@orchagent/cli 0.3.69 → 0.3.71

package/dist/commands/agent-keys.js

@@ -15,7 +15,12 @@ const errors_1 = require("../lib/errors");
 async function resolveAgentId(config, ref) {
     const parts = ref.split('/');
     const agentName = parts.length >= 2 ? parts[1] : parts[0];
-    const agents = await (0, api_1.listMyAgents)(config);
+    const orgSlug = parts.length >= 2 ? parts[0] : undefined;
+    // Resolve workspace context from org slug or config
+    const configFile = await (0, config_1.loadConfig)();
+    const resolvedOrg = orgSlug ?? configFile.workspace ?? config.defaultOrg;
+    const workspaceId = resolvedOrg ? await (0, api_1.resolveWorkspaceIdForOrg)(config, resolvedOrg) : undefined;
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agentName);
     if (matching.length === 0) {
         throw new errors_1.CliError(`Agent '${ref}' not found. Run 'orchagent agents' to list your agents.`);

package/dist/commands/agents.js

@@ -49,7 +49,11 @@ function registerAgentsCommand(program) {
         .option('--json', 'Output raw JSON')
         .action(async (options) => {
         const config = await (0, config_1.getResolvedConfig)();
-        const agents = await (0, api_1.listMyAgents)(config);
+        // Resolve workspace context
+        const configFile = await (0, config_1.loadConfig)();
+        const orgSlug = configFile.workspace ?? config.defaultOrg;
+        const workspaceId = orgSlug ? await (0, api_1.resolveWorkspaceIdForOrg)(config, orgSlug) : undefined;
+        const agents = await (0, api_1.listMyAgents)(config, workspaceId);
         // Apply filter if provided
         const filteredAgents = options.filter
             ? agents.filter(a => a.name.toLowerCase().includes(options.filter.toLowerCase()))

package/dist/commands/delete.js

@@ -42,9 +42,11 @@ Examples:
         if (!config.apiKey) {
             throw new errors_1.CliError('Not logged in. Run `orchagent login` first.');
         }
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, ref.org);
         process.stdout.write('Finding agent...\n');
         // Find the agent by name, filtering by org if provided
-        const agents = await (0, api_1.listMyAgents)(config);
+        const agents = await (0, api_1.listMyAgents)(config, workspaceId);
         const matching = agents.filter(a => a.name === ref.agent && (!a.org_slug || a.org_slug === ref.org));
         if (matching.length === 0) {
             throw new errors_1.CliError(`Agent '${ref.org}/${ref.agent}' not found`);

package/dist/commands/info.js

@@ -49,7 +49,7 @@ async function fetchReadme(url) {
         return null;
     }
 }
-async function getAgentInfo(config, org, agent, version) {
+async function getAgentInfo(config, org, agent, version, workspaceId) {
     // Use public metadata endpoint as primary source — never blocked by download restrictions
     try {
         const publicMeta = await (0, api_1.getPublicAgent)(config, org, agent, version);
@@ -78,11 +78,11 @@ async function getAgentInfo(config, org, agent, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agent);
     if (matching.length === 0) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
@@ -123,8 +123,10 @@ function registerInfoCommand(program) {
         .action(async (agentArg, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         const { org, agent, version } = (0, agent_ref_1.parseAgentRef)(agentArg);
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, org);
         // Fetch agent metadata
-        const agentData = await getAgentInfo(config, org, agent, version);
+        const agentData = await getAgentInfo(config, org, agent, version, workspaceId);
         if (options.json) {
             // Don't expose internal routing URLs in JSON output
             const output = { ...agentData };

