@thinkingai/ae-cli 6.0.55 → 6.0.56

package/README.md

@@ -62,11 +62,11 @@ ae-cli update --dry-run
 
 Updates use the same global Skills installation and verification as `install`. Older packages need no installer or generated manifest: their bundled Skills define the expected contents. If Skills fail after the CLI installs, the result reports partial completion and can be retried.
 
-Automatic synchronization runs during normal commands after login; host version checks are cached for up to 24 hours. `ae-cli update --host <AE_HOST>` checks immediately. After a downgrade, future updates run the older CLI's own updater, including its historical limitations. To use the new installer logic while following an older host, run `npx @thinkingai/ae-cli@latest update --host <AE_HOST>`; the target remains the host-required version.
+Automatic synchronization runs during normal commands after login; host version checks are cached for up to one hour. `ae-cli update --host <AE_HOST>` checks immediately. After a downgrade, future updates run the older CLI's own updater, including its historical limitations. To use the new installer logic while following an older host, run `npx @thinkingai/ae-cli@latest update --host <AE_HOST>`; the target remains the host-required version.
 
 `ae-cli update` installs the exact version required by the active host rather than npm `latest`. It synchronizes Skills from the installed npm package first and uses the matching GitHub tag only as a fallback.
 
-Starting with the `6.0.37` and `6.1.9` release lines, ordinary business commands can automatically upgrade or downgrade the CLI to the host-required version. After a successful synchronization, the old process exits with `AE_CLI_VERSION_SYNCED`; re-run the original command so it executes with the new CLI and Skills. Installation failures are reported without replacing the business command's JSON output.
+Starting with the `6.0.37` and `6.1.9` release lines, ordinary business commands can automatically upgrade or downgrade the CLI to the host-required version, including switching from `6.0.x` to `6.1.x`. Automatic synchronization requires stable `major.minor.patch` versions at both ends; development and other nonstandard versions are skipped. After a successful synchronization, the old process exits with `AE_CLI_VERSION_SYNCED`; re-run the original command so it executes with the new CLI and Skills. Installation failures are reported without replacing the business command's JSON output.
 
 Useful controls:
 
@@ -143,6 +143,7 @@ The table covers every current root command individually. Use `ae-cli --help` fo
 | Agent platform | `context` | Read the current product-page context authorized for the active Agent Run |
 | Agent platform | `memory` | AgentSpace memory, drafts, shared review, extraction jobs, revisions, and state transitions |
 | Agent platform | `team` | Agent Team and TeamRun execution, chat, results, and artifacts |
+| Agent platform | `evaluation` | Agent Evaluation datasets, LLM judge evaluators, runs, case results, exports, schedules, and model/agent configs |
 | Agent platform | `system` | Root/admin management of members, sandboxes, tools, models, usage, quotas, and channels |
 | General tools | `capability` | Capability discovery, schema inspection, validation, dry-run, and generic execution |
 | General tools | `auth` | Host-scoped login, status, and multi-account management |
@@ -156,6 +157,8 @@ The table covers every current root command individually. Use `ae-cli --help` fo
 | Agent platform | `automation` | Automation configuration, execution, history, and results |
 <!-- root-command-surface:end -->
 
+Evaluation commands follow the current AE Host in personal terminals and sandboxes; use `--host` to select another host. Evaluation requests use the HTTP or HTTPS scheme configured for that AE Host, consistent with other AE commands. Legacy `--endpoint` and `AE_EVAL_BASE_URL` values may only match the current AE Host; other values fail before credentials are sent. Remove these settings and use `--host` to select a host. Outside a sandbox, export `AE_EVAL_ACCESS_TOKEN` with a platform session token; sandboxes can obtain a session automatically. See [endpoint and authentication rules](skills/ae-evaluation/SKILL.md#endpoint-and-authentication).
+
 ## Capability Gateway
 
