@thinkingai/ae-cli 6.0.28 → 6.0.29

package/skills/ae-analysis/references/virtual_event_delete.md

@@ -1,4 +1,4 @@
-# analysis virtual-event delete
+# analysis-meta virtual-event delete
 
 Use when the user needs to delete a virtual event rule.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis virtual-event delete --project-id <project_id> --v-event-id <v_event_id>
-ae-cli analysis virtual-event delete --dry-run
+ae-cli analysis-meta virtual-event delete --project-id <project_id> --v-event-id <v_event_id>
+ae-cli analysis-meta virtual-event delete --dry-run
 ```
 
 Capability id: `metadata.virtual_event.delete`.

package/skills/ae-analysis/references/virtual_event_get.md

@@ -1,4 +1,4 @@
-# analysis virtual-event get
+# analysis-meta virtual-event get
 
 Use when the user needs to get virtual event rule.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis virtual-event get --project-id <project_id> --v-event-id <v_event_id>
-ae-cli analysis virtual-event get --dry-run
+ae-cli analysis-meta virtual-event get --project-id <project_id> --v-event-id <v_event_id>
+ae-cli analysis-meta virtual-event get --dry-run
 ```
 
 Capability id: `metadata.virtual_event.get`.

package/skills/ae-analysis/references/virtual_property_create.md

@@ -1,4 +1,4 @@
-# analysis virtual-property create
+# analysis-meta virtual-property create
 
 Use when the user needs to create a SQL virtual event or user property.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis virtual-property create --project-id <project_id> --payload '{}'
-ae-cli analysis virtual-property create --dry-run
+ae-cli analysis-meta virtual-property create --project-id <project_id> --payload '{}'
+ae-cli analysis-meta virtual-property create --dry-run
 ```
 
 Capability id: `metadata.virtual_property.create`.

package/skills/ae-analysis/references/virtual_property_sql_rule_delete.md

@@ -1,4 +1,4 @@
-# analysis virtual-property sql-rule-delete
+# analysis-meta virtual-property sql-rule-delete
 
 Use when the user needs to delete or revoke SQL virtual property rule.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis virtual-property sql-rule-delete --project-id <project_id> --v-prop-id <v_prop_id> --operation <operation>
-ae-cli analysis virtual-property sql-rule-delete --dry-run
+ae-cli analysis-meta virtual-property sql-rule-delete --project-id <project_id> --v-prop-id <v_prop_id> --operation <operation>
+ae-cli analysis-meta virtual-property sql-rule-delete --dry-run
 ```
 
 Capability id: `metadata.virtual_property.sql_rule_delete`.

package/skills/ae-analysis/references/virtual_property_sql_rule_update.md

@@ -1,4 +1,4 @@
-# analysis virtual-property sql-rule-update
+# analysis-meta virtual-property sql-rule-update
 
