@orchagent/cli 0.3.99 → 0.3.101

package/dist/commands/run.js

@@ -54,6 +54,7 @@ const child_process_1 = require("child_process");
 const chalk_1 = __importDefault(require("chalk"));
 const dotenv_1 = require("../lib/dotenv");
 const config_1 = require("../lib/config");
+const resolve_agent_1 = require("../lib/resolve-agent");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
 const output_1 = require("../lib/output");
@@ -84,18 +85,6 @@ function localCommandForEntrypoint(entrypoint) {
     }
     return 'python3';
 }
-function parseAgentRef(value) {
-    const [ref, versionPart] = value.split('@');
-    const version = versionPart?.trim() || DEFAULT_VERSION;
-    const segments = ref.split('/');
-    if (segments.length === 1) {
-        return { agent: segments[0], version };
-    }
-    if (segments.length === 2) {
-        return { org: segments[0], agent: segments[1], version };
-    }
-    throw new errors_1.CliError('Invalid agent reference. Use org/agent or agent format.');
-}
 function canonicalAgentType(typeValue) {
     const normalized = (typeValue || 'agent').toLowerCase();
     // Handle legacy type names: agentic → agent, code → tool
@@ -656,7 +645,7 @@ async function downloadAgent(config, org, agent, version, workspaceId) {
         entrypoint: targetAgent.entrypoint,
     };
 }
-async function downloadBundleWithFallback(config, org, agentName, version, agentId) {
+async function downloadBundleWithFallback(config, org, agentName, version, agentId, workspaceId) {
     try {
         return await (0, api_1.downloadCodeBundle)(config, org, agentName, version);
     }
@@ -667,7 +656,7 @@ async function downloadBundleWithFallback(config, org, agentName, version, agent
     if (!config.apiKey || !agentId) {
         throw new api_1.ApiError(`Bundle for '${org}/${agentName}@${version}' not found`, 404);
     }
-    return await (0, api_1.downloadCodeBundleAuthenticated)(config, agentId);
+    return await (0, api_1.downloadCodeBundleAuthenticated)(config, agentId, workspaceId);
 }
 async function checkDependencies(config, dependencies) {
     const results = [];
@@ -738,7 +727,7 @@ async function downloadSkillDependency(config, ref, defaultOrg) {
     const skillData = await (0, api_1.publicRequest)(config, `/public/agents/${org}/${parsed.skill}/${parsed.version}/download`);
     await saveAgentLocally(org, parsed.skill, skillData);
 }
-async function downloadDependenciesRecursively(config, depStatuses, visited = new Set()) {
+async function downloadDependenciesRecursively(config, depStatuses, visited = new Set(), workspaceId) {
     for (const status of depStatuses) {
         if (!status.downloadable || !status.agentData)
             continue;
@@ -750,7 +739,7 @@ async function downloadDependenciesRecursively(config, depStatuses, visited = ne
         await (0, spinner_1.withSpinner)(`Downloading dependency: ${depRef}...`, async () => {
             await saveAgentLocally(org, agent, status.agentData);
             if (status.agentData.has_bundle) {
-                await saveBundleLocally(config, org, agent, status.dep.version, status.agentData.id);
+                await saveBundleLocally(config, org, agent, status.dep.version, status.agentData.id, workspaceId);
             }
             if (resolveExecutionEngine(status.agentData) === 'code_runtime' && (status.agentData.source_url || status.agentData.pip_package)) {
                 await installTool(status.agentData);
@@ -767,7 +756,7 @@ async function downloadDependenciesRecursively(config, depStatuses, visited = ne
         }
         if (status.agentData.dependencies && status.agentData.dependencies.length > 0) {
             const nestedStatuses = await checkDependencies(config, status.agentData.dependencies);
-            await downloadDependenciesRecursively(config, nestedStatuses, visited);
+            await downloadDependenciesRecursively(config, nestedStatuses, visited, workspaceId);
         }
     }
 }
@@ -1168,7 +1157,7 @@ async function unzipBundle(zipPath, destDir) {
         });
     });
 }
-async function executeBundleAgent(config, org, agentName, version, agentData, args, inputOption) {
+async function executeBundleAgent(config, org, agentName, version, agentData, args, inputOption, workspaceId) {
     const userCwd = process.cwd();
