@thinkingai/ae-cli 6.0.24 → 6.0.27

package/dist/{te-agent-OYNNTJDU.js → te-agent-QLIVKRUN.js}

@@ -1,11 +1,13 @@
 import {
   deleteFromMainApp,
+  getBufferFromMainApp,
   getFromMainApp,
   patchToMainApp,
   postToMainApp,
+  putToMainApp,
   uploadToMainApp
-} from "./chunk-4FQ36OGO.js";
-import "./chunk-65DKFJZB.js";
+} from "./chunk-R77JT7XD.js";
+import "./chunk-YCLVYFK7.js";
 
 // src/commands/te-agent/agents.ts
 var BASE_PATH = "/api/sandbox/agent/agents";
@@ -46,10 +48,171 @@ var listAgents = {
   dryRun: (ctx) => ({ method: "GET", url: `${BASE_PATH}${buildQuery(ctx)}` }),
   execute: async (ctx) => getFromMainApp(`${BASE_PATH}${buildQuery(ctx)}`)
 };
+async function resolveInstructions(raw) {
+  if (raw === "@-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (!text) throw new Error("stdin is empty; cannot read instructions");
+    return text;
+  }
+  return raw;
+}
+var createAgent = {
+  service: "agent",
+  command: "+create-agent",
+  description: "Create an Agent (personal scope by default; company requires root/agent_admin)",
+  flags: [
+    { name: "name", type: "string", required: true, desc: "Agent name (1-100 chars)" },
+    { name: "description", type: "string", required: false, desc: "Agent description (max 2000 chars)" },
+    { name: "instructions", type: "string", required: false, desc: "Agent system prompt (use @- to read from stdin)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Scope: personal | company (company requires root/agent_admin)" },
+    { name: "model-id", type: "string", required: false, desc: "Model identifier (Model.id uuid or legacy modelId); omit to use global default" },
+    { name: "mcp-ids", type: "json", required: false, desc: 'MCP server record IDs as JSON array string (e.g. ["id1","id2"])' },
+    { name: "skill-ids", type: "json", required: false, desc: "Skill record IDs as JSON array string" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on name conflict (append -N suffix)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (!name || name.length < 1 || name.length > 100) {
+      throw new Error("--name length must be between 1 and 100");
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      name: ctx.str("name"),
+      scope: ctx.str("scope") || "personal"
+    };
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructions = ctx.str("instructions");
+    if (instructions) body.systemPrompt = instructions === "@-" ? "(from stdin)" : instructions;
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    return { method: "POST", url: BASE_PATH, body };
+  },
+  execute: async (ctx) => {
+    const body = {
+      name: ctx.str("name"),
+      scope: ctx.str("scope") || "personal"
+    };
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructionsRaw = ctx.str("instructions");
+    if (instructionsRaw) body.systemPrompt = await resolveInstructions(instructionsRaw);
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    return postToMainApp(BASE_PATH, body);
+  }
+};
+var updateAgent = {
+  service: "agent",
+  command: "+update-agent",
+  description: "Update an Agent (name/description/instructions/model/MCP/Skill/enabled)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Agent record ID (CUID)" },
+    { name: "name", type: "string", required: false, desc: "New Agent name (1-100 chars)" },
+    { name: "description", type: "string", required: false, desc: "New description (max 2000 chars)" },
+    { name: "instructions", type: "string", required: false, desc: "New system prompt (use @- to read from stdin)" },
+    { name: "model-id", type: "string", required: false, desc: "New model identifier (uuid or legacy modelId); omit to keep" },
+    { name: "mcp-ids", type: "json", required: false, desc: "MCP server record IDs as JSON array string (replaces the list; [] clears)" },
+    { name: "skill-ids", type: "json", required: false, desc: "Skill record IDs as JSON array string (replaces the list; [] clears)" },
+    { name: "enabled", type: "boolean", required: false, desc: "Enable/disable (system/company: writes personal preference)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name && (name.length < 1 || name.length > 100)) {
+      throw new Error("--name length must be between 1 and 100");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {};
+    const name = ctx.str("name");
+    if (name) body.name = name;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructions = ctx.str("instructions");
+    if (instructions) body.systemPrompt = instructions === "@-" ? "(from stdin)" : instructions;
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.str("enabled")) body.enabled = ctx.bool("enabled");
+    return { method: "PATCH", url: `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`, body };
+  },
+  execute: async (ctx) => {
+    const body = {};
+    const name = ctx.str("name");
+    if (name) body.name = name;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructionsRaw = ctx.str("instructions");
+    if (instructionsRaw) body.systemPrompt = await resolveInstructions(instructionsRaw);
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.str("enabled")) body.enabled = ctx.bool("enabled");
+    return patchToMainApp(`${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`, body);
+  }
+};
+var delAgent = {
+  service: "agent",
+  command: "+del-agent",
+  description: "Soft-delete an Agent (system agents cannot be deleted)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Agent record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "DELETE",
+    url: `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return deleteFromMainApp(`${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+var getAgent = {
+  service: "agent",
+  command: "+get-agent",
+  description: "Get Agent details by ID",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Agent record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return getFromMainApp(`${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
 
 // src/commands/te-agent/models.ts
 var BASE_PATH2 = "/api/sandbox/agent/models";
-var LIST_PATH = "/api/sandbox/models";
 var listModels = {
   service: "agent",
   command: "+list-models",
@@ -72,26 +235,32 @@ var listModels = {
   dryRun: (ctx) => {
     const scope = ctx.str("scope");
     const params = new URLSearchParams();
-    const current = process.env.TE_AGENT_CURRENT_MODEL_ID?.trim();
     if (scope) params.set("scope", scope);
-    if (current) params.set("current", current);
