@orchestraworks/cli 0.5.1 → 0.5.2

package/README.md

@@ -20,7 +20,7 @@ The full guide to every construct, secrets, connections and troubleshooting is [
 ```bash
 npm install -g @orchestraworks/cli         # the CLI, on your path as `orchestra`
 npm install @orchestraworks/cli            # the current release
-npm install @orchestraworks/cli@0.5.1      # this exact release
+npm install @orchestraworks/cli@0.5.2      # this exact release
 ```
 
 Then `import { Factory, Agent, … } from "@orchestraworks/cli"` normally — the package `exports` entry resolves

package/dist/generated/cli-commands.json

@@ -2421,7 +2421,7 @@
                     "required": true,
                     "repeatable": false,
                     "credential": false,
-                    "description": "The type of the principal the key signs in. A key of a type that cannot sign in yet is refused 403; today a service account's key alone signs in",
+                    "description": "The type of the principal the key signs in. A key of a type that cannot sign in is refused 403; a person's key and a service account's key sign in, and an agent's does not",
                     "enumValues": [
                         "USER",
                         "SERVICE_ACCOUNT",
@@ -2453,6 +2453,19 @@
                     "repeatable": false,
                     "credential": false,
                     "description": "Human-readable key name"
+                },
+                {
+                    "name": "expires-at",
+                    "names": [
+                        "expires-at"
+                    ],
+                    "source": "body",
+                    "field": "expiresAt",
+                    "type": "string",
+                    "required": false,
+                    "repeatable": false,
+                    "credential": false,
+                    "description": "When the key stops signing its principal in, after the request's time and fixed at create; absent means the key never expires"
                 }
             ],
             "emptyDefaults": [],
@@ -2478,6 +2491,11 @@
                         "schema": {
                             "kind": "scalar"
                         }
+                    },
+                    "expiresAt": {
+                        "schema": {
+                            "kind": "scalar"
+                        }
                     }
                 }
             },
@@ -2513,6 +2531,11 @@
                                         "kind": "scalar"
                                     }
                                 },
+                                "expiresAt": {
+                                    "schema": {
+                                        "kind": "scalar"
+                                    }
+                                },
                                 "createdAt": {
                                     "schema": {
                                         "kind": "scalar"
@@ -2614,6 +2637,11 @@
                             "kind": "scalar"
                         }
                     },
+                    "expiresAt": {
+                        "schema": {
+                            "kind": "scalar"
+                        }
+                    },
                     "createdAt": {
                         "schema": {
                             "kind": "scalar"
@@ -2746,6 +2774,11 @@
                                             "kind": "scalar"
                                         }
                                     },
+                                    "expiresAt": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    },
                                     "createdAt": {
                                         "schema": {
                                             "kind": "scalar"

package/node_modules/@orchestraworks/client/dist/esm/models/ApiKey.d.ts

@@ -45,6 +45,12 @@ export interface ApiKey {
      * @memberof ApiKey
      */
     lastUsedAt?: Date;
+    /**
+     * When the key stops signing its principal in, fixed at create; absent when it never expires
+     * @type {Date}
+     * @memberof ApiKey
+     */
+    expiresAt?: Date;
     /**
      * Creation timestamp
      * @type {Date}

package/node_modules/@orchestraworks/client/dist/esm/models/ApiKey.js

@@ -50,6 +50,7 @@ export function ApiKeyFromJSONTyped(json, ignoreDiscriminator) {
         'principalId': json['principalId'],
         'name': json['name'],
         'lastUsedAt': json['lastUsedAt'] == null ? undefined : (new Date(json['lastUsedAt'])),
+        'expiresAt': json['expiresAt'] == null ? undefined : (new Date(json['expiresAt'])),
         'createdAt': (new Date(json['createdAt'])),
         'updatedAt': (new Date(json['updatedAt'])),
     };
@@ -67,6 +68,7 @@ export function ApiKeyToJSONTyped(value, ignoreDiscriminator = false) {
         'principalId': value['principalId'],
         'name': value['name'],
         'lastUsedAt': value['lastUsedAt'] == null ? value['lastUsedAt'] : value['lastUsedAt'].toISOString(),
+        'expiresAt': value['expiresAt'] == null ? value['expiresAt'] : value['expiresAt'].toISOString(),
         'createdAt': value['createdAt'].toISOString(),
         'updatedAt': value['updatedAt'].toISOString(),
     };

package/node_modules/@orchestraworks/client/dist/esm/models/CreateApiKeyRequest.d.ts

