@orchagent/cli 0.3.31 → 0.3.33

package/dist/lib/config.test.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * Tests for config loading and saving.
+ *
+ * These tests cover the security-critical config management:
+ * - Loading config from file
+ * - Saving config with proper permissions
+ * - Config resolution priority (overrides > env > file)
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+// Mock fs/promises
+vitest_1.vi.mock('fs/promises', () => ({
+    default: {
+        readFile: vitest_1.vi.fn(),
+        writeFile: vitest_1.vi.fn(),
+        mkdir: vitest_1.vi.fn(),
+        chmod: vitest_1.vi.fn(),
+    },
+}));
+const promises_1 = __importDefault(require("fs/promises"));
+const config_1 = require("./config");
+(0, vitest_1.describe)('loadConfig', () => {
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.resetAllMocks();
+    });
+    (0, vitest_1.it)('returns empty object when config file missing', async () => {
+        const error = new Error('ENOENT');
+        error.code = 'ENOENT';
+        vitest_1.vi.mocked(promises_1.default.readFile).mockRejectedValueOnce(error);
+        const config = await (0, config_1.loadConfig)();
+        (0, vitest_1.expect)(config).toEqual({});
+    });
+    (0, vitest_1.it)('parses JSON config file', async () => {
+        const configData = {
+            api_key: 'sk_test_123',
+            api_url: 'https://custom.api.com',
+            default_org: 'my-org',
+        };
+        vitest_1.vi.mocked(promises_1.default.readFile).mockResolvedValueOnce(JSON.stringify(configData));
+        const config = await (0, config_1.loadConfig)();
+        (0, vitest_1.expect)(config).toEqual(configData);
+    });
+    (0, vitest_1.it)('throws on non-ENOENT errors', async () => {
+        const error = new Error('Permission denied');
+        error.code = 'EACCES';
+        vitest_1.vi.mocked(promises_1.default.readFile).mockRejectedValueOnce(error);
+        await (0, vitest_1.expect)((0, config_1.loadConfig)()).rejects.toThrow('Permission denied');
+    });
+    (0, vitest_1.it)('reads from ~/.orchagent/config.json', async () => {
+        vitest_1.vi.mocked(promises_1.default.readFile).mockResolvedValueOnce('{}');
+        await (0, config_1.loadConfig)();
+        (0, vitest_1.expect)(promises_1.default.readFile).toHaveBeenCalledWith(path_1.default.join(os_1.default.homedir(), '.orchagent', 'config.json'), 'utf-8');
+    });
+});
+(0, vitest_1.describe)('saveConfig', () => {
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.resetAllMocks();
+        vitest_1.vi.mocked(promises_1.default.mkdir).mockResolvedValue(undefined);
+        vitest_1.vi.mocked(promises_1.default.writeFile).mockResolvedValue(undefined);
+        vitest_1.vi.mocked(promises_1.default.chmod).mockResolvedValue(undefined);
+    });
+    (0, vitest_1.it)('creates config directory if missing', async () => {
+        await (0, config_1.saveConfig)({ api_key: 'sk_test' });
+        (0, vitest_1.expect)(promises_1.default.mkdir).toHaveBeenCalledWith(path_1.default.join(os_1.default.homedir(), '.orchagent'), { recursive: true });
+    });
+    (0, vitest_1.it)('writes JSON with pretty formatting', async () => {
+        const config = { api_key: 'sk_test_123' };
+        await (0, config_1.saveConfig)(config);
+        (0, vitest_1.expect)(promises_1.default.writeFile).toHaveBeenCalledWith(path_1.default.join(os_1.default.homedir(), '.orchagent', 'config.json'), vitest_1.expect.stringContaining('"api_key": "sk_test_123"'), { mode: 0o600 });
+    });
+    (0, vitest_1.it)('sets restrictive file permissions (0600)', async () => {
+        await (0, config_1.saveConfig)({ api_key: 'sk_test' });
+        // First via writeFile options
+        (0, vitest_1.expect)(promises_1.default.writeFile).toHaveBeenCalledWith(vitest_1.expect.any(String), vitest_1.expect.any(String), { mode: 0o600 });
+        // Then explicitly with chmod
+        (0, vitest_1.expect)(promises_1.default.chmod).toHaveBeenCalledWith(path_1.default.join(os_1.default.homedir(), '.orchagent', 'config.json'), 0o600);
+    });
+    (0, vitest_1.it)('adds trailing newline to file', async () => {
+        await (0, config_1.saveConfig)({ api_key: 'test' });
+        const writeCall = vitest_1.vi.mocked(promises_1.default.writeFile).mock.calls[0];
