@orchagent/cli 0.3.83 → 0.3.85

package/dist/commands/publish.js

@@ -39,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractTemplateVariables = extractTemplateVariables;
 exports.deriveInputSchema = deriveInputSchema;
 exports.scanUndeclaredEnvVars = scanUndeclaredEnvVars;
+exports.scanReservedPort = scanReservedPort;
 exports.detectSdkCompatible = detectSdkCompatible;
 exports.checkDependencies = checkDependencies;
 exports.registerPublishCommand = registerPublishCommand;
@@ -167,6 +168,68 @@ async function scanUndeclaredEnvVars(agentDir, requiredSecrets) {
     // Return env vars that are referenced but not declared or auto-injected
     return [...found].filter(v => !declared.has(v) && !autoInjected.has(v)).sort();
 }
+/**
+ * Scan code files for patterns that bind to port 8080 — the platform reserves
+ * this port for the always-on service health server.  Returns true if a likely
+ * port-8080 binding is detected.
+ */
+async function scanReservedPort(agentDir) {
+    // Patterns that indicate binding to port 8080 in Python / JS / TS
+    const pyPatterns = [
+        /\.listen\s*\(\s*8080\b/, // server.listen(8080
+        /\.run\s*\([^)]*port\s*=\s*8080\b/, // app.run(port=8080
+        /\.run\s*\([^)]*host\s*=\s*['"][^'"]*['"],?\s*8080\b/, // app.run("0.0.0.0", 8080
+        /bind\s*\(\s*\(?['"][^'"]*['"]\s*,\s*8080\b/, // bind(("0.0.0.0", 8080
+        /PORT\s*=\s*8080\b/, // PORT = 8080
+        /port\s*=\s*8080\b/, // port=8080
+    ];
+    const jsPatterns = [
+        /\.listen\s*\(\s*8080\b/, // app.listen(8080
+        /port\s*[:=]\s*8080\b/, // port: 8080  or  port = 8080
+        /PORT\s*[:=]\s*8080\b/, // PORT = 8080
+    ];
+    async function scanDir(dir, depth) {
+        let entries;
+        try {
+            entries = await promises_1.default.readdir(dir, { withFileTypes: true });
+            if (!entries || !Array.isArray(entries))
+                return false;
+        }
+        catch {
+            return false;
+        }
+        for (const entry of entries) {
+            const name = entry.name;
+            const fullPath = path_1.default.join(dir, name);
+            if (entry.isDirectory() && depth < 2 && !name.startsWith('.') && name !== 'node_modules' && name !== '__pycache__' && name !== 'venv' && name !== '.venv') {
+                if (await scanDir(fullPath, depth + 1))
+                    return true;
+            }
+            else if (entry.isFile() && name.endsWith('.py')) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    for (const re of pyPatterns) {
+                        if (re.test(content))
+                            return true;
+                    }
+                }
+                catch { /* skip */ }
+            }
+            else if (entry.isFile() && (name.endsWith('.js') || name.endsWith('.ts'))) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    for (const re of jsPatterns) {
+                        if (re.test(content))
+                            return true;
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        return false;
+    }
+    return scanDir(agentDir, 0);
+}
 /**
  * Check if orchagent-sdk is listed in requirements.txt or pyproject.toml
  */
@@ -319,11 +382,8 @@ function inferExecutionEngineFromManifest(manifest, rawType) {
         return 'managed_loop';
     if (rawType === 'tool' || rawType === 'code')
         return 'code_runtime';
-    if (rawType === 'agentic')
+    if (rawType === 'agentic' || rawType === 'agent')
         return 'managed_loop';
-    if (rawType === 'agent' && (manifest.custom_tools?.length || manifest.max_turns)) {
-        return 'managed_loop';
-    }
     return 'direct_llm';
 }
 function commandForEntrypoint(entrypoint) {
@@ -485,6 +545,7 @@ function registerPublishCommand(program) {
                     description: skillData.frontmatter.description,
                     prompt: skillData.body,
                     is_public: false,
+                    callable: false,
                     supported_providers: ['any'],
