@orchagent/cli 0.3.63 → 0.3.65

package/dist/commands/publish.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractTemplateVariables = extractTemplateVariables;
 exports.deriveInputSchema = deriveInputSchema;
 exports.scanUndeclaredEnvVars = scanUndeclaredEnvVars;
+exports.checkDependencies = checkDependencies;
 exports.registerPublishCommand = registerPublishCommand;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
@@ -15,7 +16,6 @@ const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
-const api_2 = require("../lib/api");
 const analytics_1 = require("../lib/analytics");
 const bundle_1 = require("../lib/bundle");
 /**
@@ -270,6 +270,56 @@ function commandForEntrypoint(entrypoint) {
     }
     return `python ${entrypoint}`;
 }
+/**
+ * Check if manifest dependencies are published and callable.
+ * Best-effort: network errors cause the check to be silently skipped
+ * (returns empty array) to avoid false alarms.
+ */
+async function checkDependencies(config, dependencies, publishingOrgSlug, workspaceId) {
+    // Pre-fetch user's agents if any deps are in the same org (one API call)
+    let myAgents = null;
+    const hasSameOrgDeps = dependencies.some(d => {
+        const [org] = d.id.split('/');
+        return org === publishingOrgSlug;
+    });
+    if (hasSameOrgDeps) {
+        try {
+            const headers = {};
+            if (workspaceId)
+                headers['X-Workspace-Id'] = workspaceId;
+            myAgents = await (0, api_1.request)(config, 'GET', '/agents', { headers });
+        }
+        catch {
+            return []; // Can't reach API — skip check entirely
+        }
+    }
+    return Promise.all(dependencies.map(async (dep) => {
+        const parts = dep.id.split('/');
+        const ref = `${dep.id}@${dep.version}`;
+        if (parts.length !== 2)
+            return { ref, status: 'not_found' };
+        const [depOrg, depName] = parts;
+        // Same org: check against pre-fetched agent list
+        if (depOrg === publishingOrgSlug && myAgents) {
+            const match = myAgents.find(a => a.name === depName && a.version === dep.version);
+            if (!match)
+                return { ref, status: 'not_found' };
+            return { ref, status: match.callable ? 'found_callable' : 'found_not_callable' };
+        }
+        // Different org: try public endpoint
+        try {
+            const agent = await (0, api_1.getPublicAgent)(config, depOrg, depName, dep.version);
+            return { ref, status: agent.callable ? 'found_callable' : 'found_not_callable' };
+        }
+        catch (err) {
+            if (err?.status === 404) {
+                return { ref, status: 'not_found' };
+            }
+            // Network/unexpected error — don't false alarm
+            return { ref, status: 'found_callable' };
+        }
+    }));
+}
 function registerPublishCommand(program) {
     program
         .command('publish')
@@ -287,18 +337,33 @@ function registerPublishCommand(program) {
             : undefined;
         const config = await (0, config_1.getResolvedConfig)({}, options.profile);
         const cwd = process.cwd();
+        // Resolve workspace context — if `orch workspace use` was called, publish
+        // to that workspace instead of the personal org (F-5)
+        const configFile = await (0, config_1.loadConfig)();
+        let workspaceId;
+        if (configFile.workspace) {
+            const { workspaces } = await (0, api_1.request)(config, 'GET', '/workspaces');
+            const ws = workspaces.find(w => w.slug === configFile.workspace);
+            if (!ws) {
+                throw new errors_1.CliError(`Workspace '${configFile.workspace}' not found. Run \`orch workspace list\` to see available workspaces.`);
