@orchagent/cli 0.3.28 → 0.3.29

package/dist/commands/publish.js

@@ -162,6 +162,8 @@ function registerPublishCommand(program) {
         .option('--skills <skills>', 'Default skills (comma-separated, e.g., org/skill@v1,org/other@v1)')
         .option('--skills-locked', 'Lock default skills (callers cannot override via headers)')
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
+        .option('--price <amount>', 'Set price per call in USD (e.g., 0.50 for $0.50/call)')
+        .option('--pricing-mode <mode>', 'Pricing mode: free or per_call (default: free)')
         .action(async (options) => {
         if (options.private) {
             process.stderr.write('Warning: --private is deprecated (private is now the default). You can safely remove it.\n');
@@ -230,12 +232,47 @@ function registerPublishCommand(program) {
                     skill_files: hasMultipleFiles ? skillFiles : undefined,
                 });
                 const skillVersion = skillResult.agent?.version || 'v1';
+                const skillAgentId = skillResult.agent?.id;
+                // Handle pricing for skills
+                if (skillAgentId && (options.price || options.pricingMode)) {
+                    let pricingMode = 'free';
+                    let pricePerCallCents;
+                    if (options.price) {
+                        const priceFloat = parseFloat(options.price);
+                        if (isNaN(priceFloat) || priceFloat < 0) {
+                            throw new errors_1.CliError('Price must be a positive number', errors_1.ExitCodes.INVALID_INPUT);
+                        }
+                        if (priceFloat === 0) {
+                            pricingMode = 'free';
+                        }
+                        else if (priceFloat < 0.01) {
+                            throw new errors_1.CliError('Price must be at least $0.01 USD', errors_1.ExitCodes.INVALID_INPUT);
+                        }
+                        else {
+                            pricingMode = 'per_call';
+                            pricePerCallCents = Math.round(priceFloat * 100);
+                        }
+                    }
+                    else if (options.pricingMode) {
+                        pricingMode = options.pricingMode === 'per_call' ? 'per_call' : 'free';
+                    }
+                    // Set pricing
+                    if (pricingMode === 'per_call' && !pricePerCallCents) {
+                        throw new errors_1.CliError('--price required when using per_call mode', errors_1.ExitCodes.INVALID_INPUT);
+                    }
+                    await (0, api_1.setAgentPricing)(config, skillAgentId, pricingMode, pricePerCallCents);
+                }
                 await (0, analytics_1.track)('cli_publish', { agent_type: 'skill', multi_file: hasMultipleFiles });
                 process.stdout.write(`\nPublished skill: ${org.slug}/${skillData.frontmatter.name}@${skillVersion}\n`);
                 if (hasMultipleFiles) {
                     process.stdout.write(`Files: ${skillFiles.length} files included\n`);
                 }
                 process.stdout.write(`Public: ${options.public ? 'yes' : 'no'}\n`);
+                // Show pricing info
+                if (options.price && parseFloat(options.price) > 0) {
+                    const price = parseFloat(options.price);
+                    process.stdout.write(`Pricing: $${price.toFixed(2)} USD per call\n`);
+                }
             }
             catch (err) {
                 if (handleSecurityFlaggedError(err)) {
@@ -498,11 +535,45 @@ function registerPublishCommand(program) {
                 await promises_1.default.rm(tempDir, { recursive: true, force: true });
             }
         }
+        // Handle pricing for agents
+        if (agentId && (options.price || options.pricingMode)) {
+            let pricingMode = 'free';
+            let pricePerCallCents;
+            if (options.price) {
+                const priceFloat = parseFloat(options.price);
+                if (isNaN(priceFloat) || priceFloat < 0) {
+                    throw new errors_1.CliError('Price must be a positive number', errors_1.ExitCodes.INVALID_INPUT);
+                }
+                if (priceFloat === 0) {
+                    pricingMode = 'free';
+                }
+                else if (priceFloat < 0.01) {
+                    throw new errors_1.CliError('Price must be at least $0.01 USD', errors_1.ExitCodes.INVALID_INPUT);
+                }
+                else {
+                    pricingMode = 'per_call';
