@thinkingai/ae-cli 6.0.52 → 6.0.53

package/dist/{te-analysis-KQKCAI5H.js → te-analysis-3EVYQ3IO.js}

@@ -7,12 +7,12 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-WEPZ5M3Z.js";
+} from "./chunk-PGCIKZRE.js";
 import {
   createCapabilityCommand,
   definitionIntentSnapshotFlag,
   modelDefinitionIntentSnapshotFlag
-} from "./chunk-L2QUIZTS.js";
+} from "./chunk-647BRKZK.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
@@ -26,19 +26,20 @@ import {
   requestCapabilityGateway,
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
-  validateCapability
-} from "./chunk-HFGZGYCG.js";
+  validateCapability,
+  validateCapabilityWithEnvelope
+} from "./chunk-QYXDJOLA.js";
 import {
   withOutputMetadata
-} from "./chunk-DX5CDO34.js";
+} from "./chunk-BW7JUDEI.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-7XGFSUOM.js";
-import "./chunk-7FTTULED.js";
+} from "./chunk-DU72X2IO.js";
+import "./chunk-IG3DYEIR.js";
 import {
   CliValidationError
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -148,7 +149,7 @@ var sqlTableUsageFlag = {
   name: "usage",
   type: "string",
   required: false,
-  desc: "Authorized table set: analysis (default) or tag_cluster. Use tag_cluster before creating SQL tags or clusters."
+  desc: "Authorized table set: analysis (default), tag_cluster for SQL tags/clusters, or sql_datatable for SQL-built data tables. Use the same usage for list and columns."
 };
 var reportListLimitFlag = {
   name: "limit",
@@ -288,7 +289,7 @@ function certificationScopeInput(ctx) {
   }
   return value;
 }
-function dashboardReportDataInput(ctx) {
+function dashboardReportDataInput(ctx, includeCache = true) {
   return compactInput({
     ...projectInput(ctx),
     dashboard_id: ctx.num("dashboard-id"),
@@ -299,7 +300,7 @@ function dashboardReportDataInput(ctx) {
     cluster_query_scope: optionalString(ctx, "cluster-query-scope"),
     slave_cluster_id: optionalString(ctx, "slave-cluster-id"),
     zone_offset: optionalNumber(ctx, "zone-offset"),
-    use_cache: optionalBoolean(ctx, "use-cache"),
+    ...includeCache ? { use_cache: optionalBoolean(ctx, "use-cache") } : {},
     request_id: optionalString(ctx, "request-id"),
     preview_rows: optionalNumber(ctx, "preview-rows"),
     timeout_seconds: optionalNumber(ctx, "timeout-seconds"),
@@ -756,6 +757,7 @@ var metadataEventExport = createAnalysisMetaCapabilityCommand({
     queriesFlag,
     fieldsFlag,
     { name: "authenticated-only", type: "boolean", required: false, desc: "When true, export only authenticated events." },
+    certificationScopeFlag,
     metadataExportOutputFlag
   ],
   risk: "read",
@@ -764,7 +766,8 @@ var metadataEventExport = createAnalysisMetaCapabilityCommand({
     ...projectInput(ctx),
     queries: optionalQueries(ctx),
     fields: optionalJson(ctx, "fields"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   }),
   postProcess: metadataExportPostProcess("event", "events")
 });
@@ -947,6 +950,7 @@ var metadataPropertyExport = createAnalysisMetaCapabilityCommand({
     queriesFlag,
     fieldsFlag,
     { name: "authenticated-only", type: "boolean", required: false, desc: "When true, export only authenticated properties." },
+    certificationScopeFlag,
     metadataExportOutputFlag
   ],
   risk: "read",
@@ -958,7 +962,8 @@ var metadataPropertyExport = createAnalysisMetaCapabilityCommand({
     event_name: optionalString(ctx, "event-name"),
     queries: optionalQueries(ctx),
     fields: optionalJson(ctx, "fields"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   }),
   postProcess: metadataExportPostProcess("property", "properties")
 });
@@ -1350,6 +1355,7 @@ var metadataMetricExport = createAnalysisMetaCapabilityCommand({
     queriesFlag,
     fieldsFlag,
     { name: "authenticated-only", type: "boolean", required: false, desc: "When true, export only authenticated metrics." },
+    certificationScopeFlag,
     metadataExportOutputFlag
   ],
   risk: "read",
@@ -1359,7 +1365,8 @@ var metadataMetricExport = createAnalysisMetaCapabilityCommand({
     ignore_authentication: optionalBoolean(ctx, "ignore-authentication"),
     queries: optionalQueries(ctx),
     fields: optionalJson(ctx, "fields"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   }),
   postProcess: metadataExportPostProcess("metric", "metrics")
 });
@@ -1500,13 +1507,13 @@ var ownTypesFlag = {
 var requiredQueriesFlag = {
   ...queriesFlag,
   required: true,
-  desc: "Required JSON array of 1 to 20 keyword filters. For first-pass asset discovery, use one broad search without --asset-types so results can include both dashboards and reports."
+  desc: "Required JSON array of 1 to 20 keyword filters. For first-pass asset discovery, use one broad search without --asset-types and request a large page; when has_more is true and no strong candidate is present, continue with next_offset before narrowing or rewriting keywords."
 };
 var analysisAssetSearch = createAnalysisCapabilityCommand({
   resource: "asset",
   command: "search",
   capabilityId: "analysis.asset.search",
-  description: "Search visible saved analysis assets by keyword. Default first-pass search should omit --asset-types to cover both dashboards and reports.",
+  description: "Search readable saved analysis assets by keyword, including shared read-only and editable dashboards and reports. Results are ranked before pagination by match quality, certification, recent heat/users, and governance impact. Omit --asset-types for first-pass discovery.",
   flags: [
     projectIdFlag,
     requiredQueriesFlag,
@@ -1635,7 +1642,16 @@ var statusFlag = { name: "status", type: "json", required: false, desc: "Operati
 var sortFieldFlag = { name: "sort-field", type: "string", required: false, desc: "Sort field." };
 var sortOrderFlag = { name: "sort-order", type: "string", required: false, desc: "Sort order: asc or desc." };
 var recordIdFlag = { name: "record-id", type: "number", required: false, desc: "Operation record ID." };
+var governanceExportFlags = (format) => [
+  requestIdFlag,
+  { ...artifactFormatFlag, desc: `Artifact format: ${format}. This capability supports only ${format}.` },
+  { ...asyncTimeoutSecondsFlag, max: 7200, desc: "Async export runtime in seconds. Default: 3600, max: 7200." }
+];
+var governanceExportFields = ["request_id", "format", "timeout_seconds"];
 var readers = {
+  request_id: (ctx) => optionalString(ctx, "request-id"),
+  format: (ctx) => optionalString(ctx, "artifact-format"),
+  timeout_seconds: (ctx) => optionalNumber(ctx, "timeout-seconds"),
   node_id: (ctx) => optionalString(ctx, "node-id"),
   resource_id: (ctx) => optionalString(ctx, "resource-id"),
   resource_type: (ctx) => optionalString(ctx, "resource-type"),
@@ -2238,6 +2254,715 @@ var metadataGovernanceRecommendationSubmit = createAnalysisMetaCapabilityCommand
   })
 });
 
+// src/commands/te-analysis/meta/governance-recommendation/auto-review.ts
+import { randomUUID } from "crypto";
+var windowDaysFlag3 = {
+  name: "window-days",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 365,
+  desc: "Usage window in days for the recommendation batch. Default: 90."
+};
+var limitFlag4 = {
+  name: "limit",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 100,
+  desc: "Maximum hot dashboard evidence packages selected before automatic asset review. Omit for CLI bounded expansion over top-20/top-50/top-100; pass explicitly for a fixed diagnostic scope."
