@thinkingai/ae-cli 6.1.14 → 6.1.16

package/dist/te-agent-HLW4VTQK.js

@@ -0,0 +1,3893 @@
+import {
+  assertValidSkillVersion
+} from "./chunk-4NN5IWVN.js";
+import {
+  deleteFromMainApp,
+  getBufferFromMainApp,
+  getFromMainApp,
+  patchToMainApp,
+  postToMainApp,
+  putToMainApp,
+  uploadToMainApp
+} from "./chunk-UOUS37JQ.js";
+import {
+  buildCapabilityGatewayUrl,
+  callCapabilityApi
+} from "./chunk-P3FGXJTU.js";
+import "./chunk-C4MGVGJW.js";
+import "./chunk-4SGZG4XY.js";
+import "./chunk-ZZUOD757.js";
+import {
+  CliValidationError
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
+
+// src/commands/te-agent/api-client.ts
+function getAgentApi(ctx, path) {
+  return getFromMainApp(path, ctx.host());
+}
+function postAgentApi(ctx, path, body) {
+  return postToMainApp(path, body, ctx.host());
+}
+function patchAgentApi(ctx, path, body) {
+  return patchToMainApp(path, body, ctx.host());
+}
+function putAgentApi(ctx, path, body) {
+  return putToMainApp(path, body, ctx.host());
+}
+function deleteAgentApi(ctx, path) {
+  return deleteFromMainApp(path, ctx.host());
+}
+function uploadAgentApi(ctx, path, formData) {
+  return uploadToMainApp(path, formData, ctx.host());
+}
+function getAgentBuffer(ctx, path) {
+  return getBufferFromMainApp(path, ctx.host());
+}
+
+// src/commands/te-agent/agents.ts
+var BASE_PATH = "/api/sandbox/agent/agents";
+function buildQuery(ctx) {
+  const params = new URLSearchParams();
+  const scope = ctx.str("scope");
+  const q = ctx.str("q");
+  if (scope) params.set("scope", scope);
+  if (q) params.set("q", q);
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+var listAgents = {
+  service: "agent",
+  command: "+list-agents",
+  description: "List Agents visible to current user",
+  flags: [
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      desc: "Filter by scope: personal | company | system"
+    },
+    {
+      name: "q",
+      type: "string",
+      required: false,
+      desc: "Search by Agent name or description"
+    }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company", "system"].includes(scope)) {
+      throw new Error("--scope \u5FC5\u987B\u662F personal\u3001company \u6216 system");
+    }
+  },
+  dryRun: (ctx) => ({ method: "GET", url: `${BASE_PATH}${buildQuery(ctx)}` }),
+  execute: async (ctx) => getAgentApi(ctx, `${BASE_PATH}${buildQuery(ctx)}`)
+};
+async function resolveInstructions(raw) {
+  if (raw === "@-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (!text) throw new Error("stdin is empty; cannot read instructions");
+    return text;
+  }
+  return raw;
+}
+var createAgent = {
+  service: "agent",
+  command: "+create-agent",
+  description: "Create an Agent (personal scope by default; company requires root/agent_admin)",
+  flags: [
+    { name: "name", type: "string", required: true, desc: "Agent name (1-100 chars)" },
+    { name: "description", type: "string", required: false, desc: "Agent description (max 2000 chars)" },
+    { name: "instructions", type: "string", required: false, desc: "Agent system prompt (use @- to read from stdin)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Scope: personal | company (company requires root/agent_admin)" },
+    { name: "model-id", type: "string", required: false, desc: "Model identifier (Model.id uuid or legacy modelId); omit to use global default" },
+    { name: "mcp-ids", type: "json", required: false, desc: 'MCP server record IDs as JSON array string (e.g. ["id1","id2"])' },
+    { name: "skill-ids", type: "json", required: false, desc: "Skill record IDs as JSON array string" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on name conflict (append -N suffix)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (!name || name.length < 1 || name.length > 100) {
+      throw new Error("--name length must be between 1 and 100");
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      name: ctx.str("name"),
+      scope: ctx.str("scope") || "personal"
+    };
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructions = ctx.str("instructions");
+    if (instructions) body.systemPrompt = instructions === "@-" ? "(from stdin)" : instructions;
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    return { method: "POST", url: BASE_PATH, body };
+  },
+  execute: async (ctx) => {
+    const body = {
+      name: ctx.str("name"),
+      scope: ctx.str("scope") || "personal"
+    };
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructionsRaw = ctx.str("instructions");
+    if (instructionsRaw) body.systemPrompt = await resolveInstructions(instructionsRaw);
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    return postAgentApi(ctx, BASE_PATH, body);
+  }
+};
+var updateAgent = {
+  service: "agent",
+  command: "+update-agent",
+  description: "Update an Agent (name/description/instructions/model/MCP/Skill/enabled)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Agent record ID (CUID)" },
+    { name: "name", type: "string", required: false, desc: "New Agent name (1-100 chars)" },
+    { name: "description", type: "string", required: false, desc: "New description (max 2000 chars)" },
+    { name: "instructions", type: "string", required: false, desc: "New system prompt (use @- to read from stdin)" },
+    { name: "model-id", type: "string", required: false, desc: "New model identifier (uuid or legacy modelId); omit to keep" },
+    { name: "mcp-ids", type: "json", required: false, desc: "MCP server record IDs as JSON array string (replaces the list; [] clears)" },
+    { name: "skill-ids", type: "json", required: false, desc: "Skill record IDs as JSON array string (replaces the list; [] clears)" },
+    { name: "enabled", type: "boolean", required: false, desc: "Enable/disable (system/company: writes personal preference)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name && (name.length < 1 || name.length > 100)) {
+      throw new Error("--name length must be between 1 and 100");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {};
+    const name = ctx.str("name");
+    if (name) body.name = name;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructions = ctx.str("instructions");
+    if (instructions) body.systemPrompt = instructions === "@-" ? "(from stdin)" : instructions;
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.str("enabled")) body.enabled = ctx.bool("enabled");
+    return { method: "PATCH", url: `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`, body };
+  },
+  execute: async (ctx) => {
+    const body = {};
+    const name = ctx.str("name");
+    if (name) body.name = name;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const instructionsRaw = ctx.str("instructions");
+    if (instructionsRaw) body.systemPrompt = await resolveInstructions(instructionsRaw);
+    const modelId = ctx.str("modelId");
+    if (modelId) body.model = modelId;
+    const mcpIds = ctx.json("mcpIds");
+    if (mcpIds) body.mcpServerIds = mcpIds;
+    const skillIds = ctx.json("skillIds");
+    if (skillIds) body.skillIds = skillIds;
+    if (ctx.str("enabled")) body.enabled = ctx.bool("enabled");
+    return patchAgentApi(ctx, `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`, body);
+  }
+};
+var delAgent = {
+  service: "agent",
+  command: "+del-agent",
+  description: "Soft-delete an Agent (system agents cannot be deleted)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Agent record ID (CUID)" }
+  ],
+  risk: "high-risk-write",
+  dryRun: (ctx) => ({
+    method: "DELETE",
+    url: `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return deleteAgentApi(ctx, `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+var getAgent = {
+  service: "agent",
+  command: "+get-agent",
+  description: "Get Agent details by ID",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Agent record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, `${BASE_PATH}/${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+
+// src/commands/te-agent/models.ts
+var BASE_PATH2 = "/api/sandbox/agent/models";
+var listModels = {
+  service: "agent",
+  command: "+list-models",
+  description: "List models visible to current user (personal / company / system)",
+  flags: [
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      desc: "Filter by scope: personal | company | system"
+    }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company", "system"].includes(scope)) {
+      throw new Error("--scope must be personal, company, or system");
+    }
+  },
+  dryRun: (ctx) => {
+    const scope = ctx.str("scope");
+    const params = new URLSearchParams();
+    if (scope) params.set("scope", scope);
+    const qs = params.toString();
+    return { method: "GET", url: `${BASE_PATH2}${qs ? `?${qs}` : ""}` };
+  },
+  execute: async (ctx) => {
+    const scope = ctx.str("scope");
+    const params = new URLSearchParams();
+    if (scope) params.set("scope", scope);
+    const qs = params.toString();
+    const current = process.env.TE_AGENT_CURRENT_MODEL_ID?.trim();
+    const data = await getAgentApi(
+      ctx,
+      `${BASE_PATH2}${qs ? `?${qs}` : ""}`
+    );
+    const items = data?.items ?? [];
+    return {
+      models: items.map((m) => ({
+        ...m,
+        isCurrent: current ? m.id === current : false
+      }))
+    };
+  }
+};
+var addModel = {
+  service: "agent",
+  command: "+add-model",
+  description: "Add a custom model (personal or company scope)",
+  flags: [
+    {
+      name: "model-id",
+      type: "string",
+      required: true,
+      desc: "Model identifier (e.g. gpt-4o)"
+    },
+    { name: "name", type: "string", required: true, desc: "Display name" },
+    { name: "base-url", type: "string", required: true, desc: "API base URL" },
+    { name: "api-key", type: "string", required: false, desc: "API key" },
+    {
+      name: "provider",
+      type: "string",
+      required: false,
+      desc: "Provider name"
+    },
+    {
+      name: "description",
+      type: "string",
+      required: false,
+      desc: "Description"
+    },
+    {
+      name: "context-length",
+      type: "number",
+      required: false,
+      desc: "Context window length"
+    },
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "personal",
+      desc: "Target scope: personal | company"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const baseUrl = ctx.str("baseUrl");
+    try {
+      new URL(baseUrl);
+    } catch {
+      throw new Error("--base-url must be a valid URL");
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: BASE_PATH2,
+    body: {
+      modelId: ctx.str("modelId"),
+      displayName: ctx.str("name"),
+      baseUrl: ctx.str("baseUrl"),
+      apiKey: ctx.str("apiKey") || void 0,
+      provider: ctx.str("provider") || void 0,
+      description: ctx.str("description") || void 0,
+      contextLength: ctx.num("contextLength") || void 0,
+      scope: ctx.str("scope") || "personal"
+    }
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, BASE_PATH2, {
+      modelId: ctx.str("modelId"),
+      displayName: ctx.str("name"),
+      baseUrl: ctx.str("baseUrl"),
+      apiKey: ctx.str("apiKey") || void 0,
+      provider: ctx.str("provider") || void 0,
+      description: ctx.str("description") || void 0,
+      contextLength: ctx.num("contextLength") || void 0,
+      scope: ctx.str("scope") || "personal"
+    });
+  }
+};
+var delModel = {
+  service: "agent",
+  command: "+del-model",
+  description: "Delete a model (personal or company scope)",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Model record ID (CUID)"
+    },
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "personal",
+      desc: "Target scope: personal | company"
+    }
+  ],
+  risk: "high-risk-write",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const scope = ctx.str("scope") || "personal";
+    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope)}`;
+    return { method: "DELETE", url: `${BASE_PATH2}?${qs}` };
+  },
+  execute: async (ctx) => {
+    const scope = ctx.str("scope") || "personal";
+    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope)}`;
+    return deleteAgentApi(ctx, `${BASE_PATH2}?${qs}`);
+  }
+};
+var toggleModel = {
+  service: "agent",
+  command: "+toggle-model",
+  description: "Enable or disable a model",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Model record ID (CUID)"
+    },
+    {
+      name: "enabled",
+      type: "boolean",
+      required: true,
+      desc: "true to enable, false to disable"
+    }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: BASE_PATH2,
+    body: { id: ctx.str("id"), enabled: ctx.bool("enabled") }
+  }),
+  execute: async (ctx) => {
+    return patchAgentApi(ctx, BASE_PATH2, {
+      id: ctx.str("id"),
+      enabled: ctx.bool("enabled")
+    });
+  }
+};
+var updateModel = {
+  service: "agent",
+  command: "+update-model",
+  description: "Update a custom model (id determines the record to update; personal or company scope)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Model record ID (CUID) to update" },
+    { name: "model-id", type: "string", required: true, desc: "Model identifier (e.g. gpt-4o)" },
+    { name: "name", type: "string", required: true, desc: "Display name" },
+    { name: "base-url", type: "string", required: true, desc: "API base URL (must be a valid URL)" },
+    { name: "api-key", type: "string", required: false, desc: "API key; omit or empty to preserve the existing key" },
+    { name: "provider", type: "string", required: false, desc: "Provider name" },
+    { name: "description", type: "string", required: false, desc: "Description" },
+    { name: "context-length", type: "number", required: false, desc: "Context window length" },
+    { name: "connectivity-verified", type: "boolean", required: false, desc: "Whether connectivity was verified (default false; pass true after +test-model)" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on display name conflict (append -N suffix)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Target scope: personal | company" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const baseUrl = ctx.str("baseUrl");
+    try {
+      new URL(baseUrl);
+    } catch {
+      throw new Error("--base-url must be a valid URL");
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      id: ctx.str("id"),
+      modelId: ctx.str("modelId"),
+      displayName: ctx.str("name"),
+      baseUrl: ctx.str("baseUrl"),
+      connectivityVerified: ctx.bool("connectivityVerified")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const contextLength = ctx.optionalNum("contextLength");
+    if (contextLength !== void 0) body.contextLength = contextLength;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    body.scope = ctx.str("scope") || "personal";
+    return { method: "POST", url: BASE_PATH2, body };
+  },
+  execute: async (ctx) => {
+    const body = {
+      id: ctx.str("id"),
+      modelId: ctx.str("modelId"),
+      displayName: ctx.str("name"),
+      baseUrl: ctx.str("baseUrl"),
+      connectivityVerified: ctx.bool("connectivityVerified")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const description = ctx.str("description");
+    if (description) body.description = description;
+    const contextLength = ctx.optionalNum("contextLength");
+    if (contextLength !== void 0) body.contextLength = contextLength;
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    body.scope = ctx.str("scope") || "personal";
+    return postAgentApi(ctx, BASE_PATH2, body);
+  }
+};
+var testModel = {
+  service: "agent",
+  command: "+test-model",
+  description: "Test model connectivity (LLM models only)",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "Model identifier (e.g. gpt-4o)" },
+    { name: "base-url", type: "string", required: true, desc: "API base URL (must be a valid URL)" },
+    { name: "api-key", type: "string", required: false, desc: "API key; omit to reuse the stored key of --id" },
+    { name: "provider", type: "string", required: false, desc: "Provider name" },
+    { name: "id", type: "string", required: false, desc: "Existing model config ID; when --api-key is omitted, the stored key is decrypted and reused" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const baseUrl = ctx.str("baseUrl");
+    try {
+      new URL(baseUrl);
+    } catch {
+      throw new Error("--base-url must be a valid URL");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      modelId: ctx.str("modelId"),
+      baseUrl: ctx.str("baseUrl")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const id = ctx.str("id");
+    if (id) body.existingConfigId = id;
+    return { method: "POST", url: `${BASE_PATH2}/test`, body };
+  },
+  execute: async (ctx) => {
+    const body = {
+      modelId: ctx.str("modelId"),
+      baseUrl: ctx.str("baseUrl")
+    };
+    const apiKey = ctx.str("apiKey");
+    if (apiKey) body.apiKey = apiKey;
+    const provider = ctx.str("provider");
+    if (provider) body.provider = provider;
+    const id = ctx.str("id");
+    if (id) body.existingConfigId = id;
+    return postAgentApi(ctx, `${BASE_PATH2}/test`, body);
+  }
+};
+
