@orchagent/cli 0.3.36 → 0.3.38

package/dist/commands/config.js

@@ -78,6 +78,13 @@ async function getConfigValue(key) {
         }
     }
 }
+async function unsetConfigValue(key) {
+    if (!isValidKey(key)) {
+        throw new errors_1.CliError(`Unknown config key: ${key}. Supported keys: ${SUPPORTED_KEYS.join(', ')}`);
+    }
+    await (0, config_1.unsetConfigKey)(key);
+    process.stdout.write(`Unset ${key}\n`);
+}
 async function listConfigValues() {
     const config = await (0, config_1.loadConfig)();
     process.stdout.write('CLI Configuration:\n\n');
@@ -123,6 +130,12 @@ function registerConfigCommand(program) {
         .action(async (key) => {
         await getConfigValue(key);
     });
+    config
+        .command('unset <key>')
+        .description('Remove a configuration value (restore to default)')
+        .action(async (key) => {
+        await unsetConfigValue(key);
+    });
     config
         .command('list')
         .description('List all configuration values')

package/dist/commands/install.js

@@ -86,6 +86,37 @@ async function downloadAgentWithFallback(config, org, name, version) {
                 `Use: orch call ${org}/${name}@${version} --input '{...}'`);
         }
     }
+    // Check if download is disabled (server-only agent)
+    if (publicMeta && publicMeta.allow_local_download === false) {
+        // Check if owner (can bypass)
+        if (config.apiKey) {
+            const callerOrg = await (0, api_1.getOrg)(config);
+            const isOwner = (publicMeta.org_id && callerOrg.id === publicMeta.org_id) ||
+                (publicMeta.org_slug && callerOrg.slug === publicMeta.org_slug);
+            if (isOwner) {
+                // Owner - fetch from authenticated endpoint
+                const myAgents = await (0, api_1.listMyAgents)(config);
+                const matching = myAgents.filter(a => a.name === name);
+                if (matching.length > 0) {
+                    let targetAgent;
+                    if (version === 'latest') {
+                        targetAgent = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+                    }
+                    else {
+                        const found = matching.find(a => a.version === version);
+                        if (!found) {
+                            throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
+                        }
+                        targetAgent = found;
+                    }
+                    const agentData = await (0, api_1.request)(config, 'GET', `/agents/${targetAgent.id}`);
+                    return { ...agentData, org_slug: org };
+                }
+            }
+        }
+        throw new errors_1.CliError(`This agent is server-only and cannot be downloaded.\n\n` +
+            `Use: orch call ${org}/${name}@${version} --input '{...}'`);
+    }
     // Free agent - proceed normally with public data
     if (publicMeta) {
         // Cast PublicAgent to Agent for use as CanonicalAgent

package/dist/commands/pricing.js

@@ -12,7 +12,9 @@ function registerPricingCommand(program) {
     program
         .command('pricing <agent> <mode>')
         .description('Set pricing for your agent (free or per-call in USD)')
-        .action(async (agentRef, mode) => {
+        .option('--local-download', 'Allow users to download and run locally')
+        .option('--no-local-download', 'Restrict to server-only (orch call)')
+        .action(async (agentRef, mode, options) => {
         const resolved = await (0, config_1.getResolvedConfig)();
         // Parse agent reference
         const [orgOrAgent, maybeName] = agentRef.split('/');
@@ -56,17 +58,36 @@ function registerPricingCommand(program) {
             pricingMode = 'per_call';
             pricePerCallCents = Math.round(priceFloat * 100);
         }
+        // Determine allow_local_download value
+        let allowLocalDownload;
+        if (pricingMode === 'per_call') {
+            // Paid agents are always server-only
+            allowLocalDownload = false;
+            if (options.localDownload) {
+                process.stderr.write(chalk_1.default.yellow('Note: Paid agents are always server-only. --local-download ignored.\n'));
+            }
+        }
+        else if (options.localDownload !== undefined) {
+            allowLocalDownload = options.localDownload;
+        }
         // Set pricing
-        await (0, api_1.setAgentPricing)(resolved, agent.id, pricingMode, pricePerCallCents);
+        await (0, api_1.setAgentPricing)(resolved, agent.id, pricingMode, pricePerCallCents, allowLocalDownload);
         // Show confirmation
         process.stdout.write(chalk_1.default.green('✓ Pricing updated\n'));
         process.stdout.write(`Agent: ${org}/${agentName}\n`);
         if (pricingMode === 'free') {
             process.stdout.write(`Mode: FREE\n`);
+            if (allowLocalDownload === true) {
+                process.stdout.write(`Local download: enabled\n`);
+            }
+            else if (allowLocalDownload === false) {
+                process.stdout.write(`Local download: disabled (server-only)\n`);
+            }
         }
         else {
             process.stdout.write(`Mode: Pay per call\n`);
             process.stdout.write(`Price: $${(pricePerCallCents / 100).toFixed(2)} USD per call\n`);
+            process.stdout.write(`Local download: disabled (paid agents are server-only)\n`);
         }
     });
 }

