@orchagent/cli 0.3.76 → 0.3.77

package/dist/commands/publish.js

@@ -360,6 +360,7 @@ function registerPublishCommand(program) {
         .option('--skills-locked', 'Lock default skills (callers cannot override via headers)')
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
         .option('--local-download', 'Allow users to download and run locally (default: server-only)')
+        .option('--no-required-secrets', 'Skip required_secrets check for tool/agent types')
         .action(async (options) => {
         const skillsFromFlag = options.skills
             ? options.skills.split(',').map(s => s.trim()).filter(Boolean)
@@ -820,6 +821,19 @@ function registerPublishCommand(program) {
                     `  (Platform-injected vars like LLM API keys are already excluded.)\n\n`);
             }
         }
+        // C-1: Block publish if tool/agent type has no required_secrets declared.
+        // Prompt and skill types are exempt (prompt agents get LLM keys from platform,
+        // skills don't run standalone).
+        if ((canonicalType === 'tool' || canonicalType === 'agent') &&
+            (!manifest.required_secrets || manifest.required_secrets.length === 0) &&
+            options.requiredSecrets !== false) {
+            process.stderr.write(chalk_1.default.red(`\nError: ${canonicalType} agents must declare required_secrets in orchagent.json.\n\n`) +
+                `  Add the env vars your code needs at runtime:\n` +
+                `  ${chalk_1.default.cyan('"required_secrets": ["ANTHROPIC_API_KEY", "MY_TOKEN"]')}\n\n` +
+                `  These are matched by name against your workspace secrets vault.\n` +
+                `  Use ${chalk_1.default.cyan('--no-required-secrets')} to skip this check.\n`);
+            throw new errors_1.CliError('Missing required_secrets declaration', errors_1.ExitCodes.INVALID_INPUT);
+        }
         // Create the agent (server auto-assigns version)
         let result;
         try {

package/dist/commands/service.js

@@ -147,6 +147,13 @@ function registerServiceCommand(program) {
             spinner.fail('Failed to resolve agent');
             throw e;
         }
+        // C-2: Show deprecation notice when --secret is used
+        if (options.secret.length > 0) {
+            process.stderr.write(chalk_1.default.yellow(`\nTip: `) +
+                `Declare secrets in orchagent.json ${chalk_1.default.cyan('required_secrets')} instead.\n` +
+                `They'll be auto-injected from your workspace vault at deploy time.\n` +
+                `The ${chalk_1.default.cyan('--secret')} flag is for extras not declared on the agent.\n\n`);
+        }
         const deploySpinner = (0, spinner_1.createSpinner)('Deploying service...');
         deploySpinner.start();
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.76",
+  "version": "0.3.77",
   "description": "Command-line interface for orchagent — deploy and run AI agents for your team",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",