     const qs = params.toString();
-    return { method: "GET", url: `${LIST_PATH}${qs ? `?${qs}` : ""}` };
+    return { method: "GET", url: `${BASE_PATH2}${qs ? `?${qs}` : ""}` };
   },
   execute: async (ctx) => {
     const scope = ctx.str("scope");
     const params = new URLSearchParams();
-    const current = process.env.TE_AGENT_CURRENT_MODEL_ID?.trim();
     if (scope) params.set("scope", scope);
-    if (current) params.set("current", current);
     const qs = params.toString();
-    return getFromMainApp(`${LIST_PATH}${qs ? `?${qs}` : ""}`);
+    const current = process.env.TE_AGENT_CURRENT_MODEL_ID?.trim();
+    const data = await getFromMainApp(
+      `${BASE_PATH2}${qs ? `?${qs}` : ""}`
+    );
+    const items = data?.items ?? [];
+    return {
+      models: items.map((m) => ({
+        ...m,
+        isCurrent: current ? m.id === current : false
+      }))
+    };
   }
 };
 var addModel = {
   service: "agent",
   command: "+add-model",
-  description: "Add a custom model (personal scope)",
+  description: "Add a custom model (personal or company scope)",
   flags: [
     {
       name: "model-id",
@@ -119,6 +288,13 @@ var addModel = {
       type: "number",
       required: false,
       desc: "Context window length"
+    },
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "personal",
+      desc: "Target scope: personal | company"
     }
   ],
   risk: "write",
@@ -129,6 +305,10 @@ var addModel = {
     } catch {
       throw new Error("--base-url must be a valid URL");
     }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
   },
   dryRun: (ctx) => ({
     method: "POST",
@@ -140,7 +320,8 @@ var addModel = {
       apiKey: ctx.str("apiKey") || void 0,
       provider: ctx.str("provider") || void 0,
       description: ctx.str("description") || void 0,
-      contextLength: ctx.num("contextLength") || void 0
+      contextLength: ctx.num("contextLength") || void 0,
+      scope: ctx.str("scope") || "personal"
     }
   }),
   execute: async (ctx) => {
@@ -151,31 +332,46 @@ var addModel = {
       apiKey: ctx.str("apiKey") || void 0,
       provider: ctx.str("provider") || void 0,
       description: ctx.str("description") || void 0,
-      contextLength: ctx.num("contextLength") || void 0
+      contextLength: ctx.num("contextLength") || void 0,
+      scope: ctx.str("scope") || "personal"
     });
   }
 };
 var delModel = {
   service: "agent",
   command: "+del-model",
-  description: "Delete a personal model",
+  description: "Delete a model (personal or company scope)",
   flags: [
     {
       name: "id",
       type: "string",
       required: true,
       desc: "Model record ID (CUID)"
+    },
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "personal",
+      desc: "Target scope: personal | company"
     }
   ],
   risk: "write",
-  dryRun: (ctx) => ({
-    method: "DELETE",
-    url: `${BASE_PATH2}?id=${encodeURIComponent(ctx.str("id"))}`
-  }),
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const scope = ctx.str("scope") || "personal";
+    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope)}`;
+    return { method: "DELETE", url: `${BASE_PATH2}?${qs}` };
+  },
   execute: async (ctx) => {
-    return deleteFromMainApp(
-      `${BASE_PATH2}?id=${encodeURIComponent(ctx.str("id"))}`
-    );
+    const scope = ctx.str("scope") || "personal";
+    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope)}`;
+    return deleteFromMainApp(`${BASE_PATH2}?${qs}`);
   }
 };
 var toggleModel = {
@@ -209,6 +405,124 @@ var toggleModel = {
     });
   }
 };
+var updateModel = {
+  service: "agent",
+  command: "+update-model",
+  description: "Update a custom model (id determines the record to update; personal or company scope)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Model record ID (CUID) to update" },
+    { name: "model-id", type: "string", required: true, desc: "Model identifier (e.g. gpt-4o)" },
+    { name: "name", type: "string", required: true, desc: "Display name" },
+    { name: "base-url", type: "string", required: true, desc: "API base URL (must be a valid URL)" },
+    { name: "api-key", type: "string", required: false, desc: "API key; omit or empty to preserve the existing key" },
+    { name: "provider", type: "string", required: false, desc: "Provider name" },
+    { name: "description", type: "string", required: false, desc: "Description" },
+    { name: "context-length", type: "number", required: false, desc: "Context window length" },
+    { name: "connectivity-verified", type: "boolean", required: false, desc: "Whether connectivity was verified (default false; pass true after +test-model)" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on display name conflict (append -N suffix)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Target scope: personal | company" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const baseUrl = ctx.str("baseUrl");
+    try {
+      new URL(baseUrl);
+    } catch {
+      throw new Error("--base-url must be a valid URL");
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      id: ctx.str("id"),
+      modelId: ctx.str("modelId"),
+      displayName: ctx.str("name"),
+      baseUrl: ctx.str("baseUrl"),
+      connectivityVerified: ctx.bool("connectivityVerified")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const contextLength = ctx.optionalNum("contextLength");
+    if (contextLength !== void 0) body.contextLength = contextLength;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    body.scope = ctx.str("scope") || "personal";
+    return { method: "POST", url: BASE_PATH2, body };
+  },
+  execute: async (ctx) => {
+    const body = {
+      id: ctx.str("id"),
+      modelId: ctx.str("modelId"),
+      displayName: ctx.str("name"),
+      baseUrl: ctx.str("baseUrl"),
+      connectivityVerified: ctx.bool("connectivityVerified")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const contextLength = ctx.optionalNum("contextLength");
+    if (contextLength !== void 0) body.contextLength = contextLength;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    body.scope = ctx.str("scope") || "personal";
+    return postToMainApp(BASE_PATH2, body);
+  }
+};
+var testModel = {
+  service: "agent",
+  command: "+test-model",
+  description: "Test model connectivity (LLM models only)",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "Model identifier (e.g. gpt-4o)" },
+    { name: "base-url", type: "string", required: true, desc: "API base URL (must be a valid URL)" },
