@skrr-ai/cli 0.1.60 → 0.1.62

package/dist/commands/agents/import.js

@@ -0,0 +1,233 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const agent_spec_1 = require("../../lib/agent-spec");
+/**
+ * Bring a Claude Code asset in: a subagent (`.claude/agents/<name>.md`) or a
+ * skill (`SKILL.md`, or the directory holding one).
+ *
+ * A subagent becomes an agent spec document — printed or written with
+ * `--output`, or pushed onto an existing agent with `--agent` (the same push
+ * as `agents push`). A skill becomes a skill in your library, attached to
+ * `--agent` when given.
+ *
+ * Either way, `hooks` and MCP server commands are NEVER carried: they run on
+ * the machine that loads the file, and a portable spec is read on machines
+ * that are not yours. What was left out is printed, one line per key, so the
+ * import says what it did not do.
+ */
+class AgentsImport extends base_command_1.BaseCommand {
+    static description = 'Import a Claude Code subagent (.claude/agents/*.md) or SKILL.md; hooks and MCP commands are never imported';
+    static examples = [
+        '<%= config.bin %> agents import .claude/agents/reviewer.md --output reviewer.agent.json',
+        '<%= config.bin %> agents import .claude/agents/reviewer.md --agent <agent-id>',
+        '<%= config.bin %> agents import .claude/skills/release-notes --agent <agent-id>',
+        '<%= config.bin %> agents import .claude/skills/release-notes/SKILL.md',
+        'cat reviewer.md | <%= config.bin %> agents import - --output reviewer.agent.json',
+    ];
+    static args = {
+        path: core_1.Args.string({
+            description: 'A .claude/agents/*.md file, a SKILL.md, a directory containing SKILL.md, or "-" to read a subagent file from stdin',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        agent: core_1.Flags.string({
+            description: 'Subagent: push the converted spec onto this agent. Skill: attach the new skill to it.',
+        }),
+        output: core_1.Flags.string({
+            char: 'o',
+            description: 'Subagent only: write the converted spec document here (omit for stdout)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AgentsImport);
+        // stdin has no file name to route on, so it is read as a subagent file;
+        // a SKILL.md is imported by path, where its directory names it.
+        const fromStdin = args.path === '-';
+        let sourcePath = args.path;
+        if (!fromStdin) {
+            try {
+                if ((await (0, promises_1.stat)(sourcePath)).isDirectory()) {
+                    sourcePath = node_path_1.default.join(sourcePath, 'SKILL.md');
+                }
+            }
+            catch (err) {
+                this.failWithCliError({
+                    message: `Could not read ${args.path}: ${err.message}`,
+                    code: 'IMPORT_SOURCE_UNREADABLE',
+                    exit: 1,
+                    retryable: false,
+                    details: { path: args.path },
+                });
+            }
+        }
+        let text;
+        try {
+            text = await (0, agent_spec_1.readSpecSource)(sourcePath);
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: `Could not read ${sourcePath}: ${err.message}`,
+                code: 'IMPORT_SOURCE_UNREADABLE',
+                exit: 1,
+                retryable: false,
+                details: { path: sourcePath },
+            });
+        }
+        if (fromStdin) {
+            await this.importAgent(text, 'stdin', flags);
+            return;
+        }
+        if ((0, data_provider_1.claudeCodeImportKind)(sourcePath) === 'skill') {
+            await this.importSkill(text, sourcePath, flags);
+            return;
+        }
+        await this.importAgent(text, sourcePath, flags, sourcePath);
+    }
+    convert(fn) {
+        try {
+            return fn();
+        }
+        catch (err) {
+            if (err instanceof data_provider_1.ClaudeCodeImportError) {
+                this.failWithCliError({ message: err.message, code: err.code, exit: 1, retryable: false });
+            }
+            throw err;
+        }
+    }
+    printDropped(dropped) {
+        for (const drop of dropped) {
+            this.log(`Not imported: ${drop.key} — ${data_provider_1.CLAUDE_CODE_IMPORT_DROP_REASONS[drop.reason]}`);
+        }
+    }
+    /**
+     * @param sourceLabel - how messages name the source
+     * @param filePath - the file, when there is one; its name is the fallback
+     *   agent name. stdin has none, so its frontmatter must carry `name`.
+     */
+    async importAgent(text, sourceLabel, flags, filePath) {
+        const { document, dropped } = this.convert(() => (0, data_provider_1.agentSpecFromClaudeCodeAgent)(text, { sourcePath: filePath }));
+        // The importer builds only portable fields; checking its output with the
+        // same validator as push keeps that a property rather than a promise.
