@orchagent/cli 0.3.62 → 0.3.64

package/dist/commands/publish.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractTemplateVariables = extractTemplateVariables;
 exports.deriveInputSchema = deriveInputSchema;
+exports.scanUndeclaredEnvVars = scanUndeclaredEnvVars;
+exports.checkDependencies = checkDependencies;
 exports.registerPublishCommand = registerPublishCommand;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
@@ -14,7 +16,6 @@ const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
-const api_2 = require("../lib/api");
 const analytics_1 = require("../lib/analytics");
 const bundle_1 = require("../lib/bundle");
 /**
@@ -55,6 +56,68 @@ function deriveInputSchema(variables) {
         required: [...variables],
     };
 }
+/**
+ * Scan Python files for environment variable references and return var names
+ * that aren't covered by required_secrets or auto-injected by the platform.
+ */
+async function scanUndeclaredEnvVars(agentDir, requiredSecrets) {
+    // Auto-injected by the gateway — never need to be in required_secrets
+    const autoInjected = new Set([
+        'ORCHAGENT_SERVICE_KEY', 'ORCHAGENT_GATEWAY_URL', 'ORCHAGENT_CALL_CHAIN',
+        'ORCHAGENT_DEADLINE_MS', 'ORCHAGENT_MAX_HOPS', 'ORCHAGENT_DOWNSTREAM_REMAINING',
+        'ORCHAGENT_SDK_REQUIRED', 'ORCHAGENT_BILLING_ORG_ID', 'ORCHAGENT_ROOT_RUN_ID',
+        'ORCHAGENT_REQUEST_ID',
+        // LLM keys injected via the platform's credential mechanism
+        'ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'GEMINI_API_KEY', 'LLM_MODEL',
+        // Standard system env vars
+        'PATH', 'HOME', 'USER', 'LANG', 'SHELL', 'TERM', 'PWD', 'TMPDIR',
+    ]);
+    const declared = new Set(requiredSecrets);
+    // Python env var access patterns
+    const patterns = [
+        /os\.environ\s*\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\]/g,
+        /os\.environ\.get\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/g,
+        /os\.getenv\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/g,
+    ];
+    const found = new Set();
+    // Scan .py files in the agent directory (up to 2 levels deep)
+    async function scanDir(dir, depth) {
+        let entries;
+        try {
+            entries = await promises_1.default.readdir(dir, { withFileTypes: true });
+            if (!entries || !Array.isArray(entries))
+                return;
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const name = entry.name;
+            const fullPath = path_1.default.join(dir, name);
+            if (entry.isDirectory() && depth < 2 && !name.startsWith('.') && name !== 'node_modules' && name !== '__pycache__' && name !== 'venv' && name !== '.venv') {
+                await scanDir(fullPath, depth + 1);
+            }
+            else if (entry.isFile() && name.endsWith('.py')) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    for (const re of patterns) {
+                        re.lastIndex = 0;
+                        let m;
+                        while ((m = re.exec(content)) !== null) { // eslint-disable-line no-cond-assign
+                            found.add(m[1]);
+                        }
+                    }
+                }
+                catch {
+                    // Skip unreadable files
+                }
+            }
+        }
+    }
+    await scanDir(agentDir, 0);
+    // Return env vars that are referenced but not declared or auto-injected
+    return [...found].filter(v => !declared.has(v) && !autoInjected.has(v)).sort();
+}
 /**
  * Check if orchagent-sdk is listed in requirements.txt or pyproject.toml
  */
@@ -207,6 +270,56 @@ function commandForEntrypoint(entrypoint) {
     }
     return `python ${entrypoint}`;
 }
+/**
+ * Check if manifest dependencies are published and callable.
+ * Best-effort: network errors cause the check to be silently skipped
+ * (returns empty array) to avoid false alarms.
