@pipod/cli 0.1.5 → 0.1.6

package/dist/cli.js

@@ -18533,6 +18533,11 @@ async function showCmd(client, args) {
     info("bake script:");
     out(t.bakeScript);
   }
+  if (t.agentInstructions) {
+    out("");
+    info("agent instructions:");
+    out(t.agentInstructions);
+  }
   if (t.piSettings && Object.keys(t.piSettings).length > 0) {
     info(`Pi settings ${describePiSettings(flatPiSettings(t.piSettings))}`);
   }
@@ -18611,6 +18616,12 @@ function parseOpts(args) {
         opts.bakeScript = fs30.readFileSync(file, "utf8");
         break;
       }
+      case "--agent-instructions": {
+        const file = next();
+        if (!fs30.existsSync(file)) throw new PiPodError(`no such agent instructions file: ${file}`);
+        opts.agentInstructions = fs30.readFileSync(file, "utf8");
+        break;
+      }
       default:
         rest.push(arg);
     }
@@ -18664,6 +18675,7 @@ async function createCmd(client, args, flags) {
     ...opts.description ? { description: opts.description } : {},
     ...initScript ? { initScript } : {},
     ...bakeScript ? { bakeScript } : {},
+    ...opts.agentInstructions ? { agentInstructions: opts.agentInstructions } : {},
     // An explicit refresh is replacement, not merge: an empty project file set clears stale custody.
     ...opts.fromHere ? { piSettings: piSettings ?? {} } : {}
   });
@@ -18770,9 +18782,9 @@ async function editCmd(client, args) {
     });
   }
   const t = await findTemplate(client, rest[0]);
-  if (opts.name === void 0 && opts.description === void 0 && !opts.config && opts.initScript === void 0 && opts.bakeScript === void 0) {
+  if (opts.name === void 0 && opts.description === void 0 && !opts.config && opts.initScript === void 0 && opts.bakeScript === void 0 && opts.agentInstructions === void 0) {
     throw new PiPodError("nothing to change", {
-      hint: "pass --name, --description, --config <file>, --init-script <file> or --bake-script <file>"
+      hint: "pass --name, --description, --config <file>, --init-script <file>, --bake-script <file> or --agent-instructions <file>"
     });
   }
   const updated = await client.updateTemplate(t.id, {
@@ -18783,7 +18795,8 @@ async function editCmd(client, args) {
     ...opts.description !== void 0 ? { description: opts.description } : {},
     ...opts.config ? { config: opts.config } : {},
     ...opts.initScript !== void 0 ? { initScript: opts.initScript } : {},
-    ...opts.bakeScript !== void 0 ? { bakeScript: opts.bakeScript } : {}
+    ...opts.bakeScript !== void 0 ? { bakeScript: opts.bakeScript } : {},
+    ...opts.agentInstructions !== void 0 ? { agentInstructions: opts.agentInstructions } : {}
   });
   info(`updated template ${updated.name}`);
   await hintMissingCredentials(client);
@@ -19826,15 +19839,23 @@ are never stored on the server.
   templates: `Usage: pipod templates [action]
 
 Manage pod templates on the pi pod server. A template stores config, init and
-bake scripts, Pi settings files, and named secrets. Templates are personal by
-default: only their owner sees and launches them. --org at creation or
-\`templates share\` makes one org-wide.
+bake scripts, Pi settings files, named secrets, and agent instructions.
+Templates are personal by default: only their owner sees and launches them.
+--org at creation or \`templates share\` makes one org-wide.
+
+Agent instructions are added to the agent's system prompt in every pod launched
+from the template, with the hosts and secrets the pod actually has: say what
+access the template is meant to have. They guide the agent and enforce nothing;
+the template's secrets and egress decide what a pod can reach. A pod's child
+pods and the jobs it schedules launch from the pod's own template.
 
 Actions:
   list             List templates with scope and key counts (default)
-  show <name|id>   Show config, scripts, Pi settings, and secret names
+  show <name|id>   Show config, scripts, agent instructions, Pi settings, and
+                   secret names
   create <name>    Create a template
-  edit <name|id>   Update a template's name, description, config, or scripts
+  edit <name|id>   Update a template's name, description, config, scripts, or
+                   agent instructions
   share <name|id>  Make a personal template org-wide (cannot be undone)
   rm <name|id>     Delete a template (alias: delete)
 
@@ -19846,6 +19867,9 @@ create/edit options:
                         scripts, and sanitized Pi files (contradicts --config)
   --init-script <file>  Store this init script
   --bake-script <file>  Store this bake script
+  --agent-instructions <file>
+                        Store this file as the agent instructions (an empty
+                        file removes them); \`pipod push\` leaves them alone
   --org                 create only: make the template org-wide from the start
   --with-secrets        With --from-here: also upload project env values as
                         template secrets