+        const validation = (0, data_provider_1.validateAgentSpecDocument)(document);
+        if (!validation.ok) {
+            this.failWithCliError({
+                message: (0, agent_spec_1.issueBlock)(`${sourceLabel} did not convert to a valid agent spec:`, validation.issues),
+                code: 'IMPORT_PRODUCED_INVALID_SPEC',
+                exit: 1,
+                retryable: false,
+                details: { issues: validation.issues },
+            });
+        }
+        if (!flags.agent) {
+            const content = (0, agent_spec_1.serializeAgentSpecDocument)(document);
+            if (!flags.output || flags.output === '-') {
+                process.stdout.write(content);
+            }
+            else {
+                try {
+                    await (0, promises_1.writeFile)(flags.output, content, 'utf8');
+                }
+                catch (err) {
+                    this.failWithCliError({
+                        message: `Could not write ${flags.output}: ${err.message}`,
+                        code: 'AGENT_SPEC_WRITE_FAILED',
+                        exit: 1,
+                        retryable: true,
+                        details: { path: flags.output },
+                    });
+                }
+                if (flags.json) {
+                    this.log(JSON.stringify({ output: flags.output, document, dropped }, null, 2));
+                    return;
+                }
+                this.log(`Wrote ${Object.keys(document.spec).length} field(s) to ${flags.output}.`);
+            }
+            // stdout carries the document, so the report goes to stderr.
+            for (const drop of dropped) {
+                process.stderr.write(`Not imported: ${drop.key} — ${data_provider_1.CLAUDE_CODE_IMPORT_DROP_REASONS[drop.reason]}\n`);
+            }
+            return;
+        }
+        this.requireAuth();
+        let result;
+        try {
+            result = await data_provider_1.dataService.pushAgentSpec(flags.agent, document);
+        }
+        catch (err) {
+            const refusal = (0, agent_spec_1.refusalIssues)(err);
+            if (refusal) {
+                this.failWithCliError({
+                    message: (0, agent_spec_1.issueBlock)(`The server refused the import into agent ${flags.agent}. Nothing was changed.`, refusal.issues),
+                    code: refusal.code ?? 'AGENT_SPEC_REFUSED',
+                    exit: 1,
+                    retryable: false,
+                    details: { issues: refusal.issues },
+                });
+            }
+            this.handleApiError(err, { subject: `agent ${flags.agent}` });
+        }
+        if (flags.json) {
+            this.log(this.agentJson(flags.agent, { ...result, dropped }));
+            return;
+        }
+        this.log(result.applied.length > 0
+            ? `Imported ${sourceLabel} into agent ${flags.agent}: ${result.applied.join(', ')}.`
+            : `Agent ${flags.agent} already matches ${sourceLabel}; nothing to change.`);
+        this.printDropped(dropped);
+        this.printAgentUrl(flags.agent);
+    }
+    async importSkill(text, sourcePath, flags) {
+        if (flags.output) {
+            this.failWithCliError({
+                message: '--output applies to a subagent file; a SKILL.md is imported as a skill.',
+                code: 'IMPORT_FLAG_NOT_APPLICABLE',
+                exit: 2,
+                retryable: false,
+            });
+        }
+        const { skill, dropped } = this.convert(() => (0, data_provider_1.skillFromSkillMarkdown)(text, { sourcePath }));
+        this.requireAuth();
+        let created;
+        try {
+            created = await data_provider_1.dataService.createSkill({
+                agentId: flags.agent ?? null,
+                name: skill.name,
+                description: skill.description,
+                content: skill.content,
+                frontmatter: skill.frontmatter,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err, { subject: `skill ${skill.name}` });
+        }
+        const skillId = created.id;
+        if (flags.agent && skillId) {
+            try {
+                await data_provider_1.dataService.addAgentSkill({ agentId: flags.agent, skillId });
+            }
+            catch (err) {
+                this.handleApiError(err, { subject: `agent ${flags.agent}` });
+            }
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ skill: created, attachedTo: flags.agent ?? null, dropped }, null, 2));
+            return;
+        }
+        this.log(flags.agent
+            ? `Imported skill ${skill.name} (${skillId ?? 'no id returned'}) and attached it to agent ${flags.agent}.`
+            : `Imported skill ${skill.name} (${skillId ?? 'no id returned'}) into your library.`);
+        this.printDropped(dropped);
+    }
+}
+exports.default = AgentsImport;