+// src/commands/te-agent/market-constants.ts
+var MARKET_CATEGORIES = [
+  "ae_preset",
+  "dev_tool",
+  "search_tool",
+  "data_query",
+  "content_gen",
+  "enterprise",
+  "life",
+  "automation",
+  "other"
+];
+var MARKET_SCOPES = ["all", "system", "company", "custom"];
+var MARKET_SORTS = ["newest", "calls", "likes"];
+var SUBMISSION_STATUSES = ["pending", "approved", "rejected", "cancelled"];
+var SHARE_DIRECTIONS = ["received", "sent"];
+var SHARE_STATUSES = ["pending", "accepted", "rejected"];
+function isValidMarketCategory(key) {
+  return !!key && MARKET_CATEGORIES.includes(key);
+}
+function buildMarketQuery(ctx) {
+  const params = new URLSearchParams();
+  params.set("scope", ctx.str("scope") || "all");
+  const category = ctx.str("category");
+  if (category) params.set("category", category);
+  const search = ctx.str("search");
+  if (search) params.set("search", search);
+  params.set("sort", ctx.str("sort") || "newest");
+  params.set("limit", String(ctx.num("limit") || 50));
+  params.set("offset", String(ctx.num("offset") || 0));
+  return params;
+}
+
+// src/commands/te-agent/mcps.ts
+var BASE_PATH3 = "/api/sandbox/agent/mcp-servers";
+var MARKET_BASE_PATH = "/api/sandbox/agent/mcp-servers";
+var CRED_BASE_PATH = "/api/sandbox/agent/mcp-credentials";
+var STATS_PATH = "/api/sandbox/agent/mcp-servers/stats";
+function buildMetaBody(ctx) {
+  const body = {};
+  const category = ctx.str("category");
+  const iconEmoji = ctx.str("iconEmoji");
+  const iconColor = ctx.str("iconColor");
+  if (category) body.category = category;
+  if (iconEmoji) body.iconEmoji = iconEmoji;
+  if (iconColor) body.iconColor = iconColor;
+  return Object.keys(body).length > 0 ? body : null;
+}
+var listMcps = {
+  service: "agent",
+  command: "+list-mcps",
+  description: "List MCP servers visible to current user",
+  flags: [
+    { name: "scope", type: "string", required: false, desc: "Filter by scope: personal | company | system" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company", "system"].includes(scope)) {
+      throw new Error("--scope must be personal, company, or system");
+    }
+  },
+  dryRun: (ctx) => {
+    const scope = ctx.str("scope");
+    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    return { method: "GET", url: `${BASE_PATH3}${qs}` };
+  },
+  execute: async (ctx) => {
+    const scope = ctx.str("scope");
+    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    return getAgentApi(ctx, `${BASE_PATH3}${qs}`);
+  }
+};
+var addMcp = {
+  service: "agent",
+  command: "+add-mcp",
+  description: "Add an MCP server (personal or company scope)",
+  flags: [
+    { name: "name", type: "string", required: true, desc: "Server name (2-64 chars, letter start, [a-zA-Z0-9_-])" },
+    { name: "url", type: "string", required: true, desc: "MCP server URL" },
+    { name: "display-name", type: "string", required: false, desc: "Display name (max 100)" },
+    { name: "description", type: "string", required: false, desc: "Description (max 255)" },
+    { name: "transport", type: "string", required: false, default: "http", desc: "Transport: sse | http" },
+    { name: "headers", type: "json", required: false, desc: "HTTP headers as JSON object" },
+    { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" },
+    { name: "scope", type: "string", required: false, default: "personal", desc: "Target scope: personal | company" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name)) {
+      throw new Error("--name must start with a letter and contain only letters, digits, _, or -");
+    }
+    if (name.length < 2 || name.length > 64) {
+      throw new Error("--name length must be between 2 and 64");
+    }
+    try {
+      new URL(ctx.str("url"));
+    } catch {
+      throw new Error("--url must be a valid URL");
+    }
+    if (!/^https?:\/\//i.test(ctx.str("url"))) {
+      throw new Error("--url only supports http:// or https:// protocols");
+    }
+    const transport = ctx.str("transport");
+    if (transport && !["sse", "http"].includes(transport)) {
+      throw new Error("--transport must be sse or http");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      name: ctx.str("name"),
+      url: ctx.str("url"),
+      displayName: ctx.str("displayName") || void 0,
+      description: ctx.str("description") || void 0,
+      transport: ctx.str("transport") || "http",
+      headers: ctx.json("headers") || void 0,
+      scope: ctx.str("scope") || "personal"
+    };
+    const meta = buildMetaBody(ctx);
+    if (meta) body._meta = meta;
+    return { method: "POST", url: BASE_PATH3, body };
+  },
+  execute: async (ctx) => {
+    const created = await postAgentApi(ctx, BASE_PATH3, {
+      name: ctx.str("name"),
+      url: ctx.str("url"),
+      displayName: ctx.str("displayName") || void 0,
+      description: ctx.str("description") || void 0,
+      transport: ctx.str("transport") || "http",
+      headers: ctx.json("headers") || void 0,
+      scope: ctx.str("scope") || "personal"
+    });
+    const id = created?.item?.id;
+    const meta = buildMetaBody(ctx);
+    if (id && meta) {
+      try {
+        await patchAgentApi(ctx, `${MARKET_BASE_PATH}/${encodeURIComponent(id)}/meta`, meta);
+      } catch (err) {
+        process.stderr.write(`Warning: MCP created but meta update failed: ${err?.message ?? err}
+`);
+      }
+    }
+    return created;
+  }
+};
+var delMcp = {
+  service: "agent",
+  command: "+del-mcp",
+  description: "Delete a personal MCP server",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "high-risk-write",
+  dryRun: (ctx) => ({
+    method: "DELETE",
+    url: `${BASE_PATH3}?id=${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return deleteAgentApi(ctx, `${BASE_PATH3}?id=${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+var toggleMcp = {
+  service: "agent",
+  command: "+toggle-mcp",
+  description: "Enable or disable an MCP server",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" },
+    { name: "enabled", type: "boolean", required: true, desc: "true to enable, false to disable" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: BASE_PATH3,
+    body: { id: ctx.str("id"), enabled: ctx.bool("enabled") }
+  }),
+  execute: async (ctx) => {
+    return patchAgentApi(ctx, BASE_PATH3, {
+      id: ctx.str("id"),
+      enabled: ctx.bool("enabled")
+    });
+  }
+};
+var listMcpMarket = {
+  service: "agent",
+  command: "+list-mcp-market",
+  description: "List MCP servers from the market (system/company/personal)",
+  flags: [
+    { name: "scope", type: "string", required: false, default: "all", desc: `Market scope: ${MARKET_SCOPES.join(" | ")} (custom = personal)` },
+    { name: "category", type: "string", required: false, desc: `Category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "search", type: "string", required: false, desc: "Fuzzy search on name/displayName/description/url" },
+    { name: "sort", type: "string", required: false, default: "newest", desc: `Sort: ${MARKET_SORTS.join(" | ")}` },
+    { name: "limit", type: "number", required: false, default: 50, desc: "Page size (1-100, default 50)" },
+    { name: "offset", type: "number", required: false, default: 0, desc: "Page offset (>=0, default 0)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !MARKET_SCOPES.includes(scope)) {
+      throw new Error(`--scope must be one of: ${MARKET_SCOPES.join(", ")}`);
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const sort = ctx.str("sort");
+    if (sort && !MARKET_SORTS.includes(sort)) {
+      throw new Error(`--sort must be one of: ${MARKET_SORTS.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${MARKET_BASE_PATH}/market?${buildMarketQuery(ctx).toString()}`
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, `${MARKET_BASE_PATH}/market?${buildMarketQuery(ctx).toString()}`);
+  }
+};
+var setMcpMeta = {
+  service: "agent",
+  command: "+set-mcp-meta",
+  description: "Update an MCP server market meta (category / icon). Company scope requires root; system is read-only.",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" },
+    { name: "category", type: "string", required: false, desc: `Category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    if (!buildMetaBody(ctx)) {
+      throw new Error("Provide at least one of --category / --icon-emoji / --icon-color");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: `${MARKET_BASE_PATH}/${encodeURIComponent(ctx.str("id"))}/meta`,
+    body: buildMetaBody(ctx)
+  }),
+  execute: async (ctx) => {
+    return patchAgentApi(
+      ctx,
+      `${MARKET_BASE_PATH}/${encodeURIComponent(ctx.str("id"))}/meta`,
+      buildMetaBody(ctx)
+    );
+  }
+};
+var UPDATE_TRANSPORTS = ["sse", "http", "streamable-http"];
+var UPDATE_AUTH_MODES = ["none", "oauth2", "header", "manual"];
+var CRED_AUTH_TYPES = ["oauth", "apikey"];
+function buildUpdateBody(ctx) {
+  const body = {};
+  const name = ctx.str("name");
+  if (name) body.name = name;
+  const url = ctx.str("url");
+  if (url) body.url = url;
+  const displayName = ctx.str("displayName");
+  if (displayName) body.displayName = displayName;
+  const description = ctx.str("description");
+  if (description) body.description = description;
+  const transport = ctx.str("transport");
+  if (transport) body.transport = transport;
+  const headers = ctx.json("headers");
+  if (headers) body.headers = headers;
+  const secretHeaders = ctx.json("secretHeaders");
+  if (secretHeaders) body.secretHeaders = secretHeaders;
+  const authMode = ctx.str("authMode");
+  if (authMode) body.authMode = authMode;
+  const enabledStr = ctx.str("enabled");
+  if (enabledStr === "true") body.enabled = true;
+  else if (enabledStr === "false") body.enabled = false;
+  if (ctx.bool("autoRename")) body.autoRename = true;
+  return body;
+}
+var updateMcp = {
+  service: "agent",
+  command: "+update-mcp",
+  description: "Update an MCP server config (personal owner / company root / system read-only)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" },
+    { name: "name", type: "string", required: false, desc: "Server name (2-64 chars, letter start, [a-zA-Z0-9_-])" },
+    { name: "url", type: "string", required: false, desc: "MCP server URL (http:// or https:// only)" },
+    { name: "display-name", type: "string", required: false, desc: "Display name (max 100)" },
+    { name: "description", type: "string", required: false, desc: "Description (max 255)" },
+    { name: "transport", type: "string", required: false, desc: `Transport: ${UPDATE_TRANSPORTS.join(" | ")}` },
+    { name: "headers", type: "json", required: false, desc: "HTTP headers as JSON object" },
+    { name: "secret-headers", type: "json", required: false, desc: "Secret headers as JSON object (encrypted server-side)" },
+    { name: "auth-mode", type: "string", required: false, desc: `Auth mode: ${UPDATE_AUTH_MODES.join(" | ")}` },
+    { name: "enabled", type: "string", required: false, desc: "Set enabled state: true | false (omit to leave unchanged)" },
+    { name: "auto-rename", type: "boolean", required: false, desc: "Auto-rename on name conflict (default false)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name && !/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name)) {
+      throw new Error("--name must start with a letter and contain only letters, digits, _, or -");
+    }
+    const url = ctx.str("url");
+    if (url) {
+      try {
+        new URL(url);
+      } catch {
+        throw new Error("--url must be a valid URL");
+      }
+      if (!/^https?:\/\//i.test(url)) {
+        throw new Error("--url only supports http:// or https:// protocols");
+      }
+    }
+    const transport = ctx.str("transport");
+    if (transport && !UPDATE_TRANSPORTS.includes(transport)) {
+      throw new Error(`--transport must be one of: ${UPDATE_TRANSPORTS.join(", ")}`);
+    }
+    const authMode = ctx.str("authMode");
+    if (authMode && !UPDATE_AUTH_MODES.includes(authMode)) {
+      throw new Error(`--auth-mode must be one of: ${UPDATE_AUTH_MODES.join(", ")}`);
+    }
+    const enabledStr = ctx.str("enabled");
+    if (enabledStr && enabledStr !== "true" && enabledStr !== "false") {
+      throw new Error("--enabled must be true or false");
+    }
+    const body = buildUpdateBody(ctx);
+    if (Object.keys(body).length === 0) {
+      throw new Error("Provide at least one field to update: --name / --url / --display-name / --description / --transport / --headers / --secret-headers / --auth-mode / --enabled / --auto-rename");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}`,
+    body: buildUpdateBody(ctx)
+  }),
+  execute: async (ctx) => {
+    return patchAgentApi(
+      ctx,
+      `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}`,
+      buildUpdateBody(ctx)
+    );
+  }
+};
+var mcpTools = {
+  service: "agent",
+  command: "+mcp-tools",
+  description: "List tools exposed by an MCP server (with OAuth auto-refresh)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/tools`
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/tools`);
+  }
+};
+var mcpAuthStart = {
+  service: "agent",
+  command: "+mcp-auth-start",
+  description: "Start MCP OAuth flow (CLI mode: get authorizeUrl, then poll +mcp-auth-status)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" },
+    { name: "redirect-after", type: "string", required: false, desc: "URL to redirect to after OAuth completes (must be same-origin as the service base URL)" },
+    { name: "cli", type: "boolean", required: false, default: true, desc: "CLI mode (always true on sandbox endpoint; server derives the callback URL)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/start`,
+    body: {
+      cliMode: true,
+      redirectAfter: ctx.str("redirectAfter") || void 0
+    }
+  }),
+  execute: async (ctx) => {
+    const result = await postAgentApi(
+      ctx,
+      `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/start`,
+      {
+        redirectAfter: ctx.str("redirectAfter") || void 0
+      }
+    );
+    if (result?.authorizeUrl && (process.stderr.isTTY || process.stdout.isTTY)) {
+      const id = ctx.str("id");
+      process.stderr.write(
+        `
+\u8BF7\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00\u4EE5\u4E0B URL \u5B8C\u6210\u6388\u6743\uFF1A
+${result.authorizeUrl}
+
+\u6388\u6743\u5B8C\u6210\u540E\uFF0C\u8FD0\u884C\u4EE5\u4E0B\u547D\u4EE4\u8F6E\u8BE2\u6388\u6743\u72B6\u6001\uFF1A
+ae-cli agent +mcp-auth-status --id ${id}
+
+`
+      );
+    }
+    return result;
+  }
+};
+var mcpAuthStatus = {
+  service: "agent",
+  command: "+mcp-auth-status",
+  description: "Query MCP OAuth authorization status (CLI poll after +mcp-auth-start)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/status`
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/status`);
+  }
+};
+var mcpAuthDisconnect = {
+  service: "agent",
+  command: "+mcp-auth-disconnect",
+  description: "Disconnect MCP OAuth (clears token and disables the server)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "MCP server record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/disconnect`
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(
+      ctx,
+      `${BASE_PATH3}/${encodeURIComponent(ctx.str("id"))}/auth/disconnect`,
+      {}
+    );
+  }
+};
+var listMcpCredentials = {
+  service: "agent",
+  command: "+list-mcp-credentials",
+  description: "List per-user credentials for system MCP servers",
+  flags: [],
+  risk: "read",
+  dryRun: () => ({
+    method: "GET",
+    url: CRED_BASE_PATH
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, CRED_BASE_PATH);
+  }
+};
+var setMcpCredential = {
+  service: "agent",
+  command: "+set-mcp-credential",
+  description: "Upsert a per-user MCP credential (by mcpServerId + userId)",
+  flags: [
+    { name: "mcp-server-id", type: "string", required: true, desc: "System MCP server record ID (CUID)" },
+    { name: "auth-type", type: "string", required: false, default: "oauth", desc: `Auth type: ${CRED_AUTH_TYPES.join(" | ")}` },
+    { name: "token", type: "string", required: false, desc: "Token / API key (plaintext; encrypted server-side)" },
+    { name: "expires-at", type: "string", required: false, desc: "ISO 8601 datetime (e.g. 2026-12-31T23:59:59Z)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const authType = ctx.str("authType") || "oauth";
+    if (!CRED_AUTH_TYPES.includes(authType)) {
+      throw new Error(`--auth-type must be one of: ${CRED_AUTH_TYPES.join(", ")}`);
+    }
+    const expiresAt = ctx.str("expiresAt");
+    if (expiresAt) {
+      const d = new Date(expiresAt);
+      if (isNaN(d.getTime())) {
+        throw new Error("--expires-at must be a valid ISO 8601 datetime");
+      }
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: CRED_BASE_PATH,
+    body: {
+      mcpServerId: ctx.str("mcpServerId"),
+      authType: ctx.str("authType") || "oauth",
+      token: ctx.str("token") || void 0,
+      expiresAt: ctx.str("expiresAt") || void 0
+    }
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, CRED_BASE_PATH, {
+      mcpServerId: ctx.str("mcpServerId"),
+      authType: ctx.str("authType") || "oauth",
+      token: ctx.str("token") || void 0,