+                    pricePerCallCents = Math.round(priceFloat * 100);
+                }
+            }
+            else if (options.pricingMode) {
+                pricingMode = options.pricingMode === 'per_call' ? 'per_call' : 'free';
+            }
+            // Set pricing
+            if (pricingMode === 'per_call' && !pricePerCallCents) {
+                throw new errors_1.CliError('--price required when using per_call mode', errors_1.ExitCodes.INVALID_INPUT);
+            }
+            await (0, api_1.setAgentPricing)(config, agentId, pricingMode, pricePerCallCents);
+        }
         await (0, analytics_1.track)('cli_publish', { agent_type: manifest.type, hosted: shouldUploadBundle });
         process.stdout.write(`\nPublished agent: ${org.slug}/${manifest.name}@${assignedVersion}\n`);
         process.stdout.write(`Type: ${manifest.type}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
         process.stdout.write(`Providers: ${supportedProviders.join(', ')}\n`);
         process.stdout.write(`Public: ${options.public ? 'yes' : 'no'}\n`);
+        // Show pricing info
+        if (options.price && parseFloat(options.price) > 0) {
+            const price = parseFloat(options.price);
+            process.stdout.write(`Pricing: $${price.toFixed(2)} USD per call\n`);
+        }
         if (result.service_key) {
             process.stdout.write(`\nService key (save this - shown only once):\n`);
             process.stdout.write(`  ${result.service_key}\n`);

package/dist/commands/run.js

@@ -74,6 +74,50 @@ async function downloadAgent(config, org, agent, version) {
         return await (0, api_1.publicRequest)(config, `/public/agents/${org}/${agent}/${version}/download`);
     }
     catch (err) {
+        // Check for paid-agent error
+        if (err instanceof api_1.ApiError && err.status === 403) {
+            const payload = err.payload;
+            if (payload?.error?.code === 'PAID_AGENT_SERVER_ONLY') {
+                // Paid agent - try owner path if authenticated
+                if (config.apiKey) {
+                    try {
+                        const myAgents = await (0, api_1.listMyAgents)(config);
+                        const matchingAgent = myAgents.find(a => a.name === agent && a.version === version && a.org_slug === org);
+                        if (matchingAgent) {
+                            // Owner! Fetch from authenticated endpoint
+                            const agentData = await (0, api_1.request)(config, 'GET', `/agents/${matchingAgent.id}`);
+                            // Convert Agent to AgentDownload format
+                            return {
+                                id: agentData.id,
+                                type: agentData.type,
+                                name: agentData.name,
+                                version: agentData.version,
+                                description: agentData.description,
+                                prompt: agentData.prompt,
+                                input_schema: agentData.input_schema,
+                                output_schema: agentData.output_schema,
+                                supported_providers: agentData.supported_providers || ['any'],
+                                default_models: agentData.default_models,
+                                source_url: agentData.source_url,
+                                pip_package: agentData.pip_package,
+                                run_command: agentData.run_command,
+                                url: agentData.url,
+                                has_bundle: !!agentData.code_bundle_url,
+                                entrypoint: agentData.entrypoint,
+                            };
+                        }
+                    }
+                    catch {
+                        // Not owner or other error, fall through
+                    }
+                }
+                // Non-owner - block with helpful message
+                const price = payload.error.price_per_call_cents || 0;
+                const priceStr = price ? `$${(price / 100).toFixed(2)}/call` : 'PAID';
+                throw new errors_1.CliError(`This agent is paid (${priceStr}) and runs on server only.\n\n` +
+                    `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+            }
+        }
         if (!(err instanceof api_1.ApiError) || err.status !== 404)
             throw err;
     }
@@ -788,6 +832,12 @@ Examples:
   orch run orchagent/leak-finder --download-only
 
 Note: Use 'run' for local execution, 'call' for server-side execution.