package/dist/commands/publish.js

@@ -54,36 +54,6 @@ function deriveInputSchema(variables) {
         required: [...variables],
     };
 }
-/**
- * Handle security flagged error response (422 with error: 'content_flagged')
- * Returns true if the error was handled, false otherwise
- */
-function handleSecurityFlaggedError(err) {
-    if (!(err instanceof api_1.ApiError) || err.status !== 422) {
-        return false;
-    }
-    const payload = err.payload;
-    if (payload?.error !== 'content_flagged') {
-        return false;
-    }
-    process.stderr.write('\n');
-    process.stderr.write('Error: Skill flagged for security review\n\n');
-    if (payload.concerns && payload.concerns.length > 0) {
-        process.stderr.write('Concerns found:\n');
-        for (const concern of payload.concerns) {
-            const severityLabel = concern.severity.toUpperCase();
-            const fileInfo = concern.file_path ? ` in ${concern.file_path}` : '';
-            process.stderr.write(`  [${severityLabel}] ${concern.category}${fileInfo}\n`);
-            process.stderr.write(`    "${concern.description}"\n\n`);
-        }
-    }
-    if (payload.summary) {
-        process.stderr.write(`Summary: ${payload.summary}\n\n`);
-    }
-    process.stderr.write('Please review and remove suspicious patterns before publishing.\n');
-    process.stderr.write('If you believe this is a false positive, contact support@orchagent.com\n');
-    return true;
-}
 /**
  * Check if orchagent-sdk is listed in requirements.txt or pyproject.toml
  */
@@ -204,6 +174,7 @@ function registerPublishCommand(program) {
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
         .option('--price <amount>', 'Set price per call in USD (e.g., 0.50 for $0.50/call)')
         .option('--pricing-mode <mode>', 'Pricing mode: free or per_call (default: free)')
+        .option('--local-download', 'Allow users to download and run locally (default: server-only)')
         .action(async (options) => {
         if (options.private) {
             process.stderr.write('Warning: --private is deprecated (private is now the default). You can safely remove it.\n');
@@ -270,6 +241,7 @@ function registerPublishCommand(program) {
                     skills_locked: options.skillsLocked || undefined,
                     // SC-05: Include all skill files for UI preview
                     skill_files: hasMultipleFiles ? skillFiles : undefined,
+                    allow_local_download: options.localDownload || false,
                 });
                 const skillVersion = skillResult.agent?.version || 'v1';
                 const skillAgentId = skillResult.agent?.id;
@@ -316,9 +288,6 @@ function registerPublishCommand(program) {
                 process.stdout.write(`\nView analytics and usage: https://orchagent.io/dashboard\n`);
             }
             catch (err) {
-                if (handleSecurityFlaggedError(err)) {
-                    process.exit(1);
-                }
                 throw err;
             }
             return;
@@ -545,12 +514,10 @@ function registerPublishCommand(program) {
                 manifest: manifest.manifest,
                 default_skills: skillsFromFlag || manifest.default_skills,
                 skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
+                allow_local_download: options.localDownload || false,
             });
         }
         catch (err) {
-            if (handleSecurityFlaggedError(err)) {
-                process.exit(1);
-            }
             throw err;
         }
         const assignedVersion = result.agent?.version || 'v1';

