@orchagent/cli 0.3.84 → 0.3.85

package/dist/adapters/claude-code.js

@@ -37,13 +37,6 @@ exports.claudeCodeAdapter = {
             errors.push('Agent has no prompt content');
             return { canConvert: false, warnings, errors };
         }
-        // Warnings for fields that can't be fully mapped
-        if (agent.input_schema) {
-            warnings.push('input_schema will be described in the prompt body, not enforced');
-        }
-        if (agent.output_schema) {
-            warnings.push('output_schema will be described in the prompt body, not enforced');
-        }
         return { canConvert: true, warnings, errors };
     },
     convert(agent) {
@@ -52,8 +45,11 @@ exports.claudeCodeAdapter = {
         const frontmatter = {
             name: normalizedName,
             description: agent.description || `Delegatable agent: ${agent.name}`,
-            tools: 'Read, Glob, Grep', // Safe defaults - read-only
         };
+        // Only include tools for agent-type (prompt and skill types are single LLM calls)
+        if (agent.type === 'agent') {
+            frontmatter.tools = 'Read, Glob, Grep'; // Safe defaults - read-only
+        }
         // Map model if specified
         if (agent.default_models?.anthropic) {
             const modelAlias = (0, utils_1.mapModelToAlias)(agent.default_models.anthropic);