     const tempDir = path_1.default.join(os_1.default.tmpdir(), `orchagent-${agentName}-${Date.now()}`);
     await promises_1.default.mkdir(tempDir, { recursive: true });
@@ -1176,7 +1165,7 @@ async function executeBundleAgent(config, org, agentName, version, agentData, ar
     const extractDir = path_1.default.join(tempDir, 'agent');
     try {
         const bundleBuffer = await (0, spinner_1.withSpinner)(`Downloading ${org}/${agentName}@${version} bundle...`, async () => {
-            const buffer = await downloadBundleWithFallback(config, org, agentName, version, agentData.id);
+            const buffer = await downloadBundleWithFallback(config, org, agentName, version, agentData.id, workspaceId);
             await promises_1.default.writeFile(bundleZip, buffer);
             return buffer;
         }, { successText: (buf) => `Downloaded bundle (${buf.length} bytes)` });
@@ -1391,7 +1380,7 @@ async function saveAgentLocally(org, agent, agentData) {
     }
     return agentDir;
 }
-async function saveBundleLocally(config, org, agent, version, agentId) {
+async function saveBundleLocally(config, org, agent, version, agentId, workspaceId) {
     const agentDir = path_1.default.join(AGENTS_DIR, org, agent);
     const bundleDir = path_1.default.join(agentDir, 'bundle');
     const metaPath = path_1.default.join(agentDir, 'agent.json');
@@ -1411,7 +1400,7 @@ async function saveBundleLocally(config, org, agent, version, agentId) {
     catch {
         // Metadata doesn't exist, need to download
     }
-    const bundleBuffer = await (0, spinner_1.withSpinner)(`Downloading bundle for ${org}/${agent}@${version}...`, async () => downloadBundleWithFallback(config, org, agent, version, agentId), { successText: `Downloaded bundle for ${org}/${agent}@${version}` });
+    const bundleBuffer = await (0, spinner_1.withSpinner)(`Downloading bundle for ${org}/${agent}@${version}...`, async () => downloadBundleWithFallback(config, org, agent, version, agentId, workspaceId), { successText: `Downloaded bundle for ${org}/${agent}@${version}` });
     const tempZip = path_1.default.join(os_1.default.tmpdir(), `bundle-${Date.now()}.zip`);
     await promises_1.default.writeFile(tempZip, bundleBuffer);
     try {
@@ -1869,15 +1858,8 @@ async function executeCloud(agentRef, file, options) {
     if (!resolved.apiKey) {
         throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
     }
-    const parsed = parseAgentRef(agentRef);
-    const configFile = await (0, config_1.loadConfig)();
-    const org = parsed.org ?? configFile.workspace ?? resolved.defaultOrg;
-    if (!org) {
-        throw new errors_1.CliError('Missing org. Use org/agent or set default org.');
-    }
-    // Resolve workspace context for the target org
-    const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
-    const agentMeta = await (0, api_1.getAgentWithFallback)(resolved, org, parsed.agent, parsed.version, workspaceId);
+    const { org, agent: agentName, version, workspaceId } = await (0, resolve_agent_1.resolveAgentContext)(agentRef, resolved);
+    const agentMeta = await (0, api_1.getAgentWithFallback)(resolved, org, agentName, version, workspaceId);
     const cloudType = canonicalAgentType(agentMeta.type);
     const cloudEngine = resolveExecutionEngine({
         type: agentMeta.type,
@@ -1891,10 +1873,8 @@ async function executeCloud(agentRef, file, options) {
         const agentRequiredSecrets = agentMeta.required_secrets;
         if (agentRequiredSecrets?.length) {
             try {
-                // Use already-resolved workspaceId (or fall back to config workspace slug)
-                const wsId = workspaceId ?? (configFile.workspace ? (await (0, api_1.resolveWorkspaceIdForOrg)(resolved, configFile.workspace)) : undefined);
-                if (wsId) {
-                    const secretsResult = await (0, api_1.request)(resolved, 'GET', `/workspaces/${wsId}/secrets`);
+                if (workspaceId) {
+                    const secretsResult = await (0, api_1.request)(resolved, 'GET', `/workspaces/${workspaceId}/secrets`);
                     const existingNames = new Set(secretsResult.secrets.map((s) => s.name));
                     const missing = agentRequiredSecrets.filter((s) => !existingNames.has(s));
                     if (missing.length > 0) {
@@ -1918,7 +1898,7 @@ async function executeCloud(agentRef, file, options) {
