@orchestraworks/cli 0.5.7 → 0.6.0

package/node_modules/@orchestraworks/client/dist/models/EnvironmentSnapshot.d.ts

@@ -107,7 +107,7 @@ export interface EnvironmentSnapshot {
      */
     setup?: string;
     /**
-     * Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: SFDK_WORKER_RESTART_AFTER_IDLE, SFDK_WORKER_RELEASE_FETCH_TIMEOUT and SFDK_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; SFDK_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and SFDK_WORKER_AUTO_UPGRADE and SFDK_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
+     * Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: ORCHESTRA_WORKER_RESTART_AFTER_IDLE, ORCHESTRA_WORKER_RELEASE_FETCH_TIMEOUT and ORCHESTRA_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; ORCHESTRA_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and ORCHESTRA_WORKER_AUTO_UPGRADE and ORCHESTRA_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. Their former spellings beginning SFDK_WORKER_ are refused. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
      * @type {{ [key: string]: string; }}
      * @memberof EnvironmentSnapshot
      */

package/node_modules/@orchestraworks/client/dist/models/InjectionRecipe.d.ts

@@ -28,6 +28,12 @@ export interface InjectionRecipe {
      * @memberof InjectionRecipe
      */
     removeHeaders: Array<string>;
+    /**
+     * Host patterns this secret is presented on, in egress rule host syntax (exact host, *.suffix, or *); empty or omitted covers no host. A non-empty list needs at least one header, and no pattern may name the platform API host or the object store host.
+     * @type {Array<string>}
+     * @memberof InjectionRecipe
+     */
+    hosts?: Array<string>;
 }
 /**
  * Check if a given object implements the InjectionRecipe interface.

package/node_modules/@orchestraworks/client/dist/models/InjectionRecipe.js

@@ -37,6 +37,7 @@ function InjectionRecipeFromJSONTyped(json, ignoreDiscriminator) {
     return {
         'headers': json['headers'] == null ? undefined : (json['headers'].map(InjectionHeader_1.InjectionHeaderFromJSON)),
         'removeHeaders': json['removeHeaders'],
+        'hosts': json['hosts'] == null ? undefined : json['hosts'],
     };
 }
 function InjectionRecipeToJSON(json) {
@@ -49,5 +50,6 @@ function InjectionRecipeToJSONTyped(value, ignoreDiscriminator = false) {
     return {
         'headers': value['headers'] == null ? undefined : (value['headers'].map(InjectionHeader_1.InjectionHeaderToJSON)),
         'removeHeaders': value['removeHeaders'],
+        'hosts': value['hosts'],
     };
 }

package/node_modules/@orchestraworks/client/dist/models/OAuthTokenRequest.d.ts

@@ -46,7 +46,7 @@ export interface OAuthTokenRequest {
      */
     refreshToken?: string;
     /**
-     * Public client identifier; omit it or send sfdk-public
+     * Public client identifier; omit it or send orchestra-public
      * @type {string}
      * @memberof OAuthTokenRequest
      */

package/node_modules/@orchestraworks/client/dist/models/Secret.d.ts

@@ -80,17 +80,11 @@ export interface Secret {
      */
     expiresAt?: Date;
     /**
-     * Optional injection recipe describing the request mutations the broker applies from this secret
+     * Optional injection recipe: the request mutations the broker applies from this secret, and the hosts it applies them on. A secret without one is stored only: the broker presents it on no request. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {InjectionRecipe}
      * @memberof Secret
      */
     injection?: InjectionRecipe;
-    /**
-     * Host patterns this secret is presented on, in egress rule host syntax (exact host, *.suffix, or *); empty covers no host
-     * @type {Array<string>}
-     * @memberof Secret
-     */
-    hosts: Array<string>;
     /**
      * The agents you can see that may use this secret, as IAM decides at this read. Present on the singular read only; a list row leaves it out.
      * @type {Array<Agent>}