package/dist/commands/init.js

@@ -87,6 +87,185 @@ def main():
 if __name__ == "__main__":
     main()
 `;
+const CODE_TEMPLATE_JS = `/**
+ * orchagent tool entrypoint.
+ *
+ * Reads JSON input from stdin, processes it, and writes JSON output to stdout.
+ * This is the standard orchagent tool protocol.
+ *
+ * Usage:
+ *   echo '{"input": "hello"}' | node main.js
+ */
+
+const fs = require('fs');
+
+function main() {
+  const raw = fs.readFileSync('/dev/stdin', 'utf-8');
+  let data;
+  try {
+    data = raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    console.log(JSON.stringify({ error: 'Invalid JSON input' }));
+    process.exit(1);
+  }
+
+  const input = data.input || '';
+
+  // --- Your logic here ---
+  // To use workspace secrets, add them to "required_secrets" in orchagent.json:
+  //   "required_secrets": ["MY_API_KEY"]
+  // Then access via: process.env.MY_API_KEY
+  const result = \`Received: \${input}\`;
+  // --- End your logic ---
+
+  console.log(JSON.stringify({ result }));
+}
+
+main();
+`;
+const DISCORD_MAIN_JS = `/**
+ * Discord bot agent — powered by Claude.
+ *
+ * Listens for messages in configured channels and responds using the Anthropic API.
+ *
+ * Local development:
+ *   1. Copy .env.example to .env and fill in your tokens
+ *   2. npm install
+ *   3. node main.js
+ */
+
+const { Client, GatewayIntentBits } = require('discord.js');
+const Anthropic = require('@anthropic-ai/sdk');
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+
+const DISCORD_BOT_TOKEN = process.env.DISCORD_BOT_TOKEN || '';
+const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || '';
+const DISCORD_CHANNEL_IDS = process.env.DISCORD_CHANNEL_IDS || '';
+
+const MODEL = process.env.MODEL || 'claude-sonnet-4-5-20250929';
+const MAX_TOKENS = parseInt(process.env.MAX_TOKENS || '1024', 10);
+
+const SYSTEM_PROMPT = \`\\
+You are a helpful assistant in a Discord server.
+
+Be concise and friendly. Use code blocks for code examples.
+Keep responses under 1800 characters (Discord limit is 2000).\`;
+
+
+// ---------------------------------------------------------------------------
+// Anthropic API
+// ---------------------------------------------------------------------------
+
+async function askClaude(client, userMessage) {
+  const response = await client.messages.create({
+    model: MODEL,
+    max_tokens: MAX_TOKENS,
+    system: SYSTEM_PROMPT,
+    messages: [{ role: 'user', content: userMessage }],
+  });
+  return response.content[0].text;
+}
+
+
+// ---------------------------------------------------------------------------
+// Discord bot
+// ---------------------------------------------------------------------------
+
+function parseChannelIds(raw) {
+  return new Set(
+    raw.split(',')
+      .map(s => s.trim())
+      .filter(s => /^\\d+$/.test(s))
+  );
+}
+
+function main() {
+  if (!DISCORD_BOT_TOKEN) {
+    console.error('DISCORD_BOT_TOKEN not set');
+    process.exit(1);
+  }
+  if (!ANTHROPIC_API_KEY) {
+    console.error('ANTHROPIC_API_KEY not set');
+    process.exit(1);
+  }
+  if (!DISCORD_CHANNEL_IDS) {
+    console.error('DISCORD_CHANNEL_IDS not set — add comma-separated channel IDs');
+    process.exit(1);
+  }
+
+  const allowedChannels = parseChannelIds(DISCORD_CHANNEL_IDS);
+  if (allowedChannels.size === 0) {
+    console.error('No valid channel IDs in DISCORD_CHANNEL_IDS:', DISCORD_CHANNEL_IDS);
+    process.exit(1);
+  }
+
+  console.log(\`Starting bot — model: \${MODEL}, channels: \${[...allowedChannels].join(', ')}\`);
+
+  const anthropic = new Anthropic({ apiKey: ANTHROPIC_API_KEY });
+
+  const bot = new Client({
+    intents: [
+      GatewayIntentBits.Guilds,
+      GatewayIntentBits.GuildMessages,
+      GatewayIntentBits.MessageContent,
+    ],
+  });
+
+  bot.on('ready', () => {
+    console.log(\`Bot connected as \${bot.user.tag}\`);
+  });
+
+  bot.on('messageCreate', async (message) => {
+    if (message.author.bot || !message.content.trim()) return;
+
+    const channelId = message.channelId;
+    const parentId = message.channel.parentId;
+    if (!allowedChannels.has(channelId) && !allowedChannels.has(parentId)) return;
+
+    console.log(\`Message from \${message.author.tag}: \${message.content.slice(0, 100)}\`);
+
+    try {
+      await message.channel.sendTyping();
+      const answer = await askClaude(anthropic, message.content);
+      const trimmed = answer.length > 1900 ? answer.slice(0, 1897) + '...' : answer;
+      await message.reply(trimmed);
+    } catch (err) {
+      console.error('Anthropic API error:', err.message || err);
+      await message.reply('Sorry, I ran into an issue. Please try again.');
+    }
+  });
+
+  bot.login(DISCORD_BOT_TOKEN);
+}
+
+main();
+`;
+const DISCORD_PACKAGE_JSON = `{
+  "name": "discord-bot",
+  "private": true,
+  "type": "commonjs",
+  "dependencies": {
+    "discord.js": "^14.16.0",
+    "@anthropic-ai/sdk": "^0.30.0"
+  }
+}
+`;
+const DISCORD_JS_ENV_EXAMPLE = `# Required — get your bot token from https://discord.com/developers/applications
+DISCORD_BOT_TOKEN=
+
+# Required for local dev — auto-injected in production via supported_providers
+ANTHROPIC_API_KEY=
+
+# Required — comma-separated Discord channel IDs where the bot should respond
+DISCORD_CHANNEL_IDS=
+
+# Optional — customize the model and response length
+# MODEL=claude-sonnet-4-5-20250929