     // --estimate-only: show cost estimate and exit without running
     if (options.estimate || options.estimateOnly) {
         try {
-            const est = await (0, api_1.getAgentCostEstimate)(resolved, org, parsed.agent, parsed.version);
+            const est = await (0, api_1.getAgentCostEstimate)(resolved, org, agentName, version);
             const e = est.estimate;
             if (e.sample_size === 0) {
                 process.stderr.write(chalk_1.default.yellow('\nNo run history available for cost estimation.\n'));
@@ -2245,7 +2225,7 @@ async function executeCloud(agentRef, file, options) {
         }
     } // end of non-injection path
     const verboseQs = options.verbose ? '?verbose=true' : '';
-    const url = `${resolved.apiUrl.replace(/\/$/, '')}/${org}/${parsed.agent}/${parsed.version}/${endpoint}${verboseQs}`;
+    const url = `${resolved.apiUrl.replace(/\/$/, '')}/${org}/${agentName}/${version}/${endpoint}${verboseQs}`;
     // Enable SSE streaming for sandbox-backed engines (unless --json or --no-stream or --output)
     const isManagedLoopAgent = cloudType === 'agent' && cloudEngine === 'managed_loop';
     const isCodeRuntimeAgent = cloudEngine === 'code_runtime';
@@ -2257,13 +2237,13 @@ async function executeCloud(agentRef, file, options) {
     }
     // Print verbose debug info before request
     if (options.verbose && !options.json) {
-        process.stderr.write(chalk_1.default.gray(`\n[verbose] ${org}/${parsed.agent}@${parsed.version}\n` +
+        process.stderr.write(chalk_1.default.gray(`\n[verbose] ${org}/${agentName}@${version}\n` +
             `[verbose] type=${cloudType}  engine=${cloudEngine}  endpoint=${endpoint}\n` +
             `[verbose] stream=${wantStream ? 'yes' : 'no'}  url=${url}\n`));
     }
     const { spinner, dispose: disposeSpinner } = options.json
         ? { spinner: null, dispose: () => { } }
-        : (0, spinner_1.createElapsedSpinner)(`Running ${org}/${parsed.agent}@${parsed.version}...`);
+        : (0, spinner_1.createElapsedSpinner)(`Running ${org}/${agentName}@${version}...`);
     spinner?.start();
     // Streamed sandbox runs can take longer; use 10 min timeout (or --wait-timeout).
     const waitTimeoutSec = options.waitTimeout ? parseInt(options.waitTimeout, 10) : undefined;
@@ -2432,11 +2412,11 @@ async function executeCloud(agentRef, file, options) {
         let finalPayload = null;
         let hadError = false;
         if (options.verbose) {
-            process.stderr.write(chalk_1.default.gray(`\nStreaming ${org}/${parsed.agent}@${parsed.version} (verbose):\n`));
+            process.stderr.write(chalk_1.default.gray(`\nStreaming ${org}/${agentName}@${version} (verbose):\n`));
             process.stderr.write(chalk_1.default.gray(`  type=${cloudType}  engine=${cloudEngine}  endpoint=${endpoint}\n`));
         }
         else {
-            process.stderr.write(chalk_1.default.gray(`\nStreaming ${org}/${parsed.agent}@${parsed.version}:\n`));
+            process.stderr.write(chalk_1.default.gray(`\nStreaming ${org}/${agentName}@${version}:\n`));
         }
         let progressErrorShown = false;
         let streamTimedOut = false;
@@ -2497,7 +2477,7 @@ async function executeCloud(agentRef, file, options) {
                     ? ''
                     : chalk_1.default.gray('Tip: Use --wait-timeout <seconds> to wait longer.\n')));
             await (0, analytics_1.track)('cli_run', {
-                agent: `${org}/${parsed.agent}@${parsed.version}`,
+                agent: `${org}/${agentName}@${version}`,
                 input_type: hasInjection ? 'file_injection' : unkeyedFileArgs.length > 0 ? 'file' : options.data ? 'json' : 'empty',
                 mode: 'cloud',
                 streamed: true,
@@ -2508,7 +2488,7 @@ async function executeCloud(agentRef, file, options) {
             throw err;
         }
         await (0, analytics_1.track)('cli_run', {
-            agent: `${org}/${parsed.agent}@${parsed.version}`,
+            agent: `${org}/${agentName}@${version}`,
             input_type: hasInjection ? 'file_injection' : unkeyedFileArgs.length > 0 ? 'file' : options.data ? 'json' : 'empty',
             mode: 'cloud',
             streamed: true,
@@ -2549,14 +2529,14 @@ async function executeCloud(agentRef, file, options) {
                     }
