@orchagent/cli 0.3.119 → 0.3.120

package/dist/commands/run.js

@@ -57,6 +57,7 @@ const config_1 = require("../lib/config");
 const resolve_agent_1 = require("../lib/resolve-agent");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
+const sanitize_1 = require("../lib/sanitize");
 const json_input_1 = require("../lib/json-input");
 const output_1 = require("../lib/output");
 const spinner_1 = require("../lib/spinner");
@@ -124,6 +125,8 @@ function resolveExecutionEngine(agentData) {
 }
 // ─── Validation helpers ─────────────────────────────────────────────────────
 async function validateFilePath(filePath) {
+    // DX-29: reject ../ traversal in file paths
+    (0, sanitize_1.rejectPathTraversal)(filePath, 'file path');
     const stat = await promises_1.default.stat(filePath);
     if (stat.isDirectory()) {
         throw new errors_1.CliError(`Cannot upload a directory for cloud execution: ${filePath}\n\n` +
@@ -381,6 +384,8 @@ async function readKeyedFiles(args) {
         const parsed = isKeyedFileArg(arg);
         if (!parsed)
             continue;
+        // DX-29: reject ../ traversal in file paths
+        (0, sanitize_1.rejectPathTraversal)(parsed.filePath, 'file path');
         const resolved = path_1.default.resolve(parsed.filePath);
         let stat;
         try {
@@ -403,6 +408,8 @@ const MOUNT_SKIP_DIRS = new Set([
 const MOUNT_MAX_DEPTH = 15;
 const MOUNT_MAX_FILES = 500;
 async function mountDirectory(dirPath) {
+    // DX-29: reject ../ traversal in mount paths
+    (0, sanitize_1.rejectPathTraversal)(dirPath, 'mount path');
     const resolved = path_1.default.resolve(dirPath);
     let stat;
     try {
@@ -1856,7 +1863,7 @@ async function executeCloud(agentRef, file, options) {
         runtime: agentMeta.runtime ?? null,
         loop: agentMeta.loop ?? null,
     });
-    // Pre-flight: check required secrets before running (F-18)
+    // Pre-flight: check required secrets before running (F-18, DX-3)
     // Only for sandbox-backed engines where secrets are injected as env vars
     if (cloudEngine !== 'direct_llm') {
         const agentRequiredSecrets = agentMeta.required_secrets;
@@ -1867,12 +1874,15 @@ async function executeCloud(agentRef, file, options) {
                     const existingNames = new Set(secretsResult.secrets.map((s) => s.name));
                     const missing = agentRequiredSecrets.filter((s) => !existingNames.has(s));
                     if (missing.length > 0) {
-                        throw new errors_1.CliError(`Agent requires secrets not found in workspace '${org}':\n` +
+                        const err = new errors_1.CliError(`Agent requires ${missing.length} secret${missing.length === 1 ? '' : 's'} not found in workspace '${org}':\n` +
                             missing.map((s) => `  - ${s}`).join('\n') + '\n\n' +
                             `Set them before running:\n` +
                             missing.map((s) => `  orch secrets set ${s} <value>`).join('\n') + '\n\n' +
                             `Secrets are injected as environment variables into the agent sandbox.\n` +
-                            `View existing secrets: orch secrets list`);
+                            `View existing secrets: orch secrets list`, errors_1.ExitCodes.INVALID_INPUT);
+                        err.code = errors_1.ErrorCodes.MISSING_SECRETS;
+                        err.hint = `Set missing secrets: ${missing.map(s => `orch secrets set ${s} <value>`).join(', ')}`;
+                        throw err;
                     }
                 }
             }
@@ -2297,6 +2307,14 @@ async function executeCloud(agentRef, file, options) {
             const sandboxExitCode = typeof payload === 'object' && payload
                 ? payload.metadata?.sandbox_exit_code
                 : undefined;
+            // DX-1: Read failure classification from gateway
+            const userMessage = typeof payload === 'object' && payload
+                ? payload.error?.user_message
+                : undefined;
+            // DX-2: Read stderr tail from gateway for immediate debugging
+            const stderrTail = typeof payload === 'object' && payload
+                ? payload.error?.stderr_tail
+                : undefined;
             // Detect platform errors that surface as SANDBOX_ERROR (BUG-11)
             const lowerMessage = (message || '').toLowerCase();
             const isPlatformError = /\b403\b/.test(message || '') ||
@@ -2304,13 +2322,16 @@ async function executeCloud(agentRef, file, options) {
                 lowerMessage.includes('proxy token') ||
                 lowerMessage.includes('orchagent_service_key') ||
                 lowerMessage.includes('orchagent_billing_org');
-            // Categorize: platform > gateway category > exit_code heuristic > neutral
+            // DX-1: Prefer user_message from gateway when available
             let attribution;
             if (isPlatformError) {
                 attribution =
                     `This may be a platform configuration issue, not an error in the agent's code.\n` +
                         `If this persists, contact support with the ref below.`;
             }
+            else if (userMessage) {
+                attribution = userMessage;
+            }
             else if (errorCategory === 'code_error' || (!errorCategory && sandboxExitCode != null && sandboxExitCode !== 0)) {
                 attribution =
                     `This is an error in the agent's code, not the platform.\n` +
@@ -2322,21 +2343,30 @@ async function executeCloud(agentRef, file, options) {
                         `Check requirements.txt and environment configuration.`;
             }
             else {
-                // No category from gateway, no exit code — can't determine blame
                 attribution = `Agent execution failed. Check agent logs for details.`;
             }
+            // DX-2: Show stderr tail for immediate debugging
+            const stderrSection = stderrTail
+                ? `\n\n--- stderr (last lines) ---\n${stderrTail}`
+                : '';
             throw new errors_1.CliError(`${message}\n\n` +
                 attribution +
+                stderrSection +
                 (hint ? `\n\nHint: ${hint}` : '') +
+                (requestId ? `\n\nFull logs: orch logs ${requestId.slice(0, 8)}` : '') +
                 refSuffix);
         }
         if (errorCode === 'SANDBOX_TIMEOUT') {
             spinner?.stop();
+            // DX-1: Use user_message from gateway when available
+            const userMessage = typeof payload === 'object' && payload
+                ? payload.error?.user_message
+                : undefined;
             throw new errors_1.CliError(`${message}\n\n` +
-                `The agent did not complete in time. Try:\n` +
-                `  - Simplifying the input\n` +
-                `  - Using a smaller dataset\n` +
-                `  - Contacting the agent author to increase the timeout` +
+                (userMessage || `The agent did not complete in time. Try:\n` +
+                    `  - Simplifying the input\n` +
+                    `  - Using a smaller dataset\n` +
+                    `  - Contacting the agent author to increase the timeout`) +
                 refSuffix);
         }
         if (errorCode === 'MISSING_SECRETS') {

