Installation and local checks

# Windows (for the verified temporary script)
py oasn-sa-dev.py install --expected-sha256 <Skill-bound 64-character SHA-256>

# macOS / Linux
python3 oasn-sa-dev.py install --expected-sha256 <Skill-bound 64-character SHA-256>

The installation result returns installed_path, command, and path_hint. First use the complete returned command to run --version again. If PATH still resolves to an older copy, do not reinstall repeatedly or modify shell configuration on your own.

Authentication and SSH keys

oasn-sa-dev auth status
oasn-sa-dev auth login
oasn-sa-dev auth logout

oasn-sa-dev ssh-key ensure
oasn-sa-dev ssh-key ensure --create
oasn-sa-dev ssh-key ensure --create --path <new_private_key_path>

• auth status only checks the secure credential store. Use auth login to explicitly retry OAuth; other commands that require authentication also open the browser when needed.
• auth logout reports local deletion and server-side revocation separately. server_status=unconfirmed must not be treated as confirmed revocation.
• ssh-key ensure without --create only finds or validates a public key. Creating a new key requires explicit authorization, and the CLI refuses to overwrite an existing target.
• The private key always remains on the local machine; the platform receives only the public key. The CLI uses the system Credential Manager, Keychain, or Secret Service and never falls back to a plaintext session file.

Select a source, create a Workspace, and connect

1. Query available sources without changing state

oasn-sa-dev workspace sources --version-id <agent_version_id>

The result may include the current existing_workspace, recoverable published versions, and a recommended_source_version_id. A recommendation is not automatic authorization. The developer must explicitly choose among reusing the existing Workspace, selecting a historical snapshot, or starting from a fresh base environment.

2. Create or reuse

# Start from a published version snapshot confirmed by the developer
oasn-sa-dev workspace create --version-id <target_draft_version_id> --source-version-id <source_version_id>

# Explicitly start from the platform base environment
oasn-sa-dev workspace create --version-id <target_draft_version_id> --fresh

# Query the lifecycle of a known Workspace without changing state
oasn-sa-dev workspace status --workspace-id <workspace_id>

A source Version restores only a compatible code and file snapshot. It does not copy the Agent Card, Pricing, model, resource specifications, or WebUI ports. If sources already returns a reusable Workspace, use its ID instead of calling create to overwrite it.

3. Bind the public key and verify SSH for real

oasn-sa-dev workspace connect --workspace-id <workspace_id>

status=active only means that the lifecycle is ready; it does not prove that SSH works. workspace connect verifies the local public/private key pair, binds an unbound Workspace using a stable idempotent intent, uses Workspace-isolated known_hosts, and performs a real -vvv authentication probe. Only after the result returns ssh_binding_status=bound and ssh_verified=true should you execute the complete returned ssh_command/scp_command exactly as provided.

4. Renew only the short-lived connection

oasn-sa-dev workspace resume --workspace-id <workspace_id>

Run this only when the developer explicitly asks to continue using the same active + expired Workspace. resume does not create a new Sandbox, bind an SSH key, or replace the authentication probe performed by a subsequent workspace connect.

Wait parameters

WebUI application ports

# Query without changing state
oasn-sa-dev version webui-ports get --version-id <agent_version_id>

# Replace the entire port list after developer confirmation
oasn-sa-dev version webui-ports set --version-id <agent_version_id> --ports 7860,8765

# Clear all ports after explicit developer confirmation
oasn-sa-dev version webui-ports set --version-id <agent_version_id> --clear

# Preserve the complete port list and create a new generation of application links
oasn-sa-dev version webui-ports refresh --version-id <agent_version_id>

• Ports must be unique integers in 1..65535; 22/18789/18790 are not allowed.
• set replaces the complete list. Supplying the same list is an idempotent no-op. refresh is not set; it neither clears the list nor recreates the Sandbox.
• The port revision in the result is not the official website draft ETag.
• sync_status=ready proves only that the declaration has synchronized. proxy_status=ready provides the currently valid webui_urls, but you must still perform a real HTTP test.

Official website developer operations

# List the official website operations supported by this deployment and their write properties, offline
oasn-sa-dev portal commands

In 0.7.3, portal commands use the same public APIs as the official website. Read-only commands can query directly. A write command must be the current action the developer explicitly requested and must include the command's required --confirm, stable --idempotency-key, original quoted --if-match, or temporary --body-file. Use the local portal commands output and --help as the authority for specific operations and parameters; do not guess from an old manual.

Compatibility Skill Link

oasn-sa-dev skill-link create --version-id <VERSION_ID>

This compatibility entry point is still accepted by the parser. The recommended primary flow remains clicking Build With Local Agent on the official website and copying the complete trusted prompt bound to the current Agent and Version.

Operations that still do not exist or cannot be substituted

Common stable errors