+ */
+async function checkDependencies(config, dependencies, publishingOrgSlug, workspaceId) {
+    // Pre-fetch user's agents if any deps are in the same org (one API call)
+    let myAgents = null;
+    const hasSameOrgDeps = dependencies.some(d => {
+        const [org] = d.id.split('/');
+        return org === publishingOrgSlug;
+    });
+    if (hasSameOrgDeps) {
+        try {
+            const headers = {};
+            if (workspaceId)
+                headers['X-Workspace-Id'] = workspaceId;
+            myAgents = await (0, api_1.request)(config, 'GET', '/agents', { headers });
+        }
+        catch {
+            return []; // Can't reach API — skip check entirely
+        }
+    }
+    return Promise.all(dependencies.map(async (dep) => {
+        const parts = dep.id.split('/');
+        const ref = `${dep.id}@${dep.version}`;
+        if (parts.length !== 2)
+            return { ref, status: 'not_found' };
+        const [depOrg, depName] = parts;
+        // Same org: check against pre-fetched agent list
+        if (depOrg === publishingOrgSlug && myAgents) {
+            const match = myAgents.find(a => a.name === depName && a.version === dep.version);
+            if (!match)
+                return { ref, status: 'not_found' };
+            return { ref, status: match.callable ? 'found_callable' : 'found_not_callable' };
+        }
+        // Different org: try public endpoint
+        try {
+            const agent = await (0, api_1.getPublicAgent)(config, depOrg, depName, dep.version);
+            return { ref, status: agent.callable ? 'found_callable' : 'found_not_callable' };
+        }
+        catch (err) {
+            if (err?.status === 404) {
+                return { ref, status: 'not_found' };
+            }
+            // Network/unexpected error — don't false alarm
+            return { ref, status: 'found_callable' };
+        }
+    }));
+}
 function registerPublishCommand(program) {
     program
         .command('publish')
@@ -224,18 +337,33 @@ function registerPublishCommand(program) {
             : undefined;
         const config = await (0, config_1.getResolvedConfig)({}, options.profile);
         const cwd = process.cwd();
+        // Resolve workspace context — if `orch workspace use` was called, publish
+        // to that workspace instead of the personal org (F-5)
+        const configFile = await (0, config_1.loadConfig)();
+        let workspaceId;
+        if (configFile.workspace) {
+            const { workspaces } = await (0, api_1.request)(config, 'GET', '/workspaces');
+            const ws = workspaces.find(w => w.slug === configFile.workspace);
+            if (!ws) {
+                throw new errors_1.CliError(`Workspace '${configFile.workspace}' not found. Run \`orch workspace list\` to see available workspaces.`);
+            }
+            workspaceId = ws.id;
+        }
         // Check for SKILL.md first (skills take precedence)
         const skillMdPath = path_1.default.join(cwd, 'SKILL.md');
         const skillData = await parseSkillMd(skillMdPath);
         if (skillData) {
             // Publish as a skill (server auto-assigns version)
-            const org = await (0, api_1.getOrg)(config);
+            const org = await (0, api_1.getOrg)(config, workspaceId);
+            if (workspaceId && !options.dryRun) {
+                process.stdout.write(`Workspace: ${org.slug}\n`);
+            }
             // SC-05: Collect all files in the skill directory for multi-file support
             const skillFiles = await collectSkillFiles(cwd);
             const hasMultipleFiles = skillFiles.length > 1;
             // Handle dry-run for skills
             if (options.dryRun) {
-                const preview = await (0, api_1.previewAgentVersion)(config, skillData.frontmatter.name);
+                const preview = await (0, api_1.previewAgentVersion)(config, skillData.frontmatter.name, workspaceId);
                 const skillBodyBytes = Buffer.byteLength(skillData.body, 'utf-8');
                 const totalFilesSize = skillFiles.reduce((sum, f) => sum + f.size, 0);
                 const versionInfo = preview.existing_versions.length > 0
@@ -252,6 +380,9 @@ function registerPublishCommand(program) {
                 process.stderr.write('\nSkill Preview:\n');
                 process.stderr.write(`  Name:        ${skillData.frontmatter.name}\n`);
                 process.stderr.write(`  Type:        skill\n`);
+                if (workspaceId) {
+                    process.stderr.write(`  Workspace:   ${org.slug}\n`);
+                }
                 process.stderr.write(`  Version:     ${versionInfo}\n`);
                 process.stderr.write(`  Visibility:  private\n`);
                 process.stderr.write(`  Providers:   any\n`);
@@ -282,7 +413,7 @@ function registerPublishCommand(program) {
                     // SC-05: Include all skill files for UI preview
                     skill_files: hasMultipleFiles ? skillFiles : undefined,
                     allow_local_download: options.localDownload || false,
-                });
+                }, workspaceId);
                 const skillVersion = skillResult.agent?.version || 'v1';
                 const skillAgentId = skillResult.agent?.id;
                 await (0, analytics_1.track)('cli_publish', { agent_type: 'skill', multi_file: hasMultipleFiles });
@@ -511,8 +642,11 @@ function registerPublishCommand(program) {
         if (options.docker && executionEngine !== 'code_runtime') {
             throw new errors_1.CliError('--docker is only supported for code runtime agents');
         }
-        // Get org info
-        const org = await (0, api_1.getOrg)(config);
+        // Get org info (workspace-aware — returns workspace org if workspace is active)
+        const org = await (0, api_1.getOrg)(config, workspaceId);
+        if (workspaceId && !options.dryRun) {
+            process.stdout.write(`Workspace: ${org.slug}\n`);
+        }
         // Default to 'any' provider if not specified
         const supportedProviders = manifest.supported_providers || ['any'];
         // Detect SDK compatibility for code runtime agents
@@ -523,9 +657,33 @@ function registerPublishCommand(program) {
                 process.stdout.write(`SDK detected - agent will be marked as Local Ready\n`);
             }
         }
+        // Check if manifest dependencies are published and callable (F-9b).