 Capability Gateway is the preferred entry point for operations that do not need a dedicated curated command:
@@ -169,6 +172,10 @@ ae-cli capability dry-run analysis.report.list --input input.json
 ae-cli capability run analysis.report.list --input input.json
 ```
 
+Administrators can set each member's daily CLI call limit in External Access Management.
+
+For asynchronous exports, omit `--timeout-seconds` to use the server's default timeout. See the [export guide](skills/ae-analysis/references/analysis_data_export.md) for submitting, waiting for, and downloading results.
+
 `--input` accepts inline JSON, a JSON file path, `@<path>`, or `-` for stdin.
 
 Use `validate` while fixing complex nested input. Use `dry-run` when you need the final risk, output mode, cancellation support, or delete confirmation preview. Do not stack `validate` and `dry-run` for the same final payload by default; `dry-run` already validates it.
@@ -194,7 +201,7 @@ ae-cli auth status --host https://host-a.example.com
 # Import a CLI token copied from External Access Management (hidden prompt)
 ae-cli auth set-token --host https://host-a.example.com
 # Non-interactive input for local scripts or tests
-printf '%s' "$AE_CLI_TOKEN" | ae-cli auth set-token --host https://host-a.example.com --token-stdin
+printf '%s' "$IMPORTED_CLI_TOKEN" | ae-cli auth set-token --host https://host-a.example.com --token-stdin
 # For the uncommon case where one Host needs multiple accounts
 ae-cli auth login --host https://host-a.example.com --add
 ae-cli auth list --host https://host-a.example.com
@@ -216,6 +223,20 @@ A regular `auth login` keeps the simple one-Host/one-account behavior and replac
 
 `auth set-token` is for local use with a `cli_` token copied from External Access Management. It prompts without echo by default; `--token-stdin` supports non-interactive local testing. The CLI validates the token against the target Host before replacing the stored credential, encrypts it in the existing per-Host vault, and never includes the value in command output. Add `--add` to retain other accounts for the same Host.
 
+Inject credentials into the current CLI invocation through environment variables or a specified file without changing stored machine accounts. This supports automation scripts, CI/CD, shared Agents, and other workflows:
+
+```bash
+AE_CLI_TOKEN="$CALLER_CLI_TOKEN" AE_CLI_TOKEN_HOST=https://host-a.example.com ae-cli auth status
+AE_CLI_TOKEN_FILE=/secure/caller-token.json ae-cli auth status
+ae-cli --cli-token-file /secure/caller-token.json auth status
+```
+
+The token file is a read-only JSON object: `{"url":"https://host-a.example.com","token":"cli_REPLACE_WITH_USER_TOKEN"}`. The historical `cli-token` key is also accepted. Keep the file private to its owner (for example, mode `600`). Files must be regular JSON files no larger than 64 KiB. The file URL or `AE_CLI_TOKEN_HOST` selects the host for this invocation; an explicit `--host` must match it. External tokens are sent only to that origin; alternate service origins and HTTP redirects are rejected.
+
+Credential precedence is `--cli-token-file` > `AE_CLI_TOKEN` with required `AE_CLI_TOKEN_HOST` > `AE_CLI_TOKEN_FILE` > the existing stored-account/sandbox sources. An explicitly selected source that is empty, malformed, unreadable, or bound to a different host returns `EXTERNAL_CLI_TOKEN_INVALID`; it never falls back to another identity. External credentials also take precedence over sandbox identity headers for Agent calls. `auth status` reports `environment-cli-token` or `file-cli-token`, account and expiration when available, and never reveals the token. Authentication failures do not replace or delete stored credentials.