package/dist/commands/init.js

@@ -123,6 +123,133 @@ function main() {
 
 main();
 `;
+const ALWAYS_ON_TEMPLATE_PY = `"""
+orchagent always-on service entrypoint.
+
+Runs a long-lived HTTP server that handles requests over HTTP.
+This is the standard pattern for always-on services on orchagent.
+
+IMPORTANT: Port 8080 is reserved by the platform health server.
+           Use a different port (default: 3000).
+
+Local development:
+  python main.py
+"""
+
+import json
+import os
+from http.server import HTTPServer, BaseHTTPRequestHandler
+
+PORT = int(os.environ.get("PORT", "3000"))
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        content_length = int(self.headers.get("Content-Length", 0))
+        body = self.rfile.read(content_length)
+        try:
+            data = json.loads(body) if body else {}
+        except json.JSONDecodeError:
+            self._respond(400, {"error": "Invalid JSON"})
+            return
+
+        user_input = data.get("input", "")
+
+        # --- Your logic here ---
+        # To use workspace secrets, add them to "required_secrets" in orchagent.json:
+        #   "required_secrets": ["MY_API_KEY"]
+        # Then access via: os.environ["MY_API_KEY"]
+        result = f"Received: {user_input}"
+        # --- End your logic ---
+
+        self._respond(200, {"result": result})
+
+    def do_GET(self):
+        if self.path == "/health":
+            self._respond(200, {"status": "ok"})
+            return
+        self._respond(200, {"status": "running"})
+
+    def _respond(self, code, body):
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.end_headers()
+        self.wfile.write(json.dumps(body).encode())
+
+    def log_message(self, format, *args):
+        print(f"[{self.log_date_time_string()}] {format % args}")
+
+
+if __name__ == "__main__":
+    server = HTTPServer(("0.0.0.0", PORT), Handler)
+    print(f"Always-on service listening on port {PORT}")
+    server.serve_forever()
+`;
+const ALWAYS_ON_TEMPLATE_JS = `/**
+ * orchagent always-on service entrypoint.
+ *
+ * Runs a long-lived HTTP server that handles requests over HTTP.
+ * This is the standard pattern for always-on services on orchagent.
+ *
+ * IMPORTANT: Port 8080 is reserved by the platform health server.
+ *            Use a different port (default: 3000).
+ *
+ * Local development:
+ *   node main.js
+ */
+
+const http = require('http');
+
+const PORT = parseInt(process.env.PORT || '3000', 10);
+
+const server = http.createServer((req, res) => {
+  if (req.method === 'GET') {
+    if (req.url === '/health') {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ status: 'ok' }));
+      return;
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ status: 'running' }));
+    return;
+  }
+
+  if (req.method === 'POST') {
+    let body = '';
+    req.on('data', chunk => { body += chunk; });
+    req.on('end', () => {
+      let data;
+      try {
+        data = body ? JSON.parse(body) : {};
+      } catch {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid JSON' }));
+        return;
+      }
+
+      const input = data.input || '';
+
+      // --- Your logic here ---
+      // To use workspace secrets, add them to "required_secrets" in orchagent.json:
+      //   "required_secrets": ["MY_API_KEY"]
+      // Then access via: process.env.MY_API_KEY
+      const result = \`Received: \${input}\`;
+      // --- End your logic ---
+
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ result }));
+    });
+    return;
+  }
+
+  res.writeHead(405, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ error: 'Method not allowed' }));
+});
+
+server.listen(PORT, '0.0.0.0', () => {
+  console.log(\`Always-on service listening on port \${PORT}\`);
+});
+`;
 const DISCORD_MAIN_JS = `/**
  * Discord bot agent — powered by Claude.
  *
@@ -266,6 +393,7 @@ DISCORD_CHANNEL_IDS=
 # MODEL=claude-sonnet-4-5-20250929
 # MAX_TOKENS=1024
 `;
+const AGENT_BUILDER_HINT = `\n  Tip: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`;
 function readmeTemplate(agentName, flavor) {
     if (flavor === 'support_agent') {
         return `# ${agentName}
@@ -852,6 +980,11 @@ function registerInitCommand(program) {
             throw new errors_1.CliError('JavaScript agent-type agents are not yet supported. Use --type tool for JavaScript agents.');
         }
         // JS orchestrators are now supported via the orchagent-sdk npm package
+        // Block --language for types that don't create runtime files
+        if (isJavaScript && (initMode.type === 'prompt' || initMode.type === 'skill')) {
+            throw new errors_1.CliError(`The --language flag has no effect for ${initMode.type} types (no runtime files are created). ` +
+                'Use --type tool or --type agent to create a project with runtime scaffolding.');
+        }
         if (options.template) {
             const template = options.template.trim().toLowerCase();
             const validTemplates = ['support-agent', 'discord', 'discord-js', 'github-weekly-summary'];
@@ -988,7 +1121,7 @@ function registerInitCommand(program) {
             process.stdout.write(`  ${s + 2}. Copy .env.example to .env and add platform tokens\n`);
             process.stdout.write(`  ${s + 3}. Test locally: pip install -r requirements.txt && python main.py\n`);
             process.stdout.write(`  ${s + 4}. Deploy: orch publish && orch service deploy\n`);
-            process.stdout.write(`\n  Skill: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`);
+            process.stdout.write(AGENT_BUILDER_HINT);
             return;
         }
         // Handle github-weekly-summary template separately (own file set + output)
@@ -1044,7 +1177,7 @@ function registerInitCommand(program) {
             process.stdout.write(`  ${s + 3}. orch run <org>/${agentName}            Test it\n`);
             process.stdout.write(`  ${s + 4}. orch schedule create <org>/${agentName} --cron "0 9 * * 1"   Schedule weekly\n`);
             process.stdout.write(`\n  See README.md for full setup guide.\n`);
-            process.stdout.write(`\n  Skill: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`);
+            process.stdout.write(AGENT_BUILDER_HINT);
             return;
         }
         // Handle discord-js template separately (JS Discord bot)
@@ -1094,7 +1227,7 @@ function registerInitCommand(program) {
             process.stdout.write(`  ${stepNum + 2}. Copy .env.example to .env and fill in your tokens\n`);
             process.stdout.write(`  ${stepNum + 3}. Test locally: npm install && node main.js\n`);
             process.stdout.write(`  ${stepNum + 4}. Deploy: orch publish\n`);
-            process.stdout.write(`\n  Skill: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`);
+            process.stdout.write(AGENT_BUILDER_HINT);
             return;
         }
         const manifestPath = path_1.default.join(targetDir, 'orchagent.json');
@@ -1182,7 +1315,7 @@ function registerInitCommand(program) {
         }
         else if (initMode.flavor === 'code_runtime') {
             if (isJavaScript) {
-                await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.js'), CODE_TEMPLATE_JS);
+                await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.js'), runMode === 'always_on' ? ALWAYS_ON_TEMPLATE_JS : CODE_TEMPLATE_JS);
                 await promises_1.default.writeFile(path_1.default.join(targetDir, 'package.json'), JSON.stringify({
                     name: agentName,
                     private: true,
@@ -1191,7 +1324,7 @@ function registerInitCommand(program) {
                 }, null, 2) + '\n');
             }
             else {
-                await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.py'), CODE_TEMPLATE_PY);
+                await promises_1.default.writeFile(path_1.default.join(targetDir, 'main.py'), runMode === 'always_on' ? ALWAYS_ON_TEMPLATE_PY : CODE_TEMPLATE_PY);
             }
             await promises_1.default.writeFile(schemaPath, SCHEMA_TEMPLATE);
         }
@@ -1226,12 +1359,13 @@ function registerInitCommand(program) {
             process.stdout.write(`  ${prefix}.env.example      - Environment variables template\n`);
         }
         else if (initMode.flavor === 'code_runtime') {
+            const entrypointDesc = runMode === 'always_on' ? 'Always-on HTTP server' : 'Agent entrypoint (stdin/stdout JSON)';
             if (isJavaScript) {
-                process.stdout.write(`  ${prefix}main.js           - Agent entrypoint (stdin/stdout JSON)\n`);
+                process.stdout.write(`  ${prefix}main.js           - ${entrypointDesc}\n`);
                 process.stdout.write(`  ${prefix}package.json      - npm dependencies\n`);
             }
             else {
-                process.stdout.write(`  ${prefix}main.py           - Agent entrypoint (stdin/stdout JSON)\n`);
+                process.stdout.write(`  ${prefix}main.py           - ${entrypointDesc}\n`);
             }
         }
         else {
@@ -1274,7 +1408,15 @@ function registerInitCommand(program) {
             if (name) {
                 process.stdout.write(`  1. cd ${name}\n`);
             }
-            if (isJavaScript) {
+            if (runMode === 'always_on') {
+                const mainFile = isJavaScript ? 'main.js' : 'main.py';
+                const testCmd = isJavaScript ? 'node main.js' : 'python main.py';
+                process.stdout.write(`  ${stepNum}. Edit ${mainFile} with your service logic\n`);
+                process.stdout.write(`  ${stepNum + 1}. Test locally: ${testCmd}\n`);
+                process.stdout.write(`  ${stepNum + 2}. Publish: orch publish\n`);
+                process.stdout.write(`  ${stepNum + 3}. Deploy: orch service deploy\n`);
+            }
+            else if (isJavaScript) {
                 process.stdout.write(`  ${stepNum}. Edit main.js with your agent logic\n`);
                 process.stdout.write(`  ${stepNum + 1}. Edit schema.json with your input/output schemas\n`);
                 process.stdout.write(`  ${stepNum + 2}. Test: echo '{"input": "test"}' | node main.js\n`);
@@ -1296,6 +1438,6 @@ function registerInitCommand(program) {
             process.stdout.write(`  ${stepNum + 1}. Edit schema.json with your input/output schemas\n`);
             process.stdout.write(`  ${stepNum + 2}. Run: orchagent publish\n`);
         }
-        process.stdout.write(`\n  Skill: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`);
+        process.stdout.write(AGENT_BUILDER_HINT);
     });
 }