+    { name: "api-key", type: "string", required: false, desc: "API key; omit to reuse the stored key of --id" },
+    { name: "provider", type: "string", required: false, desc: "Provider name" },
+    { name: "id", type: "string", required: false, desc: "Existing model config ID; when --api-key is omitted, the stored key is decrypted and reused" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const baseUrl = ctx.str("baseUrl");
+    try {
+      new URL(baseUrl);
+    } catch {
+      throw new Error("--base-url must be a valid URL");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      modelId: ctx.str("modelId"),
+      baseUrl: ctx.str("baseUrl")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const id = ctx.str("id");
+    if (id) body.existingConfigId = id;
+    return { method: "POST", url: `${BASE_PATH2}/test`, body };
+  },
+  execute: async (ctx) => {
+    const body = {
+      modelId: ctx.str("modelId"),
+      baseUrl: ctx.str("baseUrl")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const id = ctx.str("id");
+    if (id) body.existingConfigId = id;
+    return postToMainApp(`${BASE_PATH2}/test`, body);
+  }
+};
 
 // src/commands/te-agent/market-constants.ts
 var MARKET_CATEGORIES = [
@@ -245,7 +559,9 @@ function buildMarketQuery(ctx) {
 
 // src/commands/te-agent/mcps.ts
 var BASE_PATH3 = "/api/sandbox/agent/mcp-servers";
-var MARKET_BASE_PATH = "/api/mcp-servers";
+var MARKET_BASE_PATH = "/api/sandbox/agent/mcp-servers";
+var CRED_BASE_PATH = "/api/sandbox/agent/mcp-credentials";
+var STATS_PATH = "/api/sandbox/agent/mcp-servers/stats";
 function buildMetaBody(ctx) {
   const body = {};
   const category = ctx.str("category");
@@ -284,7 +600,7 @@ var listMcps = {
 var addMcp = {
   service: "agent",
   command: "+add-mcp",
-  description: "Add an MCP server (personal scope)",
+  description: "Add an MCP server (personal or company scope)",
   flags: [
     { name: "name", type: "string", required: true, desc: "Server name (2-64 chars, letter start, [a-zA-Z0-9_-])" },
     { name: "url", type: "string", required: true, desc: "MCP server URL" },
@@ -294,7 +610,8 @@ var addMcp = {
     { name: "headers", type: "json", required: false, desc: "HTTP headers as JSON object" },
     { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
     { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
-    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Target scope: personal | company" }
   ],
   risk: "write",
   validate: (ctx) => {
@@ -321,6 +638,10 @@ var addMcp = {
     if (category && !isValidMarketCategory(category)) {
       throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
     }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
   },
   dryRun: (ctx) => {
     const body = {
@@ -329,7 +650,8 @@ var addMcp = {
       displayName: ctx.str("displayName") || void 0,
       description: ctx.str("description") || void 0,
       transport: ctx.str("transport") || "http",
-      headers: ctx.json("headers") || void 0
+      headers: ctx.json("headers") || void 0,
+      scope: ctx.str("scope") || "personal"
     };
     const meta = buildMetaBody(ctx);
     if (meta) body._meta = meta;
@@ -342,7 +664,8 @@ var addMcp = {
       displayName: ctx.str("displayName") || void 0,
       description: ctx.str("description") || void 0,
       transport: ctx.str("transport") || "http",
-      headers: ctx.json("headers") || void 0
+      headers: ctx.json("headers") || void 0,
+      scope: ctx.str("scope") || "personal"
     });
     const id = created?.item?.id;
     const meta = buildMetaBody(ctx);
@@ -461,10 +784,315 @@ var setMcpMeta = {
     );
   }
 };
+var UPDATE_TRANSPORTS = ["sse", "http", "streamable-http"];
+var UPDATE_AUTH_MODES = ["none", "oauth2", "header", "manual"];
+var CRED_AUTH_TYPES = ["oauth", "apikey"];
+function buildUpdateBody(ctx) {
+  const body = {};
+  const name = ctx.str("name");
+  if (name) body.name = name;
+  const url = ctx.str("url");
+  if (url) body.url = url;
+  const displayName = ctx.str("displayName");
+  if (displayName) body.displayName = displayName;
+  const description = ctx.str("description");
+  if (description) body.description = description;
+  const transport = ctx.str("transport");
+  if (transport) body.transport = transport;
+  const headers = ctx.json("headers");
+  if (headers) body.headers = headers;
+  const secretHeaders = ctx.json("secretHeaders");
+  if (secretHeaders) body.secretHeaders = secretHeaders;
+  const authMode = ctx.str("authMode");
+  if (authMode) body.authMode = authMode;
+  const enabledStr = ctx.str("enabled");
+  if (enabledStr === "true") body.enabled = true;
+  else if (enabledStr === "false") body.enabled = false;
+  if (ctx.bool("autoRename")) body.autoRename = true;
+  return body;
+}
+var updateMcp = {
+  service: "agent",
+  command: "+update-mcp",
+  description: "Update an MCP server config (personal owner / company root / system read-only)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" },
+    { name: "name", type: "string", required: false, desc: "Server name (2-64 chars, letter start, [a-zA-Z0-9_-])" },
+    { name: "url", type: "string", required: false, desc: "MCP server URL (http:// or https:// only)" },
+    { name: "display-name", type: "string", required: false, desc: "Display name (max 100)" },
+    { name: "description", type: "string", required: false, desc: "Description (max 255)" },
+    { name: "transport", type: "string", required: false, desc: `Transport: ${UPDATE_TRANSPORTS.join(" | ")}` },
+    { name: "headers", type: "json", required: false, desc: "HTTP headers as JSON object" },
+    { name: "secret-headers", type: "json", required: false, desc: "Secret headers as JSON object (encrypted server-side)" },
+    { name: "auth-mode", type: "string", required: false, desc: `Auth mode: ${UPDATE_AUTH_MODES.join(" | ")}` },
+    { name: "enabled", type: "string", required: false, desc: "Set enabled state: true | false (omit to leave unchanged)" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on name conflict (default false)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name && !/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name)) {
+      throw new Error("--name must start with a letter and contain only letters, digits, _, or -");
+    }
+    const url = ctx.str("url");
+    if (url) {
+      try {
+        new URL(url);
+      } catch {
+        throw new Error("--url must be a valid URL");
+      }
