@orchagent/cli 0.3.61 → 0.3.63

package/dist/commands/github.js

@@ -226,13 +226,10 @@ async function importFromGitHub(config, repo, options) {
             selectedPath = selection.path;
         }
     }
-    // Determine visibility (default to public)
-    const isPublic = options.private ? false : true;
     const importResult = await (0, api_1.request)(config, 'POST', '/github/import', {
         body: JSON.stringify({
             repo,
             path: selectedPath,
-            is_public: isPublic,
             name: options.name,
         }),
         headers: { 'Content-Type': 'application/json' },
@@ -240,7 +237,6 @@ async function importFromGitHub(config, repo, options) {
     await (0, analytics_1.track)('cli_github_import', {
         repo,
         path: selectedPath,
-        is_public: isPublic,
         type: importResult.agent.type,
     });
     if (options.json) {
@@ -253,7 +249,6 @@ async function importFromGitHub(config, repo, options) {
     process.stdout.write(`  Agent:   ${importResult.agent.name}\n`);
     process.stdout.write(`  Version: ${importResult.agent.version}\n`);
     process.stdout.write(`  Type:    ${importResult.agent.type}\n`);
-    process.stdout.write(`  Public:  ${isPublic ? chalk_1.default.green('Yes') : chalk_1.default.yellow('No')}\n`);
     process.stdout.write('\n');
 }
 async function getSyncConfig(config, agentId, options) {
@@ -335,8 +330,6 @@ function registerGitHubCommand(program) {
         .command('import <repo>')
         .description('Import an agent or skill from GitHub')
         .option('--path <path>', 'Path to manifest within repo (scans if not specified)')
-        .option('--public', 'Make the agent public (default)')
-        .option('--private', 'Make the agent private')
         .option('--name <name>', 'Override agent name')
         .option('--json', 'Output raw JSON')
         .action(async (repo, options) => {

package/dist/commands/index.js

@@ -33,6 +33,7 @@ const schedule_1 = require("./schedule");
 const service_1 = require("./service");
 const transfer_1 = require("./transfer");
 const pull_1 = require("./pull");
+const logs_1 = require("./logs");
 function registerCommands(program) {
     (0, login_1.registerLoginCommand)(program);
     (0, whoami_1.registerWhoamiCommand)(program);
@@ -66,4 +67,5 @@ function registerCommands(program) {
     (0, service_1.registerServiceCommand)(program);
     (0, transfer_1.registerTransferCommand)(program);
     (0, pull_1.registerPullCommand)(program);
+    (0, logs_1.registerLogsCommand)(program);
 }

package/dist/commands/info.js

@@ -60,6 +60,7 @@ async function getAgentInfo(config, org, agent, version) {
             version: publicMeta.version,
             description: (publicMeta.description ?? undefined),
             supported_providers: publicMeta.supported_providers || ['any'],
+            callable: publicMeta.callable ?? false,
             input_schema: publicMeta.input_schema,
             output_schema: publicMeta.output_schema,
             source_url: meta.source_url,
@@ -103,6 +104,7 @@ async function getAgentInfo(config, org, agent, version) {
         version: targetAgent.version,
         description: targetAgent.description,
         prompt: targetAgent.prompt,
+        callable: targetAgent.callable ?? false,
         input_schema: targetAgent.input_schema,
         output_schema: targetAgent.output_schema,
         supported_providers: targetAgent.supported_providers || ['any'],
@@ -140,6 +142,9 @@ function registerInfoCommand(program) {
             process.stdout.write(`${agentData.description}\n\n`);
         }
         process.stdout.write(`Type: ${agentData.type}\n`);
+        if (agentData.callable) {
+            process.stdout.write(`Callable: ${chalk_1.default.green('yes')} — other agents can invoke this via the orchagent SDK\n`);
+        }
         process.stdout.write(`Providers: ${agentData.supported_providers.join(', ')}\n`);
         // Display pricing information
         const priceStr = (0, pricing_1.formatPrice)(agentData);

package/dist/commands/init.js

@@ -72,6 +72,9 @@ def main():
     user_input = data.get("input", "")
 