                     default_skills: skillsFromFlag,
                     skills_locked: options.skillsLocked || undefined,
@@ -495,7 +556,7 @@ function registerPublishCommand(program) {
                 const skillVersion = skillResult.agent?.version || 'v1';
                 const skillAgentId = skillResult.agent?.id;
                 await (0, analytics_1.track)('cli_publish', { agent_type: 'skill', multi_file: hasMultipleFiles });
-                process.stdout.write(`\nPublished skill: ${org.slug}/${skillData.frontmatter.name}@${skillVersion}\n`);
+                process.stdout.write(`\n${chalk_1.default.green('✔')} Published ${org.slug}/${skillData.frontmatter.name}@${skillVersion} successfully!\n\n`);
                 if (hasMultipleFiles) {
                     process.stdout.write(`Files: ${skillFiles.length} files included\n`);
                 }
@@ -542,7 +603,7 @@ function registerPublishCommand(program) {
         const { canonicalType, rawType } = canonicalizeManifestType(manifest.type);
         const runMode = normalizeRunMode(manifest.run_mode);
         const executionEngine = inferExecutionEngineFromManifest(manifest, rawType);
-        const callable = Boolean(manifest.callable);
+        const callable = manifest.callable !== undefined ? Boolean(manifest.callable) : true;
         if (canonicalType === 'skill') {
             throw new errors_1.CliError("Use SKILL.md for publishing skills. Remove orchagent.json and run 'orchagent publish' from a skill directory.");
         }
@@ -706,6 +767,7 @@ function registerPublishCommand(program) {
         }
         let agentUrl = options.url;
         let shouldUploadBundle = false;
+        let servicesUpdated = 0;
         let runtimeConfig;
         let bundleEntrypoint = manifest.entrypoint;
         if (executionEngine === 'code_runtime') {
@@ -766,12 +828,13 @@ function registerPublishCommand(program) {
                     `  Publish each dependency first, then re-run this publish.\n\n`);
             }
             if (notCallable.length > 0) {
-                process.stderr.write(chalk_1.default.yellow(`\n⚠ Dependencies not marked as callable:\n`));
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Dependencies have callable: false:\n`));
                 for (const dep of notCallable) {
                     process.stderr.write(chalk_1.default.yellow(`  - ${dep.ref}\n`));
                 }
-                process.stderr.write(`\n  Agents must have callable: true in orchagent.json to be invoked\n` +
-                    `  by orchestrators. Update and republish each dependency.\n\n`);
+                process.stderr.write(`\n  These agents have explicitly set callable: false, which blocks\n` +
+                    `  agent-to-agent calls at runtime. Set callable: true (or remove\n` +
+                    `  the field to use the default) and republish each dependency.\n\n`);
             }
         }
         // Handle dry-run for agents
@@ -882,18 +945,35 @@ function registerPublishCommand(program) {
                     `  (Platform-injected vars like LLM API keys are already excluded.)\n\n`);
             }
         }
+        // Warn if always_on code binds to port 8080 (reserved for platform health server)
+        if (runMode === 'always_on' && executionEngine === 'code_runtime') {
+            const usesReservedPort = await scanReservedPort(cwd);
+            if (usesReservedPort) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Your code appears to bind to port 8080, which is reserved by the\n`) +
+                    chalk_1.default.yellow(`  platform health server for always-on services.\n\n`) +
+                    `  Your service will crash with EADDRINUSE at runtime.\n` +
+                    `  Use a different port (e.g. 3000) or read the ORCHAGENT_HEALTH_PORT\n` +
+                    `  env var to detect the reserved port.\n\n`);
+            }
+        }
         // C-1: Block publish if tool/agent type has no required_secrets declared.
