@orchagent/cli 0.3.38 → 0.3.40

package/dist/commands/init.js

@@ -84,10 +84,10 @@ if __name__ == "__main__":
 function readmeTemplate(agentName, type) {
     const callExample = type === 'code'
         ? `orchagent call ${agentName} input-file.txt`
-        : `orchagent call ${agentName} --data '{"input": "Hello world"}'`;
+        : `orchagent call ${agentName} --data '{"${type === 'agentic' ? 'task' : 'input'}": "Hello world"}'`;
     const runExample = type === 'code'
         ? `orchagent run ${agentName} --input '{"file_path": "src/app.py"}'`
-        : `orchagent run ${agentName} --input '{"input": "Hello world"}'`;
+        : `orchagent run ${agentName} --input '{"${type === 'agentic' ? 'task' : 'input'}": "Hello world"}'`;
     return `# ${agentName}
 
 A brief description of what this agent does.
@@ -119,6 +119,61 @@ ${runExample}
 | \`result\` | string | The agent's response |
 `;
 }
+const AGENTIC_MANIFEST_TEMPLATE = `{
+  "name": "my-agent",
+  "description": "An agentic AI agent with tool use",
+  "type": "agentic",
+  "supported_providers": ["anthropic"],
+  "max_turns": 25,
+  "timeout_seconds": 300,
+  "custom_tools": [
+    {
+      "name": "run_tests",
+      "description": "Run the test suite",
+      "command": "pytest"
+    }
+  ]
+}
+`;
+const AGENTIC_PROMPT_TEMPLATE = `You are a helpful AI agent with access to a sandboxed environment.
+
+Given the input, complete the task using the available tools:
+- Use bash to run commands
+- Use read_file and write_file to work with files
+- Use custom tools defined by the agent author
+- Call submit_result when you're done
+
+Input: The caller's input will be provided as JSON.
+
+Work step by step, verify your results, and submit the final output.
+`;
+const AGENTIC_SCHEMA_TEMPLATE = `{
+  "input": {
+    "type": "object",
+    "properties": {
+      "task": {
+        "type": "string",
+        "description": "The task to complete"
+      }
+    },
+    "required": ["task"]
+  },
+  "output": {
+    "type": "object",
+    "properties": {
+      "result": {
+        "type": "string",
+        "description": "The result of the task"
+      },
+      "success": {
+        "type": "boolean",
+        "description": "Whether the task completed successfully"
+      }
+    },
+    "required": ["result", "success"]
+  }
+}
+`;
 const SKILL_TEMPLATE = `---
 name: my-skill
 description: When to use this skill
@@ -134,7 +189,7 @@ function registerInitCommand(program) {
         .command('init')
         .description('Initialize a new agent project')
         .argument('[name]', 'Agent name (default: current directory name)')
-        .option('--type <type>', 'Type: prompt, code, or skill (default: prompt)', 'prompt')
+        .option('--type <type>', 'Type: prompt, code, agentic, or skill (default: prompt)', 'prompt')
         .action(async (name, options) => {
         const cwd = process.cwd();
         // When a name is provided, create a subdirectory for the project
@@ -187,21 +242,30 @@ function registerInitCommand(program) {
                 throw err;
             }
         }
-        // Create manifest
-        const manifest = JSON.parse(MANIFEST_TEMPLATE);
-        manifest.name = agentName;
-        manifest.type = ['code', 'skill'].includes(options.type) ? options.type : 'prompt';
-        await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
-        // Create prompt template (for prompt-based agents) or entrypoint (for code agents)
-        if (options.type === 'code') {
-            const entrypointPath = path_1.default.join(targetDir, 'main.py');
-            await promises_1.default.writeFile(entrypointPath, CODE_TEMPLATE_PY);
+        // Create manifest and type-specific files
+        if (options.type === 'agentic') {
+            const manifest = JSON.parse(AGENTIC_MANIFEST_TEMPLATE);
+            manifest.name = agentName;
+            await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+            await promises_1.default.writeFile(promptPath, AGENTIC_PROMPT_TEMPLATE);
+            await promises_1.default.writeFile(schemaPath, AGENTIC_SCHEMA_TEMPLATE);
         }
         else {
-            await promises_1.default.writeFile(promptPath, PROMPT_TEMPLATE);
+            const manifest = JSON.parse(MANIFEST_TEMPLATE);
+            manifest.name = agentName;
+            manifest.type = ['code', 'skill'].includes(options.type) ? options.type : 'prompt';
+            await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+            // Create prompt template (for prompt-based agents) or entrypoint (for code agents)
+            if (options.type === 'code') {
+                const entrypointPath = path_1.default.join(targetDir, 'main.py');
+                await promises_1.default.writeFile(entrypointPath, CODE_TEMPLATE_PY);
+            }
+            else {
+                await promises_1.default.writeFile(promptPath, PROMPT_TEMPLATE);
+            }
+            // Create schema template
+            await promises_1.default.writeFile(schemaPath, SCHEMA_TEMPLATE);
         }
-        // Create schema template
-        await promises_1.default.writeFile(schemaPath, SCHEMA_TEMPLATE);
         // Create README
         const readmePath = path_1.default.join(targetDir, 'README.md');
         await promises_1.default.writeFile(readmePath, readmeTemplate(agentName, options.type));
@@ -218,7 +282,17 @@ function registerInitCommand(program) {
         process.stdout.write(`  ${prefix}schema.json    - Input/output schemas\n`);
         process.stdout.write(`  ${prefix}README.md      - Agent documentation\n`);
         process.stdout.write(`\nNext steps:\n`);
-        if (options.type !== 'code') {
+        if (options.type === 'agentic') {
+            const stepNum = name ? 2 : 1;
+            if (name) {
+                process.stdout.write(`  1. cd ${name}\n`);
+            }
+            process.stdout.write(`  ${stepNum}. Edit prompt.md with your agent instructions\n`);
+            process.stdout.write(`  ${stepNum + 1}. Edit custom_tools in orchagent.json for your environment\n`);
+            process.stdout.write(`  ${stepNum + 2}. Edit schema.json with your input/output schemas\n`);
+            process.stdout.write(`  ${stepNum + 3}. Run: orchagent publish\n`);
+        }
+        else if (options.type !== 'code') {
             const stepNum = name ? 2 : 1;
             if (name) {
                 process.stdout.write(`  1. cd ${name}\n`);

