@skrr-ai/cli 0.1.60 → 0.1.62

package/dist/commands/agents/releases/known-issues/add.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * Post a known issue against a published release. The release stays immutable;
+ * its known issues are what a buyer reads on the Store listing before install.
+ */
+export default class AgentsReleasesKnownIssuesAdd extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        releaseId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        title: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        body: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/known-issues/add.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+/**
+ * Post a known issue against a published release. The release stays immutable;
+ * its known issues are what a buyer reads on the Store listing before install.
+ */
+class AgentsReleasesKnownIssuesAdd extends base_command_1.BaseCommand {
+    static description = 'Post a known issue on a published release; the Store listing shows it before install';
+    static examples = [
+        '<%= config.bin %> agents releases known-issues add agent_abc ar_123 --title "Double-sends the Monday digest" --body "Fixed in 1.5"',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true }),
+        releaseId: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        title: core_1.Flags.string({ required: true, description: 'One line: what goes wrong' }),
+        body: core_1.Flags.string({ description: 'Who it affects, a workaround, when a fix ships' }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesKnownIssuesAdd);
+        try {
+            const result = await data_provider_1.dataService.addAgentReleaseKnownIssue({
+                agentId: args.agentId,
+                releaseId: args.releaseId,
+                title: flags.title,
+                body: flags.body,
+            });
+            this.log(flags.json
+                ? JSON.stringify(result, null, 2)
+                : `Posted known issue ${result.knownIssue.id} on release ${result.releaseId}`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = AgentsReleasesKnownIssuesAdd;

package/dist/commands/agents/releases/known-issues/list.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * The known issues posted against one release — what the Store listing shows a
+ * buyer before install.
+ */
+export default class AgentsReleasesKnownIssuesList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        releaseId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/known-issues/list.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+const format_1 = require("../../../../lib/format");
+/**
+ * The known issues posted against one release — what the Store listing shows a
+ * buyer before install.
+ */
+class AgentsReleasesKnownIssuesList extends base_command_1.BaseCommand {
+    static description = 'List the known issues posted on an agent release';
+    static examples = [
+        '<%= config.bin %> agents releases known-issues list agent_abc ar_123',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true }),
+        releaseId: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesKnownIssuesList);
+        let releases;
+        try {
+            releases = await data_provider_1.dataService.getAgentReleases(args.agentId);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const release = releases?.data?.find((entry) => entry.id === args.releaseId);
+        if (!release) {
+            this.error(`Release ${args.releaseId} was not found on agent ${args.agentId}`, { exit: 1 });
+        }
+        const issues = release.knownIssues ?? [];
+        if (flags.json) {
+            this.log(JSON.stringify({ releaseId: release.id, knownIssues: issues }, null, 2));
+            return;
+        }
+        if (issues.length === 0) {
+            this.log(`No known issues on v${release.versionLabel}.`);
+            return;
+        }
+        (0, format_1.renderTable)(issues.map((issue) => ({
+            id: issue.id,
+            status: data_provider_1.STORE_RELEASE_KNOWN_ISSUE_STATUS_COPY[issue.status] ?? issue.status,
+            title: issue.title,
+        })), [
+            { key: 'id', header: 'ID', verbatim: true },
+            { key: 'status', header: 'STATUS' },
+            { key: 'title', header: 'TITLE', maxWidth: 60 },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = AgentsReleasesKnownIssuesList;