         // Prompt and skill types are exempt (prompt agents get LLM keys from platform,
         // skills don't run standalone).
+        // An explicit empty array (required_secrets: []) is a valid declaration
+        // meaning "this agent deliberately needs no secrets."
         if ((canonicalType === 'tool' || canonicalType === 'agent') &&
-            (!manifest.required_secrets || manifest.required_secrets.length === 0) &&
+            manifest.required_secrets === undefined &&
             options.requiredSecrets !== false) {
             process.stderr.write(chalk_1.default.red(`\nError: ${canonicalType} agents must declare required_secrets in orchagent.json.\n\n`) +
                 `  Add the env vars your code needs at runtime:\n` +
                 `  ${chalk_1.default.cyan('"required_secrets": ["ANTHROPIC_API_KEY", "MY_TOKEN"]')}\n\n` +
+                `  If this agent genuinely needs no secrets, add an empty array:\n` +
+                `  ${chalk_1.default.cyan('"required_secrets": []')}\n\n` +
                 `  These are matched by name against your workspace secrets vault.\n` +
                 `  Use ${chalk_1.default.cyan('--no-required-secrets')} to skip this check.\n`);
-            throw new errors_1.CliError('Missing required_secrets declaration', errors_1.ExitCodes.INVALID_INPUT);
+            const err = new errors_1.CliError('Missing required_secrets declaration', errors_1.ExitCodes.INVALID_INPUT);
+            err.displayed = true;
+            throw err;
         }
         // Create the agent (server auto-assigns version)
         let result;
@@ -1045,9 +1125,9 @@ function registerPublishCommand(program) {
                         process.stdout.write(`  ${chalk_1.default.cyan('Using workspace default environment')}\n`);
                     }
                 }
-                // Show service auto-update info
+                // Store service update count for success message
                 if (uploadResult.services_updated && uploadResult.services_updated > 0) {
-                    process.stdout.write(`  ${chalk_1.default.green(`Updated ${uploadResult.services_updated} service(s) to ${assignedVersion}`)}\n`);
+                    servicesUpdated = uploadResult.services_updated;
                 }
             }
             finally {
@@ -1062,7 +1142,11 @@ function registerPublishCommand(program) {
             callable,
             hosted: shouldUploadBundle,
         });
-        process.stdout.write(`\nPublished agent: ${org.slug}/${manifest.name}@${assignedVersion}\n`);
+        process.stdout.write(`\n${chalk_1.default.green('✔')} Published ${org.slug}/${manifest.name}@${assignedVersion} successfully!\n`);
+        if (servicesUpdated > 0) {
+            process.stdout.write(`${chalk_1.default.green('✔')} Updated ${servicesUpdated} running service(s) to ${assignedVersion} successfully!\n`);
+        }
+        process.stdout.write(`\n`);
         process.stdout.write(`Type: ${canonicalType}\n`);
         process.stdout.write(`Run mode: ${runMode}\n`);
         process.stdout.write(`Execution engine: ${executionEngine}${shouldUploadBundle ? ' (hosted)' : ''}\n`);
@@ -1120,6 +1204,5 @@ function registerPublishCommand(program) {
             process.stdout.write(`\nNote: Hosted code execution is in beta. Contact support for full deployment.\n`);
         }
         process.stdout.write(`\nView analytics and usage: https://orchagent.io/dashboard\n`);
-        process.stdout.write(`\nSkill: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`);
     });
 }

package/dist/commands/pull.js

@@ -29,7 +29,13 @@ function parsePullRef(value) {
 }
 function canonicalType(typeValue) {
     const normalized = (typeValue || 'agent').toLowerCase();
-    return normalized === 'skill' ? 'skill' : 'agent';
+    if (['prompt', 'tool', 'agent', 'skill'].includes(normalized))
+        return normalized;
+    if (normalized === 'code')
+        return 'tool';
+    if (normalized === 'agentic')
+        return 'agent';
+    return 'agent';
 }
 function resolveEngine(data) {
     const ee = data.execution_engine;
@@ -200,7 +206,7 @@ function buildManifest(data) {
     const manifest = {
         name: data.name,