package/dist/commands/publish.js

@@ -328,16 +328,16 @@ function registerPublishCommand(program) {
                 `  }\n\n` +
                 `See docs/manifest.md for details.`);
         }
-        // Read prompt (for prompt-based agents and skills)
+        // Read prompt (for prompt-based, agentic, and skill agents)
         let prompt;
-        if (manifest.type === 'prompt' || manifest.type === 'skill') {
+        if (manifest.type === 'prompt' || manifest.type === 'skill' || manifest.type === 'agentic') {
             const promptPath = path_1.default.join(cwd, 'prompt.md');
             try {
                 prompt = await promises_1.default.readFile(promptPath, 'utf-8');
             }
             catch (err) {
                 if (err.code === 'ENOENT') {
-                    const agentTypeName = manifest.type === 'skill' ? 'skill' : 'prompt-based agent';
+                    const agentTypeName = manifest.type === 'skill' ? 'skill' : manifest.type === 'agentic' ? 'agentic agent' : 'prompt-based agent';
                     throw new errors_1.CliError(`No prompt.md found for ${agentTypeName}.\n\n` +
                         'Create a prompt.md file in the current directory with your prompt template.\n' +
                         'See: https://orchagent.io/docs/publishing');
@@ -345,6 +345,39 @@ function registerPublishCommand(program) {
                 throw err;
             }
         }
+        // For agentic agents, validate custom_tools and build manifest
+        if (manifest.type === 'agentic') {
+            // Validate custom_tools format
+            if (manifest.custom_tools) {
+                for (const tool of manifest.custom_tools) {
+                    if (!tool.name || !tool.command) {
+                        throw new errors_1.CliError(`Invalid custom_tool: each tool must have 'name' and 'command' fields.\n` +
+                            `Found: ${JSON.stringify(tool)}`);
+                    }
+                }
+            }
+            // Validate max_turns
+            if (manifest.max_turns !== undefined) {
+                if (typeof manifest.max_turns !== 'number' || manifest.max_turns < 1 || manifest.max_turns > 50) {
+                    throw new errors_1.CliError('max_turns must be a number between 1 and 50');
+                }
+            }
+            // Store agentic config in manifest field
+            const agenticManifest = {
+                ...(manifest.manifest || {}),
+            };
+            if (manifest.custom_tools) {
+                agenticManifest.custom_tools = manifest.custom_tools;
+            }
+            if (manifest.max_turns) {
+                agenticManifest.max_turns = manifest.max_turns;
+            }
+            manifest.manifest = agenticManifest;
+            // Agentic agents default to anthropic provider
+            if (!manifest.supported_providers) {
+                manifest.supported_providers = ['anthropic'];
+            }
+        }
         // Read schemas
         let inputSchema;
         let outputSchema;
@@ -363,7 +396,8 @@ function registerPublishCommand(program) {
                 throw new errors_1.CliError(`Failed to read schema.json: ${err}`);
             }
         }
-        // For prompt agents, derive input schema from template variables if needed
+        // For prompt/skill agents, derive input schema from template variables if needed
+        // (Agentic agents use schema.json directly — no template variable derivation)
         if (prompt && (manifest.type === 'prompt' || manifest.type === 'skill')) {
             const templateVars = extractTemplateVariables(prompt);
             if (templateVars.length > 0) {
@@ -391,9 +425,26 @@ function registerPublishCommand(program) {
             }
         }
         // For code-based agents, either --url is required OR we bundle the code
+        // For agentic agents, use internal placeholder (no user code, platform handles execution)
         let agentUrl = options.url;
         let shouldUploadBundle = false;
-        if (manifest.type === 'code' && !options.url) {