package/node_modules/@orchestraworks/client/dist/models/Secret.js

@@ -40,8 +40,6 @@ function instanceOfSecret(value) {
         return false;
     if (!('updatedAt' in value) || value['updatedAt'] === undefined)
         return false;
-    if (!('hosts' in value) || value['hosts'] === undefined)
-        return false;
     return true;
 }
 function SecretFromJSON(json) {
@@ -63,7 +61,6 @@ function SecretFromJSONTyped(json, ignoreDiscriminator) {
         'updatedAt': (new Date(json['updatedAt'])),
         'expiresAt': json['expiresAt'] == null ? undefined : (new Date(json['expiresAt'])),
         'injection': json['injection'] == null ? undefined : (0, InjectionRecipe_1.InjectionRecipeFromJSON)(json['injection']),
-        'hosts': json['hosts'],
         'usableBy': json['usableBy'] == null ? undefined : (json['usableBy'].map(Agent_1.AgentFromJSON)),
     };
 }
@@ -86,6 +83,5 @@ function SecretToJSONTyped(value, ignoreDiscriminator = false) {
         'updatedAt': value['updatedAt'].toISOString(),
         'expiresAt': value['expiresAt'] == null ? value['expiresAt'] : value['expiresAt'].toISOString(),
         'injection': (0, InjectionRecipe_1.InjectionRecipeToJSON)(value['injection']),
-        'hosts': value['hosts'],
     };
 }

package/node_modules/@orchestraworks/client/dist/models/UpdateEnvironmentRequest.d.ts

@@ -10,6 +10,7 @@
  * Do not edit the class manually.
  */
 import type { EnvironmentIngressPolicy } from './EnvironmentIngressPolicy';
+import type { EnvironmentCredential } from './EnvironmentCredential';
 import type { EnvironmentPlatformRequest } from './EnvironmentPlatformRequest';
 import type { EnvironmentEgressPolicy } from './EnvironmentEgressPolicy';
 import type { EnvironmentProvisionSpecRequest } from './EnvironmentProvisionSpecRequest';
@@ -44,6 +45,12 @@ export interface UpdateEnvironmentRequest {
      * @memberof UpdateEnvironmentRequest
      */
     ingressPolicy?: EnvironmentIngressPolicy | null;
+    /**
+     * The credentials this environment's machines get on a request that names none, in order: the first one covering the request's host is added, whatever the agent. Each entry is a Secret or Connection of this organization by id, and adding one needs the caller's own use of it. A request naming a credential gets that one instead. A provided list replaces the stored one, and absent leaves it.
+     * @type {Array<EnvironmentCredential>}
+     * @memberof UpdateEnvironmentRequest
+     */
+    credentials?: Array<EnvironmentCredential>;
     /**
      * The launch spec — every fact that applies only when the platform controls the machine. Rejected on an enrolled environment, whose machine the platform never launches.
      * @type {EnvironmentProvisionSpecRequest}

package/node_modules/@orchestraworks/client/dist/models/UpdateEnvironmentRequest.js

@@ -19,6 +19,7 @@ exports.UpdateEnvironmentRequestFromJSONTyped = UpdateEnvironmentRequestFromJSON
 exports.UpdateEnvironmentRequestToJSON = UpdateEnvironmentRequestToJSON;
 exports.UpdateEnvironmentRequestToJSONTyped = UpdateEnvironmentRequestToJSONTyped;
 const EnvironmentIngressPolicy_1 = require("./EnvironmentIngressPolicy");
+const EnvironmentCredential_1 = require("./EnvironmentCredential");
 const EnvironmentPlatformRequest_1 = require("./EnvironmentPlatformRequest");
 const EnvironmentEgressPolicy_1 = require("./EnvironmentEgressPolicy");
 const EnvironmentProvisionSpecRequest_1 = require("./EnvironmentProvisionSpecRequest");
@@ -41,6 +42,7 @@ function UpdateEnvironmentRequestFromJSONTyped(json, ignoreDiscriminator) {
         'platform': json['platform'] == null ? undefined : (0, EnvironmentPlatformRequest_1.EnvironmentPlatformRequestFromJSON)(json['platform']),
         'egressPolicy': json['egressPolicy'] == null ? undefined : (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyFromJSON)(json['egressPolicy']),
         'ingressPolicy': json['ingressPolicy'] == null ? undefined : (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyFromJSON)(json['ingressPolicy']),
+        'credentials': json['credentials'] == null ? undefined : (json['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialFromJSON)),
         'provisionSpec': json['provisionSpec'] == null ? undefined : (0, EnvironmentProvisionSpecRequest_1.EnvironmentProvisionSpecRequestFromJSON)(json['provisionSpec']),
         'workingDirectory': json['workingDirectory'] == null ? undefined : json['workingDirectory'],
         'hooks': json['hooks'] == null ? undefined : (0, EnvironmentHooksRequest_1.EnvironmentHooksRequestFromJSON)(json['hooks']),
@@ -59,6 +61,7 @@ function UpdateEnvironmentRequestToJSONTyped(value, ignoreDiscriminator = false)
         'platform': (0, EnvironmentPlatformRequest_1.EnvironmentPlatformRequestToJSON)(value['platform']),
         'egressPolicy': (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyToJSON)(value['egressPolicy']),
         'ingressPolicy': (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyToJSON)(value['ingressPolicy']),
+        'credentials': value['credentials'] == null ? undefined : (value['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialToJSON)),
         'provisionSpec': (0, EnvironmentProvisionSpecRequest_1.EnvironmentProvisionSpecRequestToJSON)(value['provisionSpec']),
         'workingDirectory': value['workingDirectory'],
         'hooks': (0, EnvironmentHooksRequest_1.EnvironmentHooksRequestToJSON)(value['hooks']),