package/dist/commands/agents/releases/known-issues/update.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../../base-command';
+/** Edit, resolve or reopen a known issue on a release. */
+export default class AgentsReleasesKnownIssuesUpdate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        releaseId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        issueId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        body: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/known-issues/update.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+/** Edit, resolve or reopen a known issue on a release. */
+class AgentsReleasesKnownIssuesUpdate extends base_command_1.BaseCommand {
+    static description = 'Edit, resolve or reopen a known issue on a release';
+    static examples = [
+        '<%= config.bin %> agents releases known-issues update agent_abc ar_123 ki_456 --status resolved',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true }),
+        releaseId: core_1.Args.string({ required: true, ignoreStdin: true }),
+        issueId: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        status: core_1.Flags.string({ options: ['open', 'resolved'] }),
+        title: core_1.Flags.string(),
+        body: core_1.Flags.string({ description: 'Replace the details; pass "" to clear them' }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesKnownIssuesUpdate);
+        if (flags.status === undefined && flags.title === undefined && flags.body === undefined) {
+            this.error('Nothing to update: pass --status, --title or --body', { exit: 1 });
+        }
+        try {
+            const result = await data_provider_1.dataService.updateAgentReleaseKnownIssue({
+                agentId: args.agentId,
+                releaseId: args.releaseId,
+                issueId: args.issueId,
+                status: flags.status,
+                title: flags.title,
+                body: flags.body,
+            });
+            this.log(flags.json
+                ? JSON.stringify(result, null, 2)
+                : `Known issue ${args.issueId} is ${result.knownIssue.status}`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = AgentsReleasesKnownIssuesUpdate;

package/dist/commands/agents/releases/list.js

@@ -3,6 +3,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
+/**
+ * Human-readable one-line-per-release view. `pending_review` releases get a
+ * second line naming the capability facets that parked them for curator
+ * review (SUP02) — a publisher running `skrr agents releases` must see why a
+ * release is not live and what happens next.
+ */
+function renderReleases(releases) {
+    if (!releases.length)
+        return 'No releases.';
+    const lines = [];
+    for (const release of releases) {
+        const label = release.versionLabel || `v${release.versionMajor}.${release.versionMinor}`;
+        lines.push(`#${release.releaseNumber} ${label}  ${release.visibility}/${release.status}`);
+        const admission = release.admission;
+        if (release.status === 'pending_review' && admission) {
+            const facets = admission.facets.length ? admission.facets.join(', ') : '-';
+            lines.push(`    capability review pending · facets: ${facets} · next: awaiting curator review`);
+        }
+        else if (release.status === 'rejected' && admission?.reviewNote) {
+            lines.push(`    rejected: ${admission.reviewNote}`);
+        }
+    }
+    return lines.join('\n');
+}
 class AgentsReleasesList extends base_command_1.BaseCommand {
     static description = "List an agent's releases";
     static args = { agentId: core_1.Args.string({ required: true, ignoreStdin: true }) };
@@ -11,9 +35,7 @@ class AgentsReleasesList extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(AgentsReleasesList);
         const result = await data_provider_1.dataService.getAgentReleases(args.agentId);
-        this.log(flags.json
-            ? this.agentJson(args.agentId, result)
-            : JSON.stringify(result.data ?? result, null, 2));
+        this.log(flags.json ? this.agentJson(args.agentId, result) : renderReleases(result.data ?? []));
         if (!flags.json)
             this.printAgentUrl(args.agentId);
     }

package/dist/commands/agents/releases/rollback.js

@@ -13,10 +13,18 @@ class AgentsReleasesRollback extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(AgentsReleasesRollback);
-        const result = await data_provider_1.dataService.rollbackAgentRelease({
-            agentId: args.agentId,
-            releaseId: args.releaseId,
-        });
+        // Through handleApiError so a refusal says why — in particular
+        // STEP_UP_REQUIRED (OSK-12275), whose remedy is `step-up`, not a retry.
+        let result;
+        try {
+            result = await data_provider_1.dataService.rollbackAgentRelease({
+                agentId: args.agentId,
+                releaseId: args.releaseId,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
         this.log(flags.json ? this.agentJson(args.agentId, result) : `Rolled back agent ${args.agentId}`);
         if (!flags.json)
             this.printAgentUrl(args.agentId);

