@thinkingai/ae-cli 6.0.40 → 6.0.41

package/dist/{te-system-XGS5EQIQ.js → te-system-AZ3URMUO.js}

@@ -1,15 +1,16 @@
 import {
   deleteFromMainApp,
+  downloadFromMainApp,
   getFromMainApp,
   patchToMainApp,
   postToMainApp,
   putToMainApp,
   tryLoadTeAgentSandboxCredentials,
   uploadToMainApp
-} from "./chunk-VKD5WQKN.js";
+} from "./chunk-VLWOLBGZ.js";
 import {
   safeJsonParse
-} from "./chunk-GJJA4CQZ.js";
+} from "./chunk-3FY3RJ26.js";
 import {
   CliValidationError
 } from "./chunk-AXDXJTPC.js";
@@ -38,6 +39,10 @@ async function uploadAdminForm(path3, formData, host) {
   assertAdminPath(path3);
   return uploadToMainApp(path3, formData, host);
 }
+async function downloadAdmin(path3, outputPath, host) {
+  assertAdminPath(path3);
+  return downloadFromMainApp(path3, outputPath, host);
+}
 async function executeAdminRequest(ctx, request) {
   assertAdminPath(request.path);
   const host = ctx.host();
@@ -79,6 +84,30 @@ function createAdminCommand(config) {
     execute: async (ctx) => executeAdminRequest(ctx, config.prepare(ctx))
   };
 }
+function createAdminDownloadCommand(config) {
+  return {
+    service: "system",
+    command: config.command,
+    description: config.description,
+    flags: config.flags,
+    risk: "read",
+    helpText: config.helpText,
+    validate: config.validate,
+    dryRun: (ctx) => {
+      const request = config.prepare(ctx);
+      assertAdminPath(request.path);
+      return {
+        method: "GET",
+        url: request.path,
+        body: { outputPath: request.outputPath }
+      };
+    },
+    execute: async (ctx) => {
+      const request = config.prepare(ctx);
+      return downloadAdmin(request.path, request.outputPath, ctx.host());
+    }
+  };
+}
 function optionalString(ctx, name) {
   const value = ctx.str(name).trim();
   return value || void 0;
@@ -133,6 +162,10 @@ function requireJsonObject(ctx, name) {
   }
   return value;
 }
+function optionalJsonObject(ctx, name) {
+  if (!optionalString(ctx, name)) return void 0;
+  return requireJsonObject(ctx, name);
+}
 function requireJsonArray(ctx, name) {
   const value = readJsonFlag(ctx, name);
   if (!Array.isArray(value)) {
@@ -145,7 +178,17 @@ function requireStringArray(ctx, name) {
   if (value.length === 0 || value.some((item) => typeof item !== "string" || !item.trim())) {
     throw new CliValidationError(`--${name} must be a non-empty JSON array of strings`);
   }
-  return value;
+  return value.map((item) => item.trim());
+}
+function requireBoundedStringArray(ctx, name, max) {
+  const values = requireStringArray(ctx, name);
+  if (values.length > max) {
+    throw new CliValidationError(`--${name} supports at most ${max} values`);
+  }
+  if (new Set(values).size !== values.length) {
+    throw new CliValidationError(`--${name} must not contain duplicate values`);
+  }
+  return values;
 }
 function redactSecrets(value) {
   if (Array.isArray(value)) return value.map(redactSecrets);
@@ -306,13 +349,29 @@ var removeMember = createAdminCommand({
     path: `/api/admin/members/${encodeId(ctx.str("user-id"))}`
   })
 });
+var getMemberStats = createAdminCommand({
+  command: "+get-member-stats",
+  description: "Get token usage and recent conversation statistics for one company member",
+  flags: [
+    { name: "user-id", type: "string", required: true, desc: "Agent database user ID from +list-members" },
+    { name: "days", type: "number", min: 1, max: 365, desc: "Recent range in days (1-365, default: 30)" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery(`/api/admin/members/${encodeId(ctx.str("user-id"))}/stats`, {
+      days: ctx.optionalNum("days")
+    })
+  })
+});
 var memberCommands = [
   listMemberCandidates,
   listMembers,
   addMembers,
   setMemberStatus,
   setMemberRole,
-  removeMember
+  removeMember,
+  getMemberStats
 ];
 
 // src/commands/te-system/sandboxes.ts
@@ -333,6 +392,13 @@ var listSandboxes = createAdminCommand({