+        // Runs for both dry-run and normal publish so users catch issues early.
+        const manifestDeps = manifest.manifest?.dependencies;
+        if (manifestDeps?.length) {
+            const depResults = await checkDependencies(config, manifestDeps, org.slug, workspaceId);
+            const notFound = depResults.filter(r => r.status === 'not_found');
+            const notCallable = depResults.filter(r => r.status === 'found_not_callable');
+            if (notFound.length > 0) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Unpublished dependencies:\n`));
+                for (const dep of notFound) {
+                    process.stderr.write(chalk_1.default.yellow(`  - ${dep.ref}\n`));
+                }
+                process.stderr.write(`\n  These agents must be published before this orchestrator can call them.\n` +
+                    `  Publish each dependency first, then re-run this publish.\n\n`);
+            }
+            if (notCallable.length > 0) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Dependencies not marked as callable:\n`));
+                for (const dep of notCallable) {
+                    process.stderr.write(chalk_1.default.yellow(`  - ${dep.ref}\n`));
+                }
+                process.stderr.write(`\n  Agents must have callable: true in orchagent.json to be invoked\n` +
+                    `  by orchestrators. Update and republish each dependency.\n\n`);
+            }
+        }
         // Handle dry-run for agents
         if (options.dryRun) {
-            const preview = await (0, api_1.previewAgentVersion)(config, manifest.name);
+            const preview = await (0, api_1.previewAgentVersion)(config, manifest.name, workspaceId);
             const versionInfo = preview.existing_versions.length > 0
                 ? `${preview.next_version} (new version, ${preview.existing_versions[preview.existing_versions.length - 1]} exists)`
                 : `${preview.next_version} (first version)`;
@@ -578,6 +736,9 @@ function registerPublishCommand(program) {
             process.stderr.write('\nAgent Preview:\n');
             process.stderr.write(`  Name:        ${manifest.name}\n`);
             process.stderr.write(`  Type:        ${canonicalType}\n`);
+            if (workspaceId) {
+                process.stderr.write(`  Workspace:   ${org.slug}\n`);
+            }
             process.stderr.write(`  Run mode:    ${runMode}\n`);
             process.stderr.write(`  Engine:      ${executionEngine}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
             process.stderr.write(`  Callable:    ${callable ? 'enabled' : 'disabled'}\n`);
@@ -605,6 +766,26 @@ function registerPublishCommand(program) {
             process.stderr.write('No changes made (dry run)\n');
             return;
         }
+        // Warn if ORCHAGENT_SERVICE_KEY is in required_secrets — the gateway
+        // auto-injects it for agents with manifest dependencies (F-12).
+        if (manifest.required_secrets?.includes('ORCHAGENT_SERVICE_KEY')) {
+            process.stderr.write('\n⚠ Warning: ORCHAGENT_SERVICE_KEY found in required_secrets.\n' +
+                '  The gateway auto-injects this for agents with manifest dependencies.\n' +
+                '  Having it in required_secrets can override the auto-injected key and\n' +
+                '  break orchestration. Remove it from required_secrets in orchagent.json.\n\n');
+        }
+        // Scan code for env var references not covered by required_secrets (F-1a).
