@orchagent/cli 0.3.75 → 0.3.77

package/dist/commands/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerCommands = registerCommands;
 const login_1 = require("./login");
+const logout_1 = require("./logout");
 const call_1 = require("./call");
 const agents_1 = require("./agents");
 const init_1 = require("./init");
@@ -37,6 +38,7 @@ const logs_1 = require("./logs");
 const secrets_1 = require("./secrets");
 function registerCommands(program) {
     (0, login_1.registerLoginCommand)(program);
+    (0, logout_1.registerLogoutCommand)(program);
     (0, whoami_1.registerWhoamiCommand)(program);
     (0, init_1.registerInitCommand)(program);
     (0, publish_1.registerPublishCommand)(program);

package/dist/commands/logout.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLogoutCommand = registerLogoutCommand;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const analytics_1 = require("../lib/analytics");
+function registerLogoutCommand(program) {
+    program
+        .command('logout')
+        .description('Log out of orchagent (revokes API key and clears local credentials)')
+        .action(async () => {
+        const config = await (0, config_1.loadConfig)();
+        // Check if already logged out
+        if (!config.api_key && !process.env.ORCHAGENT_API_KEY) {
+            process.stdout.write('Not logged in.\n');
+            return;
+        }
+        const resolved = await (0, config_1.getResolvedConfig)();
+        // Best-effort server-side key revocation (Vercel/Fly pattern)
+        if (resolved.apiKey) {
+            try {
+                await (0, api_1.safeFetch)(`${resolved.apiUrl}/auth/cli-logout`, {
+                    method: 'POST',
+                    headers: {
+                        Authorization: `Bearer ${resolved.apiKey}`,
+                    },
+                });
+            }
+            catch {
+                // Network errors, server down, etc. — proceed with local cleanup
+            }
+        }
+        // Clear auth fields but preserve user preferences
+        delete config.api_key;
+        delete config.default_org;
+        delete config.workspace;
+        await (0, config_1.saveConfig)(config);
+        await (0, analytics_1.track)('cli_logout', {});
+        process.stdout.write('Logged out.\n');
+        // Warn if env var is still set (GitHub CLI / Fly.io pattern)
+        if (process.env.ORCHAGENT_API_KEY) {
+            process.stderr.write('\nWarning: ORCHAGENT_API_KEY is set in your environment.\n' +
+                'The env var will still authenticate requests. Unset it with:\n' +
+                '  unset ORCHAGENT_API_KEY\n');
+        }
+    });
+}

package/dist/commands/publish.js

@@ -360,6 +360,7 @@ function registerPublishCommand(program) {
         .option('--skills-locked', 'Lock default skills (callers cannot override via headers)')
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
         .option('--local-download', 'Allow users to download and run locally (default: server-only)')
+        .option('--no-required-secrets', 'Skip required_secrets check for tool/agent types')
         .action(async (options) => {
         const skillsFromFlag = options.skills
             ? options.skills.split(',').map(s => s.trim()).filter(Boolean)
@@ -820,6 +821,19 @@ function registerPublishCommand(program) {
                     `  (Platform-injected vars like LLM API keys are already excluded.)\n\n`);
             }
         }
+        // C-1: Block publish if tool/agent type has no required_secrets declared.
+        // Prompt and skill types are exempt (prompt agents get LLM keys from platform,
+        // skills don't run standalone).
+        if ((canonicalType === 'tool' || canonicalType === 'agent') &&
+            (!manifest.required_secrets || manifest.required_secrets.length === 0) &&
+            options.requiredSecrets !== false) {
+            process.stderr.write(chalk_1.default.red(`\nError: ${canonicalType} agents must declare required_secrets in orchagent.json.\n\n`) +
+                `  Add the env vars your code needs at runtime:\n` +
+                `  ${chalk_1.default.cyan('"required_secrets": ["ANTHROPIC_API_KEY", "MY_TOKEN"]')}\n\n` +
+                `  These are matched by name against your workspace secrets vault.\n` +
+                `  Use ${chalk_1.default.cyan('--no-required-secrets')} to skip this check.\n`);
+            throw new errors_1.CliError('Missing required_secrets declaration', errors_1.ExitCodes.INVALID_INPUT);
+        }
         // Create the agent (server auto-assigns version)
         let result;
         try {

package/dist/commands/service.js

@@ -147,6 +147,13 @@ function registerServiceCommand(program) {
             spinner.fail('Failed to resolve agent');
             throw e;
         }
+        // C-2: Show deprecation notice when --secret is used
+        if (options.secret.length > 0) {
+            process.stderr.write(chalk_1.default.yellow(`\nTip: `) +
+                `Declare secrets in orchagent.json ${chalk_1.default.cyan('required_secrets')} instead.\n` +
+                `They'll be auto-injected from your workspace vault at deploy time.\n` +
+                `The ${chalk_1.default.cyan('--secret')} flag is for extras not declared on the agent.\n\n`);
+        }
         const deploySpinner = (0, spinner_1.createSpinner)('Deploying service...');
         deploySpinner.start();
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.75",
+  "version": "0.3.77",
   "description": "Command-line interface for orchagent — deploy and run AI agents for your team",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",