
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
orquesta-agent
Advanced tools
Local agent for Orquesta - connects your VM to the Orquesta dashboard for collaborative AI-powered development.
npm install -g orquesta-agent
Or run directly with npx:
npx orquesta-agent --token <your-token> --daemon
The --daemon flag enables automatic restart if the agent exits.
npx orquesta-agent --token oat_xxxxxxxxxxxx --daemon
The --daemon flag ensures the agent automatically restarts if it exits for any reason.
orquesta-agent [options]
orquesta-agent setup # Check prerequisites
| Option | Description |
|---|---|
-t, --token <token> | Connection token from Orquesta dashboard (required) |
-D, --daemon | Run in daemon mode with automatic restart on exit (recommended) |
--max-restarts <n> | Maximum restart attempts in daemon mode (0=unlimited, default) |
-v, --verbose | Enable verbose logging |
-d, --working-dir <dir> | Working directory for command execution |
--no-auto-clone | Disable automatic repository cloning |
--no-auto-pull | Disable automatic git pull before prompts |
-m, --permission-mode <mode> | Permission mode: auto (default) or supervised |
The daemon mode provides automatic restart functionality similar to systemd:
# Run with daemon mode (recommended for production)
npx orquesta-agent --token oat_xxxxx --daemon
# Limit restart attempts (default: unlimited)
npx orquesta-agent --token oat_xxxxx --daemon --max-restarts 10
Features:
Run the setup wizard to check prerequisites:
npx orquesta-agent setup
This checks:
Everything above is dispatch: Orquesta sends work down to the agent. Hooks are the opposite direction — you keep working in your own IDE and Orquesta mirrors what happened. No daemon runs, and nothing is ever executed back into your editor.
# Wire both tools (default)
orquesta-agent init --token oat_xxxxx
# Or pick one
orquesta-agent init --token oat_xxxxx --client cursor
orquesta-agent init --token oat_xxxxx --client claude
init writes .orquesta.json (project binding — it is added to .gitignore
because it holds the raw token) plus .claude/settings.json and/or
.cursor/hooks.json. Hooks you already had are preserved, and re-running init
upgrades Orquesta's entries rather than stacking duplicates.
| Moment | Claude Code | Cursor | Recorded as |
|---|---|---|---|
| Prompt sent | UserPromptSubmit | beforeSubmitPrompt | The prompt |
| Tool ran | PostToolUse | postToolUse, afterShellExecution, afterFileEdit | Tool call + result |
| Answer written | — | afterAgentResponse | The assistant's reply |
| Session done | Stop | stop | Marks the prompt complete |
Cursor surfaces shell runs and file edits as their own events on top of
postToolUse, so all three are wired and the handler de-dupes by content — an
action reported twice is still logged once.
Two behaviours differ per tool, both deliberate:
UserPromptSubmit stdout as extra model context,
so the hook injects a short Orquesta block there. Cursor parses hook stdout as a
JSON permission decision, so on that path the hook writes nothing..orquesta.json all
leave your session untouched.The tool is detected from the payload, so --client is only needed to override
the guess. Mirrored prompts arrive with source: terminal and a cli_type of
claude-code or cursor-cli, and are excluded from agent dispatch so a hooked
session is never re-executed.
┌─────────────────────────────────────────────────────────────┐
│ ORQUESTA DASHBOARD │
│ (orquesta.live) │
└──────────────────────────┬──────────────────────────────────┘
│
Supabase Realtime
(WebSocket)
│
▼
┌─────────────────────────────────────────────────────────────┐
│ LOCAL AGENT │
│ │
│ 1. Validates token with Orquesta API │
│ 2. Receives Supabase credentials │
│ 3. Subscribes to project channel │
│ 4. Listens for 'execute' commands │
│ 5. Spawns Claude CLI: claude --print "..." │
│ 6. Streams stdout/stderr back via broadcast │
│ 7. Sends 'complete' or 'error' when done │
└─────────────────────────────────────────────────────────────┘
/api/agent/validateagent:project-{projectId}execute eventsoutput events in real-timecomplete with exit codeDashboard → Agent:
execute: Run a prompt { id, promptId, content, workingDirectory? }cancel: Kill running process { id }ping: Heartbeat check { timestamp }Agent → Dashboard:
output: Stream data { id, type: 'stdout'|'stderr', data, timestamp }complete: Finished { id, exitCode, duration }error: Failed { id, error, code? }pong: Heartbeat response { timestamp, latency }The agent supports two Claude authentication methods:
export ANTHROPIC_API_KEY=sk-ant-xxxxx
npx orquesta-agent --token oat_xxxxx
On your local machine (with browser):
claude auth login
Then copy credentials to the server:
scp ~/.claude/.credentials.json user@server:~/.claude/
If you've stored an Anthropic API key in Orquesta:
The agent can automatically manage your repository:
If a repository URL is configured in Orquesta:
npx orquesta-agent --token oat_xxxxx
# Automatically clones repo if not present
Disable with --no-auto-clone.
Before each prompt execution:
# Agent runs: git pull
# Then executes the prompt
Disable with --no-auto-pull.
npm install -g @anthropic-ai/claude-code
# Option 1: Set API key
export ANTHROPIC_API_KEY=sk-ant-xxxxx
# Option 2: Login (requires browser)
claude auth login
Generate a new token from the dashboard:
The agent sends heartbeats every 30 seconds. If offline:
--verbose to see errors# Clone the repo
git clone https://github.com/your-org/orquesta.git
cd orquesta/packages/orquesta-agent
# Install dependencies
npm install
# Build
npm run build
# Run locally
npm start -- --token oat_xxxxx
MIT
FAQs
Local agent for Orquesta - connects your VM to the Orquesta dashboard
The npm package orquesta-agent receives a total of 651 weekly downloads. As such, orquesta-agent popularity was classified as not popular.
We found that orquesta-agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.