package/dist/commands/schedule.js

@@ -13,6 +13,7 @@ const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
 const json_input_1 = require("../lib/json-input");
 const output_1 = require("../lib/output");
+const list_options_1 = require("../lib/list-options");
 const agent_ref_1 = require("../lib/agent-ref");
 const api_2 = require("../lib/api");
 // ============================================
@@ -88,6 +89,9 @@ function registerScheduleCommand(program) {
         .option('--agent <name>', 'Filter by agent name')
         .option('--type <type>', 'Filter by type (cron or webhook)')
         .option('--json', 'Output as JSON')
+        .option('--fields <fields>', 'Comma-separated fields to include in JSON output (implies --json)')
+        .option('--limit <n>', 'Maximum number of schedules to return (default: 100)')
+        .option('--offset <n>', 'Number of schedules to skip')
         .action(async (options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -99,11 +103,24 @@ function registerScheduleCommand(program) {
             params.set('agent_name', options.agent);
         if (options.type)
             params.set('schedule_type', options.type);
-        params.set('limit', '100');
+        params.set('limit', options.limit ?? '100');
+        if (options.offset) {
+            const offset = parseInt(options.offset, 10);
+            if (!isNaN(offset) && offset > 0)
+                params.set('offset', String(offset));
+        }
         const qs = params.toString() ? `?${params.toString()}` : '';
         const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules${qs}`);
-        if (options.json) {
-            (0, output_1.printJson)(result);
+        // --fields implies --json
+        const useJson = options.json || !!options.fields;
+        if (useJson) {
+            if (options.fields) {
+                const fields = (0, list_options_1.parseFields)(options.fields);
+                (0, output_1.printJson)({ ...result, schedules: (0, list_options_1.filterFields)(result.schedules, fields) });
+            }
+            else {
+                (0, output_1.printJson)(result);
+            }
             return;
         }
         if (result.schedules.length === 0) {
@@ -561,7 +578,9 @@ function registerScheduleCommand(program) {
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .option('--status <status>', 'Filter by status (completed, failed, running, timeout)')
         .option('--limit <n>', 'Number of runs to show (default: 20)', '20')
+        .option('--offset <n>', 'Number of runs to skip')
         .option('--json', 'Output as JSON')
+        .option('--fields <fields>', 'Comma-separated fields to include in JSON output (implies --json)')
         .action(async (scheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -572,10 +591,23 @@ function registerScheduleCommand(program) {
         params.set('limit', options.limit);
         if (options.status)
             params.set('status', options.status);
+        if (options.offset) {
+            const offset = parseInt(options.offset, 10);
+            if (!isNaN(offset) && offset > 0)
+                params.set('offset', String(offset));
+        }
         const qs = `?${params.toString()}`;
         const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}/runs${qs}`);
-        if (options.json) {
-            (0, output_1.printJson)(result);
+        // --fields implies --json
+        const useJson = options.json || !!options.fields;
+        if (useJson) {
+            if (options.fields) {
+                const fields = (0, list_options_1.parseFields)(options.fields);
+                (0, output_1.printJson)({ ...result, runs: (0, list_options_1.filterFields)(result.runs, fields) });
+            }
+            else {
+                (0, output_1.printJson)(result);
+            }
             return;
         }
         if (!result.runs.length) {