   risk: "read",
   prepare: () => ({ method: "GET", path: "/api/admin/sandboxes" })
 });
+var getSandboxConfig = createAdminCommand({
+  command: "+get-sandbox-config",
+  description: "Get sandbox feature status and company create/active seat limits",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/sandbox/config" })
+});
 var batchCreateSandboxes = createAdminCommand({
   command: "+batch-create-sandboxes",
   description: "Create personal sandboxes for up to 100 company members",
@@ -471,6 +537,7 @@ var removeSandbox = createAdminCommand({
 });
 var sandboxCommands = [
   listSandboxes,
+  getSandboxConfig,
   batchCreateSandboxes,
   updateSandbox,
   setSandboxEnabled,
@@ -505,6 +572,45 @@ var setSystemModelEnabled = createAdminCommand({
     body: { enabled: ctx.bool("enabled") }
   })
 });
+var getModelSyncSettings = createAdminCommand({
+  command: "+get-model-sync-settings",
+  description: "Get the company policy for newly synchronized system models",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/models/sync-settings" })
+});
+var setModelSyncSettings = createAdminCommand({
+  command: "+set-model-sync-settings",
+  description: "Set whether newly synchronized system models are enabled for the company",
+  flags: [
+    {
+      name: "new-system-models-enabled-by-default",
+      type: "boolean",
+      required: true,
+      desc: "Whether future system models are enabled for this company by default"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: "/api/admin/models/sync-settings",
+    body: {
+      newSystemModelsEnabledByDefault: ctx.bool("new-system-models-enabled-by-default")
+    }
+  })
+});
+var getSystemModelPriceRules = createAdminCommand({
+  command: "+get-system-model-price-rules",
+  description: "Get the stored pricing rule snapshot for one managed system model",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "System Model.id from +list-system-models" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/admin/system-models/${encodeId(ctx.str("model-id"))}/price-rules`
+  })
+});
 var listCompanyModels = createAdminCommand({
   command: "+list-company-models",
   description: "List all company models, including disabled models",
@@ -579,6 +685,9 @@ var clearDefaultModel = createAdminCommand({
 var modelCommands = [
   listSystemModels,
   setSystemModelEnabled,
+  getModelSyncSettings,
+  setModelSyncSettings,
+  getSystemModelPriceRules,
   listCompanyModels,
   setCompanyModelEnabled,
   getDefaultModels,
@@ -587,18 +696,27 @@ var modelCommands = [
 ];
 
 // src/commands/te-system/usage.ts
+import { resolve } from "path";
 var GROUP_BY = ["user", "model", "date", "app_type"];
 var SORT_BY = ["totalTokens", "cost", "share", "requestCount"];
 var SORT_DIRECTIONS2 = ["asc", "desc"];
+var EXPORT_SCOPES = ["full", "drill"];
 var DATE_PATTERN = "^\\d{4}-\\d{2}-\\d{2}$";
-function validateDatePair(ctx, required) {
+function validateDatePair(ctx, required, supportsDays = false) {
   const startDate = optionalString(ctx, "start-date");
   const endDate = optionalString(ctx, "end-date");
+  const days = ctx.optionalNum("days");
   if (Boolean(startDate) !== Boolean(endDate)) {
     throw new CliValidationError("--start-date and --end-date must be provided together");
   }
   if (required && (!startDate || !endDate)) {
-    throw new CliValidationError("--start-date and --end-date are required for usage details");
+    throw new CliValidationError("--start-date and --end-date are required");
+  }
+  if (supportsDays && days !== void 0 && startDate) {
+    throw new CliValidationError("--days cannot be combined with --start-date/--end-date");
+  }
+  if (startDate && endDate && startDate > endDate) {
+    throw new CliValidationError("--start-date cannot be later than --end-date");
   }
 }
 function usageRangeQuery(ctx) {
@@ -608,6 +726,64 @@ function usageRangeQuery(ctx) {
     endDate: optionalString(ctx, "end-date")
   };
 }
