@orchagent/cli 0.3.48 → 0.3.51

package/dist/commands/agent-keys.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAgentKeysCommand = registerAgentKeysCommand;
+const chalk_1 = __importDefault(require("chalk"));
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const errors_1 = require("../lib/errors");
+/**
+ * Resolve an agent reference ("org/agent" or just "agent") to an agent ID.
+ * Uses the authenticated list-agents endpoint and finds the latest version.
+ */
+async function resolveAgentId(config, ref) {
+    const parts = ref.split('/');
+    const agentName = parts.length >= 2 ? parts[1] : parts[0];
+    const agents = await (0, api_1.listMyAgents)(config);
+    const matching = agents.filter(a => a.name === agentName);
+    if (matching.length === 0) {
+        throw new errors_1.CliError(`Agent '${ref}' not found. Run 'orchagent agents' to list your agents.`);
+    }
+    // Use the latest version
+    const latest = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+    return { agent: latest, agentId: latest.id };
+}
+function registerAgentKeysCommand(program) {
+    const agentKeys = program
+        .command('agent-keys')
+        .description('Manage agent service keys');
+    agentKeys
+        .command('list <agent>')
+        .description('List service keys for an agent (org/name or name)')
+        .action(async (ref) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const { agent, agentId } = await resolveAgentId(config, ref);
+        const result = await (0, api_1.listAgentKeys)(config, agentId);
+        if (result.keys.length === 0) {
+            process.stdout.write(`No service keys for ${agent.name}.\n`);
+            process.stdout.write(`\nCreate one with: orchagent agent-keys create ${ref}\n`);
+            return;
+        }
+        process.stdout.write(`Service keys for ${agent.name}:\n\n`);
+        process.stdout.write(`  ${'ID'.padEnd(38)} ${'PREFIX'.padEnd(14)} ${'CREATED'.padEnd(22)} LAST USED\n`);
+        process.stdout.write(`  ${'─'.repeat(38)} ${'─'.repeat(14)} ${'─'.repeat(22)} ${'─'.repeat(22)}\n`);
+        for (const key of result.keys) {
+            const created = new Date(key.created_at).toLocaleDateString();
+            const lastUsed = key.last_used_at
+                ? new Date(key.last_used_at).toLocaleDateString()
+                : chalk_1.default.gray('never');
+            process.stdout.write(`  ${key.id.padEnd(38)} ${key.prefix.padEnd(14)} ${created.padEnd(22)} ${lastUsed}\n`);
+        }
+        process.stdout.write('\n');
+    });
+    agentKeys
+        .command('create <agent>')
+        .description('Create a new service key for an agent')
+        .action(async (ref) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const { agent } = await resolveAgentId(config, ref);
+        const result = await (0, api_1.createAgentKey)(config, agent.id);
+        process.stdout.write(`\nNew service key for ${agent.name}:\n\n`);
+        process.stdout.write(`  ${result.key}\n\n`);
+        process.stderr.write(chalk_1.default.yellow('Save this key now — it cannot be retrieved again.\n'));
+    });
+    agentKeys
+        .command('delete <agent> <key-id>')
+        .description('Delete a service key')
+        .action(async (ref, keyId) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const { agent, agentId } = await resolveAgentId(config, ref);
+        await (0, api_1.deleteAgentKey)(config, agentId, keyId);
+        process.stdout.write(`Deleted key ${keyId} from ${agent.name}.\n`);
+    });
+}

package/dist/commands/index.js

@@ -27,6 +27,7 @@ const list_1 = require("./list");
 const test_1 = require("./test");
 const security_1 = require("./security");
 const billing_1 = require("./billing");
+const agent_keys_1 = require("./agent-keys");
 function registerCommands(program) {
     (0, login_1.registerLoginCommand)(program);
     (0, whoami_1.registerWhoamiCommand)(program);
@@ -54,4 +55,5 @@ function registerCommands(program) {
     (0, test_1.registerTestCommand)(program);
     (0, security_1.registerSecurityCommand)(program);
     (0, billing_1.registerBillingCommand)(program);
+    (0, agent_keys_1.registerAgentKeysCommand)(program);
 }