+      expiresAt: ctx.str("expiresAt") || void 0
+    });
+  }
+};
+var autoProvisionMcpCredentials = {
+  service: "agent",
+  command: "+auto-provision-mcp-credentials",
+  description: "Auto-provision credentials for all system MCP servers using the current access token",
+  flags: [
+    { name: "access-token", type: "string", required: false, desc: "Access token (defaults to the current session token from ctx.token())" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${CRED_BASE_PATH}/auto-provision`,
+    body: {
+      accessToken: ctx.str("accessToken") || "<current-session-token>"
+    }
+  }),
+  execute: async (ctx) => {
+    const accessToken = ctx.str("accessToken") || await ctx.token();
+    return postAgentApi(ctx, `${CRED_BASE_PATH}/auto-provision`, { accessToken });
+  }
+};
+var mcpToken = {
+  service: "agent",
+  command: "+mcp-token",
+  description: "Get the plaintext MCP token (for useMcpToken=true system MCP servers)",
+  flags: [],
+  risk: "read",
+  dryRun: () => ({
+    method: "GET",
+    url: `${CRED_BASE_PATH}/mcp-token`
+  }),
+  execute: async (ctx) => {
+    const result = await getAgentApi(ctx, `${CRED_BASE_PATH}/mcp-token`);
+    if (process.stderr.isTTY) {
+      process.stderr.write(
+        `
+\u6CE8\u610F\uFF1A\u8FD4\u56DE\u660E\u6587 MCP Token\uFF0C\u8BF7\u59A5\u5584\u4FDD\u7BA1\uFF0C\u907F\u514D\u5199\u5165 shell history \u6216\u65E5\u5FD7\u3002
+
+`
+      );
+    }
+    return result;
+  }
+};
+var mcpStats = {
+  service: "agent",
+  command: "+mcp-stats",
+  description: "Show MCP call statistics for the last N days (by server / by day)",
+  flags: [
+    { name: "days", type: "number", required: false, default: 30, desc: "Lookback window in days (1-365, default 30)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const days = ctx.optionalNum("days");
+    if (days !== void 0 && (!Number.isInteger(days) || days < 1 || days > 365)) {
+      throw new Error("--days must be an integer between 1 and 365");
+    }
+  },
+  dryRun: (ctx) => {
+    const days = ctx.optionalNum("days") ?? 30;
+    return { method: "GET", url: `${STATS_PATH}?days=${days}` };
+  },
+  execute: async (ctx) => {
+    const days = ctx.optionalNum("days") ?? 30;
+    return getAgentApi(ctx, `${STATS_PATH}?days=${days}`);
+  }
+};
+
+// src/commands/te-agent/skills.ts
+var BASE_PATH4 = "/api/sandbox/agent/skills";
+var MARKET_BASE_PATH2 = "/api/sandbox/agent/skills";
+function buildMetaBody2(ctx) {
+  const body = {};
+  const category = ctx.str("category");
+  const iconEmoji = ctx.str("iconEmoji");
+  const iconColor = ctx.str("iconColor");
+  if (category) body.category = category;
+  if (iconEmoji) body.iconEmoji = iconEmoji;
+  if (iconColor) body.iconColor = iconColor;
+  return Object.keys(body).length > 0 ? body : null;
+}
+async function resolveInstructions2(raw) {
+  if (raw === "@-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (!text) throw new Error("stdin is empty; cannot read instructions");
+    return text;
+  }
+  return raw;
+}
+var listSkills = {
+  service: "agent",
+  command: "+list-skills",
+  description: "List Skills visible to current user",
+  flags: [
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      desc: "Filter by scope: personal | company | system"
+    }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company", "system"].includes(scope)) {
+      throw new Error("--scope must be personal, company, or system");
+    }
+  },
+  dryRun: (ctx) => {
+    const scope = ctx.str("scope");
+    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    return { method: "GET", url: `${BASE_PATH4}${qs}` };
+  },
+  execute: async (ctx) => {
+    const scope = ctx.str("scope");
+    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    return getAgentApi(ctx, `${BASE_PATH4}${qs}`);
+  }
+};
+var addSkill = {
+  service: "agent",
+  command: "+add-skill",
+  description: "Create a custom Skill (personal or company scope)",
+  flags: [
+    {
+      name: "name",
+      type: "string",
+      required: true,
+      desc: "Skill name (1-80 chars)"
+    },
+    {
+      name: "description",
+      type: "string",
+      required: true,
+      desc: "Skill description"
+    },
+    {
+      name: "instructions",
+      type: "string",
+      required: true,
+      desc: "Skill instructions (use @- to read from stdin)"
+    },
+    {
+      name: "display-name",
+      type: "string",
+      required: false,
+      desc: "Display name (max 100)"
+    },
+    {
+      name: "category",
+      type: "string",
+      required: false,
+      desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}`
+    },
+    {
+      name: "icon-emoji",
+      type: "string",
+      required: false,
+      desc: "Market icon emoji (e.g. robot)"
+    },
+    {
+      name: "icon-color",
+      type: "string",
+      required: false,
+      desc: "Market icon color (e.g. #1E76F0)"
+    },
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "personal",
+      desc: "Target scope: personal | company"
+    },
+    {
+      name: "version",
+      type: "string",
+      required: false,
+      desc: "Initial content version (major.minor; default 1.0)"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name.length < 1 || name.length > 80) {
+      throw new Error("--name length must be between 1 and 80");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+    const version = ctx.str("version");
+    if (version) assertValidSkillVersion(version);
+  },
+  dryRun: (ctx) => {
+    const body = {
+      name: ctx.str("name"),
+      description: ctx.str("description"),
+      instructions: ctx.str("instructions") === "@-" ? "(from stdin)" : ctx.str("instructions"),
+      displayName: ctx.str("displayName") || void 0,
+      scope: ctx.str("scope") || "personal",
+      version: ctx.str("version") || void 0
+    };
+    const meta = buildMetaBody2(ctx);
+    if (meta) body._meta = meta;
+    return { method: "POST", url: BASE_PATH4, body };
+  },
+  execute: async (ctx) => {
+    const instructions = await resolveInstructions2(ctx.str("instructions"));
+    const created = await postAgentApi(ctx, BASE_PATH4, {
+      name: ctx.str("name"),
+      description: ctx.str("description"),
+      instructions,
+      displayName: ctx.str("displayName") || void 0,
+      scope: ctx.str("scope") || "personal",
+      version: ctx.str("version") || void 0
+    });
+    const id = created?.item?.id;
+    const meta = buildMetaBody2(ctx);
+    if (id && meta) {
+      try {
+        await patchAgentApi(ctx, `${MARKET_BASE_PATH2}/${encodeURIComponent(id)}/meta`, meta);
+      } catch (err) {
+        process.stderr.write(`Warning: Skill created but meta update failed: ${err?.message ?? err}
+`);
+      }
+    }
+    return created;
+  }
+};
+var delSkill = {
+  service: "agent",
+  command: "+del-skill",
+  description: "Delete a personal Skill (physical delete)",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Skill record ID (CUID)"
+    }
+  ],
+  risk: "high-risk-write",
+  dryRun: (ctx) => ({
+    method: "DELETE",
+    url: `${BASE_PATH4}?id=${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return deleteAgentApi(ctx, `${BASE_PATH4}?id=${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+var toggleSkill = {
+  service: "agent",
+  command: "+toggle-skill",
+  description: "Enable or disable a Skill",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Skill record ID (CUID)"
+    },
+    {
+      name: "enabled",
+      type: "boolean",
+      required: true,
+      desc: "true to enable, false to disable"
+    }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: BASE_PATH4,
+    body: { id: ctx.str("id"), enabled: ctx.bool("enabled") }
+  }),
+  execute: async (ctx) => {
+    return patchAgentApi(ctx, BASE_PATH4, {
+      id: ctx.str("id"),
+      enabled: ctx.bool("enabled")
+    });
+  }
+};
+var listSkillMarket = {
+  service: "agent",
+  command: "+list-skill-market",
+  description: "List Skills from the market (only approved items; system/company/personal)",
+  flags: [
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "all",
+      desc: `Market scope: ${MARKET_SCOPES.join(" | ")} (custom = personal)`
+    },
+    {
+      name: "category",
+      type: "string",
+      required: false,
+      desc: `Category key: ${MARKET_CATEGORIES.join(" | ")}`
+    },
+    {
+      name: "search",
+      type: "string",
+      required: false,
+      desc: "Fuzzy search on name/displayName/description"
+    },
+    {
+      name: "sort",
+      type: "string",
+      required: false,
+      default: "newest",
+      desc: `Sort: ${MARKET_SORTS.join(" | ")} (calls = downloads)`
+    },
+    {
+      name: "limit",
+      type: "number",
+      required: false,
+      default: 50,
+      desc: "Page size (1-100, default 50)"
+    },
+    {
+      name: "offset",
+      type: "number",
+      required: false,
+      default: 0,
+      desc: "Page offset (>=0, default 0)"
+    }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const scope = ctx.str("scope");
+    if (scope && !MARKET_SCOPES.includes(scope)) {
+      throw new Error(`--scope must be one of: ${MARKET_SCOPES.join(", ")}`);
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const sort = ctx.str("sort");
+    if (sort && !MARKET_SORTS.includes(sort)) {
+      throw new Error(`--sort must be one of: ${MARKET_SORTS.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${MARKET_BASE_PATH2}/market?${buildMarketQuery(ctx).toString()}`
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, `${MARKET_BASE_PATH2}/market?${buildMarketQuery(ctx).toString()}`);
+  }
+};
+var setSkillMeta = {
+  service: "agent",
+  command: "+set-skill-meta",
+  description: "Update a Skill market meta (category / icon). Company scope requires root; system is read-only.",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Skill record ID (CUID)"
+    },
+    {
+      name: "category",
+      type: "string",
+      required: false,
+      desc: `Category key: ${MARKET_CATEGORIES.join(" | ")}`
+    },
+    {
+      name: "icon-emoji",
+      type: "string",
+      required: false,
+      desc: "Market icon emoji (e.g. robot)"
+    },
+    {
+      name: "icon-color",
+      type: "string",
+      required: false,
+      desc: "Market icon color (e.g. #1E76F0)"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    if (!buildMetaBody2(ctx)) {
+      throw new Error("Provide at least one of --category / --icon-emoji / --icon-color");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: `${MARKET_BASE_PATH2}/${encodeURIComponent(ctx.str("id"))}/meta`,
+    body: buildMetaBody2(ctx)
+  }),
+  execute: async (ctx) => {
+    return patchAgentApi(ctx, `${MARKET_BASE_PATH2}/${encodeURIComponent(ctx.str("id"))}/meta`, buildMetaBody2(ctx));
+  }
+};
+var copySkill = {
+  service: "agent",
+  command: "+copy-skill",
+  description: "Copy a system/company Skill to a personal copy (independent duplicate)",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Source Skill record ID (CUID, system or company scope)"
+    },
+    {
+      name: "category",
+      type: "string",
+      required: false,
+      desc: `Market category key for the copy: ${MARKET_CATEGORIES.join(" | ")}`
+    },
+    {
+      name: "icon-emoji",
+      type: "string",
+      required: false,
+      desc: "Override market icon emoji (e.g. robot)"
+    },
+    {
+      name: "icon-color",
+      type: "string",
+      required: false,
+      desc: "Override market icon color (e.g. #1E76F0)"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${MARKET_BASE_PATH2}/${encodeURIComponent(ctx.str("id"))}/copy`,
+    body: buildMetaBody2(ctx) ?? {}
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${MARKET_BASE_PATH2}/${encodeURIComponent(ctx.str("id"))}/copy`, buildMetaBody2(ctx) ?? {});
+  }
+};
+
+// src/commands/te-agent/skill-content.ts
+import { readFileSync, existsSync, writeFileSync } from "fs";
+import { resolve, basename, extname } from "path";
+var BASE_PATH5 = "/api/sandbox/agent/skills";
+async function resolveInstructions3(raw) {
+  if (raw === "@-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (!text) throw new Error("stdin is empty; cannot read instructions");
+    return text;
+  }
+  return raw;
+}
+function readFileForUpload(filePath) {
+  const resolved = resolve(filePath);
+  if (!existsSync(resolved)) {
+    throw new Error(`File not found: ${resolved}`);
+  }
+  const buffer = readFileSync(resolved);
+  const fileName = basename(resolved);
+  const mimeType = guessMimeType(resolved);
+  return { buffer, fileName, mimeType };
+}
+function guessMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  const map = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".md": "text/markdown",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".xml": "application/xml",
+    ".doc": "application/msword",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xls": "application/vnd.ms-excel",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    ".zip": "application/zip"
+  };
+  return map[ext] || "application/octet-stream";
+}
+function buildAssetFormData(filePath, subPath) {
+  const { buffer, fileName, mimeType } = readFileForUpload(filePath);
+  const fd = new FormData();
+  const blob = new Blob([new Uint8Array(buffer)], { type: mimeType });
+  fd.append("file", blob, fileName);
+  if (subPath) fd.append("subPath", subPath);
+  return fd;
+}
+function makeAssetListCommand(commandName, description, dirName) {
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      {
+        name: "id",
+        type: "string",
+        required: true,
+        desc: "Skill record ID (CUID)"
+      }
+    ],
+    risk: "read",
+    dryRun: (ctx) => ({
+      method: "GET",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`
+    }),
+    execute: async (ctx) => {
+      return getAgentApi(ctx, `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`);
+    }
+  };
+}
+function makeAssetUploadCommand(commandName, description, dirName) {
+  const validate = (ctx) => {
+    const filePath = ctx.str("file");
+    if (!filePath) throw new Error("--file is required");
+    if (!existsSync(resolve(filePath))) throw new Error(`File not found: ${resolve(filePath)}`);
+  };
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      {
+        name: "id",
+        type: "string",
+        required: true,
+        desc: "Skill record ID (CUID)"
+      },
+      {
+        name: "file",
+        type: "string",
+        required: true,
+        desc: "Local file path to upload (max 1MB)"
+      },
+      {
+        name: "sub-path",
+        type: "string",
+        required: false,
+        desc: 'Sub-directory under the target dir (e.g. "sub/")'
+      }
+    ],
+    risk: "write",
+    validate,
+    dryRun: (ctx) => ({
+      method: "POST",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`,
+      body: { file: ctx.str("file"), subPath: ctx.str("subPath") || "" }
+    }),
+    execute: async (ctx) => {
+      const fd = buildAssetFormData(ctx.str("file"), ctx.str("subPath") || void 0);
+      return uploadAgentApi(ctx, `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}`, fd);
+    }
+  };
+}
+function isTextContentType(contentType) {
+  const mediaType = contentType?.split(";", 1)[0]?.trim().toLowerCase();
+  if (!mediaType) return false;
+  return mediaType.startsWith("text/") || mediaType === "application/json" || mediaType.endsWith("+json") || mediaType === "application/xml" || mediaType.endsWith("+xml");
+}
+function makeAssetReadCommand(commandName, description, dirName) {
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      {
+        name: "id",
+        type: "string",
+        required: true,
+        desc: "Skill record ID (CUID)"
+      },
+      {
+        name: "path",
+        type: "string",
+        required: true,
+        desc: 'Relative file path within the directory (e.g. "guide.md" or "sub/icon.png")'
+      },
+      {
+        name: "output",
+        type: "string",
+        required: false,
+        desc: "Write binary content to a local file (preserves binary data)"
+      }
+    ],
+    risk: "read",
+    dryRun: (ctx) => ({
+      method: "GET",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodeURIComponent(ctx.str("path"))}`
+    }),
+    execute: async (ctx) => {
+      const filePath = ctx.str("path");
+      const encodedPath = filePath.split("/").map((seg) => encodeURIComponent(seg)).join("/");
+      const url = `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodedPath}`;
+      const { buffer, fileName, contentType } = await getAgentBuffer(ctx, url);
+      const outputPath = ctx.str("output");
+      if (outputPath) {
+        const resolved = resolve(outputPath);
+        writeFileSync(resolved, buffer);
+        return { saved: true, path: resolved, size: buffer.length, fileName };
+      }
+      if (dirName === "references" && !isTextContentType(contentType)) {
+        throw new CliValidationError("Binary content requires --output", {
+          code: "output_required",
+          hint: "Re-run with --output <path> to preserve the original bytes."