package/dist/commands/agents/releases/test-install.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Try one of your own private releases the way a buyer would receive it.
+ *
+ * The copy lands in a fresh Space you own. It is not a purchase and is never
+ * counted as an install, in the install funnel, or in marketplace proof.
+ */
+export default class AgentsReleasesTestInstall extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        releaseId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        'include-bootstrap': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'include-memory': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'run-on': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/test-install.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const web_url_1 = require("../../../lib/web-url");
+/**
+ * Try one of your own private releases the way a buyer would receive it.
+ *
+ * The copy lands in a fresh Space you own. It is not a purchase and is never
+ * counted as an install, in the install funnel, or in marketplace proof.
+ */
+class AgentsReleasesTestInstall extends base_command_1.BaseCommand {
+    static description = 'Test-install one of your private releases, as a buyer would receive it, into a new Space';
+    static examples = [
+        '<%= config.bin %> agents releases test-install agent_abc123 rel_def456',
+        '<%= config.bin %> agents releases test-install agent_abc123 rel_def456 --include-bootstrap --json',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true, description: 'Your agent' }),
+        releaseId: core_1.Args.string({
+            required: true,
+            ignoreStdin: true,
+            description: 'One of its approved private releases',
+        }),
+    };
+    static flags = {
+        'include-bootstrap': core_1.Flags.boolean({
+            description: 'Also copy the release-pinned bootstrap files, as a buyer could choose to',
+        }),
+        'include-memory': core_1.Flags.boolean({
+            description: 'Also copy the release-pinned memories, as a buyer could choose to',
+        }),
+        'run-on': core_1.Flags.string({
+            description: 'Where the copy runs, the choice a buyer makes at install. cloud (the default) keeps ' +
+                'its tools off this computer; local lets it use your shell, files and browser',
+            options: [...data_provider_1.STORE_INSTALL_EXECUTION_PLACEMENTS],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesTestInstall);
+        let result;
+        try {
+            result = await data_provider_1.dataService.testInstallAgentRelease({
+                agentId: args.agentId,
+                releaseId: args.releaseId,
+                includeBootstrap: flags['include-bootstrap'] || undefined,
+                includeMemory: flags['include-memory'] || undefined,
+                ...(flags['run-on']
+                    ? { executionPlacement: flags['run-on'] }
+                    : {}),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(this.agentJson(result.installedAgentId, result));
+            return;
+        }
+        const baseURL = this.cliConfig.baseURL;
+        this.log(`Test-installed ${args.releaseId} (v${result.sourceVersionLabel}) as agent ${result.installedAgentId}`);
+        this.log('Not a purchase: it is excluded from installs, the install funnel and marketplace proof.');
+        this.log(`Agent URL: ${(0, web_url_1.agentUrlFrom)(baseURL, { id: result.installedAgentId }) ?? '-'}`);
+        this.log(`Space URL: ${(0, web_url_1.spaceUrlFrom)(baseURL, { id: result.spaceId }) ?? '-'}`);
+    }
+}
+exports.default = AgentsReleasesTestInstall;

package/dist/commands/agents/releases/trusted-publishers/list.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * List the agent's trusted-publisher bindings — the CI pipelines (GitHub
+ * repositories, optionally pinned by ref / environment / workflow file) that
+ * may mint releases via OIDC (OSK-12311).
+ */
+export default class AgentsReleasesTrustedPublishersList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/trusted-publishers/list.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+/**
+ * List the agent's trusted-publisher bindings — the CI pipelines (GitHub
+ * repositories, optionally pinned by ref / environment / workflow file) that
+ * may mint releases via OIDC (OSK-12311).
+ */
+class AgentsReleasesTrustedPublishersList extends base_command_1.BaseCommand {
+    static description = "List the agent's trusted-publisher bindings (which CI repos may publish it)";
+    static examples = [
+        '<%= config.bin %> agents releases trusted-publishers list agent_abc123',
+        '<%= config.bin %> agents releases trusted-publishers list agent_abc123 --json',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesTrustedPublishersList);
+        try {
+            const result = await data_provider_1.dataService.getAgentTrustedPublishers(args.agentId);
+            const bindings = result.data ?? [];
+            if (flags.json) {
+                this.log(JSON.stringify(bindings, null, 2));
+                return;
+            }
+            if (bindings.length === 0) {
+                this.log('No trusted publishers. Bind one with:');
+                this.log(`  ${this.config.bin} agents releases trusted-publishers set ${args.agentId} --repo owner/name`);
+                return;
+            }
+            for (const binding of bindings) {
+                const pins = [
+                    binding.workflow ? `workflow=${binding.workflow}` : null,
+                    binding.ref ? `ref=${binding.ref}` : null,
+                    binding.environment ? `environment=${binding.environment}` : null,
+                    binding.allowPublicChannel ? 'allow-public-channel' : null,
+                ]
+                    .filter(Boolean)
+                    .join('  ');
+                this.log(`${binding.id}  ${binding.provider}:${binding.repository}${pins ? `  ${pins}` : ''}`);
+            }
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = AgentsReleasesTrustedPublishersList;