package/dist/commands/run.js

@@ -74,11 +74,12 @@ async function downloadAgent(config, org, agent, version) {
         return await (0, api_1.publicRequest)(config, `/public/agents/${org}/${agent}/${version}/download`);
     }
     catch (err) {
-        // Check for paid-agent error
+        // Check for paid-agent or download-disabled error
         if (err instanceof api_1.ApiError && err.status === 403) {
             const payload = err.payload;
-            if (payload?.error?.code === 'PAID_AGENT_SERVER_ONLY') {
-                // Paid agent - try owner path if authenticated
+            const errorCode = payload?.error?.code;
+            if (errorCode === 'PAID_AGENT_SERVER_ONLY' || errorCode === 'DOWNLOAD_DISABLED') {
+                // Try owner path if authenticated
                 if (config.apiKey) {
                     try {
                         const myAgents = await (0, api_1.listMyAgents)(config);
@@ -112,10 +113,16 @@ async function downloadAgent(config, org, agent, version) {
                     }
                 }
                 // Non-owner - block with helpful message
-                const price = payload.error.price_per_call_cents || 0;
-                const priceStr = price ? `$${(price / 100).toFixed(2)}/call` : 'PAID';
-                throw new errors_1.CliError(`This agent is paid (${priceStr}) and runs on server only.\n\n` +
-                    `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+                if (errorCode === 'PAID_AGENT_SERVER_ONLY') {
+                    const price = payload.error.price_per_call_cents || 0;
+                    const priceStr = price ? `$${(price / 100).toFixed(2)}/call` : 'PAID';
+                    throw new errors_1.CliError(`This agent is paid (${priceStr}) and runs on server only.\n\n` +
+                        `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+                }
+                else {
+                    throw new errors_1.CliError(`This agent is server-only and cannot be downloaded.\n\n` +
+                        `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+                }
             }
         }
         if (!(err instanceof api_1.ApiError) || err.status !== 404)

package/dist/commands/security.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractCount = extractCount;
 exports.registerSecurityCommand = registerSecurityCommand;
 const promises_1 = __importDefault(require("fs/promises"));
 const chalk_1 = __importDefault(require("chalk"));
@@ -61,6 +62,14 @@ function riskLevelColor(level) {
             return level;
     }
 }
+/** Extract count from summary value (handles both flat numbers and {total, leaked} objects). */
+function extractCount(value) {
+    if (typeof value === 'number')
+        return value;
+    if (value && typeof value === 'object' && 'leaked' in value)
+        return value.leaked;
+    return 0;
+}
 function formatSummaryOutput(result) {
     process.stdout.write('\n');
     process.stdout.write(chalk_1.default.bold('Security Scan Results\n'));
@@ -78,8 +87,8 @@ function formatSummaryOutput(result) {
         process.stdout.write(chalk_1.default.bold('By Severity:\n'));
         const severityOrder = ['critical', 'high', 'medium', 'low'];
         for (const sev of severityOrder) {
-            const count = result.summary.by_severity[sev];
-            if (count && count > 0) {
+            const count = extractCount(result.summary.by_severity[sev]);
+            if (count > 0) {
                 process.stdout.write(`  ${severityColor(sev)}: ${count}\n`);
             }
         }
@@ -88,7 +97,8 @@ function formatSummaryOutput(result) {
     // Breakdown by category
     if (Object.keys(result.summary.by_category).length > 0) {
         process.stdout.write(chalk_1.default.bold('By Category:\n'));
-        for (const [cat, count] of Object.entries(result.summary.by_category)) {
+        for (const [cat, rawCount] of Object.entries(result.summary.by_category)) {
+            const count = extractCount(rawCount);
             if (count > 0) {
                 process.stdout.write(`  ${cat}: ${count}\n`);
             }
@@ -293,7 +303,8 @@ function generateMarkdownReport(result) {
     if (Object.keys(result.summary.by_severity).length > 0) {
         lines.push('### By Severity');
         lines.push('');
-        for (const [sev, count] of Object.entries(result.summary.by_severity)) {
+        for (const [sev, rawCount] of Object.entries(result.summary.by_severity)) {
+            const count = extractCount(rawCount);
             if (count > 0) {
                 lines.push(`- ${sev.toUpperCase()}: ${count}`);
             }
@@ -303,7 +314,8 @@ function generateMarkdownReport(result) {
     if (Object.keys(result.summary.by_category).length > 0) {
         lines.push('### By Category');
         lines.push('');
-        for (const [cat, count] of Object.entries(result.summary.by_category)) {
+        for (const [cat, rawCount] of Object.entries(result.summary.by_category)) {
+            const count = extractCount(rawCount);
             if (count > 0) {
                 lines.push(`- ${cat}: ${count}`);
             }