 Use when the user needs to update SQL virtual property rule.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis virtual-property sql-rule-update --project-id <project_id> --payload '{}'
-ae-cli analysis virtual-property sql-rule-update --dry-run
+ae-cli analysis-meta virtual-property sql-rule-update --project-id <project_id> --payload '{}'
+ae-cli analysis-meta virtual-property sql-rule-update --dry-run
 ```
 
 Capability id: `metadata.virtual_property.sql_rule_update`.

package/skills/ae-capability/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: ae-capability
+version: 1.2.0
+description: "AE/TE capability gateway discovery and generic invocation with ae-cli. Use when the user needs to list or search available capabilities, inspect an unknown capability schema/risk/auth contract, dry-run a capability, or invoke a long-tail capability that has no curated ae-cli command. Always discover and inspect before composing input; never guess capability IDs or input fields."
+---
+
+# ae-capability
+
+Use this skill for progressive capability discovery and generic gateway invocation. Prefer a domain-specific curated command when one exists; use `ae-cli capability ...` for discovery and long-tail capabilities.
+
+## Decision Order
+
+1. Use a domain skill and its curated command when it directly covers the task.
+2. Otherwise search the capability catalog.
+3. Inspect the selected capability before constructing input.
+4. Dry-run with real input when helpful.
+5. Run after dry-run succeeds; obtain chat confirmation only for delete capabilities.
+
+Never guess a capability ID, input field, enum value, resource ID, or project ID.
+
+## Skill references
+
+Default: **do not** create a standalone skill reference for every new capability. Use `search` → `inspect` → `dry-run` → `run`; catalog `description`, `risk`, and `inspect` `input_schema` are the contract.
+
+Create or keep a standalone reference only when at least one applies: L2 hard bar, easily confused with neighbors, `high-risk-write` delete workflow, or multi-step orchestration. Domain skills may inline one-line summaries in overview matrices (e.g. `analysis_gateway_assets.md`). See [`capability-command-admission` §10](../../docs/capability-command-admission.md).
+
+## Commands
+
+```bash
+# List summaries for one capability namespace.
+ae-cli capability list --domain <domain>
+
+# Search capability IDs and descriptions. All terms must match.
+ae-cli capability search "<terms>" --domain <domain>
+
+# Read input_schema, risk, auth, output, and dry-run support.
+ae-cli capability inspect <capability-id>
+
+# Validate and preview input without execution.
+ae-cli capability dry-run <capability-id> --input '<json-object>'
+
+# Execute after inspection (and dry-run when input is non-trivial).
+ae-cli capability run <capability-id> --input '<json-object>'
+```
+
+`--input` accepts:
+
+- An inline JSON object.
+- A JSON file path.
+- `@<path>`.
+- `-` to read JSON from stdin.
+
+The capability namespace is inferred from `<capability-id>` for `inspect`, `dry-run`, and `run`. Use `--domain <domain>` only to override routing.
+
+## Risk Levels (aligned with lark-cli)
+
+| `risk` | Meaning | Chat confirmation before `run`? | CLI `[y/N]` without `--yes`? |
+| --- | --- | --- | --- |
+| `read` | Query / list / inspect | No | No |
+| `write` | Create, update, share, and other ordinary writes | No | No |
+| `high-risk-write` | Delete or remove resources | **Yes** | **Yes** |
+
+Legacy values such as `create`, `update`, or `delete` are normalized to this three-tier model (`delete` → `high-risk-write`; `create`/`update` → `write`).
+
+## Safety
+
+- `list`, `search`, `inspect`, and `dry-run` never execute business mutations.