+
+Paid Agents:
+  Paid agents run on server only for non-owners.
+  You CAN download and run your own paid agents for development/testing.
+
+  For other users' paid agents, use 'orch call' instead.
 `)
         .action(async (agentRef, args, options) => {
         // Merge --data alias into --input

package/dist/commands/search.js

@@ -5,6 +5,7 @@ const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const output_1 = require("../lib/output");
 const analytics_1 = require("../lib/analytics");
+const pricing_1 = require("../lib/pricing");
 const DEFAULT_LIMIT = 20;
 function registerSearchCommand(program) {
     program
@@ -15,7 +16,14 @@ function registerSearchCommand(program) {
         .option('--recent', 'Show most recently published')
         .option('--type <type>', 'Filter by type: agents, skills, all (default: all)', 'all')
         .option('--limit <n>', `Max results (default: ${DEFAULT_LIMIT})`, String(DEFAULT_LIMIT))
+        .option('--free', 'Show only free agents')
+        .option('--paid', 'Show only paid agents')
         .option('--json', 'Output raw JSON')
+        .addHelpText('after', `
+Pricing Filters:
+  --free    Show only free agents
+  --paid    Show only paid agents
+`)
         .action(async (query, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         const limit = parseInt(options.limit, 10) || DEFAULT_LIMIT;
@@ -39,6 +47,13 @@ function registerSearchCommand(program) {
         else if (options.type === 'skills') {
             agents = agents.filter(a => a.type === 'skill');
         }
+        // Filter by pricing if requested
+        if (options.free) {
+            agents = agents.filter(a => !(0, pricing_1.isPaidAgent)(a));
+        }
+        if (options.paid) {
+            agents = agents.filter(a => (0, pricing_1.isPaidAgent)(a));
+        }
         // Sort results
         if (options.popular || (!query && !options.recent)) {
             agents.sort((a, b) => (b.stars_count ?? 0) - (a.stars_count ?? 0));

package/dist/commands/security.js

@@ -0,0 +1,344 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSecurityCommand = registerSecurityCommand;
+const promises_1 = __importDefault(require("fs/promises"));
+const chalk_1 = __importDefault(require("chalk"));
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const errors_1 = require("../lib/errors");
+const output_1 = require("../lib/output");
+const spinner_1 = require("../lib/spinner");
+const llm_1 = require("../lib/llm");
+const analytics_1 = require("../lib/analytics");
+const DEFAULT_VERSION = 'latest';
+function parseAgentRef(value) {
+    const [ref, versionPart] = value.split('@');
+    const version = versionPart?.trim() || DEFAULT_VERSION;
+    const segments = ref.split('/');
+    if (segments.length === 1) {
+        return { agent: segments[0], version };
+    }
+    if (segments.length === 2) {
+        return { org: segments[0], agent: segments[1], version };
+    }
+    if (segments.length === 3) {
+        return { org: segments[0], agent: segments[1], version: segments[2] };
+    }
+    throw new errors_1.CliError('Invalid agent reference. Use org/agent/version or org/agent@version format.');
+}
+// Severity color mapping
+function severityColor(severity) {
+    switch (severity.toLowerCase()) {
+        case 'critical':
+            return chalk_1.default.red.bold(severity.toUpperCase());