+};
+var GOVERNANCE_RECOMMENDATION_AUTO_REVIEW_HELP = [
+  "Automatic asset certification contract:",
+  "- Use this command only when the user explicitly asks to automatically review or automatically certify recommended assets.",
+  "- Do not call this command for a plain recommendation request.",
+  "- Do not call this command when the user asks to submit recommendations to the review page.",
+  "- The command first validates project config agent_auto_asset_certification_enabled and project_semantic_enable. If disabled, report the returned config error and stop before collecting recommendations.",
+  "- When --limit is omitted, the CLI performs the same bounded expansion used by recurring page-review jobs: inspect top-20 pending material, then top-50/top-100 only when pending assets or pending dashboard branches are insufficient.",
+  "- Expansion is read-only. The CLI Agent builds automatic decisions once from the final selected material, then submits those decisions for execution and audit.",
+  "- When --limit is explicitly provided, respect that scope and do not expand it.",
+  "- Automatic review only certifies eligible asset candidates from the current recommendation batch. It does not create recommended metrics.",
+  "- CLI Agent blocks semantic duplicates, copy-like assets, synonym properties and ambiguous close definitions; every duplicate skip must name the conflicting asset targets.",
+  "- The result includes manual_review_handoff for assets still uncertified after automatic review. Use it only when the user later asks to submit those assets to the review page.",
+  "- For that later page submission, build the review packet from manual_review_handoff.page_review_items and relations so skipped assets keep their dashboard/report parent context; manual_review_handoff.items remains the exact unapproved review workload.",
+  "- Automatic decisions are recorded for audit. Page-visible reasons must be reviewer-readable Chinese; keep raw source/rule codes only in debug exports.",
+  "- Returned SKIP decisions mean the asset remains for manual review; do not describe skipped items as certified."
+].join("\n");
+var AUTO_REVIEW_CAPABILITY_ID = "metadata.governance_recommendation.auto_review";
+var EXPORT_CAPABILITY_ID = "metadata.governance_recommendation.export";
+var SUBMIT_CAPABILITY_ID = "metadata.governance_recommendation.submit";
+var DEFAULT_LIMIT = 20;
+var EXPANSION_LIMITS = [20, 50, 100];
+var MIN_PENDING_ASSETS = 10;
+var MIN_PENDING_WORK_UNITS = 3;
+var AUTO_REVIEW_DECISION_LIMIT = 100;
+var AUTO_REVIEW_MIN_HEAT = 50;
+var AUTO_REVIEW_MIN_USERS = 5;
+var AUTO_REVIEW_MIN_IMPACT = 2;
+var metadataGovernanceRecommendationAutoReview = {
+  service: "analysis-meta",
+  resource: "governance-recommendation",
+  command: "auto-review",
+  capabilityId: AUTO_REVIEW_CAPABILITY_ID,
+  description: "Automatically review and certify eligible recommended assets when the project switch is enabled.",
+  helpText: GOVERNANCE_RECOMMENDATION_AUTO_REVIEW_HELP,
+  flags: [projectIdFlag, windowDaysFlag3, limitFlag4],
+  risk: "write",
+  preflight: (ctx) => {
+    autoReviewInput(ctx);
+  },
+  validateInput: async (ctx) => validateCapability(
+    ctx.host(),
+    gatewayDomain(),
+    AUTO_REVIEW_CAPABILITY_ID,
+    autoReviewInput(ctx)
+  ),
+  dryRun: async (ctx) => dryRunCapability(
+    ctx.host(),
+    gatewayDomain(),
+    AUTO_REVIEW_CAPABILITY_ID,
+    autoReviewInput(ctx)
+  ),
+  execute: async (ctx) => {
+    const input = autoReviewInput(ctx);
+    if (hasExplicitLimit(ctx)) {
+      await validateCapabilityWithEnvelope(ctx.host(), gatewayDomain(), AUTO_REVIEW_CAPABILITY_ID, input);
+      const finalExport = await exportRecommendationMaterial(ctx, input, numberValue(input.limit) || DEFAULT_LIMIT);
+      const result2 = await executeCliAgentAutoReview(ctx, input, finalExport.data);
+      return withOutputMetadata({
+        ...record(result2.data),
+        manual_review_handoff: buildManualReviewHandoff(result2.data, finalExport.data)
+      }, result2.meta);
+    }
+    const plan = await planBoundedExpansion(ctx, input);
+    const expansion = plan.expansion;
+    const finalInput = { ...input, limit: expansion.final_limit };
+    const result = await executeCliAgentAutoReview(ctx, finalInput, plan.finalExport);
+    if (result.data && typeof result.data === "object" && !Array.isArray(result.data)) {
+      return withOutputMetadata({
+        ...result.data,
+        auto_review_expansion: expansion,
+        manual_review_handoff: buildManualReviewHandoff(result.data, plan.finalExport)
+      }, result.meta);
+    }
+    return withOutputMetadata(result.data, result.meta);
+  }
+};
+function autoReviewInput(ctx) {
+  return compactInput({
+    ...projectInput(ctx),
+    window_days: optionalNumber(ctx, "window-days"),
+    limit: optionalNumber(ctx, "limit")
+  });
+}
+function gatewayDomain() {
+  return resolveGatewayDomain("analysis-meta", "analysis");
+}
+function hasExplicitLimit(ctx) {
+  return typeof ctx.has === "function" ? ctx.has("limit") : ctx.str("limit") !== "";
+}
+async function executeCliAgentAutoReview(ctx, input, exportResult) {
+  const review = buildCliAgentAutoReview(input, exportResult);
+  if (review.decisions.length === 0) {
+    return {
+      data: {
+        ...review.base,
+        total: 0,
+        applied: 0,
+        recorded: 0,
+        failed: 0,
+        items: []
+      },
+      meta: {}
+    };
+  }
+  const submitted = await executeCapabilityWithEnvelope(ctx.host(), gatewayDomain(), SUBMIT_CAPABILITY_ID, {
+    ...input,
+    run_id: review.runId,
+    snapshot_hash: review.snapshotHash,
+    topic_id: "agent_auto_asset_certification",
+    topic_name: "Agent \u81EA\u52A8\u8BA4\u8BC1\u8D44\u4EA7",
+    decisions: review.decisions
+  });
+  const submittedData = record(submitted.data);
+  return {
+    data: {
+      ...review.base,
+      total: submittedData.total,
+      applied: submittedData.applied,
+      recorded: submittedData.recorded,
+      failed: submittedData.failed,
+      items: autoReviewItemsWithDisplayReason(submittedData.items)
+    },
+    meta: submitted.meta
+  };
+}
+async function planBoundedExpansion(ctx, input) {
+  await validateCapabilityWithEnvelope(ctx.host(), gatewayDomain(), AUTO_REVIEW_CAPABILITY_ID, {
+    ...input,
+    limit: DEFAULT_LIMIT
+  });
+  const attempts = [];
+  let finalExport = {};
+  let finalLimit = DEFAULT_LIMIT;
+  let stopReason = "top_100_inspected";
+  for (const limit of EXPANSION_LIMITS) {
+    const exported = await exportRecommendationMaterial(ctx, input, limit);
+    finalExport = exported.data;
+    const summary = summarizeExport(exported.data, limit);
+    attempts.push(summary);
+    finalLimit = limit;
+    const pendingAssets = numberValue(summary.pending_asset_candidates);
+    const pendingWorkUnits = numberValue(summary.pending_work_units);
+    const hasMore = summary.has_more === true;
+    if (pendingAssets >= MIN_PENDING_ASSETS && pendingWorkUnits >= MIN_PENDING_WORK_UNITS) {
+      stopReason = "sufficient_pending_scope";
+      break;
+    }
+    if (!hasMore) {
+      stopReason = "dashboard_pool_exhausted";
+      break;
+    }
+  }
+  return {
+    expansion: {
+      strategy: "bounded_hot_dashboard_expansion",
+      initial_limit: DEFAULT_LIMIT,
+      final_limit: finalLimit,
+      inspected_limits: attempts.map((attempt) => attempt.dashboard_limit),
+      min_pending_asset_candidates: MIN_PENDING_ASSETS,
+      min_pending_work_units: MIN_PENDING_WORK_UNITS,
+      attempts,
+      stop_reason: stopReason,
+      write_policy: "single_auto_review_execute_after_read_only_expansion"
+    },
+    finalExport
+  };
+}
+function exportRecommendationMaterial(ctx, input, limit) {