+function usageCombinationQuery(ctx) {
+  return {
+    startDate: ctx.str("start-date"),
+    endDate: ctx.str("end-date"),
+    parentDimension: ctx.str("parent-dimension"),
+    openId: optionalString(ctx, "open-id"),
+    modelId: optionalString(ctx, "model-id"),
+    modelScope: optionalString(ctx, "model-scope"),
+    appType: optionalString(ctx, "app-type"),
+    date: optionalString(ctx, "date"),
+    page: ctx.optionalNum("page"),
+    pageSize: ctx.optionalNum("page-size"),
+    sortBy: optionalString(ctx, "sort-by") || "totalTokens",
+    sortDir: optionalString(ctx, "sort-dir") || "desc"
+  };
+}
+function validateUsageCombination(ctx) {
+  validateDatePair(ctx, true);
+  const parent = optionalString(ctx, "parent-dimension");
+  assertEnum("parent-dimension", parent, GROUP_BY);
+  assertEnum("sort-by", optionalString(ctx, "sort-by"), SORT_BY);
+  assertEnum("sort-dir", optionalString(ctx, "sort-dir"), SORT_DIRECTIONS2);
+  const openId = optionalString(ctx, "open-id");
+  const modelId = optionalString(ctx, "model-id");
+  const modelScope = optionalString(ctx, "model-scope");
+  const appType = optionalString(ctx, "app-type");
+  const date = optionalString(ctx, "date");
+  const supplied = [openId, modelId, modelScope, appType, date].filter(Boolean).length;
+  if (parent === "user" && (!openId || supplied !== 1)) {
+    throw new CliValidationError("user drill-down requires only --open-id");
+  }
+  if (parent === "model" && (!modelId || !modelScope || supplied !== 2)) {
+    throw new CliValidationError("model drill-down requires only --model-id and --model-scope");
+  }
+  if (parent === "app_type" && (!appType || supplied !== 1)) {
+    throw new CliValidationError("app_type drill-down requires only --app-type");
+  }
+  if (parent === "date" && (!date || supplied !== 1)) {
+    throw new CliValidationError("date drill-down requires only --date");
+  }
+  if (date && (date < ctx.str("start-date") || date > ctx.str("end-date"))) {
+    throw new CliValidationError("--date must be within --start-date and --end-date");
+  }
+}
+var COMBINATION_FLAGS = [
+  { name: "start-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD)" },
+  { name: "end-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD)" },
+  { name: "parent-dimension", type: "string", required: true, desc: `Parent dimension: ${GROUP_BY.join(" | ")}` },
+  { name: "open-id", type: "string", desc: "Required only for user drill-down" },
+  { name: "model-id", type: "string", desc: "Required only for model drill-down" },
+  { name: "model-scope", type: "string", desc: "Required only for model drill-down" },
+  { name: "app-type", type: "string", desc: "Required only for app_type drill-down" },
+  { name: "date", type: "string", pattern: DATE_PATTERN, desc: "Required only for date drill-down" },
+  { name: "page", type: "number", min: 1, desc: "Page number (default: 1)" },
+  { name: "page-size", type: "number", min: 1, max: 100, desc: "Page size (1-100, default: 20)" },
+  { name: "sort-by", type: "string", default: "totalTokens", desc: `Sort by: ${SORT_BY.join(" | ")}` },
+  { name: "sort-dir", type: "string", default: "desc", desc: `Sort direction: ${SORT_DIRECTIONS2.join(" | ")}` }
+];
 var getUsageSummary = createAdminCommand({
   command: "+get-usage-summary",
   description: "Get company token and cost usage summary",
@@ -624,13 +800,17 @@ var getUsageSummary = createAdminCommand({
       type: "string",
       pattern: DATE_PATTERN,
       desc: "End date (YYYY-MM-DD); requires --start-date"
-    }
+    },
+    { name: "refresh", type: "boolean", desc: "Bypass the cached overview and refresh from the source" }
   ],
   risk: "read",
-  validate: (ctx) => validateDatePair(ctx, false),
+  validate: (ctx) => validateDatePair(ctx, false, true),
   prepare: (ctx) => ({
     method: "GET",
-    path: withQuery("/api/admin/stats/summary", usageRangeQuery(ctx))
+    path: withQuery("/api/admin/stats/summary", {