+      if (!/^https?:\/\//i.test(url)) {
+        throw new Error("--url only supports http:// or https:// protocols");
+      }
+    }
+    const transport = ctx.str("transport");
+    if (transport && !UPDATE_TRANSPORTS.includes(transport)) {
+      throw new Error(`--transport must be one of: ${UPDATE_TRANSPORTS.join(", ")}`);
+    }
+    const authMode = ctx.str("authMode");
+    if (authMode && !UPDATE_AUTH_MODES.includes(authMode)) {
+      throw new Error(`--auth-mode must be one of: ${UPDATE_AUTH_MODES.join(", ")}`);
+    }
+    const enabledStr = ctx.str("enabled");
+    if (enabledStr && enabledStr !== "true" && enabledStr !== "false") {
+      throw new Error("--enabled must be true or false");
+    }
+    const body = buildUpdateBody(ctx);
+    if (Object.keys(body).length === 0) {
+      throw new Error("Provide at least one field to update: --name / --url / --display-name / --description / --transport / --headers / --secret-headers / --auth-mode / --enabled / --auto-rename");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}`,
+    body: buildUpdateBody(ctx)
+  }),
+  execute: async (ctx) => {
+    return patchToMainApp(
+      `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}`,
+      buildUpdateBody(ctx)
+    );
+  }
+};
+var mcpTools = {
+  service: "agent",
+  command: "+mcp-tools",
+  description: "List tools exposed by an MCP server (with OAuth auto-refresh)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/tools`
+  }),
+  execute: async (ctx) => {
+    return getFromMainApp(`${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/tools`);
+  }
+};
+var mcpAuthStart = {
+  service: "agent",
+  command: "+mcp-auth-start",
+  description: "Start MCP OAuth flow (CLI mode: get authorizeUrl, then poll +mcp-auth-status)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" },
+    { name: "redirect-after", type: "string", required: false, desc: "URL to redirect to after OAuth completes (must be same-origin as the service base URL)" },
+    { name: "cli", type: "boolean", required: false, default: true, desc: "CLI mode (always true on sandbox endpoint; server derives the callback URL)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/start`,
+    body: {
+      cliMode: true,
+      redirectAfter: ctx.str("redirectAfter") || void 0
+    }
+  }),
+  execute: async (ctx) => {
+    const result = await postToMainApp(
+      `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/start`,
+      {
+        redirectAfter: ctx.str("redirectAfter") || void 0
+      }
+    );
+    if (result?.authorizeUrl && (process.stderr.isTTY || process.stdout.isTTY)) {
+      const id = ctx.str("id");
+      process.stderr.write(
+        `
+\u8BF7\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00\u4EE5\u4E0B URL \u5B8C\u6210\u6388\u6743\uFF1A
+${result.authorizeUrl}
+
+\u6388\u6743\u5B8C\u6210\u540E\uFF0C\u8FD0\u884C\u4EE5\u4E0B\u547D\u4EE4\u8F6E\u8BE2\u6388\u6743\u72B6\u6001\uFF1A
+ae-cli agent +mcp-auth-status --id ${id}
+
+`
+      );
+    }
+    return result;
+  }
+};
+var mcpAuthStatus = {
+  service: "agent",
+  command: "+mcp-auth-status",
+  description: "Query MCP OAuth authorization status (CLI poll after +mcp-auth-start)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/status`
+  }),
+  execute: async (ctx) => {
+    return getFromMainApp(`${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/status`);
+  }
+};
+var mcpAuthDisconnect = {
+  service: "agent",
+  command: "+mcp-auth-disconnect",
+  description: "Disconnect MCP OAuth (clears token and disables the server)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/disconnect`
+  }),
+  execute: async (ctx) => {
+    return postToMainApp(
+      `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/disconnect`,
+      {}
+    );
+  }
+};
+var listMcpCredentials = {
+  service: "agent",
+  command: "+list-mcp-credentials",
+  description: "List per-user credentials for system MCP servers",
+  flags: [],
+  risk: "read",
+  dryRun: () => ({
+    method: "GET",
+    url: CRED_BASE_PATH
+  }),
+  execute: async () => {
+    return getFromMainApp(CRED_BASE_PATH);
+  }
+};
+var setMcpCredential = {
+  service: "agent",
+  command: "+set-mcp-credential",
+  description: "Upsert a per-user MCP credential (by mcpServerId + userId)",
+  flags: [
+    { name: "mcp-server-id", type: "string", required: true, desc: "System MCP server record ID (CUID)" },
+    { name: "auth-type", type: "string", required: false, default: "oauth", desc: `Auth type: ${CRED_AUTH_TYPES.join(" | ")}` },
+    { name: "token", type: "string", required: false, desc: "Token / API key (plaintext; encrypted server-side)" },
+    { name: "expires-at", type: "string", required: false, desc: "ISO 8601 datetime (e.g. 2026-12-31T23:59:59Z)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const authType = ctx.str("authType") || "oauth";
+    if (!CRED_AUTH_TYPES.includes(authType)) {
+      throw new Error(`--auth-type must be one of: ${CRED_AUTH_TYPES.join(", ")}`);
+    }
+    const expiresAt = ctx.str("expiresAt");
+    if (expiresAt) {
+      const d = new Date(expiresAt);
+      if (isNaN(d.getTime())) {
+        throw new Error("--expires-at must be a valid ISO 8601 datetime");
+      }
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: CRED_BASE_PATH,
+    body: {
+      mcpServerId: ctx.str("mcpServerId"),
+      authType: ctx.str("authType") || "oauth",
+      token: ctx.str("token") || void 0,
+      expiresAt: ctx.str("expiresAt") || void 0
+    }
+  }),
+  execute: async (ctx) => {
+    return postToMainApp(CRED_BASE_PATH, {
+      mcpServerId: ctx.str("mcpServerId"),
+      authType: ctx.str("authType") || "oauth",
+      token: ctx.str("token") || void 0,
+      expiresAt: ctx.str("expiresAt") || void 0
+    });
+  }
+};
+var autoProvisionMcpCredentials = {
+  service: "agent",
+  command: "+auto-provision-mcp-credentials",
+  description: "Auto-provision credentials for all system MCP servers using the current access token",
+  flags: [
+    { name: "access-token", type: "string", required: false, desc: "Access token (defaults to the current session token from ctx.token())" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${CRED_BASE_PATH}/auto-provision`,
+    body: {
+      accessToken: ctx.str("accessToken") || "<current-session-token>"
+    }
+  }),
+  execute: async (ctx) => {
+    const accessToken = ctx.str("accessToken") || await ctx.token();
+    return postToMainApp(`${CRED_BASE_PATH}/auto-provision`, { accessToken });