package/node_modules/@orchestraworks/client/dist/models/UpdateSecretRequest.d.ts

@@ -29,7 +29,7 @@ export interface UpdateSecretRequest {
      */
     description?: string;
     /**
-     * Secret value. This is write-only and is never returned by management APIs.
+     * Secret value. This is write-only and is never returned by management APIs. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {string}
      * @memberof UpdateSecretRequest
      */
@@ -41,7 +41,7 @@ export interface UpdateSecretRequest {
      */
     expiresAt?: Date;
     /**
-     * Injection recipe update: absent = unchanged, null = clear the recipe, value = replace it
+     * Injection recipe update: absent = unchanged, null = clear the recipe and its hosts, leaving the secret stored only, value = replace the recipe and its hosts. Optional injection recipe: the request mutations the broker applies from this secret, and the hosts it applies them on. A secret without one is stored only: the broker presents it on no request. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {InjectionRecipe}
      * @memberof UpdateSecretRequest
      */
@@ -55,9 +55,10 @@ export interface UpdateSecretRequest {
         [key: string]: string | null;
     };
     /**
-     * Whole-list replacement of the host patterns this secret is presented on; absent = unchanged, [] covers no host. A non-empty list needs an injection recipe with a header, and no pattern may name the platform API host or the object store host.
+     * Deprecated: write injection.hosts instead. Accepted for one release and moved into the recipe's hosts; a request whose recipe names other hosts is refused. Absent leaves the recipe's hosts unchanged; a list replaces them.
      * @type {Array<string>}
      * @memberof UpdateSecretRequest
+     * @deprecated
      */
     hosts?: Array<string>;
 }

package/node_modules/@orchestraworks/client/dist/models/index.d.ts

@@ -120,6 +120,7 @@ export * from './EmbeddedResourceResource';
 export * from './EntitlementPeriodUsage';
 export * from './EntitlementTeamUsage';
 export * from './Environment';
+export * from './EnvironmentCredential';
 export * from './EnvironmentDisk';
 export * from './EnvironmentDiskMount';
 export * from './EnvironmentEgressPolicy';

package/node_modules/@orchestraworks/client/dist/models/index.js

@@ -138,6 +138,7 @@ __exportStar(require("./EmbeddedResourceResource"), exports);
 __exportStar(require("./EntitlementPeriodUsage"), exports);
 __exportStar(require("./EntitlementTeamUsage"), exports);
 __exportStar(require("./Environment"), exports);
+__exportStar(require("./EnvironmentCredential"), exports);
 __exportStar(require("./EnvironmentDisk"), exports);
 __exportStar(require("./EnvironmentDiskMount"), exports);
 __exportStar(require("./EnvironmentEgressPolicy"), exports);