+            }
+            workspaceId = ws.id;
+        }
         // Check for SKILL.md first (skills take precedence)
         const skillMdPath = path_1.default.join(cwd, 'SKILL.md');
         const skillData = await parseSkillMd(skillMdPath);
         if (skillData) {
             // Publish as a skill (server auto-assigns version)
-            const org = await (0, api_1.getOrg)(config);
+            const org = await (0, api_1.getOrg)(config, workspaceId);
+            if (workspaceId && !options.dryRun) {
+                process.stdout.write(`Workspace: ${org.slug}\n`);
+            }
             // SC-05: Collect all files in the skill directory for multi-file support
             const skillFiles = await collectSkillFiles(cwd);
             const hasMultipleFiles = skillFiles.length > 1;
             // Handle dry-run for skills
             if (options.dryRun) {
-                const preview = await (0, api_1.previewAgentVersion)(config, skillData.frontmatter.name);
+                const preview = await (0, api_1.previewAgentVersion)(config, skillData.frontmatter.name, workspaceId);
                 const skillBodyBytes = Buffer.byteLength(skillData.body, 'utf-8');
                 const totalFilesSize = skillFiles.reduce((sum, f) => sum + f.size, 0);
                 const versionInfo = preview.existing_versions.length > 0
@@ -315,6 +380,9 @@ function registerPublishCommand(program) {
                 process.stderr.write('\nSkill Preview:\n');
                 process.stderr.write(`  Name:        ${skillData.frontmatter.name}\n`);
                 process.stderr.write(`  Type:        skill\n`);
+                if (workspaceId) {
+                    process.stderr.write(`  Workspace:   ${org.slug}\n`);
+                }
                 process.stderr.write(`  Version:     ${versionInfo}\n`);
                 process.stderr.write(`  Visibility:  private\n`);
                 process.stderr.write(`  Providers:   any\n`);
@@ -345,7 +413,7 @@ function registerPublishCommand(program) {
                     // SC-05: Include all skill files for UI preview
                     skill_files: hasMultipleFiles ? skillFiles : undefined,
                     allow_local_download: options.localDownload || false,
-                });
+                }, workspaceId);
                 const skillVersion = skillResult.agent?.version || 'v1';
                 const skillAgentId = skillResult.agent?.id;
                 await (0, analytics_1.track)('cli_publish', { agent_type: 'skill', multi_file: hasMultipleFiles });
@@ -574,8 +642,11 @@ function registerPublishCommand(program) {
         if (options.docker && executionEngine !== 'code_runtime') {
             throw new errors_1.CliError('--docker is only supported for code runtime agents');
         }
-        // Get org info
-        const org = await (0, api_1.getOrg)(config);
+        // Get org info (workspace-aware — returns workspace org if workspace is active)
+        const org = await (0, api_1.getOrg)(config, workspaceId);
+        if (workspaceId && !options.dryRun) {
+            process.stdout.write(`Workspace: ${org.slug}\n`);
+        }
         // Default to 'any' provider if not specified
         const supportedProviders = manifest.supported_providers || ['any'];
         // Detect SDK compatibility for code runtime agents
@@ -586,9 +657,33 @@ function registerPublishCommand(program) {
                 process.stdout.write(`SDK detected - agent will be marked as Local Ready\n`);
             }
         }
+        // Check if manifest dependencies are published and callable (F-9b).
+        // Runs for both dry-run and normal publish so users catch issues early.
