@orchagent/cli 0.3.49 → 0.3.52

package/dist/commands/agent-keys.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAgentKeysCommand = registerAgentKeysCommand;
+const chalk_1 = __importDefault(require("chalk"));
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const errors_1 = require("../lib/errors");
+/**
+ * Resolve an agent reference ("org/agent" or just "agent") to an agent ID.
+ * Uses the authenticated list-agents endpoint and finds the latest version.
+ */
+async function resolveAgentId(config, ref) {
+    const parts = ref.split('/');
+    const agentName = parts.length >= 2 ? parts[1] : parts[0];
+    const agents = await (0, api_1.listMyAgents)(config);
+    const matching = agents.filter(a => a.name === agentName);
+    if (matching.length === 0) {
+        throw new errors_1.CliError(`Agent '${ref}' not found. Run 'orchagent agents' to list your agents.`);
+    }
+    // Use the latest version
+    const latest = matching.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
+    return { agent: latest, agentId: latest.id };
+}
+function registerAgentKeysCommand(program) {
+    const agentKeys = program
+        .command('agent-keys')
+        .description('Manage agent service keys');
+    agentKeys
+        .command('list <agent>')
+        .description('List service keys for an agent (org/name or name)')
+        .action(async (ref) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const { agent, agentId } = await resolveAgentId(config, ref);
+        const result = await (0, api_1.listAgentKeys)(config, agentId);
+        if (result.keys.length === 0) {
+            process.stdout.write(`No service keys for ${agent.name}.\n`);
+            process.stdout.write(`\nCreate one with: orchagent agent-keys create ${ref}\n`);
+            return;
+        }
+        process.stdout.write(`Service keys for ${agent.name}:\n\n`);
+        process.stdout.write(`  ${'ID'.padEnd(38)} ${'PREFIX'.padEnd(14)} ${'CREATED'.padEnd(22)} LAST USED\n`);
+        process.stdout.write(`  ${'─'.repeat(38)} ${'─'.repeat(14)} ${'─'.repeat(22)} ${'─'.repeat(22)}\n`);
+        for (const key of result.keys) {
+            const created = new Date(key.created_at).toLocaleDateString();
+            const lastUsed = key.last_used_at
+                ? new Date(key.last_used_at).toLocaleDateString()
+                : chalk_1.default.gray('never');
+            process.stdout.write(`  ${key.id.padEnd(38)} ${key.prefix.padEnd(14)} ${created.padEnd(22)} ${lastUsed}\n`);
+        }
+        process.stdout.write('\n');
+    });
+    agentKeys
+        .command('create <agent>')
+        .description('Create a new service key for an agent')
+        .action(async (ref) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const { agent } = await resolveAgentId(config, ref);
+        const result = await (0, api_1.createAgentKey)(config, agent.id);
+        process.stdout.write(`\nNew service key for ${agent.name}:\n\n`);
+        process.stdout.write(`  ${result.key}\n\n`);
+        process.stderr.write(chalk_1.default.yellow('Save this key now — it cannot be retrieved again.\n'));
+    });
+    agentKeys
+        .command('delete <agent> <key-id>')
+        .description('Delete a service key')
+        .action(async (ref, keyId) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
+        }
+        const { agent, agentId } = await resolveAgentId(config, ref);
+        await (0, api_1.deleteAgentKey)(config, agentId, keyId);
+        process.stdout.write(`Deleted key ${keyId} from ${agent.name}.\n`);
+    });
+}

package/dist/commands/index.js

@@ -27,6 +27,7 @@ const list_1 = require("./list");
 const test_1 = require("./test");
 const security_1 = require("./security");
 const billing_1 = require("./billing");
+const agent_keys_1 = require("./agent-keys");
 function registerCommands(program) {
     (0, login_1.registerLoginCommand)(program);
     (0, whoami_1.registerWhoamiCommand)(program);
@@ -54,4 +55,5 @@ function registerCommands(program) {
     (0, test_1.registerTestCommand)(program);
     (0, security_1.registerSecurityCommand)(program);
     (0, billing_1.registerBillingCommand)(program);
+    (0, agent_keys_1.registerAgentKeysCommand)(program);
 }