         description: data.description || '',
-        type: canonicalType(data.type) === 'skill' ? 'skill' : 'agent',
+        type: canonicalType(data.type),
     };
     if (data.run_mode)
         manifest.run_mode = data.run_mode;

package/dist/commands/run.js

@@ -55,7 +55,6 @@ const output_1 = require("../lib/output");
 const spinner_1 = require("../lib/spinner");
 const llm_1 = require("../lib/llm");
 const analytics_1 = require("../lib/analytics");
-const pricing_1 = require("../lib/pricing");
 const package_json_1 = __importDefault(require("../../package.json"));
 const DEFAULT_VERSION = 'latest';
 const AGENTS_DIR = path_1.default.join(os_1.default.homedir(), '.orchagent', 'agents');
@@ -462,16 +461,10 @@ async function downloadAgent(config, org, agent, version, workspaceId) {
                     }
                 }
                 // Non-owner - block with helpful message
-                if (errorCode === 'PAID_AGENT_SERVER_ONLY') {
-                    const price = payload.error.price_per_call_cents || 0;
-                    const priceStr = price ? `$${(price / 100).toFixed(2)}/call` : 'PAID';
-                    throw new errors_1.CliError(`This agent is paid (${priceStr}) and runs on server only.\n\n` +
-                        `Run without --local: orch run ${org}/${agent}@${version} --data '{...}'`);
-                }
-                else {
-                    throw new errors_1.CliError(`This agent is server-only and cannot be downloaded.\n\n` +
-                        `Run without --local: orch run ${org}/${agent}@${version} --data '{...}'`);
-                }
+                // Use the gateway message which has the correct type label (agent/tool/skill/prompt)
+                const serverMsg = payload?.error?.message || 'This agent is server-only.';
+                throw new errors_1.CliError(`${serverMsg}\n\n` +
+                    `Run without --local: orch run ${org}/${agent}@${version} --data '{...}'`);
             }
         }
         if (!(err instanceof api_1.ApiError) || err.status !== 404)
@@ -682,7 +675,7 @@ async function executePromptLocally(agentData, inputData, skillPrompts = [], con
         if (allProviders.length === 0) {
             const providers = providersToCheck.join(', ');
             throw new errors_1.CliError(`No LLM key found for: ${providers}\n` +
-                `Set an environment variable (e.g., OPENAI_API_KEY), run 'orchagent keys add <provider>', or configure in web dashboard`);
+                `Set an environment variable (e.g., OPENAI_API_KEY), run 'orch secrets set <PROVIDER>_API_KEY <key>', or configure in web dashboard`);
         }
         if (modelOverride && !providerOverride && allProviders.length > 1) {
             process.stderr.write(`Warning: --model specified without --provider. The model '${modelOverride}' will be used for all ${allProviders.length} fallback providers, which may cause errors if the model is incompatible.\n` +
@@ -709,7 +702,7 @@ async function executePromptLocally(agentData, inputData, skillPrompts = [], con
     if (!detected) {
         const providers = providersToCheck.join(', ');
         throw new errors_1.CliError(`No LLM key found for: ${providers}\n` +
-            `Set an environment variable (e.g., OPENAI_API_KEY), run 'orchagent keys add <provider>', or configure in web dashboard`);
+            `Set an environment variable (e.g., OPENAI_API_KEY), run 'orch secrets set <PROVIDER>_API_KEY <key>', or configure in web dashboard`);
     }
     const { provider, key, model: serverModel } = detected;
     const model = modelOverride || serverModel || agentData.default_models?.[provider] || (0, llm_1.getDefaultModel)(provider);
@@ -743,7 +736,7 @@ async function executeAgentLocally(agentDir, prompt, inputData, outputSchema, cu
     if (allProviders.length === 0) {
         const providers = providersToCheck.join(', ');
         throw new errors_1.CliError(`No LLM key found for: ${providers}\n` +
-            `Set an environment variable (e.g., ANTHROPIC_API_KEY), run 'orchagent keys add <provider>', or configure in web dashboard`);