                     const runId = response.headers?.get?.('x-run-id');
                     if (runId) {
-                        process.stderr.write(chalk_1.default.gray(`View logs: orch logs ${runId}\n`));
+                        process.stderr.write(chalk_1.default.gray(`Snapshot saved · Logs: orch logs ${runId}  · Replay: orch replay ${runId}\n`));
                     }
                 }
             }
         }
         return;
     }
-    spinner?.succeed(`Ran ${org}/${parsed.agent}@${parsed.version}`);
+    spinner?.succeed(`Ran ${org}/${agentName}@${version}`);
     const inputType = hasInjection
         ? 'file_injection'
         : unkeyedFileArgs.length > 0
@@ -2569,7 +2549,7 @@ async function executeCloud(agentRef, file, options) {
                         ? 'metadata'
                         : 'empty';
     await (0, analytics_1.track)('cli_run', {
-        agent: `${org}/${parsed.agent}@${parsed.version}`,
+        agent: `${org}/${agentName}@${version}`,
         input_type: inputType,
         mode: 'cloud',
     });
@@ -2638,7 +2618,7 @@ async function executeCloud(agentRef, file, options) {
             }
             const runId = response.headers?.get?.('x-run-id');
             if (runId) {
-                process.stderr.write(chalk_1.default.gray(`View logs: orch logs ${runId}\n`));
+                process.stderr.write(chalk_1.default.gray(`Snapshot saved · Logs: orch logs ${runId}  · Replay: orch replay ${runId}\n`));
             }
         }
     }
@@ -2670,21 +2650,14 @@ async function executeLocal(agentRef, args, options) {
         }
     }
     const resolved = await (0, config_1.getResolvedConfig)();
-    const parsed = parseAgentRef(agentRef);
-    const configFile = await (0, config_1.loadConfig)();
-    const org = parsed.org ?? configFile.workspace ?? resolved.defaultOrg;
-    if (!org) {
-        throw new errors_1.CliError('Missing org. Use org/agent format.');
-    }
-    // Resolve workspace context for the target org
-    const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
+    const { org, agent: localAgentName, version: localVersion, workspaceId } = await (0, resolve_agent_1.resolveAgentContext)(agentRef, resolved);
     // Download agent definition with spinner
-    const agentData = await (0, spinner_1.withSpinner)(`Downloading ${org}/${parsed.agent}@${parsed.version}...`, async () => {
+    const agentData = await (0, spinner_1.withSpinner)(`Downloading ${org}/${localAgentName}@${localVersion}...`, async () => {
         try {
-            return await downloadAgent(resolved, org, parsed.agent, parsed.version, workspaceId);
+            return await downloadAgent(resolved, org, localAgentName, localVersion, workspaceId);
         }
         catch (err) {
-            const agentMeta = await (0, api_1.getPublicAgent)(resolved, org, parsed.agent, parsed.version);
+            const agentMeta = await (0, api_1.getPublicAgent)(resolved, org, localAgentName, localVersion);
             return {
                 type: agentMeta.type || 'agent',
                 run_mode: agentMeta.run_mode ?? null,
@@ -2696,7 +2669,7 @@ async function executeLocal(agentRef, args, options) {
                 supported_providers: agentMeta.supported_providers || ['any'],
             };
         }
-    }, { successText: `Downloaded ${org}/${parsed.agent}@${parsed.version}` });
+    }, { successText: `Downloaded ${org}/${localAgentName}@${localVersion}` });
     const localType = canonicalAgentType(agentData.type);
     const localEngine = resolveExecutionEngine(agentData);
     // Skills cannot be run directly
@@ -2704,8 +2677,8 @@ async function executeLocal(agentRef, args, options) {
         throw new errors_1.CliError('Skills cannot be run directly.\n\n' +
             'Skills are instructions meant to be injected into AI agent contexts.\n\n' +
             'Options:\n' +
-            `  Install for AI tools:  orchagent skill install ${org}/${parsed.agent}\n` +
-            `  Use with an agent:     orchagent run <agent> --skills ${org}/${parsed.agent}`);
+            `  Install for AI tools:  orchagent skill install ${org}/${localAgentName}\n` +
+            `  Use with an agent:     orchagent run <agent> --skills ${org}/${localAgentName}`);
     }
     // Managed-loop agents execute locally with the agent runner.