+        const content = writeCall[1];
+        (0, vitest_1.expect)(content.endsWith('\n')).toBe(true);
+    });
+});
+(0, vitest_1.describe)('getResolvedConfig', () => {
+    const originalEnv = process.env;
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.resetAllMocks();
+        process.env = { ...originalEnv };
+        // Default: no config file
+        const error = new Error('ENOENT');
+        error.code = 'ENOENT';
+        vitest_1.vi.mocked(promises_1.default.readFile).mockRejectedValue(error);
+    });
+    (0, vitest_1.afterEach)(() => {
+        process.env = originalEnv;
+    });
+    (0, vitest_1.it)('uses default API URL when not configured', async () => {
+        const config = await (0, config_1.getResolvedConfig)();
+        (0, vitest_1.expect)(config.apiUrl).toBe('https://api.orchagent.com');
+    });
+    (0, vitest_1.it)('reads API key from file config', async () => {
+        vitest_1.vi.mocked(promises_1.default.readFile).mockResolvedValueOnce(JSON.stringify({ api_key: 'sk_from_file' }));
+        const config = await (0, config_1.getResolvedConfig)();
+        (0, vitest_1.expect)(config.apiKey).toBe('sk_from_file');
+    });
+    (0, vitest_1.it)('prioritizes env vars over file config', async () => {
+        process.env.ORCHAGENT_API_KEY = 'sk_from_env';
+        vitest_1.vi.mocked(promises_1.default.readFile).mockResolvedValueOnce(JSON.stringify({ api_key: 'sk_from_file' }));
+        const config = await (0, config_1.getResolvedConfig)();
+        (0, vitest_1.expect)(config.apiKey).toBe('sk_from_env');
+    });
+    (0, vitest_1.it)('prioritizes overrides over env vars', async () => {
+        process.env.ORCHAGENT_API_KEY = 'sk_from_env';
+        const config = await (0, config_1.getResolvedConfig)({ api_key: 'sk_override' });
+        (0, vitest_1.expect)(config.apiKey).toBe('sk_override');
+    });
+    (0, vitest_1.it)('resolves API URL from env var', async () => {
+        process.env.ORCHAGENT_API_URL = 'https://custom.api.com';
+        const config = await (0, config_1.getResolvedConfig)();
+        (0, vitest_1.expect)(config.apiUrl).toBe('https://custom.api.com');
+    });
+    (0, vitest_1.it)('resolves default org from env var', async () => {
+        process.env.ORCHAGENT_DEFAULT_ORG = 'my-org';
+        const config = await (0, config_1.getResolvedConfig)();
+        (0, vitest_1.expect)(config.defaultOrg).toBe('my-org');
+    });
+    (0, vitest_1.it)('returns undefined apiKey when not set anywhere', async () => {
+        const config = await (0, config_1.getResolvedConfig)();
+        (0, vitest_1.expect)(config.apiKey).toBeUndefined();
+    });
+});
+(0, vitest_1.describe)('getConfigPath', () => {
+    (0, vitest_1.it)('returns path to config file', () => {
+        const configPath = (0, config_1.getConfigPath)();
+        (0, vitest_1.expect)(configPath).toBe(path_1.default.join(os_1.default.homedir(), '.orchagent', 'config.json'));
+    });
+});

package/dist/lib/output.js

@@ -11,17 +11,17 @@ const pricing_1 = require("./pricing");
 function printJson(value) {
     process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
-function printAgentsTable(agents) {
-    const table = new cli_table3_1.default({
-        head: [
-            chalk_1.default.bold('Agent'),
-            chalk_1.default.bold('Type'),
-            chalk_1.default.bold('Providers'),
-            chalk_1.default.bold('Stars'),
-            chalk_1.default.bold('Price'),
-            chalk_1.default.bold('Description'),
-        ],
-    });
+function printAgentsTable(agents, options) {
+    const head = [
+        chalk_1.default.bold('Agent'),
+        chalk_1.default.bold('Type'),
+        ...(options?.showVisibility ? [chalk_1.default.bold('Visibility')] : []),
+        chalk_1.default.bold('Providers'),
+        chalk_1.default.bold('Stars'),
+        chalk_1.default.bold('Price'),
+        chalk_1.default.bold('Description'),
+    ];
+    const table = new cli_table3_1.default({ head });
     agents.forEach((agent) => {
         const fullName = `${agent.org_slug}/${agent.name}`;
         const type = agent.type || 'code';
@@ -34,7 +34,14 @@ function printAgentsTable(agents) {
                 ? agent.description.slice(0, 27) + '...'
