@orchagent/cli 0.3.77 → 0.3.79

package/dist/commands/init.js

@@ -256,7 +256,7 @@ const DISCORD_PACKAGE_JSON = `{
 const DISCORD_JS_ENV_EXAMPLE = `# Required — get your bot token from https://discord.com/developers/applications
 DISCORD_BOT_TOKEN=
 
-# Required for local dev — auto-injected in production via supported_providers
+# Required — add to workspace secrets: orch secrets set ANTHROPIC_API_KEY <key>
 ANTHROPIC_API_KEY=
 
 # Required — comma-separated Discord channel IDs where the bot should respond
@@ -364,7 +364,7 @@ Edit \`main.py\` to customize:
 | Variable | Required | Description |
 |----------|----------|-------------|
 | \`DISCORD_BOT_TOKEN\` | Yes | Discord bot token (workspace secret) |
-| \`ANTHROPIC_API_KEY\` | Auto | Injected by orchagent via \`supported_providers\` |
+| \`ANTHROPIC_API_KEY\` | Yes | Anthropic API key (workspace secret via \`required_secrets\`) |
 | \`DISCORD_CHANNEL_IDS\` | Yes | Comma-separated channel IDs (workspace secret) |
 | \`MODEL\` | No | Claude model (default: claude-sonnet-4-5-20250929) |
 | \`MAX_TOKENS\` | No | Max response tokens (default: 1024) |
@@ -422,7 +422,7 @@ Edit \`main.js\` to customize:
 | Variable | Required | Description |
 |----------|----------|-------------|
 | \`DISCORD_BOT_TOKEN\` | Yes | Discord bot token (workspace secret) |
-| \`ANTHROPIC_API_KEY\` | Auto | Injected by orchagent via \`supported_providers\` |
+| \`ANTHROPIC_API_KEY\` | Yes | Anthropic API key (workspace secret via \`required_secrets\`) |
 | \`DISCORD_CHANNEL_IDS\` | Yes | Comma-separated channel IDs (workspace secret) |
 | \`MODEL\` | No | Claude model (default: claude-sonnet-4-5-20250929) |
 | \`MAX_TOKENS\` | No | Max response tokens (default: 1024) |
@@ -782,7 +782,7 @@ anthropic>=0.40.0,<1.0.0
 const DISCORD_ENV_EXAMPLE = `# Required — get your bot token from https://discord.com/developers/applications
 DISCORD_BOT_TOKEN=
 
-# Required for local dev — auto-injected in production via supported_providers
+# Required — add to workspace secrets: orch secrets set ANTHROPIC_API_KEY <key>
 ANTHROPIC_API_KEY=
 
 # Required — comma-separated Discord channel IDs where the bot should respond
@@ -942,8 +942,7 @@ function registerInitCommand(program) {
                 entrypoint: 'main.py',
                 supported_providers: ['anthropic'],
                 default_models: { anthropic: 'claude-sonnet-4-5-20250929' },
-                required_secrets: [],
-                optional_secrets: ['DISCORD_BOT_TOKEN', 'DISCORD_CHANNEL_IDS', 'TELEGRAM_BOT_TOKEN', 'SLACK_BOT_TOKEN', 'SLACK_APP_TOKEN'],
+                required_secrets: ['ANTHROPIC_API_KEY'],
                 tags: ['support', 'discord', 'telegram', 'slack', 'always-on', 'multi-platform'],
                 bundle: {
                     include: ['*.py', 'connectors/*.py', 'knowledge/*.md', 'requirements.txt'],
@@ -1069,7 +1068,7 @@ function registerInitCommand(program) {
                 runtime: { command: 'node main.js' },
                 entrypoint: 'main.js',
                 supported_providers: ['anthropic'],
-                required_secrets: ['DISCORD_BOT_TOKEN', 'DISCORD_CHANNEL_IDS'],
+                required_secrets: ['ANTHROPIC_API_KEY', 'DISCORD_BOT_TOKEN', 'DISCORD_CHANNEL_IDS'],
                 tags: ['discord', 'always-on', 'javascript'],
             };
             await promises_1.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
@@ -1147,7 +1146,7 @@ function registerInitCommand(program) {
             manifest.description = 'An always-on Discord bot powered by Claude';
             manifest.runtime = { command: 'python main.py' };
             manifest.supported_providers = ['anthropic'];
-            manifest.required_secrets = ['DISCORD_BOT_TOKEN', 'DISCORD_CHANNEL_IDS'];
+            manifest.required_secrets = ['ANTHROPIC_API_KEY', 'DISCORD_BOT_TOKEN', 'DISCORD_CHANNEL_IDS'];
             manifest.tags = ['discord', 'always-on'];
         }
         else if (initMode.flavor === 'code_runtime') {