     if (localEngine === 'managed_loop') {
@@ -2713,11 +2686,11 @@ async function executeLocal(agentRef, args, options) {
             throw new errors_1.CliError('Agent prompt not available for local execution.\n\n' +
                 'This agent may have local download disabled.\n' +
                 'Remove the --local flag to run in the cloud:\n' +
-                `  orch run ${org}/${parsed.agent}@${parsed.version} --data '{"task": "..."}'`);
+                `  orch run ${org}/${localAgentName}@${localVersion} --data '{"task": "..."}'`);
         }
         if (!options.input) {
             process.stderr.write(`\nAgent downloaded. Run with:\n`);
-            process.stderr.write(`  orch run ${org}/${parsed.agent}@${parsed.version} --local --data '{\"task\": \"...\"}'\n`);
+            process.stderr.write(`  orch run ${org}/${localAgentName}@${localVersion} --local --data '{\"task\": \"...\"}'\n`);
             return;
         }
         // Resolve @file.json / @- stdin syntax before parsing
@@ -2731,7 +2704,7 @@ async function executeLocal(agentRef, args, options) {
         }
         warnInputSchemaErrors(agentInputData, agentData.input_schema);
         // Write prompt to temp dir and run
-        const tempAgentDir = path_1.default.join(os_1.default.tmpdir(), `orchagent-agent-${parsed.agent}-${Date.now()}`);
+        const tempAgentDir = path_1.default.join(os_1.default.tmpdir(), `orchagent-agent-${localAgentName}-${Date.now()}`);
         await promises_1.default.mkdir(tempAgentDir, { recursive: true });
         try {
             await promises_1.default.writeFile(path_1.default.join(tempAgentDir, 'prompt.md'), agentData.prompt);
@@ -2761,10 +2734,10 @@ async function executeLocal(agentRef, args, options) {
         }
         if (choice === 'server') {
             process.stderr.write(`\nRun without --local for server execution:\n`);
-            process.stderr.write(`  orch run ${org}/${parsed.agent}@${parsed.version} --data '{...}'\n\n`);
+            process.stderr.write(`  orch run ${org}/${localAgentName}@${localVersion} --data '{...}'\n\n`);
             process.exit(0);
         }
-        await downloadDependenciesRecursively(resolved, depStatuses);
+        await downloadDependenciesRecursively(resolved, depStatuses, new Set(), workspaceId);
     }
     // Check if user is overriding locked skills
     const agentSkillsLocked = agentData.skills_locked;
@@ -2784,13 +2757,13 @@ async function executeLocal(agentRef, args, options) {
         }
     }
     // Save locally
-    const agentDir = await saveAgentLocally(org, parsed.agent, agentData);
+    const agentDir = await saveAgentLocally(org, localAgentName, agentData);
     process.stderr.write(`\nAgent saved to: ${agentDir}\n`);
     if (localEngine === 'code_runtime') {
         if (agentData.has_bundle) {
             if (options.downloadOnly) {
                 process.stdout.write(`\nCode runtime bundle is available for local execution.\n`);
-                process.stdout.write(`Run with: orch run ${org}/${parsed.agent} --local [args...]\n`);
+                process.stdout.write(`Run with: orch run ${org}/${localAgentName} --local [args...]\n`);
                 return;
             }
             // Pre-build injected payload for bundle agent if keyed files/mounts present
@@ -2806,13 +2779,13 @@ async function executeLocal(agentRef, args, options) {
                 });
                 bundleInput = injected.body;
             }
-            await executeBundleAgent(resolved, org, parsed.agent, parsed.version, agentData, args, bundleInput);
+            await executeBundleAgent(resolved, org, localAgentName, localVersion, agentData, args, bundleInput, workspaceId);
             return;
         }
         if (agentData.run_command && (agentData.source_url || agentData.pip_package)) {
             if (options.downloadOnly) {
                 process.stdout.write(`\nTool ready for local execution.\n`);
-                process.stdout.write(`Run with: orch run ${org}/${parsed.agent} --local [args...]\n`);
+                process.stdout.write(`Run with: orch run ${org}/${localAgentName} --local [args...]\n`);
                 return;
             }
             await executeTool(agentData, args);
@@ -2820,12 +2793,12 @@ async function executeLocal(agentRef, args, options) {
         }
         // Fallback: code runtime agent doesn't support local execution.