+  return executeCapabilityWithEnvelope(
+    ctx.host(),
+    gatewayDomain(),
+    EXPORT_CAPABILITY_ID,
+    compactInput({ ...input, limit, include_completed: false })
+  );
+}
+function summarizeExport(result, requestedLimit) {
+  const data = record(result);
+  const workUnits = array(data.work_units);
+  const coverage = record(data.coverage);
+  const pendingAssetCandidates = countPendingAssetCandidates(workUnits);
+  return {
+    dashboard_limit: numberValue(data.dashboard_limit) || requestedLimit,
+    run_id: stringValue(data.run_id),
+    snapshot_hash: stringValue(data.snapshot_hash),
+    selected_dashboards: numberValue(coverage.selected_dashboards),
+    returned_work_units: workUnits.length,
+    pending_work_units: workUnits.filter((unit) => numberValue(record(unit).actionable_count) > 0).length,
+    pending_asset_candidates: pendingAssetCandidates,
+    has_more: coverage.has_more === true
+  };
+}
+function countPendingAssetCandidates(workUnits) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const unit of workUnits) {
+    for (const candidate of array(record(unit).asset_candidates)) {
+      const item = record(candidate);
+      if (item.actionable !== true || item.action_state !== "PENDING") {
+        continue;
+      }
+      const type = stringValue(item.resource_type);
+      const key = stringValue(item.resource_key);
+      if (type && key) {
+        seen.add(`${type}|${key}`);
+      }
+    }
+  }
+  return seen.size;
+}
+function buildCliAgentAutoReview(input, exportResult) {
+  const exported = record(exportResult);
+  const material = record(exported.review_material_package);
+  const candidates = array(material.candidate_assets).map(record);
+  const runId = `rec_auto_${randomUUID().replace(/-/g, "")}`;
+  const snapshotHash = stringValue(exported.snapshot_hash);
+  const semanticConflicts = semanticDuplicateConflicts(candidates);
+  const decisions = [];
+  let approved = 0;
+  let skipped = 0;
+  let overflow = 0;
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const target = record(candidate.target_ref);
+    const type = stringValue(target.type);
+    const key = stringValue(target.key);
+    if (!type || !key || !seen.add(`${type}|${key}`)) continue;
+    if (candidate.actionable !== true || candidate.action_state !== "PENDING") continue;
+    if (decisions.length >= AUTO_REVIEW_DECISION_LIMIT) {
+      overflow++;
+      continue;
+    }
+    const verdict = cliAgentAutoReviewVerdict(candidate, semanticConflicts.get(`${type}|${key}`));
+    if (verdict.decision === "APPROVE") approved++;
+    else skipped++;
+    decisions.push({
+      item_type: "asset",
+      decision: verdict.decision,
+      resource_type: type,
+      resource_key: key,
+      evidence_hash: candidate.evidence_hash,
+      reason: verdict.reason
+    });
+  }
+  return {
+    runId,
+    snapshotHash,
+    decisions,
+    base: {
+      schema_version: "1.0",
+      run_id: runId,
+      project_id: input.project_id ?? exported.project_id,
+      window_days: input.window_days ?? exported.window_days,
+      dashboard_limit: input.limit ?? exported.dashboard_limit,
+      snapshot_hash: snapshotHash,
+      rule_version: "agent_auto_asset_certification_v1",
+      config_key: "agent_auto_asset_certification_enabled",
+      semantic_config_key: "project_semantic_enable",
+      auto_approved: approved,
+      skipped,
+      overflow
+    }
+  };
+}
+function cliAgentAutoReviewVerdict(candidate, semanticConflict) {
+  if (semanticConflict) {
+    return {
+      decision: "SKIP",
+      reason: autoReviewReason(`semantic_duplicate_targets=${encodeReasonPayload(semanticConflict)}`)
+    };
+  }
+  if (listIncludes(candidate.conflict_risks, "same_evidence_rejected_before")) {
+    return {
+      decision: "SKIP",
+      reason: autoReviewReason("same_evidence_rejected_before")
+    };
+  }
+  if (array(candidate.source_evidence).length === 0 && candidate.recommendation_role !== "source_dashboard") {
+    return {
+      decision: "SKIP",
+      reason: autoReviewReason("source_evidence_missing")
+    };
+  }
+  const heat = numberValue(candidate.heat_count90d);
+  const users = numberValue(candidate.user_count90d);
+  const impact = numberValue(candidate.impact_degree);
+  const matched = [];
+  if (heat >= AUTO_REVIEW_MIN_HEAT) matched.push(`heat_count90d>=${AUTO_REVIEW_MIN_HEAT}`);
+  if (users >= AUTO_REVIEW_MIN_USERS) matched.push(`user_count90d>=${AUTO_REVIEW_MIN_USERS}`);
+  if (impact > AUTO_REVIEW_MIN_IMPACT) matched.push(`impact_degree>${AUTO_REVIEW_MIN_IMPACT}.0`);
+  if (matched.length === 0) {
+    return {
+      decision: "SKIP",
+      reason: autoReviewReason(`signals_below_threshold: heat_count90d=${heat}, user_count90d=${users}, impact_degree=${impact}`)
+    };
+  }
+  return {
+    decision: "APPROVE",
+    reason: autoReviewReason(`matched=${matched.join(",")}; role=${stringValue(candidate.recommendation_role) ?? "asset"}`)
+  };
+}
+function autoReviewReason(reason) {
+  return `source=AGENT_AUTO_REVIEW; rule_version=agent_auto_asset_certification_v1; ${reason}`;
+}
+function autoReviewItemsWithDisplayReason(items) {
+  return array(items).map((value) => {
+    const item = record(value);
+    const copy = {
+      ...item,
+      semantic_duplicate_targets: semanticDuplicateTargetsFromReason(stringValue(item.reason) ?? "")
+    };
+    if (item.decision !== "APPROVE") {
+      copy.display_reason = autoReviewDisplayReason(item);
+    }
+    return copy;
+  });
+}
+function semanticDuplicateConflicts(candidates) {
+  const result = /* @__PURE__ */ new Map();
+  const comparable = candidates.map((candidate) => comparableAsset(candidate)).filter((candidate) => !!candidate);
+  for (const candidate of comparable) {
+    if (candidate.actionable !== true || candidate.actionState !== "PENDING") continue;
+    const matches = [];
+    for (const other of comparable) {
+      if (candidate.assetKey === other.assetKey) continue;
+      const basis = semanticDuplicateBasis(candidate, other);
+      if (basis) matches.push({ asset: other, basis });
+    }
+    if (!matches.length) continue;
+    matches.sort((left, right) => duplicateRank(right.asset) - duplicateRank(left.asset));
+    const targets = matches.slice(0, 3).map(({ asset, basis }) => ({
+      target_ref: { type: asset.type, key: asset.key },
+      display_name: asset.displayName,
+      resource_type: asset.type,
+      resource_key: asset.key,
+      authentication_status: asset.authenticationStatus,
+      action_state: asset.actionState,
+      reason: duplicateBasisText(basis)
+    }));
+    result.set(candidate.assetKey, {
+      targets,
+      basis: Array.from(new Set(matches.map((match) => match.basis))).map(duplicateBasisText)
+    });
+  }
+  return result;
+}
+function comparableAsset(candidate) {
+  const target = record(candidate.target_ref);
+  const type = stringValue(target.type);
+  const key = stringValue(target.key);
+  if (!type || !key) return void 0;
+  const displayName = stringValue(candidate.display_name) ?? key;
+  const evidence = record(candidate.evidence_snapshot);
+  const evidenceAsset = record(evidence.asset);
+  const description = stringValue(record(candidate.evidence_snapshot).description) ?? stringValue(evidenceAsset.description) ?? stringValue(candidate.description) ?? "";
+  return {
+    assetKey: `${type}|${key}`,
+    type,
+    key,
+    displayName,
+    description,
+    authenticationStatus: numberValue(evidenceAsset.authentication_status ?? candidate.authentication_status),
+    actionState: stringValue(candidate.action_state) ?? "",
+    actionable: candidate.actionable === true,
+    normalizedName: normalizeSemanticText(displayName || key),