+
+External mode does not write the token or renewal state to the local credential vault. Renewal is best effort, uses the `cli-token` header, and is limited per host/token per process day; older servers without header-based renewal can still authenticate business calls but cannot automatically extend external tokens. `auth`, `auth login`, `auth set-token`, `auth use`, and `auth logout` return `EXTERNAL_CLI_TOKEN_ACTIVE` while external credentials are selected. Remove these process settings before managing machine accounts; `auth list` continues to list local accounts.
+
 The new CLI persists only CLI tokens, never access or refresh tokens. Multiple accounts live in an encrypted V1 vault while the active account is projected into the historical file shape for automatic downgrades. When the CLI upgrades again, it reconciles login, switch, or logout changes made by the old CLI.
 
 Login uses a cross-platform device-code flow. Use `--no-browser` when the environment cannot open a browser.

package/README.zh.md

@@ -66,11 +66,11 @@ ae-cli update --dry-run
 
 更新与 `install` 复用全局 Skills 安装和校验。旧包无需包含安装器或生成的清单，直接以目标包内置 Skills 为准。CLI 安装后 Skills 失败会返回部分成功信息，修复后可重复执行。
 
-自动同步在登录后的普通命令中触发，集群版本检查最长缓存 24 小时；`ae-cli update --host <AE_HOST>` 可立即查询。降级后，后续更新由旧版 CLI 自身执行，也受旧版实现限制。需要用新安装逻辑匹配旧集群时，可运行 `npx @thinkingai/ae-cli@latest update --host <AE_HOST>`，目标仍是集群要求的版本。
+自动同步在登录后的普通命令中触发，集群版本检查最长缓存 1 小时；`ae-cli update --host <AE_HOST>` 可立即查询。降级后，后续更新由旧版 CLI 自身执行，也受旧版实现限制。需要用新安装逻辑匹配旧集群时，可运行 `npx @thinkingai/ae-cli@latest update --host <AE_HOST>`，目标仍是集群要求的版本。
 
 `ae-cli update` 安装当前 Host 要求的精确版本，不依赖 npm `latest`。更新时优先从已安装的 npm 包同步 Skills，本地来源失败后才回退到对应的 GitHub tag。
 
-从 `6.0.37` 和 `6.1.9` 维护线开始，普通业务命令可以自动升级或降级到环境要求的版本。同步成功后，旧进程会返回 `AE_CLI_VERSION_SYNCED`；重新执行原命令，即可使用新的 CLI 和 Skills。安装失败会给出提示，但不会用安装输出污染业务命令的 JSON 结果。
+从 `6.0.37` 和 `6.1.9` 维护线开始，普通业务命令可以自动升级或降级到环境要求的版本，包括从 `6.0.x` 切换到 `6.1.x`。自动同步要求本地和目标均为 `主版本.次版本.补丁号` 格式的正式版本，开发版等不规则版本会跳过。同步成功后，旧进程会返回 `AE_CLI_VERSION_SYNCED`；重新执行原命令，即可使用新的 CLI 和 Skills。安装失败会给出提示，但不会用安装输出污染业务命令的 JSON 结果。
 
 常用控制方式：
 
@@ -147,6 +147,7 @@ ae-cli capability list --domain analysis --jq '.data.capabilities[] | .id'
 | Agent 平台 | `context` | 读取当前 Agent Run 已授权的产品页面上下文 |
 | Agent 平台 | `memory` | AgentSpace 记忆、草稿、共享审核、提取任务、版本与状态治理 |
 | Agent 平台 | `team` | Agent Team 和 TeamRun 的执行、对话、结果及产物 |
+| Agent 平台 | `evaluation` | Agent Evaluation 评测数据集、LLM 裁判、评测任务、用例结果、导出、调度，以及模型/Agent 配置 |
 | Agent 平台 | `system` | root/admin 的成员、沙盒、工具、模型、用量、配额和渠道管理 |
 | 通用工具 | `capability` | 能力发现、Schema 查看、参数校验、dry-run 和通用执行 |
 | 通用工具 | `auth` | 按 Host 登录、查看状态及管理同一 Host 的多个账号 |
@@ -160,6 +161,8 @@ ae-cli capability list --domain analysis --jq '.data.capabilities[] | .id'
 | Agent 平台 | `automation` | 自动化配置、执行、历史和结果 |
 <!-- root-command-surface:end -->
 
+评测命令在普通终端和沙箱中均跟随当前 AE Host，可通过 `--host` 切换。评测请求沿用该 AE Host 配置的 HTTP 或 HTTPS 协议，与其他 AE 命令一致。旧 `--endpoint` 和 `AE_EVAL_BASE_URL` 只能与当前 AE Host 一致，其他值会在发送凭证前报错；请移除这些配置，统一使用 `--host` 切换。沙箱外需设置 `AE_EVAL_ACCESS_TOKEN` 平台 session token，沙箱内可自动获取会话。详见 [地址与鉴权规则](skills/ae-evaluation/SKILL.md#endpoint-and-authentication)。
+
 ## Capability Gateway
 
 不需要独立精选命令的能力，应优先通过 Capability Gateway 调用：
@@ -173,6 +176,10 @@ ae-cli capability dry-run analysis.report.list --input input.json
 ae-cli capability run analysis.report.list --input input.json
 ```
 