         process.stdout.write(`\nThis code runtime agent is configured for server execution.\n`);
-        process.stdout.write(`\nRun without --local: orch run ${org}/${parsed.agent}@${parsed.version} --data '{...}'\n`);
+        process.stdout.write(`\nRun without --local: orch run ${org}/${localAgentName}@${localVersion} --data '{...}'\n`);
         return;
     }
     if (options.downloadOnly) {
         process.stdout.write(`\nAgent downloaded. Run with:\n`);
-        process.stdout.write(`  orch run ${org}/${parsed.agent}@${parsed.version} --local --input '{...}'\n`);
+        process.stdout.write(`  orch run ${org}/${localAgentName}@${localVersion} --local --input '{...}'\n`);
         return;
     }
     // Check for keyed file/mount injection
@@ -2835,7 +2808,7 @@ async function executeLocal(agentRef, args, options) {
     // Direct LLM agents execute locally via prompt composition.
     if (!options.input && !execLocalHasInjection) {
         process.stdout.write(`\nAgent ready.\n`);
-        process.stdout.write(`Run with: orch run ${org}/${parsed.agent}@${parsed.version} --local --input '{...}'\n`);
+        process.stdout.write(`Run with: orch run ${org}/${localAgentName}@${localVersion} --local --input '{...}'\n`);
         return;
     }
     let inputData;

package/dist/commands/schedule.js

@@ -162,6 +162,7 @@ function registerScheduleCommand(program) {
         .option('--alert-webhook <url>', 'Webhook URL to POST on failure (HTTPS required)')
         .option('--alert-on-failure-count <n>', 'Number of consecutive failures before alerting (default: 3)', parseInt)
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON')
         .action(async (agentArg, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -217,6 +218,10 @@ function registerScheduleCommand(program) {
             body: JSON.stringify(body),
             headers: { 'Content-Type': 'application/json' },
         });
+        if (options.json) {
+            (0, output_1.printJson)(result);
+            return;
+        }
         const s = result.schedule;
         process.stdout.write(chalk_1.default.green('\u2713') + ` Schedule created\n\n`);
         process.stdout.write(`  ID:          ${s.id}\n`);
@@ -264,6 +269,7 @@ function registerScheduleCommand(program) {
         .option('--alert-on-failure-count <n>', 'Number of consecutive failures before alerting', parseInt)
         .option('--clear-alert-webhook', 'Remove the alert webhook URL')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -322,6 +328,10 @@ function registerScheduleCommand(program) {
             body: JSON.stringify(updates),
             headers: { 'Content-Type': 'application/json' },
         });
+        if (options.json) {
+            (0, output_1.printJson)(result);
+            return;
+        }
         const s = result.schedule;
         process.stdout.write(chalk_1.default.green('\u2713') + ` Schedule updated\n\n`);
         process.stdout.write(`  ID:      ${s.id}\n`);
@@ -349,6 +359,7 @@ function registerScheduleCommand(program) {
         .description('Delete a schedule')
         .option('-y, --yes', 'Skip confirmation prompt')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON (implies --yes)')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -356,7 +367,7 @@ function registerScheduleCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const scheduleId = await resolveScheduleId(config, partialScheduleId, workspaceId);
-        if (!options.yes) {
+        if (!options.yes && !options.json) {
             const rl = promises_1.default.createInterface({
                 input: process.stdin,
                 output: process.stdout,
@@ -368,7 +379,11 @@ function registerScheduleCommand(program) {
                 return;
             }
         }
-        await (0, api_1.request)(config, 'DELETE', `/workspaces/${workspaceId}/schedules/${scheduleId}`);
+        const result = await (0, api_1.request)(config, 'DELETE', `/workspaces/${workspaceId}/schedules/${scheduleId}`);
+        if (options.json) {
+            (0, output_1.printJson)({ ...result, id: scheduleId });
+            return;
+        }
         process.stdout.write(chalk_1.default.green('\u2713') + ` Schedule ${scheduleId} deleted\n`);
     });
     // orch schedule trigger <schedule-id>
@@ -378,6 +393,7 @@ function registerScheduleCommand(program) {
         .option('--data <json>', 'Override input data as JSON')
         .addOption(new commander_1.Option('--input <json>').hideHelp())