+            `Set an environment variable (e.g., ANTHROPIC_API_KEY), run 'orch secrets set <PROVIDER>_API_KEY <key>', or configure in web dashboard`);
     }
     const primary = allProviders[0];
     const model = modelOverride || primary.model || (0, llm_1.getDefaultModel)(primary.provider);
@@ -1703,58 +1696,6 @@ async function executeCloud(agentRef, file, options) {
             }
         }
     }
-    // Pre-call balance check for paid agents
-    let pricingInfo;
-    if ((0, pricing_1.isPaidAgent)(agentMeta)) {
-        let isOwner = false;
-        try {
-            const callerOrg = await (0, api_1.getOrg)(resolved, workspaceId);
-            const agentOrgId = agentMeta.org_id;
-            const agentOrgSlug = agentMeta.org_slug;
-            if (agentOrgId && callerOrg.id === agentOrgId) {
-                isOwner = true;
-            }
-            else if (agentOrgSlug && callerOrg.slug === agentOrgSlug) {
-                isOwner = true;
-            }
-        }
-        catch {
-            isOwner = false;
-        }
-        if (isOwner) {
-            if (!options.json)
-                process.stderr.write(`Cost: FREE (author)\n\n`);
-        }
-        else {
-            const price = agentMeta.price_per_call_cents;
-            pricingInfo = { price_cents: price ?? null };
-            if (!price || price <= 0) {
-                if (!options.json)
-                    process.stderr.write(`Warning: Pricing data unavailable. The server will verify payment.\n\n`);
-            }
-            else {
-                try {
-                    const balanceData = await (0, api_1.getCreditsBalance)(resolved);
-                    const balance = balanceData.balance_cents;
-                    if (balance < price) {
-                        process.stderr.write(`Insufficient credits:\n` +
-                            `  Balance:  $${(balance / 100).toFixed(2)}\n` +
-                            `  Required: $${(price / 100).toFixed(2)}\n\n` +
-                            `Add credits:\n` +
-                            `  orch billing add 5\n` +
-                            `  orch billing balance  # check current balance\n`);
-                        process.exit(errors_1.ExitCodes.PERMISSION_DENIED);
-                    }
-                    if (!options.json)
-                        process.stderr.write(`Cost: $${(price / 100).toFixed(2)}/call\n\n`);
-                }
-                catch (err) {
-                    if (!options.json)
-                        process.stderr.write(`Warning: Could not verify balance. The server will check payment.\n\n`);
-                }
-            }
-        }
-    }
     const endpoint = options.endpoint?.trim() || agentMeta.default_endpoint || 'analyze';
     const headers = {
         Authorization: `Bearer ${resolved.apiKey}`,
@@ -1834,12 +1775,6 @@ async function executeCloud(agentRef, file, options) {
             ...(options.model && { model: options.model }),
         };
     }
-    else if (cloudEngine !== 'code_runtime') {
-        const searchedProviders = effectiveProvider ? [effectiveProvider] : supportedProviders;
-        const providerList = searchedProviders.join(', ');
-        process.stderr.write(`Warning: No LLM key found for provider(s): ${providerList}\n` +
-            `Set an env var (e.g., OPENAI_API_KEY), run 'orchagent keys add <provider>', use --key, or configure in web dashboard\n\n`);
-    }
     if (options.skills) {
         headers['X-OrchAgent-Skills'] = options.skills;
     }
@@ -2033,7 +1968,7 @@ async function executeCloud(agentRef, file, options) {
         });
     }
     catch (err) {
-        spinner?.fail(`Run failed: ${err instanceof Error ? err.message : 'Unknown error'}`);
+        spinner?.stop();
         throw err;
     }
     if (!response.ok) {
@@ -2048,20 +1983,8 @@ async function executeCloud(agentRef, file, options) {
         const errorCode = typeof payload === 'object' && payload
             ? payload.error?.code
             : undefined;
-        if (response.status === 402 || errorCode === 'INSUFFICIENT_CREDITS') {
-            spinner?.fail('Insufficient credits');
-            let errorMessage = 'Insufficient credits to run this agent.\n\n';
-            if (pricingInfo?.price_cents) {