+# MAX_TOKENS=1024
+`;
 function readmeTemplate(agentName, flavor) {
     if (flavor === 'support_agent') {
         return `# ${agentName}
@@ -525,7 +704,8 @@ function registerInitCommand(program) {
         .option('--type <type>', 'Type: prompt, tool, agent, or skill (legacy aliases: agentic, code)', 'prompt')
         .option('--orchestrator', 'Create an orchestrator agent with dependency scaffolding and SDK boilerplate')
         .option('--run-mode <mode>', 'Run mode for agents: on_demand or always_on', 'on_demand')
-        .option('--template <name>', 'Start from a template (available: support-agent, discord, github-weekly-summary)')
+        .option('--language <lang>', 'Language: python or javascript (default: python)', 'python')
+        .option('--template <name>', 'Start from a template (available: support-agent, discord, discord-js, github-weekly-summary)')
         .action(async (name, options) => {
         const cwd = process.cwd();
         let runMode = (options.runMode || 'on_demand').trim().toLowerCase();
@@ -539,9 +719,22 @@ function registerInitCommand(program) {
             }
             initMode = { type: 'agent', flavor: 'orchestrator' };
         }
+        // Validate --language option
+        const language = (options.language || 'python').trim().toLowerCase();
+        if (!['python', 'javascript', 'js', 'typescript', 'ts'].includes(language)) {
+            throw new errors_1.CliError(`Invalid --language '${options.language}'. Use 'python' or 'javascript'.`);
+        }
+        const isJavaScript = ['javascript', 'js', 'typescript', 'ts'].includes(language);
+        // Block unsupported JS flavors
+        if (isJavaScript && initMode.flavor === 'managed_loop') {
+            throw new errors_1.CliError('JavaScript agent-type agents are not yet supported. Use --type tool for JavaScript agents.');
+        }
+        if (isJavaScript && options.orchestrator) {
+            throw new errors_1.CliError('JavaScript orchestrators are not yet supported. Use Python for orchestrator agents.');
+        }
         if (options.template) {
             const template = options.template.trim().toLowerCase();
-            const validTemplates = ['support-agent', 'discord', 'github-weekly-summary'];
+            const validTemplates = ['support-agent', 'discord', 'discord-js', 'github-weekly-summary'];
             if (!validTemplates.includes(template)) {
                 throw new errors_1.CliError(`Unknown --template '${template}'. Available templates: ${validTemplates.join(', ')}`);
             }
@@ -559,6 +752,10 @@ function registerInitCommand(program) {
                 initMode = { type: 'agent', flavor: 'discord' };
                 runMode = 'always_on';
             }
+            else if (template === 'discord-js') {
+                initMode = { type: 'agent', flavor: 'discord_js' };
+                runMode = 'always_on';
+            }
             else if (template === 'github-weekly-summary') {
                 initMode = { type: 'agent', flavor: 'github_weekly_summary' };
             }
@@ -729,6 +926,55 @@ function registerInitCommand(program) {
             process.stdout.write(`\n  See README.md for full setup guide.\n`);
             return;
         }
+        // Handle discord-js template separately (JS Discord bot)
+        if (initMode.flavor === 'discord_js') {
+            const manifestPath = path_1.default.join(targetDir, 'orchagent.json');
+            // Check if already initialized
+            try {
+                await promises_1.default.access(manifestPath);
+                throw new errors_1.CliError(`Already initialized (orchagent.json exists in ${name ? name + '/' : 'current directory'})`);
+            }
+            catch (err) {
+                if (err.code !== 'ENOENT') {
+                    throw err;
+                }
+            }
+            const manifest = {
+                name: agentName,
+                type: 'agent',
+                description: 'An always-on Discord bot powered by Claude (JavaScript)',
+                run_mode: 'always_on',
+                runtime: { command: 'node main.js' },
+                entrypoint: 'main.js',
+                supported_providers: ['anthropic'],
+                required_secrets: ['DISCORD_BOT_TOKEN', 'DISCORD_CHANNEL_IDS'],
+                tags: ['discord', 'always-on', 'javascript'],
+            };
+            await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+            await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.js'), DISCORD_MAIN_JS);
+            await promises_1.default.writeFile(path_1.default.join(targetDir, 'package.json'), DISCORD_PACKAGE_JSON);
+            await promises_1.default.writeFile(path_1.default.join(targetDir, '.env.example'), DISCORD_JS_ENV_EXAMPLE);
+            await promises_1.default.writeFile(path_1.default.join(targetDir, 'README.md'), readmeTemplate(agentName, 'discord'));
+            const prefix = name ? name + '/' : '';
+            process.stdout.write(`\nInitialized JS Discord bot "${agentName}" in ${targetDir}\n`);
+            process.stdout.write(`\nFiles created:\n`);
+            process.stdout.write(`  ${prefix}orchagent.json    - Agent configuration\n`);
+            process.stdout.write(`  ${prefix}main.js           - Discord bot (discord.js + Anthropic)\n`);