+      ...usageRangeQuery(ctx),
+      refresh: ctx.bool("refresh") ? "true" : void 0
+    })
   })
 });
 var getUsageDetails = createAdminCommand({
@@ -690,7 +870,117 @@ var getUsageDetails = createAdminCommand({
     })
   })
 });
-var usageCommands = [getUsageSummary, getUsageDetails];
+var getAgentToolCalls = createAdminCommand({
+  command: "+get-agent-tool-calls",
+  description: "Get the company Agent tool-call count for a usage range",
+  flags: [
+    { name: "days", type: "number", min: 1, max: 365, desc: "Relative range in days (1-365, default: 30)" },
+    { name: "start-date", type: "string", pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD); requires --end-date" },
+    { name: "end-date", type: "string", pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD); requires --start-date" },
+    { name: "refresh", type: "boolean", desc: "Bypass the cached overview and refresh from the source" }
+  ],
+  risk: "read",
+  validate: (ctx) => validateDatePair(ctx, false, true),
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/stats/agent-tool-calls", {
+      ...usageRangeQuery(ctx),
+      refresh: ctx.bool("refresh") ? "true" : void 0
+    })
+  })
+});
+var getUsageCombinations = createAdminCommand({
+  command: "+get-usage-combinations",
+  description: "Drill one usage group into the remaining dimensions",
+  flags: COMBINATION_FLAGS,
+  risk: "read",
+  validate: validateUsageCombination,
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/stats/combinations", usageCombinationQuery(ctx))
+  })
+});
+var exportUsage = createAdminDownloadCommand({
+  command: "+export-usage",
+  description: "Export filtered one-dimension usage groups to a CSV file",
+  flags: [
+    { name: "start-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD)" },
+    { name: "end-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD)" },
+    { name: "group-by", type: "string", default: "user", desc: `Group by: ${GROUP_BY.join(" | ")}` },
+    { name: "search", type: "string", maxLength: 100, desc: "Optional search text (max 100 characters)" },
+    { name: "open-id", type: "string", desc: "Filter by TE user openId" },
+    { name: "model-id", type: "string", desc: "Filter by model ID" },
+    { name: "model-scope", type: "string", desc: "Model scope; requires --model-id" },
+    { name: "app-type", type: "string", desc: "Filter by product/application type" },
+    { name: "sort-by", type: "string", default: "totalTokens", desc: `Sort by: ${SORT_BY.join(" | ")}` },
+    { name: "sort-dir", type: "string", default: "desc", desc: `Sort direction: ${SORT_DIRECTIONS2.join(" | ")}` },
+    { name: "output", type: "string", required: true, desc: "New local CSV path; existing files are never overwritten" }
+  ],
+  validate: (ctx) => {
+    validateDatePair(ctx, true);
+    assertEnum("group-by", optionalString(ctx, "group-by"), GROUP_BY);
+    assertEnum("sort-by", optionalString(ctx, "sort-by"), SORT_BY);
+    assertEnum("sort-dir", optionalString(ctx, "sort-dir"), SORT_DIRECTIONS2);
+    if (optionalString(ctx, "model-scope") && !optionalString(ctx, "model-id")) {
+      throw new CliValidationError("--model-scope requires --model-id");
+    }
+  },
+  prepare: (ctx) => ({
+    path: withQuery("/api/admin/stats/export", {
+      startDate: ctx.str("start-date"),
+      endDate: ctx.str("end-date"),
+      groupBy: ctx.str("group-by") || "user",
+      search: optionalString(ctx, "search"),
+      openId: optionalString(ctx, "open-id"),
+      modelId: optionalString(ctx, "model-id"),
+      modelScope: optionalString(ctx, "model-scope"),
+      appType: optionalString(ctx, "app-type"),
+      sortBy: ctx.str("sort-by") || "totalTokens",
+      sortDir: ctx.str("sort-dir") || "desc"
+    }),
+    outputPath: resolve(ctx.str("output"))
+  })
+});
+var exportUsageDetails = createAdminDownloadCommand({
+  command: "+export-usage-details",