                 : agent.description
             : '-';
-        table.push([fullName, type, providers, stars.toString(), priceColored, desc]);
+        const visibility = agent.is_public === false
+            ? chalk_1.default.yellow('private')
+            : chalk_1.default.green('public');
+        const row = [fullName, type];
+        if (options?.showVisibility)
+            row.push(visibility);
+        row.push(providers, stars.toString(), priceColored, desc);
+        table.push(row);
     });
     process.stdout.write(`${table.toString()}\n`);
 }

package/dist/lib/skill-resolve.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSkills = resolveSkills;
+const api_1 = require("./api");
+function parseSkillRef(ref) {
+    const [namePart, versionPart] = ref.split('@');
+    const version = versionPart?.trim() || 'latest';
+    const segments = namePart.split('/');
+    if (segments.length !== 2 || !segments[0] || !segments[1]) {
+        throw new Error(`Invalid skill reference: ${ref}. Expected format: org/name[@version]`);
+    }
+    return { org: segments[0], name: segments[1], version };
+}
+/**
+ * Download a single skill's content.
+ * Tries public endpoint first, falls back to authenticated for private skills.
+ * Returns null if the skill can't be found.
+ */
+async function downloadSkill(config, org, name, version) {
+    // Try public download endpoint first
+    try {
+        return await (0, api_1.publicRequest)(config, `/public/agents/${org}/${name}/${version}/download`);
+    }
+    catch (err) {
+        if (!(err instanceof api_1.ApiError) || err.status !== 404) {
+            // Non-404 errors (network, 500, etc.) - rethrow
+            throw err;
+        }
+    }
+    // Public not found - try authenticated endpoint for private skills
+    if (!config.apiKey) {
+        return null;
+    }
+    try {
+        const userOrg = await (0, api_1.getOrg)(config);
+        if (userOrg.slug !== org) {
+            return null;
+        }
+        const agents = await (0, api_1.listMyAgents)(config);
+        const matching = agents.filter(a => a.name === name && a.type === 'skill');
+        if (matching.length === 0) {
+            return null;
+        }
+        let target;
+        if (version === 'latest') {
+            target = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+        }
+        else {
+            const found = matching.find(a => a.version === version);
+            if (!found)
+                return null;
+            target = found;
+        }
+        return {
+            name: target.name,
+            version: target.version,
+            description: target.description,
+            prompt: target.prompt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve an array of skill references to their full content.
+ * Fetches each skill from the API and returns resolved skills with prompts.
+ * Skills that can't be fetched are skipped with a warning.
+ */
+async function resolveSkills(config, skillRefs, onWarning) {
+    const resolved = [];
+    for (const ref of skillRefs) {
+        let parsed;
+        try {
+            parsed = parseSkillRef(ref);
+        }
+        catch {
+            onWarning?.(`Skipping invalid skill reference: ${ref}`);
+            continue;
+        }
+        try {
+            const skill = await downloadSkill(config, parsed.org, parsed.name, parsed.version);
+            if (!skill || !skill.prompt) {
+                onWarning?.(`Could not resolve skill '${ref}' (not found or empty)`);
+                continue;
+            }
+            resolved.push({
+                ref,
+                name: skill.name,
+                description: skill.description,
+                prompt: skill.prompt,
+            });
+        }
+        catch (err) {
+            onWarning?.(`Could not fetch skill '${ref}': ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return resolved;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.31",
+  "version": "0.3.33",
   "description": "Command-line interface for the orchagent AI agent marketplace",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",