package/dist/commands/logs.js

@@ -56,10 +56,14 @@ function formatDuration(ms) {
         return `${(ms / 1000).toFixed(1)}s`;
     return `${(ms / 60000).toFixed(1)}m`;
 }
-/** Detect if a string looks like a UUID (run ID) */
+/** Detect if a string looks like a full UUID (run ID) */
 function isUuid(value) {
     return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
+/** Detect if a string looks like a short UUID prefix (8+ hex chars) */
+function isShortUuid(value) {
+    return /^[0-9a-f]{7,}$/i.test(value) && !value.includes('/');
+}
 // ============================================
 // COMMAND REGISTRATION
 // ============================================
@@ -77,16 +81,38 @@ function registerLogsCommand(program) {
             throw new errors_1.CliError('Missing API key. Run `orch login` first.');
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
-        // If target looks like a UUID, show detailed logs for that run
+        // If target looks like a UUID (full or short prefix), show detailed logs for that run
         if (target && isUuid(target)) {
             await showRunLogs(config, workspaceId, target, options.json);
             return;
         }
-        // Otherwise list runs, optionally filtered by agent name
-        await listRuns(config, workspaceId, target, options);
+        if (target && isShortUuid(target)) {
+            // Short UUID prefix — find the matching run from the list
+            const fullId = await resolveShortRunId(config, workspaceId, target);
+            await showRunLogs(config, workspaceId, fullId, options.json);
+            return;
+        }
+        // Otherwise list runs, optionally filtered by agent name.
+        // Strip org prefix if provided (e.g. "joe/my-agent" → "my-agent")
+        const agentFilter = target?.includes('/') ? target.split('/').pop() : target;
+        await listRuns(config, workspaceId, agentFilter, options);
     });
 }
 // ============================================
+// SHORT RUN ID RESOLUTION
+// ============================================
+async function resolveShortRunId(config, workspaceId, shortId) {
+    // Server-side prefix matching — searches ALL runs, not just the last 200
+    const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/runs?limit=200&run_id_prefix=${encodeURIComponent(shortId)}`);
+    if (result.runs.length === 0) {
+        throw new errors_1.CliError(`No run found matching '${shortId}'.`);
+    }
+    if (result.runs.length > 1) {
+        throw new errors_1.CliError(`Ambiguous run ID '${shortId}' — matches ${result.runs.length} runs. Use more characters to narrow it down.`);
+    }
+    return result.runs[0].id;
+}
+// ============================================
 // LIST RUNS
 // ============================================
 async function listRuns(config, workspaceId, agentName, options) {
@@ -161,6 +187,16 @@ async function showRunLogs(config, workspaceId, runId, json) {
         const exitLabel = result.exit_code === 0 ? chalk_1.default.green(String(result.exit_code)) : chalk_1.default.red(String(result.exit_code));
         process.stdout.write(`Exit code: ${exitLabel}\n`);
     }
+    // Input data
+    if (result.input_data != null && Object.keys(result.input_data).length > 0) {
+        process.stdout.write('\n' + chalk_1.default.bold.blue('--- input ---') + '\n' +
+            JSON.stringify(result.input_data, null, 2) + '\n');
+    }
+    // Output data
+    if (result.output_data != null && Object.keys(result.output_data).length > 0) {
+        process.stdout.write('\n' + chalk_1.default.bold.green('--- output ---') + '\n' +
+            JSON.stringify(result.output_data, null, 2) + '\n');
+    }
     // Error message
     if (result.error_message) {
         process.stdout.write('\n' + chalk_1.default.red.bold('Error:\n') + chalk_1.default.red(result.error_message) + '\n');