@@ -16,7 +16,7 @@
  */
 export interface CreateApiKeyRequest {
     /**
-     * The type of the principal the key signs in. A key of a type that cannot sign in yet is refused 403; today a service account's key alone signs in
+     * The type of the principal the key signs in. A key of a type that cannot sign in is refused 403; a person's key and a service account's key sign in, and an agent's does not
      * @type {CreateApiKeyRequestPrincipalTypeEnum}
      * @memberof CreateApiKeyRequest
      */
@@ -33,6 +33,12 @@ export interface CreateApiKeyRequest {
      * @memberof CreateApiKeyRequest
      */
     name: string;
+    /**
+     * When the key stops signing its principal in, after the request's time and fixed at create; absent means the key never expires
+     * @type {Date}
+     * @memberof CreateApiKeyRequest
+     */
+    expiresAt?: Date;
 }
 /**
  * @export

package/node_modules/@orchestraworks/client/dist/esm/models/CreateApiKeyRequest.js

@@ -42,6 +42,7 @@ export function CreateApiKeyRequestFromJSONTyped(json, ignoreDiscriminator) {
         'principalType': json['principalType'],
         'principalId': json['principalId'],
         'name': json['name'],
+        'expiresAt': json['expiresAt'] == null ? undefined : (new Date(json['expiresAt'])),
     };
 }
 export function CreateApiKeyRequestToJSON(json) {
@@ -55,5 +56,6 @@ export function CreateApiKeyRequestToJSONTyped(value, ignoreDiscriminator = fals
         'principalType': value['principalType'],
         'principalId': value['principalId'],
         'name': value['name'],
+        'expiresAt': value['expiresAt'] == null ? value['expiresAt'] : value['expiresAt'].toISOString(),
     };
 }

package/node_modules/@orchestraworks/client/dist/models/ApiKey.d.ts

@@ -45,6 +45,12 @@ export interface ApiKey {
      * @memberof ApiKey
      */
     lastUsedAt?: Date;
+    /**
+     * When the key stops signing its principal in, fixed at create; absent when it never expires
+     * @type {Date}
+     * @memberof ApiKey
+     */
+    expiresAt?: Date;
     /**
      * Creation timestamp
      * @type {Date}

package/node_modules/@orchestraworks/client/dist/models/ApiKey.js

@@ -58,6 +58,7 @@ function ApiKeyFromJSONTyped(json, ignoreDiscriminator) {
         'principalId': json['principalId'],
         'name': json['name'],
         'lastUsedAt': json['lastUsedAt'] == null ? undefined : (new Date(json['lastUsedAt'])),
+        'expiresAt': json['expiresAt'] == null ? undefined : (new Date(json['expiresAt'])),
         'createdAt': (new Date(json['createdAt'])),
         'updatedAt': (new Date(json['updatedAt'])),
     };
@@ -75,6 +76,7 @@ function ApiKeyToJSONTyped(value, ignoreDiscriminator = false) {
         'principalId': value['principalId'],
         'name': value['name'],
         'lastUsedAt': value['lastUsedAt'] == null ? value['lastUsedAt'] : value['lastUsedAt'].toISOString(),
+        'expiresAt': value['expiresAt'] == null ? value['expiresAt'] : value['expiresAt'].toISOString(),
         'createdAt': value['createdAt'].toISOString(),
         'updatedAt': value['updatedAt'].toISOString(),
     };

package/node_modules/@orchestraworks/client/dist/models/CreateApiKeyRequest.d.ts

@@ -16,7 +16,7 @@
  */
 export interface CreateApiKeyRequest {
     /**
-     * The type of the principal the key signs in. A key of a type that cannot sign in yet is refused 403; today a service account's key alone signs in
+     * The type of the principal the key signs in. A key of a type that cannot sign in is refused 403; a person's key and a service account's key sign in, and an agent's does not
      * @type {CreateApiKeyRequestPrincipalTypeEnum}
      * @memberof CreateApiKeyRequest
      */
@@ -33,6 +33,12 @@ export interface CreateApiKeyRequest {
      * @memberof CreateApiKeyRequest
      */
     name: string;
+    /**
+     * When the key stops signing its principal in, after the request's time and fixed at create; absent means the key never expires
+     * @type {Date}
+     * @memberof CreateApiKeyRequest
+     */
+    expiresAt?: Date;
 }
 /**
  * @export