package/dist/commands/agents/pull.d.ts

@@ -0,0 +1,27 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Write an agent out as an agent-as-code document.
+ *
+ * What comes back is always the AUDIENCE document — the fields another person
+ * would receive — never the owner's full row, because a git repository is an
+ * audience: it is cloned, forked and pasted into issues by people who could
+ * not open the agent. Where the agent runs, who owns it, what it has learned
+ * and every credential stay behind; a reference whose target holds a
+ * credential (OpenAPI actions) is WITHHELD and named in `withheld`, so an
+ * empty list and "not exported" never look alike.
+ *
+ * Unlike `tones export`, this overwrites `--output`: pull refreshes a tracked
+ * file, and the point is that `git diff` then shows what changed.
+ */
+export default class AgentsPull extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/pull.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const agent_spec_1 = require("../../lib/agent-spec");
+/**
+ * Write an agent out as an agent-as-code document.
+ *
+ * What comes back is always the AUDIENCE document — the fields another person
+ * would receive — never the owner's full row, because a git repository is an
+ * audience: it is cloned, forked and pasted into issues by people who could
+ * not open the agent. Where the agent runs, who owns it, what it has learned
+ * and every credential stay behind; a reference whose target holds a
+ * credential (OpenAPI actions) is WITHHELD and named in `withheld`, so an
+ * empty list and "not exported" never look alike.
+ *
+ * Unlike `tones export`, this overwrites `--output`: pull refreshes a tracked
+ * file, and the point is that `git diff` then shows what changed.
+ */
+class AgentsPull extends base_command_1.BaseCommand {
+    static description = 'Write an agent as a portable spec document (agent-as-code); round-trips with `agents push`';
+    static examples = [
+        '<%= config.bin %> agents pull <agent-id> --output agents/research.agent.json',
+        '<%= config.bin %> agents pull <agent-id> | jq .spec.instructions',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        output: core_1.Flags.string({
+            char: 'o',
+            description: 'Write the document to this path (overwrites it). Omit for stdout.',
+        }),
+        json: core_1.Flags.boolean({ description: 'With --output, print a JSON receipt instead of a line' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsPull);
+        let document;
+        try {
+            document = await data_provider_1.dataService.getAgentSpec(args.id);
+        }
+        catch (err) {
+            this.handleApiError(err, { subject: `agent ${args.id}` });
+        }
+        const content = (0, agent_spec_1.serializeAgentSpecDocument)(document);
+        if (!flags.output || flags.output === '-') {
+            process.stdout.write(content);
+            return;
+        }
+        try {
+            await (0, promises_1.writeFile)(flags.output, content, 'utf8');
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: `Could not write ${flags.output}: ${err.message}`,
+                code: 'AGENT_SPEC_WRITE_FAILED',
+                exit: 1,
+                retryable: true,
+                details: { path: flags.output },
+            });
+        }
+        const fields = Object.keys(document.spec ?? {});
+        const withheld = document.withheld ?? [];
+        if (flags.json) {
+            this.log(this.agentJson(args.id, {
+                output: flags.output,
+                fields,
+                withheld,
+            }));
+            return;
+        }
+        this.log(`Wrote ${fields.length} portable field(s) of agent ${args.id} to ${flags.output}.`);
+        for (const entry of withheld) {
+            const count = typeof entry.count === 'number' ? ` (${entry.count})` : '';
+            this.log(`Not exported: ${entry.field}${count} — ${entry.reason}`);
+        }
+    }
+}
+exports.default = AgentsPull;