+        });
+      }
+      const content = buffer.toString("utf8");
+      return { content, fileName };
+    }
+  };
+}
+function makeAssetDelCommand(commandName, description, dirName) {
+  return {
+    service: "agent",
+    command: commandName,
+    description,
+    flags: [
+      {
+        name: "id",
+        type: "string",
+        required: true,
+        desc: "Skill record ID (CUID)"
+      },
+      {
+        name: "path",
+        type: "string",
+        required: true,
+        desc: "Relative file path within the directory to delete"
+      }
+    ],
+    risk: "high-risk-write",
+    dryRun: (ctx) => ({
+      method: "DELETE",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodeURIComponent(ctx.str("path"))}`
+    }),
+    execute: async (ctx) => {
+      const filePath = ctx.str("path");
+      const encodedPath = filePath.split("/").map((seg) => encodeURIComponent(seg)).join("/");
+      return deleteAgentApi(ctx, `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/${dirName}/${encodedPath}`);
+    }
+  };
+}
+var editSkill = {
+  service: "agent",
+  command: "+edit-skill",
+  description: "Edit a personal Skill content (name / description / instructions / icon)",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Skill record ID (CUID)"
+    },
+    {
+      name: "name",
+      type: "string",
+      required: false,
+      desc: "New Skill name (1-80 chars)"
+    },
+    {
+      name: "description",
+      type: "string",
+      required: false,
+      desc: "New Skill description"
+    },
+    {
+      name: "instructions",
+      type: "string",
+      required: false,
+      desc: "New instructions (use @- to read from stdin)"
+    },
+    {
+      name: "display-name",
+      type: "string",
+      required: false,
+      desc: "New display name (max 100)"
+    },
+    {
+      name: "category",
+      type: "string",
+      required: false,
+      desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}`
+    },
+    {
+      name: "icon-emoji",
+      type: "string",
+      required: false,
+      desc: "Market icon emoji (e.g. robot)"
+    },
+    {
+      name: "icon-color",
+      type: "string",
+      required: false,
+      desc: "Market icon color (e.g. #1E76F0)"
+    },
+    {
+      name: "version",
+      type: "string",
+      required: false,
+      desc: "New content version (major.minor; required for content changes)"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const name = ctx.str("name");
+    if (name && (name.length < 1 || name.length > 80)) {
+      throw new Error("--name length must be between 1 and 80");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const hasAny = ctx.str("name") || ctx.str("description") || ctx.str("instructions") || ctx.str("displayName") || ctx.str("category") || ctx.str("iconEmoji") || ctx.str("iconColor");
+    if (!hasAny) {
+      throw new Error(
+        "Provide at least one of --name / --description / --instructions / --display-name / --category / --icon-emoji / --icon-color"
+      );
+    }
+    const version = ctx.str("version");
+    if (version) assertValidSkillVersion(version);
+    const changesContent = Boolean(ctx.str("name")) || Boolean(ctx.str("description")) || Boolean(ctx.str("instructions"));
+    if (changesContent && !version) {
+      throw new Error("--version is required when editing Skill content");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {};
+    if (ctx.str("name")) body.name = ctx.str("name");
+    if (ctx.str("description")) body.description = ctx.str("description");
+    body.instructions = ctx.str("instructions") === "@-" ? "(from stdin)" : ctx.str("instructions") || void 0;
+    if (ctx.str("displayName")) body.displayName = ctx.str("displayName");
+    if (ctx.str("category")) body.category = ctx.str("category");
+    if (ctx.str("iconEmoji")) body.iconEmoji = ctx.str("iconEmoji");
+    if (ctx.str("iconColor")) body.iconColor = ctx.str("iconColor");
+    if (ctx.str("version")) body.version = ctx.str("version");
+    return {
+      method: "PUT",
+      url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}`,
+      body
+    };
+  },
+  execute: async (ctx) => {
+    const body = {};
+    if (ctx.str("name")) body.name = ctx.str("name");
+    if (ctx.str("description")) body.description = ctx.str("description");
+    if (ctx.str("instructions")) {
+      body.instructions = await resolveInstructions3(ctx.str("instructions"));
+    }
+    if (ctx.str("displayName")) body.displayName = ctx.str("displayName");
+    if (ctx.str("category")) body.category = ctx.str("category");
+    if (ctx.str("iconEmoji")) body.iconEmoji = ctx.str("iconEmoji");
+    if (ctx.str("iconColor")) body.iconColor = ctx.str("iconColor");
+    if (ctx.str("version")) body.version = ctx.str("version");
+    return putAgentApi(ctx, `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}`, body);
+  }
+};
+var getSkillContent = {
+  service: "agent",
+  command: "+get-skill-content",
+  description: "Read a Skill SKILL.md text content",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Skill record ID (CUID)"
+    }
+  ],
+  risk: "read",
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/content`
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, `${BASE_PATH5}/${encodeURIComponent(ctx.str("id"))}/content`);
+  }
+};
+var listSkillAssets = makeAssetListCommand(
+  "+list-skill-assets",
+  "List all files in a Skill assets directory",
+  "assets"
+);
+var uploadSkillAsset = makeAssetUploadCommand(
+  "+upload-skill-asset",
+  "Upload a single file to a Skill assets directory (max 1MB)",
+  "assets"
+);
+var readSkillAsset = makeAssetReadCommand(
+  "+read-skill-asset",
+  "Read a Skill asset file (binary-safe; use --output to save to disk)",
+  "assets"
+);
+var delSkillAsset = makeAssetDelCommand(
+  "+del-skill-asset",
+  "Delete a file from a Skill assets directory",
+  "assets"
+);
+var listSkillReferences = makeAssetListCommand(
+  "+list-skill-references",
+  "List all files in a Skill references directory",
+  "references"
+);
+var uploadSkillReference = makeAssetUploadCommand(
+  "+upload-skill-reference",
+  "Upload a single file to a Skill references directory (max 1MB)",
+  "references"
+);
+var readSkillReference = makeAssetReadCommand(
+  "+read-skill-reference",
+  "Read a Skill reference file (binary-safe; use --output for non-text files)",
+  "references"
+);
+var delSkillReference = makeAssetDelCommand(
+  "+del-skill-reference",
+  "Delete a file from a Skill references directory",
+  "references"
+);
+var listSkillScripts = makeAssetListCommand(
+  "+list-skill-scripts",
+  "List all files in a Skill scripts directory",
+  "scripts"
+);
+var uploadSkillScript = makeAssetUploadCommand(
+  "+upload-skill-script",
+  "Upload a single file to a Skill scripts directory (max 1MB)",
+  "scripts"
+);
+var readSkillScript = makeAssetReadCommand(
+  "+read-skill-script",
+  "Read a Skill script file (binary-safe; use --output to save to disk)",
+  "scripts"
+);
+var delSkillScript = makeAssetDelCommand(
+  "+del-skill-script",
+  "Delete a file from a Skill scripts directory",
+  "scripts"
+);
+var uploadSkill = {
+  service: "agent",
+  command: "+upload-skill",
+  description: "Upload a ZIP-format Skill (parses SKILL.md + extracts to target dir)",
+  flags: [
+    {
+      name: "file",
+      type: "string",
+      required: true,
+      desc: "Local .zip file path"
+    },
+    {
+      name: "scope",
+      type: "string",
+      required: false,
+      default: "personal",
+      desc: "Target scope: personal | company"
+    },
+    {
+      name: "auto-rename",
+      type: "boolean",
+      required: false,
+      desc: "Auto-rename on name conflict"
+    },
+    {
+      name: "replace-skill-id",
+      type: "string",
+      required: false,
+      desc: "Replace an existing Skill (CUID) instead of creating a new one"
+    },
+    {
+      name: "category",
+      type: "string",
+      required: false,
+      desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}`
+    },
+    {
+      name: "name",
+      type: "string",
+      required: false,
+      desc: "Override Skill name (from ZIP SKILL.md if omitted)"
+    },
+    {
+      name: "display-name",
+      type: "string",
+      required: false,
+      desc: "Override display name"
+    },
+    {
+      name: "description",
+      type: "string",
+      required: false,
+      desc: "Override description"
+    },
+    {
+      name: "instructions",
+      type: "string",
+      required: false,
+      desc: "Override instructions (use @- to read from stdin)"
+    },
+    {
+      name: "icon-emoji",
+      type: "string",
+      required: false,
+      desc: "Market icon emoji (e.g. robot)"
+    },
+    {
+      name: "icon-color",
+      type: "string",
+      required: false,
+      desc: "Market icon color (e.g. #1E76F0)"
+    },
+    {
+      name: "version",
+      type: "string",
+      required: false,
+      desc: "Content version (major.minor; required with --replace-skill-id)"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const filePath = ctx.str("file");
+    if (!filePath) throw new Error("--file is required");
+    const resolved = resolve(filePath);
+    if (!existsSync(resolved)) throw new Error(`File not found: ${resolved}`);
+    const ext = extname(resolved).toLowerCase();
+    if (ext !== ".zip") throw new Error("--file must be a .zip file");
+    const scope = ctx.str("scope");
+    if (scope && !["personal", "company"].includes(scope)) {
+      throw new Error("--scope must be personal or company");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+    const version = ctx.str("version");
+    if (version) assertValidSkillVersion(version);
+    if (ctx.str("replaceSkillId") && !version) {
+      throw new Error("--version is required with --replace-skill-id");
+    }
+  },
+  dryRun: (ctx) => {
+    const body = {
+      file: ctx.str("file"),
+      scope: ctx.str("scope") || "personal"
+    };
+    if (ctx.bool("autoRename")) body.autoRename = true;
+    if (ctx.str("replaceSkillId")) body.replaceSkillId = ctx.str("replaceSkillId");
+    if (ctx.str("category")) body.category = ctx.str("category");
+    if (ctx.str("name")) body.name = ctx.str("name");
+    if (ctx.str("displayName")) body.displayName = ctx.str("displayName");
+    if (ctx.str("description")) body.description = ctx.str("description");
+    if (ctx.str("instructions"))
+      body.instructions = ctx.str("instructions") === "@-" ? "(from stdin)" : ctx.str("instructions");
+    if (ctx.str("iconEmoji")) body.iconEmoji = ctx.str("iconEmoji");
+    if (ctx.str("iconColor")) body.iconColor = ctx.str("iconColor");
+    if (ctx.str("version")) body.version = ctx.str("version");
+    return {
+      method: "POST",
+      url: `${BASE_PATH5}/upload`,
+      body
+    };
+  },
+  execute: async (ctx) => {
+    const filePath = ctx.str("file");
+    const resolved = resolve(filePath);
+    const buffer = readFileSync(resolved);
+    const fileName = basename(resolved);
+    const fd = new FormData();
+    const blob = new Blob([new Uint8Array(buffer)], {
+      type: "application/zip"
+    });
+    fd.append("file", blob, fileName);
+    const scope = ctx.str("scope") || "personal";
+    fd.append("scope", scope);
+    if (ctx.bool("autoRename")) fd.append("autoRename", "true");
+    if (ctx.str("replaceSkillId")) fd.append("replaceSkillId", ctx.str("replaceSkillId"));
+    if (ctx.str("category")) fd.append("category", ctx.str("category"));
+    if (ctx.str("name")) fd.append("name", ctx.str("name"));
+    if (ctx.str("displayName")) fd.append("displayName", ctx.str("displayName"));
+    if (ctx.str("description")) fd.append("description", ctx.str("description"));
+    if (ctx.str("instructions")) {
+      const instructions = await resolveInstructions3(ctx.str("instructions"));
+      fd.append("instructions", instructions);
+    }
+    if (ctx.str("iconEmoji")) fd.append("iconEmoji", ctx.str("iconEmoji"));
+    if (ctx.str("iconColor")) fd.append("iconColor", ctx.str("iconColor"));
+    if (ctx.str("version")) fd.append("version", ctx.str("version"));
+    return uploadAgentApi(ctx, `${BASE_PATH5}/upload`, fd);
+  }
+};
+var rescanSkills = {
+  service: "agent",
+  command: "+rescan-skills",
+  description: "Rescan Skill files and sync to database (root only)",
+  flags: [],
+  risk: "write",
+  dryRun: () => ({
+    method: "POST",
+    url: `${BASE_PATH5}/rescan`
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${BASE_PATH5}/rescan`, {});
+  }
+};
+
+// src/commands/te-agent/skill-approvals.ts
+var BASE = "/api/sandbox/agent/skills";
+var submitSkill = {
+  service: "agent",
+  command: "+submit-skill",
+  description: "Submit a personal Skill for company-scope approval review",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Skill record ID (CUID, personal scope)" },
+    { name: "description", type: "string", required: true, desc: "Submission reason / description (1-80 chars)" },
+    { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const description = ctx.str("description");
+    if (description.length < 1 || description.length > 80) {
+      throw new Error("--description length must be between 1 and 80");
+    }
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => {
+    const body = { description: ctx.str("description") };
+    const category = ctx.str("category");
+    if (category) body.category = category;
+    const iconEmoji = ctx.str("iconEmoji");
+    if (iconEmoji) body.iconEmoji = iconEmoji;
+    const iconColor = ctx.str("iconColor");
+    if (iconColor) body.iconColor = iconColor;
+    return {
+      method: "POST",
+      url: `${BASE}/${encodeURIComponent(ctx.str("id"))}/submit`,
+      body
+    };
+  },
+  execute: async (ctx) => {
+    const body = { description: ctx.str("description") };
+    const category = ctx.str("category");
+    if (category) body.category = category;
+    const iconEmoji = ctx.str("iconEmoji");
+    if (iconEmoji) body.iconEmoji = iconEmoji;
+    const iconColor = ctx.str("iconColor");
+    if (iconColor) body.iconColor = iconColor;
+    return postAgentApi(ctx, `${BASE}/${encodeURIComponent(ctx.str("id"))}/submit`, body);
+  }
+};
+var listSkillSubmissions = {
+  service: "agent",
+  command: "+list-skill-submissions",
+  description: "List Skill submissions (approvals). Root sees all company submissions; others see only their own.",
+  flags: [
+    { name: "status", type: "string", required: false, desc: `Filter by status: ${SUBMISSION_STATUSES.join(" | ")}` },
+    { name: "mine", type: "boolean", required: false, desc: "Only show submissions created by the current user (root only)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const status = ctx.str("status");
+    if (status && !SUBMISSION_STATUSES.includes(status)) {
+      throw new Error(`--status must be one of: ${SUBMISSION_STATUSES.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => {
+    const params = new URLSearchParams();
+    const status = ctx.str("status");
+    if (status) params.set("status", status);
+    if (ctx.bool("mine")) params.set("mine", "true");
+    const qs = params.toString();