package/dist/commands/publish.js

@@ -39,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractTemplateVariables = extractTemplateVariables;
 exports.deriveInputSchema = deriveInputSchema;
 exports.scanUndeclaredEnvVars = scanUndeclaredEnvVars;
+exports.scanReservedPort = scanReservedPort;
 exports.detectSdkCompatible = detectSdkCompatible;
 exports.checkDependencies = checkDependencies;
 exports.registerPublishCommand = registerPublishCommand;
@@ -167,6 +168,68 @@ async function scanUndeclaredEnvVars(agentDir, requiredSecrets) {
     // Return env vars that are referenced but not declared or auto-injected
     return [...found].filter(v => !declared.has(v) && !autoInjected.has(v)).sort();
 }
+/**
+ * Scan code files for patterns that bind to port 8080 — the platform reserves
+ * this port for the always-on service health server.  Returns true if a likely
+ * port-8080 binding is detected.
+ */
+async function scanReservedPort(agentDir) {
+    // Patterns that indicate binding to port 8080 in Python / JS / TS
+    const pyPatterns = [
+        /\.listen\s*\(\s*8080\b/, // server.listen(8080
+        /\.run\s*\([^)]*port\s*=\s*8080\b/, // app.run(port=8080
+        /\.run\s*\([^)]*host\s*=\s*['"][^'"]*['"],?\s*8080\b/, // app.run("0.0.0.0", 8080
+        /bind\s*\(\s*\(?['"][^'"]*['"]\s*,\s*8080\b/, // bind(("0.0.0.0", 8080
+        /PORT\s*=\s*8080\b/, // PORT = 8080
+        /port\s*=\s*8080\b/, // port=8080
+    ];
+    const jsPatterns = [
+        /\.listen\s*\(\s*8080\b/, // app.listen(8080
+        /port\s*[:=]\s*8080\b/, // port: 8080  or  port = 8080
+        /PORT\s*[:=]\s*8080\b/, // PORT = 8080
+    ];
+    async function scanDir(dir, depth) {
+        let entries;
+        try {
+            entries = await promises_1.default.readdir(dir, { withFileTypes: true });
+            if (!entries || !Array.isArray(entries))
+                return false;
+        }
+        catch {
+            return false;
+        }
+        for (const entry of entries) {
+            const name = entry.name;
+            const fullPath = path_1.default.join(dir, name);
+            if (entry.isDirectory() && depth < 2 && !name.startsWith('.') && name !== 'node_modules' && name !== '__pycache__' && name !== 'venv' && name !== '.venv') {
+                if (await scanDir(fullPath, depth + 1))
+                    return true;
+            }
+            else if (entry.isFile() && name.endsWith('.py')) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    for (const re of pyPatterns) {
+                        if (re.test(content))
+                            return true;
+                    }
+                }
+                catch { /* skip */ }
+            }
+            else if (entry.isFile() && (name.endsWith('.js') || name.endsWith('.ts'))) {
+                try {
+                    const content = await promises_1.default.readFile(fullPath, 'utf-8');
+                    for (const re of jsPatterns) {
+                        if (re.test(content))
+                            return true;
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        return false;
+    }
+    return scanDir(agentDir, 0);
+}
 /**
  * Check if orchagent-sdk is listed in requirements.txt or pyproject.toml
  */
@@ -319,11 +382,8 @@ function inferExecutionEngineFromManifest(manifest, rawType) {
         return 'managed_loop';
     if (rawType === 'tool' || rawType === 'code')
         return 'code_runtime';
-    if (rawType === 'agentic')
-        return 'managed_loop';
-    if (rawType === 'agent' && (manifest.custom_tools?.length || manifest.max_turns)) {
+    if (rawType === 'agentic' || rawType === 'agent')
         return 'managed_loop';
-    }
     return 'direct_llm';
 }
 function commandForEntrypoint(entrypoint) {
@@ -485,6 +545,7 @@ function registerPublishCommand(program) {
                     description: skillData.frontmatter.description,
                     prompt: skillData.body,
                     is_public: false,
+                    callable: false,
                     supported_providers: ['any'],
                     default_skills: skillsFromFlag,
                     skills_locked: options.skillsLocked || undefined,
@@ -542,7 +603,7 @@ function registerPublishCommand(program) {
         const { canonicalType, rawType } = canonicalizeManifestType(manifest.type);
         const runMode = normalizeRunMode(manifest.run_mode);
         const executionEngine = inferExecutionEngineFromManifest(manifest, rawType);
-        const callable = Boolean(manifest.callable);
+        const callable = manifest.callable !== undefined ? Boolean(manifest.callable) : true;
         if (canonicalType === 'skill') {
             throw new errors_1.CliError("Use SKILL.md for publishing skills. Remove orchagent.json and run 'orchagent publish' from a skill directory.");
         }
@@ -767,12 +828,13 @@ function registerPublishCommand(program) {
                     `  Publish each dependency first, then re-run this publish.\n\n`);
             }
             if (notCallable.length > 0) {
-                process.stderr.write(chalk_1.default.yellow(`\n⚠ Dependencies not marked as callable:\n`));
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Dependencies have callable: false:\n`));
                 for (const dep of notCallable) {
                     process.stderr.write(chalk_1.default.yellow(`  - ${dep.ref}\n`));
                 }
-                process.stderr.write(`\n  Agents must have callable: true in orchagent.json to be invoked\n` +
-                    `  by orchestrators. Update and republish each dependency.\n\n`);
+                process.stderr.write(`\n  These agents have explicitly set callable: false, which blocks\n` +
+                    `  agent-to-agent calls at runtime. Set callable: true (or remove\n` +
+                    `  the field to use the default) and republish each dependency.\n\n`);
             }
         }
         // Handle dry-run for agents
@@ -883,18 +945,35 @@ function registerPublishCommand(program) {
                     `  (Platform-injected vars like LLM API keys are already excluded.)\n\n`);
             }
         }
+        // Warn if always_on code binds to port 8080 (reserved for platform health server)
+        if (runMode === 'always_on' && executionEngine === 'code_runtime') {
+            const usesReservedPort = await scanReservedPort(cwd);
+            if (usesReservedPort) {
+                process.stderr.write(chalk_1.default.yellow(`\n⚠ Your code appears to bind to port 8080, which is reserved by the\n`) +
+                    chalk_1.default.yellow(`  platform health server for always-on services.\n\n`) +
+                    `  Your service will crash with EADDRINUSE at runtime.\n` +
+                    `  Use a different port (e.g. 3000) or read the ORCHAGENT_HEALTH_PORT\n` +
+                    `  env var to detect the reserved port.\n\n`);
+            }
+        }
         // C-1: Block publish if tool/agent type has no required_secrets declared.
         // Prompt and skill types are exempt (prompt agents get LLM keys from platform,
         // skills don't run standalone).
+        // An explicit empty array (required_secrets: []) is a valid declaration
+        // meaning "this agent deliberately needs no secrets."
         if ((canonicalType === 'tool' || canonicalType === 'agent') &&
-            (!manifest.required_secrets || manifest.required_secrets.length === 0) &&
+            manifest.required_secrets === undefined &&
             options.requiredSecrets !== false) {
             process.stderr.write(chalk_1.default.red(`\nError: ${canonicalType} agents must declare required_secrets in orchagent.json.\n\n`) +
                 `  Add the env vars your code needs at runtime:\n` +
                 `  ${chalk_1.default.cyan('"required_secrets": ["ANTHROPIC_API_KEY", "MY_TOKEN"]')}\n\n` +
+                `  If this agent genuinely needs no secrets, add an empty array:\n` +
+                `  ${chalk_1.default.cyan('"required_secrets": []')}\n\n` +
                 `  These are matched by name against your workspace secrets vault.\n` +
                 `  Use ${chalk_1.default.cyan('--no-required-secrets')} to skip this check.\n`);
-            throw new errors_1.CliError('Missing required_secrets declaration', errors_1.ExitCodes.INVALID_INPUT);
+            const err = new errors_1.CliError('Missing required_secrets declaration', errors_1.ExitCodes.INVALID_INPUT);
+            err.displayed = true;
+            throw err;
         }
         // Create the agent (server auto-assigns version)
         let result;
@@ -1125,6 +1204,5 @@ function registerPublishCommand(program) {
             process.stdout.write(`\nNote: Hosted code execution is in beta. Contact support for full deployment.\n`);
         }
         process.stdout.write(`\nView analytics and usage: https://orchagent.io/dashboard\n`);
-        process.stdout.write(`\nSkill: orch skill install orchagent-public/agent-builder — gives your AI the full platform builder reference\n`);
     });
 }