package/dist/commands/agents/push.d.ts

@@ -0,0 +1,28 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Apply an agent-as-code document to an agent.
+ *
+ * Refuse-or-apply: a document carrying any field that may not travel is
+ * refused WHOLE, first here with no network (the same rules as
+ * `agents validate`) and again by the server, which also refuses a change to
+ * a field push cannot set. Nothing is ever applied partially, because a push
+ * that quietly skipped a field would leave git and the agent disagreeing while
+ * both looked right.
+ *
+ * A field missing from the file is left as it is on the agent and listed, so
+ * deleting a line is never mistaken for clearing a field. A field the server
+ * derives (`network_agent_release_pins`) is listed when the file's copy is
+ * stale, and the server's value kept, so pushing the same file twice works.
+ */
+export default class AgentsPush extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/push.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const agent_spec_1 = require("../../lib/agent-spec");
+/**
+ * Apply an agent-as-code document to an agent.
+ *
+ * Refuse-or-apply: a document carrying any field that may not travel is
+ * refused WHOLE, first here with no network (the same rules as
+ * `agents validate`) and again by the server, which also refuses a change to
+ * a field push cannot set. Nothing is ever applied partially, because a push
+ * that quietly skipped a field would leave git and the agent disagreeing while
+ * both looked right.
+ *
+ * A field missing from the file is left as it is on the agent and listed, so
+ * deleting a line is never mistaken for clearing a field. A field the server
+ * derives (`network_agent_release_pins`) is listed when the file's copy is
+ * stale, and the server's value kept, so pushing the same file twice works.
+ */
+class AgentsPush extends base_command_1.BaseCommand {
+    static description = 'Apply a portable agent spec document to an agent; refuses any field that may not travel';
+    static examples = [
+        '<%= config.bin %> agents push <agent-id> --file agents/research.agent.json',
+        'cat agent.json | <%= config.bin %> agents push <agent-id> --file -',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        file: core_1.Flags.string({
+            char: 'f',
+            description: 'Agent spec document ("-" for stdin)',
+            required: true,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the push result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsPush);
+        let raw;
+        try {
+            raw = await (0, agent_spec_1.readSpecSource)(flags.file);
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: `Could not read ${flags.file}: ${err.message}`,
+                code: 'AGENT_SPEC_READ_FAILED',
+                exit: 1,
+                retryable: true,
+                details: { path: flags.file },
+            });
+        }
+        const parsed = (0, agent_spec_1.parseAndValidateAgentSpec)(raw, flags.file);
+        if (!parsed.ok) {
+            this.failWithCliError({
+                message: parsed.message,
+                code: 'AGENT_SPEC_NOT_JSON',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (!parsed.validation.ok) {
+            this.failWithCliError({
+                message: (0, agent_spec_1.issueBlock)(`Refused before sending: ${flags.file} carries fields that may not be pushed. Nothing was changed.`, parsed.validation.issues),
+                code: 'AGENT_SPEC_INVALID',
+                exit: 1,
+                retryable: false,
+                details: { issues: parsed.validation.issues },
+            });
+        }
+        let result;
+        try {
+            result = await data_provider_1.dataService.pushAgentSpec(args.id, parsed.validation.document);
+        }
+        catch (err) {
+            const refusal = (0, agent_spec_1.refusalIssues)(err);
+            if (refusal) {
+                this.failWithCliError({
+                    message: (0, agent_spec_1.issueBlock)(`The server refused the push to agent ${args.id}. Nothing was changed.`, refusal.issues),
+                    code: refusal.code ?? 'AGENT_SPEC_REFUSED',
+                    status: err.status,
+                    exit: 1,
+                    retryable: false,
+                    details: { issues: refusal.issues },
+                });
+            }
+            this.handleApiError(err, { subject: `agent ${args.id}` });
+        }
+        if (flags.json) {
+            this.log(this.agentJson(args.id, result));
+            return;
+        }
+        if (result.applied.length === 0) {
+            this.log(`Agent ${args.id} already matches ${flags.file}; nothing to change.`);
+        }
+        else {
+            this.log(`Updated agent ${args.id}: ${result.applied.join(', ')}.`);
+        }
+        const derived = result.derived ?? [];
+        if (derived.length > 0) {
+            this.log(`Not taken from the file, because the server derives it from other fields: ` +
+                `${derived.join(', ')}. Run \`skrr agents pull\` to refresh the file.`);
+        }
+        if (result.untouched.length > 0) {
+            this.log(`Left unchanged (not in the file): ${result.untouched.join(', ')}.`);
+        }
+        this.printAgentUrl(args.id);
+    }
+}
+exports.default = AgentsPush;