     # --- Your logic here ---
+    # To use workspace secrets, add them to "required_secrets" in orchagent.json:
+    #   "required_secrets": ["MY_API_KEY"]
+    # Then access via: os.environ["MY_API_KEY"]
     result = f"Received: {user_input}"
     # --- End your logic ---
 
@@ -256,10 +259,12 @@ function registerInitCommand(program) {
             manifest.description = 'An AI agent with tool use';
             manifest.supported_providers = ['anthropic'];
             manifest.loop = { max_turns: 25 };
+            manifest.required_secrets = [];
         }
         else if (initMode.flavor === 'code_runtime') {
             manifest.description = 'A code-runtime agent';
             manifest.runtime = { command: 'python main.py' };
+            manifest.required_secrets = [];
         }
         await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
         if (initMode.flavor === 'code_runtime') {

package/dist/commands/logs.js

@@ -0,0 +1,182 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLogsCommand = registerLogsCommand;
+const cli_table3_1 = __importDefault(require("cli-table3"));
+const chalk_1 = __importDefault(require("chalk"));
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const errors_1 = require("../lib/errors");
+const output_1 = require("../lib/output");
+// ============================================
+// HELPERS
+// ============================================
+async function resolveWorkspaceId(config, slug) {
+    const configFile = await (0, config_1.loadConfig)();
+    const targetSlug = slug ?? configFile.workspace;
+    if (!targetSlug) {
+        throw new errors_1.CliError('No workspace specified. Use --workspace <slug> or run `orch workspace use <slug>` first.');
+    }
+    const response = await (0, api_1.request)(config, 'GET', '/workspaces');
+    const workspace = response.workspaces.find((w) => w.slug === targetSlug);
+    if (!workspace) {
+        throw new errors_1.CliError(`Workspace '${targetSlug}' not found.`);
+    }
+    return workspace.id;
+}
+function formatDate(iso) {
+    if (!iso)
+        return '-';
+    return new Date(iso).toLocaleString();
+}
+function statusColor(status) {
+    if (!status)
+        return '-';
+    switch (status) {
+        case 'completed':
+            return chalk_1.default.green(status);
+        case 'failed':
+            return chalk_1.default.red(status);
+        case 'running':
+            return chalk_1.default.yellow(status);
+        case 'timeout':
+            return chalk_1.default.red(status);
+        default:
+            return status;
+    }
+}
+function formatDuration(ms) {
+    if (ms == null)
+        return '-';
+    if (ms < 1000)
+        return `${ms}ms`;
+    if (ms < 60000)
+        return `${(ms / 1000).toFixed(1)}s`;
+    return `${(ms / 60000).toFixed(1)}m`;
+}
+/** Detect if a string looks like a UUID (run ID) */
+function isUuid(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+// ============================================
+// COMMAND REGISTRATION
+// ============================================
+function registerLogsCommand(program) {
+    program
+        .command('logs [target]')
+        .description('View execution logs. Use with no args to list recent runs, an agent name to filter, or a run ID for full detail.')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--status <status>', 'Filter by status: running, completed, failed, timeout')
+        .option('--limit <n>', 'Number of runs to show (default: 20)', '20')
+        .option('--json', 'Output as JSON')
+        .action(async (target, options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        // If target looks like a UUID, show detailed logs for that run
+        if (target && isUuid(target)) {
+            await showRunLogs(config, workspaceId, target, options.json);
+            return;
+        }
+        // Otherwise list runs, optionally filtered by agent name
+        await listRuns(config, workspaceId, target, options);
+    });
+}
+// ============================================