+    canonicalName: canonicalDuplicateText(displayName || key),
+    aliasName: aliasDuplicateText(displayName || key),
+    normalizedDescription: normalizeSemanticText(description),
+    heat: numberValue(candidate.heat_count90d),
+    users: numberValue(candidate.user_count90d),
+    impact: numberValue(candidate.impact_degree)
+  };
+}
+function semanticDuplicateBasis(left, right) {
+  if (!left.normalizedName || !right.normalizedName) return void 0;
+  if (left.normalizedName.length >= 3 && left.normalizedName === right.normalizedName) return "same_display_name";
+  if (left.canonicalName.length >= 3 && left.canonicalName === right.canonicalName) return "copy_or_suffix_variant";
+  if (left.aliasName.length >= 3 && left.aliasName === right.aliasName && relatedAssetTypes(left.type, right.type)) {
+    return "business_alias_equivalent";
+  }
+  if (left.normalizedDescription.length >= 6 && left.normalizedDescription === right.normalizedDescription) {
+    return "same_description";
+  }
+  return void 0;
+}
+function relatedAssetTypes(left, right) {
+  if (left === right) return true;
+  return left.endsWith("_prop") && right.endsWith("_prop");
+}
+function duplicateRank(asset) {
+  return (asset.authenticationStatus === 1 ? 1e5 : 0) + (asset.actionState === "AUTHENTICATED" ? 5e4 : 0) + asset.heat + asset.users * 10 + asset.impact * 100;
+}
+function normalizeSemanticText(value) {
+  return value.toLowerCase().replace(/[\s_\-—–/\\|:：,，.。"'`【】\[\]()（）{}<>《》]/g, "").trim();
+}
+function canonicalDuplicateText(value) {
+  return normalizeSemanticText(value).replace(/(副本|复制|拷贝|备份|copy|backup|bak|test|测试|临时|tmp)+$/g, "").replace(/v\d+$/g, "").replace(/\d+$/g, "");
+}
+function aliasDuplicateText(value) {
+  return canonicalDuplicateText(value).replace(/(公司|企业|客户|客戶|client|customer|company|account)/g, "\u5BA2\u6237").replace(/(项目|工程|project)/g, "\u9879\u76EE").replace(/(用户|玩家|会员|user|player|member)/g, "\u7528\u6237");
+}
+function duplicateBasisText(value) {
+  switch (value) {
+    case "same_display_name":
+      return "\u8D44\u4EA7\u540D\u79F0\u4E00\u81F4";
+    case "copy_or_suffix_variant":
+      return "\u540D\u79F0\u4EC5\u5B58\u5728\u526F\u672C\u3001\u7248\u672C\u6216\u4E34\u65F6\u540E\u7F00\u5DEE\u5F02";
+    case "business_alias_equivalent":
+      return "\u4E1A\u52A1\u5BF9\u8C61\u8868\u8FF0\u76F8\u8FD1\uFF0C\u53EF\u80FD\u662F\u540C\u4E49\u5C5E\u6027\u6216\u76F8\u8FD1\u53E3\u5F84";
+    case "same_description":
+      return "\u8D44\u4EA7\u63CF\u8FF0\u4E00\u81F4";
+    default:
+      return value;
+  }
+}
+function encodeReasonPayload(value) {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+function decodeReasonPayload(value) {
+  try {
+    return record(JSON.parse(Buffer.from(value, "base64url").toString("utf8")));
+  } catch {
+    return {};
+  }
+}
+function semanticDuplicateTargetsFromReason(reason) {
+  const encoded = /semantic_duplicate_targets=([A-Za-z0-9_-]+)/.exec(reason)?.[1];
+  if (!encoded) return [];
+  return array(decodeReasonPayload(encoded).targets);
+}
+function listIncludes(value, expected) {
+  return array(value).some((item) => item === expected);
+}
+function buildManualReviewHandoff(autoReviewResult, exportResult) {
+  const result = record(autoReviewResult);
+  const exported = record(exportResult);
+  const material = record(exported.review_material_package);
+  const decisions = decisionsByAsset(result.items);
+  const candidates = array(material.candidate_assets);
+  const relations = array(material.relations).map(record);
+  const handoffItems = [];
+  const approved = /* @__PURE__ */ new Set();
+  for (const decision of decisions.values()) {
+    if (decision.decision === "APPROVE" && decision.landing_status === "APPLIED") {
+      approved.add(decision.assetKey);
+    }
+  }
+  const autoCertifiedItems = buildAutoCertifiedItems(decisions, candidates);
+  for (const value of candidates) {
+    const candidate = record(value);
+    const target = record(candidate.target_ref);
+    const type = stringValue(target.type);
+    const key = stringValue(target.key);
+    if (!type || !key) {
+      continue;
+    }
+    const assetKey = `${type}|${key}`;
+    if (approved.has(assetKey)) {
+      continue;
+    }
+    const decision = decisions.get(assetKey);
+    const actionable = candidate.actionable === true;
+    if (!decision && !actionable) {
+      continue;
+    }
+    const reviewReason = decision ? manualReviewReason(decision, candidate) : "\u672C\u6B21\u81EA\u52A8\u8BA4\u8BC1\u672A\u4EA7\u751F\u660E\u786E\u7ED3\u8BBA\uFF0C\u53EF\u80FD\u662F\u5019\u9009\u8D44\u4EA7\u8D85\u51FA\u672C\u6B21\u81EA\u52A8\u8BA4\u8BC1\u5904\u7406\u4E0A\u9650\u6216\u88AB\u53BB\u91CD\uFF0C\u8BF7\u4EBA\u5DE5\u786E\u8BA4\u3002";
+    handoffItems.push({
+      ...candidate,
+      auto_review_decision: decision ? decision.raw : {
+        decision: "NOT_REVIEWED",
+        reason: reviewReason
+      },
+      semantic_duplicate_targets: decision ? array(decision.raw.semantic_duplicate_targets) : [],
+      manual_review_reason: reviewReason
+    });
+  }
+  const pageReviewItems = buildPageReviewItems(handoffItems, candidates, relations, decisions);
+  const pageReviewIds = new Set(pageReviewItems.map((item) => stringValue(item.client_item_id)).filter(Boolean));
+  return {
+    schema_version: "1.0",
+    handoff_type: "auto_review_uncertified_assets_to_page_review",
+    project_id: result.project_id ?? exported.project_id,
+    source_auto_review_run_id: result.run_id,
+    source_export_run_id: exported.run_id,
+    snapshot_hash: exported.snapshot_hash ?? result.snapshot_hash,
+    dashboard_limit: exported.dashboard_limit ?? result.dashboard_limit,
+    auto_review_trace: {
+      run_id: result.run_id,
+      rule_version: result.rule_version,
+      auto_approved: result.auto_approved,
+      skipped: result.skipped,
+      overflow: result.overflow,
+      approved_items: autoCertifiedItems,
+      skipped_items: handoffItems.map((item) => ({
+        target_ref: record(item.target_ref),
+        display_name: item.display_name,
+        manual_review_reason: item.manual_review_reason
+      }))
+    },
+    auto_certified_items: autoCertifiedItems,
+    candidate_count: handoffItems.length,
+    items: handoffItems,
+    page_review_items: pageReviewItems,
+    page_review_context_count: pageReviewItems.length - handoffItems.length,
+    relations: relations.filter((edge) => pageReviewIds.has(stringValue(edge.parent)) && pageReviewIds.has(stringValue(edge.child))),
+    source_index: array(material.source_index).map(record).filter((source) => pageReviewIds.has(stringValue(source.client_item_id))),
+    quality_gates: array(material.quality_gates),
+    definition_policy: record(material.definition_policy),
+    submit_to_page_policy: {
+      command: "analysis-meta agent-review submit-to-page",
+      scope: "Submit page_review_items so unapproved assets keep dashboard/report parent context; only items without manual_review_context require human certification decisions.",
+      reason_field: "manual_review_reason",
+      source_metadata: "When submitting leftovers, copy manual_review_handoff.auto_review_trace to submit-to-page source_metadata.auto_review_trace so the page audit records show the assets Agent already certified.",
+      requires_user_submission_intent: true
+    }
+  };
+}
+function buildPageReviewItems(handoffItems, candidates, relations, decisions) {
+  const byId = /* @__PURE__ */ new Map();
+  const requiredIds = /* @__PURE__ */ new Set();
+  for (const value of candidates) {
+    const candidate = record(value);
+    const id = stringValue(candidate.client_item_id);
+    if (id) byId.set(id, candidate);
+  }
+  for (const item of handoffItems) {