package/node_modules/@orchestraworks/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestraworks/client",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "description": "Orchestra public API TypeScript client",
   "author": "Living Computers",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestraworks/cli",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "type": "module",
   "description": "The Orchestra command line.",
   "license": "Apache-2.0",
@@ -109,13 +109,13 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.3.0",
-    "@orchestraworks/client": "0.5.7",
-    "@orchestraworks/worker": "0.0.140",
+    "@orchestraworks/client": "0.6.0",
+    "@orchestraworks/worker": "0.0.142",
     "commander": "^14.0.0",
     "liquidjs": "^10.28.0"
   },
   "optionalDependencies": {
-    "@orchestraworks/local": "0.0.140"
+    "@orchestraworks/local": "0.0.142"
   },
   "bundleDependencies": [
     "@orchestraworks/client"

package/skills/orchestra/SKILL.md

@@ -265,8 +265,8 @@ unless you set one, so it wins over the open default and over the usual allow ru
 **Live effect.** The edge reads the environment's rules on each request. So an apply that changes the rules
 reaches every machine at once, machines already running included, from their next request.
 
-**How it relates.** On a request a rule allows, the edge adds the secret or connection whose `hosts` cover the
-host, and only on `https` (section 6). Calls to the Orchestra platform itself skip these rules: the agent's
+**How it relates.** On a request a rule allows, the edge adds a secret or connection whose `hosts` cover the
+host, only on `https`, and only when the request names it or an environment default covers it (section 6). Calls to the Orchestra platform itself skip these rules: the agent's
 role decides them (section 1). So a machine blocked from the code host still downloads a file through
 `orchestra files get-content`. The worker points each harness's tools at the edge through proxy variables, so
 a service the agent runs in a container needs its name in `NO_PROXY` in the environment's settings.
@@ -291,10 +291,19 @@ resolved at the edge on an allow); AGENTS.md "Egress And Credentials". Kit: cli/
 **What it's for.** It lets agents use a key without seeing it. No agent, no person and no apply output ever shows
 the value.
 
-**What it is.** A *secret* is a stored value that can be written and never read back. It declares its `hosts`
-and an `injection` recipe, the headers it sets, and the network edge adds it to each allowed `https` request
-to one of those hosts. This is *credential injection at the network edge*. When two credentials cover one
-host, the request names one with a reference, `orchestra:secret/<id>`, in place of its key.
+**What it is.** A *secret* is a stored value that can be written and never read back. It declares an
+`injection` recipe, the headers it sets and the `hosts` it sets them on, and the network edge adds it to an
+allowed `https` request to one of those hosts. A secret with no recipe is stored only, and the edge never adds it. This is *credential injection at the network edge*. The edge adds it only in two cases:
+
+- The request names it with a reference, `orchestra:secret/<id>` or `orchestra:connection/<id>`, in place
+  of its key. A `Secret` or `Connection` set as an environment `env` value is written as that reference:
+  `ANTHROPIC_API_KEY` for claude, `GH_TOKEN` for `gh`, `GITLAB_TOKEN` for `glab`, `ORCHESTRA_GIT_CREDENTIAL`
+  for git. `routeModelsViaGateway({ key })` names the gateway key this way for claude and codex. The
+  `linear`, `slack` and `teams` commands take `--connection-id <id>`.
+- The environment's `credentials` list covers the host, for a request that names nothing. The first
+  covering entry serves; with `replace: false`, a request carrying its own value keeps it.
+
+A request that names nothing and that no default covers leaves as it was sent.
 
 **How it relates.** A secret is added only where a network rule lets the request leave (section 5). Never put
 a key in an environment's settings or in instructions: the machine's processes read every setting.
@@ -325,8 +334,9 @@ network rules carry the option (sections 2 and 5).
 **A Claude or Codex subscription.**
 
 - *Claude.* `claude setup-token` prints a long-lived token. It is stored as a secret, and the network edge
-  adds it to each call to `api.anthropic.com`. The machine holds only a placeholder token and an empty API
-  key, so no agent and no person sees the real one. Never put the token in an environment's settings: they
+  adds it to each call to `api.anthropic.com` that names it. The environment's `env` names the secret in
+  `CLAUDE_CODE_OAUTH_TOKEN` by reference, `orchestra:secret/<id>`, beside an empty API key, so no agent
+  and no person sees the real one. Never put the token in an environment's settings: they
   are plain text.
 - *Codex.* A personal access token, made by a ChatGPT Business or Enterprise member, or a separate ChatGPT
   sign-in kept on a `/home` volume that every machine using it shares. A Codex sign-in stays off the model
@@ -337,7 +347,8 @@ network rules carry the option (sections 2 and 5).
 
