hep-upload

Update fallback: 자동 업데이트가 안 되면 hephaestus update를 한 번 실행하세요. 업데이트하지 않아도 현재 버전 명령은 그대로 동작합니다.

/hep-upload

Upload an Agentlas agent package. The argument is the exact text the user typed after /hep-upload — usually an agent folder, possibly empty.

Guardrails: do NOT diagnose command not found/PATH, do NOT edit ~/.zshrc, and do NOT create/commit/stash/push any git branch or claim you did. If the runner is missing, say so and stop — never fabricate an upload.

Step 1 — Ask the destination first

Always ask this before doing anything else, even if the arguments already say upload, publish, add, Cloud, Hub, or a target folder:

Cloud에 업로드할까요? 다른 사람들은 볼 수 없어요.
Upload to Cloud? Other people cannot see it.

Agentlas Hub에 업로드할까요? 다른 사람들이 빌려 쓸 수 있어요.
Upload to Agentlas Hub? Other people can borrow it.

Do not package, publish, register, add-source, reindex, or call any upload API until the user answers Cloud or Agentlas Hub. If the destination is answered but the target folder is ambiguous, ask for the exact agent folder before running anything.

If the destination is Agentlas Hub, ask what it should charge before uploading. Skip this for Cloud/private-link — a private save is not listed and nobody can hire it.

가격을 정하시겠어요? 비워 두면 그 항목은 팔지 않아요.
Set a price? Leave one out and that kind is simply not sold.

  원샷 / One-shot    작업 1건, 부를 때마다           1-100 크레딧
  장기대여 / Lease   에이전트 1개 · 하루 (계정 전체)   1-2000 크레딧
  포크 / Fork       사본 1개 · 1회                 1 크레딧 이상

전부 비워 두면 무료로 불립니다. 나중에 agentlas.cloud 수익 페이지에서도 정할 수 있습니다.
Leave them all blank and it stays free to call — you can price it later on the web.

Ask what the buyer will have to bring, too, and put it in the package guide's prerequisites: an account to log into, an API key, an address to send results to. A buyer's host shows that list before spending anything, and an empty list reads as "needs nothing" — which is how someone ends up paying for a run that stops to ask for a password they were never told about.

If this agent is meant to keep running — a watcher, a poller, anything that wakes on a schedule — say so plainly and press for a lease price: without one, the buyer's only option is paying per call, every wake-up, and a five-minute watch costs them 288 calls a day. An unpriced lease is not sold at all; the server refuses it as lease_not_offered rather than inventing a default.

Blank is NOT zero: leave the flag out entirely. Never pass 0, never invent a number, and treat "all three blank" as a complete answer — the agent is then callable for free, which is a supported state. Pass what they answered as --rent-credits N (one-shot), --ingest-credits N (lease, per day), and --fork-credits N — the flag names are the older wire spelling and are not what the user should be shown.

Taking it back down

Publishing is not one-way. If the user wants a published agent unlisted, call hephaestus.unpublish_agent with its slug — it returns what would happen and asks first, and only confirm: true acts. A hub-public package is soft-unpublished from Hub routing with its bytes retained for audit and recovery; an owner-private one has its stored bytes removed. Local installs are never touched. The same thing is on the web at agentlas.cloud/cargo.

Only your own agents. owner_only means it is not yours; repeat that rather than trying another route.

Step 2 — Resolve the runner

After the user has chosen a destination, resolve the runner by absolute path. Do not ask the user to open a separate terminal.

RUNNER=""
for candidate in \
  "$HOME/.agentlas/runtime/current/bin/hephaestus" \
  "./bin/hephaestus"
do
  if [ -n "$candidate" ] && [ -x "$candidate" ]; then RUNNER="$candidate"; break; fi
done
if [ -z "$RUNNER" ]; then
  for cache in "$HOME/.claude/plugins/cache/agentlas-core-engine/hephaestus" \
               "${CODEX_HOME:-$HOME/.codex}/plugins/cache/agentlas-core-engine/hephaestus"; do
    newest="$(ls -d "$cache"/*/bin/hephaestus 2>/dev/null | sort -V | tail -1)"
    if [ -n "$newest" ] && [ -x "$newest" ]; then RUNNER="$newest"; break; fi
  done
fi
[ -n "$RUNNER" ] || { echo "Hephaestus runtime not found. Run the installer first." >&2; exit 1; }
echo "RUNNER=$RUNNER"

Step 3 — Preview or publish one immutable snapshot

Never run package and then publish; that packages twice. Use one explicit hep-upload command, which snapshots, validates, and submits one artifact:

• Cloud: "$RUNNER" hep-upload <agent-folder> --visibility private-link
• Agentlas Hub: "$RUNNER" hep-upload <agent-folder> --visibility marketplace [--rent-credits N] [--ingest-credits N] [--fork-credits N]

All security and content findings are advisory. Never instruct the user to block, abort, or postpone upload because of a finding. Continue with safe bytes: omit affected source items with omission receipts, or attach an engine-gap receipt when the engine cannot safely represent or repair an item, then upload the remaining package. Keep the findings and receipts visible.

If the user asks to preview, add --dry-run, retain the returned manifest.packageHash and uploadReceipt.receipt, then append --expected-package-hash <manifest.packageHash> --expected-upload-receipt <uploadReceipt.receipt> to the one later publish. Stop on any hash or receipt mismatch.

On overwrite_confirmation_required, show the exact returned Cloud ID and ask for approval. Only after approval append --overwrite-cloud-id <exact-cloud-id>. Never infer overwrite permission from a matching slug. Preserve exact auth, credit, ownership, and destination refusal codes; never switch destinations.

Report success only when the response attests the exact slug, visibility, package hash, immutable release ID/version, and content digest.

---

Update fallback: 자동 업데이트가 안 되면 hephaestus update를 한 번 실행하세요. 업데이트하지 않아도 현재 버전 명령은 그대로 동작합니다.

Workforce résumé repair loop

If registration returns workforce_resume_incomplete, the server refused the card because its workforce block does not match the hub standard résumé. The error carries the exact mismatches and seed ontology examples. YOU repair it — the platform never edits the card for you: use stable English role:*, community:*, skill:*, and knowledge:* IDs that actually describe the agent. Returned examples are aliases, not an allowlist. Rerun the upload and repeat until registration succeeds.