package/dist/commands/skill.js

@@ -155,6 +155,42 @@ async function downloadSkillWithFallback(config, org, skill, version) {
                 `Paid skills are loaded automatically during server execution.`);
         }
     }
+    // Check if download is disabled (server-only skill)
+    if (skillMeta && skillMeta.allow_local_download === false) {
+        if (config.apiKey) {
+            const callerOrg = await (0, api_1.getOrg)(config);
+            const isOwner = (skillMeta.org_id && callerOrg.id === skillMeta.org_id) ||
+                (skillMeta.org_slug && callerOrg.slug === skillMeta.org_slug);
+            if (isOwner) {
+                // Owner - fetch from authenticated endpoint
+                const myAgents = await (0, api_1.listMyAgents)(config);
+                const matching = myAgents.filter(a => a.name === skill && a.type === 'skill');
+                if (matching.length > 0) {
+                    let targetAgent;
+                    if (version === 'latest') {
+                        targetAgent = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+                    }
+                    else {
+                        const found = matching.find(a => a.version === version);
+                        if (!found) {
+                            throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
+                        }
+                        targetAgent = found;
+                    }
+                    const skillData = await (0, api_1.request)(config, 'GET', `/agents/${targetAgent.id}`);
+                    return {
+                        type: skillData.type,
+                        name: skillData.name,
+                        version: skillData.version,
+                        description: skillData.description,
+                        prompt: skillData.prompt,
+                    };
+                }
+            }
+        }
+        throw new errors_1.CliError(`This skill is server-only and cannot be downloaded.\n\n` +
+            `Skills are loaded automatically during server execution via 'orch call'.`);
+    }
     // Free skill or public metadata available - proceed with normal download
     if (skillMeta) {
         try {
@@ -165,11 +201,14 @@ async function downloadSkillWithFallback(config, org, skill, version) {
             if (err instanceof api_1.ApiError && err.status === 403) {
                 const payload = err.payload;
                 if (payload?.error?.code === 'PAID_AGENT_SERVER_ONLY') {
-                    // Legacy error handling (shouldn't reach here with new logic)
                     const price = payload.error.price_per_call_cents || 0;
                     throw new errors_1.CliError(`This skill costs $${(price / 100).toFixed(2)}/call and runs on server only.\n\n` +
                         `Use: orch call ${org}/${skill}@${version} --input '{...}'`);
                 }
+                if (payload?.error?.code === 'DOWNLOAD_DISABLED') {
+                    throw new errors_1.CliError(`This skill is server-only and cannot be downloaded.\n\n` +
+                        `Skills are loaded automatically during server execution via 'orch call'.`);
+                }
             }
             throw err;
         }

package/dist/lib/api.js

@@ -547,11 +547,12 @@ async function getSellerDashboardLink(config) {
 async function getSellerEarnings(config) {
     return request(config, 'GET', '/billing/earnings');
 }
-async function setAgentPricing(config, agentId, pricingMode, pricePerCallCents) {
+async function setAgentPricing(config, agentId, pricingMode, pricePerCallCents, allowLocalDownload) {
     return request(config, 'PUT', `/agents/${agentId}/pricing`, {
         body: JSON.stringify({
             pricing_mode: pricingMode,
             price_per_call_cents: pricePerCallCents,
+            allow_local_download: allowLocalDownload,
         }),
         headers: { 'Content-Type': 'application/json' },
     });

package/dist/lib/config.js

@@ -47,6 +47,7 @@ exports.getDefaultScope = getDefaultScope;
 exports.setDefaultScope = setDefaultScope;
 exports.getDefaultProvider = getDefaultProvider;
 exports.setDefaultProvider = setDefaultProvider;
+exports.unsetConfigKey = unsetConfigKey;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
@@ -152,3 +153,21 @@ async function setDefaultProvider(provider) {
     config.default_provider = provider;
     await saveConfig(config);
 }
+/**
+ * Remove a config key, restoring it to "not set" state.
+ * Maps CLI key names (kebab-case) to ConfigFile properties.
+ */
+const CONFIG_KEY_MAP = {
+    'default-format': 'default_formats',
+    'default-scope': 'default_scope',
+    'default-provider': 'default_provider',
+};
+async function unsetConfigKey(cliKey) {
+    const configProp = CONFIG_KEY_MAP[cliKey];
+    if (!configProp) {
+        throw new Error(`Unknown config key: ${cliKey}`);
+    }
+    const config = await loadConfig();
+    delete config[configProp];
+    await saveConfig(config);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.36",
+  "version": "0.3.38",
   "description": "Command-line interface for the orchagent AI agent marketplace",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",