 **An Orchestra account, through the model gateway.** The model gateway is a hosted service at
 `models.orchestraworks.ai`. One endpoint reaches OpenAI, Anthropic and open models. A *gateway key* is a key
-to it, stored as a secret. The network edge adds it to each model call, so no agent and no person sees it.
+to it, stored as a secret. `routeModelsViaGateway({ key })` names it to each harness, and the network edge
+adds it to each model call, so no agent and no person sees it.
 Without it, an agent's first message fails with "Invalid API key".
 
 - *Routing.* `orchestra model-configs` sets which providers serve a model, and in which order, so a call
@@ -348,10 +359,11 @@ Without it, an agent's first message fails with "Invalid API key".
 - *A cap.* Each gateway key can carry a monthly cap, set in the console at **Settings › Gateway keys**.
 
 **Their own provider API key.** The team's Anthropic or OpenAI API key is a secret that the network edge adds
-to calls straight to the provider, with no gateway in between.
+to calls straight to the provider, with no gateway in between. The environment names it in `ANTHROPIC_API_KEY`
+or `ORCHESTRA_WORKER_OPENAI_API_KEY`, or lists it in `credentials`.
 
 **How it relates.** Each option reaches the model through an ordinary allow rule on the model's host, and a
-secret whose `hosts` name that host (sections 5 and 6). An agent on the model gateway turns it on in its model settings (section 2). An agent on a
+secret whose recipe's `hosts` name that host (sections 5 and 6). An agent on the model gateway turns it on in its model settings (section 2). An agent on a
 subscription or its own key turns it off. For plan questions, send the person to **Settings › Plan & usage**
 in the console.
 
@@ -549,7 +561,8 @@ names its team, and a row with none sits in Shared.
 
 <!-- Sources, on the kit's own branch: cli/src/cli/main.ts:60-160 (two jobs; nouns match API paths; standard
 verbs; --output json; --body @file.json; approval defaults; orchestra api), cli/src/cli/core/auth.ts:1-45
-(ORCHESTRA_API_TOKEN, then the login profile, then the machine's edge; ORCHESTRA_BASE_URL),
+(ORCHESTRA_API_TOKEN, then the file ORCHESTRA_API_TOKEN_FILE names, then the login profile, then the machine's
+edge; ORCHESTRA_BASE_URL),
 cli/src/cli/core/profile.ts:39-52 (profiles in ~/.config/orchestra/config.json), cli/src/generated/cli-commands.json
 (each command's answer), cli/src/cli/core/output.ts:94-113 and :143-145 (json prints the answer as it is),
 cli/src/cli/core/errors.ts:287-296 and :366-370 (the json error, on stderr), cli/src/cli/core/login.ts:361-363 (a
@@ -581,8 +594,12 @@ each part at length. What follows is only what a reader needs to run a command s
   `~/.config/orchestra/config.json`. It selects the person's organization when they have one; with several,
   name it: `orchestra auth login --org <organization>`. The browser sign-in renews itself. A token typed at the
   `--no-browser` prompt cannot renew itself, so it suits a short run only.
-- **Scripts.** `ORCHESTRA_API_TOKEN` and `ORCHESTRA_BASE_URL` in the shell are used before the profile. On an
-  Orchestra machine, the network edge signs the agent's calls, so it needs no token.
+- **Scripts.** `ORCHESTRA_API_TOKEN` and `ORCHESTRA_BASE_URL` in the shell are used before the profile.
+- **On an Orchestra machine.** The worker writes the agent's own token to a file, renews it, and names the
+  file in `ORCHESTRA_API_TOKEN_FILE`. `orchestra` reads that file before each request, so the agent needs no
+  sign-in. Where a network edge stands in front of the machine, the edge replaces that token with one for the
+  same agent. A 401 here is not fixed by `orchestra auth login`: the token expired before the worker renewed
+  it, or the agent is no longer placed on the machine.
 - **Fallback.** `orchestra api <METHOD> </path>` makes a raw call when a typed command is missing.
 