+// LIST RUNS
+// ============================================
+async function listRuns(config, workspaceId, agentName, options) {
+    const params = new URLSearchParams();
+    if (agentName)
+        params.set('agent_name', agentName);
+    if (options.status)
+        params.set('status', options.status);
+    const limit = parseInt(options.limit ?? '20', 10);
+    params.set('limit', String(Math.min(Math.max(1, limit), 200)));
+    const qs = params.toString() ? `?${params.toString()}` : '';
+    const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/runs${qs}`);
+    if (options.json) {
+        (0, output_1.printJson)(result);
+        return;
+    }
+    if (result.runs.length === 0) {
+        if (agentName) {
+            process.stdout.write(`No runs found for agent '${agentName}'.\n`);
+        }
+        else {
+            process.stdout.write('No runs found in this workspace.\n');
+        }
+        return;
+    }
+    const table = new cli_table3_1.default({
+        head: [
+            chalk_1.default.bold('Run ID'),
+            chalk_1.default.bold('Agent'),
+            chalk_1.default.bold('Status'),
+            chalk_1.default.bold('Duration'),
+            chalk_1.default.bold('Source'),
+            chalk_1.default.bold('Started'),
+            chalk_1.default.bold('Error'),
+        ],
+    });
+    result.runs.forEach((r) => {
+        const errorPreview = r.error_message
+            ? chalk_1.default.red(r.error_message.length > 50 ? r.error_message.slice(0, 50) + '...' : r.error_message)
+            : chalk_1.default.gray('-');
+        table.push([
+            r.id.slice(0, 8),
+            `${r.agent_name}@${r.agent_version}`,
+            statusColor(r.status),
+            formatDuration(r.duration_ms),
+            r.trigger_source ?? '-',
+            formatDate(r.started_at || r.created_at),
+            errorPreview,
+        ]);
+    });
+    process.stdout.write(table.toString() + '\n');
+    if (result.total > result.runs.length) {
+        process.stdout.write(chalk_1.default.gray(`\nShowing ${result.runs.length} of ${result.total} runs. Use --limit to see more.\n`));
+    }
+    process.stdout.write(chalk_1.default.gray('\nView detailed logs for a run: orch logs <run-id>\n'));
+}
+// ============================================
+// SHOW RUN LOGS
+// ============================================
+async function showRunLogs(config, workspaceId, runId, json) {
+    const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/runs/${runId}/logs`);
+    if (json) {
+        (0, output_1.printJson)(result);
+        return;
+    }
+    // Header
+    process.stdout.write(chalk_1.default.bold(`\nRun ${runId}\n`) +
+        `Agent:    ${result.agent_name ?? '-'}@${result.agent_version ?? '-'}\n` +
+        `Status:   ${statusColor(result.run_status)}\n` +
+        `Duration: ${formatDuration(result.execution_time_ms)}\n`);
+    if (result.exit_code != null) {
+        const exitLabel = result.exit_code === 0 ? chalk_1.default.green(String(result.exit_code)) : chalk_1.default.red(String(result.exit_code));
+        process.stdout.write(`Exit code: ${exitLabel}\n`);
+    }
+    // Error message
+    if (result.error_message) {
+        process.stdout.write('\n' + chalk_1.default.red.bold('Error:\n') + chalk_1.default.red(result.error_message) + '\n');
+    }
+    // Stdout
+    if (result.stdout) {
+        process.stdout.write('\n' + chalk_1.default.bold.cyan('--- stdout ---') + '\n' + result.stdout + '\n');
+    }
+    // Stderr
+    if (result.stderr) {
+        process.stdout.write('\n' + chalk_1.default.bold.yellow('--- stderr ---') + '\n' + result.stderr + '\n');
+    }
+    // No execution log available
+    if (!result.has_execution_log && !result.error_message) {
+        process.stdout.write(chalk_1.default.gray('\nNo sandbox output available for this run. ' +
+            'Execution logs are captured for agents with a code runtime (tool/agent types with runtime.command).\n'));
+    }
+    process.stdout.write('\n');
+}