+        const manifestDeps = manifest.manifest?.dependencies;
+        if (manifestDeps?.length) {
+            const depResults = await checkDependencies(config, manifestDeps, org.slug, workspaceId);
+            const notFound = depResults.filter(r => r.status === 'not_found');
+            const notCallable = depResults.filter(r => r.status === 'found_not_callable');
+            if (notFound.length > 0) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Unpublished dependencies:\n`));
+                for (const dep of notFound) {
+                    process.stderr.write(chalk_1.default.yellow(`  - ${dep.ref}\n`));
+                }
+                process.stderr.write(`\n  These agents must be published before this orchestrator can call them.\n` +
+                    `  Publish each dependency first, then re-run this publish.\n\n`);
+            }
+            if (notCallable.length > 0) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Dependencies not marked as callable:\n`));
+                for (const dep of notCallable) {
+                    process.stderr.write(chalk_1.default.yellow(`  - ${dep.ref}\n`));
+                }
+                process.stderr.write(`\n  Agents must have callable: true in orchagent.json to be invoked\n` +
+                    `  by orchestrators. Update and republish each dependency.\n\n`);
+            }
+        }
         // Handle dry-run for agents
         if (options.dryRun) {
-            const preview = await (0, api_1.previewAgentVersion)(config, manifest.name);
+            const preview = await (0, api_1.previewAgentVersion)(config, manifest.name, workspaceId);
             const versionInfo = preview.existing_versions.length > 0
                 ? `${preview.next_version} (new version, ${preview.existing_versions[preview.existing_versions.length - 1]} exists)`
                 : `${preview.next_version} (first version)`;
@@ -641,6 +736,9 @@ function registerPublishCommand(program) {
             process.stderr.write('\nAgent Preview:\n');
             process.stderr.write(`  Name:        ${manifest.name}\n`);
             process.stderr.write(`  Type:        ${canonicalType}\n`);
+            if (workspaceId) {
+                process.stderr.write(`  Workspace:   ${org.slug}\n`);
+            }
             process.stderr.write(`  Run mode:    ${runMode}\n`);
             process.stderr.write(`  Engine:      ${executionEngine}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
             process.stderr.write(`  Callable:    ${callable ? 'enabled' : 'disabled'}\n`);
@@ -655,6 +753,9 @@ function registerPublishCommand(program) {
             else if (effectiveSkills?.length) {
                 process.stderr.write(`  Skills:      ${effectiveSkills.join(', ')}\n`);
             }
+            if (manifest.required_secrets?.length) {
+                process.stderr.write(`  Secrets:     ${manifest.required_secrets.join(', ')}\n`);
+            }
             process.stderr.write(`\nWould publish: ${preview.org_slug}/${manifest.name}@${preview.next_version}\n`);
             if (shouldUploadBundle) {
                 const bundlePreview = await (0, bundle_1.previewBundle)(cwd, {
@@ -719,11 +820,11 @@ function registerPublishCommand(program) {
                 default_skills: skillsFromFlag || manifest.default_skills,
                 skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
                 allow_local_download: options.localDownload || false,
-            });
+            }, workspaceId);
         }
         catch (err) {
             // Improve SECURITY_BLOCKED error display
-            if (err instanceof api_2.ApiError && err.status === 422) {
+            if (err instanceof api_1.ApiError && err.status === 422) {
                 const payload = err.payload;
                 const errorCode = payload?.error?.code;
                 if (errorCode === 'SECURITY_BLOCKED') {
@@ -838,6 +939,18 @@ function registerPublishCommand(program) {
         process.stdout.write(`Callable: ${callable ? 'enabled' : 'disabled'}\n`);
         process.stdout.write(`Providers: ${supportedProviders.join(', ')}\n`);
         process.stdout.write(`Visibility: private\n`);
+        // Show required secrets with setup instructions (F-18)
+        if (manifest.required_secrets?.length) {
+            process.stdout.write(`\nRequired secrets:\n`);
+            for (const secret of manifest.required_secrets) {
+                process.stdout.write(`  ${secret}\n`);
+            }
+            process.stdout.write(`\nSet secrets before running:\n`);