+        // Only relevant for agents with code (code_runtime engine).
+        if (executionEngine === 'code_runtime') {
+            const undeclared = await scanUndeclaredEnvVars(cwd, manifest.required_secrets || []);
+            if (undeclared.length > 0) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Your code references environment variables not in required_secrets:\n`) +
+                    chalk_1.default.yellow(`  ${undeclared.join(', ')}\n\n`) +
+                    `  If these should be workspace secrets, add them to required_secrets\n` +
+                    `  in orchagent.json so they're available in the sandbox at runtime.\n` +
+                    `  (Platform-injected vars like LLM API keys are already excluded.)\n\n`);
+            }
+        }
         // Create the agent (server auto-assigns version)
         let result;
         try {
@@ -636,11 +817,11 @@ function registerPublishCommand(program) {
                 default_skills: skillsFromFlag || manifest.default_skills,
                 skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
                 allow_local_download: options.localDownload || false,
-            });
+            }, workspaceId);
         }
         catch (err) {
             // Improve SECURITY_BLOCKED error display
-            if (err instanceof api_2.ApiError && err.status === 422) {
+            if (err instanceof api_1.ApiError && err.status === 422) {
                 const payload = err.payload;
                 const errorCode = payload?.error?.code;
                 if (errorCode === 'SECURITY_BLOCKED') {
@@ -772,6 +953,22 @@ function registerPublishCommand(program) {
             process.stdout.write(`\nService key (save this - shown only once):\n`);
             process.stdout.write(`  ${result.service_key}\n`);
         }
+        // Show next-step CLI command based on run mode
+        const runRef = `${org.slug}/${manifest.name}`;
+        if (runMode === 'always_on') {
+            process.stdout.write(`\nDeploy as service:\n`);
+            process.stdout.write(`  orch service deploy ${runRef}\n`);
+        }
+        else {
+            const schemaProps = inputSchema && typeof inputSchema === 'object' && 'properties' in inputSchema
+                ? Object.keys(inputSchema.properties).slice(0, 3)
+                : null;
+            const exampleFields = schemaProps?.length
+                ? schemaProps.map(k => `"${k}": "..."`).join(', ')
+                : '"input": "..."';
+            process.stdout.write(`\nRun with CLI:\n`);
+            process.stdout.write(`  orch run ${runRef} --data '{${exampleFields}}'\n`);
+        }
         process.stdout.write(`\nAPI endpoint:\n`);
         process.stdout.write(`  POST ${config.apiUrl}/${org.slug}/${manifest.name}/${assignedVersion}/run\n`);
         if (shouldUploadBundle) {

package/dist/commands/run.js

@@ -46,6 +46,7 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const child_process_1 = require("child_process");
 const chalk_1 = __importDefault(require("chalk"));
+const dotenv_1 = require("../lib/dotenv");
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
@@ -1303,6 +1304,17 @@ async function executeLocalFromDir(dirPath, args, options) {
         runtime: manifest.runtime || null,
         loop: manifest.loop || null,
     });
+    // Load .env from agent directory (existing env vars take precedence)
+    const dotEnvVars = await (0, dotenv_1.loadDotEnv)(resolved);
+    const dotEnvCount = Object.keys(dotEnvVars).length;
+    if (dotEnvCount > 0) {
+        for (const [key, value] of Object.entries(dotEnvVars)) {
+            if (!(key in process.env) || process.env[key] === undefined) {
+                process.env[key] = value;
+            }
+        }
+        process.stderr.write(chalk_1.default.gray(`Loaded ${dotEnvCount} variable${dotEnvCount === 1 ? '' : 's'} from .env\n`));
+    }
     if (localType === 'skill') {
         throw new errors_1.CliError('Skills cannot be run directly.\n\n' +
             'Skills are instructions meant to be injected into AI agent contexts.\n' +
@@ -1908,7 +1920,8 @@ async function executeCloud(agentRef, file, options) {
             sourceLabel = multipart.sourceLabel;
         }
     } // end of non-injection path
-    const url = `${resolved.apiUrl.replace(/\/$/, '')}/${org}/${parsed.agent}/${parsed.version}/${endpoint}`;
+    const verboseQs = options.verbose ? '?verbose=true' : '';
+    const url = `${resolved.apiUrl.replace(/\/$/, '')}/${org}/${parsed.agent}/${parsed.version}/${endpoint}${verboseQs}`;