+  description: "Export full or drill-down multi-dimension usage details to a streamed CSV file",
+  flags: [
+    { name: "scope", type: "string", required: true, desc: `Export scope: ${EXPORT_SCOPES.join(" | ")}` },
+    { name: "days", type: "number", min: 1, max: 365, desc: "Relative range for full export (1-365, default: 30)" },
+    { name: "start-date", type: "string", pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD)" },
+    { name: "end-date", type: "string", pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD)" },
+    ...COMBINATION_FLAGS.filter((flag) => !["start-date", "end-date", "page", "page-size", "sort-by", "sort-dir"].includes(flag.name)).map((flag) => ({ ...flag, required: false })),
+    { name: "output", type: "string", required: true, desc: "New local CSV path; existing files are never overwritten" }
+  ],
+  validate: (ctx) => {
+    const scope = optionalString(ctx, "scope");
+    assertEnum("scope", scope, EXPORT_SCOPES);
+    if (scope === "drill") {
+      validateUsageCombination(ctx);
+    } else {
+      validateDatePair(ctx, false, true);
+      if (optionalString(ctx, "parent-dimension") || optionalString(ctx, "open-id") || optionalString(ctx, "model-id") || optionalString(ctx, "model-scope") || optionalString(ctx, "app-type") || optionalString(ctx, "date")) {
+        throw new CliValidationError("full export does not accept drill-down filters");
+      }
+    }
+  },
+  prepare: (ctx) => ({
+    path: withQuery("/api/admin/stats/detailed-export", {
+      scope: ctx.str("scope"),
+      ...usageRangeQuery(ctx),
+      ...ctx.str("scope") === "drill" ? usageCombinationQuery(ctx) : {}
+    }),
+    outputPath: resolve(ctx.str("output"))
+  })
+});
+var usageCommands = [
+  getUsageSummary,
+  getUsageDetails,
+  getAgentToolCalls,
+  getUsageCombinations,
+  exportUsage,
+  exportUsageDetails
+];
 
 // src/commands/te-system/cost-control.ts
 function createRuleBody(ctx) {
@@ -709,6 +999,20 @@ var getCostSummary = createAdminCommand({
   risk: "read",
   prepare: () => ({ method: "GET", path: "/api/admin/cost-control/summary" })
 });
+var getBalance = createAdminCommand({
+  command: "+get-balance",
+  description: "Get the current company model account balance and currency",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/cost-control/balance" })
+});
+var listOverLimitUsers = createAdminCommand({
+  command: "+list-over-limit-users",
+  description: "List company members currently over cost or token quota limits",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/cost-control/over-limit-users" })
+});
 var getBalanceAlert = createAdminCommand({
   command: "+get-balance-alert",
   description: "Get the company balance alert configuration and current status",
@@ -812,6 +1116,8 @@ var bindQuotaRuleUser = createAdminCommand({
 });
 var costControlCommands = [
   getCostSummary,
+  getBalance,
+  listOverLimitUsers,
   getBalanceAlert,
   setBalanceAlert,
   listQuotaRules,
@@ -1427,10 +1733,90 @@ async function removeTemporaryTree(root) {
 var TOOL_UPLOAD_PATH = "/api/admin/sandbox-tools";
 var TOOL_UPLOAD_POLICY_PATH = "/api/admin/sandbox-tools/upload-policy";
 var NPM_INSTALL_TIMEOUT_MS = 10 * 60 * 1e3;
+var TARGET_MODES = ["selected", "all-running"];
+var OPERATION_ACTIONS = ["activate", "deactivate"];
+var SORT_ORDERS = ["asc", "desc"];
 function optionalFlag(ctx, name) {
   const value = ctx.str(name).trim();
   return value || void 0;
 }
+function optionalBoundedStringArray(ctx, name, max) {
+  return optionalString(ctx, name) ? requireBoundedStringArray(ctx, name, max) : void 0;
+}
+function validateCommandNamesByToolId(value, toolIds) {
+  if (!value) return void 0;
+  const normalized = {};
+  for (const [toolId, commandNames] of Object.entries(value)) {
+    if (!toolIds.includes(toolId)) {
+      throw new CliValidationError("--command-names-by-tool-id keys must exist in --tool-ids");
+    }