+管理员可在“外部访问管理”为成员配置每日 CLI 调用限额。
+
+异步导出时，省略 `--timeout-seconds` 即使用服务端默认超时。提交、等待和下载结果的方法见[导出使用指南](skills/ae-analysis/references/analysis_data_export.md)。
+
 `--input` 支持内联 JSON、JSON 文件路径、`@<path>`，或通过 `-` 从 stdin 读取。
 
 复杂嵌套参数尚在调整时使用 `validate`；需要确认最终风险等级、输出模式、取消能力或删除门禁时使用 `dry-run`。默认不要对同一份最终入参连续执行 `validate` 和 `dry-run`，因为 `dry-run` 已包含参数校验。
@@ -198,7 +205,7 @@ ae-cli auth status --host https://host-a.example.com
 # 导入从“外部访问管理”复制的 CLI Token（隐藏输入）
 ae-cli auth set-token --host https://host-a.example.com
 # 本地脚本或测试使用非交互输入
-printf '%s' "$AE_CLI_TOKEN" | ae-cli auth set-token --host https://host-a.example.com --token-stdin
+printf '%s' "$IMPORTED_CLI_TOKEN" | ae-cli auth set-token --host https://host-a.example.com --token-stdin
 # 少量需要同一 Host 多账号的场景
 ae-cli auth login --host https://host-a.example.com --add
 ae-cli auth list --host https://host-a.example.com
@@ -220,6 +227,20 @@ ae-cli config remove pre-production --yes
 
 `auth set-token` 用于在本地导入从“外部访问管理”复制的 `cli_` Token。默认使用不回显的隐藏输入，`--token-stdin` 支持本地测试等非交互场景。CLI 会先向目标 Host 校验 Token，再替换本地凭证，并写入现有的按 Host 加密凭据库；命令输出不会包含 Token。需要保留同一 Host 的其他账号时增加 `--add`。
 
+支持通过环境变量或指定文件，为当前 CLI 调用注入凭证，不改变机器上已保存的账号；适用于自动化脚本、CI/CD、公共Agent等场景。
+
+```bash
+AE_CLI_TOKEN="$CALLER_CLI_TOKEN" AE_CLI_TOKEN_HOST=https://host-a.example.com ae-cli auth status
+AE_CLI_TOKEN_FILE=/secure/caller-token.json ae-cli auth status
+ae-cli --cli-token-file /secure/caller-token.json auth status
+```
+
+Token 文件是只读 JSON 对象：`{"url":"https://host-a.example.com","token":"cli_REPLACE_WITH_USER_TOKEN"}`，也兼容历史字段 `cli-token`。文件应仅允许所有者读取，例如权限 `600`；必须是大小不超过 64 KiB 的普通 JSON 文件。文件中的 URL 或 `AE_CLI_TOKEN_HOST` 决定本次调用的 Host；显式 `--host` 必须与之匹配。外部 Token 仅发送到该 Origin，拒绝其他服务 Origin 和 HTTP 重定向。
+
+凭证优先级为 `--cli-token-file` > `AE_CLI_TOKEN`（必须同时提供 `AE_CLI_TOKEN_HOST`）> `AE_CLI_TOKEN_FILE` > 现有本地账号或沙箱来源。显式来源为空、格式错误、无法读取或 Host 不匹配时返回 `EXTERNAL_CLI_TOKEN_INVALID`，不会回退到其他身份。外部凭证也优先于 Agent 调用的沙箱身份头。`auth status` 的来源为 `environment-cli-token` 或 `file-cli-token`，并在后端支持时展示账号与到期时间，不输出 Token。认证失败不会替换或删除本地凭证。
+
+外部模式不将 Token 或续期状态写入本地凭据库。自动续期使用 `cli-token` 请求头，失败不阻断业务请求，每个进程按 Host、Token 和当天日期限频；旧后端不支持请求头续期时仍可认证业务请求，但不能自动延长外部 Token。选择外部凭证时，`auth`、`auth login`、`auth set-token`、`auth use` 和 `auth logout` 返回 `EXTERNAL_CLI_TOKEN_ACTIVE`。管理机器账号前先移除这些进程设置；`auth list` 仍只列出本地账号。
+
 新版 CLI 只持久化 CLI Token，不保存 access token 或 refresh token。多账号保存在加密的 V1 凭据文件中，同时维护旧文件格式的当前账号投影，保证 CLI 自动降级后仍可登录；再次升级时会合并旧 CLI 对投影的登录、切换或退出变更。
 