package/dist/commands/pull.js

@@ -29,7 +29,13 @@ function parsePullRef(value) {
 }
 function canonicalType(typeValue) {
     const normalized = (typeValue || 'agent').toLowerCase();
-    return normalized === 'skill' ? 'skill' : 'agent';
+    if (['prompt', 'tool', 'agent', 'skill'].includes(normalized))
+        return normalized;
+    if (normalized === 'code')
+        return 'tool';
+    if (normalized === 'agentic')
+        return 'agent';
+    return 'agent';
 }
 function resolveEngine(data) {
     const ee = data.execution_engine;
@@ -200,7 +206,7 @@ function buildManifest(data) {
     const manifest = {
         name: data.name,
         description: data.description || '',
-        type: canonicalType(data.type) === 'skill' ? 'skill' : 'agent',
+        type: canonicalType(data.type),
     };
     if (data.run_mode)
         manifest.run_mode = data.run_mode;

package/dist/commands/run.js

@@ -675,7 +675,7 @@ async function executePromptLocally(agentData, inputData, skillPrompts = [], con
         if (allProviders.length === 0) {
             const providers = providersToCheck.join(', ');
             throw new errors_1.CliError(`No LLM key found for: ${providers}\n` +
-                `Set an environment variable (e.g., OPENAI_API_KEY), run 'orchagent keys add <provider>', or configure in web dashboard`);
+                `Set an environment variable (e.g., OPENAI_API_KEY), run 'orch secrets set <PROVIDER>_API_KEY <key>', or configure in web dashboard`);
         }
         if (modelOverride && !providerOverride && allProviders.length > 1) {
             process.stderr.write(`Warning: --model specified without --provider. The model '${modelOverride}' will be used for all ${allProviders.length} fallback providers, which may cause errors if the model is incompatible.\n` +
@@ -702,7 +702,7 @@ async function executePromptLocally(agentData, inputData, skillPrompts = [], con
     if (!detected) {
         const providers = providersToCheck.join(', ');
         throw new errors_1.CliError(`No LLM key found for: ${providers}\n` +
-            `Set an environment variable (e.g., OPENAI_API_KEY), run 'orchagent keys add <provider>', or configure in web dashboard`);
+            `Set an environment variable (e.g., OPENAI_API_KEY), run 'orch secrets set <PROVIDER>_API_KEY <key>', or configure in web dashboard`);
     }
     const { provider, key, model: serverModel } = detected;
     const model = modelOverride || serverModel || agentData.default_models?.[provider] || (0, llm_1.getDefaultModel)(provider);
@@ -736,7 +736,7 @@ async function executeAgentLocally(agentDir, prompt, inputData, outputSchema, cu
     if (allProviders.length === 0) {
         const providers = providersToCheck.join(', ');
         throw new errors_1.CliError(`No LLM key found for: ${providers}\n` +
-            `Set an environment variable (e.g., ANTHROPIC_API_KEY), run 'orchagent keys add <provider>', or configure in web dashboard`);
+            `Set an environment variable (e.g., ANTHROPIC_API_KEY), run 'orch secrets set <PROVIDER>_API_KEY <key>', or configure in web dashboard`);
     }
     const primary = allProviders[0];
     const model = modelOverride || primary.model || (0, llm_1.getDefaultModel)(primary.provider);
@@ -1775,12 +1775,6 @@ async function executeCloud(agentRef, file, options) {
             ...(options.model && { model: options.model }),
         };
     }
-    else if (cloudEngine !== 'code_runtime') {
-        const searchedProviders = effectiveProvider ? [effectiveProvider] : supportedProviders;
-        const providerList = searchedProviders.join(', ');
-        process.stderr.write(`Warning: No LLM key found for provider(s): ${providerList}\n` +
-            `Set an env var (e.g., OPENAI_API_KEY), run 'orchagent keys add <provider>', use --key, or configure in web dashboard\n\n`);
-    }
     if (options.skills) {
         headers['X-OrchAgent-Skills'] = options.skills;
     }
@@ -2027,9 +2021,20 @@ async function executeCloud(agentRef, file, options) {
             const hint = typeof payload === 'object' && payload
                 ? payload.error?.hint
                 : undefined;
+            // Detect platform errors that surface as SANDBOX_ERROR (BUG-11)
+            const lowerMessage = (message || '').toLowerCase();
+            const isPlatformError = /\b403\b/.test(message || '') ||
+                /\b401\b/.test(message || '') ||
+                lowerMessage.includes('proxy token') ||
+                lowerMessage.includes('orchagent_service_key') ||
+                lowerMessage.includes('orchagent_billing_org');
+            const attribution = isPlatformError
+                ? `This may be a platform configuration issue, not an error in the agent's code.\n` +
+                    `If this persists, contact support with the ref below.`
+                : `This is an error in the agent's code, not the platform.\n` +
+                    `Check the agent code and requirements, then republish.`;
             throw new errors_1.CliError(`${message}\n\n` +
-                `This is an error in the agent's code, not the platform.\n` +
-                `Check the agent code and requirements, then republish.` +
+                attribution +
                 (hint ? `\n\nHint: ${hint}` : '') +
                 refSuffix);
         }