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -396,11 +412,17 @@ function registerScheduleCommand(program) {
                 throw new errors_1.CliError('Invalid JSON in --data');
             }
         }
-        process.stdout.write('Triggering schedule...\n');
+        if (!options.json) {
+            process.stdout.write('Triggering schedule...\n');
+        }
         const result = await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/schedules/${scheduleId}/trigger`, body ? {
             body,
             headers: { 'Content-Type': 'application/json' },
         } : {});
+        if (options.json) {
+            (0, output_1.printJson)(result);
+            return;
+        }
         // Status-aware header message
         const isAsync = result.status === 'queued' || result.status === 'deduplicated';
         if (isAsync) {
@@ -565,6 +587,7 @@ function registerScheduleCommand(program) {
         .command('test-alert <schedule-id>')
         .description('Send a test alert to the schedule\'s configured webhook URL')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -572,8 +595,14 @@ function registerScheduleCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const scheduleId = await resolveScheduleId(config, partialScheduleId, workspaceId);
-        process.stdout.write('Sending test alert...\n');
+        if (!options.json) {
+            process.stdout.write('Sending test alert...\n');
+        }
         const result = await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/schedules/${scheduleId}/test-alert`);
+        if (options.json) {
+            (0, output_1.printJson)({ ...result, schedule_id: scheduleId });
+            return;
+        }
         if (result.success) {
             process.stdout.write(chalk_1.default.green('\u2713') + ' Test alert delivered successfully\n');
         }
@@ -587,6 +616,7 @@ function registerScheduleCommand(program) {
         .description('Regenerate the webhook secret (invalidates old URL)')
         .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
         .option('-y, --yes', 'Skip confirmation prompt')
+        .option('--json', 'Output as JSON (implies --yes)')
         .action(async (partialScheduleId, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         if (!config.apiKey) {
@@ -594,7 +624,7 @@ function registerScheduleCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const scheduleId = await resolveScheduleId(config, partialScheduleId, workspaceId);
-        if (!options.yes) {
+        if (!options.yes && !options.json) {
             const rl = promises_1.default.createInterface({
                 input: process.stdin,
                 output: process.stdout,
@@ -609,6 +639,10 @@ function registerScheduleCommand(program) {
             }
         }
         const result = await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/schedules/${scheduleId}/regenerate-webhook`);
+        if (options.json) {
+            (0, output_1.printJson)({ ...result, schedule_id: scheduleId });
+            return;
+        }
         process.stdout.write(chalk_1.default.green('\u2713') + ' Webhook secret regenerated\n\n');
         process.stdout.write(`  ${chalk_1.default.bold('New Webhook URL')} (save this — retrieve later with ${chalk_1.default.cyan('orch schedule info --reveal')}):\n`);
         process.stdout.write(`  ${result.webhook_url}\n\n`);

package/dist/commands/security.js

@@ -11,26 +11,11 @@ const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const errors_1 = require("../lib/errors");
+const resolve_agent_1 = require("../lib/resolve-agent");
 const output_1 = require("../lib/output");
 const spinner_1 = require("../lib/spinner");
 const llm_1 = require("../lib/llm");
 const analytics_1 = require("../lib/analytics");
-const DEFAULT_VERSION = 'latest';
-function parseAgentRef(value) {
-    const [ref, versionPart] = value.split('@');
-    const version = versionPart?.trim() || DEFAULT_VERSION;
-    const segments = ref.split('/');
-    if (segments.length === 1) {
-        return { agent: segments[0], version };
-    }
-    if (segments.length === 2) {
-        return { org: segments[0], agent: segments[1], version };
-    }
-    if (segments.length === 3) {
-        return { org: segments[0], agent: segments[1], version: segments[2] };
-    }
-    throw new errors_1.CliError('Invalid agent reference. Use org/agent/version or org/agent@version format.');
-}
 // Severity color mapping
 function severityColor(severity) {