+        case 'high':
+            return chalk_1.default.red(severity.toUpperCase());
+        case 'medium':
+            return chalk_1.default.yellow(severity.toUpperCase());
+        case 'low':
+            return chalk_1.default.blue(severity.toUpperCase());
+        default:
+            return severity;
+    }
+}
+// Risk level color mapping
+function riskLevelColor(level) {
+    switch (level.toLowerCase()) {
+        case 'critical':
+            return chalk_1.default.bgRed.white.bold(` ${level.toUpperCase()} `);
+        case 'high':
+            return chalk_1.default.bgRed.white(` ${level.toUpperCase()} `);
+        case 'medium':
+            return chalk_1.default.bgYellow.black(` ${level.toUpperCase()} `);
+        case 'low':
+            return chalk_1.default.bgBlue.white(` ${level.toUpperCase()} `);
+        case 'minimal':
+            return chalk_1.default.bgGreen.white(` ${level.toUpperCase()} `);
+        default:
+            return level;
+    }
+}
+function formatSummaryOutput(result) {
+    process.stdout.write('\n');
+    process.stdout.write(chalk_1.default.bold('Security Scan Results\n'));
+    process.stdout.write('━'.repeat(50) + '\n\n');
+    // Agent info
+    process.stdout.write(`${chalk_1.default.bold('Agent:')} ${result.agent_id}\n`);
+    process.stdout.write(`${chalk_1.default.bold('Scan Time:')} ${result.scan_timestamp}\n\n`);
+    // Risk level banner
+    process.stdout.write(`${chalk_1.default.bold('Risk Level:')} ${riskLevelColor(result.risk_level)}\n\n`);
+    // Summary stats
+    process.stdout.write(`${chalk_1.default.bold('Attacks Tested:')} ${result.total_attacks}\n`);
+    process.stdout.write(`${chalk_1.default.bold('Vulnerabilities Found:')} ${result.vulnerabilities_found}\n\n`);
+    // Breakdown by severity
+    if (Object.keys(result.summary.by_severity).length > 0) {
+        process.stdout.write(chalk_1.default.bold('By Severity:\n'));
+        const severityOrder = ['critical', 'high', 'medium', 'low'];
+        for (const sev of severityOrder) {
+            const count = result.summary.by_severity[sev];
+            if (count && count > 0) {
+                process.stdout.write(`  ${severityColor(sev)}: ${count}\n`);
+            }
+        }
+        process.stdout.write('\n');
+    }
+    // Breakdown by category
+    if (Object.keys(result.summary.by_category).length > 0) {
+        process.stdout.write(chalk_1.default.bold('By Category:\n'));
+        for (const [cat, count] of Object.entries(result.summary.by_category)) {
+            if (count > 0) {
+                process.stdout.write(`  ${cat}: ${count}\n`);
+            }
+        }
+        process.stdout.write('\n');
+    }
+    // Top vulnerabilities (show first 5)
+    if (result.vulnerabilities.length > 0) {
+        process.stdout.write(chalk_1.default.bold('Top Issues:\n'));
+        const topVulns = result.vulnerabilities.slice(0, 5);
+        for (const vuln of topVulns) {
+            process.stdout.write(`\n  ${severityColor(vuln.severity)} - ${chalk_1.default.bold(vuln.attack_name)}\n`);
+            process.stdout.write(`  Category: ${vuln.category}\n`);
+            if (vuln.attack_description) {
+                const desc = vuln.attack_description.length > 100
+                    ? vuln.attack_description.slice(0, 97) + '...'