package/node_modules/@orchestraworks/client/dist/models/CreateApiKeyRequest.js

@@ -50,6 +50,7 @@ function CreateApiKeyRequestFromJSONTyped(json, ignoreDiscriminator) {
         'principalType': json['principalType'],
         'principalId': json['principalId'],
         'name': json['name'],
+        'expiresAt': json['expiresAt'] == null ? undefined : (new Date(json['expiresAt'])),
     };
 }
 function CreateApiKeyRequestToJSON(json) {
@@ -63,5 +64,6 @@ function CreateApiKeyRequestToJSONTyped(value, ignoreDiscriminator = false) {
         'principalType': value['principalType'],
         'principalId': value['principalId'],
         'name': value['name'],
+        'expiresAt': value['expiresAt'] == null ? value['expiresAt'] : value['expiresAt'].toISOString(),
     };
 }

package/node_modules/@orchestraworks/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestraworks/client",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Orchestra public API TypeScript client",
   "author": "Living Computers",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestraworks/cli",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "type": "module",
   "description": "The Orchestra command line.",
   "license": "Apache-2.0",
@@ -109,13 +109,13 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.3.0",
-    "@orchestraworks/client": "0.5.1",
-    "@orchestraworks/worker": "0.0.136",
+    "@orchestraworks/client": "0.5.2",
+    "@orchestraworks/worker": "0.0.137",
     "commander": "^14.0.0",
     "liquidjs": "^10.28.0"
   },
   "optionalDependencies": {
-    "@orchestraworks/local": "0.0.136"
+    "@orchestraworks/local": "0.0.137"
   },
   "bundleDependencies": [
     "@orchestraworks/client"

package/skills/orchestra/SKILL.md

@@ -138,7 +138,7 @@ ports, settings and network rules. A *machine* is one live computer made from it
 machine carries one agent.
 
 - *Size.* CPU and memory, from a fixed ladder: 0.5, 1, 2, 4, 8, 16 or 32 CPU, with 2 GB of memory per CPU.
-- *Image.* The disk the machine starts from. The stock image is Debian with Node 22, Java 21 and 25, git,
+- *Image.* The disk the machine starts from. The stock image is Debian with Node 24, Java 21 and 25, git,
   Docker with Compose, `gh` and `acli`, and all four harnesses.
 - *Setup script.* A script that runs once, as root, on each new machine, before the agent arrives and before
   any code is cloned. Bash on Linux, PowerShell on Windows. At most 64 KiB, stopped after 10 minutes. A failed

package/skills/orchestra-fdk/references/authoring.md

@@ -516,7 +516,7 @@ const claudeSignIn = new Secret(factory, "claude-sign-in", {
 });
 