+        if (manifest.type === 'agentic') {
+            // Agentic agents don't need a URL or code bundle
+            agentUrl = agentUrl || 'https://agentic-agent.internal';
+            // But they can include a Dockerfile for custom environments
+            if (options.docker) {
+                const dockerfilePath = path_1.default.join(cwd, 'Dockerfile');
+                try {
+                    await promises_1.default.access(dockerfilePath);
+                    shouldUploadBundle = true;
+                    process.stdout.write(`Including Dockerfile for custom environment\n`);
+                }
+                catch {
+                    throw new errors_1.CliError('--docker flag specified but no Dockerfile found in project directory');
+                }
+            }
+        }
+        else if (manifest.type === 'code' && !options.url) {
             // Check if this looks like a Python or JS project that can be bundled
             const entrypoint = manifest.entrypoint || await (0, bundle_1.detectEntrypoint)(cwd);
             if (entrypoint) {
@@ -441,6 +492,18 @@ function registerPublishCommand(program) {
                     process.stderr.write(`  ✓ Input schema derived from template variables: ${vars.join(', ')}\n`);
                 }
             }
+            else if (manifest.type === 'agentic') {
+                // Agentic agent validations
+                const promptBytes = prompt ? Buffer.byteLength(prompt, 'utf-8') : 0;
+                process.stderr.write(`  ✓ prompt.md found (${promptBytes.toLocaleString()} bytes)\n`);
+                if (schemaFromFile) {
+                    const schemaTypes = [inputSchema ? 'input' : null, outputSchema ? 'output' : null].filter(Boolean).join(' + ');
+                    process.stderr.write(`  ✓ schema.json found (${schemaTypes} schemas)\n`);
+                }
+                const customToolCount = manifest.custom_tools?.length || 0;
+                process.stderr.write(`  ✓ Custom tools: ${customToolCount}\n`);
+                process.stderr.write(`  ✓ Max turns: ${manifest.max_turns || 25}\n`);
+            }
             else if (manifest.type === 'code') {
                 // Code agent validations
                 const entrypoint = manifest.entrypoint || await (0, bundle_1.detectEntrypoint)(cwd);
@@ -522,7 +585,7 @@ function registerPublishCommand(program) {
         }
         const assignedVersion = result.agent?.version || 'v1';
         const agentId = result.agent?.id;
-        // Upload code bundle if this is a hosted code agent
+        // Upload code bundle if this is a hosted code agent or agentic agent with --docker
         if (shouldUploadBundle && agentId) {
             process.stdout.write(`\nBundling code...\n`);
             const tempDir = await promises_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), 'orchagent-bundle-'));
@@ -541,8 +604,20 @@ function registerPublishCommand(program) {
                         throw new errors_1.CliError('--docker flag specified but no Dockerfile found in project directory');
                     }
                 }
+                // For agentic agents, also include requirements.txt if present
+                if (manifest.type === 'agentic') {
+                    const reqPath = path_1.default.join(cwd, 'requirements.txt');
+                    try {
+                        await promises_1.default.access(reqPath);
+                        includePatterns.push('requirements.txt');
+                        process.stdout.write(`  Including requirements.txt for sandbox dependencies\n`);
+                    }
+                    catch {
+                        // Optional
+                    }
+                }
                 const bundleResult = await (0, bundle_1.createCodeBundle)(cwd, bundlePath, {
-                    entrypoint: manifest.entrypoint,
+                    entrypoint: manifest.type === 'agentic' ? undefined : manifest.entrypoint,
                     exclude: manifest.bundle?.exclude,
                     include: includePatterns.length > 0 ? includePatterns : undefined,
                 });