package/dist/commands/schedule.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerScheduleCommand = registerScheduleCommand;
 const cli_table3_1 = __importDefault(require("cli-table3"));
 const chalk_1 = __importDefault(require("chalk"));
+const promises_1 = __importDefault(require("readline/promises"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
@@ -64,7 +65,8 @@ async function resolveScheduleId(config, partialId, workspaceId) {
 function registerScheduleCommand(program) {
     const schedule = program
         .command('schedule')
-        .description('Manage scheduled agent runs (cron and webhooks)');
+        .description('Manage scheduled agent runs (cron and webhooks)')
+        .action(() => { schedule.help(); });
     // orch schedule list
     schedule
         .command('list')
@@ -282,6 +284,7 @@ function registerScheduleCommand(program) {
     schedule
         .command('delete <schedule-id>')
         .description('Delete a schedule')
+        .option('-y, --yes', 'Skip confirmation prompt')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .action(async (scheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -289,6 +292,18 @@ function registerScheduleCommand(program) {
             throw new errors_1.CliError('Missing API key. Run `orch login` first.');
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        if (!options.yes) {
+            const rl = promises_1.default.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            const answer = await rl.question(`Delete schedule ${scheduleId}? (y/N): `);
+            rl.close();
+            if (answer.trim().toLowerCase() !== 'y' && answer.trim().toLowerCase() !== 'yes') {
+                process.stdout.write('Cancelled.\n');
+                return;
+            }
+        }
         await (0, api_1.request)(config, 'DELETE', `/workspaces/${workspaceId}/schedules/${scheduleId}`);
         process.stdout.write(chalk_1.default.green('\u2713') + ` Schedule ${scheduleId} deleted\n`);
     });
@@ -338,6 +353,7 @@ function registerScheduleCommand(program) {
         .command('info <schedule-id>')
         .description('Show detailed schedule information with recent runs and events')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--reveal', 'Show full webhook URL (for webhook schedules)')
         .option('--json', 'Output as JSON')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
@@ -346,8 +362,9 @@ function registerScheduleCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const scheduleId = await resolveScheduleId(config, partialScheduleId, workspaceId);
+        const revealParam = options.reveal ? '?reveal_webhook=true' : '';
         const [scheduleRes, runsRes, eventsRes] = await Promise.all([
-            (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}`),
+            (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}${revealParam}`),
             (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}/runs?limit=5`),
             (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/schedules/${scheduleId}/events?limit=5`),
         ]);
@@ -364,6 +381,12 @@ function registerScheduleCommand(program) {
             process.stdout.write(`  Cron:       ${s.cron_expression}\n`);
             process.stdout.write(`  Timezone:   ${s.timezone}\n`);
         }
+        if (s.webhook_url) {
+            process.stdout.write(`  Webhook:    ${s.webhook_url}\n`);
+        }
+        else if (s.schedule_type === 'webhook' && !options.reveal) {
+            process.stdout.write(`  Webhook:    ${chalk_1.default.gray('(redacted — use --reveal to show)')}\n`);
+        }
         process.stdout.write(`  Enabled:    ${s.enabled ? chalk_1.default.green('yes') : chalk_1.default.red('no')}\n`);
         process.stdout.write(`  Auto-update: ${s.auto_update === false ? chalk_1.default.yellow('pinned') : chalk_1.default.green('yes')}\n`);
         if (s.auto_disabled_at) {
@@ -374,6 +397,10 @@ function registerScheduleCommand(program) {
         if (s.next_run_at) {
             process.stdout.write(`  Next Run:   ${formatDate(s.next_run_at)}\n`);
         }
+        if (s.input_data && Object.keys(s.input_data).length > 0) {
+            const inputStr = JSON.stringify(s.input_data);
+            process.stdout.write(`  Input:      ${inputStr.length > 100 ? inputStr.slice(0, 100) + '...' : inputStr}\n`);
+        }
         if (s.alert_webhook_url) {
             process.stdout.write(`  Alert URL:  ${s.alert_webhook_url.slice(0, 50)}...\n`);
         }

