feat(cli): agent templates with spawn export and --repo by AhmedTMM · Pull Request #3350 · OpenRouterLabs/spawn

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMM · 2026-04-24T06:24:32Z

Summary

spawn export — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner
spawn <agent> <cloud> --repo user/repo — clones the template repo onto the VM, reads spawn.md, merges built-in steps, guides through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches in the project directory
spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command)

New files

packages/cli/src/shared/spawn-md.ts — YAML frontmatter parser, valibot schemas, spawn.md generation/application
packages/cli/src/commands/export.ts — export command (VM scan, repo creation, shareable link)

Modified files

packages/cli/src/index.ts — --repo flag extraction, export command dispatch
packages/cli/src/shared/orchestrate.ts — repo clone + spawn.md application in postInstall
packages/cli/src/flags.ts — added --repo to KNOWN_FLAGS
packages/cli/src/commands/help.ts — updated help text
packages/cli/src/commands/index.ts — barrel export
packages/cli/package.json — version bump to 0.28.0

Test plan

bunx @biomejs/biome check src/ — zero errors
bun test — 1951 pass (1 pre-existing failure unrelated)
Manual: create a repo with spawn.md, run spawn claude digitalocean --repo user/repo
Manual: run spawn export on a running spawn

🤖 Generated with Claude Code

Adds the ability to share agent setups as templates: - `spawn export` — SSHes into a running spawn, scans installed MCP servers, CLI auths, and tools, generates a spawn.md recipe (no secrets), pushes to GitHub, and prints a shareable one-liner command - `spawn <agent> <cloud> --repo user/repo` — clones the template repo onto the provisioned VM, reads spawn.md, merges built-in steps, guides the user through custom auth (OAuth, CLI login, API keys), installs MCP servers, runs setup commands, and launches the agent in the project directory - spawn.md format supports built-in steps (github, auto-update, browser) and custom setup steps (oauth, cli_auth, api_key, command) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Steps like github, auto-update, browser belong in the shareable --steps flag, not in spawn.md. spawn.md now only handles custom setup (OAuth, CLI auth, API keys, MCP servers, setup commands). The exported command now looks like: spawn claude digitalocean --repo user/repo --steps github,auto-update Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-24T06:39:59Z

Rebased onto main and resolved merge conflicts:

packages/cli/package.json — version conflict: took main's 1.0.21 and bumped to 1.0.22 for this feature
packages/cli/src/shared/orchestrate.ts (2 conflicts):
- Skill installation block (from main) + spawn.md application (from this branch) — kept both, placed spawn.md setup after skill installation
- Funnel tracking trackFunnel("funnel_handoff") (from main) + repo-aware launch command cd ~/project && (from this branch) — kept both

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2106 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts

`spawn export` now publishes ~/project as a real working-folder snapshot of a running spawn: - MCP scan reads from ~/.claude/settings.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, and ~/.openclaw/openclaw.json (with hand-rolled Codex TOML parsing); entries are deduped by name and env values are replaced with ${NAME} placeholders. - CLI auth scan covers GitHub, GitLab, AWS, gcloud, Azure, DO, Hetzner, Vercel, Netlify, Fly, Heroku, Railway, Render, Shopify, Stripe, Firebase, Supabase, Cloudflare, Pulumi, Docker, npm, Turso, Neon, PlanetScale, 1Password, ngrok. One batched SSH probe replaces N round-trips. - rsync exclude list expanded to filter common secret/key files (.ssh, .aws, .gnupg, *.pem, *.key, terraform state, etc.) and a post-rsync content scan flags inline secrets (PEM keys, GitHub PATs, Slack/Stripe/AWS/Google API keys) before push. - Repo visibility prompt defaults to private. Replay-side fixes: - installMcpServersFromTemplate routes through skills.ts helpers (no more `node -e` injection); adds Codex TOML support. - launchCmd `cd ~/project` now gates on actual clone success, not the --repo flag — invalid slugs no longer break agent boot. - api_key var name regex no longer strips lowercase letters. Bumps CLI to 1.0.23. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

la14-1 · 2026-04-27T06:56:35Z

Rebased onto main (3e6c876) and resolved merge conflicts:

packages/cli/src/shared/orchestrate.ts (3 conflicts):
- Kept main's repoCloned flag pattern (gates launch cd ~/project on actual clone success, not just env var)
- Kept main's getErrorMessage() for clone failure logging
- Preserved repoCloned = true; assignment from main
packages/cli/src/shared/spawn-md.ts (5 conflicts):
- Header: merged branch's "generate" mention with main's detailed comment
- Schema: kept branch's steps field (then correctly removed by commit 2, matching main's approach)
- generateSpawnMd(): kept branch's new function (feature addition)
- escapedName regex: took main's [^A-Za-z0-9_] (more permissive, handles lowercase env var names)
- MCP installation: took main's extracted helpers (installClaudeMcpServers etc. from skills.js) over branch's inline require() approach

Verification:

bunx @biomejs/biome check src/ — 0 errors
bun test — 2110 pass, 2 fail (same pre-existing failures as main, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)

-- refactor/pr-maintainer

la14-1 · 2026-04-28T22:19:29Z

Rebased on main — merge conflict resolved. Lint clean, tests pass (2 pre-existing failures unrelated to this PR).

-- refactor/pr-maintainer

AhmedTMMand others added 2 commits April 23, 2026 23:24

AhmedTMMand others added 2 commits April 24, 2026 22:29

Merge remote-tracking branch 'upstream/main' into feat/agent-templates
c374187
# Conflicts: # packages/cli/package.json # packages/cli/src/shared/orchestrate.ts