'Lock default skills (callers cannot override via headers)')
         .action(async (options) => {
         if (options.private) {
             process.stderr.write('Warning: --private is deprecated (private is now the default). You can safely remove it.\n');
         }
+        const skillsFromFlag = options.skills
+            ? options.skills.split(',').map(s => s.trim()).filter(Boolean)
+            : undefined;
         const config = await (0, config_1.getResolvedConfig)({}, options.profile);
         const cwd = process.cwd();
         // Check for SKILL.md first (skills take precedence)
@@ -111,6 +116,8 @@ function registerPublishCommand(program) {
                 prompt: skillData.body,
                 is_public: options.public ? true : false,
                 supported_providers: ['any'],
+                default_skills: skillsFromFlag,
+                skills_locked: options.skillsLocked || undefined,
             });
             const skillVersion = skillResult.agent?.version || 'v1';
             await (0, analytics_1.track)('cli_publish', { agent_type: 'skill' });
@@ -261,6 +268,14 @@ function registerPublishCommand(program) {
             process.stderr.write(`  Version:     ${versionInfo}\n`);
             process.stderr.write(`  Visibility:  ${options.public ? 'public' : 'private'}\n`);
             process.stderr.write(`  Providers:   ${supportedProviders.join(', ')}\n`);
+            const effectiveSkills = skillsFromFlag || manifest.default_skills;
+            const effectiveLocked = manifest.skills_locked || options.skillsLocked;
+            if (effectiveLocked) {
+                process.stderr.write(`  Skills:      ${effectiveSkills?.join(', ') || '(none)'} [LOCKED]\n`);
+            }
+            else if (effectiveSkills?.length) {
+                process.stderr.write(`  Skills:      ${effectiveSkills.join(', ')}\n`);
+            }
             process.stderr.write(`\nWould publish: ${preview.org_slug}/${manifest.name}@${preview.next_version}\n`);
             if (shouldUploadBundle) {
                 const bundlePreview = await (0, bundle_1.previewBundle)(cwd, {
@@ -295,6 +310,8 @@ function registerPublishCommand(program) {
             sdk_compatible: sdkCompatible || undefined,
             // Orchestration manifest (includes dependencies)
             manifest: manifest.manifest,
+            default_skills: skillsFromFlag || manifest.default_skills,
+            skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
         });
         const assignedVersion = result.agent?.version || 'v1';
         const agentId = result.agent?.id;

package/dist/commands/run.js

@@ -728,6 +728,23 @@ Note: Use 'run' for local execution, 'call' for server-side execution.
             await downloadDependenciesRecursively(resolved, depStatuses);
             process.stderr.write(`\nAll dependencies downloaded.\n`);
         }
+        // Check if user is overriding locked skills
+        const agentSkillsLocked = agentData.skills_locked;
+        if (agentSkillsLocked && (options.noSkills || options.skillsOnly)) {
+            const readline = await Promise.resolve().then(() => __importStar(require('readline')));
+            const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+            const answer = await new Promise(resolve => {
+                rl.question(`\nWarning: Author locked skills for this agent.\n` +
+                    `Default skills: ${agentData.default_skills?.join(', ') || '(none)'}\n` +
+                    `Override anyway? [y/N] `, resolve);
+            });
+            rl.close();
+            if (answer.toLowerCase() !== 'y') {
+                process.stderr.write('Aborted. Running with author\'s locked skills.\n');
+                options.noSkills = false;
+                options.skillsOnly = undefined;
+            }
+        }
         // Save locally
         const agentDir = await saveAgentLocally(org, parsed.agent, agentData);
         process.stderr.write(`\nAgent saved to: ${agentDir}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "Command-line interface for the OrchAgent AI agent marketplace",
   "license": "MIT",
   "author": "OrchAgent <hello@orchagent.io>",