+            for (const secret of manifest.required_secrets) {
+                process.stdout.write(`  orch secrets set ${secret} <value>\n`);
+            }
+            process.stdout.write(`\nView existing secrets: ${chalk_1.default.cyan('orch secrets list')}\n`);
+        }
         // Show security review result if available
         const secReview = result.security_review;
         if (secReview?.verdict) {
@@ -855,6 +968,22 @@ function registerPublishCommand(program) {
             process.stdout.write(`\nService key (save this - shown only once):\n`);
             process.stdout.write(`  ${result.service_key}\n`);
         }
+        // Show next-step CLI command based on run mode
+        const runRef = `${org.slug}/${manifest.name}`;
+        if (runMode === 'always_on') {
+            process.stdout.write(`\nDeploy as service:\n`);
+            process.stdout.write(`  orch service deploy ${runRef}\n`);
+        }
+        else {
+            const schemaProps = inputSchema && typeof inputSchema === 'object' && 'properties' in inputSchema
+                ? Object.keys(inputSchema.properties).slice(0, 3)
+                : null;
+            const exampleFields = schemaProps?.length
+                ? schemaProps.map(k => `"${k}": "..."`).join(', ')
+                : '"input": "..."';
+            process.stdout.write(`\nRun with CLI:\n`);
+            process.stdout.write(`  orch run ${runRef} --data '{${exampleFields}}'\n`);
+        }
         process.stdout.write(`\nAPI endpoint:\n`);
         process.stdout.write(`  POST ${config.apiUrl}/${org.slug}/${manifest.name}/${assignedVersion}/run\n`);
         if (shouldUploadBundle) {

package/dist/commands/run.js

@@ -1624,6 +1624,38 @@ async function executeCloud(agentRef, file, options) {
         runtime: agentMeta.runtime ?? null,
         loop: agentMeta.loop ?? null,
     });
+    // Pre-flight: check required secrets before running (F-18)
+    // Only for sandbox-backed engines where secrets are injected as env vars
+    if (cloudEngine !== 'direct_llm') {
+        const agentRequiredSecrets = agentMeta.required_secrets;
+        if (agentRequiredSecrets?.length) {
+            try {
+                const wsSlug = configFile.workspace;
+                if (wsSlug) {
+                    const { workspaces } = await (0, api_1.request)(resolved, 'GET', '/workspaces');
+                    const ws = workspaces.find((w) => w.slug === wsSlug);
+                    if (ws) {
+                        const secretsResult = await (0, api_1.request)(resolved, 'GET', `/workspaces/${ws.id}/secrets`);
+                        const existingNames = new Set(secretsResult.secrets.map((s) => s.name));
+                        const missing = agentRequiredSecrets.filter((s) => !existingNames.has(s));
+                        if (missing.length > 0) {
+                            throw new errors_1.CliError(`Agent requires secrets not found in workspace '${wsSlug}':\n` +
+                                missing.map((s) => `  - ${s}`).join('\n') + '\n\n' +
+                                `Set them before running:\n` +
+                                missing.map((s) => `  orch secrets set ${s} <value>`).join('\n') + '\n\n' +
+                                `Secrets are injected as environment variables into the agent sandbox.\n` +
+                                `View existing secrets: orch secrets list`);
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                if (err instanceof errors_1.CliError)
+                    throw err;
+                // Non-fatal: gateway will catch missing secrets at execution time
+            }
+        }
+    }
     // Pre-call balance check for paid agents
     let pricingInfo;
     if ((0, pricing_1.isPaidAgent)(agentMeta)) {
@@ -1680,6 +1712,7 @@ async function executeCloud(agentRef, file, options) {
     const headers = {
         Authorization: `Bearer ${resolved.apiKey}`,
         'X-CLI-Version': package_json_1.default.version,
+        'X-OrchAgent-Client': 'cli',
     };
     if (options.tenant) {
         headers['X-OrchAgent-Tenant'] = options.tenant;
@@ -2022,6 +2055,37 @@ async function executeCloud(agentRef, file, options) {
                 `  - Contacting the agent author to increase the timeout` +
                 refSuffix);
         }
+        if (errorCode === 'MISSING_SECRETS') {
+            spinner?.fail('Missing workspace secrets');
+            // Extract secret names from gateway message:
+            // "Agent requires secret(s) not found in workspace: NAME1, NAME2. Add them in Settings > Secrets."