+    const id = stringValue(item.client_item_id);
+    if (id) requiredIds.add(id);
+  }
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const edge of relations) {
+      const parent = stringValue(edge.parent);
+      const child = stringValue(edge.child);
+      if (parent && child && requiredIds.has(child) && !requiredIds.has(parent) && byId.has(parent)) {
+        requiredIds.add(parent);
+        changed = true;
+      }
+    }
+  }
+  const handoffById = new Map(handoffItems.map((item) => [stringValue(item.client_item_id), item]).filter((entry) => !!entry[0]));
+  return candidates.map(record).filter((candidate) => {
+    const id = stringValue(candidate.client_item_id);
+    return id !== void 0 && requiredIds.has(id);
+  }).map((candidate) => {
+    const id = stringValue(candidate.client_item_id) ?? "";
+    const handoff = handoffById.get(id);
+    if (handoff) return handoff;
+    const target = record(candidate.target_ref);
+    const type = stringValue(target.type);
+    const key = stringValue(target.key);
+    const decision = type && key ? decisions.get(`${type}|${key}`) : void 0;
+    return markContextCandidate(candidate, decision);
+  });
+}
+function markContextCandidate(candidate, decision) {
+  const item = { ...candidate };
+  item.manual_review_context = true;
+  item.manual_review_reason = "\u8BE5\u8D44\u4EA7\u7528\u4E8E\u4FDD\u7559\u81EA\u52A8\u53D1\u73B0\u9875\u9762\u7684\u7236\u5B50\u5C42\u7EA7\u548C\u6765\u6E90\u4E0A\u4E0B\u6587\uFF0C\u4E0D\u4F5C\u4E3A\u672C\u6B21\u4EBA\u5DE5\u5BA1\u6838\u5BF9\u8C61\u3002";
+  if (decision?.decision === "APPROVE" && decision.landing_status === "APPLIED") {
+    item.auto_review_decision = decision.raw;
+    item.auto_review_context_reason = autoReviewDisplayReason(decision.raw, candidate);
+    item.evidence_snapshot = markEvidenceAuthenticated(record(candidate.evidence_snapshot));
+  }
+  return item;
+}
+function markEvidenceAuthenticated(evidence) {
+  const snapshot = { ...evidence };
+  const asset = record(snapshot.asset);
+  if (Object.keys(asset).length) {
+    snapshot.asset = { ...asset, authentication_status: 1 };
+  }
+  return snapshot;
+}
+function decisionsByAsset(value) {
+  const result = /* @__PURE__ */ new Map();
+  for (const itemValue of array(value)) {
+    const item = record(itemValue);
+    if (item.item_type !== "asset") {
+      continue;
+    }
+    const type = stringValue(item.resource_type);
+    const key = stringValue(item.resource_key);
+    if (!type || !key) {
+      continue;
+    }
+    const assetKey = `${type}|${key}`;
+    result.set(assetKey, {
+      assetKey,
+      decision: stringValue(item.decision) ?? "",
+      landing_status: stringValue(item.landing_status) ?? "",
+      raw: item
+    });
+  }
+  return result;
+}
+function buildAutoCertifiedItems(decisions, candidates) {
+  const byAsset = /* @__PURE__ */ new Map();
+  for (const value of candidates) {
+    const candidate = record(value);
+    const target = record(candidate.target_ref);
+    const type = stringValue(target.type);
+    const key = stringValue(target.key);
+    if (type && key) byAsset.set(`${type}|${key}`, candidate);
+  }
+  const items = [];
+  for (const decision of decisions.values()) {
+    if (decision.decision !== "APPROVE" || decision.landing_status !== "APPLIED") continue;
+    const candidate = byAsset.get(decision.assetKey) ?? {};
+    items.push({
+      target_ref: record(candidate.target_ref),
+      display_name: candidate.display_name ?? decision.raw.resource_key,
+      auto_review_reason: autoReviewDisplayReason(decision.raw, candidate),
+      landing_message: decision.raw.landing_message
+    });
+  }
+  return items;
+}
+function manualReviewReason(decision, context) {
+  const reason = autoReviewDisplayReason(decision.raw, context);
+  if (decision.decision === "SKIP") {
+    return reason;
+  }
+  if (decision.decision === "APPROVE" && decision.landing_status !== "APPLIED") {
+    const landing = stringValue(decision.raw.landing_message);
+    return landing ? `${reason}; landing_${decision.landing_status.toLowerCase()}: ${landing}` : `${reason}; landing_${decision.landing_status.toLowerCase()}`;
+  }
+  return reason;
+}
+function autoReviewDisplayReason(raw, context = {}) {
+  const display = stringValue(raw.display_reason);
+  if (display) return display;
+  const reason = stringValue(raw.reason);
+  if (!reason) return "\u672C\u6B21\u81EA\u52A8\u8BA4\u8BC1\u6CA1\u6709\u8FD4\u56DE\u539F\u56E0\uFF0C\u8BF7\u4EBA\u5DE5\u786E\u8BA4\u3002";
+  return humanizeAutoReviewReason(reason, context);
+}
+function humanizeAutoReviewReason(reason, context) {
+  if (reason.includes("semantic_duplicate_targets=")) {
+    const targets = semanticDuplicateTargetsFromReason(reason).map(record).map((target) => {
+      const ref = record(target.target_ref);
+      const label = stringValue(target.display_name) ?? stringValue(target.resource_key) ?? stringValue(ref.key) ?? "\u672A\u77E5\u8D44\u4EA7";
+      const type = stringValue(target.resource_type) ?? stringValue(ref.type) ?? "asset";
+      const key = stringValue(target.resource_key) ?? stringValue(ref.key) ?? "-";
+      const targetReason = stringValue(target.reason);
+      return `${label}\uFF08${type}:${key}${targetReason ? `\uFF0C${targetReason}` : ""}\uFF09`;
+    });
+    const targetText = targets.length ? targets.join("\uFF1B") : "\u76F8\u8FD1\u8D44\u4EA7";
+    return `\u672A\u81EA\u52A8\u8BA4\u8BC1\u539F\u56E0\uFF1A\u7591\u4F3C\u4E0E ${targetText} \u8BED\u4E49\u91CD\u590D\u6216\u53E3\u5F84\u76F8\u8FD1\u3002\u8BF7\u4EBA\u5DE5\u786E\u8BA4\u662F\u5426\u5E94\u4F5C\u4E3A\u72EC\u7ACB\u8D44\u4EA7\u8BA4\u8BC1\uFF1B\u5982\u679C\u53EA\u662F\u526F\u672C\u3001\u540C\u4E49\u5C5E\u6027\u6216\u76F8\u8FD1\u53E3\u5F84\uFF0C\u8BF7\u4F18\u5148\u9009\u62E9\u66F4\u6807\u51C6\u7684\u8D44\u4EA7\u3002`;
+  }
+  if (reason.includes("previous_decision_exists_for_different_evidence")) {
+    return "\u672A\u81EA\u52A8\u8BA4\u8BC1\u539F\u56E0\uFF1A\u68C0\u6D4B\u5230\u8BE5\u8D44\u4EA7\u5B58\u5728\u5386\u53F2\u5904\u7406\u8BB0\u5F55\uFF0C\u4F46\u672C\u6B21\u672A\u8FD4\u56DE\u53EF\u6838\u9A8C\u7684\u91CD\u590D\u5BF9\u8C61\u3002\u8BF7\u6309\u5F53\u524D\u8D44\u4EA7\u5B9A\u4E49\u548C\u6765\u6E90\u8BC1\u636E\u4EBA\u5DE5\u786E\u8BA4\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u7CFB\u7EDF\u53D1\u73B0\u4E86\u91CD\u590D\u8D44\u4EA7\u3002";
+  }
+  if (reason.includes("same_evidence_rejected_before")) {
+    return "\u672A\u81EA\u52A8\u8BA4\u8BC1\u539F\u56E0\uFF1A\u76F8\u540C\u8BA4\u8BC1\u5EFA\u8BAE\u6B64\u524D\u5DF2\u88AB\u4EBA\u5DE5\u9A73\u56DE\uFF0C\u81EA\u52A8\u8BA4\u8BC1\u4E0D\u4F1A\u8986\u76D6\u4EBA\u5DE5\u7ED3\u8BBA\u3002\u5982\u4E1A\u52A1\u53E3\u5F84\u5DF2\u8C03\u6574\uFF0C\u8BF7\u4EBA\u5DE5\u91CD\u65B0\u786E\u8BA4\u662F\u5426\u8BA4\u8BC1\u3002";
+  }
+  if (reason.includes("source_evidence_missing")) {
+    return "\u81EA\u52A8\u8BA4\u8BC1\u672A\u901A\u8FC7\uFF1A\u7F3A\u5C11\u53EF\u6838\u9A8C\u7684\u6765\u6E90\u8D44\u4EA7\u8BC1\u636E\uFF0C\u8BF7\u4EBA\u5DE5\u786E\u8BA4\u8D44\u4EA7\u6765\u6E90\u3001\u5B9A\u4E49\u548C\u4F9D\u8D56\u5173\u7CFB\u540E\u518D\u8BA4\u8BC1\u3002";
+  }
+  if (reason.includes("signals_below_threshold")) {
+    const heat = /heat_count90d=(\d+)/.exec(reason)?.[1];
+    const users = /user_count90d=(\d+)/.exec(reason)?.[1];
+    const impact = /impact_degree=([0-9.]+)/.exec(reason)?.[1];
+    return `\u81EA\u52A8\u8BA4\u8BC1\u672A\u901A\u8FC7\uFF1A\u8BE5\u8D44\u4EA7\u8FD1 90 \u5929\u8BBF\u95EE/\u4F7F\u7528 ${heat ?? "\u672A\u77E5"} \u6B21\u3001\u4F7F\u7528\u4EBA\u6570 ${users ?? "\u672A\u77E5"}\uFF0C\u5F71\u54CD\u5EA6 ${impact ?? "\u672A\u77E5"}\uFF0C\u672A\u8FBE\u5230\u81EA\u52A8\u8BA4\u8BC1\u9608\u503C\uFF0C\u8BF7\u4EBA\u5DE5\u786E\u8BA4\u662F\u5426\u4ECD\u9700\u8981\u8BA4\u8BC1\u3002`;