+    return { method: "GET", url: `${BASE}/submissions${qs ? `?${qs}` : ""}` };
+  },
+  execute: async (ctx) => {
+    const params = new URLSearchParams();
+    const status = ctx.str("status");
+    if (status) params.set("status", status);
+    if (ctx.bool("mine")) params.set("mine", "true");
+    const qs = params.toString();
+    return getAgentApi(ctx, `${BASE}/submissions${qs ? `?${qs}` : ""}`);
+  }
+};
+var cancelSkillSubmission = {
+  service: "agent",
+  command: "+cancel-skill-submission",
+  description: "Cancel a pending Skill submission (submitter or root)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Submission record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE}/submissions/${encodeURIComponent(ctx.str("id"))}/cancel`
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${BASE}/submissions/${encodeURIComponent(ctx.str("id"))}/cancel`, {});
+  }
+};
+var approveSkill = {
+  service: "agent",
+  command: "+approve-skill",
+  description: "Approve a pending Skill submission (root only). Creates a company-scope copy.",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Submission record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE}/submissions/${encodeURIComponent(ctx.str("id"))}/approve`
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${BASE}/submissions/${encodeURIComponent(ctx.str("id"))}/approve`, {});
+  }
+};
+var rejectSkill = {
+  service: "agent",
+  command: "+reject-skill",
+  description: "Reject a pending Skill submission with a reason (root only).",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Submission record ID (CUID)" },
+    { name: "reason", type: "string", required: true, desc: "Rejection reason (1-80 chars)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const reason = ctx.str("reason");
+    if (reason.length < 1 || reason.length > 80) {
+      throw new Error("--reason length must be between 1 and 80");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE}/submissions/${encodeURIComponent(ctx.str("id"))}/reject`,
+    body: { reason: ctx.str("reason") }
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${BASE}/submissions/${encodeURIComponent(ctx.str("id"))}/reject`, {
+      reason: ctx.str("reason")
+    });
+  }
+};
+
+// src/commands/te-agent/skill-shares.ts
+var BASE2 = "/api/sandbox/agent/skills";
+var shareSkill = {
+  service: "agent",
+  command: "+share-skill",
+  description: "Share a personal Skill to another user in the same company",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Skill record ID (CUID, personal scope)" },
+    { name: "to-user-id", type: "string", required: true, desc: "Recipient user ID (same company)" },
+    { name: "category", type: "string", required: false, desc: `Market category key: ${MARKET_CATEGORIES.join(" | ")}` },
+    { name: "icon-emoji", type: "string", required: false, desc: "Market icon emoji (e.g. robot)" },
+    { name: "icon-color", type: "string", required: false, desc: "Market icon color (e.g. #1E76F0)" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    const category = ctx.str("category");
+    if (category && !isValidMarketCategory(category)) {
+      throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => {
+    const body = { toUserId: ctx.str("toUserId") };
+    const category = ctx.str("category");
+    if (category) body.category = category;
+    const iconEmoji = ctx.str("iconEmoji");
+    if (iconEmoji) body.iconEmoji = iconEmoji;
+    const iconColor = ctx.str("iconColor");
+    if (iconColor) body.iconColor = iconColor;
+    return {
+      method: "POST",
+      url: `${BASE2}/${encodeURIComponent(ctx.str("id"))}/share`,
+      body
+    };
+  },
+  execute: async (ctx) => {
+    const body = { toUserId: ctx.str("toUserId") };
+    const category = ctx.str("category");
+    if (category) body.category = category;
+    const iconEmoji = ctx.str("iconEmoji");
+    if (iconEmoji) body.iconEmoji = iconEmoji;
+    const iconColor = ctx.str("iconColor");
+    if (iconColor) body.iconColor = iconColor;
+    return postAgentApi(ctx, `${BASE2}/${encodeURIComponent(ctx.str("id"))}/share`, body);
+  }
+};
+var listSkillShares = {
+  service: "agent",
+  command: "+list-skill-shares",
+  description: "List Skill shares (received by default; use --direction sent for outgoing)",
+  flags: [
+    { name: "direction", type: "string", required: false, default: "received", desc: `Direction: ${SHARE_DIRECTIONS.join(" | ")}` },
+    { name: "status", type: "string", required: false, desc: `Filter by status: ${SHARE_STATUSES.join(" | ")}` }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const direction = ctx.str("direction");
+    if (direction && !SHARE_DIRECTIONS.includes(direction)) {
+      throw new Error(`--direction must be one of: ${SHARE_DIRECTIONS.join(", ")}`);
+    }
+    const status = ctx.str("status");
+    if (status && !SHARE_STATUSES.includes(status)) {
+      throw new Error(`--status must be one of: ${SHARE_STATUSES.join(", ")}`);
+    }
+  },
+  dryRun: (ctx) => {
+    const params = new URLSearchParams();
+    params.set("direction", ctx.str("direction") || "received");
+    const status = ctx.str("status");
+    if (status) params.set("status", status);
+    return { method: "GET", url: `${BASE2}/shares?${params.toString()}` };
+  },
+  execute: async (ctx) => {
+    const params = new URLSearchParams();
+    params.set("direction", ctx.str("direction") || "received");
+    const status = ctx.str("status");
+    if (status) params.set("status", status);
+    return getAgentApi(ctx, `${BASE2}/shares?${params.toString()}`);
+  }
+};
+var acceptSkillShare = {
+  service: "agent",
+  command: "+accept-skill-share",
+  description: "Accept a received Skill share (creates a personal copy for the recipient)",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Share record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE2}/shares/${encodeURIComponent(ctx.str("id"))}/accept`
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${BASE2}/shares/${encodeURIComponent(ctx.str("id"))}/accept`, {});
+  }
+};
+var rejectSkillShare = {
+  service: "agent",
+  command: "+reject-skill-share",
+  description: "Reject a received Skill share",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Share record ID (CUID)" }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${BASE2}/shares/${encodeURIComponent(ctx.str("id"))}/reject`
+  }),
+  execute: async (ctx) => {
+    return postAgentApi(ctx, `${BASE2}/shares/${encodeURIComponent(ctx.str("id"))}/reject`, {});
+  }
+};
+
+// src/commands/te-agent/attachments.ts
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { resolve as resolve2, basename as basename2, extname as extname2 } from "path";
+var LIST_PATH = "/api/sandbox/agent/attachments";
+var UPLOAD_PATH = "/api/sandbox/agent/attachments/upload";
+var STATS_PATH2 = "/api/sandbox/agent/attachments/stats";
+function guessMimeType2(filePath) {
+  const ext = extname2(filePath).toLowerCase();
+  const map = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".md": "text/markdown",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".xml": "application/xml",
+    ".doc": "application/msword",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xls": "application/vnd.ms-excel",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    ".zip": "application/zip"
+  };
+  return map[ext] || "application/octet-stream";
+}
+function resolveFilePaths(ctx) {
+  const file = ctx.str("file");
+  const files = ctx.str("files");
+  if (file && files) {
+    throw new Error("--file and --files cannot be used together");
+  }
+  if (!file && !files) {
+    throw new Error("Either --file or --files must be specified");
+  }
+  if (file) return [file];
+  try {
+    const parsed = JSON.parse(files);
+    if (!Array.isArray(parsed)) throw new Error("--files must be a JSON array");
+    return parsed.map((p) => {
+      if (typeof p !== "string") throw new Error("--files array elements must be strings");
+      return p;
+    });
+  } catch (err) {
+    if (err instanceof SyntaxError) throw new Error("--files must be a valid JSON array");
+    throw err;
+  }
+}
+async function uploadFiles(ctx, filePaths) {
+  const formData = new FormData();
+  for (const filePath of filePaths) {
+    const resolved = resolve2(filePath);
+    if (!existsSync2(resolved)) {
+      throw new Error(`File not found: ${resolved}`);
+    }
+    const buffer = readFileSync2(resolved);
+    const mimeType = guessMimeType2(resolved);
+    const blob = new Blob([buffer], { type: mimeType });
+    formData.append("file", blob, basename2(resolved));
+  }
+  return uploadAgentApi(ctx, UPLOAD_PATH, formData);
+}
+var listAttachments = {
+  service: "agent",
+  command: "+list-attachments",
+  description: "List user attachments (paginated)",
+  flags: [
+    { name: "q", type: "string", required: false, desc: "Search keyword" },
+    { name: "type", type: "string", required: false, desc: "Filter by type: image | document" },
+    { name: "page", type: "number", required: false, desc: "Page number (default 1)" },
+    { name: "page-size", type: "number", required: false, desc: "Page size (default 20, max 10000)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const type = ctx.str("type");
+    if (type && !["image", "document"].includes(type)) {
+      throw new Error("--type must be image or document");
+    }
+  },
+  dryRun: (ctx) => {
+    const params = new URLSearchParams();
+    if (ctx.str("q")) params.set("q", ctx.str("q"));
+    if (ctx.str("type")) params.set("type", ctx.str("type"));
+    if (ctx.num("page")) params.set("page", String(ctx.num("page")));
+    if (ctx.num("pageSize")) params.set("pageSize", String(ctx.num("pageSize")));
+    const qs = params.toString();
+    return { method: "GET", url: `${LIST_PATH}${qs ? "?" + qs : ""}` };
+  },
+  execute: async (ctx) => {
+    const params = new URLSearchParams();
+    if (ctx.str("q")) params.set("q", ctx.str("q"));
+    if (ctx.str("type")) params.set("type", ctx.str("type"));
+    if (ctx.num("page")) params.set("page", String(ctx.num("page")));
+    if (ctx.num("pageSize")) params.set("pageSize", String(ctx.num("pageSize")));
+    const qs = params.toString();
+    return getAgentApi(ctx, `${LIST_PATH}${qs ? "?" + qs : ""}`);
+  }
+};
+var addAttachment = {
+  service: "agent",
+  command: "+add-attachment",
+  description: "Upload sandbox file(s) to attachment library",
+  flags: [
+    { name: "file", type: "string", required: false, desc: "Single file path" },
+    { name: "files", type: "string", required: false, desc: `JSON array of file paths, e.g. '["./a.png","./b.pdf"]'` }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    resolveFilePaths(ctx);
+  },
+  dryRun: (ctx) => {
+    const paths = resolveFilePaths(ctx);
+    return { method: "POST", url: UPLOAD_PATH, body: { files: paths } };
+  },
+  execute: async (ctx) => {
+    const paths = resolveFilePaths(ctx);
+    return uploadFiles(ctx, paths);
+  }
+};
+var delAttachment = {
+  service: "agent",
+  command: "+del-attachment",
+  description: "Soft-delete an attachment",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Attachment ID" }
+  ],
+  risk: "high-risk-write",
+  dryRun: (ctx) => ({
+    method: "DELETE",
+    url: `${LIST_PATH}?id=${encodeURIComponent(ctx.str("id"))}`
+  }),
+  execute: async (ctx) => {
+    return deleteAgentApi(ctx, `${LIST_PATH}?id=${encodeURIComponent(ctx.str("id"))}`);
+  }
+};
+var attachmentStats = {
+  service: "agent",
+  command: "+attachment-stats",
+  description: "Show attachment library statistics (total files, size, images, documents)",
+  flags: [],
+  risk: "read",
+  dryRun: () => ({
+    method: "GET",
+    url: STATS_PATH2
+  }),
+  execute: async (ctx) => {
+    return getAgentApi(ctx, STATS_PATH2);
+  }
+};
+
+// src/commands/te-agent/automations.ts
+var BASE_PATH6 = "/api/sandbox/agent/automations";
+var SCHEDULE_KINDS = ["hourly", "daily", "weekly", "monthly"];
+var TIME_RE = /^([01]\d|2[0-3]):([0-5]\d)$/;
+var AUTOMATION_STATUSES = ["active", "paused"];
+function optional(value) {
+  const trimmed = value.trim();
+  return trimmed ? trimmed : void 0;
+}
+function envOptional(name) {
+  return optional(process.env[name] ?? "");
+}
+function readEnabled(ctx) {
+  return readEnabledOptional(ctx) ?? true;
+}
+function readEnabledOptional(ctx) {
+  const enabled = ctx.json("enabled");
+  if (enabled === void 0) return void 0;
+  if (typeof enabled !== "boolean") {
+    throw new Error("--enabled \u5FC5\u987B\u662F true \u6216 false");
+  }
+  return enabled;
+}
+function readReuseConversation(ctx) {
+  return readReuseConversationOptional(ctx) ?? false;
+}
+function readReuseConversationOptional(ctx) {
+  const reuseConversation = ctx.json("reuseConversation");
+  if (reuseConversation === void 0) return void 0;
+  if (typeof reuseConversation !== "boolean") {
+    throw new Error("--reuse-conversation must be true or false");
+  }
+  return reuseConversation;
+}
+function buildSchedule(ctx) {
+  const kind = optional(ctx.str("scheduleKind"));
+  if (!kind) return void 0;
+  if (kind === "hourly") {
+    const minute = ctx.str("minute") ? ctx.num("minute") : void 0;
+    return { kind, ...minute === void 0 ? {} : { minute } };
+  }
+  if (kind === "daily") return { kind, time: ctx.str("time") };
+  if (kind === "weekly") {
+    return { kind, time: ctx.str("time"), weekday: ctx.num("weekday") };
+  }
+  return {
+    kind: "monthly",
+    time: ctx.str("time"),
+    dayOfMonth: ctx.num("dayOfMonth")
+  };
+}
+function hasScheduleDetail(ctx) {
+  return Boolean(
+    optional(ctx.str("time")) || optional(ctx.str("minute")) || optional(ctx.str("weekday")) || optional(ctx.str("dayOfMonth"))
+  );
+}
+function validateSchedule(ctx, required) {
+  const cron = optional(ctx.str("cron"));
+  const kind = optional(ctx.str("scheduleKind"));
+  if (cron && kind) {
+    throw new Error("--cron \u4E0E --schedule-kind \u53EA\u80FD\u4E8C\u9009\u4E00");
+  }
+  if (!cron && !kind) {
+    if (required || hasScheduleDetail(ctx)) {
+      throw new Error("\u5FC5\u987B\u63D0\u4F9B --cron \u6216 --schedule-kind");
+    }
+    return;
+  }
+  if (!kind) return;
+  if (!SCHEDULE_KINDS.includes(kind)) {
+    throw new Error("--schedule-kind \u5FC5\u987B\u662F hourly\u3001daily\u3001weekly \u6216 monthly");
+  }
+  const time = optional(ctx.str("time"));
+  if (kind !== "hourly") {
+    if (!time) throw new Error(`${kind} \u8C03\u5EA6\u5FC5\u987B\u63D0\u4F9B --time HH:mm`);
+    if (!TIME_RE.test(time)) throw new Error("--time \u683C\u5F0F\u5FC5\u987B\u662F HH:mm");
+  }
+  if (kind === "hourly" && ctx.str("minute")) {
+    const minute = ctx.num("minute");
+    if (!Number.isInteger(minute) || minute < 0 || minute > 59) {
+      throw new Error("--minute \u5FC5\u987B\u662F 0-59 \u7684\u6574\u6570");
+    }
+  }
+  if (kind === "weekly") {
+    const weekday = ctx.num("weekday");
+    if (!Number.isInteger(weekday) || weekday < 0 || weekday > 6) {
+      throw new Error("--weekday \u5FC5\u987B\u662F 0-6 \u7684\u6574\u6570\uFF0C0 \u8868\u793A\u5468\u65E5");
+    }
+  }
+  if (kind === "monthly") {
+    const dayOfMonth = ctx.num("dayOfMonth");
+    if (!Number.isInteger(dayOfMonth) || dayOfMonth < 1 || dayOfMonth > 28) {