 // …in the Environment's props:
-env: { CLAUDE_CODE_OAUTH_TOKEN: "placeholder", ANTHROPIC_API_KEY: "" },
+env: { CLAUDE_CODE_OAUTH_TOKEN: "software-factory-egress-placeholder", ANTHROPIC_API_KEY: "" },
 egress: EgressPolicy.allowAll()
   .allow("claude-sign-in", { hosts: ["api.anthropic.com"], priority: 300, credential: claudeSignIn }),
 ```
@@ -604,6 +604,106 @@ which the harness would otherwise send instead.
   (the recipe supplies the headers), or use `bearer(header, secret)` / `basic(...)` / `header(...)`
   for one-header bindings, or `inject(secret, recipe)` for a binding-owned recipe.
 
+## How the agents reach a model
+
+Ask the person which of three ways they want, and walk them through its steps once.
+
+**1. Subscription: their own Claude or Codex sign-in.** The person makes the sign-in in a real terminal
+on their own computer; run from your shell, its browser step hangs. Never read or copy a value yourself.
+
+- **Claude: a long-lived token in a Secret, the recommended way.** `claude setup-token` prints an
+  `sk-ant-oat…` token made for servers. It lasts about a year, and nothing on a machine renews or revokes
+  it, so it needs no shared `/home`. The person copies it and saves it to a file only they can read,
+  without pasting it into a chat: `umask 077 && pbpaste | tr -d '\n' > <file> && pbcopy </dev/null`.
+  At apply, the shell exports it from that file into the variable the Secret reads. Declare the Claude
+  sign-in recipe (§ Secrets are recipes, never values): a `Secret`, an egress rule that allows
+  `api.anthropic.com` and sets `Authorization: Bearer ${secret}` with `x-api-key` removed, and, in the
+  environment's `env`, `CLAUDE_CODE_OAUTH_TOKEN: "software-factory-egress-placeholder"` and an empty
+  `ANTHROPIC_API_KEY`. Turn `enableModelGateway` off for the agent. The machine holds only the
+  placeholder; the edge adds the token. Copying the renewing credentials file instead is the fallback,
+  and follows the ChatGPT sign-in steps below.
+- **Codex: a personal access token, where the workspace allows one.** A ChatGPT Business or Enterprise
+  member creates it at chatgpt.com/admin/access-tokens, once the workspace owner allows access tokens,
+  and chooses how long it lasts, such as 7 to 90 days. Codex never renews it, so it needs no shared
+  `/home`; the person supplies a new one before it expires. It begins `at-` and goes in
+  `ORCHESTRA_WORKER_CODEX_PERSONAL_ACCESS_TOKEN`, which outranks a ChatGPT sign-in or an API key beside
+  it. On their own computer, `codex login --with-access-token` reads the same token from standard input.
+- **Codex otherwise: a separate ChatGPT sign-in on a shared `/home`.** The other long-lived choice is an
+  OpenAI API key, billed by use rather than by the subscription (option 3).
+  1. **Make a separate sign-in, never a copy of the local one:** `mkdir -p <dir> && CODEX_HOME=<dir>
+     codex login`, with `--device-auth` only on a machine with no browser. Its tokens in
+     `<dir>/auth.json` go in the `ORCHESTRA_WORKER_CODEX_` variables below, or a setup step writes the
+     file.
+  2. **Put it on a shared `/home`.** Give the environment a durable `/home` volume, shared by every
+     machine that uses the sign-in, so one file renews for all of them. Separate copies fight: each
+     renewal replaces the refresh token, so the first copy to renew signs out the others. Two machines
+     that renew in the same second can still sign each other out; then make a new separate sign-in.
+     Remove the variables after the first machine starts, or each new machine writes the old token back.
+  3. **Never sign in again in the default folder after the copy.** A new `codex login` in `~/.codex`
+     revokes the cloud copy, and every machine then answers "refresh token was revoked". If it
+     happened, make a new separate sign-in.
+- **Keep a Codex sign-in off an agent that uses the model gateway.** With a ChatGPT sign-in or a personal
+  access token, Codex compresses its requests, and the gateway refuses them with `model_not_found`, a
+  known issue. Give such an agent the subscription directly, with `enableModelGateway` off, or keep the
+  homes apart.
+
+**2. Model gateway: Orchestra provides the key.** One endpoint reaches OpenAI, Anthropic and open-source
+models, on the organization's credits. The person can also bring their own provider key to the gateway:
+`orchestra fdk init --model-key anthropic` (or `openai`) declares a `ModelProviderKey`, which the gateway uses for
+that provider's calls. The gateway also routes models: `orchestra model-configs` sets which providers serve a
+model and in what order, so a call falls back to the next one when a provider is down, and
+`orchestra model-aliases` gives a model a name of the organization's own, such as `default`, that one change
+points elsewhere.
+
+**3. Own API key via the vault.** Their Anthropic or OpenAI API key is a platform `Secret`, added at the
+network edge on calls straight to the provider, with no gateway in between, and nothing to sync, because