package/dist/commands/publish.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractTemplateVariables = extractTemplateVariables;
 exports.deriveInputSchema = deriveInputSchema;
+exports.scanUndeclaredEnvVars = scanUndeclaredEnvVars;
 exports.registerPublishCommand = registerPublishCommand;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
@@ -55,6 +56,68 @@ function deriveInputSchema(variables) {
         required: [...variables],
     };
 }
+/**
+ * Scan Python files for environment variable references and return var names
+ * that aren't covered by required_secrets or auto-injected by the platform.
+ */
+async function scanUndeclaredEnvVars(agentDir, requiredSecrets) {
+    // Auto-injected by the gateway — never need to be in required_secrets
+    const autoInjected = new Set([
+        'ORCHAGENT_SERVICE_KEY', 'ORCHAGENT_GATEWAY_URL', 'ORCHAGENT_CALL_CHAIN',
+        'ORCHAGENT_DEADLINE_MS', 'ORCHAGENT_MAX_HOPS', 'ORCHAGENT_DOWNSTREAM_REMAINING',
+        'ORCHAGENT_SDK_REQUIRED', 'ORCHAGENT_BILLING_ORG_ID', 'ORCHAGENT_ROOT_RUN_ID',
+        'ORCHAGENT_REQUEST_ID',
+        // LLM keys injected via the platform's credential mechanism
+        'ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'GEMINI_API_KEY', 'LLM_MODEL',
+        // Standard system env vars
+        'PATH', 'HOME', 'USER', 'LANG', 'SHELL', 'TERM', 'PWD', 'TMPDIR',
+    ]);
+    const declared = new Set(requiredSecrets);
+    // Python env var access patterns
+    const patterns = [
+        /os\.environ\s*\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\]/g,
+        /os\.environ\.get\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/g,
+        /os\.getenv\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/g,
+    ];
+    const found = new Set();
+    // Scan .py files in the agent directory (up to 2 levels deep)
+    async function scanDir(dir, depth) {
+        let entries;
+        try {
+            entries = await promises_1.default.readdir(dir, { withFileTypes: true });
+            if (!entries || !Array.isArray(entries))
+                return;
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const name = entry.name;
+            const fullPath = path_1.default.join(dir, name);
+            if (entry.isDirectory() && depth < 2 && !name.startsWith('.') && name !== 'node_modules' && name !== '__pycache__' && name !== 'venv' && name !== '.venv') {
+                await scanDir(fullPath, depth + 1);
+            }
+            else if (entry.isFile() && name.endsWith('.py')) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    for (const re of patterns) {
+                        re.lastIndex = 0;
+                        let m;
+                        while ((m = re.exec(content)) !== null) { // eslint-disable-line no-cond-assign
+                            found.add(m[1]);
+                        }
+                    }
+                }
+                catch {
+                    // Skip unreadable files
+                }
+            }
+        }
+    }
+    await scanDir(agentDir, 0);
+    // Return env vars that are referenced but not declared or auto-injected
+    return [...found].filter(v => !declared.has(v) && !autoInjected.has(v)).sort();
+}
 /**
  * Check if orchagent-sdk is listed in requirements.txt or pyproject.toml
  */
@@ -605,6 +668,26 @@ function registerPublishCommand(program) {
             process.stderr.write('No changes made (dry run)\n');
             return;
         }
+        // Warn if ORCHAGENT_SERVICE_KEY is in required_secrets — the gateway
+        // auto-injects it for agents with manifest dependencies (F-12).
+        if (manifest.required_secrets?.includes('ORCHAGENT_SERVICE_KEY')) {
+            process.stderr.write('\n⚠ Warning: ORCHAGENT_SERVICE_KEY found in required_secrets.\n' +
+                '  The gateway auto-injects this for agents with manifest dependencies.\n' +
+                '  Having it in required_secrets can override the auto-injected key and\n' +
+                '  break orchestration. Remove it from required_secrets in orchagent.json.\n\n');
+        }
+        // Scan code for env var references not covered by required_secrets (F-1a).
+        // Only relevant for agents with code (code_runtime engine).
+        if (executionEngine === 'code_runtime') {
+            const undeclared = await scanUndeclaredEnvVars(cwd, manifest.required_secrets || []);
+            if (undeclared.length > 0) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Your code references environment variables not in required_secrets:\n`) +
+                    chalk_1.default.yellow(`  ${undeclared.join(', ')}\n\n`) +
+                    `  If these should be workspace secrets, add them to required_secrets\n` +
+                    `  in orchagent.json so they're available in the sandbox at runtime.\n` +
+                    `  (Platform-injected vars like LLM API keys are already excluded.)\n\n`);
+            }
+        }
         // Create the agent (server auto-assigns version)
         let result;
         try {
@@ -632,6 +715,7 @@ function registerPublishCommand(program) {
                 sdk_compatible: sdkCompatible || undefined,
                 // Orchestration manifest (includes dependencies)
                 manifest: manifest.manifest,
+                required_secrets: manifest.required_secrets,
                 default_skills: skillsFromFlag || manifest.default_skills,
                 skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
                 allow_local_download: options.localDownload || false,