+      throw new Error("--day-of-month \u5FC5\u987B\u662F 1-28 \u7684\u6574\u6570");
+    }
+  }
+}
+function buildCreateBody(ctx) {
+  const explicitAgentId = optional(ctx.str("agentId"));
+  const explicitAgentName = optional(ctx.str("agentName"));
+  const agentId = explicitAgentId ?? (explicitAgentName ? void 0 : envOptional("TE_AGENT_CURRENT_AGENT_ID"));
+  const conversationId = optional(ctx.str("conversationId")) ?? envOptional("TE_AGENT_CONVERSATION_ID");
+  const model = optional(ctx.str("model")) ?? envOptional("TE_AGENT_CURRENT_MODEL_ID");
+  const enabled = readEnabled(ctx);
+  return {
+    name: ctx.str("name"),
+    message: ctx.str("message"),
+    agentId,
+    agentName: explicitAgentName,
+    conversationId,
+    cronExpression: optional(ctx.str("cron")),
+    schedule: buildSchedule(ctx),
+    triggerType: "scheduled",
+    model,
+    reuseConversation: readReuseConversation(ctx),
+    status: enabled ? "active" : "paused"
+  };
+}
+function buildListPath(ctx) {
+  const params = new URLSearchParams();
+  const q = optional(ctx.str("q"));
+  const status = optional(ctx.str("status"));
+  const limit = optional(ctx.str("limit"));
+  if (q) params.set("q", q);
+  if (status) params.set("status", status);
+  if (limit) params.set("limit", String(ctx.num("limit")));
+  const query = params.toString();
+  return query ? `${BASE_PATH6}?${query}` : BASE_PATH6;
+}
+function validateList(ctx) {
+  const status = optional(ctx.str("status"));
+  if (status && !AUTOMATION_STATUSES.includes(status)) {
+    throw new Error("--status \u5FC5\u987B\u662F active \u6216 paused");
+  }
+  if (ctx.str("limit")) {
+    const limit = ctx.num("limit");
+    if (!Number.isInteger(limit) || limit < 1 || limit > 50) {
+      throw new Error("--limit \u5FC5\u987B\u662F 1-10000 \u7684\u6574\u6570");
+    }
+  }
+}
+function buildUpdateBody2(ctx) {
+  const enabled = readEnabledOptional(ctx);
+  const reuseConversation = readReuseConversationOptional(ctx);
+  const body = {};
+  const name = optional(ctx.str("name"));
+  const message = optional(ctx.str("message"));
+  const cron = optional(ctx.str("cron"));
+  const schedule = buildSchedule(ctx);
+  if (name) body.name = name;
+  if (message !== void 0) body.message = message;
+  if (enabled !== void 0) body.status = enabled ? "active" : "paused";
+  if (reuseConversation !== void 0)
+    body.reuseConversation = reuseConversation;
+  if (cron) body.cronExpression = cron;
+  if (schedule) body.schedule = schedule;
+  return body;
+}
+function validateUpdate(ctx) {
+  validateSchedule(ctx, false);
+  if (!Object.keys(buildUpdateBody2(ctx)).length) {
+    throw new Error("\u81F3\u5C11\u63D0\u4F9B\u4E00\u4E2A\u66F4\u65B0\u5B57\u6BB5");
+  }
+}
+var scheduleFlags = [
+  {
+    name: "cron",
+    type: "string",
+    required: false,
+    desc: "Cron expression for supported hourly/daily/weekly/monthly schedules"
+  },
+  {
+    name: "schedule-kind",
+    type: "string",
+    required: false,
+    desc: "hourly | daily | weekly | monthly"
+  },
+  {
+    name: "time",
+    type: "string",
+    required: false,
+    desc: "Time in HH:mm for daily/weekly/monthly"
+  },
+  {
+    name: "minute",
+    type: "number",
+    required: false,
+    desc: "Minute 0-59 for hourly schedules"
+  },
+  {
+    name: "weekday",
+    type: "number",
+    required: false,
+    desc: "Weekday 0-6 for weekly schedules; 0 is Sunday"
+  },
+  {
+    name: "day-of-month",
+    type: "number",
+    required: false,
+    desc: "Day 1-28 for monthly schedules"
+  }
+];
+var listAutomations = {
+  service: "agent",
+  command: "+list-automations",
+  description: "List current user's Agent automation tasks",
+  flags: [
+    {
+      name: "q",
+      type: "string",
+      required: false,
+      desc: "Keyword for automation name or instruction"
+    },
+    {
+      name: "status",
+      type: "string",
+      required: false,
+      desc: "active | paused"
+    },
+    {
+      name: "limit",
+      type: "number",
+      required: false,
+      desc: "Maximum number of automations to return, 1-10000"
+    }
+  ],
+  risk: "read",
+  validate: validateList,
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: buildListPath(ctx)
+  }),
+  execute: async (ctx) => getAgentApi(ctx, buildListPath(ctx))
+};
+var createAutomation = {
+  service: "agent",
+  command: "+create-automation",
+  description: "Create an Agent automation task",
+  flags: [
+    {
+      name: "name",
+      type: "string",
+      required: true,
+      desc: "Automation task name"
+    },
+    {
+      name: "message",
+      type: "string",
+      required: true,
+      desc: "Instruction sent to the Agent"
+    },
+    {
+      name: "agent-id",
+      type: "string",
+      required: false,
+      desc: "Agent ID; defaults to current conversation Agent"
+    },
+    {
+      name: "agent-name",
+      type: "string",
+      required: false,
+      desc: "Agent name; use only after +list-agents discovery"
+    },
+    {
+      name: "model",
+      type: "string",
+      required: false,
+      desc: "Model record ID; defaults to current selected model"
+    },
+    {
+      name: "enabled",
+      type: "boolean",
+      required: false,
+      desc: "Whether to enable the automation immediately; defaults to true"
+    },
+    {
+      name: "reuse-conversation",
+      type: "boolean",
+      required: false,
+      desc: "Continue future runs in the same conversation; defaults to false"
+    },
+    {
+      name: "conversation-id",
+      type: "string",
+      required: false,
+      desc: "Conversation ID fallback for resolving current Agent"
+    },
+    ...scheduleFlags
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    if (ctx.str("agentId") && ctx.str("agentName")) {
+      throw new Error("--agent-id \u4E0E --agent-name \u53EA\u80FD\u4E8C\u9009\u4E00");
+    }
+    validateSchedule(ctx, true);
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: BASE_PATH6,
+    body: buildCreateBody(ctx)
+  }),
+  execute: async (ctx) => postAgentApi(ctx, BASE_PATH6, buildCreateBody(ctx))
+};
+var updateAutomation = {
+  service: "agent",
+  command: "+update-automation",
+  description: "Update an Agent automation task",
+  flags: [
+    {
+      name: "id",
+      type: "string",
+      required: true,
+      desc: "Automation task ID from +list-automations"
+    },
+    {
+      name: "name",
+      type: "string",
+      required: false,
+      desc: "New automation task name"
+    },
+    {
+      name: "message",
+      type: "string",
+      required: false,
+      desc: "New instruction sent to the Agent"
+    },
+    {
+      name: "enabled",
+      type: "boolean",
+      required: false,
+      desc: "true to enable, false to pause"
+    },
+    {
+      name: "reuse-conversation",
+      type: "boolean",
+      required: false,
+      desc: "true to reuse one conversation, false to create one per run"
+    },
+    ...scheduleFlags
+  ],
+  risk: "write",
+  validate: validateUpdate,
+  dryRun: (ctx) => ({
+    method: "PATCH",
+    url: `${BASE_PATH6}/${encodeURIComponent(ctx.str("id"))}`,
+    body: buildUpdateBody2(ctx)
+  }),
+  execute: async (ctx) => patchAgentApi(
+    ctx,
+    `${BASE_PATH6}/${encodeURIComponent(ctx.str("id"))}`,
+    buildUpdateBody2(ctx)
+  )
+};
+
+// src/commands/te-agent/sandbox-tools.ts
+import {
+  accessSync,
+  closeSync,
+  constants,
+  existsSync as existsSync3,
+  lstatSync,
+  openSync,
+  readSync,
+  readdirSync,
+  realpathSync
+} from "fs";
+import { isAbsolute, join, relative, resolve as resolve3 } from "path";
+var SANDBOX_BIN_DIR = "/home/ta/.local/bin";
+var SANDBOX_SHARE_ROOT = process.env.SANDBOX_SYSTEM_SHARE_ROOT ?? "/data/app/te_agent_ta/share";
+var SHIM_MARKER = "managed-by: te-agent-sandbox-tools";
+var MAX_SHIM_BYTES = 16 * 1024;
+var NAME_RE = /^[a-z][a-z0-9._-]{0,63}$/;
+function hasControlCharacters(value) {
+  return /[\x00-\x1f\x7f]/.test(value);
+}
+function readShimHeader(filePath, size) {
+  const buffer = Buffer.alloc(Math.min(size, MAX_SHIM_BYTES));
+  const fd = openSync(filePath, "r");
+  try {
+    const bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
+    return buffer.toString("utf8", 0, bytesRead);
+  } finally {
+    closeSync(fd);
+  }
+}
+function parseShim(filePath) {
+  const fallback = {
+    managed: false,
+    tool: "",
+    version: "unknown",
+    command: "",
+    target: ""
+  };
+  try {
+    const stat = lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) return fallback;
+    const lines = readShimHeader(filePath, stat.size).split("\n").slice(0, 10);
+    const managed = lines.includes(`# ${SHIM_MARKER}`);
+    if (!managed) return fallback;
+    if (stat.size > MAX_SHIM_BYTES) {
+      return { ...fallback, managed: true, reason: "shim exceeds size limit" };
+    }
+    const values = /* @__PURE__ */ new Map();
+    for (const line of lines) {
+      if (line === `# ${SHIM_MARKER}`) continue;
+      const match = /^# (tool|version|command|target|runtime): (.*)$/.exec(
+        line
+      );
+      if (!match) continue;
+      if (values.has(match[1])) {
+        return { ...fallback, managed, reason: `duplicate ${match[1]} marker` };
+      }
+      values.set(match[1], match[2].trim());
+    }
+    const tool = values.get("tool") ?? "";
+    const version = values.get("version") || "unknown";
+    const command = values.get("command") ?? "";
+    const target = values.get("target") ?? "";
+    const runtimeValue = values.get("runtime");
+    const runtime = runtimeValue === "node" || runtimeValue === "native" ? runtimeValue : void 0;
+    if (!NAME_RE.test(tool) || !NAME_RE.test(command)) {
+      return {
+        ...fallback,
+        managed: true,
+        reason: "invalid tool or command marker"
+      };
+    }
+    if (version.length > 64 || hasControlCharacters(version) || hasControlCharacters(target) || !isAbsolute(target)) {
+      return {
+        ...fallback,
+        managed: true,
+        tool,
+        command,
+        reason: "invalid version or target marker"
+      };
+    }
+    if (runtimeValue && !runtime) {
+      return {
+        ...fallback,
+        managed: true,
+        tool,
+        version,
+        command,
+        target,
+        reason: "invalid runtime marker"
+      };
+    }
+    return { managed: true, tool, version, command, target, runtime };
+  } catch {
+    return fallback;
+  }
+}
+function isInsideOrEqual(candidate, root) {
+  const rel = relative(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function classifyShim(parsed, toolsRoot) {
+  if (parsed.reason) return { status: "broken", reason: parsed.reason };
+  if (!parsed.target)
+    return { status: "broken", reason: "shim missing target marker" };
+  let realRoot;
+  try {
+    realRoot = realpathSync(resolve3(toolsRoot));
+  } catch {
+    return { status: "broken", reason: "tools root missing" };
+  }
+  let realTarget;
+  try {
+    realTarget = realpathSync(parsed.target);
+  } catch {
+    return { status: "broken", reason: "target missing" };
+  }
+  if (!isInsideOrEqual(realTarget, realRoot)) {
+    return { status: "broken", reason: "target outside tools root" };
+  }
+  try {
+    if (!lstatSync(realTarget).isFile()) {
+      return { status: "broken", reason: "target not a file" };
+    }
+    accessSync(
+      realTarget,
+      parsed.runtime === "native" ? constants.X_OK : constants.R_OK
+    );
+  } catch {
+    return {
+      status: "broken",
+      reason: parsed.runtime === "native" ? "target not executable" : "target not readable"
+    };
+  }
+  return { status: "active" };
+}
+function scanSandboxTools(options = {}) {
+  const binDir = options.binDir ?? SANDBOX_BIN_DIR;
+  const toolsRoot = options.toolsRoot ?? join(SANDBOX_SHARE_ROOT, "tools");
+  if (!existsSync3(binDir)) {
+    return { tools: [], summary: { total: 0, active: 0, broken: 0 } };
+  }
+  const all = [];
+  for (const name of readdirSync(binDir).sort()) {
+    const filePath = join(binDir, name);
+    const parsed = parseShim(filePath);
+    if (!parsed.managed) continue;
+    const { status, reason } = classifyShim(parsed, toolsRoot);
+    all.push({
+      tool: parsed.tool || "unknown",
+      version: parsed.version || "unknown",
+      command: parsed.command || name,
+      runtime: parsed.runtime ?? "unknown",
+      target: parsed.target,
+      status,
+      reason
+    });
+  }
+  const active = all.filter((entry) => entry.status === "active").length;
+  const broken = all.filter((entry) => entry.status === "broken").length;
+  const tools = options.status ? all.filter((entry) => entry.status === options.status) : all;
+  return { tools, summary: { total: all.length, active, broken } };
+}
+var listSandboxTools = {
+  service: "agent",
+  command: "+list-sandbox-tools",
+  description: "List managed tools in the current sandbox and verify their targets and permissions",
+  flags: [
+    {
+      name: "status",
+      type: "string",
+      required: false,
+      desc: "Filter by status: active | broken"
+    }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    const status = ctx.str("status");
+    if (status && !["active", "broken"].includes(status)) {
+      throw new Error("--status must be active or broken");
+    }
+  },
+  dryRun: () => ({
+    method: "LOCAL_SCAN",
+    url: SANDBOX_BIN_DIR,
+    body: { marker: SHIM_MARKER, toolsRoot: join(SANDBOX_SHARE_ROOT, "tools") }
+  }),
+  execute: async (ctx) => scanSandboxTools({ status: ctx.str("status") })
+};
+
+// src/commands/te-agent/conversations.ts
+var CONVERSATION_PATH = "/api/sandbox/agent/conversations";
+var ARCHIVE_SEARCH_PATH = `${CONVERSATION_PATH}/archived`;
+var DEFAULT_LIMIT = 20;
+var DEFAULT_TIME_ZONE = "Asia/Shanghai";
+function optional2(value) {
+  const trimmed = value.trim();
+  return trimmed ? trimmed : void 0;
+}
+function envOptional2(name) {
+  return optional2(process.env[name] ?? "");
+}
+function readAll(ctx) {
+  return ctx.str("all") === "true";
+}
+function readTimeZone(ctx) {
+  return optional2(ctx.str("timeZone")) ?? DEFAULT_TIME_ZONE;
+}
+function isValidTimeZone(timeZone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone }).format();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function formatTimestampInTimeZone(timestamp, timeZone) {
+  const parts = new Intl.DateTimeFormat("en-CA", {
+    timeZone,
+    calendar: "gregory",
+    numberingSystem: "latn",
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hourCycle: "h23"
+  }).formatToParts(new Date(timestamp));
+  const values = Object.fromEntries(
+    parts.map(({ type, value }) => [type, value])
+  );
+  return `${values.year}-${values.month}-${values.day} ${values.hour}:${values.minute}:${values.second}`;
+}
+function validateFind(ctx) {
+  const rawAll = ctx.str("all");
+  if (rawAll && rawAll !== "true" && rawAll !== "false") return;
+  const agentId = optional2(ctx.str("agentId"));
+  const all = readAll(ctx);
+  if (agentId && all) {
+    throw new Error("--agent-id and --all true cannot be used together");
+  }
+  if (!agentId && !all && !envOptional2("TE_AGENT_CURRENT_AGENT_ID")) {
+    throw new Error(
+      "Archive scope is required. Provide --agent-id or --all true, or run inside an Agent sandbox."