     switch (severity.toLowerCase()) {
@@ -189,13 +174,8 @@ Examples:
         if (!resolved.apiKey) {
             throw new errors_1.CliError('Missing API key. Run `orchagent login` first.');
         }
-        const parsed = parseAgentRef(agentRef);
-        const configFile = await (0, config_1.loadConfig)();
-        const org = parsed.org ?? configFile.workspace ?? resolved.defaultOrg;
-        if (!org) {
-            throw new errors_1.CliError('Missing org. Use org/agent or set default org.');
-        }
-        const agentId = `${org}/${parsed.agent}/${parsed.version}`;
+        const { org, agent: agentName, version, workspaceId } = await (0, resolve_agent_1.resolveAgentContext)(agentRef, resolved);
+        const agentId = `${org}/${agentName}/${version}`;
         // Detect LLM key for the scan
         let llmKey;
         let llmProvider;
@@ -208,7 +188,13 @@ Examples:
             llmProvider = options.provider;
         }
         else {
-            const detected = await (0, llm_1.detectLlmKey)(['any'], resolved);
+            // Respect --provider preference when detecting local keys
+            let providersToCheck = ['any'];
+            if (options.provider) {
+                (0, llm_1.validateProvider)(options.provider);
+                providersToCheck = [options.provider];
+            }
+            const detected = await (0, llm_1.detectLlmKey)(providersToCheck, resolved);
             if (detected) {
                 llmKey = detected.key;
                 llmProvider = detected.provider;
@@ -227,6 +213,12 @@ Examples:
         if (options.maxAttacks) {
             requestBody.max_attacks = options.maxAttacks;
         }
+        // Send provider preference so gateway can narrow vault key search
+        // (even when no local key is found, the gateway resolves from vault)
+        const effectiveProvider = llmProvider || options.provider;
+        if (effectiveProvider) {
+            requestBody.llm_provider = effectiveProvider;
+        }
         const url = `${resolved.apiUrl.replace(/\/$/, '')}/security/test`;
         // Make the API call with a spinner
         const spinner = (0, spinner_1.createSpinner)(`Scanning ${agentId} for vulnerabilities...`);
@@ -236,6 +228,9 @@ Examples:
             'Content-Type': 'application/json',
             Authorization: `Bearer ${resolved.apiKey}`,
         };
+        if (workspaceId) {
+            headers['X-Workspace-Id'] = workspaceId;
+        }
         if (llmKey) {
             headers['X-LLM-API-Key'] = llmKey;
         }

package/dist/commands/test.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_LLM_KEY_FIXTURE_MESSAGE = void 0;
 exports.registerTestCommand = registerTestCommand;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
@@ -18,6 +19,15 @@ const config_1 = require("../lib/config");
 const llm_1 = require("../lib/llm");
 const bundle_1 = require("../lib/bundle");
 const test_mock_runner_1 = require("../lib/test-mock-runner");
+// ─── Constants ────────────────────────────────────────────────────────────────
+exports.NO_LLM_KEY_FIXTURE_MESSAGE = 'No LLM API key found for fixture tests.\n\n' +
+    'Fixture tests run locally on your machine and cannot access workspace vault keys.\n' +
+    'Set a local environment variable:\n\n' +
+    '  export OPENAI_API_KEY=sk-...\n' +
+    '  export ANTHROPIC_API_KEY=sk-ant-...\n' +
+    '  export GEMINI_API_KEY=AI...\n\n' +
+    'Or add it to a .env file in your agent directory.\n\n' +
+    'To run with vault keys instead, use: orch run --cloud';
 // ─── Utility functions ───────────────────────────────────────────────────────
 function validateFixture(data, fixturePath) {
     const fileName = path_1.default.basename(fixturePath);
@@ -511,11 +521,10 @@ async function runPromptFixtureTests(agentDir, fixtures, verbose, config) {
     catch {
         // Schema is optional
     }
-    // Detect LLM key
+    // Detect LLM key — fixture tests run locally, so vault keys can't be used
     const detected = await (0, llm_1.detectLlmKey)(['any'], config);
     if (!detected) {
-        throw new errors_1.CliError('No LLM key found for fixture tests.\n' +
-            'Set an environment variable (e.g., OPENAI_API_KEY) or run `orch secrets set <PROVIDER>_API_KEY <key>`');
+        throw new errors_1.CliError(exports.NO_LLM_KEY_FIXTURE_MESSAGE);
     }
     const { provider, key, model: serverModel } = detected;
     const model = serverModel ?? (0, llm_1.getDefaultModel)(provider);