+  }
+  if (reason.includes("matched=")) {
+    const matched = [];
+    if (reason.includes("heat_count90d>=")) matched.push("\u8BBF\u95EE/\u4F7F\u7528\u6B21\u6570\u8FBE\u5230\u9608\u503C");
+    if (reason.includes("user_count90d>=")) matched.push("\u4F7F\u7528\u4EBA\u6570\u8FBE\u5230\u9608\u503C");
+    if (reason.includes("impact_degree>")) matched.push("\u5F71\u54CD\u5EA6\u8FBE\u5230\u9608\u503C");
+    const matchedText = matched.length ? matched.join("\u3001") : "\u547D\u4E2D\u81EA\u52A8\u8BA4\u8BC1\u89C4\u5219";
+    return `Agent \u81EA\u52A8\u8BA4\u8BC1\u901A\u8FC7\uFF1A\u8BE5\u8D44\u4EA7\u8FD1 90 \u5929\u8BBF\u95EE/\u4F7F\u7528 ${displaySignal(context.heat_count90d)} \u6B21\u3001\u4F7F\u7528\u4EBA\u6570 ${displaySignal(context.user_count90d)}\uFF0C\u5F71\u54CD\u5EA6 ${displaySignal(context.impact_degree)}\uFF1B\u672A\u53D1\u73B0\u8BED\u4E49\u91CD\u590D\u98CE\u9669\uFF0C\u4E14${matchedText}\u3002`;
+  }
+  return reason.replace(/^source=AGENT_AUTO_REVIEW;\s*/, "").replace(/rule_version=[^;]+;\s*/, "").replace(/conflict_risks=\[[^\]]*]/, "\u81EA\u52A8\u8BA4\u8BC1\u672A\u901A\u8FC7\uFF1A\u5B58\u5728\u9700\u8981\u4EBA\u5DE5\u786E\u8BA4\u7684\u5BA1\u6838\u98CE\u9669\u3002").replace(/conflict_risks=/, "\u81EA\u52A8\u8BA4\u8BC1\u672A\u901A\u8FC7\uFF1A\u5B58\u5728\u9700\u8981\u4EBA\u5DE5\u786E\u8BA4\u7684\u5BA1\u6838\u98CE\u9669\u3002");
+}
+function displaySignal(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "string" && value.trim()) return value;
+  return "\u672A\u77E5";
+}
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function array(value) {
+  return Array.isArray(value) ? value : [];
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+
 // src/commands/te-analysis/meta/governance-recommendation/decisions.ts
 var runIdFlag2 = {
   name: "run-id",
@@ -2245,7 +2970,7 @@ var runIdFlag2 = {
   required: false,
   desc: "Optional run_id filter."
 };
-var limitFlag4 = {
+var limitFlag5 = {
   name: "limit",
   type: "number",
   required: false,
@@ -2258,7 +2983,7 @@ var metadataGovernanceRecommendationDecisions = createAnalysisMetaCapabilityComm
   command: "decisions",
   capabilityId: "metadata.governance_recommendation.decisions",
   description: "List recent CLI Agent recommendation approval decisions.",
-  flags: [projectIdFlag, runIdFlag2, limitFlag4],
+  flags: [projectIdFlag, runIdFlag2, limitFlag5],
   risk: "read",
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
@@ -2271,6 +2996,7 @@ var metadataGovernanceRecommendationDecisions = createAnalysisMetaCapabilityComm
 var commands11 = [
   metadataGovernanceRecommendationExport,
   metadataGovernanceRecommendationSubmit,
+  metadataGovernanceRecommendationAutoReview,
   metadataGovernanceRecommendationDecisions
 ];
 var governance_recommendation_default = commands11;
@@ -2322,7 +3048,7 @@ function object(value, name) {
   }
   return value;
 }
-function array(value, name) {
+function array2(value, name) {
   if (!Array.isArray(value) || value.length < 1 || value.length > 5e3) {
     throw new Error(`${name} must contain 1 to 5000 items.`);
   }
@@ -2367,6 +3093,7 @@ var SUBMIT_TO_PAGE_HELP = [
   "- relations should let the page render dashboard -> report -> metadata with contains/uses edges. Use an empty relations array only when the package truly has no known parent-child evidence.",
   "- Each submitted item must keep source_link or evidence_links[].url so reviewers can jump to source evidence.",
   "- item.ai_summary.summary is the per-item recommendation reason. It must cite concrete item evidence, not generic review boilerplate. batch ai_summary.summary is only the batch overview.",
+  "- When submitting manual_review_handoff leftovers, copy manual_review_handoff.auto_review_trace into source_metadata.auto_review_trace so page audit records include the assets already certified automatically.",
   "- For reports and SQL reports, item.ai_summary.analysis_explanation must explain reviewer-readable calculations or measures from packaged evidence_snapshot.analysis. A purpose-only summary is incomplete and is rejected locally before dispatch.",
   "- Reviewer-visible text should follow the project-KB source style: one business Chinese Agent summary that explains purpose, calculation caliber, filters, time scope, boundaries, and concrete reviewer questions. Keep raw SQL, parser labels, temporary aliases, parameter placeholders, hashes, and evidence paths in evidence_snapshot only; independent Agent preflight flags visible implementation terms as quality findings.",
   "- The command output includes review_page_url when review_url is present. Return review_page_url to the user; do not prepend the Common/API host to review_url yourself.",
@@ -2378,6 +3105,7 @@ var SUBMIT_TO_PAGE_HELP = [
   '  "title": "<review batch title>",',
   '  "source_run_id": "<export.run_id>",',
   '  "source_task_id": "<optional preauthorized task id>",',
+  '  "source_metadata": { "auto_review_trace": "<optional trace from manual_review_handoff.auto_review_trace>" },',
   '  "ai_summary": { "summary": "<batch overview>" },',
   '  "presentation_snapshot": {',
   '    "project": { "id": 1, "name": "<project name>" },',
@@ -2465,7 +3193,7 @@ var agentReviewSubmitToPage = createAnalysisMetaCapabilityCommand({
   postProcess: (result, _input, ctx) => normalizeSubmitResult(result, resolvePublicWebHost(ctx.host()), ctx.host())
 });
 function validateInput(input) {
-  const items = array(input.items, "items").map((value) => {
+  const items = array2(input.items, "items").map((value) => {
     const item = object(value, "items[]");
     fields(item, [
       "client_item_id",
@@ -2512,6 +3240,7 @@ function validateInput(input) {
     "title",
     "source_run_id",
     "source_task_id",
+    "source_metadata",
     "ai_summary",
     "presentation_snapshot",
     "items"
@@ -2581,7 +3310,7 @@ function validateEvidenceLinks(item) {
   const sourceLink = typeof item.source_link === "string" && item.source_link.trim();
   let evidenceLink = false;
   if ("evidence_links" in item) {
-    evidenceLink = array(item.evidence_links, "items[].evidence_links").some((value) => {
+    evidenceLink = array2(item.evidence_links, "items[].evidence_links").some((value) => {
       const link = object(value, "items[].evidence_links[]");
       return typeof link.url === "string" && !!link.url.trim();
     });
@@ -2592,17 +3321,17 @@ function validateEvidenceLinks(item) {
 }
 function validatePresentation(presentation, itemIds) {
   const displayed = /* @__PURE__ */ new Set();
-  for (const topicValue of array(presentation.topics, "presentation_snapshot.topics")) {
+  for (const topicValue of array2(presentation.topics, "presentation_snapshot.topics")) {
     const topic = object(topicValue, "presentation_snapshot.topics[]");
     if ("items" in topic) {
       throw new Error("presentation_snapshot.topics[] must use groups[].items, not top-level items.");
     }
-    for (const groupValue of array(topic.groups, "presentation_snapshot.topics[].groups")) {
+    for (const groupValue of array2(topic.groups, "presentation_snapshot.topics[].groups")) {
       const group = object(groupValue, "presentation_snapshot.topics[].groups[]");
       if (typeof group.id !== "string" || !group.id.trim() || typeof group.name !== "string" || !group.name.trim()) {
         throw new Error("presentation_snapshot.topics[].groups[] requires nonempty string id and name.");
       }
-      for (const itemValue of array(group.items, "presentation_snapshot.topics[].groups[].items")) {
+      for (const itemValue of array2(group.items, "presentation_snapshot.topics[].groups[].items")) {
         const item = object(itemValue, "presentation_snapshot.topics[].groups[].items[]");