+    if (!Array.isArray(commandNames) || commandNames.length === 0 || commandNames.length > 64 || commandNames.some((name) => typeof name !== "string" || !name.trim())) {
+      throw new CliValidationError(
+        "--command-names-by-tool-id values must be arrays of 1-64 non-empty command names"
+      );
+    }
+    normalized[toolId] = commandNames.map((name) => name.trim());
+  }
+  return normalized;
+}
+function validateExpectedSnapshots(value, toolIds) {
+  if (!value) return void 0;
+  const normalized = {};
+  for (const [toolId, snapshot] of Object.entries(value)) {
+    if (!toolIds.includes(toolId)) {
+      throw new CliValidationError("--expected-tool-snapshots-by-id keys must exist in --tool-ids");
+    }
+    if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) {
+      throw new CliValidationError("--expected-tool-snapshots-by-id values must be objects");
+    }
+    const item = snapshot;
+    if (typeof item.name !== "string" || !item.name.trim() || item.version !== null && typeof item.version !== "string" || typeof item.packagePath !== "string" || !item.packagePath.trim() || !Array.isArray(item.commands) || item.commands.length === 0 || item.commands.length > 64 || item.commands.some((name) => typeof name !== "string" || !name.trim())) {
+      throw new CliValidationError(
+        "--expected-tool-snapshots-by-id contains an invalid tool snapshot"
+      );
+    }
+    normalized[toolId] = {
+      name: item.name.trim(),
+      version: item.version,
+      packagePath: item.packagePath.trim(),
+      commands: item.commands.map((name) => name.trim())
+    };
+  }
+  return normalized;
+}
+function sandboxToolOperationBody(ctx) {
+  const mode = optionalString(ctx, "target-mode");
+  assertEnum("target-mode", mode, TARGET_MODES);
+  const sandboxIds = optionalBoundedStringArray(ctx, "sandbox-ids", 50);
+  if (mode === "selected" && !sandboxIds) {
+    throw new CliValidationError("selected mode requires --sandbox-ids with 1-50 sandbox IDs");
+  }
+  if (mode === "all-running" && sandboxIds) {
+    throw new CliValidationError("all-running mode does not accept --sandbox-ids");
+  }
+  const toolIds = requireBoundedStringArray(ctx, "tool-ids", 20);
+  const commandNamesByToolId = validateCommandNamesByToolId(
+    optionalJsonObject(ctx, "command-names-by-tool-id"),
+    toolIds
+  );
+  const expectedToolSnapshotsById = validateExpectedSnapshots(
+    optionalJsonObject(ctx, "expected-tool-snapshots-by-id"),
+    toolIds
+  );
+  return {
+    target: { mode, ...sandboxIds ? { sandboxIds } : {} },
+    toolIds,
+    ...commandNamesByToolId ? { commandNamesByToolId } : {},
+    ...expectedToolSnapshotsById ? { expectedToolSnapshotsById } : {}
+  };
+}
+var TOOL_OPERATION_FLAGS = [
+  { name: "target-mode", type: "string", required: true, desc: `Target mode: ${TARGET_MODES.join(" | ")}` },
+  { name: "sandbox-ids", type: "string", sensitive: true, desc: "Selected mode only: JSON/@file array of 1-50 sandbox IDs" },
+  { name: "tool-ids", type: "string", required: true, desc: "JSON/@file array of 1-20 sandbox tool IDs" },
+  { name: "command-names-by-tool-id", type: "string", desc: "Optional JSON/@file map of tool ID to selected command names" },
+  { name: "expected-tool-snapshots-by-id", type: "string", sensitive: true, desc: "Optional JSON/@file optimistic-lock snapshots keyed by tool ID" }
+];
 async function requireUploadPolicy(ctx) {
   const policy = await getAdmin(
     TOOL_UPLOAD_POLICY_PATH,
@@ -1685,9 +2071,127 @@ var npmInstallSandboxTool = {
     }
   }
 };
+var listSandboxTools = createAdminCommand({
+  command: "+list-sandbox-tools",
+  description: "List preset and custom sandbox tools registered for the current company",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/sandbox-tools" })
+});
+var syncSandboxTools = createAdminCommand({
+  command: "+sync-sandbox-tools",
+  description: "Synchronize the current company sandbox tool registry from the system manifest",
+  flags: [],
+  risk: "write",