package/dist/commands/publish.js

@@ -14,6 +14,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
+const api_2 = require("../lib/api");
 const analytics_1 = require("../lib/analytics");
 const bundle_1 = require("../lib/bundle");
 /**
@@ -268,15 +269,38 @@ function registerPublishCommand(program) {
         if (!manifest.name) {
             throw new errors_1.CliError('orchagent.json must have name');
         }
-        // Warn about deprecated fields that are ignored
+        // Warn about deprecated prompt field
         if (manifest.prompt) {
             process.stderr.write(chalk_1.default.yellow('Warning: "prompt" field in orchagent.json is ignored. Use prompt.md file instead.\n'));
         }
-        if (manifest.input_schema) {
-            process.stderr.write(chalk_1.default.yellow('Warning: "input_schema" field in orchagent.json is ignored. Use schema.json file instead.\n'));
+        // Auto-migrate inline schemas to schema.json
+        const schemaPath = path_1.default.join(cwd, 'schema.json');
+        let schemaFileExists = false;
+        try {
+            await promises_1.default.access(schemaPath);
+            schemaFileExists = true;
         }
-        if (manifest.output_schema) {
-            process.stderr.write(chalk_1.default.yellow('Warning: "output_schema" field in orchagent.json is ignored. Use schema.json file instead.\n'));
+        catch {
+            // File doesn't exist
+        }
+        if ((manifest.input_schema || manifest.output_schema) && !schemaFileExists) {
+            // Auto-create schema.json from inline schemas
+            const schemaContent = {};
+            if (manifest.input_schema)
+                schemaContent.input = manifest.input_schema;
+            if (manifest.output_schema)
+                schemaContent.output = manifest.output_schema;
+            if (options.dryRun) {
+                process.stderr.write(chalk_1.default.cyan('Would create schema.json from inline schemas in orchagent.json\n'));
+            }
+            else {
+                await promises_1.default.writeFile(schemaPath, JSON.stringify(schemaContent, null, 2) + '\n');
+                process.stderr.write(chalk_1.default.green('Created schema.json from inline schemas in orchagent.json\n'));
+                process.stderr.write(chalk_1.default.yellow('You can now remove input_schema/output_schema from orchagent.json\n'));
+            }
+        }
+        else if ((manifest.input_schema || manifest.output_schema) && schemaFileExists) {
+            process.stderr.write(chalk_1.default.yellow('Warning: inline schemas in orchagent.json are ignored (schema.json takes priority).\n'));
         }
         // Check for misplaced manifest fields at top level (common user error)
         const manifestFields = ['manifest_version', 'dependencies', 'max_hops', 'timeout_ms', 'per_call_downstream_cap'];
@@ -361,7 +385,6 @@ function registerPublishCommand(program) {
         let inputSchema;
         let outputSchema;
         let schemaFromFile = false;
-        const schemaPath = path_1.default.join(cwd, 'schema.json');
         try {
             const raw = await promises_1.default.readFile(schemaPath, 'utf-8');
             const schemas = JSON.parse(raw);
@@ -560,6 +583,34 @@ function registerPublishCommand(program) {
             });
         }
         catch (err) {
+            // Improve SECURITY_BLOCKED error display
+            if (err instanceof api_2.ApiError && err.status === 422) {
+                const payload = err.payload;
+                const errorCode = payload?.error?.code;
+                if (errorCode === 'SECURITY_BLOCKED') {
+                    const analysis = payload?.security_analysis;
+                    const blockReason = payload?.error?.message || 'Security pattern detected';
+                    process.stderr.write(chalk_1.default.red(`\nPublish blocked: ${blockReason}\n\n`));
+                    // Show matched patterns with file:line
+                    const matches = (analysis?.matches || []);
+                    if (matches.length > 0) {
+                        process.stderr.write(chalk_1.default.yellow('Patterns detected:\n'));
+                        for (const match of matches.slice(0, 5)) {
+                            const severity = String(match.severity || '').toUpperCase();
+                            const file = match.file_path || 'unknown';
+                            const line = match.line_number || '?';
+                            const desc = match.description || match.pattern_id || '';
+                            process.stderr.write(`  ${chalk_1.default.red(severity)} ${file}:${line} — ${desc}\n`);
+                        }
+                        process.stderr.write('\n');
+                    }
+                    process.stderr.write('Skills are scanned for patterns that could instruct AI agents to\n' +
+                        'perform harmful actions (shell injection, data exfiltration, etc.).\n\n' +
+                        'Code-execution references (eval, subprocess, importlib) are allowed\n' +
+                        'since the E2B sandbox is the security boundary for code execution.\n');
+                    throw new errors_1.CliError('Publish blocked by security scan', errors_1.ExitCodes.PERMISSION_DENIED);
+                }
+            }
             throw err;
         }
         const assignedVersion = result.agent?.version || 'v1';
@@ -636,6 +687,19 @@ function registerPublishCommand(program) {
         process.stdout.write(`Type: ${manifest.type}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
         process.stdout.write(`Providers: ${supportedProviders.join(', ')}\n`);
         process.stdout.write(`Visibility: private\n`);
+        // Show security review result if available
+        const secReview = result.security_review;
+        if (secReview?.verdict) {
+            if (secReview.verdict === 'passed') {
+                process.stdout.write(`Security: ${chalk_1.default.green('passed')}\n`);
+            }
+            else if (secReview.verdict === 'flagged') {
+                process.stdout.write(`Security: ${chalk_1.default.yellow('flagged')} — ${secReview.summary || 'review recommended'}\n`);
+            }
+            else {
+                process.stdout.write(`Security: ${secReview.verdict}\n`);
+            }
+        }
         if (result.service_key) {
             process.stdout.write(`\nService key (save this - shown only once):\n`);
             process.stdout.write(`  ${result.service_key}\n`);