+    );
+  }
+  const limit = optional2(ctx.str("limit")) ? ctx.num("limit") : DEFAULT_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+    throw new Error("--limit must be an integer between 1 and 100");
+  }
+  if (!isValidTimeZone(readTimeZone(ctx))) {
+    throw new Error("--time-zone must be a valid IANA time zone");
+  }
+}
+function buildArchivedConversationSearchPath(ctx) {
+  const params = new URLSearchParams();
+  const q = optional2(ctx.str("q"));
+  const explicitAgentId = optional2(ctx.str("agentId"));
+  const all = readAll(ctx);
+  const agentId = explicitAgentId ?? envOptional2("TE_AGENT_CURRENT_AGENT_ID");
+  const limit = optional2(ctx.str("limit")) ? ctx.num("limit") : DEFAULT_LIMIT;
+  if (q) params.set("q", q);
+  if (all) params.set("all", "true");
+  else if (agentId) params.set("agentId", agentId);
+  params.set("limit", String(limit));
+  return `${ARCHIVE_SEARCH_PATH}?${params.toString()}`;
+}
+function toArchivedConversationOutput(item, timeZone) {
+  return {
+    conversation_id: item.id,
+    title: item.title,
+    last_preview: item.lastPreview,
+    archived_at: item.archivedAt,
+    archived_at_local: formatTimestampInTimeZone(item.archivedAt, timeZone),
+    updated_at: item.updatedAt,
+    updated_at_local: formatTimestampInTimeZone(item.updatedAt, timeZone),
+    time_zone: timeZone,
+    agent: item.agent ? {
+      agent_id: item.agent.id,
+      name: item.agent.name,
+      avatar_url: item.agent.avatarUrl,
+      scope: item.agent.scope
+    } : null
+  };
+}
+var findArchivedConversations = {
+  service: "agent",
+  command: "+find-archived-conversations",
+  description: "Find archived conversations for one Agent or all Agents",
+  flags: [
+    {
+      name: "q",
+      type: "string",
+      required: false,
+      desc: "Optional keyword matched against conversation titles and message previews"
+    },
+    {
+      name: "agent-id",
+      type: "string",
+      required: false,
+      desc: "Agent ID; defaults to TE_AGENT_CURRENT_AGENT_ID inside an Agent sandbox"
+    },
+    {
+      name: "all",
+      type: "boolean",
+      required: false,
+      desc: "Set true to search archived conversations across all Agents"
+    },
+    {
+      name: "limit",
+      type: "number",
+      required: false,
+      default: DEFAULT_LIMIT,
+      min: 1,
+      max: 100,
+      desc: "Maximum number of archived conversations to return, 1-100; default 20"
+    },
+    {
+      name: "time-zone",
+      type: "string",
+      required: false,
+      default: DEFAULT_TIME_ZONE,
+      desc: "IANA time zone used for local timestamp fields; default Asia/Shanghai"
+    }
+  ],
+  risk: "read",
+  validate: validateFind,
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: buildArchivedConversationSearchPath(ctx)
+  }),
+  execute: async (ctx) => {
+    const timeZone = readTimeZone(ctx);
+    const result = await getAgentApi(
+      ctx,
+      buildArchivedConversationSearchPath(ctx)
+    );
+    return {
+      items: result.items.map(
+        (item) => toArchivedConversationOutput(item, timeZone)
+      ),
+      has_more: result.hasMore
+    };
+  }
+};
+var restoreConversation = {
+  service: "agent",
+  command: "+restore-conversation",
+  description: "Restore an archived conversation by conversation ID",
+  flags: [
+    {
+      name: "conversation-id",
+      type: "string",
+      required: true,
+      desc: "Conversation ID returned by +find-archived-conversations"
+    }
+  ],
+  risk: "write",
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: `${CONVERSATION_PATH}/${encodeURIComponent(ctx.str("conversationId"))}/restore`,
+    body: {}
+  }),
+  execute: async (ctx) => {
+    const result = await postAgentApi(
+      ctx,
+      `${CONVERSATION_PATH}/${encodeURIComponent(ctx.str("conversationId"))}/restore`,
+      {}
+    );
+    return { changed: result.changed, conversation_id: result.conversationId };
+  }
+};
+
+// src/commands/te-agent/approval-cli-client.ts
+var APPROVAL_GATEWAY_DOMAIN = "approval";
+var DEFAULT_TE_CLAUDE_BASE_PATH = "/agent";
+function normalizeBasePath(value) {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed === "/") return "";
+  return `/${trimmed.replace(/^\/+|\/+$/g, "")}`;
+}
+function resolveApprovalApiBaseUrl(host) {
+  const base = host.replace(/\/+$/, "");
+  const basePath = normalizeBasePath(
+    process.env.TE_CLAUDE_BASE_PATH ?? process.env.AE_API_PREFIX ?? DEFAULT_TE_CLAUDE_BASE_PATH
+  );
+  return basePath && !base.endsWith(basePath) ? `${base}${basePath}` : base;
+}
+function buildApprovalCliUrl(ctx, path) {
+  return buildCapabilityGatewayUrl(resolveApprovalApiBaseUrl(ctx.host()), APPROVAL_GATEWAY_DOMAIN, path);
+}
+function requestApprovalCli(ctx, method, path, body, options = {}) {
+  return callCapabilityApi(
+    ctx.host(),
+    APPROVAL_GATEWAY_DOMAIN,
+    path,
+    method,
+    body,
+    {
+      apiBaseUrl: resolveApprovalApiBaseUrl(ctx.host()),
+      ...options,
+      retryOnInvalidTokenForbidden: false
+    }
+  );
+}
+function getApprovalCli(ctx, path) {
+  return requestApprovalCli(ctx, "GET", path);
+}
+function postApprovalCli(ctx, path, body, options = {}) {
+  return requestApprovalCli(ctx, "POST", path, body, options);
+}
+
+// src/commands/te-agent/approval-commands.ts
+var SERVICE = "agent";
+var MAX_ID_LENGTH = 191;
+var MAX_VERSION = 2147483647;
+var DECISION_STATUSES = ["pending", "approved", "rejected", "cancelled"];
+var TASK_STATUSES = ["pending", "completed", "cancelled"];
+var EFFECT_STATUSES = ["pending", "running", "succeeded", "failed", "manual_required"];
+var LOCAL_DRY_RUN_HELP = [
+  "Dry-run is a local request preview only.",
+  "It does not verify server permissions, current approval state, or future conditional routing."
+].join(" ");
+function validation(message, hint) {
+  throw new CliValidationError(message, { hint });
+}
+function optionalString(ctx, name) {
+  const value = ctx.str(name);
+  return value ? value : void 0;
+}
+function validateStableId(ctx, name, flagName) {
+  const value = ctx.str(name);
+  if (!value || value !== value.trim() || value.length > MAX_ID_LENGTH) {
+    validation(`--${flagName} must be a non-empty identifier of at most ${MAX_ID_LENGTH} characters`);
+  }
+}
+function validateApprovalTypeId(ctx) {
+  const value = ctx.str("approvalTypeId");
+  if (!value || value.length > MAX_ID_LENGTH || !/^[a-z][a-z0-9_.-]*@[1-9]\d*$/.test(value)) {
+    validation("--approval-type-id must use the format type.key@version");
+  }
+  const version = value.slice(value.lastIndexOf("@") + 1);
+  if (BigInt(version) > BigInt(MAX_VERSION)) {
+    validation("--approval-type-id version is out of range");
+  }
+}
+function validateClientRequestId(ctx) {
+  validateStableId(ctx, "clientRequestId", "client-request-id");
+  if (ctx.str("clientRequestId").startsWith("system:")) {
+    validation("--client-request-id must not use the reserved system: prefix");
+  }
+}
+function validateText(ctx, name, flagName, options) {
+  const value = ctx.str(name);
+  if (!value && !options.required) return;
+  if (!value || value.trim().length === 0) {
+    validation(`--${flagName} must not be empty`);
+  }
+  if (value.length > options.maxLength) {
+    validation(`--${flagName} must not exceed ${options.maxLength} characters`);
+  }
+}
+function validateNonNegativeInteger(ctx, name, flagName) {
+  const value = ctx.optionalNum(name);
+  if (value === void 0 || !Number.isInteger(value) || value < 0 || value > MAX_VERSION) {
+    validation(`--${flagName} must be an integer between 0 and ${MAX_VERSION}`);
+  }
+}
+function validateExpectedVersion(ctx) {
+  validateNonNegativeInteger(ctx, "expectedVersion", "expected-version");
+}
+function validateExpectedAttempt(ctx) {
+  validateNonNegativeInteger(ctx, "expectedAttempt", "expected-attempt");
+}
+function assertAllowed(value, flagName, allowed) {
+  if (value && !allowed.includes(value)) {
+    validation(`--${flagName} must be one of: ${allowed.join(", ")}`);
+  }
+}
+function validateDateRange(ctx) {
+  const createdAfter = optionalString(ctx, "createdAfter");
+  const createdBefore = optionalString(ctx, "createdBefore");
+  if (createdAfter && Number.isNaN(Date.parse(createdAfter))) {
+    validation("--created-after must be a valid ISO datetime");
+  }
+  if (createdBefore && Number.isNaN(Date.parse(createdBefore))) {
+    validation("--created-before must be a valid ISO datetime");
+  }
+  if (createdAfter && createdBefore && Date.parse(createdAfter) >= Date.parse(createdBefore)) {
+    validation("--created-after must be earlier than --created-before");
+  }
+}
+function validateLimit(ctx) {
+  const limit = ctx.optionalNum("limit") ?? 20;
+  if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+    validation("--limit must be an integer between 1 and 100");
+  }
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateSnakeCaseValue(value, path = "payload") {
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => validateSnakeCaseValue(item, `${path}[${index}]`));
+    return;
+  }
+  if (!isRecord(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    if (!/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/.test(key)) {
+      validation(`--payload keys must use snake_case (invalid key at ${path})`);
+    }
+    validateSnakeCaseValue(child, `${path}.${key}`);
+  }
+}
+function approvalPayload(ctx) {
+  const payload = ctx.json("payload");
+  if (!isRecord(payload)) {
+    validation("--payload must be a JSON object");
+  }
+  validateSnakeCaseValue(payload);
+  return payload;
+}
+function buildQuery2(params) {
+  const searchParams = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "") searchParams.set(key, String(value));
+  }
+  const query = searchParams.toString();
+  return query ? `?${query}` : "";
+}
+function requestListPath(ctx) {
+  return `requests${buildQuery2({
+    cursor: optionalString(ctx, "cursor"),
+    limit: ctx.optionalNum("limit") ?? 20,
+    type_id: optionalString(ctx, "approvalTypeId"),
+    status: optionalString(ctx, "status"),
+    requester_id: optionalString(ctx, "requesterId"),
+    created_after: optionalString(ctx, "createdAfter"),
+    created_before: optionalString(ctx, "createdBefore")
+  })}`;
+}
+function taskListPath(ctx) {
+  return `tasks${buildQuery2({
+    cursor: optionalString(ctx, "cursor"),
+    limit: ctx.optionalNum("limit") ?? 20,
+    status: optionalString(ctx, "status"),
+    request_id: optionalString(ctx, "approvalRequestId"),
+    created_after: optionalString(ctx, "createdAfter"),
+    created_before: optionalString(ctx, "createdBefore")
+  })}`;
+}
+function effectListPath(ctx) {
+  return `effects${buildQuery2({
+    cursor: optionalString(ctx, "cursor"),
+    limit: ctx.optionalNum("limit") ?? 20,
+    status: optionalString(ctx, "status"),
+    request_id: optionalString(ctx, "approvalRequestId"),
+    created_after: optionalString(ctx, "createdAfter"),
+    created_before: optionalString(ctx, "createdBefore")
+  })}`;
+}
+function submitBody(ctx) {
+  return {
+    type_id: ctx.str("approvalTypeId"),
+    resource_id: ctx.str("resourceId"),
+    reason: ctx.str("reason"),
+    payload: approvalPayload(ctx),
+    client_request_id: ctx.str("clientRequestId")
+  };
+}
+function cancelBody(ctx) {
+  return {
+    expected_version: ctx.num("expectedVersion"),
+    ...optionalString(ctx, "reason") ? { reason: ctx.str("reason") } : {},
+    client_request_id: ctx.str("clientRequestId")
+  };
+}
+function approveBody(ctx) {
+  return {
+    expected_version: ctx.num("expectedVersion"),
+    ...optionalString(ctx, "note") ? { note: ctx.str("note") } : {},
+    client_request_id: ctx.str("clientRequestId")
+  };
+}
+function rejectBody(ctx) {
+  return {
+    expected_version: ctx.num("expectedVersion"),
+    reason: ctx.str("reason"),
+    client_request_id: ctx.str("clientRequestId")
+  };
+}
+function retryEffectBody(ctx) {
+  return {
+    expected_version: ctx.num("expectedVersion"),
+    expected_attempt: ctx.num("expectedAttempt"),
+    reason: ctx.str("reason"),
+    confirm_risk: true,
+    client_request_id: ctx.str("clientRequestId")
+  };
+}
+var approvalTypeIdFlag = {
+  name: "approval-type-id",
+  type: "string",
+  required: true,
+  maxLength: MAX_ID_LENGTH,
+  desc: "Versioned approval type ID, for example skill.publish@1"
+};
+var approvalRequestIdFlag = {
+  name: "approval-request-id",
+  type: "string",
+  required: true,
+  maxLength: MAX_ID_LENGTH,
+  desc: "Approval request ID"
+};
+var taskIdFlag = {
+  name: "task-id",
+  type: "string",
+  required: true,
+  maxLength: MAX_ID_LENGTH,
+  desc: "Approval task ID"
+};
+var effectIdFlag = {
+  name: "effect-id",
+  type: "string",
+  required: true,
+  maxLength: MAX_ID_LENGTH,
+  desc: "Approval Effect ID"
+};
+var clientRequestIdFlag = {
+  name: "client-request-id",
+  type: "string",
+  required: true,
+  maxLength: MAX_ID_LENGTH,
+  desc: "Caller-generated idempotency key"
+};
+var expectedVersionFlag = {
+  name: "expected-version",
+  type: "number",
+  required: true,
+  min: 0,
+  max: MAX_VERSION,
+  desc: "Expected optimistic version from the latest request, task, or Effect read"
+};
+var expectedAttemptFlag = {
+  name: "expected-attempt",
+  type: "number",
+  required: true,
+  min: 0,
+  max: MAX_VERSION,
+  desc: "Expected Effect attempt from the latest Effect read"
+};
+var pageFlags = [