package/dist/commands/security.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractCount = extractCount;
 exports.registerSecurityCommand = registerSecurityCommand;
+exports.generateMarkdownReport = generateMarkdownReport;
 const promises_1 = __importDefault(require("fs/promises"));
 const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../lib/config");
@@ -82,26 +83,28 @@ function formatSummaryOutput(result) {
     // Summary stats
     process.stdout.write(`${chalk_1.default.bold('Attacks Tested:')} ${result.total_attacks}\n`);
     process.stdout.write(`${chalk_1.default.bold('Vulnerabilities Found:')} ${result.vulnerabilities_found}\n\n`);
-    // Breakdown by severity
+    // Breakdown by severity — show all tested levels, not just those with leaks
     if (Object.keys(result.summary.by_severity).length > 0) {
         process.stdout.write(chalk_1.default.bold('By Severity:\n'));
         const severityOrder = ['critical', 'high', 'medium', 'low'];
-        for (const sev of severityOrder) {
-            const count = extractCount(result.summary.by_severity[sev]);
-            if (count > 0) {
-                process.stdout.write(`  ${severityColor(sev)}: ${count}\n`);
-            }
+        const entries = Object.entries(result.summary.by_severity)
+            .sort(([a], [b]) => {
+            const ai = severityOrder.indexOf(a);
+            const bi = severityOrder.indexOf(b);
+            return (ai === -1 ? 999 : ai) - (bi === -1 ? 999 : bi);
+        });
+        for (const [sev, rawCount] of entries) {
+            const count = extractCount(rawCount);
+            process.stdout.write(`  ${severityColor(sev)}: ${count}\n`);
         }
         process.stdout.write('\n');
     }
-    // Breakdown by category
+    // Breakdown by category — show all tested categories
     if (Object.keys(result.summary.by_category).length > 0) {
         process.stdout.write(chalk_1.default.bold('By Category:\n'));
         for (const [cat, rawCount] of Object.entries(result.summary.by_category)) {
             const count = extractCount(rawCount);
-            if (count > 0) {
-                process.stdout.write(`  ${cat}: ${count}\n`);
-            }
+            process.stdout.write(`  ${cat}: ${count}\n`);
         }
         process.stdout.write('\n');
     }
@@ -305,9 +308,7 @@ function generateMarkdownReport(result) {
         lines.push('');
         for (const [sev, rawCount] of Object.entries(result.summary.by_severity)) {
             const count = extractCount(rawCount);
-            if (count > 0) {
-                lines.push(`- ${sev.toUpperCase()}: ${count}`);
-            }
+            lines.push(`- ${sev.toUpperCase()}: ${count}`);
         }
         lines.push('');
     }
@@ -316,9 +317,7 @@ function generateMarkdownReport(result) {
         lines.push('');
         for (const [cat, rawCount] of Object.entries(result.summary.by_category)) {
             const count = extractCount(rawCount);
-            if (count > 0) {
-                lines.push(`- ${cat}: ${count}`);
-            }
+            lines.push(`- ${cat}: ${count}`);
         }
         lines.push('');
     }

package/dist/lib/doctor/checks/environment.js

@@ -9,6 +9,7 @@ exports.checkGitAvailable = checkGitAvailable;
 exports.runEnvironmentChecks = runEnvironmentChecks;
 const child_process_1 = require("child_process");
 const package_json_1 = __importDefault(require("../../../../package.json"));
+const update_notifier_1 = require("../../update-notifier");
 const REQUIRED_NODE_MAJOR = 18;
 /**
  * Check if Node.js version is 18+.
@@ -40,8 +41,9 @@ async function checkNodeVersion() {
 async function checkCliVersion() {
     const installedVersion = package_json_1.default.version;
     try {
-        // Fetch latest version from npm registry
-        const response = await fetch('https://registry.npmjs.org/@orchagent/cli/latest', { signal: AbortSignal.timeout(5000) });
+        // Fetch latest version from the same dist-tags endpoint the update banner uses,
+        // so both always agree on the latest version (fixes D-1 inconsistency).
+        const response = await fetch(update_notifier_1.DIST_TAGS_URL, { signal: AbortSignal.timeout(5000) });
         if (!response.ok) {
             return {
                 category: 'environment',
@@ -52,7 +54,9 @@ async function checkCliVersion() {
             };
         }
         const data = (await response.json());
-        const latestVersion = data.version;
+        const latestVersion = data.latest;
+        // Sync the update-notifier cache so the banner shows the same version
+        (0, update_notifier_1.writeCache)(latestVersion);
         if (installedVersion === latestVersion) {
             return {
                 category: 'environment',

package/dist/lib/update-notifier.js

@@ -18,6 +18,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DIST_TAGS_URL = void 0;
+exports.writeCache = writeCache;
 exports.checkForUpdates = checkForUpdates;
 exports.printUpdateNotification = printUpdateNotification;
 const https_1 = __importDefault(require("https"));
@@ -30,6 +32,8 @@ const CACHE_DIR = path_1.default.join(os_1.default.homedir(), '.orchagent');
 const CACHE_PATH = path_1.default.join(CACHE_DIR, 'update-check.json');
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const REQUEST_TIMEOUT_MS = 5000;
+/** npm dist-tags endpoint — single source of truth for latest version. */
+exports.DIST_TAGS_URL = `https://registry.npmjs.org/-/package/${PACKAGE_NAME}/dist-tags`;
 // ── Cache I/O ──────────────────────────────────────────────────────────
 function readCache() {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.38",
+  "version": "0.3.40",
   "description": "Command-line interface for the orchagent AI agent marketplace",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",