+            process.stdout.write(`  ${prefix}package.json      - npm dependencies\n`);
+            process.stdout.write(`  ${prefix}.env.example      - Environment variables template\n`);
+            process.stdout.write(`  ${prefix}README.md         - Setup guide\n`);
+            process.stdout.write(`\nNext steps:\n`);
+            const stepNum = name ? 2 : 1;
+            if (name) {
+                process.stdout.write(`  1. cd ${name}\n`);
+            }
+            process.stdout.write(`  ${stepNum}. Create a Discord bot at https://discord.com/developers/applications\n`);
+            process.stdout.write(`  ${stepNum + 1}. Enable Message Content Intent in bot settings\n`);
+            process.stdout.write(`  ${stepNum + 2}. Copy .env.example to .env and fill in your tokens\n`);
+            process.stdout.write(`  ${stepNum + 3}. Test locally: npm install && node main.js\n`);
+            process.stdout.write(`  ${stepNum + 4}. Deploy: orch publish\n`);
+            return;
+        }
         const manifestPath = path_1.default.join(targetDir, 'orchagent.json');
         const promptPath = path_1.default.join(targetDir, 'prompt.md');
         const schemaPath = path_1.default.join(targetDir, 'schema.json');
@@ -777,7 +1023,13 @@ function registerInitCommand(program) {
         }
         else if (initMode.flavor === 'code_runtime') {
             manifest.description = 'A code-runtime agent';
-            manifest.runtime = { command: 'python main.py' };
+            if (isJavaScript) {
+                manifest.runtime = { command: 'node main.js' };
+                manifest.entrypoint = 'main.js';
+            }
+            else {
+                manifest.runtime = { command: 'python main.py' };
+            }
             manifest.required_secrets = [];
         }
         await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
@@ -797,8 +1049,18 @@ function registerInitCommand(program) {
             await promises_1.default.writeFile(envExamplePath, DISCORD_ENV_EXAMPLE);
         }
         else if (initMode.flavor === 'code_runtime') {
-            const entrypointPath = path_1.default.join(targetDir, 'main.py');
-            await promises_1.default.writeFile(entrypointPath, CODE_TEMPLATE_PY);
+            if (isJavaScript) {
+                await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.js'), CODE_TEMPLATE_JS);
+                await promises_1.default.writeFile(path_1.default.join(targetDir, 'package.json'), JSON.stringify({
+                    name: agentName,
+                    private: true,
+                    type: 'commonjs',
+                    dependencies: {},
+                }, null, 2) + '\n');
+            }
+            else {
+                await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.py'), CODE_TEMPLATE_PY);
+            }
             await promises_1.default.writeFile(schemaPath, SCHEMA_TEMPLATE);
         }
         else if (initMode.flavor === 'managed_loop') {
@@ -826,7 +1088,13 @@ function registerInitCommand(program) {
             process.stdout.write(`  ${prefix}.env.example      - Environment variables template\n`);
         }
         else if (initMode.flavor === 'code_runtime') {
-            process.stdout.write(`  ${prefix}main.py           - Agent entrypoint (stdin/stdout JSON)\n`);
+            if (isJavaScript) {
+                process.stdout.write(`  ${prefix}main.js           - Agent entrypoint (stdin/stdout JSON)\n`);
+                process.stdout.write(`  ${prefix}package.json      - npm dependencies\n`);
+            }
+            else {
+                process.stdout.write(`  ${prefix}main.py           - Agent entrypoint (stdin/stdout JSON)\n`);
+            }
         }
         else {
             process.stdout.write(`  ${prefix}prompt.md         - Prompt template\n`);
@@ -863,10 +1131,18 @@ function registerInitCommand(program) {
             if (name) {
                 process.stdout.write(`  1. cd ${name}\n`);
             }
-            process.stdout.write(`  ${stepNum}. Edit main.py with your agent logic\n`);
-            process.stdout.write(`  ${stepNum + 1}. Edit schema.json with your input/output schemas\n`);
-            process.stdout.write(`  ${stepNum + 2}. Test: echo '{"input": "test"}' | python main.py\n`);
-            process.stdout.write(`  ${stepNum + 3}. Run: orchagent publish\n`);
+            if (isJavaScript) {
+                process.stdout.write(`  ${stepNum}. Edit main.js with your agent logic\n`);
+                process.stdout.write(`  ${stepNum + 1}. Edit schema.json with your input/output schemas\n`);
+                process.stdout.write(`  ${stepNum + 2}. Test: echo '{"input": "test"}' | node main.js\n`);
+                process.stdout.write(`  ${stepNum + 3}. Run: orchagent publish\n`);
+            }
+            else {
+                process.stdout.write(`  ${stepNum}. Edit main.py with your agent logic\n`);
+                process.stdout.write(`  ${stepNum + 1}. Edit schema.json with your input/output schemas\n`);
+                process.stdout.write(`  ${stepNum + 2}. Test: echo '{"input": "test"}' | python main.py\n`);
+                process.stdout.write(`  ${stepNum + 3}. Run: orchagent publish\n`);
+            }
         }
         else {
             const stepNum = name ? 2 : 1;

