@thinkingai/ae-cli 6.1.14 → 6.1.16

package/dist/{te-analysis-FCHRTNIY.js → te-analysis-O6DCO6BS.js}

@@ -6,17 +6,17 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-UIHQJK5E.js";
+} from "./chunk-YA6SMTXG.js";
 import {
   createCapabilityCommand
-} from "./chunk-753BUTNZ.js";
+} from "./chunk-VR3LCBHW.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-PTE56QPL.js";
 import {
   withOutputMetadata
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -27,16 +27,17 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-5XUSIK27.js";
+} from "./chunk-ILIU36SU.js";
+import "./chunk-6EIJSNBD.js";
 import {
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
-import "./chunk-3FY3RJ26.js";
+} from "./chunk-4SGZG4XY.js";
+import "./chunk-ZZUOD757.js";
 import {
   CliValidationError
-} from "./chunk-AXDXJTPC.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -2774,7 +2775,7 @@ var dashboardGet = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "get",
   capabilityId: "analysis.dashboard.get",
-  description: "Get one dashboard detail, including creator, create/update time, settings, reports, notes, and share information.",
+  description: "Get one dashboard detail, including location, creator, create/update time, settings, reports, notes, and share information.",
   flags: [
     projectIdFlag,
     { name: "dashboard-id", type: "number", required: true, desc: "Dashboard ID." },
@@ -2793,10 +2794,10 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "update",
   capabilityId: "analysis.dashboard.update",
-  description: "Update dashboard settings or create/update a dashboard note. Use --operation settings or note-upsert.",
+  description: "Update dashboard settings, create/update a dashboard note, or replace the dashboard-level business filter. Use --operation settings, note-upsert, or business-filter.",
   flags: [
     projectIdFlag,
-    { name: "operation", type: "string", required: true, desc: "Update operation: settings or note-upsert." },
+    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, or business-filter." },
     { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
@@ -2807,6 +2808,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
     { name: "description", type: "string", required: false, desc: "Dashboard note description." },
     { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
+    { name: "filter", type: "json", required: false, desc: 'Dashboard-level business filter in snake_case QP form. Required with --operation business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' },
     payloadFlag
   ],
   risk: "write",
@@ -2823,6 +2825,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     note_title: optionalString(ctx, "note-title"),
     description: optionalString(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
+    filter: optionalJson(ctx, "filter"),
     payload: optionalJson(ctx, "payload")
   })
 });
@@ -3973,10 +3976,30 @@ var projectSpaceGet = createAnalysisCapabilityCommand({
   })
 });
 
+// src/commands/te-analysis/project-space/business-filter-upsert.ts
+var projectSpaceBusinessFilterUpsert = createAnalysisCapabilityCommand({
+  resource: "project-space",
+  command: "business-filter-upsert",
+  capabilityId: "analysis.project_space.business_filter_upsert",
+  description: "Create or replace the space-level business filter inherited by dashboards in a project space.",
+  flags: [
+    projectIdFlag,
+    { name: "space-id", type: "number", required: true, desc: "Project space ID." },
+    { name: "filter", type: "json", required: true, desc: 'Space-level business filter in snake_case QP form. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' }
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    ...projectInput(ctx),
+    space_id: ctx.num("space-id"),
+    filter: ctx.json("filter")
+  })
+});
+
 // src/commands/te-analysis/project-space/index.ts
 var commands31 = [
   projectSpaceList,
-  projectSpaceGet
+  projectSpaceGet,
+  projectSpaceBusinessFilterUpsert
 ];
 var project_space_default = commands31;
 

package/dist/{te-analysis-QG7UKGDA.js → te-analysis-ZMNGOVNW.js}

@@ -6,17 +6,17 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-IBH3LDAH.js";
+} from "./chunk-SAU3QFIQ.js";
 import {
   createCapabilityCommand
-} from "./chunk-QATA32VR.js";
+} from "./chunk-RGKJGKT7.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-PTE56QPL.js";
 import {
   withOutputMetadata
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -27,16 +27,17 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-JUW4AJXN.js";
+} from "./chunk-P3FGXJTU.js";
+import "./chunk-C4MGVGJW.js";
 import {
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
-import "./chunk-3FY3RJ26.js";
+} from "./chunk-4SGZG4XY.js";
+import "./chunk-ZZUOD757.js";
 import {
   CliValidationError
-} from "./chunk-AXDXJTPC.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -2774,7 +2775,7 @@ var dashboardGet = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "get",
   capabilityId: "analysis.dashboard.get",
-  description: "Get one dashboard detail, including creator, create/update time, settings, reports, notes, and share information.",
+  description: "Get one dashboard detail, including location, creator, create/update time, settings, reports, notes, and share information.",
   flags: [
     projectIdFlag,
     { name: "dashboard-id", type: "number", required: true, desc: "Dashboard ID." },
@@ -2793,10 +2794,10 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "update",
   capabilityId: "analysis.dashboard.update",
-  description: "Update dashboard settings or create/update a dashboard note. Use --operation settings or note-upsert.",
+  description: "Update dashboard settings, create/update a dashboard note, or replace the dashboard-level business filter. Use --operation settings, note-upsert, or business-filter.",
   flags: [
     projectIdFlag,
-    { name: "operation", type: "string", required: true, desc: "Update operation: settings or note-upsert." },
+    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, or business-filter." },
     { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
@@ -2807,6 +2808,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
     { name: "description", type: "string", required: false, desc: "Dashboard note description." },
     { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
+    { name: "filter", type: "json", required: false, desc: 'Dashboard-level business filter in snake_case QP form. Required with --operation business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' },
     payloadFlag
   ],
   risk: "write",
@@ -2823,6 +2825,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     note_title: optionalString(ctx, "note-title"),
     description: optionalString(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
+    filter: optionalJson(ctx, "filter"),
     payload: optionalJson(ctx, "payload")
   })
 });
@@ -3973,10 +3976,30 @@ var projectSpaceGet = createAnalysisCapabilityCommand({
   })
 });
 