package/dist/commands/schema.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSchemaCommand = registerSchemaCommand;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const agent_ref_1 = require("../lib/agent-ref");
+const errors_1 = require("../lib/errors");
+const info_1 = require("./info");
+function registerSchemaCommand(program) {
+    program
+        .command('schema <agent>')
+        .description('Show agent input/output schemas as machine-readable JSON')
+        .option('--input-only', 'Show only the input schema')
+        .option('--output-only', 'Show only the output schema')
+        .option('--full', 'Show full agent spec (type, execution_engine, schemas, custom_tools, secrets)')
+        .action(async (agentArg, options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        const parsed = (0, agent_ref_1.parseAgentRef)(agentArg);
+        const configFile = await (0, config_1.loadConfig)();
+        const org = parsed.org ?? configFile.workspace ?? config.defaultOrg;
+        if (!org) {
+            throw new errors_1.CliError('Missing org. Use org/agent format or set default org.');
+        }
+        const { agent, version } = parsed;
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, org);
+        const agentData = await (0, info_1.getAgentInfo)(config, org, agent, version, workspaceId);
+        const ref = `${org}/${agent}@${agentData.version || version}`;
+        if (options.inputOnly) {
+            process.stdout.write(JSON.stringify(agentData.input_schema || {}, null, 2) + '\n');
+            return;
+        }
+        if (options.outputOnly) {
+            process.stdout.write(JSON.stringify(agentData.output_schema || {}, null, 2) + '\n');
+            return;
+        }
+        if (options.full) {
+            const output = {
+                agent: ref,
+                type: agentData.type,
+                callable: agentData.callable ?? false,
+                supported_providers: agentData.supported_providers,
+                input_schema: agentData.input_schema || {},
+                output_schema: agentData.output_schema || {},
+            };
+            if (agentData.description) {
+                output.description = agentData.description;
+            }
+            if (agentData.required_secrets && agentData.required_secrets.length > 0) {
+                output.required_secrets = agentData.required_secrets;
+            }
+            if (agentData.optional_secrets && agentData.optional_secrets.length > 0) {
+                output.optional_secrets = agentData.optional_secrets;
+            }
+            if (agentData.dependencies && agentData.dependencies.length > 0) {
+                output.dependencies = agentData.dependencies;
+            }
+            if (agentData.default_skills && agentData.default_skills.length > 0) {
+                output.default_skills = agentData.default_skills;
+            }
+            if (agentData.custom_tools && agentData.custom_tools.length > 0) {
+                output.custom_tools = agentData.custom_tools;
+            }
+            if (agentData.environment) {
+                output.environment = agentData.environment;
+            }
+            process.stdout.write(JSON.stringify(output, null, 2) + '\n');
+            return;
+        }
+        // Default: show both schemas with agent ref
+        const output = {
+            agent: ref,
+            type: agentData.type,
+            input_schema: agentData.input_schema || {},
+            output_schema: agentData.output_schema || {},
+        };
+        process.stdout.write(JSON.stringify(output, null, 2) + '\n');
+    });
+}