package/dist/commands/keys.js

@@ -1,172 +1,22 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerKeysCommand = registerKeysCommand;
-const readline = __importStar(require("readline"));
-const config_1 = require("../lib/config");
-const api_1 = require("../lib/api");
-const errors_1 = require("../lib/errors");
-const VALID_PROVIDERS = ['openai', 'anthropic', 'gemini', 'ollama'];
-async function promptForKey(provider) {
-    // Use hidden input to avoid exposing keys in terminal history/logs
-    return new Promise((resolve, reject) => {
-        const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        // Mask input by not echoing characters
-        process.stdout.write(`Enter API key for ${provider}: `);
-        if (process.stdin.isTTY) {
-            // For TTY, read without echo
-            const stdin = process.stdin;
-            stdin.setRawMode(true);
-            stdin.resume();
-            stdin.setEncoding('utf8');
-            let key = '';
-            const onData = (char) => {
-                if (char === '\n' || char === '\r') {
-                    stdin.setRawMode(false);
-                    stdin.removeListener('data', onData);
-                    rl.close();
-                    process.stdout.write('\n');
-                    resolve(key.trim());
-                }
-                else if (char === '\u0003') {
-                    // Ctrl+C
-                    stdin.setRawMode(false);
-                    rl.close();
-                    reject(new errors_1.CliError('Cancelled'));
-                }
-                else if (char === '\u007F' || char === '\b') {
-                    // Backspace
-                    if (key.length > 0) {
-                        key = key.slice(0, -1);
-                    }
-                }
-                else {
-                    key += char;
-                }
-            };
-            stdin.on('data', onData);
-        }
-        else {
-            // Non-TTY (piped input), just read normally
-            rl.question('', (answer) => {
-                rl.close();
-                resolve(answer.trim());
-            });
-        }
-    });
-}
-async function addKey(config, provider, options) {
-    let apiKey = options.key;
-    if (!apiKey) {
-        apiKey = await promptForKey(provider);
-    }
-    if (!apiKey) {
-        throw new errors_1.CliError('API key is required');
-    }
-    await (0, api_1.request)(config, 'POST', '/llm-keys', {
-        body: JSON.stringify({
-            provider,
-            api_key: apiKey,
-            endpoint_url: options.endpoint,
-        }),
-        headers: { 'Content-Type': 'application/json' },
-    });
-    process.stdout.write(`Saved ${provider} API key.\n`);
-}
-async function listKeys(config) {
-    const keys = await (0, api_1.request)(config, 'GET', '/llm-keys');
-    if (keys.length === 0) {
-        process.stdout.write('No LLM keys configured.\n');
-        process.stdout.write('\nAdd a key with: orchagent keys add <provider>\n');
-        process.stdout.write('Providers: openai, anthropic, gemini, ollama\n');
-        return;
-    }
-    process.stdout.write('Configured LLM keys:\n\n');
-    for (const key of keys) {
-        const endpoint = key.has_custom_endpoint ? ' (custom endpoint)' : '';
-        process.stdout.write(`  ${key.provider}${endpoint}\n`);
-    }
-    process.stdout.write('\n');
-}
-async function removeKey(config, provider) {
-    await (0, api_1.request)(config, 'DELETE', `/llm-keys/${provider}`);
-    process.stdout.write(`Removed ${provider} API key.\n`);
-}
+const chalk_1 = __importDefault(require("chalk"));
 function registerKeysCommand(program) {
-    const keys = program
+    program
         .command('keys')
-        .description('Manage LLM API keys for calling agents');
-    keys
-        .command('add <provider>')
-        .description('Add or update an LLM API key')
-        .option('--key <key>', 'API key (will prompt if not provided)')
-        .option('--endpoint <url>', 'Custom endpoint URL (enterprise proxy or self-hosted model)')
-        .action(async (provider, options) => {
-        const config = await (0, config_1.getResolvedConfig)();
-        if (!config.apiKey) {
-            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
-        }
-        if (!VALID_PROVIDERS.includes(provider)) {
-            throw new errors_1.CliError(`Invalid provider: ${provider}. Valid providers: ${VALID_PROVIDERS.join(', ')}`);
-        }
-        await addKey(config, provider, options);
-    });
-    keys
-        .command('list')
-        .description('List configured LLM API keys')
-        .action(async () => {
-        const config = await (0, config_1.getResolvedConfig)();
-        if (!config.apiKey) {
-            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
-        }
-        await listKeys(config);
-    });
-    keys
-        .command('remove <provider>')
-        .description('Remove an LLM API key')
-        .action(async (provider) => {
-        const config = await (0, config_1.getResolvedConfig)();
-        if (!config.apiKey) {
-            throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
-        }
-        if (!VALID_PROVIDERS.includes(provider)) {
-            throw new errors_1.CliError(`Invalid provider: ${provider}. Valid providers: ${VALID_PROVIDERS.join(', ')}`);
-        }
-        await removeKey(config, provider);
+        .description('(Deprecated) Use "orch secrets" instead')
+        .allowUnknownOption(true)
+        .action(() => {
+        process.stderr.write(chalk_1.default.yellow('\nThe `orch keys` command has been removed.\n\n') +
+            `LLM API keys are now managed through the unified workspace secrets vault.\n` +
+            `Use ${chalk_1.default.cyan('orch secrets')} instead:\n\n` +
+            `  ${chalk_1.default.cyan('orch secrets set ANTHROPIC_API_KEY <key>')}   Add an LLM key\n` +
+            `  ${chalk_1.default.cyan('orch secrets list')}                          List all secrets\n` +
+            `  ${chalk_1.default.cyan('orch secrets delete ANTHROPIC_API_KEY')}      Remove a key\n\n`);
+        process.exit(1);
     });
 }