package/dist/commands/run.js

@@ -46,6 +46,7 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const child_process_1 = require("child_process");
 const chalk_1 = __importDefault(require("chalk"));
+const dotenv_1 = require("../lib/dotenv");
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
@@ -1303,6 +1304,17 @@ async function executeLocalFromDir(dirPath, args, options) {
         runtime: manifest.runtime || null,
         loop: manifest.loop || null,
     });
+    // Load .env from agent directory (existing env vars take precedence)
+    const dotEnvVars = await (0, dotenv_1.loadDotEnv)(resolved);
+    const dotEnvCount = Object.keys(dotEnvVars).length;
+    if (dotEnvCount > 0) {
+        for (const [key, value] of Object.entries(dotEnvVars)) {
+            if (!(key in process.env) || process.env[key] === undefined) {
+                process.env[key] = value;
+            }
+        }
+        process.stderr.write(chalk_1.default.gray(`Loaded ${dotEnvCount} variable${dotEnvCount === 1 ? '' : 's'} from .env\n`));
+    }
     if (localType === 'skill') {
         throw new errors_1.CliError('Skills cannot be run directly.\n\n' +
             'Skills are instructions meant to be injected into AI agent contexts.\n' +
@@ -1908,7 +1920,8 @@ async function executeCloud(agentRef, file, options) {
             sourceLabel = multipart.sourceLabel;
         }
     } // end of non-injection path
-    const url = `${resolved.apiUrl.replace(/\/$/, '')}/${org}/${parsed.agent}/${parsed.version}/${endpoint}`;
+    const verboseQs = options.verbose ? '?verbose=true' : '';
+    const url = `${resolved.apiUrl.replace(/\/$/, '')}/${org}/${parsed.agent}/${parsed.version}/${endpoint}${verboseQs}`;
     // Enable SSE streaming for managed-loop agents (unless --json or --no-stream or --output)
     const isManagedLoopAgent = cloudType === 'agent' && cloudEngine === 'managed_loop';
     const wantStream = isManagedLoopAgent && !options.json && !options.noStream && !options.output;
@@ -1985,14 +1998,39 @@ async function executeCloud(agentRef, file, options) {
                 payload.message ||
                 response.statusText
             : response.statusText;
+        const requestId = typeof payload === 'object' && payload
+            ? payload.metadata?.request_id
+            : undefined;
+        const refSuffix = requestId ? `\n\nref: ${requestId}` : '';
+        if (errorCode === 'SANDBOX_ERROR') {
+            spinner?.fail('Agent execution failed');
+            const hint = typeof payload === 'object' && payload
+                ? payload.error?.hint
+                : undefined;
+            throw new errors_1.CliError(`${message}\n\n` +
+                `This is an error in the agent's code, not the platform.\n` +
+                `Check the agent code and requirements, then republish.` +
+                (hint ? `\n\nHint: ${hint}` : '') +
+                refSuffix);
+        }
+        if (errorCode === 'SANDBOX_TIMEOUT') {
+            spinner?.fail('Agent timed out');
+            throw new errors_1.CliError(`${message}\n\n` +
+                `The agent did not complete in time. Try:\n` +
+                `  - Simplifying the input\n` +
+                `  - Using a smaller dataset\n` +
+                `  - Contacting the agent author to increase the timeout` +
+                refSuffix);
+        }
         if (response.status >= 500) {
             spinner?.fail(`Server error (${response.status})`);
             throw new errors_1.CliError(`${message}\n\n` +