-                errorMessage += `This agent costs $${(pricingInfo.price_cents / 100).toFixed(2)} per call.\n\n`;
-            }
-            errorMessage +=
-                'Add credits:\n' +
-                    '  orch billing add 5\n' +
-                    '  orch billing balance  # check current balance\n';
-            throw new errors_1.CliError(errorMessage, errors_1.ExitCodes.PERMISSION_DENIED);
-        }
         if (errorCode === 'CLI_VERSION_TOO_OLD') {
-            spinner?.fail('CLI version too old');
+            spinner?.stop();
             const minVersion = typeof payload === 'object' && payload
                 ? payload.error?.min_version
                 : undefined;
@@ -2070,7 +1993,7 @@ async function executeCloud(agentRef, file, options) {
                 'Update with: npm update -g @orchagent/cli');
         }
         if (errorCode === 'LLM_KEY_REQUIRED') {
-            spinner?.fail('LLM key required');
+            spinner?.stop();
             throw new errors_1.CliError('This public agent requires you to provide an LLM key.\n' +
                 'Use --key <key> --provider <provider> or set OPENAI_API_KEY/ANTHROPIC_API_KEY env var.');
         }
@@ -2078,7 +2001,7 @@ async function executeCloud(agentRef, file, options) {
             const rateLimitMsg = typeof payload === 'object' && payload
                 ? payload.error?.message || 'Rate limit exceeded'
                 : 'Rate limit exceeded';
-            spinner?.fail('Rate limited by LLM provider');
+            spinner?.stop();
             throw new errors_1.CliError(rateLimitMsg + '\n\n' +
                 'This is the LLM provider\'s rate limit on your API key, not an OrchAgent limit.\n' +
                 'To switch providers: orch run <agent> --provider <gemini|anthropic|openai>', errors_1.ExitCodes.RATE_LIMITED);
@@ -2094,18 +2017,29 @@ async function executeCloud(agentRef, file, options) {
             : undefined;
         const refSuffix = requestId ? `\n\nref: ${requestId}` : '';
         if (errorCode === 'SANDBOX_ERROR') {
-            spinner?.fail('Agent execution failed');
+            spinner?.stop();
             const hint = typeof payload === 'object' && payload
                 ? payload.error?.hint
                 : undefined;
+            // Detect platform errors that surface as SANDBOX_ERROR (BUG-11)
+            const lowerMessage = (message || '').toLowerCase();
+            const isPlatformError = /\b403\b/.test(message || '') ||
+                /\b401\b/.test(message || '') ||
+                lowerMessage.includes('proxy token') ||
+                lowerMessage.includes('orchagent_service_key') ||
+                lowerMessage.includes('orchagent_billing_org');
+            const attribution = isPlatformError
+                ? `This may be a platform configuration issue, not an error in the agent's code.\n` +
+                    `If this persists, contact support with the ref below.`
+                : `This is an error in the agent's code, not the platform.\n` +
+                    `Check the agent code and requirements, then republish.`;
             throw new errors_1.CliError(`${message}\n\n` +
-                `This is an error in the agent's code, not the platform.\n` +
-                `Check the agent code and requirements, then republish.` +
+                attribution +
                 (hint ? `\n\nHint: ${hint}` : '') +
                 refSuffix);
         }
         if (errorCode === 'SANDBOX_TIMEOUT') {
-            spinner?.fail('Agent timed out');
+            spinner?.stop();
             throw new errors_1.CliError(`${message}\n\n` +
                 `The agent did not complete in time. Try:\n` +
                 `  - Simplifying the input\n` +
@@ -2114,7 +2048,7 @@ async function executeCloud(agentRef, file, options) {
                 refSuffix);
         }
         if (errorCode === 'MISSING_SECRETS') {
-            spinner?.fail('Missing workspace secrets');
+            spinner?.stop();
             // Extract secret names from gateway message:
             // "Agent requires secret(s) not found in workspace: NAME1, NAME2. Add them in Settings > Secrets."