+                    : vuln.attack_description;
+                process.stdout.write(`  ${chalk_1.default.dim(desc)}\n`);
+            }
+        }
+        if (result.vulnerabilities.length > 5) {
+            process.stdout.write(`\n  ${chalk_1.default.dim(`... and ${result.vulnerabilities.length - 5} more`)}\n`);
+        }
+        process.stdout.write('\n');
+    }
+    // Suggestion
+    if (result.vulnerabilities_found > 0) {
+        process.stdout.write(chalk_1.default.yellow('Tip: Use --output markdown for a detailed report.\n'));
+    }
+    else {
+        process.stdout.write(chalk_1.default.green('No vulnerabilities detected. Your agent appears secure.\n'));
+    }
+}
+function registerSecurityCommand(program) {
+    const security = program
+        .command('security')
+        .description('Security scanning and vulnerability testing for agents');
+    security
+        .command('test <agent>')
+        .description('Run dynamic security test against an agent')
+        .option('--categories <cats...>', 'Filter by attack categories')
+        .option('--severities <sevs...>', 'Filter by severities (critical, high, medium, low)')
+        .option('--max-attacks <n>', 'Limit number of attacks', parseInt)
+        .option('--output <format>', 'Output format: json, markdown, summary', 'summary')
+        .option('--output-file <path>', 'Write report to file')
+        .option('--key <key>', 'LLM API key (overrides env vars)')
+        .option('--provider <provider>', 'LLM provider (openai, anthropic, gemini)')
+        .addHelpText('after', `
+Examples:
+  orch security test my-org/my-agent/1.0.0
+  orch security test my-org/my-agent@latest --categories persona_roleplay logic_trap
+  orch security test my-org/my-agent/1.0.0 --severities critical high
+  orch security test my-org/my-agent/1.0.0 --output markdown --output-file report.md
+  orch security test my-org/my-agent/1.0.0 --max-attacks 10 --output json
+`)
+        .action(async (agentRef, options) => {
+        const resolved = await (0, config_1.getResolvedConfig)();
+        if (!resolved.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const parsed = parseAgentRef(agentRef);
+        const configFile = await (0, config_1.loadConfig)();
+        const org = parsed.org ?? configFile.workspace ?? resolved.defaultOrg;
+        if (!org) {
+            throw new errors_1.CliError('Missing org. Use org/agent or set default org.');
+        }
+        const agentId = `${org}/${parsed.agent}/${parsed.version}`;
+        // Detect LLM key for the scan
+        let llmKey;
+        let llmProvider;
+        if (options.key) {
+            if (!options.provider) {
+                throw new errors_1.CliError('When using --key, you must also specify --provider (openai, anthropic, or gemini)');
+            }
+            (0, llm_1.validateProvider)(options.provider);
+            llmKey = options.key;
+            llmProvider = options.provider;
+        }
+        else {
+            const detected = await (0, llm_1.detectLlmKey)(['any'], resolved);
+            if (detected) {
+                llmKey = detected.key;
+                llmProvider = detected.provider;
+            }
+        }
+        // Build request body
+        const requestBody = {
+            agent_id: agentId,
+        };
+        if (options.categories && options.categories.length > 0) {
+            requestBody.categories = options.categories;
+        }
+        if (options.severities && options.severities.length > 0) {
+            requestBody.severities = options.severities;
+        }
+        if (options.maxAttacks) {
+            requestBody.max_attacks = options.maxAttacks;
+        }
+        const url = `${resolved.apiUrl.replace(/\/$/, '')}/security/test`;
+        // Make the API call with a spinner
+        const spinner = (0, spinner_1.createSpinner)(`Scanning ${agentId} for vulnerabilities...`);
+        spinner.start();
+        // Build headers - LLM key goes in X-LLM-API-Key header
+        const headers = {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${resolved.apiKey}`,
+        };
+        if (llmKey) {
+            headers['X-LLM-API-Key'] = llmKey;
+        }
+        let response;
+        try {
+            response = await (0, api_1.safeFetchWithRetryForCalls)(url, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(requestBody),
+                timeoutMs: 300000, // 5 minutes - scans can take time
+            });
+        }
+        catch (err) {
+            spinner.fail(`Scan failed: ${err instanceof Error ? err.message : 'Unknown error'}`);
+            throw err;
+        }
+        if (!response.ok) {
+            const text = await response.text();
+            let payload;
+            try {