package/dist/commands/agents/releases/trusted-publishers/remove.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * Remove a trusted-publisher binding. Once removed, OIDC tokens from that
+ * pipeline mint nothing — this is also how you revoke a CI pipeline.
+ */
+export default class AgentsReleasesTrustedPublishersRemove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        bindingId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/trusted-publishers/remove.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+/**
+ * Remove a trusted-publisher binding. Once removed, OIDC tokens from that
+ * pipeline mint nothing — this is also how you revoke a CI pipeline.
+ */
+class AgentsReleasesTrustedPublishersRemove extends base_command_1.BaseCommand {
+    static description = 'Remove a trusted-publisher binding; that CI pipeline can no longer publish the agent';
+    static examples = [
+        '<%= config.bin %> agents releases trusted-publishers remove agent_abc123 atp_def456',
+        '<%= config.bin %> agents releases trusted-publishers remove agent_abc123 atp_def456 --json',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true }),
+        bindingId: core_1.Args.string({
+            required: true,
+            ignoreStdin: true,
+            description: 'The binding id (`atp_…`) from `trusted-publishers list`',
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesTrustedPublishersRemove);
+        try {
+            const result = await data_provider_1.dataService.removeAgentTrustedPublisher({
+                agentId: args.agentId,
+                bindingId: args.bindingId,
+            });
+            this.log(flags.json
+                ? JSON.stringify(result, null, 2)
+                : `Removed trusted publisher ${result.removed.provider}:${result.removed.repository} ` +
+                    `(${result.removed.id}) from ${args.agentId}`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = AgentsReleasesTrustedPublishersRemove;