package/dist/commands/install.js

@@ -29,7 +29,7 @@ function parseAgentRef(value) {
     }
     throw new errors_1.CliError('Invalid agent reference. Use org/agent or agent format.');
 }
-async function downloadAgentWithFallback(config, org, name, version) {
+async function downloadAgentWithFallback(config, org, name, version, workspaceId) {
     // Fetch public metadata first to check if paid
     let publicMeta;
     try {
@@ -48,12 +48,12 @@ async function downloadAgentWithFallback(config, org, name, version) {
     if (publicMeta && (0, pricing_1.isPaidAgent)(publicMeta)) {
         // Paid agent - check if owner
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (publicMeta.org_id && callerOrg.id === publicMeta.org_id) ||
                 (publicMeta.org_slug && callerOrg.slug === publicMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint with full prompt
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === name);
                 if (matching.length > 0) {
                     let targetAgent;
@@ -90,12 +90,12 @@ async function downloadAgentWithFallback(config, org, name, version) {
     if (publicMeta && publicMeta.allow_local_download === false) {
         // Check if owner (can bypass)
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (publicMeta.org_id && callerOrg.id === publicMeta.org_id) ||
                 (publicMeta.org_slug && callerOrg.slug === publicMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === name);
                 if (matching.length > 0) {
                     let targetAgent;
@@ -128,11 +128,11 @@ async function downloadAgentWithFallback(config, org, name, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
     }
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === name);
     if (matching.length === 0) {
         throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
@@ -232,11 +232,13 @@ Note: Paid agents cannot be installed locally - they run on server only.
             throw new errors_1.CliError(errMsg);
         }
         result.scope = scope;
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
         // Download agent
         log(`Fetching ${org}/${parsed.name}@${parsed.version}...\n`);
         let agent;
         try {
-            agent = await downloadAgentWithFallback(resolved, org, parsed.name, parsed.version);
+            agent = await downloadAgentWithFallback(resolved, org, parsed.name, parsed.version, workspaceId);
         }
         catch (err) {
             if (jsonMode) {

package/dist/commands/publish.js

@@ -80,7 +80,9 @@ async function scanUndeclaredEnvVars(agentDir, requiredSecrets) {
         /os\.getenv\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/g,
     ];
     const found = new Set();
-    // Scan .py files in the agent directory (up to 2 levels deep)
+    // JS/TS env var access pattern
+    const jsEnvPattern = /process\.env\.([A-Z_][A-Z0-9_]*)/g;
+    // Scan .py/.js/.ts files in the agent directory (up to 2 levels deep)
     async function scanDir(dir, depth) {
         let entries;
         try {
@@ -112,6 +114,19 @@ async function scanUndeclaredEnvVars(agentDir, requiredSecrets) {
                     // Skip unreadable files
                 }
             }
+            else if (entry.isFile() && (name.endsWith('.js') || name.endsWith('.ts'))) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    jsEnvPattern.lastIndex = 0;
+                    let m;
+                    while ((m = jsEnvPattern.exec(content)) !== null) { // eslint-disable-line no-cond-assign
+                        found.add(m[1]);
+                    }
+                }
+                catch {
+                    // Skip unreadable files
+                }
+            }
         }
     }
     await scanDir(agentDir, 0);
@@ -147,6 +162,19 @@ async function detectSdkCompatible(agentDir) {
     catch {
         // File doesn't exist
     }
+    // Check package.json (JS/TS agents)
+    const pkgJsonPath = path_1.default.join(agentDir, 'package.json');
+    try {
+        const content = await promises_1.default.readFile(pkgJsonPath, 'utf-8');
+        const pkgJson = JSON.parse(content);
+        const deps = { ...pkgJson.dependencies, ...pkgJson.devDependencies };
+        if (deps['orchagent-sdk'] || deps['@orchagent/sdk']) {
+            return true;
+        }
+    }
+    catch {
+        // File doesn't exist or invalid JSON
+    }
     return false;
 }
 async function parseSkillMd(filePath) {
@@ -886,6 +914,26 @@ function registerPublishCommand(program) {
                     catch {
                         // Optional
                     }
+                    // Include package.json + lockfile for JS agents (overrides DEFAULT_EXCLUDES)
+                    const pkgPath = path_1.default.join(cwd, 'package.json');
+                    try {
+                        await promises_1.default.access(pkgPath);
+                        includePatterns.push('package.json');
+                        process.stdout.write(`  Including package.json for sandbox dependencies\n`);
+                        // Include lockfile for deterministic installs (npm ci)
+                        const lockPath = path_1.default.join(cwd, 'package-lock.json');
+                        try {
+                            await promises_1.default.access(lockPath);
+                            includePatterns.push('package-lock.json');
+                            process.stdout.write(`  Including package-lock.json for deterministic installs\n`);
+                        }
+                        catch {
+                            // No lockfile — npm install will be used instead of npm ci
+                        }
+                    }
+                    catch {
+                        // No package.json — not a JS agent
+                    }
                 }
                 const bundleResult = await (0, bundle_1.createCodeBundle)(cwd, bundlePath, {
                     entrypoint: bundleEntrypoint,