 A first look at an organization, in the order a new reader runs it:
@@ -642,7 +659,7 @@ local/launch/modelkey.go (model key carriers per harness, the gateway address va
 worker/facts/families.json (how each harness takes the gateway address); on develop at f62fad1481,
 agents/runtime/assembly/common/placeholder-env (the images' placeholder ANTHROPIC_API_KEY),
 LauncherProperties.kt (the gallery images at Versions/latest), launcher/config/config.go (Dsv5 default);
-worker/facts/families.json (the ORCHESTRA_WORKER_ names), worker/service/manager_windows.go (SfdkWorker),
+worker/facts/families.json (the ORCHESTRA_WORKER_ names), worker/service/service.go (OrchestraWorker, and the previous SfdkWorker),
 infra/packer/azure-windows-runtime.pkr.hcl (the startup task), launcher/cloud/cloud.go (the VM tags);
 the proven list is the test run of 2026-10-05. -->
 
@@ -672,8 +689,8 @@ the proven list is the test run of 2026-10-05. -->
     1. The environment's `env` (`provisionSpec.env`). A declared value replaces our image's placeholder,
        never a real value. The platform stores `env` values in plain text, an environment read returns
        them, and the machine's startup data carries them.
-    2. Baked into the team's image at machine scope: on Windows the `SfdkWorker` service's `Environment`
-       registry value, on Linux a drop-in on `sfdk-worker.service`.
+    2. Baked into the team's image at machine scope: on Windows the `OrchestraWorker` service's
+       `Environment` registry value, on Linux a drop-in on `orchestra-worker.service`.
     3. The `onStartAgent` hook writes the harness's own key file: `.claude/.credentials.json` for a Claude
        sign-in, `.codex/auth.json` for `codex`, `.pi/agent/auth.json` for `pi`. A raw Claude API key has
        no file.
@@ -681,6 +698,10 @@ the proven list is the test run of 2026-10-05. -->
     `ORCHESTRA_WORKER_CLAUDE_OAUTH_TOKEN` for a Claude subscription token; `ORCHESTRA_WORKER_OPENAI_API_KEY`
     or `ORCHESTRA_WORKER_CODEX_PERSONAL_ACCESS_TOKEN` for `codex`. With a gateway key, keep the agent's
     model gateway on. The platform sets the gateway address.
+  - An install replaces the service an earlier release registered as `SfdkWorker` on Windows,
+    `sfdk-worker.service` on Linux or `ai.livingcomputers.sfdk.worker` on macOS. The new ones are
+    `OrchestraWorker`, `orchestra-worker.service` and `ai.livingcomputers.orchestra.worker`. Change your own
+    scripts that name the old ones.
   - Never restart the worker service to load a key. A restart after the worker registered stops the
     machine's work, and the platform parks the VM.
   - The details: the orchestra-fdk skill's `references/environment.md`, "Tokens on a compute provider's

package/skills/orchestra-fdk/references/authoring.md

@@ -68,8 +68,10 @@ const factory = new Factory({ name: "acme-support" });
 new Secret(factory, "openai-api-key", {
   name: "OpenAI API key",
   value: SecretValue.fromEnv("OPENAI_API_KEY_VALUE"), // read from env at apply — never in the plan
-  hosts: ["api.openai.com"], // where the edge presents it
-  injection: { headers: [{ name: "Authorization", value: "Bearer ${secret}" }] }, // how
+  injection: {
+    headers: [{ name: "Authorization", value: "Bearer ${secret}" }], // how the edge presents it
+    hosts: ["api.openai.com"], // where
+  },
 });
 
 const runtime = new Environment(factory, "runtime", {
@@ -554,26 +556,29 @@ token the platform mints. The **Claude sign-in recipe** is the one to copy when
 on a person's Claude subscription token rather than an API key:
 
 ```ts
-new Secret(factory, "claude-sign-in", {
+const claudeSignIn = new Secret(factory, "claude-sign-in", {
   value: SecretValue.fromEnv("ORCHESTRA_FDK_CLAUDE_CODE_OAUTH_TOKEN"),
-  hosts: ["api.anthropic.com"],
   injection: {
     headers: [{ name: "authorization", value: "Bearer ${secret}" }],
     removeHeaders: ["x-api-key"], // stripped before injection
+    hosts: ["api.anthropic.com"],
   },
 });
 
 // …in the Environment's props:
-env: { CLAUDE_CODE_OAUTH_TOKEN: "software-factory-egress-placeholder", ANTHROPIC_API_KEY: "" },
+env: { CLAUDE_CODE_OAUTH_TOKEN: claudeSignIn, ANTHROPIC_API_KEY: "" },
 egress: EgressPolicy.allowAll()
   .allow("claude-sign-in", { hosts: ["api.anthropic.com"], priority: 300 }),
 ```
 