         if (typeof item.id !== "string" || !item.id.trim()) {
           throw new Error("presentation_snapshot display items require nonempty string id.");
@@ -2649,7 +3378,7 @@ var agentReviewReview = createAnalysisMetaCapabilityCommand({
     { name: "decisions", type: "json", required: true, desc: "Versioned decisions: item_id (string), version (integer), decision APPROVE/DEFER/REJECT, reason (required for DEFER/REJECT)." }
   ],
   buildInput: (ctx) => {
-    const decisions = array(ctx.json("decisions"), "--decisions").map((value) => {
+    const decisions = array2(ctx.json("decisions"), "--decisions").map((value) => {
       const decision = object(value, "decisions[]");
       fields(decision, ["item_id", "version", "decision", "reason"], "decisions[]");
       decimalId(decision.item_id, "decisions[].item_id");
@@ -2686,7 +3415,7 @@ var agentReviewRetry = createAnalysisMetaCapabilityCommand({
     { name: "item-ids", type: "json", required: true, desc: "1 to 5000 failed item IDs as decimal strings. Successful items must not be retried." }
   ],
   buildInput: (ctx) => {
-    const ids = array(ctx.json("item-ids"), "--item-ids").map((id) => decimalId(id, "item_ids[]"));
+    const ids = array2(ctx.json("item-ids"), "--item-ids").map((id) => decimalId(id, "item_ids[]"));
     unique(ids, "item_ids");
     return { ...batchInput(ctx), client_request_id: text(ctx, "client-request-id"), item_ids: ids };
   }
@@ -2770,9 +3499,9 @@ var analysisMetaAssetUsageList = createAnalysisGovernanceCapabilityCommand({
   command: "list",
   capabilityId: "governance.asset.list",
   description: "List assets for usage governance.",
-  flags: [projectIdFlag, queryFlag, searchsFlag, ruleFlag, operationTypeFlag, directoryLimitFlag, directoryOffsetFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdFlag, queryFlag, searchsFlag, ruleFlag, operationTypeFlag, directoryLimitFlag, directoryOffsetFlag, payloadFlag],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["query", "searchs", "rule", "operation_type", "limit", "offset"])
+  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_id", "query", "searchs", "rule", "operation_type", "limit", "offset"])
 });
 
 // src/commands/te-analysis/meta/asset/usage-export.ts
@@ -2780,10 +3509,11 @@ var analysisMetaAssetUsageExport = createAnalysisGovernanceCapabilityCommand({
   resource: "asset",
   command: "export",
   capabilityId: "governance.asset.export",
-  description: "Export asset usage governance rows as an inline gateway result.",
-  flags: [projectIdFlag, queryFlag, searchsFlag, ruleFlag, operationTypeFlag, limitFlag, offsetFlag, payloadFlag],
+  description: "Export asset usage governance rows as an asynchronous artifact; optionally wait and download.",
+  flags: [projectIdFlag, nodeIdFlag, queryFlag, searchsFlag, ruleFlag, operationTypeFlag, limitFlag, offsetFlag, payloadFlag, ...governanceExportFlags("jsonl")],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["query", "searchs", "rule", "operation_type", "limit", "offset"])
+  asyncArtifact: true,
+  buildInput: (ctx) => assetGovernanceInput(ctx, [...governanceExportFields, "node_id", "query", "searchs", "rule", "operation_type", "limit", "offset"])
 });
 
 // src/commands/te-analysis/meta/asset/lineage-get.ts
@@ -2891,9 +3621,10 @@ var analysisMetaAssetBatchInfoExport = createAnalysisGovernanceCapabilityCommand
   command: "batch-info-export",
   capabilityId: "governance.asset.batch_export_info",
   description: "Batch export asset information.",
-  flags: [projectIdFlag, nodeIdsFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdsFlag, payloadFlag, ...governanceExportFlags("xlsx")],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids"])
+  asyncArtifact: true,
+  buildInput: (ctx) => assetGovernanceInput(ctx, [...governanceExportFields, "node_ids"])
 });
 
 // src/commands/te-analysis/meta/asset/batch-sql-export.ts
@@ -2902,9 +3633,10 @@ var analysisMetaAssetBatchSqlExport = createAnalysisGovernanceCapabilityCommand(
   command: "batch-sql-export",
   capabilityId: "governance.asset.batch_export_sql",
   description: "Batch export asset SQL definitions.",
-  flags: [projectIdFlag, nodeIdsFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdsFlag, payloadFlag, ...governanceExportFlags("xlsx")],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids"])
+  asyncArtifact: true,
+  buildInput: (ctx) => assetGovernanceInput(ctx, [...governanceExportFields, "node_ids"])
 });
 
 // src/commands/te-analysis/meta/asset/batch-delete.ts
@@ -2979,9 +3711,10 @@ var analysisMetaAssetOperationRecordExport = createAnalysisGovernanceCapabilityC
   command: "export",
   capabilityId: "governance.operation_record.export",
   description: "Export one asset batch operation record result.",
-  flags: [projectIdFlag, recordIdFlag, payloadFlag],
+  flags: [projectIdFlag, recordIdFlag, payloadFlag, ...governanceExportFlags("xlsx")],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["record_id"])
+  asyncArtifact: true,
+  buildInput: (ctx) => assetGovernanceInput(ctx, [...governanceExportFields, "record_id"])
 });
 
 // src/commands/te-analysis/governance/asset-authentication-shared.ts
@@ -3359,7 +4092,7 @@ var reportList = createAnalysisCapabilityCommand({
   resource: "report",
   command: "list",
   capabilityId: "analysis.report.list",
-  description: "List analysis reports visible to the current user through the capability gateway.",
+  description: "List analysis reports the current user can edit or manage. Read-only reports are excluded; use analysis asset search for readable asset discovery.",
   flags: [
     projectIdFlag,
     queriesFlag,
@@ -3439,7 +4172,7 @@ var REPORT_WRITE_MODEL_TYPE_VALUES = [
 ];
 var REPORT_WRITE_MODEL_DESCRIPTION = `${AI_MODEL_DESCRIPTION} Report create/update also supports tag for saved tag report data; use tag as the AI-facing spelling.`;
 var AI_DEFINITION_DESCRIPTION = 'Event metrics: omit optional display_name unless the target command schema explicitly supports it. Funnel step filters use event_property_name (not field) and string-array values, including "true"/"false" for boolean properties. For tag/cluster filters, cluster_date_policy accepts LATEST (default), AUTO (match the computed result for each analysis date), or SPECIFIED (requires specified_cluster_date in yyyy-MM-dd format). AI-facing model definition JSON. Do not pass raw QP, events, event_view, visual_view, or analysis_query. Distribution filters must be attached to the corresponding distribution_metrics[].filters; do not use top-level filters or relation. For path definitions, global filters support user_property, cluster, and tag only; event_property is not supported. session_unit accepts second (1..999), minute (1..999), or hour (1..24). Do not use day; express one day as session_interval=24 and session_unit=hour. For SQL, a simple query is {"sql":"select ..."}; raw variables use ${name}, while typed params use ${Text:name}, ${Selector:name}, or ${PartDate:name}. PartDate expands to a complete predicate, so write WHERE ${PartDate:d}, not a column followed by the placeholder. A part_date parameter may set boolean use_timezone; it defaults to false and controls whether that parameter uses the query effective timezone. Selector value must match one options[].value. Trino identifiers containing #, $, @, spaces, punctuation, or a reserved word must be delimited with double quotes, for example SELECT "#user_id", "$part_event", "end" FROM ...; single quotes are string literals. For multiline SQL JSON, the decoded sql value must contain a real line break; do not submit a literal \\n sequence outside quoted SQL text. Queries against an event table must include a date-partition predicate on the quoted "$part_date" column, for example WHERE "$part_date" BETWEEN \'2026-07-01\' AND \'2026-07-07\'; the backend rejects event-table SQL without it. The CLI preserves SQL text and never auto-quotes identifiers.';