+an API key does not renew. Declare it as the Claude sign-in recipe (§ Secrets are recipes) does, with the provider's own
+header, and leave `enableModelGateway` off in the agent's model settings:
+
+```ts
+const anthropicKey = new Secret(factory, "anthropic-api-key", {
+  value: SecretValue.fromEnv("ORCHESTRA_FDK_ANTHROPIC_API_KEY"),
+  injection: { headers: [{ name: "x-api-key", value: "${secret}" }] },
+});
+// …in the Environment's props:
+egress: EgressPolicy.allowAll()
+  .allow("anthropic", { hosts: ["api.anthropic.com"], priority: 300, credential: anthropicKey }),
+```
+
+For OpenAI, inject `authorization: Bearer ${secret}` on `api.openai.com`. Recommend this over a
+subscription when the person has an API key: there is no file to copy and no shared `/home`.
+
+### The subscription variables
+
+The worker writes each value into the file the harness reads, once per machine start, and hands none of
+these variables to the harness. pi can also run on the provider you name.
+
+| Variable | claude | codex | pi |
+|---|---|---|---|
+| `ORCHESTRA_WORKER_CLAUDE_OAUTH_TOKEN`: a `claude setup-token` token as a worker setting, in plain text; the Claude sign-in recipe's Secret is the recommended way | yes | — | yes |
+| `ORCHESTRA_WORKER_CLAUDE_ACCESS_TOKEN` and `ORCHESTRA_WORKER_CLAUDE_REFRESH_TOKEN`, plus `ORCHESTRA_WORKER_CLAUDE_EXPIRES_AT` in milliseconds if you have it: a renewing Claude sign-in | yes | — | yes |
+| `ORCHESTRA_WORKER_OPENAI_API_KEY` | — | yes | yes |
+| `ORCHESTRA_WORKER_CODEX_PERSONAL_ACCESS_TOKEN`: a Codex personal access token, which outranks the other Codex rows | — | yes | — |
+| `ORCHESTRA_WORKER_CODEX_ID_TOKEN`, `ORCHESTRA_WORKER_CODEX_ACCESS_TOKEN`, `ORCHESTRA_WORKER_CODEX_REFRESH_TOKEN` and `ORCHESTRA_WORKER_CODEX_ACCOUNT_ID` (`tokens.account_id`, which Codex needs to renew): a ChatGPT sign-in | — | yes | — |
+| `ORCHESTRA_WORKER_PI_PROVIDER`: pi's `defaultProvider`, such as `anthropic` or `openai` | — | — | yes |
+
+You can also bake the harness's own sign-in or settings file into the image with the setup script. With
+no variable set, the worker leaves a value already in that file alone. For pi, your own
+`ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_OAUTH_TOKEN`, `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` in `env` still works: the worker then leaves that provider's
+placeholder out of pi's sign-in file, which pi would otherwise read first, and holds back the image's
+`ANTHROPIC_OAUTH_TOKEN` placeholder beside your own `ANTHROPIC_API_KEY`.
+
+- **The value is plain text.** `env` is stored unencrypted, and an environment read returns it. Anyone
+  who can read the environment can read its setup script.
+- **Allow the sign-in hosts with no credential bound**: `platform.claude.com` for a copied Claude
+  credentials file, `api.openai.com` for an OpenAI key, `auth.openai.com` and `chatgpt.com` for ChatGPT. A
+  rule that binds a credential on one of these hosts replaces your sign-in on every call.
+- **Name pi's provider when the model is not a Claude one.** pi runs the agent's model under its
+  `defaultProvider`, which `ORCHESTRA_WORKER_PI_PROVIDER` sets; with no variable, pi keeps the image's
+  `anthropic` or the provider you configured. The platform never picks it from the model.
+- **On a Mac outpost, Claude Code reads the login Keychain first.** Sign out of Claude Code there, or
+  use `ORCHESTRA_WORKER_CLAUDE_OAUTH_TOKEN`, which Claude Code reads before the Keychain.
+
 ## Egress: apply the bundles, hand-write the rest
 
 An environment's `egress` is a policy you build up from one of **two starting points**:

package/skills/orchestra-fdk/references/environment.md

@@ -454,6 +454,61 @@ bundle. Keep the safety rule:
 When a step fails, fix it here, prove the fix locally if a local mode runs, apply again, and assign the
 item again.
 
+### The model in the cloud: subscription, model gateway, or own key via the vault
+
+The cloud agents reach a model in one of three ways. Ask the developer which one, and walk them through
+its steps once. They copy every value themselves; you never read, print or copy it.
+
+1. **Subscription: their own Claude or Codex sign-in.** Follow the sign-in steps below.
+2. **Model gateway: Orchestra provides the key.** One endpoint reaches OpenAI, Anthropic and open-source
+   models, on the organization's credits. They can also bring their own provider key to the gateway, with
+   `orchestra fdk init --model-key anthropic` or `openai`. The gateway also routes models:
+   `orchestra model-configs` sets which providers serve a model and in what order, so a call falls back to
+   the next one when a provider is down, and `orchestra model-aliases` gives a model a name of their own, such as `default`.
+3. **Own API key via the vault.** Their Anthropic or OpenAI API key is a platform Secret, added at the
+   network edge on calls straight to `api.anthropic.com` or `api.openai.com`, with no gateway in between
