@orchagent/cli 0.3.37 → 0.3.38

package/dist/commands/install.js

@@ -86,6 +86,37 @@ async function downloadAgentWithFallback(config, org, name, version) {
                 `Use: orch call ${org}/${name}@${version} --input '{...}'`);
         }
     }
+    // Check if download is disabled (server-only agent)
+    if (publicMeta && publicMeta.allow_local_download === false) {
+        // Check if owner (can bypass)
+        if (config.apiKey) {
+            const callerOrg = await (0, api_1.getOrg)(config);
+            const isOwner = (publicMeta.org_id && callerOrg.id === publicMeta.org_id) ||
+                (publicMeta.org_slug && callerOrg.slug === publicMeta.org_slug);
+            if (isOwner) {
+                // Owner - fetch from authenticated endpoint
+                const myAgents = await (0, api_1.listMyAgents)(config);
+                const matching = myAgents.filter(a => a.name === name);
+                if (matching.length > 0) {
+                    let targetAgent;
+                    if (version === 'latest') {
+                        targetAgent = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+                    }
+                    else {
+                        const found = matching.find(a => a.version === version);
+                        if (!found) {
+                            throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
+                        }
+                        targetAgent = found;
+                    }
+                    const agentData = await (0, api_1.request)(config, 'GET', `/agents/${targetAgent.id}`);
+                    return { ...agentData, org_slug: org };
+                }
+            }
+        }
+        throw new errors_1.CliError(`This agent is server-only and cannot be downloaded.\n\n` +
+            `Use: orch call ${org}/${name}@${version} --input '{...}'`);
+    }
     // Free agent - proceed normally with public data
     if (publicMeta) {
         // Cast PublicAgent to Agent for use as CanonicalAgent

package/dist/commands/pricing.js

@@ -12,7 +12,9 @@ function registerPricingCommand(program) {
     program
         .command('pricing <agent> <mode>')
         .description('Set pricing for your agent (free or per-call in USD)')
-        .action(async (agentRef, mode) => {
+        .option('--local-download', 'Allow users to download and run locally')
+        .option('--no-local-download', 'Restrict to server-only (orch call)')
+        .action(async (agentRef, mode, options) => {
         const resolved = await (0, config_1.getResolvedConfig)();
         // Parse agent reference
         const [orgOrAgent, maybeName] = agentRef.split('/');
@@ -56,17 +58,36 @@ function registerPricingCommand(program) {
             pricingMode = 'per_call';
             pricePerCallCents = Math.round(priceFloat * 100);
         }
+        // Determine allow_local_download value
+        let allowLocalDownload;
+        if (pricingMode === 'per_call') {
+            // Paid agents are always server-only
+            allowLocalDownload = false;
+            if (options.localDownload) {
+                process.stderr.write(chalk_1.default.yellow('Note: Paid agents are always server-only. --local-download ignored.\n'));
+            }
+        }
+        else if (options.localDownload !== undefined) {
+            allowLocalDownload = options.localDownload;
+        }
         // Set pricing
-        await (0, api_1.setAgentPricing)(resolved, agent.id, pricingMode, pricePerCallCents);
+        await (0, api_1.setAgentPricing)(resolved, agent.id, pricingMode, pricePerCallCents, allowLocalDownload);
         // Show confirmation
         process.stdout.write(chalk_1.default.green('✓ Pricing updated\n'));
         process.stdout.write(`Agent: ${org}/${agentName}\n`);
         if (pricingMode === 'free') {
             process.stdout.write(`Mode: FREE\n`);
+            if (allowLocalDownload === true) {
+                process.stdout.write(`Local download: enabled\n`);
+            }
+            else if (allowLocalDownload === false) {
+                process.stdout.write(`Local download: disabled (server-only)\n`);
+            }
         }
         else {
             process.stdout.write(`Mode: Pay per call\n`);
             process.stdout.write(`Price: $${(pricePerCallCents / 100).toFixed(2)} USD per call\n`);
+            process.stdout.write(`Local download: disabled (paid agents are server-only)\n`);
         }
     });
 }