+- `capability run` inspects metadata before execution when `--yes` is absent.
+- Only `high-risk-write` requires chat confirmation before `capability run ... --yes`.
+- `read` and `write` may run directly after inspect/dry-run.
+- Use `--yes` on delete runs only after the user explicitly authorizes execution in chat.
+- Global `--dry-run` on `capability run` calls the gateway dry-run endpoint instead of execute.
+
+## High-Risk Confirmation Workflow (Agent)
+
+Applies only when `inspect` shows `risk=high-risk-write`.
+
+User intent (for example "delete this space") is **not** execution authorization. Do not pass `--yes` just because the user stated the desired action.
+
+1. Run `capability inspect` and `capability dry-run` with the final input.
+2. **Stop in the same turn.** Do not call `capability run` in the same turn as dry-run.
+3. Summarize in chat: capability ID, `project_id`, key input fields, and `risk=high-risk-write`.
+4. Ask the user to confirm execution. Prefer `AskUserQuestion` when that tool is available; otherwise ask in plain text and wait for the user's **next message**.
+5. Only after the user replies with explicit authorization (for example `confirm`, `execute`, or `yes`) run `capability run ... --yes` with the same input as dry-run.
+
+For `risk=write`, run directly after a successful dry-run; no chat confirmation gate.
+
+Never pass `--yes` on the first delete attempt. CLI terminal `[y/N]` prompts do not work in Agent Bash; chat confirmation is the real gate for `high-risk-write`.
+
+## Output
+
+- `list` returns `{ domain, count, capabilities }`.
+- `search` returns `{ domain, query, count, capabilities }`.
+- `inspect`, `dry-run`, and `run` return gateway data in the standard ae-cli envelope.
+
+## Examples
+
+```bash
+ae-cli capability search "dashboard list" --domain analysis
+ae-cli capability inspect analysis.dashboard.list
+ae-cli capability dry-run analysis.dashboard.list --input '{"project_id":1}'
+ae-cli capability run analysis.dashboard.list --input input.json
+```

package/skills/ae-community/SKILL.md

@@ -214,4 +214,4 @@ Structured multi-step reports (MCP tool chains) — open the linked reference fo
 
 ## Write operations
 
-Most community commands are **read-only**. If new write-capable commands are added later, confirm user intent and use `--yes` where the CLI marks **`risk: write`**.
+Most community commands are **read-only**. If new write-capable commands are added later, confirm user intent and use `--yes` where the CLI marks **`risk: high-risk-write`**.

package/skills/ae-dataops/references/dataops-integration.md

@@ -236,10 +236,10 @@ ae-cli dataops_integration +stop_sync_solution --spaceCode "${spaceCode}" \
 - **Datasource component template**: `+get_datasource_component_template` requires only `--componentName`. It returns component metadata, `requiredFields`, `optionalFields`, `envJsonExampleObject`, and `importantNotes`.
 - **Datasource list**: `+list_space_datasources` requires `--spaceCode`; `--datasourceName` and `--componentName` are optional filters. It returns datasource summary fields including `datasourceId`, `dataSourceComponentName`, `dataSourceName`, `dataSourceRemark`, `dataSourceStatus`, `connectStatus`, `syncTaskNum`, and `sharedConfig`.
 - **Datasource detail**: `+get_datasource_detail` requires `--spaceCode` and `--datasourceName`. It returns `datasourceId`, `dataSourceComponentName`, `dataSourceName`, `dataSourceRemark`, `dataSourceStatus`, `connectStatus`, `syncTaskNum`, `sharedConfig`, masked `connectConfig`, `connectFails`, and `lastConnectTime`.
-- **Datasource creation**: `+add_datasource` creates directly after the CLI write confirmation. `envJsonList` must be a JSON array string using keys from the component template `requiredFields`; `sharedConfig=true` uses one config for DEV/PROD, while `sharedConfig=false` requires two configs (DEV, PROD).