package/dist/commands/agents/releases/trusted-publishers/set.d.ts

@@ -0,0 +1,27 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * Bind a GitHub repository to this agent for OIDC trusted publishing
+ * (OSK-12311). One binding per repository; re-running `set` replaces the
+ * constraint fields wholesale — omitting `--ref` drops a previously set ref
+ * pin.
+ *
+ * `--allow-public-channel` records the opt-in for CI-to-public publishing;
+ * the operation stays refused until capability-tiered admission ships, so the
+ * flag only readies the binding.
+ */
+export default class AgentsReleasesTrustedPublishersSet extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        repo: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workflow: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        ref: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'allow-public-channel': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/releases/trusted-publishers/set.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+/**
+ * Bind a GitHub repository to this agent for OIDC trusted publishing
+ * (OSK-12311). One binding per repository; re-running `set` replaces the
+ * constraint fields wholesale — omitting `--ref` drops a previously set ref
+ * pin.
+ *
+ * `--allow-public-channel` records the opt-in for CI-to-public publishing;
+ * the operation stays refused until capability-tiered admission ships, so the
+ * flag only readies the binding.
+ */
+class AgentsReleasesTrustedPublishersSet extends base_command_1.BaseCommand {
+    static description = 'Trust a GitHub repository to publish this agent from CI via OIDC';
+    static examples = [
+        '<%= config.bin %> agents releases trusted-publishers set agent_abc123 --repo owner/name',
+        '<%= config.bin %> agents releases trusted-publishers set agent_abc123 --repo owner/name ' +
+            '--workflow .github/workflows/publish.yml --ref refs/heads/main --environment release',
+        '<%= config.bin %> agents releases trusted-publishers set agent_abc123 --repo owner/name --json',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        repo: core_1.Flags.string({
+            required: true,
+            description: 'GitHub repository as owner/name — matched against the OIDC token claim',
+        }),
+        workflow: core_1.Flags.string({
+            description: 'Pin to one workflow file (e.g. .github/workflows/publish.yml), matched ' +
+                "against the token's workflow ref claim",
+        }),
+        ref: core_1.Flags.string({
+            description: 'Pin to one git ref (e.g. refs/heads/main)',
+        }),
+        environment: core_1.Flags.string({
+            description: 'Pin to one GitHub Actions environment (e.g. release)',
+        }),
+        'allow-public-channel': core_1.Flags.boolean({
+            description: 'Opt in to CI publishing on the public channel once capability-tiered ' +
+                'admission ships — refused outright until then',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsReleasesTrustedPublishersSet);
+        try {
+            const result = await data_provider_1.dataService.upsertAgentTrustedPublisher({
+                agentId: args.agentId,
+                provider: 'github',
+                repository: flags.repo,
+                workflow: flags.workflow,
+                ref: flags.ref,
+                environment: flags.environment,
+                allowPublicChannel: flags['allow-public-channel'],
+            });
+            if (flags.json) {
+                this.log(JSON.stringify(result.binding, null, 2));
+                return;
+            }
+            const pins = [
+                result.binding.workflow ? ` workflow=${result.binding.workflow}` : '',
+                result.binding.ref ? ` ref=${result.binding.ref}` : '',
+                result.binding.environment ? ` environment=${result.binding.environment}` : '',
+            ].join('');
+            this.log(`Trusted ${result.binding.provider}:${result.binding.repository} for ${args.agentId}` +
+                ` (${result.binding.id})${pins}`);
+            if (result.binding.allowPublicChannel) {
+                this.log('Note: --allow-public-channel is recorded, but CI-to-public publishing is refused ' +
+                    'until admission ships.');
+            }
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = AgentsReleasesTrustedPublishersSet;

package/dist/commands/agents/update.d.ts

@@ -24,6 +24,7 @@ export default class AgentsUpdate extends BaseCommand {
         'agent-ids': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'network-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'network-agent-ids': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'network-shell-write-agent-ids': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'network-include-public': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'character-3d-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'scene-background': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/agents/update.js

@@ -76,6 +76,11 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         'agent-ids': core_1.Flags.string({ description: 'Delegated agent IDs JSON array' }),
         'network-mode': core_1.Flags.string({ description: 'Agent network mode' }),
         'network-agent-ids': core_1.Flags.string({ description: 'Network agent IDs JSON array' }),
+        'network-shell-write-agent-ids': core_1.Flags.string({
+            description: 'JSON array of agents in the Specific network that may run commands and create or edit ' +
+                "files when delegated to. Agents someone else wrote, and Store installs, can't unless " +
+                'listed here. Author only; [] clears.',
+        }),
         'network-include-public': core_1.Flags.boolean({ description: 'Include public agents in network' }),
         'character-3d-id': core_1.Flags.string({ description: '3D character ID' }),
         'scene-background': core_1.Flags.string({ description: agent_visual_refs_1.SCENE_BACKGROUND_FLAG_HELP }),
@@ -90,7 +95,9 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         'agent-actions': core_1.Flags.string({ description: 'Embedded actions JSON array' }),
         'tool-policy': core_1.Flags.string({ description: 'Tool policy JSON object' }),
         artifacts: core_1.Flags.string({ description: 'Artifacts JSON value' }),
-        'support-contact': core_1.Flags.string({ description: 'Support contact JSON object' }),
+        'support-contact': core_1.Flags.string({
+            description: 'Support contact JSON object: {"name","email","security_email"}. The Store listing shows the email and security_email of the published release.',
+        }),
         'install-first-contact': core_1.Flags.string({ description: 'First-contact config JSON value' }),
         'end-after-tools': core_1.Flags.boolean({ description: 'End turn after tools' }),
         'hide-sequential-outputs': core_1.Flags.boolean({ description: 'Hide sequential outputs' }),