package/dist/commands/publish.js

@@ -54,36 +54,6 @@ function deriveInputSchema(variables) {
         required: [...variables],
     };
 }
-/**
- * Handle security flagged error response (422 with error: 'content_flagged')
- * Returns true if the error was handled, false otherwise
- */
-function handleSecurityFlaggedError(err) {
-    if (!(err instanceof api_1.ApiError) || err.status !== 422) {
-        return false;
-    }
-    const payload = err.payload;
-    if (payload?.error !== 'content_flagged') {
-        return false;
-    }
-    process.stderr.write('\n');
-    process.stderr.write('Error: Skill flagged for security review\n\n');
-    if (payload.concerns && payload.concerns.length > 0) {
-        process.stderr.write('Concerns found:\n');
-        for (const concern of payload.concerns) {
-            const severityLabel = concern.severity.toUpperCase();
-            const fileInfo = concern.file_path ? ` in ${concern.file_path}` : '';
-            process.stderr.write(`  [${severityLabel}] ${concern.category}${fileInfo}\n`);
-            process.stderr.write(`    "${concern.description}"\n\n`);
-        }
-    }
-    if (payload.summary) {
-        process.stderr.write(`Summary: ${payload.summary}\n\n`);
-    }
-    process.stderr.write('Please review and remove suspicious patterns before publishing.\n');
-    process.stderr.write('If you believe this is a false positive, contact support@orchagent.com\n');
-    return true;
-}
 /**
  * Check if orchagent-sdk is listed in requirements.txt or pyproject.toml
  */
@@ -204,6 +174,7 @@ function registerPublishCommand(program) {
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
         .option('--price <amount>', 'Set price per call in USD (e.g., 0.50 for $0.50/call)')
         .option('--pricing-mode <mode>', 'Pricing mode: free or per_call (default: free)')
+        .option('--local-download', 'Allow users to download and run locally (default: server-only)')
         .action(async (options) => {
         if (options.private) {
             process.stderr.write('Warning: --private is deprecated (private is now the default). You can safely remove it.\n');
@@ -270,6 +241,7 @@ function registerPublishCommand(program) {
                     skills_locked: options.skillsLocked || undefined,
                     // SC-05: Include all skill files for UI preview
                     skill_files: hasMultipleFiles ? skillFiles : undefined,
+                    allow_local_download: options.localDownload || false,
                 });
                 const skillVersion = skillResult.agent?.version || 'v1';
                 const skillAgentId = skillResult.agent?.id;
@@ -316,9 +288,6 @@ function registerPublishCommand(program) {
                 process.stdout.write(`\nView analytics and usage: https://orchagent.io/dashboard\n`);
             }
             catch (err) {
-                if (handleSecurityFlaggedError(err)) {
-                    process.exit(1);
-                }
                 throw err;
             }
             return;
@@ -545,12 +514,10 @@ function registerPublishCommand(program) {
                 manifest: manifest.manifest,
                 default_skills: skillsFromFlag || manifest.default_skills,
                 skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
+                allow_local_download: options.localDownload || false,
             });
         }
         catch (err) {
-            if (handleSecurityFlaggedError(err)) {
-                process.exit(1);
-            }
             throw err;
         }
         const assignedVersion = result.agent?.version || 'v1';

package/dist/commands/run.js

@@ -74,11 +74,12 @@ async function downloadAgent(config, org, agent, version) {
         return await (0, api_1.publicRequest)(config, `/public/agents/${org}/${agent}/${version}/download`);
     }
     catch (err) {
-        // Check for paid-agent error
+        // Check for paid-agent or download-disabled error
         if (err instanceof api_1.ApiError && err.status === 403) {
             const payload = err.payload;
-            if (payload?.error?.code === 'PAID_AGENT_SERVER_ONLY') {
-                // Paid agent - try owner path if authenticated
+            const errorCode = payload?.error?.code;
+            if (errorCode === 'PAID_AGENT_SERVER_ONLY' || errorCode === 'DOWNLOAD_DISABLED') {
+                // Try owner path if authenticated
                 if (config.apiKey) {
                     try {
                         const myAgents = await (0, api_1.listMyAgents)(config);
@@ -112,10 +113,16 @@ async function downloadAgent(config, org, agent, version) {
                     }
                 }
                 // Non-owner - block with helpful message
-                const price = payload.error.price_per_call_cents || 0;
-                const priceStr = price ? `$${(price / 100).toFixed(2)}/call` : 'PAID';
-                throw new errors_1.CliError(`This agent is paid (${priceStr}) and runs on server only.\n\n` +
-                    `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+                if (errorCode === 'PAID_AGENT_SERVER_ONLY') {
+                    const price = payload.error.price_per_call_cents || 0;
+                    const priceStr = price ? `$${(price / 100).toFixed(2)}/call` : 'PAID';
+                    throw new errors_1.CliError(`This agent is paid (${priceStr}) and runs on server only.\n\n` +
+                        `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+                }
+                else {
+                    throw new errors_1.CliError(`This agent is server-only and cannot be downloaded.\n\n` +
+                        `Use: orch call ${org}/${agent}@${version} --input '{...}'`);
+                }
             }
         }
         if (!(err instanceof api_1.ApiError) || err.status !== 404)

