@orchagent/cli 0.3.86 → 0.3.87

package/dist/commands/publish.js

@@ -42,17 +42,21 @@ exports.scanUndeclaredEnvVars = scanUndeclaredEnvVars;
 exports.scanReservedPort = scanReservedPort;
 exports.detectSdkCompatible = detectSdkCompatible;
 exports.checkDependencies = checkDependencies;
+exports.batchPublish = batchPublish;
 exports.registerPublishCommand = registerPublishCommand;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const yaml_1 = __importDefault(require("yaml"));
 const chalk_1 = __importDefault(require("chalk"));
+const child_process_1 = require("child_process");
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
 const analytics_1 = require("../lib/analytics");
 const bundle_1 = require("../lib/bundle");
+const key_store_1 = require("../lib/key-store");
+const batch_publish_1 = require("../lib/batch-publish");
 /**
  * Extract template placeholders from a prompt template.
  * Matches double-brace patterns like {{variable}}.
@@ -442,6 +446,133 @@ async function checkDependencies(config, dependencies, publishingOrgSlug, worksp
         }
     }));
 }
+/**
+ * Batch publish all agents found in subdirectories, in dependency order.
+ * Discovers orchagent.json/SKILL.md in immediate subdirectories,
+ * topologically sorts by manifest dependencies, and publishes leaf-first.
+ */
+async function batchPublish(rootDir, options) {
+    process.stderr.write(`\nScanning for agents in ${rootDir}...\n`);
+    const agents = await (0, batch_publish_1.discoverAgents)(rootDir);
+    if (agents.length === 0) {
+        throw new errors_1.CliError('No agents found. Expected subdirectories with orchagent.json or SKILL.md files.\n\n' +
+            'Example monorepo layout:\n' +
+            '  my-project/\n' +
+            '    leaf-tool/\n' +
+            '      orchagent.json\n' +
+            '    orchestrator/\n' +
+            '      orchagent.json\n' +
+            '      prompt.md\n\n' +
+            'Run `orch publish --all` from the parent directory.');
+    }
+    const result = (0, batch_publish_1.topoSort)(agents);
+    if (!result.ok) {
+        throw new errors_1.CliError(`Circular dependency detected between: ${result.cycle.join(' → ')}\n\n` +
+            'Break the cycle by removing a dependency in one of these agents\' orchagent.json manifest.dependencies.');
+    }
+    const sorted = result.sorted;
+    // Resolve org for display (best-effort)
+    let orgSlug;
+    try {
+        const config = await (0, config_1.getResolvedConfig)({}, options.profile);
+        const configFile = await (0, config_1.loadConfig)();
+        let workspaceId;
+        if (configFile.workspace && !options.profile) {
+            const { workspaces } = await (0, api_1.request)(config, 'GET', '/workspaces');
+            const ws = workspaces.find(w => w.slug === configFile.workspace);
+            if (ws)
+                workspaceId = ws.id;
+        }
+        const org = await (0, api_1.getOrg)(config, workspaceId);
+        orgSlug = org.slug;
+    }
+    catch {
+        // Non-critical — just won't show org prefix
+    }
+    const plan = (0, batch_publish_1.formatPublishPlan)(sorted, orgSlug);
+    process.stderr.write(plan);
+    if (options.dryRun) {
+        process.stderr.write(chalk_1.default.cyan('DRY RUN — running orch publish --dry-run in each directory:\n\n'));
+    }
+    // Build the CLI args to forward (exclude --all)
+    const forwardArgs = [];
+    if (options.profile)
+        forwardArgs.push('--profile', options.profile);
+    if (options.dryRun)
+        forwardArgs.push('--dry-run');
+    if (options.skills)
+        forwardArgs.push('--skills', options.skills);
+    if (options.skillsLocked)
+        forwardArgs.push('--skills-locked');
+    if (options.docker)
+        forwardArgs.push('--docker');
+    if (options.localDownload)
+        forwardArgs.push('--local-download');
+    if (options.requiredSecrets === false)
+        forwardArgs.push('--no-required-secrets');
+    const results = [];
+    for (let i = 0; i < sorted.length; i++) {
+        const agent = sorted[i];
+        const label = `[${i + 1}/${sorted.length}]`;
+        process.stderr.write(`${chalk_1.default.bold(label)} Publishing ${chalk_1.default.cyan(agent.name)} from ${agent.dirName}/...\n`);
+        // Spawn orch publish in the agent's directory
+        const spawnResult = (0, child_process_1.spawnSync)(process.argv[0], [process.argv[1], 'publish', ...forwardArgs], {