package/dist/commands/publish.js

@@ -14,6 +14,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
+const api_2 = require("../lib/api");
 const analytics_1 = require("../lib/analytics");
 const bundle_1 = require("../lib/bundle");
 /**
@@ -165,8 +166,6 @@ function registerPublishCommand(program) {
         .command('publish')
         .description('Publish agent or skill from local files')
         .option('--url <url>', 'Agent URL (for code-based agents)')
-        .option('--public', 'Make agent public')
-        .option('--private', 'Make agent private (deprecated: now the default)')
         .option('--profile <name>', 'Use API key from named profile')
         .option('--dry-run', 'Show what would be published without making changes')
         .option('--skills <skills>', 'Default skills (comma-separated, e.g., org/skill@v1,org/other@v1)')
@@ -174,9 +173,6 @@ function registerPublishCommand(program) {
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
         .option('--local-download', 'Allow users to download and run locally (default: server-only)')
         .action(async (options) => {
-        if (options.private) {
-            process.stderr.write('Warning: --private is deprecated (private is now the default). You can safely remove it.\n');
-        }
         const skillsFromFlag = options.skills
             ? options.skills.split(',').map(s => s.trim()).filter(Boolean)
             : undefined;
@@ -211,7 +207,7 @@ function registerPublishCommand(program) {
                 process.stderr.write(`  Name:        ${skillData.frontmatter.name}\n`);
                 process.stderr.write(`  Type:        skill\n`);
                 process.stderr.write(`  Version:     ${versionInfo}\n`);
-                process.stderr.write(`  Visibility:  ${options.public ? 'public' : 'private'}\n`);
+                process.stderr.write(`  Visibility:  private\n`);
                 process.stderr.write(`  Providers:   any\n`);
                 if (hasMultipleFiles) {
                     process.stderr.write(`  Files:       ${skillFiles.length} files\n`);
@@ -233,7 +229,7 @@ function registerPublishCommand(program) {
                     type: 'skill',
                     description: skillData.frontmatter.description,
                     prompt: skillData.body,
-                    is_public: options.public ? true : false,
+                    is_public: false,
                     supported_providers: ['any'],
                     default_skills: skillsFromFlag,
                     skills_locked: options.skillsLocked || undefined,
@@ -248,7 +244,7 @@ function registerPublishCommand(program) {
                 if (hasMultipleFiles) {
                     process.stdout.write(`Files: ${skillFiles.length} files included\n`);
                 }
-                process.stdout.write(`Public: ${options.public ? 'yes' : 'no'}\n`);
+                process.stdout.write(`Visibility: private\n`);
                 process.stdout.write(`\nView analytics and usage: https://orchagent.io/dashboard\n`);
             }
             catch (err) {
@@ -513,7 +509,7 @@ function registerPublishCommand(program) {
             process.stderr.write(`  Name:        ${manifest.name}\n`);
             process.stderr.write(`  Type:        ${manifest.type}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
             process.stderr.write(`  Version:     ${versionInfo}\n`);
-            process.stderr.write(`  Visibility:  ${options.public ? 'public' : 'private'}\n`);
+            process.stderr.write(`  Visibility:  private\n`);
             process.stderr.write(`  Providers:   ${supportedProviders.join(', ')}\n`);
             const effectiveSkills = skillsFromFlag || manifest.default_skills;
             const effectiveLocked = manifest.skills_locked || options.skillsLocked;
@@ -548,7 +544,7 @@ function registerPublishCommand(program) {
                 input_schema: inputSchema,
                 output_schema: outputSchema,
                 tags: manifest.tags,
-                is_public: options.public ? true : false,
+                is_public: false,
                 supported_providers: supportedProviders,
                 default_models: manifest.default_models,
                 // Local run fields for tool agents
@@ -565,6 +561,34 @@ function registerPublishCommand(program) {
             });
         }
         catch (err) {
+            // Improve SECURITY_BLOCKED error display
+            if (err instanceof api_2.ApiError && err.status === 422) {
+                const payload = err.payload;
+                const errorCode = payload?.error?.code;
+                if (errorCode === 'SECURITY_BLOCKED') {
+                    const analysis = payload?.security_analysis;
+                    const blockReason = payload?.error?.message || 'Security pattern detected';
+                    process.stderr.write(chalk_1.default.red(`\nPublish blocked: ${blockReason}\n\n`));
+                    // Show matched patterns with file:line
+                    const matches = (analysis?.matches || []);
+                    if (matches.length > 0) {
+                        process.stderr.write(chalk_1.default.yellow('Patterns detected:\n'));
+                        for (const match of matches.slice(0, 5)) {
+                            const severity = String(match.severity || '').toUpperCase();
+                            const file = match.file_path || 'unknown';
+                            const line = match.line_number || '?';
+                            const desc = match.description || match.pattern_id || '';
+                            process.stderr.write(`  ${chalk_1.default.red(severity)} ${file}:${line} — ${desc}\n`);
+                        }
+                        process.stderr.write('\n');
+                    }
+                    process.stderr.write('Skills are scanned for patterns that could instruct AI agents to\n' +
+                        'perform harmful actions (shell injection, data exfiltration, etc.).\n\n' +
+                        'Code-execution references (eval, subprocess, importlib) are allowed\n' +
+                        'since the E2B sandbox is the security boundary for code execution.\n');
+                    throw new errors_1.CliError('Publish blocked by security scan', errors_1.ExitCodes.PERMISSION_DENIED);
+                }
+            }
             throw err;
         }
         const assignedVersion = result.agent?.version || 'v1';
@@ -640,7 +664,20 @@ function registerPublishCommand(program) {
         process.stdout.write(`\nPublished agent: ${org.slug}/${manifest.name}@${assignedVersion}\n`);
         process.stdout.write(`Type: ${manifest.type}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
         process.stdout.write(`Providers: ${supportedProviders.join(', ')}\n`);
-        process.stdout.write(`Public: ${options.public ? 'yes' : 'no'}\n`);
+        process.stdout.write(`Visibility: private\n`);
+        // Show security review result if available
+        const secReview = result.security_review;
+        if (secReview?.verdict) {
+            if (secReview.verdict === 'passed') {
+                process.stdout.write(`Security: ${chalk_1.default.green('passed')}\n`);
+            }
+            else if (secReview.verdict === 'flagged') {
+                process.stdout.write(`Security: ${chalk_1.default.yellow('flagged')} — ${secReview.summary || 'review recommended'}\n`);
+            }
+            else {
+                process.stdout.write(`Security: ${secReview.verdict}\n`);
+            }
+        }
         if (result.service_key) {
             process.stdout.write(`\nService key (save this - shown only once):\n`);
             process.stdout.write(`  ${result.service_key}\n`);