-var REPORT_WRITE_DEFINITION_DESCRIPTION = `${AI_DEFINITION_DESCRIPTION} For model_type=tag, pass a tag report intent such as {"tag":{"tag_name":"vip_users","time_range":{"mode":"recent","unit":"day","value":7}}}. Tags are supported for report create/update and report data, not ad-hoc analysis.`;
+var REPORT_WRITE_DEFINITION_DESCRIPTION = `${AI_DEFINITION_DESCRIPTION} Saved-report filters may contain one compound group level only; every item inside that group must be a leaf without another items array. Historical deeper trees remain readable but cannot be written back as a definition. For model_type=tag, pass a tag report intent such as {"tag":{"tag_name":"vip_users","time_range":{"mode":"recent","unit":"day","value":7}}}. Tags are supported for report create/update and report data, not ad-hoc analysis.`;
 function aiModelTypeFlag(required) {
   return {
     name: "model-type",
@@ -3453,18 +4186,32 @@ function validateFunnelStepFilters(modelType, definition) {
   const steps = definition.funnel.steps;
   if (!Array.isArray(steps)) return;
   const errors = [];
-  steps.forEach((step, stepIndex) => {
-    if (!isRecord(step) || !Array.isArray(step.filters)) return;
-    step.filters.forEach((filter, filterIndex) => {
-      if (!isRecord(filter)) return;
-      const location = `definition.funnel.steps[${stepIndex}].filters[${filterIndex}]`;
-      if ("field" in filter || typeof filter.event_property_name !== "string" || !filter.event_property_name.trim()) {
-        errors.push(`${location}: use a non-empty event_property_name, not a generic field object.`);
+  const visit = (filter, location) => {
+    if (!isRecord(filter)) {
+      errors.push(`${location}: use a filter object.`);
+      return;
+    }
+    if ("items" in filter) {
+      if (Object.keys(filter).some((key) => key !== "items" && key !== "relation")) {
+        errors.push(`${location}: compound groups contain only items and relation; put event_property_name and operator on their leaf items.`);
       }
-      if ("values" in filter && (!Array.isArray(filter.values) || filter.values.some((value) => typeof value !== "string"))) {
-        errors.push(`${location}.values: use an array of strings (boolean properties use "true" or "false").`);
+      if (!Array.isArray(filter.items) || filter.items.length === 0) {
+        errors.push(`${location}.items: use a non-empty array of event-property filters or nested groups.`);
+      } else {
+        filter.items.forEach((item, index) => visit(item, `${location}.items[${index}]`));
       }
-    });
+      return;
+    }
+    if ("field" in filter || typeof filter.event_property_name !== "string" || !filter.event_property_name.trim()) {
+      errors.push(`${location}: use a non-empty event_property_name, not a generic field object.`);
+    }
+    if ("values" in filter && (!Array.isArray(filter.values) || filter.values.some((value) => typeof value !== "string"))) {
+      errors.push(`${location}.values: use an array of strings (boolean properties use "true" or "false").`);
+    }
+  };
+  steps.forEach((step, stepIndex) => {
+    if (!isRecord(step) || !Array.isArray(step.filters)) return;
+    step.filters.forEach((filter, filterIndex) => visit(filter, `definition.funnel.steps[${stepIndex}].filters[${filterIndex}]`));
   });
   if (errors.length) {
     throw new CliValidationError(errors.join("\n"), {
@@ -3554,7 +4301,7 @@ var reportCreate = createAnalysisCapabilityCommand({
 function validateReportUpdate(ctx) {
   const hasDefinition = ctx.str("definition") !== "";
   const hasResolutions = ctx.json("resolutions") !== void 0;
-  const hasMetadataUpdate = ctx.str("report-name") !== "" || ctx.str("report-desc") !== "";
+  const hasMetadataUpdate = ctx.str("report-name") !== "" || optionalStringPreserveEmpty(ctx, "report-desc") !== void 0;
   if (!hasDefinition && !hasMetadataUpdate) {
     throw new Error("At least one of --report-name, --report-desc, or --definition is required.");
   }
@@ -3576,7 +4323,7 @@ var reportUpdate = createAnalysisCapabilityCommand({
     { name: "report-id", type: "number", required: true, desc: "Report ID to update." },
     { name: "report-version", type: "number", required: true, desc: "Current report version from report get." },
     { name: "report-name", type: "string", required: false, desc: "New report display name." },
-    { name: "report-desc", type: "string", required: false, desc: "New report description." },
+    { name: "report-desc", type: "string", required: false, desc: "New report description. Pass an empty string to clear it; omit to preserve it." },
     reportWriteModelTypeFlag(false),
     reportWriteDefinitionFlag(false),
     modelDefinitionIntentSnapshotFlag,
@@ -3592,7 +4339,7 @@ var reportUpdate = createAnalysisCapabilityCommand({
     report_id: ctx.num("report-id"),
     version: ctx.num("report-version"),
     report_name: optionalString(ctx, "report-name"),
-    report_desc: optionalString(ctx, "report-desc"),
+    report_desc: optionalStringPreserveEmpty(ctx, "report-desc"),
     model_type: optionalString(ctx, "model-type"),
     definition: optionalJson(ctx, "definition"),
     resolutions: optionalJson(ctx, "resolutions"),
@@ -3841,7 +4588,7 @@ var dashboardList = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "list",
   capabilityId: "analysis.dashboard.list",
-  description: "List dashboards visible to the current user through the capability gateway.",
+  description: "List dashboards the current user can update or manage. Read-only dashboards are excluded; use analysis asset search for readable asset discovery.",
   flags: [
     projectIdFlag,
     queriesFlag,
@@ -4176,14 +4923,13 @@ var dashboardReportDataExport = createAnalysisCapabilityCommand({
     clusterQueryScopeFlag,
     slaveClusterIdFlag,
     { name: "zone-offset", type: "number", required: false, desc: reportDataZoneOffsetDescription },
-    { name: "use-cache", type: "boolean", required: false, desc: "Whether to use cache. Default: true." },
     { name: "request-id", type: "string", required: false, desc: "Optional cli_<32 lowercase hex> request ID. Generated when omitted." },
     asyncTimeoutSecondsFlag,
     { name: "artifact-format", type: "string", required: false, desc: "Artifact format. Only jsonl is supported." }
   ],
   risk: "read",
   validate: validateClusterQueryRouting,
-  buildInput: dashboardReportDataInput
+  buildInput: (ctx) => dashboardReportDataInput(ctx, false)
 });
 
 // src/commands/te-analysis/dashboard-report-data/index.ts
@@ -6592,7 +7338,7 @@ var sqlTableColumns = createAnalysisCapabilityCommand({
       name: "table-ref",
       type: "string",
       required: true,
-      desc: "Exact table_ref returned by analysis sql-table list; a unique table-only reference is also accepted."
+      desc: "Exact table_ref or quoted sql_reference returned by analysis sql-table list; a unique table-only reference is also accepted."
     },
     sqlTableUsageFlag
   ],
@@ -6609,7 +7355,7 @@ var sqlTableList = createAnalysisCapabilityCommand({
   resource: "sql-table",
   command: "list",
   capabilityId: "analysis.sql_table.list",
-  description: "List server-authoritative SQL table references queryable by the current user in a project.",
+  description: "List server-authoritative SQL table references queryable by the current user in a project, including authorized space tables. Use sql_reference when copying a table into SQL.",
   flags: [projectIdFlag, queriesFlag, directoryLimitFlag, directoryOffsetFlag, sqlTableUsageFlag],
   risk: "read",
   validate: validateQueriesFlag,