package/dist/commands/secrets.js

@@ -54,7 +54,8 @@ async function findSecretByName(config, workspaceId, name) {
 function registerSecretsCommand(program) {
     const secrets = program
         .command('secrets')
-        .description('Manage workspace secrets (injected as env vars into agent sandboxes)');
+        .description('Manage workspace secrets (injected as env vars into agent sandboxes)')
+        .action(() => { secrets.help(); });
     // orch secrets list
     secrets
         .command('list')

package/dist/commands/service.js

@@ -60,6 +60,13 @@ function healthColor(health) {
             return chalk_1.default.gray(health);
     }
 }
+function formatServiceUrl(svc) {
+    const url = svc.provider_url || svc.cloud_run_url || '-';
+    if (url !== '-' && svc.infrastructure_provider === 'flyio') {
+        return `${url} ${chalk_1.default.gray('(internal — not a public endpoint)')}`;
+    }
+    return url;
+}
 function severityColor(severity, message) {
     switch (severity.toUpperCase()) {
         case 'ERROR':
@@ -184,7 +191,7 @@ function registerServiceCommand(program) {
             process.stdout.write(`  ${chalk_1.default.bold('Name:')}     ${svc.service_name}\n`);
             process.stdout.write(`  ${chalk_1.default.bold('Agent:')}    ${svc.agent_name}@${svc.agent_version}\n`);
             process.stdout.write(`  ${chalk_1.default.bold('State:')}    ${stateColor(svc.current_state)}\n`);
-            process.stdout.write(`  ${chalk_1.default.bold('URL:')}      ${svc.provider_url || svc.cloud_run_url || '-'}\n`);
+            process.stdout.write(`  ${chalk_1.default.bold('URL:')}      ${formatServiceUrl(svc)}\n`);
             if (options.pin) {
                 process.stdout.write(`  ${chalk_1.default.bold('Pinned:')}   ${chalk_1.default.yellow(`yes (won't auto-update on publish)`)}\n`);
             }
@@ -192,7 +199,7 @@ function registerServiceCommand(program) {
             process.stdout.write(chalk_1.default.gray(`View logs: orch service logs ${svc.id}\n`));
         }
         catch (e) {
-            deploySpinner.fail('Deploy failed');
+            deploySpinner.stop();
             throw e;
         }
     });
@@ -348,7 +355,7 @@ function registerServiceCommand(program) {
         }
         process.stdout.write(`  Instances:    ${svc.min_instances}-${svc.max_instances}\n`);
         process.stdout.write(`  Service ID:   ${svc.provider_service_id || svc.cloud_run_service || '-'}\n`);
-        process.stdout.write(`  URL:          ${svc.provider_url || svc.cloud_run_url || '-'}\n`);
+        process.stdout.write(`  URL:          ${formatServiceUrl(svc)}\n`);
         process.stdout.write(`  Deployed:     ${formatDate(svc.last_deployed_at)}\n`);
         process.stdout.write(`  Last Restart: ${formatDate(svc.last_restart_at)}\n`);
         if (svc.last_error) {

package/dist/commands/skill.js

@@ -204,18 +204,18 @@ async function downloadSkillWithFallback(config, org, skill, version, workspaceI
 }
 function registerSkillCommand(program) {
     const skill = program.command('skill').description('Manage and install skills');
-    // orch skill list (deprecated)
+    skill.action(() => { skill.help(); });
+    // orch skill list
     skill
         .command('list')
-        .description('(Deprecated) Use "orchagent search --type skills" instead')
+        .description('Browse available skills')
         .option('--json', 'Output raw JSON')
         .action(async () => {
-        process.stdout.write('The "skill list" command has been replaced by "search".\n\n' +
-            'Usage:\n' +
-            '  orchagent search <query> --type skills   Search skills by keyword\n' +
-            '  orchagent search --popular --type skills Top skills by stars\n' +
-            '  orchagent search --recent --type skills  Most recently published\n\n' +
-            'View all skills at: https://orchagent.io/explore\n');
+        process.stdout.write('Browse and discover skills at: https://orchagent.io/explore\n\n' +
+            'Install a skill:\n' +
+            '  orch skill install <org>/<skill-name>\n\n' +
+            'View installed skills:\n' +
+            '  orch update --check\n');
         process.exit(0);
     });
     // orch skill create [name]

package/dist/commands/test.js

@@ -514,7 +514,7 @@ async function runPromptFixtureTests(agentDir, fixtures, verbose, config) {
     const detected = await (0, llm_1.detectLlmKey)(['any'], config);
     if (!detected) {
         throw new errors_1.CliError('No LLM key found for fixture tests.\n' +
-            'Set an environment variable (e.g., OPENAI_API_KEY) or run `orchagent keys add <provider>`');
+            'Set an environment variable (e.g., OPENAI_API_KEY) or run `orch secrets set <PROVIDER>_API_KEY <key>`');
     }
     const { provider, key, model: serverModel } = detected;
     const model = serverModel ?? (0, llm_1.getDefaultModel)(provider);