package/dist/commands/skill.js

@@ -155,6 +155,42 @@ async function downloadSkillWithFallback(config, org, skill, version) {
                 `Paid skills are loaded automatically during server execution.`);
         }
     }
+    // Check if download is disabled (server-only skill)
+    if (skillMeta && skillMeta.allow_local_download === false) {
+        if (config.apiKey) {
+            const callerOrg = await (0, api_1.getOrg)(config);
+            const isOwner = (skillMeta.org_id && callerOrg.id === skillMeta.org_id) ||
+                (skillMeta.org_slug && callerOrg.slug === skillMeta.org_slug);
+            if (isOwner) {
+                // Owner - fetch from authenticated endpoint
+                const myAgents = await (0, api_1.listMyAgents)(config);
+                const matching = myAgents.filter(a => a.name === skill && a.type === 'skill');
+                if (matching.length > 0) {
+                    let targetAgent;
+                    if (version === 'latest') {
+                        targetAgent = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+                    }
+                    else {
+                        const found = matching.find(a => a.version === version);
+                        if (!found) {
+                            throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
+                        }
+                        targetAgent = found;
+                    }
+                    const skillData = await (0, api_1.request)(config, 'GET', `/agents/${targetAgent.id}`);
+                    return {
+                        type: skillData.type,
+                        name: skillData.name,
+                        version: skillData.version,
+                        description: skillData.description,
+                        prompt: skillData.prompt,
+                    };
+                }
+            }
+        }
+        throw new errors_1.CliError(`This skill is server-only and cannot be downloaded.\n\n` +
+            `Skills are loaded automatically during server execution via 'orch call'.`);
+    }
     // Free skill or public metadata available - proceed with normal download
     if (skillMeta) {
         try {
@@ -165,11 +201,14 @@ async function downloadSkillWithFallback(config, org, skill, version) {
             if (err instanceof api_1.ApiError && err.status === 403) {
                 const payload = err.payload;
                 if (payload?.error?.code === 'PAID_AGENT_SERVER_ONLY') {
-                    // Legacy error handling (shouldn't reach here with new logic)
                     const price = payload.error.price_per_call_cents || 0;
                     throw new errors_1.CliError(`This skill costs $${(price / 100).toFixed(2)}/call and runs on server only.\n\n` +
                         `Use: orch call ${org}/${skill}@${version} --input '{...}'`);
                 }
+                if (payload?.error?.code === 'DOWNLOAD_DISABLED') {
+                    throw new errors_1.CliError(`This skill is server-only and cannot be downloaded.\n\n` +
+                        `Skills are loaded automatically during server execution via 'orch call'.`);
+                }
             }
             throw err;
         }

package/dist/lib/api.js

@@ -547,11 +547,12 @@ async function getSellerDashboardLink(config) {
 async function getSellerEarnings(config) {
     return request(config, 'GET', '/billing/earnings');
 }
-async function setAgentPricing(config, agentId, pricingMode, pricePerCallCents) {
+async function setAgentPricing(config, agentId, pricingMode, pricePerCallCents, allowLocalDownload) {
     return request(config, 'PUT', `/agents/${agentId}/pricing`, {
         body: JSON.stringify({
             pricing_mode: pricingMode,
             price_per_call_cents: pricePerCallCents,
+            allow_local_download: allowLocalDownload,
         }),
         headers: { 'Content-Type': 'application/json' },
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.37",
+  "version": "0.3.38",
   "description": "Command-line interface for the orchagent AI agent marketplace",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",