             const secretNames = [];
@@ -2145,13 +2079,13 @@ async function executeCloud(agentRef, file, options) {
             throw new errors_1.CliError(hint + refSuffix);
         }
         if (response.status >= 500) {
-            spinner?.fail(`Server error (${response.status})`);
+            spinner?.stop();
             throw new errors_1.CliError(`${message}\n\n` +
                 `This is a platform error — try again in a moment.\n` +
                 `If it persists, contact support.` +
                 refSuffix);
         }
-        spinner?.fail(`Run failed: ${message}`);
+        spinner?.stop();
         throw new errors_1.CliError(message + refSuffix);
     }
     // Handle SSE streaming response
@@ -2235,9 +2169,6 @@ async function executeCloud(agentRef, file, options) {
         return;
     }
     spinner?.succeed(`Ran ${org}/${parsed.agent}@${parsed.version}`);
-    if (!options.json && (0, pricing_1.isPaidAgent)(agentMeta) && pricingInfo?.price_cents && pricingInfo.price_cents > 0) {
-        process.stderr.write(`\nCost: $${(pricingInfo.price_cents / 100).toFixed(2)} USD\n`);
-    }
     const inputType = hasInjection
         ? 'file_injection'
         : unkeyedFileArgs.length > 0
@@ -2606,13 +2537,6 @@ Examples:
     orch run joe/summarizer --local --data '{"text": "Hello world"}'
     orch run orchagent/leak-finder --local --download-only
 
-Paid Agents:
-  Paid agents charge per call and deduct from your prepaid credits.
-  Check your balance: orch billing balance
-  Add credits: orch billing add 5
-
-  Same-author calls are FREE - you won't be charged for calling your own agents.
-
 File handling (cloud):
   For prompt agents, file content is read and sent as JSON mapped to the agent's
   input schema. Use --file-field to specify the field name (auto-detected by default).

package/dist/commands/schedule.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerScheduleCommand = registerScheduleCommand;
 const cli_table3_1 = __importDefault(require("cli-table3"));
 const chalk_1 = __importDefault(require("chalk"));
+const promises_1 = __importDefault(require("readline/promises"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
@@ -64,7 +65,8 @@ async function resolveScheduleId(config, partialId, workspaceId) {
 function registerScheduleCommand(program) {
     const schedule = program
         .command('schedule')
-        .description('Manage scheduled agent runs (cron and webhooks)');
+        .description('Manage scheduled agent runs (cron and webhooks)')
+        .action(() => { schedule.help(); });
     // orch schedule list
     schedule
         .command('list')
@@ -282,6 +284,7 @@ function registerScheduleCommand(program) {
     schedule
         .command('delete <schedule-id>')
         .description('Delete a schedule')
+        .option('-y, --yes', 'Skip confirmation prompt')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .action(async (scheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -289,6 +292,18 @@ function registerScheduleCommand(program) {
             throw new errors_1.CliError('Missing API key. Run `orch login` first.');
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        if (!options.yes) {
+            const rl = promises_1.default.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            const answer = await rl.question(`Delete schedule ${scheduleId}? (y/N): `);
+            rl.close();
+            if (answer.trim().toLowerCase() !== 'y' && answer.trim().toLowerCase() !== 'yes') {
+                process.stdout.write('Cancelled.\n');
+                return;
+            }
+        }
         await (0, api_1.request)(config, 'DELETE', `/workspaces/${workspaceId}/schedules/${scheduleId}`);