+  }
+};
+var mcpToken = {
+  service: "agent",
+  command: "+mcp-token",
+  description: "Get the plaintext MCP token (for useMcpToken=true system MCP servers)",
+  flags: [],
+  risk: "read",
+  dryRun: () => ({
+    method: "GET",
+    url: `${CRED_BASE_PATH}/mcp-token`
+  }),
+  execute: async (ctx) => {
+    const result = await getFromMainApp(`${CRED_BASE_PATH}/mcp-token`);
+    if (process.stderr.isTTY) {
+      process.stderr.write(
+        `
+\u6CE8\u610F\uFF1A\u8FD4\u56DE\u660E\u6587 MCP Token\uFF0C\u8BF7\u59A5\u5584\u4FDD\u7BA1\uFF0C\u907F\u514D\u5199\u5165 shell history \u6216\u65E5\u5FD7\u3002
+
+`
+      );
+    }
+    return result;
+  }
+};
+var mcpStats = {
+  service: "agent",
+  command: "+mcp-stats",
+  description: "Show MCP call statistics for the last N days (by server / by day)",
+  flags: [
+    { name: "days", type: "number", required: false, default: 30, desc: "Lookback window in days (1-365, default 30)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const days = ctx.optionalNum("days");
+    if (days !== void 0 && (!Number.isInteger(days) || days < 1 || days > 365)) {
+      throw new Error("--days must be an integer between 1 and 365");
+    }
+  },
+  dryRun: (ctx) => {
+    const days = ctx.optionalNum("days") ?? 30;
+    return { method: "GET", url: `${STATS_PATH}?days=${days}` };
+  },
+  execute: async (ctx) => {
+    const days = ctx.optionalNum("days") ?? 30;
+    return getFromMainApp(`${STATS_PATH}?days=${days}`);
+  }
+};
 
 // src/commands/te-agent/skills.ts
 var BASE_PATH4 = "/api/sandbox/agent/skills";
-var MARKET_BASE_PATH2 = "/api/skills";
+var MARKET_BASE_PATH2 = "/api/sandbox/agent/skills";
 function buildMetaBody2(ctx) {
   const body = {};
   const category = ctx.str("category");
@@ -475,7 +1103,7 @@ function buildMetaBody2(ctx) {
   if (iconColor) body.iconColor = iconColor;
   return Object.keys(body).length > 0 ? body : null;
 }
-async function resolveInstructions(raw) {
+async function resolveInstructions2(raw) {
   if (raw === "@-") {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -515,7 +1143,7 @@ var listSkills = {
 var addSkill = {
   service: "agent",
   command: "+add-skill",
-  description: "Create a custom Skill (personal scope)",
+  description: "Create a custom Skill (personal or company scope)",
   flags: [
     { name: "name", type: "string", required: true, desc: "Skill name (1-80 chars)" },
     { name: "description", type: "string", required: true, desc: "Skill description" },
@@ -523,7 +1151,8 @@ var addSkill = {
     { name: "display-name", type: "string", required: false, desc: "Display name (max 100)" },
     { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
     { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
-    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Target scope: personal | company" }
   ],
   risk: "write",
   validate: (ctx) => {
@@ -535,25 +1164,31 @@ var addSkill = {
     if (category && !isValidMarketCategory(category)) {
       throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
     }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
   },
   dryRun: (ctx) => {
     const body = {
       name: ctx.str("name"),
       description: ctx.str("description"),
       instructions: ctx.str("instructions") === "@-" ? "(from stdin)" : ctx.str("instructions"),
-      displayName: ctx.str("displayName") || void 0
+      displayName: ctx.str("displayName") || void 0,
+      scope: ctx.str("scope") || "personal"
     };
     const meta = buildMetaBody2(ctx);
     if (meta) body._meta = meta;
     return { method: "POST", url: BASE_PATH4, body };
   },
   execute: async (ctx) => {
-    const instructions = await resolveInstructions(ctx.str("instructions"));
+    const instructions = await resolveInstructions2(ctx.str("instructions"));
     const created = await postToMainApp(BASE_PATH4, {
       name: ctx.str("name"),
       description: ctx.str("description"),
       instructions,
-      displayName: ctx.str("displayName") || void 0
+      displayName: ctx.str("displayName") || void 0,
+      scope: ctx.str("scope") || "personal"
     });
     const id = created?.item?.id;
     const meta = buildMetaBody2(ctx);
@@ -702,8 +1337,409 @@ var copySkill = {
   }
 };
 
+// src/commands/te-agent/skill-content.ts
+import { readFileSync, existsSync, writeFileSync } from "fs";
+import { resolve, basename, extname } from "path";
+var BASE_PATH5 = "/api/sandbox/agent/skills";
+async function resolveInstructions3(raw) {
+  if (raw === "@-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (!text) throw new Error("stdin is empty; cannot read instructions");
+    return text;
+  }
+  return raw;
+}
+function readFileForUpload(filePath) {
+  const resolved = resolve(filePath);
+  if (!existsSync(resolved)) {
+    throw new Error(`File not found: ${resolved}`);
+  }
+  const buffer = readFileSync(resolved);
+  const fileName = basename(resolved);
+  const mimeType = guessMimeType(resolved);
+  return { buffer, fileName, mimeType };
+}
+function guessMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  const map = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".md": "text/markdown",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".xml": "application/xml",
+    ".doc": "application/msword",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xls": "application/vnd.ms-excel",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    ".zip": "application/zip"
+  };
+  return map[ext] || "application/octet-stream";
+}
+function buildAssetFormData(filePath, subPath) {
+  const { buffer, fileName, mimeType } = readFileForUpload(filePath);
+  const fd = new FormData();
+  const blob = new Blob([new Uint8Array(buffer)], { type: mimeType });
+  fd.append("file", blob, fileName);
+  if (subPath) fd.append("subPath", subPath);
+  return fd;
+}
+function makeAssetListCommand(commandName, description, dirName) {
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      { name: "id", type: "string", required: true, desc: "Skill record ID (CUID)" }
+    ],
+    risk: "read",
+    dryRun: (ctx) => ({
+      method: "GET",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`
+    }),
+    execute: async (ctx) => {
+      return getFromMainApp(
+        `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`
+      );
+    }
+  };
+}
+function makeAssetUploadCommand(commandName, description, dirName, mdOnly) {
+  const validate = (ctx) => {
+    const filePath = ctx.str("file");