package/dist/commands/agents/releases/ci-publish.d.ts

@@ -0,0 +1,32 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Publish a release from CI using GitHub OIDC trusted publishing (OSK-12311).
+ *
+ * The OIDC token IS the credential — no `requireAuth`, no `OVERSKY_TOKEN`. The
+ * server verifies the token's issuer, signature and claims, then checks them
+ * against the agent's trusted-publisher binding (`releases trusted-publishers
+ * set`). Default channel is `private`; `beta` publishes to the beta update
+ * channel; `public` is refused until capability-tiered admission ships.
+ *
+ * The release carries the token's {repo, sha, workflow} as system-observed
+ * provenance — an origin record, not a safety badge.
+ */
+export default class AgentsReleasesCiPublish extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        channel: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        changelog: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'version-major': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'version-minor': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'release-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'offer-version-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oidc-token': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        audience: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/ci-publish.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const github_oidc_1 = require("../../../lib/github-oidc");
+/**
+ * Publish a release from CI using GitHub OIDC trusted publishing (OSK-12311).
+ *
+ * The OIDC token IS the credential — no `requireAuth`, no `OVERSKY_TOKEN`. The
+ * server verifies the token's issuer, signature and claims, then checks them
+ * against the agent's trusted-publisher binding (`releases trusted-publishers
+ * set`). Default channel is `private`; `beta` publishes to the beta update
+ * channel; `public` is refused until capability-tiered admission ships.
+ *
+ * The release carries the token's {repo, sha, workflow} as system-observed
+ * provenance — an origin record, not a safety badge.
+ */
+class AgentsReleasesCiPublish extends base_command_1.BaseCommand {
+    static description = 'Publish a release from GitHub Actions with an OIDC token (no session token needed)';
+    static examples = [
+        '# In a workflow with `permissions: id-token: write`:\n' +
+            '<%= config.bin %> agents releases ci-publish agent_abc123',
+        '<%= config.bin %> agents releases ci-publish agent_abc123 --channel beta --release-id ar_xyz',
+        '<%= config.bin %> agents releases ci-publish agent_abc123 --oidc-token "$TOKEN" --json',
+    ];
+    static args = {
+        agentId: core_1.Args.string({
+            required: true,
+            ignoreStdin: true,
+            description: 'The agent with a matching trusted-publisher binding',
+        }),
+    };
+    static flags = {
+        channel: core_1.Flags.string({
+            description: 'Release channel: private (default) or beta. public is refused until ' +
+                'capability-tiered admission ships — promote through the web publish flow',
+            options: ['private', 'beta', 'public'],
+            default: 'private',
+        }),
+        changelog: core_1.Flags.string({ description: 'Release changelog' }),
+        'version-major': core_1.Flags.integer(),
+        'version-minor': core_1.Flags.integer(),
+        'release-id': core_1.Flags.string({
+            description: 'Immutable release id (required for --channel beta)',
+        }),
+        'offer-version-id': core_1.Flags.string({
+            description: "Offer to bind for --channel beta (defaults to the listing's current offer)",
+        }),
+        'oidc-token': core_1.Flags.string({
+            description: 'A GitHub Actions OIDC token. Without it the command requests one from ' +
+                'ACTIONS_ID_TOKEN_REQUEST_* — present only when the workflow sets ' +
+                '`permissions: id-token: write`',
+        }),
+        audience: core_1.Flags.string({
+            description: "Audience to request the OIDC token with (default: the job's default; " +
+                'the API checks it against GITHUB_ACTIONS_OIDC_AUDIENCE or DOMAIN_SERVER)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        // Deliberately NOT requireAuth(): the OIDC token is the credential.
+        const { args, flags } = await this.parse(AgentsReleasesCiPublish);
+        let idToken = flags['oidc-token'];
+        if (!idToken) {
+            try {
+                idToken = await (0, github_oidc_1.fetchGitHubActionsOidcToken)(flags.audience);
+            }
+            catch (err) {
+                this.error(err.message, { exit: 2 });
+            }
+        }
+        let result;
+        try {
+            result = await data_provider_1.dataService.publishAgentReleaseFromCi({
+                agentId: args.agentId,
+                idToken,
+                channel: flags.channel,
+                changelog: flags.changelog,
+                versionMajor: flags['version-major'],
+                versionMinor: flags['version-minor'],
+                releaseId: flags['release-id'],
+                offerVersionId: flags['offer-version-id'],
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const source = result.provenance?.source;
+        this.log(`${result.replayed ? 'Replayed' : 'Published'} ${result.visibility} release ` +
+            `${result.versionLabel} (${result.id}) for agent ${args.agentId}` +
+            (source?.repository ? ` from ${source.repository}@${source.sha}` : ''));
+    }
+}
+exports.default = AgentsReleasesCiPublish;