+   and with the agent's gateway setting off. Nothing to sync, because an API key does not renew. When they
+   have an API key, recommend this over a subscription: no file to copy and no shared `/home`.
+   `references/authoring.md` § How the agents reach a model shows the declaration.
+
+The sign-in steps. The developer makes the sign-in in a real terminal on their computer; run from an
+agent's shell, its browser step hangs.
+
+- **Claude: a long-lived token in a Secret, the recommended way.** `claude setup-token` prints an
+  `sk-ant-oat…` token made for servers. It lasts about a year, and nothing on a machine renews or revokes
+  it, so it needs no shared `/home`. Save it to a file only the developer can read, never through a chat:
+  copy it, then `umask 077 && pbpaste | tr -d '\n' > <file> && pbcopy </dev/null`. At apply, the shell
+  exports it from that file into the variable a `Secret` reads. An egress rule allows `api.anthropic.com`
+  and adds `Authorization: Bearer ${secret}`, removing `x-api-key`. The environment's `env` holds only
+  `CLAUDE_CODE_OAUTH_TOKEN=software-factory-egress-placeholder` and an empty `ANTHROPIC_API_KEY`, and the
+  agent's gateway setting is off. Never put the token itself in `env`. The Claude sign-in recipe in
+  `references/authoring.md` shows the declaration. Copying the renewing credentials file is the fallback,
+  and follows the ChatGPT sign-in steps below.
+- **Codex: a personal access token, where the workspace allows one.** A ChatGPT Business or Enterprise
+  member creates it at chatgpt.com/admin/access-tokens, once the workspace owner allows access tokens,
+  and chooses how long it lasts, such as 7 to 90 days. Codex never renews it, so it needs no shared
+  `/home`; the developer supplies a new one before it expires. It begins `at-` and goes in
+  `ORCHESTRA_WORKER_CODEX_PERSONAL_ACCESS_TOKEN`, which outranks a ChatGPT sign-in or an API key beside
+  it. On their own computer, `codex login --with-access-token` reads the same token from standard input.
+- **Codex otherwise: a separate ChatGPT sign-in on a shared `/home`.** The other long-lived choice is an
+  OpenAI API key, billed by use rather than by the subscription (option 3).
+  1. **Make a separate sign-in, never a copy of the local one:** `mkdir -p <dir> && CODEX_HOME=<dir> codex
+     login` (`--device-auth` only with no browser). Its tokens in `<dir>/auth.json` go in the
+     `ORCHESTRA_WORKER_CODEX_` variables, or a setup step writes the file.
+  2. **Give the environment a durable `/home` volume,** shared by every machine that uses the sign-in, so
+     one file renews for all of them. Each renewal replaces the refresh token, so separate copies sign
+     each other out; two machines that renew in the same second can too, and then need a new sign-in.
+     Remove the variables after the first machine starts.
+  3. **Never sign in again in the default folder after the copy.** A new `codex login` in `~/.codex`
+     revokes the cloud copy, and every machine answers "refresh token was revoked". If it happened, make
+     a new separate sign-in.
+- **Keep a Codex sign-in off an agent that uses the model gateway.** With a ChatGPT sign-in or a personal
+  access token, Codex compresses its requests, and the gateway refuses them with `model_not_found`, a
+  known issue. Give such an agent the subscription directly, with its gateway setting off, or keep the
+  homes apart.
+
+The sign-in values are plain text: the environment's settings are stored unencrypted and shown on every read.
+
 ## What the platform can do
 
 Use the orchestra skill to build an answer for a case the paths do not cover. Never promise one of its "Cannot

package/templates/engineering-team/lib/setup.sh

@@ -45,11 +45,11 @@ chown agent:agent /work || exit 16
 
 # ---- Add the team's system setup here: packages, language runtimes, tools. -----------------------------------
 
-# Optional, off by default: a Node major version other than the image's. To turn it on, remove the leading `# `
-# from the lines from NODE_MAJOR to `esac`, and set NODE_MAJOR. It replaces the image's Node in /usr/local. The
-# image's own npm and corepack go first: unpacking a second Node over them leaves a mix of two npm versions, and
-# every npm command then exits 1. Use this Node's own corepack for pnpm or yarn.
-# NODE_MAJOR=24
+# Optional, off by default: a Node major version other than the image's Node 24. To turn it on, remove the
+# leading `# ` from the lines from NODE_MAJOR to `esac`, and set NODE_MAJOR. It replaces the image's Node in
+# /usr/local. The image's own npm and corepack go first: unpacking a second Node over them leaves a mix of two npm
+# versions, and every npm command then exits 1. Use this Node's own corepack for pnpm or yarn.
+# NODE_MAJOR=22
 # case "$(node --version 2>/dev/null)" in "v$NODE_MAJOR".*) ;; *)
 #   case "$(uname -m)" in aarch64 | arm64) node_arch=arm64 ;; *) node_arch=x64 ;; esac
 #   node_version=$(curl -fsSL --retry 3 https://nodejs.org/dist/index.json |