+    if (!filePath) throw new Error("--file is required");
+    if (!existsSync(resolve(filePath))) throw new Error(`File not found: ${resolve(filePath)}`);
+    if (mdOnly) {
+      const ext = extname(filePath).toLowerCase();
+      if (ext !== ".md") throw new Error("--file must be a .md file for references");
+    }
+  };
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      { name: "id", type: "string", required: true, desc: "Skill record ID (CUID)" },
+      { name: "file", type: "string", required: true, desc: mdOnly ? "Local .md file path to upload" : "Local file path to upload (max 1MB)" },
+      { name: "sub-path", type: "string", required: false, desc: 'Sub-directory under the target dir (e.g. "sub/")' }
+    ],
+    risk: "write",
+    validate,
+    dryRun: (ctx) => ({
+      method: "POST",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`,
+      body: { file: ctx.str("file"), subPath: ctx.str("subPath") || "" }
+    }),
+    execute: async (ctx) => {
+      const fd = buildAssetFormData(ctx.str("file"), ctx.str("subPath") || void 0);
+      return uploadToMainApp(
+        `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`,
+        fd
+      );
+    }
+  };
+}
+function makeAssetReadCommand(commandName, description, dirName) {
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      { name: "id", type: "string", required: true, desc: "Skill record ID (CUID)" },
+      { name: "path", type: "string", required: true, desc: 'Relative file path within the directory (e.g. "guide.md" or "sub/icon.png")' },
+      { name: "output", type: "string", required: false, desc: "Write binary content to a local file (preserves binary data)" }
+    ],
+    risk: "read",
+    dryRun: (ctx) => ({
+      method: "GET",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodeURIComponent(ctx.str("path"))}`
+    }),
+    execute: async (ctx) => {
+      const filePath = ctx.str("path");
+      const encodedPath = filePath.split("/").map((seg) => encodeURIComponent(seg)).join("/");
+      const url = `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodedPath}`;
+      const { buffer, fileName } = await getBufferFromMainApp(url);
+      const outputPath = ctx.str("output");
+      if (outputPath) {
+        const resolved = resolve(outputPath);
+        writeFileSync(resolved, buffer);
+        return { saved: true, path: resolved, size: buffer.length, fileName };
+      }
+      const content = buffer.toString("utf8");
+      return { content, fileName };
+    }
+  };
+}
+function makeAssetDelCommand(commandName, description, dirName) {
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      { name: "id", type: "string", required: true, desc: "Skill record ID (CUID)" },
+      { name: "path", type: "string", required: true, desc: "Relative file path within the directory to delete" }
+    ],
+    risk: "write",
+    dryRun: (ctx) => ({
+      method: "DELETE",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodeURIComponent(ctx.str("path"))}`
+    }),
+    execute: async (ctx) => {
+      const filePath = ctx.str("path");
+      const encodedPath = filePath.split("/").map((seg) => encodeURIComponent(seg)).join("/");
+      return deleteFromMainApp(
+        `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodedPath}`
+      );
+    }
+  };
+}
+var editSkill = {
+  service: "agent",
+  command: "+edit-skill",
+  description: "Edit a personal Skill content (name / description / instructions / icon)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Skill record ID (CUID)" },
+    { name: "name", type: "string", required: false, desc: "New Skill name (1-80 chars)" },
+    { name: "description", type: "string", required: false, desc: "New Skill description" },
+    { name: "instructions", type: "string", required: false, desc: "New instructions (use @- to read from stdin)" },
+    { name: "display-name", type: "string", required: false, desc: "New display name (max 100)" },
+    { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name && (name.length < 1 || name.length > 80)) {
+      throw new Error("--name length must be between 1 and 80");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const hasAny = ctx.str("name") || ctx.str("description") || ctx.str("instructions") || ctx.str("displayName") || ctx.str("category") || ctx.str("iconEmoji") || ctx.str("iconColor");
+    if (!hasAny) {
+      throw new Error("Provide at least one of --name / --description / --instructions / --display-name / --category / --icon-emoji / --icon-color");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {};
+    if (ctx.str("name")) body.name = ctx.str("name");
+    if (ctx.str("description")) body.description = ctx.str("description");
+    body.instructions = ctx.str("instructions") === "@-" ? "(from stdin)" : ctx.str("instructions") || void 0;
+    if (ctx.str("displayName")) body.displayName = ctx.str("displayName");
+    if (ctx.str("category")) body.category = ctx.str("category");
+    if (ctx.str("iconEmoji")) body.iconEmoji = ctx.str("iconEmoji");
+    if (ctx.str("iconColor")) body.iconColor = ctx.str("iconColor");
+    return {
+      method: "PUT",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}`,
+      body
+    };
+  },
+  execute: async (ctx) => {
+    const body = {};
+    if (ctx.str("name")) body.name = ctx.str("name");
+    if (ctx.str("description")) body.description = ctx.str("description");
+    if (ctx.str("instructions")) {
+      body.instructions = await resolveInstructions3(ctx.str("instructions"));
+    }
+    if (ctx.str("displayName")) body.displayName = ctx.str("displayName");
+    if (ctx.str("category")) body.category = ctx.str("category");
+    if (ctx.str("iconEmoji")) body.iconEmoji = ctx.str("iconEmoji");
+    if (ctx.str("iconColor")) body.iconColor = ctx.str("iconColor");
+    return putToMainApp(`${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}`, body);
+  }
+};
+var getSkillContent = {
+  service: "agent",
+  command: "+get-skill-content",
+  description: "Read a Skill SKILL.md text content",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Skill record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/content`
+  }),
+  execute: async (ctx) => {
+    return getFromMainApp(
+      `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/content`
+    );
+  }
+};
+var listSkillAssets = makeAssetListCommand(
+  "+list-skill-assets",
+  "List all files in a Skill assets directory",
+  "assets"
+);