+  { name: "cursor", type: "string", required: false, maxLength: 1024, desc: "Opaque cursor from the previous page" },
+  { name: "limit", type: "number", required: false, default: 20, min: 1, max: 100, desc: "Page size from 1 to 100" },
+  { name: "created-after", type: "string", required: false, desc: "Include records created at or after this ISO datetime" },
+  { name: "created-before", type: "string", required: false, desc: "Include records created before this ISO datetime" }
+];
+var listApprovalTypes = {
+  service: SERVICE,
+  resource: "approval-type",
+  command: "list",
+  description: "List registered versioned approval types and their input contracts",
+  flags: [],
+  risk: "read",
+  dryRun: (ctx) => ({ method: "GET", url: buildApprovalCliUrl(ctx, "types") }),
+  execute: (ctx) => getApprovalCli(ctx, "types")
+};
+var getApprovalType = {
+  service: SERVICE,
+  resource: "approval-type",
+  command: "get",
+  description: "Get one versioned approval type and its input contract",
+  flags: [approvalTypeIdFlag],
+  risk: "read",
+  validate: validateApprovalTypeId,
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: buildApprovalCliUrl(ctx, `types/${encodeURIComponent(ctx.str("approvalTypeId"))}`)
+  }),
+  execute: (ctx) => getApprovalCli(ctx, `types/${encodeURIComponent(ctx.str("approvalTypeId"))}`)
+};
+var listApprovalRequests = {
+  service: SERVICE,
+  resource: "approval-request",
+  command: "list",
+  description: "List approval requests visible to the current user",
+  flags: [
+    ...pageFlags,
+    { name: "approval-type-id", type: "string", required: false, maxLength: MAX_ID_LENGTH, desc: "Filter by versioned approval type ID" },
+    { name: "status", type: "string", required: false, desc: `Filter by decision status: ${DECISION_STATUSES.join(" | ")}` },
+    { name: "requester-id", type: "string", required: false, maxLength: MAX_ID_LENGTH, desc: "Filter by requester user ID when authorized" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    validateLimit(ctx);
+    validateDateRange(ctx);
+    assertAllowed(optionalString(ctx, "status"), "status", DECISION_STATUSES);
+    if (optionalString(ctx, "approvalTypeId")) validateApprovalTypeId(ctx);
+    if (optionalString(ctx, "requesterId")) validateStableId(ctx, "requesterId", "requester-id");
+  },
+  dryRun: (ctx) => ({ method: "GET", url: buildApprovalCliUrl(ctx, requestListPath(ctx)) }),
+  execute: (ctx) => getApprovalCli(ctx, requestListPath(ctx))
+};
+var getApprovalRequest = {
+  service: SERVICE,
+  resource: "approval-request",
+  command: "get",
+  description: "Get one approval request by approval request ID",
+  flags: [approvalRequestIdFlag],
+  risk: "read",
+  validate: (ctx) => validateStableId(ctx, "approvalRequestId", "approval-request-id"),
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: buildApprovalCliUrl(ctx, `requests/${encodeURIComponent(ctx.str("approvalRequestId"))}`)
+  }),
+  execute: (ctx) => getApprovalCli(ctx, `requests/${encodeURIComponent(ctx.str("approvalRequestId"))}`)
+};
+var submitApprovalRequest = {
+  service: SERVICE,
+  resource: "approval-request",
+  command: "submit",
+  description: "Submit a resource snapshot to a versioned approval type",
+  helpText: LOCAL_DRY_RUN_HELP,
+  flags: [
+    approvalTypeIdFlag,
+    { name: "resource-id", type: "string", required: true, maxLength: MAX_ID_LENGTH, desc: "Business resource ID resolved by the selected approval type" },
+    { name: "reason", type: "string", required: true, maxLength: 2e3, desc: "Submission reason" },
+    { name: "payload", type: "json", required: true, desc: "Type-specific snake_case JSON object from approval-type get" },
+    clientRequestIdFlag
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    validateApprovalTypeId(ctx);
+    validateStableId(ctx, "resourceId", "resource-id");
+    validateText(ctx, "reason", "reason", { required: true, maxLength: 2e3 });
+    validateClientRequestId(ctx);
+    approvalPayload(ctx);
+  },
+  dryRun: (ctx) => ({ method: "POST", url: buildApprovalCliUrl(ctx, "requests"), body: submitBody(ctx) }),
+  execute: (ctx) => postApprovalCli(ctx, "requests", submitBody(ctx))
+};
+var cancelApprovalRequest = {
+  service: SERVICE,
+  resource: "approval-request",
+  command: "cancel",
+  description: "Cancel a pending approval request with optimistic concurrency control",
+  helpText: LOCAL_DRY_RUN_HELP,
+  flags: [
+    approvalRequestIdFlag,
+    expectedVersionFlag,
+    { name: "reason", type: "string", required: false, maxLength: 2e3, desc: "Optional cancellation reason; required when cancelling another user request" },
+    clientRequestIdFlag
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    validateStableId(ctx, "approvalRequestId", "approval-request-id");
+    validateExpectedVersion(ctx);
+    validateText(ctx, "reason", "reason", { required: false, maxLength: 2e3 });
+    validateClientRequestId(ctx);
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: buildApprovalCliUrl(ctx, `requests/${encodeURIComponent(ctx.str("approvalRequestId"))}/cancel`),
+    body: cancelBody(ctx)
+  }),
+  execute: (ctx) => postApprovalCli(
+    ctx,
+    `requests/${encodeURIComponent(ctx.str("approvalRequestId"))}/cancel`,
+    cancelBody(ctx)
+  )
+};
+var listApprovalTasks = {
+  service: SERVICE,
+  resource: "approval-task",
+  command: "list",
+  description: "List approval tasks currently visible to the current approver",
+  flags: [
+    ...pageFlags,
+    { name: "status", type: "string", required: false, desc: `Filter by task status: ${TASK_STATUSES.join(" | ")}` },
+    { name: "approval-request-id", type: "string", required: false, maxLength: MAX_ID_LENGTH, desc: "Filter by approval request ID" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    validateLimit(ctx);
+    validateDateRange(ctx);
+    assertAllowed(optionalString(ctx, "status"), "status", TASK_STATUSES);
+    if (optionalString(ctx, "approvalRequestId")) {
+      validateStableId(ctx, "approvalRequestId", "approval-request-id");
+    }
+  },
+  dryRun: (ctx) => ({ method: "GET", url: buildApprovalCliUrl(ctx, taskListPath(ctx)) }),
+  execute: (ctx) => getApprovalCli(ctx, taskListPath(ctx))
+};
+var getApprovalTask = {
+  service: SERVICE,
+  resource: "approval-task",
+  command: "get",
+  description: "Get one approval task by task ID",
+  flags: [taskIdFlag],
+  risk: "read",
+  validate: (ctx) => validateStableId(ctx, "taskId", "task-id"),
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: buildApprovalCliUrl(ctx, `tasks/${encodeURIComponent(ctx.str("taskId"))}`)
+  }),
+  execute: (ctx) => getApprovalCli(ctx, `tasks/${encodeURIComponent(ctx.str("taskId"))}`)
+};
+var approveApprovalTask = {
+  service: SERVICE,
+  resource: "approval-task",
+  command: "approve",
+  description: "Approve a pending approval task with optimistic concurrency control",
+  helpText: LOCAL_DRY_RUN_HELP,
+  flags: [
+    taskIdFlag,
+    expectedVersionFlag,
+    { name: "note", type: "string", required: false, maxLength: 2e3, desc: "Optional approval note" },
+    clientRequestIdFlag
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    validateStableId(ctx, "taskId", "task-id");
+    validateExpectedVersion(ctx);
+    validateText(ctx, "note", "note", { required: false, maxLength: 2e3 });
+    validateClientRequestId(ctx);
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: buildApprovalCliUrl(ctx, `tasks/${encodeURIComponent(ctx.str("taskId"))}/approve`),
+    body: approveBody(ctx)
+  }),
+  execute: (ctx) => postApprovalCli(
+    ctx,
+    `tasks/${encodeURIComponent(ctx.str("taskId"))}/approve`,
+    approveBody(ctx)
+  )
+};
+var rejectApprovalTask = {
+  service: SERVICE,
+  resource: "approval-task",
+  command: "reject",
+  description: "Reject a pending approval task with a required reason",
+  helpText: LOCAL_DRY_RUN_HELP,
+  flags: [
+    taskIdFlag,
+    expectedVersionFlag,
+    { name: "reason", type: "string", required: true, maxLength: 2e3, desc: "Rejection reason" },
+    clientRequestIdFlag
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    validateStableId(ctx, "taskId", "task-id");
+    validateExpectedVersion(ctx);
+    validateText(ctx, "reason", "reason", { required: true, maxLength: 2e3 });
+    validateClientRequestId(ctx);
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: buildApprovalCliUrl(ctx, `tasks/${encodeURIComponent(ctx.str("taskId"))}/reject`),
+    body: rejectBody(ctx)
+  }),
+  execute: (ctx) => postApprovalCli(
+    ctx,
+    `tasks/${encodeURIComponent(ctx.str("taskId"))}/reject`,
+    rejectBody(ctx)
+  )
+};
+var listApprovalEffects = {
+  service: SERVICE,
+  resource: "approval-effect",
+  command: "list",
+  description: "List approval Effects visible to the current company administrator",
+  flags: [
+    ...pageFlags,
+    { name: "status", type: "string", required: false, desc: `Filter by Effect status: ${EFFECT_STATUSES.join(" | ")}` },
+    { name: "approval-request-id", type: "string", required: false, maxLength: MAX_ID_LENGTH, desc: "Filter by approval request ID" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    validateLimit(ctx);
+    validateDateRange(ctx);
+    assertAllowed(optionalString(ctx, "status"), "status", EFFECT_STATUSES);
+    if (optionalString(ctx, "approvalRequestId")) {
+      validateStableId(ctx, "approvalRequestId", "approval-request-id");
+    }
+  },
+  dryRun: (ctx) => ({ method: "GET", url: buildApprovalCliUrl(ctx, effectListPath(ctx)) }),
+  execute: (ctx) => getApprovalCli(ctx, effectListPath(ctx))
+};
+var getApprovalEffect = {
+  service: SERVICE,
+  resource: "approval-effect",
+  command: "get",
+  description: "Get one approval Effect by Effect ID",
+  flags: [effectIdFlag],
+  risk: "read",
+  validate: (ctx) => validateStableId(ctx, "effectId", "effect-id"),
+  dryRun: (ctx) => ({
+    method: "GET",
+    url: buildApprovalCliUrl(ctx, `effects/${encodeURIComponent(ctx.str("effectId"))}`)
+  }),
+  execute: (ctx) => getApprovalCli(ctx, `effects/${encodeURIComponent(ctx.str("effectId"))}`)
+};
+var retryApprovalEffect = {
+  service: SERVICE,
+  resource: "approval-effect",
+  command: "retry",
+  description: "Manually retry a failed or manual-required approval Effect",
+  helpText: `${LOCAL_DRY_RUN_HELP} Actual execution requires confirmation; pass global --yes only after explicit user authorization.`,
+  flags: [
+    effectIdFlag,
+    expectedVersionFlag,
+    expectedAttemptFlag,
+    { name: "reason", type: "string", required: true, maxLength: 2e3, desc: "Auditable manual retry reason" },
+    clientRequestIdFlag
+  ],
+  risk: "high-risk-write",
+  validate: (ctx) => {
+    validateStableId(ctx, "effectId", "effect-id");
+    validateExpectedVersion(ctx);
+    validateExpectedAttempt(ctx);
+    validateText(ctx, "reason", "reason", { required: true, maxLength: 2e3 });
+    validateClientRequestId(ctx);
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: buildApprovalCliUrl(ctx, `effects/${encodeURIComponent(ctx.str("effectId"))}/retry`),
+    body: retryEffectBody(ctx)
+  }),
+  execute: (ctx) => postApprovalCli(
+    ctx,
+    `effects/${encodeURIComponent(ctx.str("effectId"))}/retry`,
+    retryEffectBody(ctx)
+  )
+};
+
+// src/commands/te-agent/index.ts
+var commands = [
+  // Agent CRUD
+  listAgents,
+  createAgent,
+  updateAgent,
+  delAgent,
+  getAgent,
+  // Model management + test
+  listModels,
+  addModel,
+  delModel,
+  toggleModel,
+  updateModel,
+  testModel,
+  // MCP server management + market + OAuth + credentials
+  listMcps,
+  addMcp,
+  delMcp,
+  toggleMcp,
+  listMcpMarket,
+  setMcpMeta,
+  updateMcp,
+  mcpTools,
+  mcpAuthStart,
+  mcpAuthStatus,
+  mcpAuthDisconnect,
+  listMcpCredentials,
+  setMcpCredential,
+  autoProvisionMcpCredentials,
+  mcpToken,
+  mcpStats,
+  // Skill management + market + copy
+  listSkills,
+  addSkill,
+  delSkill,
+  toggleSkill,
+  listSkillMarket,
+  setSkillMeta,
+  copySkill,
+  // Skill content + assets (references / assets / scripts)
+  editSkill,
+  getSkillContent,
+  listSkillAssets,
+  uploadSkillAsset,
+  readSkillAsset,
+  delSkillAsset,
+  listSkillReferences,
+  uploadSkillReference,
+  readSkillReference,
+  delSkillReference,
+  listSkillScripts,
+  uploadSkillScript,
+  readSkillScript,
+  delSkillScript,
+  uploadSkill,
+  rescanSkills,
+  // Skill approval (company-scope publish)
+  submitSkill,
+  listSkillSubmissions,
+  cancelSkillSubmission,
+  approveSkill,
+  rejectSkill,
+  // Generic versioned approval workflow
+  listApprovalTypes,
+  getApprovalType,
+  listApprovalRequests,
+  getApprovalRequest,
+  submitApprovalRequest,
+  cancelApprovalRequest,
+  listApprovalTasks,
+  getApprovalTask,
+  approveApprovalTask,
+  rejectApprovalTask,
+  listApprovalEffects,
+  getApprovalEffect,
+  retryApprovalEffect,
+  // Skill share (peer-to-peer)
+  shareSkill,
+  listSkillShares,
+  acceptSkillShare,
+  rejectSkillShare,
+  // Attachment library management
+  listAttachments,
+  addAttachment,
+  delAttachment,
+  attachmentStats,
+  // Automate tasks
+  listAutomations,
+  createAutomation,
+  updateAutomation,
+  // Archived conversations
+  findArchivedConversations,
+  restoreConversation,
+  // Sandbox tools (local scan of /home/ta/.local/bin managed shims)
+  listSandboxTools
+];
+var te_agent_default = commands;
+export {
+  te_agent_default as default
+};