+            cwd: agent.dir,
+            stdio: ['inherit', 'inherit', 'inherit'],
+            env: process.env,
+            timeout: 120_000, // 2 minute timeout per agent
+        });
+        if (spawnResult.status === 0) {
+            results.push({ name: agent.name, dir: agent.dirName, success: true });
+        }
+        else {
+            const errMsg = spawnResult.error?.message || `exit code ${spawnResult.status}`;
+            results.push({ name: agent.name, dir: agent.dirName, success: false, error: errMsg });
+            // Stop on first failure — downstream agents depend on this one
+            process.stderr.write(chalk_1.default.red(`\n✗ Failed to publish ${agent.name}. Stopping — downstream agents may depend on it.\n`));
+            break;
+        }
+        if (i < sorted.length - 1) {
+            process.stderr.write('\n'); // Visual separator between publishes
+        }
+    }
+    // Summary
+    const succeeded = results.filter(r => r.success);
+    const failed = results.filter(r => !r.success);
+    const skipped = sorted.length - results.length;
+    process.stderr.write('\n' + chalk_1.default.bold('─'.repeat(50)) + '\n');
+    process.stderr.write(chalk_1.default.bold(`Batch publish summary:\n\n`));
+    for (const r of results) {
+        if (r.success) {
+            process.stderr.write(`  ${chalk_1.default.green('✔')} ${r.name}\n`);
+        }
+        else {
+            process.stderr.write(`  ${chalk_1.default.red('✗')} ${r.name} — ${r.error}\n`);
+        }
+    }
+    if (skipped > 0) {
+        const skippedAgents = sorted.slice(results.length);
+        for (const a of skippedAgents) {
+            process.stderr.write(`  ${chalk_1.default.yellow('○')} ${a.name} (skipped)\n`);
+        }
+    }
+    process.stderr.write(`\n  ${succeeded.length} succeeded`);
+    if (failed.length > 0)
+        process.stderr.write(`, ${chalk_1.default.red(`${failed.length} failed`)}`);
+    if (skipped > 0)
+        process.stderr.write(`, ${chalk_1.default.yellow(`${skipped} skipped`)}`);
+    process.stderr.write('\n');
+    await (0, analytics_1.track)('cli_publish_all', {
+        total: sorted.length,
+        succeeded: succeeded.length,
+        failed: failed.length,
+        skipped,
+        dry_run: options.dryRun || false,
+    });
+    if (failed.length > 0) {
+        throw new errors_1.CliError(`Batch publish failed: ${failed[0].name}`, errors_1.ExitCodes.GENERAL_ERROR);
+    }
+}
 function registerPublishCommand(program) {
     program
         .command('publish')
@@ -454,12 +585,18 @@ function registerPublishCommand(program) {
         .option('--docker', 'Include Dockerfile for custom environment (builds E2B template)')
         .option('--local-download', 'Allow users to download and run locally (default: server-only)')
         .option('--no-required-secrets', 'Skip required_secrets check for tool/agent types')
+        .option('--all', 'Publish all agents in subdirectories (dependency order)')
         .action(async (options) => {
+        const cwd = process.cwd();
+        // --all: batch publish all agents in subdirectories
+        if (options.all) {
+            await batchPublish(cwd, options);
+            return;
+        }
         const skillsFromFlag = options.skills
             ? options.skills.split(',').map(s => s.trim()).filter(Boolean)
             : undefined;
         const config = await (0, config_1.getResolvedConfig)({}, options.profile);
-        const cwd = process.cwd();
         // Resolve workspace context — if `orch workspace use` was called, publish
         // to that workspace instead of the personal org (F-5)
         // Skip workspace resolution when using a named profile — the global
@@ -686,24 +823,6 @@ function registerPublishCommand(program) {
         // Validate managed-loop specific fields + normalize loop payload
         let loopConfig;
         if (executionEngine === 'managed_loop') {
-            if (manifest.custom_tools) {
-                const reservedNames = new Set(['bash', 'read_file', 'write_file', 'list_files', 'submit_result']);
-                const seenNames = new Set();
-                for (const tool of manifest.custom_tools) {
-                    if (!tool.name || !tool.command) {
-                        throw new errors_1.CliError(`Invalid custom_tool: each tool must have 'name' and 'command' fields.\n` +
-                            `Found: ${JSON.stringify(tool)}`);