+var uploadSkillAsset = makeAssetUploadCommand(
+  "+upload-skill-asset",
+  "Upload a single file to a Skill assets directory (max 1MB)",
+  "assets",
+  false
+);
+var readSkillAsset = makeAssetReadCommand(
+  "+read-skill-asset",
+  "Read a Skill asset file (binary-safe; use --output to save to disk)",
+  "assets"
+);
+var delSkillAsset = makeAssetDelCommand(
+  "+del-skill-asset",
+  "Delete a file from a Skill assets directory",
+  "assets"
+);
+var listSkillReferences = makeAssetListCommand(
+  "+list-skill-references",
+  "List all .md files in a Skill references directory",
+  "references"
+);
+var uploadSkillReference = makeAssetUploadCommand(
+  "+upload-skill-reference",
+  "Upload a single .md file to a Skill references directory (max 1MB)",
+  "references",
+  true
+);
+var readSkillReference = makeAssetReadCommand(
+  "+read-skill-reference",
+  "Read a Skill reference .md file (binary-safe; use --output to save to disk)",
+  "references"
+);
+var delSkillReference = makeAssetDelCommand(
+  "+del-skill-reference",
+  "Delete a file from a Skill references directory",
+  "references"
+);
+var listSkillScripts = makeAssetListCommand(
+  "+list-skill-scripts",
+  "List all files in a Skill scripts directory",
+  "scripts"
+);
+var uploadSkillScript = makeAssetUploadCommand(
+  "+upload-skill-script",
+  "Upload a single file to a Skill scripts directory (max 1MB)",
+  "scripts",
+  false
+);
+var readSkillScript = makeAssetReadCommand(
+  "+read-skill-script",
+  "Read a Skill script file (binary-safe; use --output to save to disk)",
+  "scripts"
+);
+var delSkillScript = makeAssetDelCommand(
+  "+del-skill-script",
+  "Delete a file from a Skill scripts directory",
+  "scripts"
+);
+var uploadSkill = {
+  service: "agent",
+  command: "+upload-skill",
+  description: "Upload a ZIP-format Skill (parses SKILL.md + extracts to target dir)",
+  flags: [
+    { name: "file", type: "string", required: true, desc: "Local .zip file path" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Target scope: personal | company" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on name conflict" },
+    { name: "replace-skill-id", type: "string", required: false, desc: "Replace an existing Skill (CUID) instead of creating a new one" },
+    { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "name", type: "string", required: false, desc: "Override Skill name (from ZIP SKILL.md if omitted)" },
+    { name: "display-name", type: "string", required: false, desc: "Override display name" },
+    { name: "description", type: "string", required: false, desc: "Override description" },
+    { name: "instructions", type: "string", required: false, desc: "Override instructions (use @- to read from stdin)" },
+    { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const filePath = ctx.str("file");
+    if (!filePath) throw new Error("--file is required");
+    const resolved = resolve(filePath);
+    if (!existsSync(resolved)) throw new Error(`File not found: ${resolved}`);
+    const ext = extname(resolved).toLowerCase();
+    if (ext !== ".zip") throw new Error("--file must be a .zip file");
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      file: ctx.str("file"),
+      scope: ctx.str("scope") || "personal"
+    };
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    if (ctx.str("replaceSkillId")) body.replaceSkillId = ctx.str("replaceSkillId");
+    if (ctx.str("category")) body.category = ctx.str("category");
+    if (ctx.str("name")) body.name = ctx.str("name");
+    if (ctx.str("displayName")) body.displayName = ctx.str("displayName");
+    if (ctx.str("description")) body.description = ctx.str("description");
+    if (ctx.str("instructions")) body.instructions = ctx.str("instructions") === "@-" ? "(from stdin)" : ctx.str("instructions");
+    if (ctx.str("iconEmoji")) body.iconEmoji = ctx.str("iconEmoji");
+    if (ctx.str("iconColor")) body.iconColor = ctx.str("iconColor");
+    return {
+      method: "POST",
+      url: `${BASE_PATH5}/upload`,
+      body
+    };
+  },
+  execute: async (ctx) => {
+    const filePath = ctx.str("file");
+    const resolved = resolve(filePath);
+    const buffer = readFileSync(resolved);
+    const fileName = basename(resolved);
+    const fd = new FormData();
+    const blob = new Blob([new Uint8Array(buffer)], { type: "application/zip" });
+    fd.append("file", blob, fileName);
+    const scope = ctx.str("scope") || "personal";
+    fd.append("scope", scope);
+    if (ctx.bool("autoRename")) fd.append("autoRename", "true");
+    if (ctx.str("replaceSkillId")) fd.append("replaceSkillId", ctx.str("replaceSkillId"));
+    if (ctx.str("category")) fd.append("category", ctx.str("category"));
+    if (ctx.str("name")) fd.append("name", ctx.str("name"));
+    if (ctx.str("displayName")) fd.append("displayName", ctx.str("displayName"));
+    if (ctx.str("description")) fd.append("description", ctx.str("description"));
+    if (ctx.str("instructions")) {
+      const instructions = await resolveInstructions3(ctx.str("instructions"));
+      fd.append("instructions", instructions);
+    }
+    if (ctx.str("iconEmoji")) fd.append("iconEmoji", ctx.str("iconEmoji"));
+    if (ctx.str("iconColor")) fd.append("iconColor", ctx.str("iconColor"));
+    return uploadToMainApp(`${BASE_PATH5}/upload`, fd);
+  }
+};
+var rescanSkills = {
+  service: "agent",
+  command: "+rescan-skills",
+  description: "Rescan Skill files and sync to database (root only)",
+  flags: [],
+  risk: "write",
+  dryRun: () => ({
+    method: "POST",
+    url: `${BASE_PATH5}/rescan`
+  }),
+  execute: async () => {
+    return postToMainApp(`${BASE_PATH5}/rescan`, {});
+  }
+};
+
 // src/commands/te-agent/skill-approvals.ts
-var BASE = "/api/skills";
+var BASE = "/api/sandbox/agent/skills";
 var submitSkill = {
   service: "agent",
   command: "+submit-skill",
@@ -843,7 +1879,7 @@ var rejectSkill = {
 };
 
 // src/commands/te-agent/skill-shares.ts
-var BASE2 = "/api/skills";
+var BASE2 = "/api/sandbox/agent/skills";
 var shareSkill = {
   service: "agent",
   command: "+share-skill",
@@ -955,12 +1991,13 @@ var rejectSkillShare = {
 };
 
 // src/commands/te-agent/attachments.ts
-import { readFileSync, existsSync } from "fs";
-import { resolve, basename, extname } from "path";
-var LIST_PATH2 = "/api/sandbox/agent/attachments";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { resolve as resolve2, basename as basename2, extname as extname2 } from "path";
+var LIST_PATH = "/api/sandbox/agent/attachments";