     // Enable SSE streaming for managed-loop agents (unless --json or --no-stream or --output)
     const isManagedLoopAgent = cloudType === 'agent' && cloudEngine === 'managed_loop';
     const wantStream = isManagedLoopAgent && !options.json && !options.noStream && !options.output;
@@ -1985,14 +1998,39 @@ async function executeCloud(agentRef, file, options) {
                 payload.message ||
                 response.statusText
             : response.statusText;
+        const requestId = typeof payload === 'object' && payload
+            ? payload.metadata?.request_id
+            : undefined;
+        const refSuffix = requestId ? `\n\nref: ${requestId}` : '';
+        if (errorCode === 'SANDBOX_ERROR') {
+            spinner?.fail('Agent execution failed');
+            const hint = typeof payload === 'object' && payload
+                ? payload.error?.hint
+                : undefined;
+            throw new errors_1.CliError(`${message}\n\n` +
+                `This is an error in the agent's code, not the platform.\n` +
+                `Check the agent code and requirements, then republish.` +
+                (hint ? `\n\nHint: ${hint}` : '') +
+                refSuffix);
+        }
+        if (errorCode === 'SANDBOX_TIMEOUT') {
+            spinner?.fail('Agent timed out');
+            throw new errors_1.CliError(`${message}\n\n` +
+                `The agent did not complete in time. Try:\n` +
+                `  - Simplifying the input\n` +
+                `  - Using a smaller dataset\n` +
+                `  - Contacting the agent author to increase the timeout` +
+                refSuffix);
+        }
         if (response.status >= 500) {
             spinner?.fail(`Server error (${response.status})`);
             throw new errors_1.CliError(`${message}\n\n` +
-                `This is a server-side error. Try again in a moment.\n` +
-                `If it persists, check the dashboard for run logs or try a different provider.`);
+                `This is a platform error — try again in a moment.\n` +
+                `If it persists, contact support.` +
+                refSuffix);
         }
         spinner?.fail(`Run failed: ${message}`);
-        throw new errors_1.CliError(message);
+        throw new errors_1.CliError(message + refSuffix);
     }
     // Handle SSE streaming response
     const contentType = response.headers?.get?.('content-type') || '';
@@ -2059,6 +2097,9 @@ async function executeCloud(agentRef, file, options) {
                         const total = (usage.input_tokens || 0) + (usage.output_tokens || 0);
                         parts.push(`${total.toLocaleString()} tokens (${(usage.input_tokens || 0).toLocaleString()} in, ${(usage.output_tokens || 0).toLocaleString()} out)`);
                     }
+                    if (typeof meta.request_id === 'string') {
+                        parts.push(`ref: ${meta.request_id}`);
+                    }
                     if (parts.length > 0) {
                         process.stderr.write(chalk_1.default.gray(`${parts.join(' · ')}\n`));
                     }
@@ -2118,6 +2159,20 @@ async function executeCloud(agentRef, file, options) {
     if (typeof payload === 'object' && payload !== null && 'metadata' in payload) {
         const meta = payload.metadata;
         if (meta) {
+            // Show sandbox output when --verbose
+            if (options.verbose) {
+                const stderr = meta.stderr;
+                const stdout = meta.stdout;
+                if (stderr) {
+                    process.stderr.write(chalk_1.default.bold.yellow('\n--- stderr ---') + '\n' + stderr + '\n');
+                }
+                if (stdout) {
+                    process.stderr.write(chalk_1.default.bold.cyan('\n--- stdout ---') + '\n' + stdout + '\n');
+                }
+                if (!stderr && !stdout) {
+                    process.stderr.write(chalk_1.default.gray('\nNo sandbox output captured.\n'));
+                }
+            }
             const parts = [];
             if (typeof meta.processing_time_ms === 'number') {
                 parts.push(`${(meta.processing_time_ms / 1000).toFixed(1)}s total`);
@@ -2130,6 +2185,9 @@ async function executeCloud(agentRef, file, options) {
                 const total = (usage.input_tokens || 0) + (usage.output_tokens || 0);
                 parts.push(`${total.toLocaleString()} tokens (${(usage.input_tokens || 0).toLocaleString()} in, ${(usage.output_tokens || 0).toLocaleString()} out)`);
             }