 It injects `authorization` and nothing else. **Never inject an `anthropic-beta` header**: an injected
-one replaces the harness's own list of beta flags, and every call then answers 400. The placeholder
-`CLAUDE_CODE_OAUTH_TOKEN` makes the harness sign in the subscription way and send its own list, and the
-edge swaps the real token in. The empty `ANTHROPIC_API_KEY` covers the runtime image's placeholder key,
-which the harness would otherwise send instead.
+one replaces the harness's own list of beta flags, and every call then answers 400. A Secret as an `env`
+value is written as its reference, `orchestra:secret/<id>`, with the id resolved at apply. In
+`CLAUDE_CODE_OAUTH_TOKEN` it makes the harness sign in the subscription way and send its own list, and the
+edge reads the reference where the token goes and swaps the real token in. The edge adds a credential only
+to a request that names one, or that an environment default covers (`references/environment.md`, "Naming a
+credential"). The empty `ANTHROPIC_API_KEY` covers the runtime image's placeholder key, which the harness
+would otherwise send instead.
 
 - Sources: `SecretValue.fromEnv(NAME)`, `SecretValue.fromCommandLine(label?)` and
   `SecretValue.fromGatewayKey(key)`, plus the derived recipes `basicAuth`, `registryCredential` and
@@ -613,7 +618,7 @@ which the harness would otherwise send instead.
   `GatewayKey` you declare in the same factory — `new GatewayKey(factory, "model-gateway-key", props)`,
   whose only props are `slug`, `displayName`, `monthlyCreditCap` and `labels` — so apply mints the
   key and writes the token it shows *exactly once* straight into this Secret, which the edge then
-  adds on its `hosts` like any other. It is legal only as the whole top-level value of exactly one Secret:
+  adds on its recipe's `hosts` like any other. It is legal only as the whole top-level value of exactly one Secret:
   nesting it inside another recipe, or a key with zero or two Secrets, is a synth error, and there
   is no importer because an existing key's token is unrecoverable. Rotation is new-slug-only.
 - A **`ModelProviderKey`** is the other credential you can declare: your organization's own key for
@@ -648,11 +653,12 @@ which the harness would otherwise send instead.
   suppresses it and none can supply it either, so a headless apply of a `fromCommandLine`
   declaration refuses at *every* level and tells you to run from a terminal or change the source —
   it never recommends a policy lever that could not clear it.
-- Presenting a secret on the network: the `Secret` itself declares `hosts` (where: an exact host,
-  `*.suffix`, or `*`) and an `injection` recipe (how: the headers it sets, reading `${secret}`, or
-  `${secret.<field>}` for a `SecretValue.fields` value). Egress rules carry no credential, so a rule
-  that passes `credential` or `credentials` is a synth error; a Secret with no `hosts` is presented
-  nowhere.
+- Presenting a secret on the network: the `Secret` itself declares an `injection` recipe — how: the
+  headers it sets, reading `${secret}`, or `${secret.<field>}` for a `SecretValue.fields` value; and
+  where: its `hosts`, each an exact host, `*.suffix`, or `*`. Egress rules carry no credential, so a rule
+  that passes `credential` or `credentials` is a synth error. A Secret with no `injection` is stored
+  only, and one whose recipe has no `hosts` is presented nowhere. The top-level `hosts` prop is
+  deprecated: it is moved into the recipe for one release.
 