         process.stdout.write(chalk_1.default.green('\u2713') + ` Schedule ${scheduleId} deleted\n`);
     });
@@ -338,6 +353,7 @@ function registerScheduleCommand(program) {
         .command('info <schedule-id>')
         .description('Show detailed schedule information with recent runs and events')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--reveal', 'Show full webhook URL (for webhook schedules)')
         .option('--json', 'Output as JSON')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -346,8 +362,9 @@ function registerScheduleCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const scheduleId = await resolveScheduleId(config, partialScheduleId, workspaceId);
+        const revealParam = options.reveal ? '?reveal_webhook=true' : '';
         const [scheduleRes, runsRes, eventsRes] = await Promise.all([
-            (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}`),
+            (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}${revealParam}`),
             (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}/runs?limit=5`),
             (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}/events?limit=5`),
         ]);
@@ -364,6 +381,12 @@ function registerScheduleCommand(program) {
             process.stdout.write(`  Cron:       ${s.cron_expression}\n`);
             process.stdout.write(`  Timezone:   ${s.timezone}\n`);
         }
+        if (s.webhook_url) {
+            process.stdout.write(`  Webhook:    ${s.webhook_url}\n`);
+        }
+        else if (s.schedule_type === 'webhook' && !options.reveal) {
+            process.stdout.write(`  Webhook:    ${chalk_1.default.gray('(redacted — use --reveal to show)')}\n`);
+        }
         process.stdout.write(`  Enabled:    ${s.enabled ? chalk_1.default.green('yes') : chalk_1.default.red('no')}\n`);
         process.stdout.write(`  Auto-update: ${s.auto_update === false ? chalk_1.default.yellow('pinned') : chalk_1.default.green('yes')}\n`);
         if (s.auto_disabled_at) {
@@ -374,6 +397,10 @@ function registerScheduleCommand(program) {
         if (s.next_run_at) {
             process.stdout.write(`  Next Run:   ${formatDate(s.next_run_at)}\n`);
         }
+        if (s.input_data && Object.keys(s.input_data).length > 0) {
+            const inputStr = JSON.stringify(s.input_data);
+            process.stdout.write(`  Input:      ${inputStr.length > 100 ? inputStr.slice(0, 100) + '...' : inputStr}\n`);
+        }
         if (s.alert_webhook_url) {
             process.stdout.write(`  Alert URL:  ${s.alert_webhook_url.slice(0, 50)}...\n`);
         }

package/dist/commands/secrets.js

@@ -54,7 +54,8 @@ async function findSecretByName(config, workspaceId, name) {
 function registerSecretsCommand(program) {
     const secrets = program
         .command('secrets')
-        .description('Manage workspace secrets (injected as env vars into agent sandboxes)');
+        .description('Manage workspace secrets (injected as env vars into agent sandboxes)')
+        .action(() => { secrets.help(); });
     // orch secrets list
     secrets
         .command('list')

package/dist/commands/security.js

@@ -222,7 +222,7 @@ Examples:
             });
         }
         catch (err) {
-            spinner.fail(`Scan failed: ${err instanceof Error ? err.message : 'Unknown error'}`);
+            spinner.stop();
             throw err;
         }
         if (!response.ok) {
@@ -239,7 +239,7 @@ Examples:
                     payload.message ||
                     response.statusText
                 : response.statusText;
-            spinner.fail(`Scan failed: ${message}`);
+            spinner.stop();
             throw new errors_1.CliError(message);
         }
         spinner.succeed(`Scan completed for ${agentId}`);