-                    }
-                    if (reservedNames.has(tool.name)) {
-                        throw new errors_1.CliError(`Custom tool '${tool.name}' conflicts with a built-in tool name.\n` +
-                            `Reserved names: ${[...reservedNames].join(', ')}`);
-                    }
-                    if (seenNames.has(tool.name)) {
-                        throw new errors_1.CliError(`Duplicate custom tool name: '${tool.name}'`);
-                    }
-                    seenNames.add(tool.name);
-                }
-            }
             if (manifest.max_turns !== undefined) {
                 if (typeof manifest.max_turns !== 'number' || manifest.max_turns < 1 || manifest.max_turns > 50) {
                     throw new errors_1.CliError('max_turns must be a number between 1 and 50');
@@ -722,6 +841,27 @@ function registerPublishCommand(program) {
                 providedLoop.max_turns = 25;
             }
             loopConfig = providedLoop;
+            // Validate custom_tools from the merged loopConfig (covers both top-level
+            // manifest.custom_tools and loop.custom_tools placements — BUG-15)
+            const mergedTools = Array.isArray(loopConfig.custom_tools) ? loopConfig.custom_tools : [];
+            if (mergedTools.length > 0) {
+                const reservedNames = new Set(['bash', 'read_file', 'write_file', 'list_files', 'submit_result']);
+                const seenNames = new Set();
+                for (const tool of mergedTools) {
+                    if (!tool.name || !tool.command) {
+                        throw new errors_1.CliError(`Invalid custom_tool: each tool must have 'name' and 'command' fields.\n` +
+                            `Found: ${JSON.stringify(tool)}`);
+                    }
+                    if (reservedNames.has(tool.name)) {
+                        throw new errors_1.CliError(`Custom tool '${tool.name}' conflicts with a built-in tool name.\n` +
+                            `Reserved names: ${[...reservedNames].join(', ')}`);
+                    }
+                    if (seenNames.has(tool.name)) {
+                        throw new errors_1.CliError(`Duplicate custom tool name: '${tool.name}'`);
+                    }
+                    seenNames.add(tool.name);
+                }
+            }
             if (!manifest.supported_providers) {
                 manifest.supported_providers = ['anthropic'];
             }
@@ -870,7 +1010,7 @@ function registerPublishCommand(program) {
                     const schemaTypes = [inputSchema ? 'input' : null, outputSchema ? 'output' : null].filter(Boolean).join(' + ');
                     process.stderr.write(`  ✓ schema.json found (${schemaTypes} schemas)\n`);
                 }
-                const customToolCount = manifest.custom_tools?.length || Number(Array.isArray(loopConfig?.custom_tools) ? loopConfig.custom_tools.length : 0);
+                const customToolCount = Array.isArray(loopConfig?.custom_tools) ? loopConfig.custom_tools.length : 0;
                 process.stderr.write(`  ✓ Custom tools: ${customToolCount}\n`);
                 process.stderr.write(`  ✓ Max turns: ${loopConfig?.max_turns || manifest.max_turns || 25}\n`);
             }
@@ -917,6 +1057,71 @@ function registerPublishCommand(program) {
             if (manifest.required_secrets?.length) {
                 process.stderr.write(`  Secrets:     ${manifest.required_secrets.join(', ')}\n`);
             }
+            if (manifest.environment) {
+                const envParts = [];
+                if (manifest.environment.python_version)
+                    envParts.push(`Python ${manifest.environment.python_version}`);
+                if (manifest.environment.node_version)
+                    envParts.push(`Node ${manifest.environment.node_version}`);
+                if (manifest.environment.pip_flags)
+                    envParts.push(`pip: ${manifest.environment.pip_flags}`);
+                if (manifest.environment.npm_flags)
+                    envParts.push(`npm: ${manifest.environment.npm_flags}`);
+                if (envParts.length) {
+                    process.stderr.write(`  Environment: ${envParts.join(', ')}\n`);
+                }
+            }
+            // Server-side validation (BUG-11: dry-run missed server-side checks)
+            process.stderr.write(`\nServer validation...\n`);
+            try {