 登录使用跨平台设备码流程。当前环境无法打开浏览器时，可使用 `--no-browser`。

package/dist/{auth-RQBO6MTY.js → auth-U7MNUUEF.js}

@@ -1,21 +1,21 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  missingAeHostGuidance,
-  missingAeHostHint
-} from "./chunk-6ZIQV5GW.js";
 import {
   MultiselectCancelled,
   promptSingleSelect
 } from "./chunk-7K24F7T2.js";
+import {
+  missingAeHostGuidance,
+  missingAeHostHint
+} from "./chunk-6ZIQV5GW.js";
 import {
   resolveHost
-} from "./chunk-OP44TT4H.js";
+} from "./chunk-P6VFCH3P.js";
 import {
   getLocalCliPackageInfo,
   printError,
   printOutput,
   runHostCompatCheck
-} from "./chunk-6VNIR4AP.js";
+} from "./chunk-ELCR235M.js";
 import {
   CliTokenValidationUnavailableError,
   CredentialStoreUnreadableError,
@@ -31,17 +31,19 @@ import {
   saveCredential,
   updateCredentialMetadata,
   validateCliTokenOnServer
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   getFallbackCliToken,
   loadConfig,
-  normalizeUrl,
   saveConfig
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-LMCYSVVA.js";
 import {
+  ExternalCliTokenError,
   PermissionError,
-  logger
-} from "./chunk-WNGFSIOB.js";
+  logger,
+  normalizeUrl,
+  readExternalCliToken
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -269,7 +271,7 @@ function getExplicitAuthHostOverride(program, opts) {
 function resolveAuthHost(program, opts) {
   return resolveHost(getExplicitAuthHostOverride(program, opts));
 }
-async function validateExistingCliToken(host, cliToken) {
+async function validateExistingCliToken(host, cliToken, external = false) {
   try {
     return { valid: true, trusted: false, details: await validateCliTokenOnServer(host, cliToken) };
   } catch (error) {
@@ -286,7 +288,7 @@ async function validateExistingCliToken(host, cliToken) {
     printError(
       "auth",
       error.message,
-      `Run: ae-cli auth logout --host ${host}, then ae-cli auth login --host ${host}`
+      external ? "Replace the external CLI token with a valid token for this host." : `Run: ae-cli auth logout --host ${host}, then ae-cli auth login --host ${host}`
     );
     process.exitCode = 1;
     return { valid: false, trusted: false, details: {} };
@@ -512,6 +514,12 @@ function resolveLoginTeClaudeBase(host) {
 }
 function registerAuth(program) {
   const auth = program.command("auth").description("Manage authentication or switch the active account interactively").hook("preAction", (_command, actionCommand) => {
+    if (["auth", "login", "set-token", "use", "logout"].includes(actionCommand.name()) && readExternalCliToken()) {
+      throw new ExternalCliTokenError(
+        "Stored-account changes are unavailable while an external CLI token is selected.",
+        "EXTERNAL_CLI_TOKEN_ACTIVE"
+      );
+    }
     if (["login", "set-token"].includes(actionCommand.name())) {
       const host = resolveAuthHost(program, actionCommand.opts());
       if (host) assertCredentialsReadable(host);
@@ -644,6 +652,22 @@ function registerAuth(program) {
       }, program.opts().format || "json");
       return;
     }
+    const external = readExternalCliToken(host);
+    if (external) {
+      const state = await validateExistingCliToken(host, external.token, true);
+      if (!state.valid) return;
+      await printOutput({
+        authenticated: true,
+        host,
+        source: external.source,
+        cli_token: {
+          status: state.trusted ? "trusted" : "valid",
+          ...state.details.cliTokenExpiresAt ? { expires_at: state.details.cliTokenExpiresAt } : {}
+        },
+        ...state.details.account ? { account: accountOutput(state.details.account) } : {}
+      }, program.opts().format || "json");
+      return;
+    }
     const active = getActiveCredential(host);
     if (active) {
       const state = await validateExistingCliToken(host, active.cliToken);

package/dist/{automation-VAAQBM7Y.js → automation-K32V2NKP.js}

@@ -1,15 +1,22 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  resolveWorkspaceTarget
+} from "./chunk-UUD5RB36.js";
+import {
+  currentAgentSpaceId
+} from "./chunk-RK6GLDGI.js";
+import "./chunk-JJJIP2XQ.js";
 import {
   TeAgentApiError,
   deleteFromMainApp,
   getFromMainApp,
   patchToMainApp,
   postToMainApp
-} from "./chunk-3YVEAZUN.js";
+} from "./chunk-2UWS5CUP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GHXZK54S.js";
-import "./chunk-ZL7SGNIA.js";
-import "./chunk-WNGFSIOB.js";
+import "./chunk-P7KL7IOH.js";
+import "./chunk-LMCYSVVA.js";
+import "./chunk-ZW4VMY5H.js";
 