+- **Datasource creation**: `+add_datasource` creates directly (`risk: write`, no CLI confirmation). `envJsonList` must be a JSON array string using keys from the component template `requiredFields`; `sharedConfig=true` uses one config for DEV/PROD, while `sharedConfig=false` requires two configs (DEV, PROD).
 - **Datasource connection test**: `+test_datasource_connect` requires `--spaceCode` and `--datasourceName`. It tests the saved datasource config and returns `datasourceName`, `connectStatus`, `connectFails`, `lastConnectTime`, and `nextAction`.
-- **Datasource modification**: `+modify_datasource` creates no preview; it updates only provided optional fields after the CLI write confirmation. Use `--envJsonList` with the same JSON array format as `+add_datasource`.
-- **Datasource online**: `+online_datasource` requires `--spaceCode` and `--dataSourceNames`. It executes after the CLI write confirmation and returns `failDataSources` and `successDataSourceNames`.
+- **Datasource modification**: `+modify_datasource` creates no preview; it updates only provided optional fields (`risk: write`). Use `--envJsonList` with the same JSON array format as `+add_datasource`.
+- **Datasource online**: `+online_datasource` requires `--spaceCode` and `--dataSourceNames`. It executes directly (`risk: write`) and returns `failDataSources` and `successDataSourceNames`.
 - **Sync datasources**: `+list_sync_datasources` requires `--spaceCode`; `--env` is optional and defaults to `DEV`. It returns `sourceComponentSet` and `sinkComponentSet`, grouped by component, with `dataSourceList` and `supportableComponent`.
 - **Datasource databases**: `+list_datasource_databases` requires `--spaceCode` and `--datasourceId`; `--catalog` and `--env` are optional, and `--env` defaults to `DEV`. It returns an array of objects with `databaseName`.
 - **Datasource tables**: `+list_datasource_tables` requires `--spaceCode`, `--datasourceId`, and `--database`; `--catalog` and `--env` are optional, and `--env` defaults to `DEV`. It returns table metadata including `database`, `tableName`, `tableType`, `tableComment`, `engine`, `disabled`, `disabledReasons`, `sameVersion`, and `supportSharding`.

package/skills/ae-engage/SKILL.md

@@ -228,12 +228,12 @@ Commands that accept date parameters usually use `yyyy-MM-dd`, for example `--st
 
 ## Write Operation Reminder
 
-The following commands are write operations. Confirm that the user intent is explicit before executing them:
+High-risk delete commands (`risk: high-risk-write`) require explicit user authorization before execution. Ordinary write commands (`risk: write`) do not:
 
-- Channels and config channels: `+add_channel`, `+delete_channel`, `+update_channel_status`, `+delete_config_channel`, `+update_config_channel_status`
-- Strategies and config items: `+delete_config_item`, `+copy_config_template`, `+manage_strategy`
-- Flows: `+save_flow`, `+modify_flow_base_info`, `+manage_flow`, `+delete_flow`
-- Tasks: `+save_task`, `+manage_task`
+- Channels and config channels: `+add_channel` (write), `+delete_channel` (high-risk-write), `+update_channel_status` (write), `+delete_config_channel` (high-risk-write), `+update_config_channel_status` (write)
+- Strategies and config items: `+delete_config_item` (high-risk-write), `+copy_config_template` (write), `+manage_strategy` (write)
+- Flows: `+save_flow` (write), `+modify_flow_base_info` (write), `+manage_flow` (write), `+delete_flow` (high-risk-write)
+- Tasks: `+save_task` (write), `+manage_task` (write)
 
 For task draft creation or update, use this workflow:
 

package/skills/ae-metadata/references/metadata_data_table_sql_write.md

@@ -5,8 +5,8 @@
 ## Command
 