+                const validation = await (0, api_1.validateAgentPublish)(config, {
+                    name: manifest.name,
+                    type: canonicalType,
+                    run_mode: runMode,
+                    runtime: runtimeConfig,
+                    loop: loopConfig,
+                    callable,
+                    description: manifest.description,
+                    prompt,
+                    url: agentUrl,
+                    input_schema: inputSchema,
+                    output_schema: outputSchema,
+                    is_public: false,
+                    supported_providers: supportedProviders,
+                    default_models: manifest.default_models,
+                    timeout_seconds: manifest.timeout_seconds,
+                    run_command: manifest.run_command,
+                    sdk_compatible: sdkCompatible || undefined,
+                    manifest: manifest.manifest,
+                    required_secrets: manifest.required_secrets,
+                    default_skills: skillsFromFlag || manifest.default_skills,
+                    skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
+                    allow_local_download: options.localDownload || false,
+                    environment: manifest.environment,
+                }, workspaceId);
+                if (validation.warnings?.length) {
+                    for (const warning of validation.warnings) {
+                        process.stderr.write(chalk_1.default.yellow(`  ⚠ ${warning}\n`));
+                    }
+                }
+                if (!validation.valid) {
+                    for (const error of validation.errors) {
+                        process.stderr.write(chalk_1.default.red(`  ✗ ${error}\n`));
+                    }
+                    process.stderr.write(chalk_1.default.red(`\nDry run failed: server-side validation found ${validation.errors.length} error(s)\n`));
+                    process.stderr.write('No changes made (dry run)\n');
+                    const err = new errors_1.CliError('Server-side validation failed', errors_1.ExitCodes.INVALID_INPUT);
+                    err.displayed = true;
+                    throw err;
+                }
+                process.stderr.write(`  ✓ Server-side validation passed\n`);
+            }
+            catch (err) {
+                if (err instanceof errors_1.CliError)
+                    throw err;
+                // Network or auth errors — show warning but don't block dry-run
+                process.stderr.write(chalk_1.default.yellow(`  ⚠ Could not reach server for validation (offline?)\n`));
+            }
             process.stderr.write(`\nWould publish: ${preview.org_slug}/${manifest.name}@${preview.next_version}\n`);
             if (shouldUploadBundle) {
                 const bundlePreview = await (0, bundle_1.previewBundle)(cwd, {
@@ -1012,6 +1217,8 @@ function registerPublishCommand(program) {
                 default_skills: skillsFromFlag || manifest.default_skills,
                 skills_locked: manifest.skills_locked || options.skillsLocked || undefined,
                 allow_local_download: options.localDownload || false,
+                // Environment pinning
+                environment: manifest.environment,
             }, workspaceId);
         }
         catch (err) {
@@ -1185,8 +1392,17 @@ function registerPublishCommand(program) {
             }
         }
         if (result.service_key) {
-            process.stdout.write(`\nService key (save this - shown only once):\n`);
+            process.stdout.write(`\nService key:\n`);
             process.stdout.write(`  ${result.service_key}\n`);
+            try {
+                const keyPrefix = result.service_key.substring(0, 12);
+                const savedPath = await (0, key_store_1.saveServiceKey)(org.slug, manifest.name, assignedVersion, result.service_key, keyPrefix);
+                process.stdout.write(`  ${chalk_1.default.gray(`Saved to ${savedPath}`)}\n`);
+            }
+            catch {
+                process.stdout.write(`  ${chalk_1.default.yellow('Could not save key locally. Copy it now — it cannot be retrieved from the server.')}\n`);
+            }
+            process.stdout.write(`  Retrieve later: ${chalk_1.default.cyan(`orch agent-keys list ${org.slug}/${manifest.name}`)}\n`);
         }
         // Show next-step CLI command based on run mode
         const runRef = `${org.slug}/${manifest.name}`;