package/dist/commands/secrets.js

@@ -10,6 +10,8 @@ const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
 const output_1 = require("../lib/output");
+const list_options_1 = require("../lib/list-options");
+const sanitize_1 = require("../lib/sanitize");
 // Known LLM key names → provider. Must stay in sync with gateway's
 // _PROVIDER_TO_SECRET_NAME (db.py) and publish.ts PROVIDER_TO_SECRET_NAME.
 const LLM_KEY_NAME_TO_PROVIDER = {
@@ -49,6 +51,8 @@ function formatDate(iso) {
     return new Date(iso).toLocaleString();
 }
 function validateSecretName(name) {
+    // DX-29: reject control chars before format check
+    (0, sanitize_1.rejectControlChars)(name, 'secret name');
     if (!name || name.length > 128) {
         throw new errors_1.CliError('Secret name must be 1-128 characters.');
     }
@@ -78,6 +82,7 @@ function registerSecretsCommand(program) {
         .description('List secrets in your workspace (names and metadata, never values)')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .option('--json', 'Output as JSON')
+        .option('--fields <fields>', 'Comma-separated fields to include in JSON output (implies --json)')
         .action(async (options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -85,8 +90,16 @@ function registerSecretsCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/secrets`);
-        if (options.json) {
-            (0, output_1.printJson)(result);
+        // --fields implies --json
+        const useJson = options.json || !!options.fields;
+        if (useJson) {
+            if (options.fields) {
+                const fields = (0, list_options_1.parseFields)(options.fields);
+                (0, output_1.printJson)({ ...result, secrets: (0, list_options_1.filterFields)(result.secrets, fields) });
+            }
+            else {
+                (0, output_1.printJson)(result);
+            }
             return;
         }
         if (result.secrets.length === 0) {
@@ -127,6 +140,8 @@ function registerSecretsCommand(program) {
             throw new errors_1.CliError('Missing API key. Run `orch login` first.');
         }
         validateSecretName(name);
+        // DX-29: strip dangerous control chars from secret values (keep \n, \r, \t for PEM keys etc.)
+        value = (0, sanitize_1.sanitizeSecretValue)(value);
         if (!value) {
             throw new errors_1.CliError('Secret value cannot be empty.');
         }

package/dist/commands/service.js

@@ -10,6 +10,7 @@ const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
 const output_1 = require("../lib/output");
+const list_options_1 = require("../lib/list-options");
 const spinner_1 = require("../lib/spinner");
 // ============================================
 // HELPERS
@@ -227,6 +228,9 @@ function registerServiceCommand(program) {
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .option('--status <state>', 'Filter by state')
         .option('--json', 'Output as JSON')
+        .option('--fields <fields>', 'Comma-separated fields to include in JSON output (implies --json)')
+        .option('--limit <n>', 'Maximum number of services to return (default: 100)')
+        .option('--offset <n>', 'Number of services to skip')
         .action(async (options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -236,11 +240,24 @@ function registerServiceCommand(program) {
         const params = new URLSearchParams();
         if (options.status)
             params.set('status', options.status);
-        params.set('limit', '100');
+        params.set('limit', options.limit ?? '100');
+        if (options.offset) {
+            const offset = parseInt(options.offset, 10);
+            if (!isNaN(offset) && offset > 0)
+                params.set('offset', String(offset));
+        }
         const qs = params.toString() ? `?${params.toString()}` : '';
         const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/services${qs}`);
-        if (options.json) {
-            (0, output_1.printJson)(result);
+        // --fields implies --json
+        const useJson = options.json || !!options.fields;
+        if (useJson) {
+            if (options.fields) {
+                const fields = (0, list_options_1.parseFields)(options.fields);
+                (0, output_1.printJson)({ ...result, services: (0, list_options_1.filterFields)(result.services, fields) });
+            }
+            else {
+                (0, output_1.printJson)(result);
+            }
             return;
         }
         if (!result.services.length) {