+            if (typeof meta.request_id === 'string') {
+                parts.push(`ref: ${meta.request_id}`);
+            }
             if (parts.length > 0) {
                 process.stderr.write(chalk_1.default.gray(`\n${parts.join(' · ')}\n`));
             }
@@ -2372,6 +2430,7 @@ function registerRunCommand(program) {
         .option('--data <json>', 'JSON payload (string or @file, @- for stdin)')
         .option('--input <json>', 'Alias for --data')
         .option('--json', 'Output raw JSON')
+        .option('--verbose', 'Show sandbox stdout/stderr output (cloud only)')
         .option('--provider <provider>', 'LLM provider (openai, anthropic, gemini, ollama)')
         .option('--model <model>', 'LLM model to use (overrides agent default)')
         .option('--key <key>', 'LLM API key (overrides env vars)')

package/dist/commands/schedule.js

@@ -101,9 +101,12 @@ function registerScheduleCommand(program) {
             const failsLabel = s.consecutive_failures > 0
                 ? chalk_1.default.red(String(s.consecutive_failures))
                 : chalk_1.default.gray('0');
+            const agentLabel = s.auto_update === false
+                ? `${s.agent_name}@${s.agent_version} ${chalk_1.default.yellow('[pinned]')}`
+                : `${s.agent_name}@${s.agent_version}`;
             table.push([
                 s.id.slice(0, 8),
-                `${s.agent_name}@${s.agent_version}`,
+                agentLabel,
                 s.schedule_type,
                 s.schedule_type === 'cron' ? (s.cron_expression ?? '-') : 'webhook',
                 enabledLabel,
@@ -125,6 +128,7 @@ function registerScheduleCommand(program) {
         .option('--timezone <tz>', 'Timezone for cron schedule (default: UTC)', 'UTC')
         .option('--input <json>', 'Input data as JSON string')
         .option('--provider <provider>', 'LLM provider (anthropic, openai, gemini)')
+        .option('--pin-version', 'Pin to this version (disable auto-update on publish)')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .action(async (agentArg, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -165,6 +169,8 @@ function registerScheduleCommand(program) {
             body.input_data = inputData;
         if (options.provider)
             body.llm_provider = options.provider;
+        if (options.pinVersion)
+            body.auto_update = false;
         const result = await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/schedules`, {
             body: JSON.stringify(body),
             headers: { 'Content-Type': 'application/json' },
@@ -199,6 +205,8 @@ function registerScheduleCommand(program) {
         .option('--provider <provider>', 'New LLM provider')
         .option('--enable', 'Enable the schedule')
         .option('--disable', 'Disable the schedule')
+        .option('--auto-update', 'Enable auto-update on publish')
+        .option('--pin-version', 'Pin to current version (disable auto-update)')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .action(async (scheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -208,6 +216,9 @@ function registerScheduleCommand(program) {
         if (options.enable && options.disable) {
             throw new errors_1.CliError('Cannot use both --enable and --disable');
         }
+        if (options.autoUpdate && options.pinVersion) {
+            throw new errors_1.CliError('Cannot use both --auto-update and --pin-version');
+        }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const updates = {};
         if (options.cron)
@@ -220,6 +231,10 @@ function registerScheduleCommand(program) {
             updates.enabled = true;
         if (options.disable)
             updates.enabled = false;
+        if (options.autoUpdate)
+            updates.auto_update = true;
+        if (options.pinVersion)
+            updates.auto_update = false;
         if (options.input) {
             try {
                 updates.input_data = JSON.parse(options.input);
@@ -333,6 +348,7 @@ function registerScheduleCommand(program) {
             process.stdout.write(`  Timezone:   ${s.timezone}\n`);
         }
         process.stdout.write(`  Enabled:    ${s.enabled ? chalk_1.default.green('yes') : chalk_1.default.red('no')}\n`);
+        process.stdout.write(`  Auto-update: ${s.auto_update === false ? chalk_1.default.yellow('pinned') : chalk_1.default.green('yes')}\n`);
         if (s.auto_disabled_at) {
             process.stdout.write(`  ${chalk_1.default.bgRed.white(' AUTO-DISABLED ')} at ${formatDate(s.auto_disabled_at)}\n`);
         }