+            const secretNames = [];
+            if (message) {
+                const match = message.match(/not found in workspace:\s*(.+?)\./);
+                if (match) {
+                    secretNames.push(...match[1].split(',').map((s) => s.trim()).filter(Boolean));
+                }
+            }
+            let hint = '';
+            if (secretNames.length > 0) {
+                hint += `Missing secrets:\n`;
+                for (const name of secretNames) {
+                    hint += `  - ${name}\n`;
+                }
+                hint += `\nSet them with:\n`;
+                for (const name of secretNames) {
+                    hint += `  orch secrets set ${name} <value>\n`;
+                }
+            }
+            else {
+                hint += `${message}\n\n`;
+                hint += `Set missing secrets:\n`;
+                hint += `  orch secrets set <NAME> <value>\n`;
+            }
+            hint += `\nView existing secrets:\n`;
+            hint += `  orch secrets list`;
+            throw new errors_1.CliError(hint + refSuffix);
+        }
         if (response.status >= 500) {
             spinner?.fail(`Server error (${response.status})`);
             throw new errors_1.CliError(`${message}\n\n` +
@@ -2103,6 +2167,10 @@ async function executeCloud(agentRef, file, options) {
                     if (parts.length > 0) {
                         process.stderr.write(chalk_1.default.gray(`${parts.join(' · ')}\n`));
                     }
+                    const runId = response.headers?.get?.('x-run-id');
+                    if (runId) {
+                        process.stderr.write(chalk_1.default.gray(`View logs: orch logs ${runId}\n`));
+                    }
                 }
             }
         }
@@ -2191,6 +2259,10 @@ async function executeCloud(agentRef, file, options) {
             if (parts.length > 0) {
                 process.stderr.write(chalk_1.default.gray(`\n${parts.join(' · ')}\n`));
             }
+            const runId = response.headers?.get?.('x-run-id');
+            if (runId) {
+                process.stderr.write(chalk_1.default.gray(`View logs: orch logs ${runId}\n`));
+            }
         }
     }
 }

package/dist/commands/secrets.js

@@ -0,0 +1,174 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSecretsCommand = registerSecretsCommand;
+const cli_table3_1 = __importDefault(require("cli-table3"));
+const chalk_1 = __importDefault(require("chalk"));
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const errors_1 = require("../lib/errors");
+const output_1 = require("../lib/output");
+// ============================================
+// HELPERS
+// ============================================
+const SECRET_NAME_REGEX = /^[A-Z][A-Z0-9_]*$/;
+async function resolveWorkspaceId(config, slug) {
+    const configFile = await (0, config_1.loadConfig)();
+    const targetSlug = slug ?? configFile.workspace;
+    if (!targetSlug) {
+        throw new errors_1.CliError('No workspace specified. Use --workspace <slug> or run `orch workspace use <slug>` first.');
+    }
+    const response = await (0, api_1.request)(config, 'GET', '/workspaces');
+    const workspace = response.workspaces.find((w) => w.slug === targetSlug);
+    if (!workspace) {
+        throw new errors_1.CliError(`Workspace '${targetSlug}' not found.`);
+    }
+    return workspace.id;
+}
+function formatDate(iso) {
+    if (!iso)
+        return '-';
+    return new Date(iso).toLocaleString();
+}
+function validateSecretName(name) {
+    if (!name || name.length > 128) {
+        throw new errors_1.CliError('Secret name must be 1-128 characters.');
+    }
+    if (!SECRET_NAME_REGEX.test(name)) {
+        throw new errors_1.CliError(`Invalid secret name '${name}'.\n\n` +
+            'Secret names must:\n' +
+            '  - Start with an uppercase letter (A-Z)\n' +
+            '  - Contain only uppercase letters, digits, and underscores\n\n' +
+            'Examples: STRIPE_SECRET_KEY, DISCORD_TOKEN, MY_API_KEY_2');
+    }
+}
+async function findSecretByName(config, workspaceId, name) {
+    const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/secrets`);
+    return result.secrets.find((s) => s.name === name);
+}
+// ============================================
+// COMMAND REGISTRATION
+// ============================================
+function registerSecretsCommand(program) {
+    const secrets = program
+        .command('secrets')
+        .description('Manage workspace secrets (injected as env vars into agent sandboxes)');
+    // orch secrets list
+    secrets
+        .command('list')