package/dist/commands/pull.js

@@ -58,7 +58,7 @@ function commandForEntrypoint(entrypoint) {
     return `python ${entrypoint}`;
 }
 // ─── Agent Resolution ───────────────────────────────────────────────────────
-async function resolveAgent(config, org, agent, version) {
+async function resolveAgent(config, org, agent, version, workspaceId) {
     // 1. Try public download endpoint
     try {
         const data = await (0, api_1.publicRequest)(config, `/public/agents/${org}/${agent}/${version}/download`);
@@ -96,7 +96,7 @@ async function resolveAgent(config, org, agent, version) {
             if (errorCode === 'PAID_AGENT_SERVER_ONLY' || errorCode === 'DOWNLOAD_DISABLED') {
                 // Try authenticated owner path
                 if (config.apiKey) {
-                    const ownerData = await tryOwnerFallback(config, org, agent, version);
+                    const ownerData = await tryOwnerFallback(config, org, agent, version, workspaceId);
                     if (ownerData)
                         return { ...ownerData, source: 'owner_authenticated' };
                 }
@@ -117,19 +117,19 @@ async function resolveAgent(config, org, agent, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const data = await resolveFromMyAgents(config, agent, version, org);
+    const data = await resolveFromMyAgents(config, agent, version, org, workspaceId);
     if (!data) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
     return { ...data, source: 'private_authenticated' };
 }
-async function tryOwnerFallback(config, org, agent, version) {
+async function tryOwnerFallback(config, org, agent, version, workspaceId) {
     try {
-        const myAgents = await (0, api_1.listMyAgents)(config);
+        const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
         let match;
         if (version === 'latest') {
             match = myAgents
@@ -148,8 +148,8 @@ async function tryOwnerFallback(config, org, agent, version) {
         return null;
     }
 }
-async function resolveFromMyAgents(config, agent, version, org) {
-    const agents = await (0, api_1.listMyAgents)(config);
+async function resolveFromMyAgents(config, agent, version, org, workspaceId) {
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agent && a.org_slug === org);
     if (matching.length === 0)
         return null;
@@ -361,9 +361,11 @@ Examples:
             throw new errors_1.CliError('Missing org. Use org/agent[@version] format, or set a default org with:\n' +
                 '  orch config set default-org <org>');
         }
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, org);
         write(`Resolving ${org}/${parsed.agent}@${parsed.version}...\n`);
         // Resolve agent data
-        const data = await resolveAgent(config, org, parsed.agent, parsed.version);
+        const data = await resolveAgent(config, org, parsed.agent, parsed.version, workspaceId);
         // Reject skills
         if (canonicalType(data.type) === 'skill') {
             throw new errors_1.CliError("This is a skill. Use 'orch skill install <ref>' instead.");