 ```bash
-ae-cli metadata data-table sql-write --project-id <project_id> --operation create --table-name datatable_<project_id>_<name> --columns '<columns_json>' --qp '<qp_json>' --zone-offset 8 --strategy overwrite --yes
-ae-cli metadata data-table sql-write --project-id <project_id> --operation update --data-table-id <id> --columns '<columns_json>' --qp '<qp_json>' --yes
+ae-cli metadata data-table sql-write --project-id <project_id> --operation create --table-name datatable_<project_id>_<name> --columns '<columns_json>' --qp '<qp_json>' --zone-offset 8 --yes
+ae-cli metadata data-table sql-write --project-id <project_id> --operation update --data-table-id <id> --columns '<columns_json>' --qp '<qp_json>' --strategy overwrite --update-cron '0 0 * * * ?' --yes
 ```
 
 ## Parameters
@@ -15,18 +15,70 @@ ae-cli metadata data-table sql-write --project-id <project_id> --operation updat
 |---|---|---|
 | `--project-id` / `-p` | Yes | Numeric project ID. |
 | `--operation` | Yes | `create` or `update`. |
-| `--columns` | Yes | Column definitions JSON array. Preferred fields are `column_name`, `column_type`, and `column_desc`; CLI also accepts `name`, `type`, and `display_name` aliases. |
-| `--qp` | Yes | SQL data table query plan JSON. |
+| `--columns` | Yes | Column definitions JSON array. Preferred fields are `column_name`, `column_type`, and `column_desc`; CLI also accepts `name`, `type`, and `display_name` aliases. Must match SQL output column names. |
+| `--qp` | Yes | `SqlDatatableDef` JSON object (see below). |
 | `--data-table-id` | For update | Existing data table ID. |
 | `--table-name` | For create | Technical table name. Use `datatable_<project_id>_<name>`. |
 | `--display-name` | No | Human-readable name. |
 | `--remarks` | No | Table remarks. |
 | `--zone-offset` | No | Time zone offset in hours. For example, UTC+8 is `8` and UTC-5 is `-5`. Valid range: -12 to 14. |
-| `--strategy` | No | `overwrite` or `insert`. |
-| `--update-cron` | No | Scheduled update cron. |
+| `--strategy` | For update | `overwrite` or `insert`. Ignored for create. |
+| `--update-cron` | For update | Scheduled update cron. Ignored for create. |
+
+## QP contract (`SqlDatatableDef`)
+
+`--qp` must be a JSON object with this shape. **Do not** pass a top-level `sql` field.
+
+```json
+{
+  "taSqlVo": {
+    "sql": "select '1' as id, 'demo' as name",
+    "sqlVoParams": []
+  },
+  "taSqlView": {}
+}
+```
+
+| Field | Required | Description |
+|---|---|---|
+| `taSqlVo` | Yes | SQL entity definition (`TaSqlVo`). |
+| `taSqlVo.sql` | Yes | SELECT statement. Output columns must appear in `--columns`. |
+| `taSqlVo.sqlVoParams` | No | Dynamic SQL parameters. Use `[]` when none. |
+| `taSqlView` | No | SQL view (`TaSqlView`). Use `{}` when no dynamic view params. |
+| `taSqlView.sqlViewParams` | No | View dynamic parameters. |
+
+Inspect the live schema:
+
+```bash
+ae-cli capability inspect metadata.data_table.sql_write
+```
+
+## Create example
+
+```bash
+ae-cli metadata data-table sql-write \
+  --project-id 1 \
+  --operation create \
+  --table-name datatable_1_orders_dim \
+  --display-name "Orders dim" \
+  --columns '[{"name":"id","type":"string","display_name":"id"},{"name":"name","type":"string","display_name":"name"}]' \
+  --qp '{"taSqlVo":{"sql":"select '\''1'\'' as id, '\''demo'\'' as name","sqlVoParams":[]},"taSqlView":{}}' \
+  --zone-offset 8 \
+  --dry-run
+
+ae-cli metadata data-table sql-write \
+  --project-id 1 \
+  --operation create \
+  --table-name datatable_1_orders_dim \
+  --display-name "Orders dim" \
+  --columns '[{"name":"id","type":"string","display_name":"id"},{"name":"name","type":"string","display_name":"name"}]' \
+  --qp '{"taSqlVo":{"sql":"select '\''1'\'' as id, '\''demo'\'' as name","sqlVoParams":[]},"taSqlView":{}}' \
+  --zone-offset 8
+```
 
 ## Decision Rules
 
-- This is a write command; use `--dry-run` before non-dry-run and pass `--yes` when executing.
-- Keep `columns` and `qp` as valid JSON; do not pass raw SQL unless the server schema requires it inside `qp`.
+- This is a write command; use `--dry-run` before non-dry-run execution.
+- Keep `columns` and `qp` as valid JSON. `qp` must follow `SqlDatatableDef`; dry-run validates structure but does not execute SQL.
 - If you provide a table name, it must include the project segment, for example `datatable_2_orders_sql`.
+- If execute fails with `CAPABILITY_EXECUTION_FAILED`, fix qp structure first, then retry with a valid query before investigating backend SQL/Presto issues.

package/skills/ae-team/SKILL.md

@@ -21,7 +21,7 @@ Global parameters:
 | `--format <json\|table>` | Output format. Default is JSON. |
 | `--jq <expr>` | jq filter expression for JSON output. |
 | `--host <url>` | Override the active AE host. Available on every command and may be placed after the subcommand, e.g. `ae-cli team +<command> --host <url>`. |
-| `--yes` | Skip confirmation for write operations. |
+| `--yes` | Skip confirmation for `high-risk-write` (delete) operations. |
 | `--dry-run` | Show request details without executing. |
 
 Output and errors:

package/skills/ae-analysis/references/folder_members.md

@@ -1,15 +0,0 @@
-# analysis folder members
-
-Use when the user needs to inspect folder members.
-
-Do not use to modify members. Use `folder share`.
-
-Command:
-
-```bash
-ae-cli analysis folder members --project-id <project_id> --folder-id <folder_id>
-```
-
-Input sends `project_id` and `folder_id`.
-
-Output is the gateway envelope. `data` contains folder members.

package/skills/ae-analysis/references/project_space_members.md

@@ -1,15 +0,0 @@
-# analysis project-space members
-
-Use when the user needs to inspect project-space members.
-
-Do not use to modify members. Use `project-space share`.
-
-Command:
-
-```bash
-ae-cli analysis project-space members --project-id <project_id> --space-id <space_id>
-```
-
-Input sends `project_id` and `space_id`.
-
-Output is the gateway envelope. `data` contains project-space members.