+                payload = JSON.parse(text);
+            }
+            catch {
+                payload = text;
+            }
+            const message = typeof payload === 'object' && payload
+                ? payload.error?.message ||
+                    payload.message ||
+                    response.statusText
+                : response.statusText;
+            spinner.fail(`Scan failed: ${message}`);
+            throw new errors_1.CliError(message);
+        }
+        spinner.succeed(`Scan completed for ${agentId}`);
+        const result = await response.json();
+        // Track successful scan
+        await (0, analytics_1.track)('cli_security_scan', {
+            agent: agentId,
+            vulnerabilities_found: result.vulnerabilities_found,
+            risk_level: result.risk_level,
+        });
+        // Handle output
+        const outputFormat = options.output || 'summary';
+        if (options.outputFile) {
+            let content;
+            if (outputFormat === 'json') {
+                content = JSON.stringify(result, null, 2);
+            }
+            else if (outputFormat === 'markdown' && result.markdown_report) {
+                content = result.markdown_report;
+            }
+            else if (outputFormat === 'markdown') {
+                // Generate basic markdown if server didn't provide one
+                content = generateMarkdownReport(result);
+            }
+            else {
+                // For summary output to file, use markdown
+                content = generateMarkdownReport(result);
+            }
+            await promises_1.default.writeFile(options.outputFile, content, 'utf8');
+            process.stdout.write(`Report saved to ${options.outputFile}\n`);
+            return;
+        }
+        // Print to stdout based on format
+        if (outputFormat === 'json') {
+            (0, output_1.printJson)(result);
+        }
+        else if (outputFormat === 'markdown') {
+            if (result.markdown_report) {
+                process.stdout.write(result.markdown_report);
+            }
+            else {
+                process.stdout.write(generateMarkdownReport(result));
+            }
+        }
+        else {
+            // summary format
+            formatSummaryOutput(result);
+        }
+    });
+}
+function generateMarkdownReport(result) {
+    const lines = [];
+    lines.push('# Security Scan Report');
+    lines.push('');
+    lines.push(`**Agent:** ${result.agent_id}`);
+    lines.push(`**Scan Time:** ${result.scan_timestamp}`);
+    lines.push(`**Risk Level:** ${result.risk_level.toUpperCase()}`);
+    lines.push('');
+    lines.push('## Summary');
+    lines.push('');
+    lines.push(`- Total Attacks Tested: ${result.total_attacks}`);
+    lines.push(`- Vulnerabilities Found: ${result.vulnerabilities_found}`);
+    lines.push('');
+    if (Object.keys(result.summary.by_severity).length > 0) {
+        lines.push('### By Severity');
+        lines.push('');
+        for (const [sev, count] of Object.entries(result.summary.by_severity)) {
+            if (count > 0) {
+                lines.push(`- ${sev.toUpperCase()}: ${count}`);
+            }
+        }
+        lines.push('');
+    }
+    if (Object.keys(result.summary.by_category).length > 0) {
+        lines.push('### By Category');
+        lines.push('');
+        for (const [cat, count] of Object.entries(result.summary.by_category)) {
+            if (count > 0) {
+                lines.push(`- ${cat}: ${count}`);
+            }
+        }
+        lines.push('');
+    }
+    if (result.vulnerabilities.length > 0) {
+        lines.push('## Vulnerabilities');
+        lines.push('');
+        for (const vuln of result.vulnerabilities) {
+            lines.push(`### ${vuln.attack_name}`);
+            lines.push('');
+            lines.push(`- **Severity:** ${vuln.severity.toUpperCase()}`);
+            lines.push(`- **Category:** ${vuln.category}`);
+            lines.push(`- **Attack ID:** ${vuln.attack_id}`);
+            lines.push('');
+            if (vuln.attack_description) {
+                lines.push(vuln.attack_description);
+                lines.push('');
+            }
+            if (vuln.leaked_content) {
+                lines.push('**Leaked Content:**');
+                lines.push('```');
+                lines.push(vuln.leaked_content);
+                lines.push('```');
+                lines.push('');
+            }
+            if (vuln.response_snippet) {
+                lines.push('**Response Snippet:**');
+                lines.push('```');
+                lines.push(vuln.response_snippet);
+                lines.push('```');
+                lines.push('');
+            }
+        }
+    }
+    return lines.join('\n');
+}