 ## How the agents reach a model
 
@@ -668,9 +674,9 @@ on their own computer; run from your shell, its browser step hangs. Never read o
   At apply, the shell exports it from that file into the variable the Secret reads. Declare the Claude
   sign-in recipe (§ Secrets are recipes, never values): a `Secret`, an egress rule that allows
   `api.anthropic.com` and sets `Authorization: Bearer ${secret}` with `x-api-key` removed, and, in the
-  environment's `env`, `CLAUDE_CODE_OAUTH_TOKEN: "software-factory-egress-placeholder"` and an empty
-  `ANTHROPIC_API_KEY`. Turn `enableModelGateway` off for the agent. The machine holds only the
-  placeholder; the edge adds the token. Copying the renewing credentials file instead is the fallback,
+  environment's `env`, `CLAUDE_CODE_OAUTH_TOKEN` set to that Secret and an empty `ANTHROPIC_API_KEY`.
+  Turn `enableModelGateway` off for the agent. The machine holds only the Secret's reference; the edge
+  adds the token. Copying the renewing credentials file instead is the fallback,
   and follows the ChatGPT sign-in steps below.
 - **Codex: a personal access token, where the workspace allows one.** A ChatGPT Business or Enterprise
   member creates it at chatgpt.com/admin/access-tokens, once the workspace owner allows access tokens,
@@ -762,7 +768,7 @@ An environment's `egress` is a policy you build up from one of **two starting po
 - **`EgressPolicy.allowAll()`** allows every host no rule refuses.
 
 Rules fold onto either one the same way: a rule only opens or closes the network, a credential still goes
-only to the hosts its own `hosts` cover, and a deny still refuses.
+only to the hosts its own recipe's `hosts` cover, and a deny still refuses.
 
 Most of what an agent needs to reach arrives ready-made as a **bundle** — a list of rules folded onto
 the policy by one `applyPreset(...)` call — so **reach for the bundles first** and hand-write allow/deny
@@ -1079,7 +1085,7 @@ orchestra gateway-keys create --slug ci-smoke --output-file key.json
   export, a CI secret) suppresses the only prompt you would have seen, the command says so in one
   line on **stderr**, naming the lever — stdout stays the response document.
 - **Writing to a factory-managed resource warns.** `apply` stamps what it manages with an
-  `sfdk.managedBy` labels key naming the owning factory, and a write to a stamped resource says so:
+  `orchestra.managedBy` labels key naming the owning factory, and a write to a stamped resource says so:
   the next `apply` reverts it. It is a warning, not a refusal — the fallback has to stay usable in an
   emergency — and it is the CLI telling you this belongs in `main.ts`.
 
@@ -1106,17 +1112,19 @@ itself a credential.
 An agent running inside a machine types the **same commands** as an operator at a workstation. There
 is no separate agent CLI, no agent-only spelling, and nothing for you to author differently:
 
-- **The agent holds no token.** Its machine is declared as edge-injected, so the CLI sends the request
-  *bare* to the platform's public HTTPS name (`PLATFORM_BASE_URL`), and the egress edge stamps the
-  authorization onto it on the way out. Credential material never enters the machine. Setting
-  `ORCHESTRA_API_TOKEN` deliberately still wins — the edge leaves an `Authorization` header the client
-  supplied alone.
+- **The agent sets no token.** The worker writes the agent's own short-lived platform token to a file,
+  renews it before it expires, and sets `ORCHESTRA_API_TOKEN_FILE` to that file's path on each agent
+  process. The CLI reads the file before each request and sends its token to the platform's public HTTPS
+  name (`PLATFORM_BASE_URL`), with no organization header, because the token names its organization.
+  The token works only while the agent is placed on that machine. A token set in `ORCHESTRA_API_TOKEN`
+  comes before the file. On a machine behind the platform's network edge, the edge replaces the
+  `Authorization` header of each call with a token for the same agent, whatever token the call carried.
 - **IAM is the only difference between principals.** The same command run by an agent and by a human
   differs only in what their grants allow; a refusal is a permission error naming the action, never
   an instruction to log in (there is nothing in a machine to log into).
 - **The factory loop works there too.** `synth`, `diff` and `apply` (and `grant`) are ordinary
   platform callers, so an agent can preview and apply a factory from inside its machine with no token
-  and no organization set — the same bare send, judged by the same IAM.
+  and no organization set — the same token file, judged by the same IAM.
 - **Triggers are runtime wiring: agents observe it, they do not author it.** Declare them in code
   (`new Trigger(factory, …)`) or have an explicitly granted principal create them. The managed
   worker role deliberately carries **no** trigger-authoring capability, so `triggers create`