package/dist/lib/api.js

@@ -46,7 +46,6 @@ exports.updateOrg = updateOrg;
 exports.getPublicAgent = getPublicAgent;
 exports.listMyAgents = listMyAgents;
 exports.createAgent = createAgent;
-exports.listLlmKeys = listLlmKeys;
 exports.downloadCodeBundle = downloadCodeBundle;
 exports.uploadCodeBundle = uploadCodeBundle;
 exports.getMyAgent = getMyAgent;
@@ -306,9 +305,6 @@ async function createAgent(config, data, workspaceId) {
         headers,
     });
 }
-async function listLlmKeys(config) {
-    return request(config, 'GET', '/llm-keys');
-}
 /**
  * Download a code-runtime bundle for local execution.
  */

package/dist/lib/doctor/checks/llm.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runLlmChecks = runLlmChecks;
-const config_1 = require("../../config");
-const api_1 = require("../../api");
 // All supported LLM providers (single source of truth)
 const PROVIDERS = [
     { id: 'openai', displayName: 'OpenAI', envVars: ['OPENAI_API_KEY'], keyPrefix: 'sk-' },
@@ -26,13 +24,18 @@ function getFormatHint(provider, value) {
     return null;
 }
 /**
- * Gather per-provider status from server keys and local env vars.
+ * Run all LLM configuration checks with per-provider breakdown.
+ *
+ * Checks local environment variables for LLM provider keys.
+ * Server-side keys are managed through the workspace secrets vault
+ * (use `orch secrets list` to check).
  */
-function gatherProviderStatuses(serverProviders) {
-    return PROVIDERS.map((provider) => {
-        // Server status
-        const server = serverProviders === null ? null : serverProviders.includes(provider.id);
-        // Local status — check each env var
+async function runLlmChecks(options) {
+    const results = [];
+    // Per-provider results (local env vars only)
+    let configuredCount = 0;
+    let firstUnconfigured;
+    for (const provider of PROVIDERS) {
         let local = false;
         let localEnvVar;
         let formatHint;
@@ -47,96 +50,37 @@ function gatherProviderStatuses(serverProviders) {
                 break;
             }
         }
-        return {
-            providerId: provider.id,
-            displayName: provider.displayName,
-            server,
-            local,
-            localEnvVar,
-            formatHint,
-        };
-    });
-}
-/**
- * Build a human-readable location string from server/local status.
- */
-function locationString(status) {
-    if (status.server === null) {
-        // Server unknown (offline)
-        if (status.local)
-            return 'Server unknown, local configured';
-        return 'Server unknown, not local';
-    }
-    if (status.server && status.local)
-        return 'Configured (server + local)';
-    if (status.server)
-        return 'Configured (server)';
-    if (status.local)
-        return 'Configured (local)';
-    return 'Not configured';
-}
-/**
- * Run all LLM configuration checks with per-provider breakdown.
- *
- * When skipServer is true, server status is null for all providers
- * (shown as "unknown" in output). Use this when the gateway is unreachable.
- */
-async function runLlmChecks(options) {
-    let serverProviders = null;
-    if (!options?.skipServer) {
-        try {
-            const config = await (0, config_1.getResolvedConfig)();
-            if (config.apiKey) {
-                const keys = await (0, api_1.listLlmKeys)(config);