package/dist/commands/run.js

@@ -69,6 +69,16 @@ const DOWNSTREAM_REMAINING_ENV = 'ORCHAGENT_DOWNSTREAM_REMAINING';
 const CONTENT_FIELD_NAMES = ['code', 'content', 'text', 'source', 'input', 'file_content', 'body'];
 // Keys that might indicate local file path references in JSON payloads
 const LOCAL_PATH_KEYS = ['path', 'directory', 'file', 'filepath', 'dir', 'folder', 'local'];
+/**
+ * Return the correct local command for a given entrypoint file extension.
+ * Uses `python3` (not `python`) to match existing behavior on macOS/Linux.
+ */
+function localCommandForEntrypoint(entrypoint) {
+    if (entrypoint.endsWith('.js') || entrypoint.endsWith('.mjs') || entrypoint.endsWith('.cjs')) {
+        return 'node';
+    }
+    return 'python3';
+}
 function parseAgentRef(value) {
     const [ref, versionPart] = value.split('@');
     const version = versionPart?.trim() || DEFAULT_VERSION;
@@ -652,25 +662,6 @@ async function detectAllLlmKeys(supportedProviders, config) {
             }
         }
     }
-    if (config?.apiKey) {
-        try {
-            const { fetchLlmKeys } = await Promise.resolve().then(() => __importStar(require('../lib/api')));
-            const serverKeys = await fetchLlmKeys(config);
-            for (const serverKey of serverKeys) {
-                if (!seen.has(serverKey.provider)) {
-                    seen.add(serverKey.provider);
-                    providers.push({
-                        provider: serverKey.provider,
-                        apiKey: serverKey.api_key,
-                        model: serverKey.model || (0, llm_1.getDefaultModel)(serverKey.provider),
-                    });
-                }
-            }
-        }
-        catch {
-            // Server fetch failed, continue with what we have
-        }
-    }
     return providers;
 }
 async function executePromptLocally(agentData, inputData, skillPrompts = [], config, providerOverride, modelOverride) {
@@ -1062,6 +1053,32 @@ async function executeBundleAgent(config, org, agentName, version, agentData, ar
                 throw err;
             }
         }
+        // Install npm dependencies if package.json exists (JS agents)
+        const pkgJsonPath = path_1.default.join(extractDir, 'package.json');
+        try {
+            await promises_1.default.access(pkgJsonPath);
+            await (0, spinner_1.withSpinner)('Installing npm dependencies...', async () => {
+                const lockfilePath = path_1.default.join(extractDir, 'package-lock.json');
+                let useNpmCi = false;
+                try {
+                    await promises_1.default.access(lockfilePath);
+                    useNpmCi = true;
+                }
+                catch { /* no lockfile */ }
+                const npmArgs = useNpmCi
+                    ? ['ci', '--no-audit', '--no-fund']
+                    : ['install', '--production', '--no-audit', '--no-fund'];
+                const { code } = await runCommand('npm', npmArgs);
+                if (code !== 0) {
+                    throw new errors_1.CliError('Failed to install npm dependencies');
+                }
+            }, { successText: 'npm dependencies installed' });
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                throw err;
+            }
+        }
         const entrypoint = agentData.entrypoint || 'sandbox_main.py';
         const entrypointPath = path_1.default.join(extractDir, entrypoint);
         try {
@@ -1116,7 +1133,8 @@ async function executeBundleAgent(config, org, agentName, version, agentData, ar
                 }
             }
         }
-        process.stderr.write(`\nRunning: python3 ${entrypoint}\n\n`);
+        const execCmd = localCommandForEntrypoint(entrypoint);
+        process.stderr.write(`\nRunning: ${execCmd} ${entrypoint}\n\n`);
         const subprocessEnv = { ...process.env };
         if (config.apiKey) {
             subprocessEnv.ORCHAGENT_SERVICE_KEY = config.apiKey;
@@ -1133,7 +1151,7 @@ async function executeBundleAgent(config, org, agentName, version, agentData, ar
             subprocessEnv[MAX_HOPS_ENV] = String(manifest.manifest?.max_hops || 10);
             subprocessEnv[DOWNSTREAM_REMAINING_ENV] = String(manifest.manifest?.per_call_downstream_cap || 100);
         }
-        const proc = (0, child_process_1.spawn)('python3', [entrypointPath], {
+        const proc = (0, child_process_1.spawn)(execCmd, [entrypointPath], {
             cwd: extractDir,
             stdio: ['pipe', 'pipe', 'pipe'],
             env: subprocessEnv,
@@ -1442,7 +1460,11 @@ async function executeLocalFromDir(dirPath, args, options) {
         return;
     }
     // Code runtime agents with bundle
-    const entrypoint = manifest.entrypoint || 'sandbox_main.py';
+    const runtimeObj = manifest.runtime;
+    const runtimeCommand = runtimeObj?.command;
+    const entrypoint = manifest.entrypoint
+        || (runtimeCommand ? runtimeCommand.split(' ').pop() || 'sandbox_main.py' : null)
+        || 'sandbox_main.py';
     const entrypointPath = path_1.default.join(resolved, entrypoint);
     try {
         await promises_1.default.access(entrypointPath);
@@ -1492,6 +1514,29 @@ async function executeLocalFromDir(dirPath, args, options) {
     catch {
         // No requirements.txt
     }
+    // Install npm dependencies if package.json exists (JS agents)
+    const localPkgJsonPath = path_1.default.join(resolved, 'package.json');
+    try {
+        await promises_1.default.access(localPkgJsonPath);
+        const lockfilePath = path_1.default.join(resolved, 'package-lock.json');
+        let useNpmCi = false;
+        try {
+            await promises_1.default.access(lockfilePath);
+            useNpmCi = true;
+        }
+        catch { /* no lockfile */ }
+        const npmArgs = useNpmCi
+            ? ['ci', '--no-audit', '--no-fund']
+            : ['install', '--production', '--no-audit', '--no-fund'];
+        process.stderr.write('Installing npm dependencies...\n');
+        const { code } = await runCommand('npm', npmArgs);
+        if (code !== 0) {
+            process.stderr.write('Warning: Failed to install npm dependencies\n');
+        }
+    }
+    catch {
+        // No package.json
+    }
     // Check for keyed file/mount injection (tool path)
     const toolFileArgs = options.file ?? [];
     const toolKeyedFiles = toolFileArgs.filter(a => isKeyedFileArg(a) !== null);
@@ -1517,13 +1562,14 @@ async function executeLocalFromDir(dirPath, args, options) {
     else if (args.length > 0) {
         inputJson = JSON.stringify({ input: args[0] });
     }
-    process.stderr.write(`\nRunning: python3 ${entrypoint}\n\n`);
+    const localExecCmd = localCommandForEntrypoint(entrypoint);
+    process.stderr.write(`\nRunning: ${localExecCmd} ${entrypoint}\n\n`);
     const subprocessEnv = { ...process.env };
     if (config.apiKey) {
         subprocessEnv.ORCHAGENT_SERVICE_KEY = config.apiKey;
         subprocessEnv.ORCHAGENT_API_URL = config.apiUrl;
     }
-    const proc = (0, child_process_1.spawn)('python3', [entrypointPath], {
+    const proc = (0, child_process_1.spawn)(localExecCmd, [entrypointPath], {
         cwd: resolved,
         stdio: ['pipe', 'pipe', 'pipe'],
         env: subprocessEnv,