package/dist/commands/storage.js

@@ -42,6 +42,7 @@ const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
 const output_1 = require("../lib/output");
+const list_options_1 = require("../lib/list-options");
 // ============================================
 // HELPERS
 // ============================================
@@ -171,6 +172,7 @@ function registerStorageCommand(program) {
         .option('--limit <n>', 'Max keys to return (default: 100)', '100')
         .option('--cursor <cursor>', 'Pagination cursor from previous response')
         .option('--json', 'Output as JSON')
+        .option('--fields <fields>', 'Comma-separated fields to include in JSON output (implies --json)')
         .action(async (namespace, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -178,11 +180,14 @@ function registerStorageCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const headers = { 'X-Workspace-Id': workspaceId };
+        // --fields implies --json
+        const useJson = options.json || !!options.fields;
+        const parsedFields = options.fields ? (0, list_options_1.parseFields)(options.fields) : undefined;
         if (!namespace) {
             // List namespaces
             const result = await (0, api_1.request)(config, 'GET', '/storage', { headers });
-            if (options.json) {
-                (0, output_1.printJson)(result);
+            if (useJson) {
+                (0, output_1.printJson)(parsedFields ? (0, list_options_1.filterFields)(result, parsedFields) : result);
                 return;
             }
             if (result.namespaces.length === 0) {
@@ -203,8 +208,8 @@ function registerStorageCommand(program) {
             if (options.cursor)
                 path += `&cursor=${encodeURIComponent(options.cursor)}`;
             const result = await (0, api_1.request)(config, 'GET', path, { headers });
-            if (options.json) {
-                (0, output_1.printJson)(result);
+            if (useJson) {
+                (0, output_1.printJson)(parsedFields ? (0, list_options_1.filterFields)(result, parsedFields) : result);
                 return;
             }
             if (result.keys.length === 0) {

package/dist/index.js

@@ -47,6 +47,7 @@ const errors_1 = require("./lib/errors");
 const suggest_1 = require("./lib/suggest");
 const analytics_1 = require("./lib/analytics");
 const config_1 = require("./lib/config");
+const output_1 = require("./lib/output");
 const spinner_1 = require("./lib/spinner");
 const update_notifier_1 = require("./lib/update-notifier");
 const package_json_1 = __importDefault(require("../package.json"));
@@ -82,12 +83,30 @@ async function main() {
     if (config.no_progress) {
         (0, spinner_1.setProgressEnabled)(false);
     }
-    // Parse args - hook will set noProgress if --no-progress flag is passed
-    program.hook('preAction', () => {
+    // Parse args - hook handles --no-progress and TTY auto-detection
+    program.hook('preAction', (_thisCommand, actionCommand) => {
         const opts = program.opts();
         if (opts.progress === false) {
             (0, spinner_1.setProgressEnabled)(false);
         }
+        // TTY auto-detection: non-TTY → auto-enable JSON on commands that support it
+        // This lets piped output (orch agents | jq .) and agent consumers get JSON automatically.
+        // Override: ORCHAGENT_OUTPUT=text forces human-readable even in non-TTY.
+        const hasJsonOption = actionCommand.options.some((o) => o.long === '--json');
+        if (hasJsonOption && actionCommand.getOptionValue('json') === undefined) {
+            if ((0, output_1.shouldAutoJson)()) {
+                actionCommand.setOptionValue('json', true);
+                (0, spinner_1.setProgressEnabled)(false);
+            }
+        }
+        // Track JSON mode globally so exitWithError can output structured errors
+        if (actionCommand.getOptionValue('json')) {
+            (0, output_1.setJsonMode)(true);
+        }
+        // Also disable progress spinners in non-TTY (even if command has no --json option)
+        if (!process.stdout.isTTY) {
+            (0, spinner_1.setProgressEnabled)(false);
+        }
     });
     await program.parseAsync(process.argv);
 }

package/dist/lib/agent-ref.js

@@ -2,7 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseAgentRef = parseAgentRef;
 const errors_1 = require("./errors");
+const sanitize_1 = require("./sanitize");
 function parseAgentRef(value, defaultVersion = 'latest') {
+    // DX-29: reject unsafe chars in the raw input before parsing
+    (0, sanitize_1.rejectResourceIdChars)(value, 'agent reference');
     const [ref, versionPart] = value.split('@');
     const version = versionPart?.trim() || defaultVersion;
     const segments = ref.split('/');