-                `This is a server-side error. Try again in a moment.\n` +
-                `If it persists, check the dashboard for run logs or try a different provider.`);
+                `This is a platform error — try again in a moment.\n` +
+                `If it persists, contact support.` +
+                refSuffix);
         }
         spinner?.fail(`Run failed: ${message}`);
-        throw new errors_1.CliError(message);
+        throw new errors_1.CliError(message + refSuffix);
     }
     // Handle SSE streaming response
     const contentType = response.headers?.get?.('content-type') || '';
@@ -2059,6 +2097,9 @@ async function executeCloud(agentRef, file, options) {
                         const total = (usage.input_tokens || 0) + (usage.output_tokens || 0);
                         parts.push(`${total.toLocaleString()} tokens (${(usage.input_tokens || 0).toLocaleString()} in, ${(usage.output_tokens || 0).toLocaleString()} out)`);
                     }
+                    if (typeof meta.request_id === 'string') {
+                        parts.push(`ref: ${meta.request_id}`);
+                    }
                     if (parts.length > 0) {
                         process.stderr.write(chalk_1.default.gray(`${parts.join(' · ')}\n`));
                     }
@@ -2118,6 +2159,20 @@ async function executeCloud(agentRef, file, options) {
     if (typeof payload === 'object' && payload !== null && 'metadata' in payload) {
         const meta = payload.metadata;
         if (meta) {
+            // Show sandbox output when --verbose
+            if (options.verbose) {
+                const stderr = meta.stderr;
+                const stdout = meta.stdout;
+                if (stderr) {
+                    process.stderr.write(chalk_1.default.bold.yellow('\n--- stderr ---') + '\n' + stderr + '\n');
+                }
+                if (stdout) {
+                    process.stderr.write(chalk_1.default.bold.cyan('\n--- stdout ---') + '\n' + stdout + '\n');
+                }
+                if (!stderr && !stdout) {
+                    process.stderr.write(chalk_1.default.gray('\nNo sandbox output captured.\n'));
+                }
+            }
             const parts = [];
             if (typeof meta.processing_time_ms === 'number') {
                 parts.push(`${(meta.processing_time_ms / 1000).toFixed(1)}s total`);
@@ -2130,6 +2185,9 @@ async function executeCloud(agentRef, file, options) {
                 const total = (usage.input_tokens || 0) + (usage.output_tokens || 0);
                 parts.push(`${total.toLocaleString()} tokens (${(usage.input_tokens || 0).toLocaleString()} in, ${(usage.output_tokens || 0).toLocaleString()} out)`);
             }
+            if (typeof meta.request_id === 'string') {
+                parts.push(`ref: ${meta.request_id}`);
+            }
             if (parts.length > 0) {
                 process.stderr.write(chalk_1.default.gray(`\n${parts.join(' · ')}\n`));
             }
@@ -2372,6 +2430,7 @@ function registerRunCommand(program) {
         .option('--data <json>', 'JSON payload (string or @file, @- for stdin)')
         .option('--input <json>', 'Alias for --data')
         .option('--json', 'Output raw JSON')
+        .option('--verbose', 'Show sandbox stdout/stderr output (cloud only)')
         .option('--provider <provider>', 'LLM provider (openai, anthropic, gemini, ollama)')
         .option('--model <model>', 'LLM model to use (overrides agent default)')
         .option('--key <key>', 'LLM API key (overrides env vars)')