package/dist/commands/skill.js

@@ -88,7 +88,7 @@ function parseSkillRef(value) {
     }
     throw new errors_1.CliError('Invalid skill reference. Use org/skill or skill format.');
 }
-async function downloadSkillWithFallback(config, org, skill, version) {
+async function downloadSkillWithFallback(config, org, skill, version, workspaceId) {
     // Fetch metadata first to check if paid
     let skillMeta;
     try {
@@ -114,12 +114,12 @@ async function downloadSkillWithFallback(config, org, skill, version) {
     if (skillMeta && (0, pricing_1.isPaidAgent)(skillMeta)) {
         // Paid skill - check ownership
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (skillMeta.org_id && callerOrg.id === skillMeta.org_id) ||
                 (skillMeta.org_slug && callerOrg.slug === skillMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint with full content
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === skill && a.type === 'skill');
                 if (matching.length > 0) {
                     let targetAgent;
@@ -162,12 +162,12 @@ async function downloadSkillWithFallback(config, org, skill, version) {
     // Check if download is disabled (server-only skill)
     if (skillMeta && skillMeta.allow_local_download === false) {
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (skillMeta.org_id && callerOrg.id === skillMeta.org_id) ||
                 (skillMeta.org_slug && callerOrg.slug === skillMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === skill && a.type === 'skill');
                 if (matching.length > 0) {
                     let targetAgent;
@@ -221,12 +221,12 @@ async function downloadSkillWithFallback(config, org, skill, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
     }
     // Find skill in user's list
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === skill && a.type === 'skill');
     if (matching.length === 0) {
         throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
@@ -420,10 +420,12 @@ Instructions and guidance for AI agents...
         }
         result.skill = `${org}/${parsed.skill}`;
         result.version = parsed.version;
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
         // Download skill (tries public first, falls back to authenticated for private)
         let skillData;
         try {
-            skillData = await downloadSkillWithFallback(resolved, org, parsed.skill, parsed.version);
+            skillData = await downloadSkillWithFallback(resolved, org, parsed.skill, parsed.version, workspaceId);
         }
         catch (err) {
             if (jsonMode) {

package/dist/lib/api.js

@@ -46,7 +46,7 @@ exports.updateOrg = updateOrg;
 exports.getPublicAgent = getPublicAgent;
 exports.listMyAgents = listMyAgents;
 exports.createAgent = createAgent;
-exports.fetchLlmKeys = fetchLlmKeys;
+exports.listLlmKeys = listLlmKeys;
 exports.downloadCodeBundle = downloadCodeBundle;
 exports.uploadCodeBundle = uploadCodeBundle;
 exports.getMyAgent = getMyAgent;
@@ -306,9 +306,8 @@ async function createAgent(config, data, workspaceId) {
         headers,
     });
 }
-async function fetchLlmKeys(config) {
-    const result = await request(config, 'GET', '/llm-keys/export');
-    return result.keys;
+async function listLlmKeys(config) {
+    return request(config, 'GET', '/llm-keys');
 }
 /**
  * Download a code-runtime bundle for local execution.

package/dist/lib/bundle.js

@@ -44,7 +44,7 @@ const DEFAULT_EXCLUDES = [
     'npm-debug.log',
     'yarn-error.log',
     'package.json',
-    'package-lock.json',
+    // package-lock.json intentionally NOT excluded — included explicitly for JS agents
     'yarn.lock',
     'bun.lockb',
     'tsconfig.json',

package/dist/lib/doctor/checks/llm.js

@@ -87,7 +87,7 @@ async function runLlmChecks(options) {
         try {
             const config = await (0, config_1.getResolvedConfig)();
             if (config.apiKey) {
-                const keys = await (0, api_1.fetchLlmKeys)(config);
+                const keys = await (0, api_1.listLlmKeys)(config);
                 serverProviders = keys.map((k) => k.provider);
             }
         }

package/dist/lib/llm.js

@@ -5,39 +5,6 @@
  * Centralized LLM provider configuration and utilities.
  * Used by run, call, and skill commands.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_MODELS = exports.PROVIDER_ENV_VARS = exports.LlmError = void 0;
 exports.isRateLimitError = isRateLimitError;
@@ -107,37 +74,10 @@ function detectLlmKeyFromEnv(supportedProviders) {
  * Checks local env vars first, then fetches from server if available.
  * Returns provider, key, and optionally the model from server config.
  */
-async function detectLlmKey(supportedProviders, config) {
-    // 1. Check local env vars first (fast path)
-    const envKey = detectLlmKeyFromEnv(supportedProviders);
-    if (envKey)
-        return envKey;
-    // 2. If no env var, try server
-    if (config?.apiKey) {
-        try {
-            const { fetchLlmKeys } = await Promise.resolve().then(() => __importStar(require('./api')));
-            const serverKeys = await fetchLlmKeys(config);
-            for (const provider of supportedProviders) {
-                if (provider === 'any') {
-                    // Return first available key
-                    if (serverKeys.length > 0) {
-                        const first = serverKeys[0];
-                        return { provider: first.provider, key: first.api_key, model: first.model };
-                    }
-                }
-                else {
-                    const match = serverKeys.find((k) => k.provider === provider);
-                    if (match) {
-                        return { provider: match.provider, key: match.api_key, model: match.model };
-                    }
-                }
-            }
-        }
-        catch {
-            // Server fetch failed, continue without
-        }
-    }
-    return null;
+async function detectLlmKey(supportedProviders, _config) {
+    // LLM keys are only available from local env vars.
+    // Server-stored keys are never exported (security best practice).
+    return detectLlmKeyFromEnv(supportedProviders);
 }
 /**
  * Get the default model for a provider.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.69",
+  "version": "0.3.71",
   "description": "Command-line interface for orchagent — deploy and run AI agents for your team",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",