-                serverProviders = keys.map((k) => k.provider);
-            }
-        }
-        catch (err) {
-            // If we can't reach the server, treat as unknown
-            if (err instanceof api_1.ApiError && err.status === 401) {
-                // Auth failed — server providers unknown
-            }
-            // Network error or other — server providers unknown
-        }
-    }
-    const statuses = gatherProviderStatuses(serverProviders);
-    const results = [];
-    // Per-provider results
-    for (const status of statuses) {
-        const configured = status.server === true || status.local;
+        if (local)
+            configuredCount++;
+        else if (!firstUnconfigured)
+            firstUnconfigured = provider.id;
         results.push({
             category: 'llm',
-            name: `llm_provider_${status.providerId}`,
-            status: configured ? 'success' : 'info',
-            message: `${status.providerId} — ${locationString(status)}`,
+            name: `llm_provider_${provider.id}`,
+            status: local ? 'success' : 'info',
+            message: `${provider.id} — ${local ? 'Configured (local)' : 'Not configured locally'}`,
             details: {
-                providerId: status.providerId,
-                displayName: status.displayName,
-                server: status.server,
-                local: status.local,
-                ...(status.localEnvVar && { localEnvVar: status.localEnvVar }),
-                ...(status.formatHint && { formatHint: status.formatHint }),
+                providerId: provider.id,
+                displayName: provider.displayName,
+                server: null,
+                local,
+                ...(localEnvVar && { localEnvVar }),
+                ...(formatHint && { formatHint }),
             },
         });
     }
     // Summary result
-    const configuredCount = statuses.filter((s) => s.server === true || s.local).length;
-    const firstUnconfigured = statuses.find((s) => s.server !== true && !s.local);
     let summaryStatus;
     let summaryMessage;
     let summaryFix;
     if (configuredCount === 0) {
         summaryStatus = 'warning';
-        summaryMessage = 'No LLM providers configured';
-        summaryFix = firstUnconfigured ? `Run: orchagent keys add ${firstUnconfigured.providerId}` : undefined;
+        summaryMessage = 'No LLM providers configured locally';
+        summaryFix = 'For cloud runs, add keys to your workspace vault: orch secrets set ANTHROPIC_API_KEY <key>';
     }
     else {
         summaryStatus = 'success';
-        summaryMessage =
-            configuredCount < 2
-                ? 'Tip: Multiple providers enable automatic rate limit fallback.'
-                : `${configuredCount} providers configured`;
-        summaryFix = firstUnconfigured ? `Run: orchagent keys add ${firstUnconfigured.providerId}` : undefined;
+        summaryMessage = `${configuredCount} local provider${configuredCount > 1 ? 's' : ''} configured`;
     }
     results.push({
         category: 'llm',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.77",
+  "version": "0.3.79",
   "description": "Command-line interface for orchagent — deploy and run AI agents for your team",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",