 var UPLOAD_PATH = "/api/sandbox/agent/attachments/upload";
-function guessMimeType(filePath) {
-  const ext = extname(filePath).toLowerCase();
+var STATS_PATH2 = "/api/sandbox/agent/attachments/stats";
+function guessMimeType2(filePath) {
+  const ext = extname2(filePath).toLowerCase();
   const map = {
     ".png": "image/png",
     ".jpg": "image/jpeg",
@@ -1009,14 +2046,14 @@ function resolveFilePaths(ctx) {
 async function uploadFiles(filePaths) {
   const formData = new FormData();
   for (const filePath of filePaths) {
-    const resolved = resolve(filePath);
-    if (!existsSync(resolved)) {
+    const resolved = resolve2(filePath);
+    if (!existsSync2(resolved)) {
       throw new Error(`File not found: ${resolved}`);
     }
-    const buffer = readFileSync(resolved);
-    const mimeType = guessMimeType(resolved);
+    const buffer = readFileSync2(resolved);
+    const mimeType = guessMimeType2(resolved);
     const blob = new Blob([buffer], { type: mimeType });
-    formData.append("file", blob, basename(resolved));
+    formData.append("file", blob, basename2(resolved));
   }
   return uploadToMainApp(UPLOAD_PATH, formData);
 }
@@ -1044,7 +2081,7 @@ var listAttachments = {
     if (ctx.num("page")) params.set("page", String(ctx.num("page")));
     if (ctx.num("pageSize")) params.set("pageSize", String(ctx.num("pageSize")));
     const qs = params.toString();
-    return { method: "GET", url: `${LIST_PATH2}${qs ? "?" + qs : ""}` };
+    return { method: "GET", url: `${LIST_PATH}${qs ? "?" + qs : ""}` };
   },
   execute: async (ctx) => {
     const params = new URLSearchParams();
@@ -1053,7 +2090,7 @@ var listAttachments = {
     if (ctx.num("page")) params.set("page", String(ctx.num("page")));
     if (ctx.num("pageSize")) params.set("pageSize", String(ctx.num("pageSize")));
     const qs = params.toString();
-    return getFromMainApp(`${LIST_PATH2}${qs ? "?" + qs : ""}`);
+    return getFromMainApp(`${LIST_PATH}${qs ? "?" + qs : ""}`);
   }
 };
 var addAttachment = {
@@ -1087,15 +2124,29 @@ var delAttachment = {
   risk: "write",
   dryRun: (ctx) => ({
     method: "DELETE",
-    url: `${LIST_PATH2}?id=${encodeURIComponent(ctx.str("id"))}`
+    url: `${LIST_PATH}?id=${encodeURIComponent(ctx.str("id"))}`
   }),
   execute: async (ctx) => {
-    return deleteFromMainApp(`${LIST_PATH2}?id=${encodeURIComponent(ctx.str("id"))}`);
+    return deleteFromMainApp(`${LIST_PATH}?id=${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+var attachmentStats = {
+  service: "agent",
+  command: "+attachment-stats",
+  description: "Show attachment library statistics (total files, size, images, documents)",
+  flags: [],
+  risk: "read",
+  dryRun: () => ({
+    method: "GET",
+    url: STATS_PATH2
+  }),
+  execute: async () => {
+    return getFromMainApp(STATS_PATH2);
   }
 };
 
 // src/commands/te-agent/automations.ts
-var BASE_PATH5 = "/api/sandbox/agent/automations";
+var BASE_PATH6 = "/api/sandbox/agent/automations";
 var SCHEDULE_KINDS = ["hourly", "daily", "weekly", "monthly"];
 var TIME_RE = /^([01]\d|2[0-3]):([0-5]\d)$/;
 var AUTOMATION_STATUSES = ["active", "paused"];
@@ -1208,7 +2259,7 @@ function buildListPath(ctx) {
   if (status) params.set("status", status);
   if (limit) params.set("limit", String(ctx.num("limit")));
   const query = params.toString();
-  return query ? `${BASE_PATH5}?${query}` : BASE_PATH5;
+  return query ? `${BASE_PATH6}?${query}` : BASE_PATH6;
 }
 function validateList(ctx) {
   const status = optional(ctx.str("status"));
@@ -1222,7 +2273,7 @@ function validateList(ctx) {
     }
   }
 }
-function buildUpdateBody(ctx) {
+function buildUpdateBody2(ctx) {
   const enabled = readEnabledOptional(ctx);
   const body = {};
   const name = optional(ctx.str("name"));
@@ -1238,7 +2289,7 @@ function buildUpdateBody(ctx) {
 }
 function validateUpdate(ctx) {
   validateSchedule(ctx, false);
-  if (!Object.keys(buildUpdateBody(ctx)).length) {
+  if (!Object.keys(buildUpdateBody2(ctx)).length) {
     throw new Error("\u81F3\u5C11\u63D0\u4F9B\u4E00\u4E2A\u66F4\u65B0\u5B57\u6BB5");
   }
 }
@@ -1370,10 +2421,10 @@ var createAutomation = {
   },
   dryRun: (ctx) => ({
     method: "POST",
-    url: BASE_PATH5,
+    url: BASE_PATH6,
     body: buildCreateBody(ctx)
   }),
-  execute: async (ctx) => postToMainApp(BASE_PATH5, buildCreateBody(ctx))
+  execute: async (ctx) => postToMainApp(BASE_PATH6, buildCreateBody(ctx))
 };
 var updateAutomation = {
   service: "agent",
@@ -1410,31 +2461,47 @@ var updateAutomation = {
   validate: validateUpdate,
   dryRun: (ctx) => ({
     method: "PATCH",
-    url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}`,
-    body: buildUpdateBody(ctx)
+    url: `${BASE_PATH6}/${encodeURIComponent(ctx.str("id"))}`,
+    body: buildUpdateBody2(ctx)
   }),
   execute: async (ctx) => patchToMainApp(
-    `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}`,
-    buildUpdateBody(ctx)
+    `${BASE_PATH6}/${encodeURIComponent(ctx.str("id"))}`,
+    buildUpdateBody2(ctx)
   )
 };
 
 // src/commands/te-agent/index.ts
 var commands = [
-  // Agent query
+  // Agent CRUD
   listAgents,
-  // Model management
+  createAgent,
+  updateAgent,
+  delAgent,
+  getAgent,
+  // Model management + test
   listModels,
   addModel,
   delModel,
   toggleModel,
-  // MCP server management + market
+  updateModel,
+  testModel,
+  // MCP server management + market + OAuth + credentials
   listMcps,
   addMcp,
   delMcp,
   toggleMcp,
   listMcpMarket,
   setMcpMeta,
+  updateMcp,
+  mcpTools,
+  mcpAuthStart,
+  mcpAuthStatus,
+  mcpAuthDisconnect,
+  listMcpCredentials,
+  setMcpCredential,
+  autoProvisionMcpCredentials,
+  mcpToken,
+  mcpStats,
   // Skill management + market + copy
   listSkills,
   addSkill,
@@ -1443,6 +2510,23 @@ var commands = [
   listSkillMarket,
   setSkillMeta,
   copySkill,
+  // Skill content + assets (references / assets / scripts)
+  editSkill,
+  getSkillContent,
+  listSkillAssets,
+  uploadSkillAsset,
+  readSkillAsset,
+  delSkillAsset,
+  listSkillReferences,
+  uploadSkillReference,
+  readSkillReference,
+  delSkillReference,
+  listSkillScripts,
+  uploadSkillScript,
+  readSkillScript,
+  delSkillScript,
+  uploadSkill,
+  rescanSkills,
   // Skill approval (company-scope publish)
   submitSkill,
   listSkillSubmissions,
@@ -1458,6 +2542,7 @@ var commands = [
   listAttachments,
   addAttachment,
   delAttachment,
+  attachmentStats,
   // Automate tasks
   listAutomations,
   createAutomation,