package/dist/lib/doctor/checks/environment.js

@@ -6,8 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkNodeVersion = checkNodeVersion;
 exports.checkCliVersion = checkCliVersion;
 exports.checkGitAvailable = checkGitAvailable;
+exports.checkDualInstallation = checkDualInstallation;
 exports.runEnvironmentChecks = runEnvironmentChecks;
 const child_process_1 = require("child_process");
+const fs_1 = require("fs");
 const package_json_1 = __importDefault(require("../../../../package.json"));
 const update_notifier_1 = require("../../update-notifier");
 const REQUIRED_NODE_MAJOR = 18;
@@ -142,6 +144,148 @@ async function checkGitAvailable() {
         };
     }
 }
+/**
+ * Find all binary paths for a given command name using `which -a`.
+ * Returns an empty array if the command is not found.
+ * Note: Uses execSync with a hardcoded binary name — no user input, safe from injection.
+ */
+function findAllBinaryPaths(binaryName) {
+    try {
+        const output = (0, child_process_1.execSync)(`which -a ${binaryName}`, {
+            encoding: 'utf-8',
+            timeout: 5000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return output.trim().split('\n').filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Get the CLI version from a binary path by running it with --version.
+ * Uses execFileSync (no shell) to avoid injection via path characters.
+ */
+function getVersionFromBinary(binPath) {
+    try {
+        const output = (0, child_process_1.execFileSync)(binPath, ['--version'], {
+            encoding: 'utf-8',
+            timeout: 5000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const match = output.match(/(\d+\.\d+\.\d+)/);
+        return match ? match[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a path through symlinks. Returns the original path if resolution fails.
+ */
+function safeRealpathSync(p) {
+    try {
+        return (0, fs_1.realpathSync)(p);
+    }
+    catch {
+        return p;
+    }
+}
+/**
+ * Detect multiple CLI installations at different paths/versions (BUG-008).
+ *
+ * System-level (/usr/local/bin/orchagent) and user-level (~/.npm-global/bin/orch)
+ * installs can coexist silently. `npm update -g` updates one but not the other,
+ * leaving the user running an outdated version without knowing it.
+ */
+async function checkDualInstallation() {
+    // Skip on Windows (which -a not available)
+    if (process.platform === 'win32') {
+        return {
+            category: 'environment',
+            name: 'dual_installation',
+            status: 'info',
+            message: 'Installation path check skipped (Windows)',
+            details: { skipped: true, reason: 'Windows not supported' },
+        };
+    }
+    try {
+        const binaryNames = ['orch', 'orchagent'];
+        const installations = new Map();
+        for (const binary of binaryNames) {
+            const paths = findAllBinaryPaths(binary);
+            for (const binPath of paths) {
+                const realPath = safeRealpathSync(binPath);
+                // Deduplicate by resolved real path
+                if (installations.has(realPath))
+                    continue;
+                const version = getVersionFromBinary(binPath) || 'unknown';
+                installations.set(realPath, {
+                    path: binPath,
+                    realPath,
+                    version,
+                    binary,
+                });
+            }
+        }
+        if (installations.size <= 1) {
+            return {
+                category: 'environment',
+                name: 'dual_installation',
+                status: 'success',
+                message: 'Single CLI installation',
+                details: {
+                    installationCount: installations.size,
+                    installations: [...installations.values()],
+                },
+            };
+        }
+        // Multiple installations found
+        const allInstalls = [...installations.values()];
+        const versions = new Set(allInstalls.map((i) => i.version));
+        const versionsDiffer = versions.size > 1;
+        const pathList = allInstalls
+            .map((i) => `${i.path} (v${i.version})`)
+            .join(', ');
+        if (versionsDiffer) {
+            return {
+                category: 'environment',
+                name: 'dual_installation',
+                status: 'warning',
+                message: `Multiple CLI versions found: ${pathList}`,
+                fix: 'Remove the outdated installation. Run `which -a orch orchagent` to see all paths, then remove the older binary',
+                details: {
+                    installationCount: installations.size,
+                    versionMismatch: true,
+                    installations: allInstalls,
+                },
+            };
+        }
+        // Same version at multiple paths — informational only
+        return {
+            category: 'environment',
+            name: 'dual_installation',
+            status: 'info',
+            message: `Multiple CLI paths (same version v${allInstalls[0].version}): ${pathList}`,
+            details: {
+                installationCount: installations.size,
+                versionMismatch: false,
+                installations: allInstalls,
+            },
+        };
+    }
+    catch (err) {
+        return {
+            category: 'environment',
+            name: 'dual_installation',
+            status: 'info',
+            message: 'Could not check for duplicate installations',
+            details: {
+                error: err instanceof Error ? err.message : 'unknown error',
+            },
+        };
+    }
+}
 /**
  * Run all environment checks.
  */
@@ -150,6 +294,7 @@ async function runEnvironmentChecks() {
         checkNodeVersion(),
         checkCliVersion(),
         checkGitAvailable(),
+        checkDualInstallation(),
     ]);
     return results;
 }

package/dist/lib/doctor/output.js

@@ -54,7 +54,7 @@ function renderLlmSection(checks, verbose) {
         // Build location text
         let location;
         if (serverVal === null) {
-            location = localVal ? 'Server unknown, local configured' : 'Server unknown, not local';
+            location = localVal ? 'Local configured (vault keys not checked)' : 'Not configured locally (vault keys used for cloud runs)';
         }
         else if (serverVal && localVal) {
             location = 'Configured (server + local)';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.84",
+  "version": "0.3.85",
   "description": "Command-line interface for orchagent — deploy and run AI agents for your team",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",
@@ -25,7 +25,8 @@
     "node": ">=18"
   },
   "bin": {
-    "orch": "dist/index.js"
+    "orch": "dist/index.js",
+    "orchagent": "dist/index.js"
   },
   "files": [
     "dist",