 // src/commands/automation/index.ts
 import { randomUUID } from "crypto";
@@ -24,7 +31,7 @@ var typeFlag = flag(
 );
 var scopeFlag = flag(
   "agent-space-id",
-  "Explicit space; otherwise server resolves sandbox context or personal space"
+  "Explicit space; otherwise current AgentSpace, then personal space"
 );
 var runFlag = flag(
   "run-id",
@@ -62,7 +69,21 @@ var configFlags = [
   flag("time", "HH:mm in server timezone"),
   flag("minute", "Hourly minute, 0-59", "number"),
   flag("weekday", "Weekly day, 0=Sunday through 6=Saturday", "number"),
-  flag("day-of-month", "Monthly day, 1-28", "number"),
+  flag(
+    "weekdays",
+    "Weekly days as JSON array, 0=Sunday through 6=Saturday",
+    "json"
+  ),
+  flag(
+    "day-of-month",
+    "Monthly day, 1-31; missing dates are skipped",
+    "number"
+  ),
+  flag(
+    "days-of-month",
+    'Monthly days as JSON array: integers 1-31 or "L" for last day; missing dates are skipped',
+    "json"
+  ),
   flag("model", "Agent model configuration ID; null clears the override"),
   flag("reuse-conversation", "Agent: true | false", "json"),
   {
@@ -71,12 +92,12 @@ var configFlags = [
   },
   flag(
     "channels",
-    "Team notification channel array; [] clears channels",
+    "Agent or Team notification channel array; [] clears external notifications",
     "json"
   ),
-  flag("feishu-chat-id", "Team Feishu destination; null clears it"),
-  flag("lark-chat-id", "Team Lark destination; null clears it"),
-  flag("slack-channel-id", "Team Slack destination; null clears it"),
+  flag("feishu-chat-id", "Feishu destination; null clears it"),
+  flag("lark-chat-id", "Lark destination; null clears it"),
+  flag("slack-channel-id", "Slack destination; null clears it"),
   flag(
     "save-to-knowledge-base-id",
     "Team output knowledge base ID; null clears it"
@@ -133,11 +154,33 @@ function configuration(ctx, create) {
   const kind = ctx.str("scheduleKind"), cron = ctx.str("cronExpression");
   enumValue(kind, ["hourly", "daily", "weekly", "monthly"], "schedule-kind");
   if (kind && cron) throw new Error("Use --schedule-kind or --cron-expression");
-  if (!kind && ["time", "minute", "weekday", "dayOfMonth"].some((name2) => ctx.str(name2)))
+  if (!kind && (["time", "minute", "weekday", "dayOfMonth"].some(
+    (name2) => ctx.str(name2)
+  ) || ctx.json("weekdays") !== void 0 || ctx.json("daysOfMonth") !== void 0))
     throw new Error("Schedule details require --schedule-kind");
-  if (kind && ctx.str("weekday") && kind !== "weekly" || kind && ctx.str("dayOfMonth") && kind !== "monthly" || kind && ctx.str("minute") && kind !== "hourly")
+  if (kind && (ctx.str("weekday") || ctx.json("weekdays") !== void 0) && kind !== "weekly" || kind && (ctx.str("dayOfMonth") || ctx.json("daysOfMonth") !== void 0) && kind !== "monthly" || kind && ctx.str("minute") && kind !== "hourly")
     throw new Error("Schedule field is not applicable to this frequency");
   if (kind) {
+    const dateSelection = (single, multiple, min, max, label, allowLastDay = false) => {
+      const values = ctx.json(multiple);
+      if (values === void 0)
+        return {
+          [single]: range(ctx.optionalNum(single) ?? NaN, min, max, label)
+        };
+      if (ctx.optionalNum(single) !== void 0)
+        throw new Error(`Use --${label} or its plural array, not both`);
+      if (!Array.isArray(values) || !values.length || values.length > max - min + 1 + Number(allowLastDay) || values.some(
+        (value) => !(allowLastDay && value === "L") && (!Number.isInteger(value) || value < min || value > max)
+      ))
+        throw new Error(
+          `${multiple} must be a non-empty JSON array of integers from ${min} to ${max}${allowLastDay ? ' or "L" for last day' : ""}`
+        );
+      return {
+        [multiple]: [...new Set(values)].sort(
+          (a, b) => (a === "L" ? 32 : a) - (b === "L" ? 32 : b)
+        )
+      };
+    };
     const schedule = { kind };
     if (kind === "hourly")
       schedule.minute = range(ctx.optionalNum("minute") ?? 0, 0, 59, "minute");
@@ -146,18 +189,21 @@ function configuration(ctx, create) {
         throw new Error("--time must use HH:mm");
       schedule.time = ctx.str("time");
       if (kind === "weekly")
-        schedule.weekday = range(
-          ctx.optionalNum("weekday") ?? NaN,
-          0,
-          6,
-          "weekday"
+        Object.assign(
+          schedule,
+          dateSelection("weekday", "weekdays", 0, 6, "weekday")
         );
       if (kind === "monthly")
-        schedule.dayOfMonth = range(
-          ctx.optionalNum("dayOfMonth") ?? NaN,
-          1,
-          28,
-          "day-of-month"
+        Object.assign(
+          schedule,
+          dateSelection(
+            "dayOfMonth",
+            "daysOfMonth",
+            1,
+            31,
+            "day-of-month",
+            true
+          )
         );
     }
     result.schedule = schedule;
@@ -165,8 +211,11 @@ function configuration(ctx, create) {
   if (cron) {
     const parts = cron.trim().split(/\s+/);