+  prepare: () => ({ method: "POST", path: "/api/admin/sandbox-tools/sync", body: {} })
+});
+var getSandboxToolDistribution = createAdminCommand({
+  command: "+get-sandbox-tool-distribution",
+  description: "Get the sandboxes to which one tool is currently distributed",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox tool ID from +list-sandbox-tools" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/admin/sandbox-tools/${encodeId(ctx.str("id"))}/distribution`
+  })
+});
+var setSandboxToolEnabled = createAdminCommand({
+  command: "+set-sandbox-tool-enabled",
+  description: "Enable or disable a sandbox tool in the company registry",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox tool ID from +list-sandbox-tools" },
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the sandbox tool is enabled" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/sandbox-tools/${encodeId(ctx.str("id"))}`,
+    body: { enabled: ctx.bool("enabled") }
+  })
+});
+var removeSandboxTool = createAdminCommand({
+  command: "+remove-sandbox-tool",
+  description: "Delete a sandbox tool after the server verifies it is fully reclaimed",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox tool ID from +list-sandbox-tools" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/admin/sandbox-tools/${encodeId(ctx.str("id"))}`
+  })
+});
+function createSandboxToolOperationCommand(command, description, route) {
+  return createAdminCommand({
+    command,
+    description,
+    flags: TOOL_OPERATION_FLAGS,
+    risk: "write",
+    validate: (ctx) => {
+      sandboxToolOperationBody(ctx);
+    },
+    prepare: (ctx) => ({
+      method: "POST",
+      path: `/api/admin/sandbox-tools/${route}`,
+      body: sandboxToolOperationBody(ctx)
+    })
+  });
+}
+var activateSandboxTools = createSandboxToolOperationCommand(
+  "+activate-sandbox-tools",
+  "Activate selected tool commands in selected or all running sandboxes",
+  "activate"
+);
+var deactivateSandboxTools = createSandboxToolOperationCommand(
+  "+deactivate-sandbox-tools",
+  "Deactivate selected managed tool commands in selected or all running sandboxes",
+  "deactivate"
+);
+var refreshSandboxToolStatus = createSandboxToolOperationCommand(
+  "+refresh-sandbox-tool-status",
+  "Refresh the observed tool state in selected or all running sandboxes",
+  "status"
+);
+var listSandboxToolOperations = createAdminCommand({
+  command: "+list-sandbox-tool-operations",
+  description: "List sandbox tool activation and deactivation operation history",
+  flags: [
+    { name: "page", type: "number", min: 1, desc: "Page number (default: 1)" },
+    { name: "page-size", type: "number", min: 1, max: 100, desc: "Page size (1-100, default: 20)" },
+    { name: "action", type: "string", desc: `Operation action: ${OPERATION_ACTIONS.join(" | ")}` },
+    { name: "operator", type: "string", maxLength: 100, desc: "Operator name or ID filter" },
+    { name: "sort-order", type: "string", desc: `Sort order: ${SORT_ORDERS.join(" | ")}` }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    assertEnum("action", optionalString(ctx, "action"), OPERATION_ACTIONS);
+    assertEnum("sort-order", optionalString(ctx, "sort-order"), SORT_ORDERS);
+  },
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/sandbox-tools/operations", {
+      page: ctx.optionalNum("page"),
+      pageSize: ctx.optionalNum("page-size"),
+      action: optionalString(ctx, "action"),
+      operator: optionalString(ctx, "operator"),
+      sortOrder: optionalString(ctx, "sort-order")
+    })
+  })
+});
 var sandboxToolCommands = [
   uploadSandboxTool,
-  npmInstallSandboxTool
+  npmInstallSandboxTool,
+  listSandboxTools,
+  syncSandboxTools,
+  getSandboxToolDistribution,
+  setSandboxToolEnabled,
+  removeSandboxTool,
+  activateSandboxTools,
+  deactivateSandboxTools,
+  refreshSandboxToolStatus,
+  listSandboxToolOperations
 ];
 
 // src/commands/te-system/index.ts