package/dist/commands/schedule.js

@@ -101,9 +101,12 @@ function registerScheduleCommand(program) {
             const failsLabel = s.consecutive_failures > 0
                 ? chalk_1.default.red(String(s.consecutive_failures))
                 : chalk_1.default.gray('0');
+            const agentLabel = s.auto_update === false
+                ? `${s.agent_name}@${s.agent_version} ${chalk_1.default.yellow('[pinned]')}`
+                : `${s.agent_name}@${s.agent_version}`;
             table.push([
                 s.id.slice(0, 8),
-                `${s.agent_name}@${s.agent_version}`,
+                agentLabel,
                 s.schedule_type,
                 s.schedule_type === 'cron' ? (s.cron_expression ?? '-') : 'webhook',
                 enabledLabel,
@@ -125,6 +128,7 @@ function registerScheduleCommand(program) {
         .option('--timezone <tz>', 'Timezone for cron schedule (default: UTC)', 'UTC')
         .option('--input <json>', 'Input data as JSON string')
         .option('--provider <provider>', 'LLM provider (anthropic, openai, gemini)')
+        .option('--pin-version', 'Pin to this version (disable auto-update on publish)')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .action(async (agentArg, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -165,6 +169,8 @@ function registerScheduleCommand(program) {
             body.input_data = inputData;
         if (options.provider)
             body.llm_provider = options.provider;
+        if (options.pinVersion)
+            body.auto_update = false;
         const result = await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/schedules`, {
             body: JSON.stringify(body),
             headers: { 'Content-Type': 'application/json' },
@@ -199,6 +205,8 @@ function registerScheduleCommand(program) {
         .option('--provider <provider>', 'New LLM provider')
         .option('--enable', 'Enable the schedule')
         .option('--disable', 'Disable the schedule')
+        .option('--auto-update', 'Enable auto-update on publish')
+        .option('--pin-version', 'Pin to current version (disable auto-update)')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .action(async (scheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -208,6 +216,9 @@ function registerScheduleCommand(program) {
         if (options.enable && options.disable) {
             throw new errors_1.CliError('Cannot use both --enable and --disable');
         }
+        if (options.autoUpdate && options.pinVersion) {
+            throw new errors_1.CliError('Cannot use both --auto-update and --pin-version');
+        }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const updates = {};
         if (options.cron)
@@ -220,6 +231,10 @@ function registerScheduleCommand(program) {
             updates.enabled = true;
         if (options.disable)
             updates.enabled = false;
+        if (options.autoUpdate)
+            updates.auto_update = true;
+        if (options.pinVersion)
+            updates.auto_update = false;
         if (options.input) {
             try {
                 updates.input_data = JSON.parse(options.input);
@@ -333,6 +348,7 @@ function registerScheduleCommand(program) {
             process.stdout.write(`  Timezone:   ${s.timezone}\n`);
         }
         process.stdout.write(`  Enabled:    ${s.enabled ? chalk_1.default.green('yes') : chalk_1.default.red('no')}\n`);
+        process.stdout.write(`  Auto-update: ${s.auto_update === false ? chalk_1.default.yellow('pinned') : chalk_1.default.green('yes')}\n`);
         if (s.auto_disabled_at) {
             process.stdout.write(`  ${chalk_1.default.bgRed.white(' AUTO-DISABLED ')} at ${formatDate(s.auto_disabled_at)}\n`);
         }