     const validNumber = (v, a, b) => /^\d+$/.test(v) && Number(v) >= a && Number(v) <= b;
+    const validDays = (v, a, b, allowLastDay = false) => v.split(",").length <= b - a + 1 + Number(allowLastDay) && v.split(",").every(
+      (day) => allowLastDay && day === "L" || validNumber(day, a, b)
+    );
     const [m, h, d, mo, w] = parts;
-    if (parts.length !== 5 || !validNumber(m, 0, 59) || !(h === "*" || validNumber(h, 0, 23)) || mo !== "*" || !(d === "*" || validNumber(d, 1, 28)) || !(w === "*" || validNumber(w, 0, 6)) || d !== "*" && w !== "*" || h === "*" && (d !== "*" || w !== "*"))
+    if (parts.length !== 5 || !validNumber(m, 0, 59) || !(h === "*" || validNumber(h, 0, 23)) || mo !== "*" || !(d === "*" || validDays(d, 1, 31, true)) || !(w === "*" || validDays(w, 0, 6)) || d !== "*" && w !== "*" || h === "*" && (d !== "*" || w !== "*"))
       throw new Error(
         "--cron-expression must specify an hourly, daily, weekly or monthly schedule"
       );
@@ -175,19 +224,18 @@ function configuration(ctx, create) {
   if (create && (ctx.str("triggerType") || "scheduled") === "scheduled" && !kind && !cron)
     throw new Error("Scheduled automation requires a schedule");
   const agentNames = ["model", "reuseConversation"];
-  const teamNames = [
-    "scope",
+  const teamNames = ["scope", "saveToKnowledgeBaseId"];
+  const notificationNames = [
     "channels",
     "feishuChatId",
     "larkChatId",
-    "slackChannelId",
-    "saveToKnowledgeBaseId"
+    "slackChannelId"
   ];
-  for (const name2 of [...agentNames, ...teamNames]) {
+  for (const name2 of [...agentNames, ...teamNames, ...notificationNames]) {
     const json = ["scope", "channels", "reuseConversation"].includes(name2);
     const value = json ? ctx.json(name2) : ctx.str(name2) || void 0;
     if (value === void 0) continue;
-    if ((agentNames.includes(name2) ? "agent" : "team") !== targetType)
+    if (!notificationNames.includes(name2) && (agentNames.includes(name2) ? "agent" : "team") !== targetType)
       throw new Error(`${name2} is not applicable to ${targetType} automations`);
     if (name2 === "reuseConversation" && typeof value !== "boolean")
       throw new Error("--reuse-conversation must be true or false");
@@ -217,9 +265,13 @@ function configuration(ctx, create) {
   if (create) result.triggerImmediately = ctx.bool("triggerImmediately");
   return result;
 }
-function query(ctx, list = false, typed = false) {
+async function query(ctx, list = false, typed = false) {
   const p = new URLSearchParams();
-  if (ctx.str("agentSpaceId")) p.set("agentSpaceId", ctx.str("agentSpaceId"));
+  let spaceId = ctx.str("agentSpaceId").trim() || currentAgentSpaceId();
+  if (!spaceId && process.env.TE_AGENT_CONVERSATION_ID?.trim()) {
+    spaceId = (await resolveWorkspaceTarget(ctx)).agentSpaceId;
+  }
+  if (spaceId) p.set("agentSpaceId", spaceId);
   if (typed && ctx.str("targetType"))
     p.set("targetType", ctx.str("targetType"));
   if (list) {
@@ -232,23 +284,27 @@ async function request(ctx, method, path, body) {
   if (method === "GET")
     return getFromMainApp(
       path,
-      ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+      ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+      "cli-token"
     );
   if (method === "POST")
     return postToMainApp(
       path,
       body,
-      ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+      ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+      "cli-token"
     );
   if (method === "PATCH")
     return patchToMainApp(
       path,
       body,
-      ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+      ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+      "cli-token"
     );
   return deleteFromMainApp(
     path,
-    ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+    ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+    "cli-token"
   );
 }
 function withDryRun(path) {
@@ -267,7 +323,7 @@ async function waitForRun(ctx, id, runId) {
     const result = await request(
       ctx,
       "GET",
-      `${base}/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/result${query(ctx)}`
+      `${base}/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/result${await query(ctx)}`
     );
     if (result.status !== "running")
       return { ...result, executionCompleted: true, timedOut: false };
@@ -397,7 +453,7 @@ var automationCommands = actions.map((a) => ({
       ...body,
       ...a.wait ? { commandId } : {}
     };
-    const path = base + a.suffix(ctx) + query(ctx, a.list, a.typed);
+    const path = base + a.suffix(ctx) + await query(ctx, a.list, a.typed);
     return {
       request: redactedPreview(a.method, path, requestBody),
       validation: await request(ctx, a.method, withDryRun(path), requestBody)
@@ -410,7 +466,7 @@ var automationCommands = actions.map((a) => ({
       output = await request(
         ctx,
         a.method,
-        base + a.suffix(ctx) + query(ctx, a.list, a.typed),
+        base + a.suffix(ctx) + await query(ctx, a.list, a.typed),
         body && { ...body, ...a.wait ? { commandId } : {} }
       );
     } catch (error) {