+        .description('List secrets in your workspace (names and metadata, never values)')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/secrets`);
+        if (options.json) {
+            (0, output_1.printJson)(result);
+            return;
+        }
+        if (result.secrets.length === 0) {
+            process.stdout.write('No secrets found in this workspace.\n');
+            process.stdout.write(chalk_1.default.gray('\nAdd one with: orch secrets set MY_SECRET_NAME my-secret-value\n'));
+            return;
+        }
+        const table = new cli_table3_1.default({
+            head: [
+                chalk_1.default.bold('Name'),
+                chalk_1.default.bold('Type'),
+                chalk_1.default.bold('Description'),
+                chalk_1.default.bold('Updated'),
+            ],
+        });
+        for (const s of result.secrets) {
+            table.push([
+                s.name,
+                s.secret_type === 'llm_key'
+                    ? chalk_1.default.cyan(`llm_key (${s.llm_provider ?? '?'})`)
+                    : chalk_1.default.gray('custom'),
+                s.description ? s.description.slice(0, 40) + (s.description.length > 40 ? '...' : '') : chalk_1.default.gray('-'),
+                formatDate(s.updated_at),
+            ]);
+        }
+        process.stdout.write(`\n${table.toString()}\n`);
+        process.stdout.write(chalk_1.default.gray(`\n${result.secrets.length} secret(s)\n`));
+    });
+    // orch secrets set <NAME> <VALUE>
+    secrets
+        .command('set <name> <value>')
+        .description('Create or update a workspace secret')
+        .option('--description <text>', 'Description of what this secret is for')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .action(async (name, value, options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        validateSecretName(name);
+        if (!value) {
+            throw new errors_1.CliError('Secret value cannot be empty.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        // Check if secret already exists (by name)
+        const existing = await findSecretByName(config, workspaceId, name);
+        if (existing) {
+            // Update existing secret
+            const body = { value };
+            if (options.description !== undefined) {
+                body.description = options.description;
+            }
+            const result = await (0, api_1.request)(config, 'PATCH', `/workspaces/${workspaceId}/secrets/${existing.id}`, {
+                body: JSON.stringify(body),
+                headers: { 'Content-Type': 'application/json' },
+            });
+            process.stdout.write(chalk_1.default.green('\u2713') + ` Updated secret ${chalk_1.default.bold(name)}\n`);
+            if (result.restarted_services && result.restarted_services.length > 0) {
+                process.stdout.write(chalk_1.default.yellow('\n  Restarted running services that use this secret:\n'));
+                for (const svc of result.restarted_services) {
+                    process.stdout.write(`    - ${svc.service_name}\n`);
+                }
+            }
+        }
+        else {
+            // Create new secret
+            const body = {
+                name,
+                value,
+                secret_type: 'custom',
+            };
+            if (options.description !== undefined) {
+                body.description = options.description;
+            }
+            await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/secrets`, {
+                body: JSON.stringify(body),
+                headers: { 'Content-Type': 'application/json' },
+            });
+            process.stdout.write(chalk_1.default.green('\u2713') + ` Created secret ${chalk_1.default.bold(name)}\n`);
+        }
+    });
+    // orch secrets delete <NAME>
+    secrets
+        .command('delete <name>')
+        .description('Delete a workspace secret')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .action(async (name, options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        // Resolve name → ID
+        const existing = await findSecretByName(config, workspaceId, name);
+        if (!existing) {
+            throw new errors_1.CliError(`Secret '${name}' not found in this workspace.\n\n` +
+                'Run `orch secrets list` to see available secrets.');
+        }
+        await (0, api_1.request)(config, 'DELETE', `/workspaces/${workspaceId}/secrets/${existing.id}`);
+        process.stdout.write(chalk_1.default.green('\u2713') + ` Deleted secret ${chalk_1.default.bold(name)}\n`);
+    });
+}