package/dist/commands/agents/releases/create.d.ts

@@ -9,6 +9,9 @@ export default class AgentsReleasesCreate extends BaseCommand {
         'version-major': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'version-minor': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        beta: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'release-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'offer-version-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/releases/create.js

@@ -11,16 +11,37 @@ class AgentsReleasesCreate extends base_command_1.BaseCommand {
         'version-major': core_1.Flags.integer(),
         'version-minor': core_1.Flags.integer(),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),
+        beta: core_1.Flags.boolean({
+            description: 'Publish on the beta update channel (OSK-12288): reaches only copies whose channel is `beta` — needs a predeclared release id and binds the listing offer',
+        }),
+        'release-id': core_1.Flags.string({ description: 'Immutable release id (required for --beta)' }),
+        'offer-version-id': core_1.Flags.string({
+            description: "Offer to bind (defaults to the listing's current offer)",
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(AgentsReleasesCreate);
-        const result = await data_provider_1.dataService.createPrivateAgentRelease({
-            agentId: args.agentId,
-            changelog: flags.changelog,
-            versionMajor: flags['version-major'],
-            versionMinor: flags['version-minor'],
-        });
+        if (flags.beta && !flags['release-id']) {
+            this.error('--beta requires --release-id, a predeclared immutable release id (ar_…)', {
+                exit: 2,
+            });
+        }
+        const result = flags.beta
+            ? await data_provider_1.dataService.createBetaAgentRelease({
+                agentId: args.agentId,
+                changelog: flags.changelog,
+                versionMajor: flags['version-major'],
+                versionMinor: flags['version-minor'],
+                releaseId: flags['release-id'],
+                offerVersionId: flags['offer-version-id'],
+            })
+            : await data_provider_1.dataService.createPrivateAgentRelease({
+                agentId: args.agentId,
+                changelog: flags.changelog,
+                versionMajor: flags['version-major'],
+                versionMinor: flags['version-minor'],
+            });
         this.log(flags.json
             ? this.agentJson(args.agentId, result)
             : `Created release for agent ${args.agentId}`);