package/dist/{capability-JRIFC4AJ.js → capability-VV7RHB3B.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-KPQY44JQ.js";
 import {
   resolveHost
-} from "./chunk-OP44TT4H.js";
+} from "./chunk-P6VFCH3P.js";
 import {
   CapabilityGatewayError,
   dryRunCapabilityWithEnvelope,
@@ -20,24 +20,25 @@ import {
   inspectCapabilityWithEnvelope,
   listCapabilitiesWithEnvelope,
   validateCapabilityWithEnvelope
-} from "./chunk-VZZNLV3I.js";
+} from "./chunk-MXV3PYC3.js";
 import {
   printError,
   printOutput,
   withOutputMetadata
-} from "./chunk-6VNIR4AP.js";
+} from "./chunk-ELCR235M.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   CredentialStoreUnreadableError,
   SecureStoreAuthError
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   safeJsonParse
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-LMCYSVVA.js";
 import {
   CliValidationError,
+  ExternalCliTokenError,
   PermissionError
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // src/commands/capability/index.ts
 import * as readline from "readline";
@@ -365,7 +366,7 @@ function printCapabilityError(error, host) {
     );
     return;
   }
-  if (error instanceof CredentialStoreUnreadableError) {
+  if (error instanceof CredentialStoreUnreadableError || error instanceof ExternalCliTokenError) {
     printError("config", error.message, error.hint, error.code);
     return;
   }

package/dist/{chunk-CT7QDJS6.js → chunk-2IYIYSUO.js}

@@ -5,11 +5,11 @@ import {
   require_node,
   require_process_nextick_args,
   require_util
-} from "./chunk-S6M42KND.js";
+} from "./chunk-T44M3PLZ.js";
 import {
   __commonJS,
   __require
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // node_modules/jszip/node_modules/readable-stream/lib/internal/streams/stream.js
 var require_stream = __commonJS({