+// src/commands/te-analysis/project-space/business-filter-upsert.ts
+var projectSpaceBusinessFilterUpsert = createAnalysisCapabilityCommand({
+  resource: "project-space",
+  command: "business-filter-upsert",
+  capabilityId: "analysis.project_space.business_filter_upsert",
+  description: "Create or replace the space-level business filter inherited by dashboards in a project space.",
+  flags: [
+    projectIdFlag,
+    { name: "space-id", type: "number", required: true, desc: "Project space ID." },
+    { name: "filter", type: "json", required: true, desc: 'Space-level business filter in snake_case QP form. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' }
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    ...projectInput(ctx),
+    space_id: ctx.num("space-id"),
+    filter: ctx.json("filter")
+  })
+});
+
 // src/commands/te-analysis/project-space/index.ts
 var commands31 = [
   projectSpaceList,
-  projectSpaceGet
+  projectSpaceGet,
+  projectSpaceBusinessFilterUpsert
 ];
 var project_space_default = commands31;
 

package/dist/{te-community-HNKVTERD.js → te-community-6HPBWJUZ.js}

@@ -1,36 +1,42 @@
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-PTE56QPL.js";
+import {
+  internalCallSourceHeaders
+} from "./chunk-C4MGVGJW.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   getActiveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   CliValidationError,
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/core/mcp.ts
-async function permissionMessage(resp) {
+async function permissionDetails(resp) {
   const text = await resp.text().catch(() => "");
   try {
     const d = safeJsonParse(text);
     const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
-    if (msg && typeof msg === "string") return msg;
+    if (msg && typeof msg === "string") {
+      return {
+        message: msg,
+        code: typeof d.code === "string" ? d.code : typeof d.error?.code === "string" ? d.error.code : void 0,
+        hint: typeof d.hint === "string" ? d.hint : typeof d.error?.hint === "string" ? d.error.hint : void 0
+      };
+    }
   } catch {
   }
-  return "Permission denied for this resource (HTTP 403)";
-}
-function isInvalidCliTokenMessage(message) {
-  return /\b(cli[-_\s]?token|token)\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\b(cli[-_\s]?token|token)\b/i.test(message);
+  return { message: "Permission denied for this resource (HTTP 403)" };
 }
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
@@ -85,6 +91,7 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     "Content-Type": "application/json",
     "Accept": "application/json, text/event-stream",
     "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+    ...internalCallSourceHeaders(),
     ...buildAuthHeaders(token)
   };
   const resp = await fetch(url, {
@@ -93,15 +100,12 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    let permissionMsg;
     if (resp.status === 403) {
-      permissionMsg = await permissionMessage(resp);
-      if (!isInvalidCliTokenMessage(permissionMsg)) {
-        throw new PermissionError(permissionMsg);
-      }
+      const permission = await permissionDetails(resp);
+      throw new PermissionError(permission.message, permission.code, permission.hint);
     }
-    if (resp.status === 401 || resp.status === 403 && permissionMsg) {
-      logger.warn(`MCP request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${hostUrl}, refreshing CLI token`);
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, refreshing CLI token`);
       clearCliToken(hostUrl);
       const newToken = await getCliToken(hostUrl);
       logger.info(`CLI token refreshed for ${hostUrl}`);
@@ -114,7 +118,8 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
         body: JSON.stringify(body)
       });
       if (retryResp.status === 403) {
-        throw new PermissionError(await permissionMessage(retryResp));
+        const permission = await permissionDetails(retryResp);
+        throw new PermissionError(permission.message, permission.code, permission.hint);
       }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);

package/dist/{te-community-IWE5B7W6.js → te-community-HLC43QKH.js}

@@ -1,36 +1,42 @@
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-PTE56QPL.js";
+import {
+  internalCallSourceHeaders
+} from "./chunk-6EIJSNBD.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   getActiveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   CliValidationError,
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/core/mcp.ts
-async function permissionMessage(resp) {
+async function permissionDetails(resp) {
   const text = await resp.text().catch(() => "");
   try {
     const d = safeJsonParse(text);
     const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
-    if (msg && typeof msg === "string") return msg;
+    if (msg && typeof msg === "string") {
+      return {
+        message: msg,
+        code: typeof d.code === "string" ? d.code : typeof d.error?.code === "string" ? d.error.code : void 0,
+        hint: typeof d.hint === "string" ? d.hint : typeof d.error?.hint === "string" ? d.error.hint : void 0
+      };
+    }
   } catch {
   }
-  return "Permission denied for this resource (HTTP 403)";
-}
-function isInvalidCliTokenMessage(message) {
-  return /\b(cli[-_\s]?token|token)\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\b(cli[-_\s]?token|token)\b/i.test(message);
+  return { message: "Permission denied for this resource (HTTP 403)" };
 }
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
@@ -85,7 +91,7 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     "Content-Type": "application/json",
     "Accept": "application/json, text/event-stream",
     "mcp-protocol-version": MCP_PROTOCOL_VERSION,
-    "X-Source": "ae-cli",
+    ...internalCallSourceHeaders(),
     ...buildAuthHeaders(token)
   };
   const resp = await fetch(url, {
@@ -94,15 +100,12 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    let permissionMsg;
     if (resp.status === 403) {
-      permissionMsg = await permissionMessage(resp);
-      if (!isInvalidCliTokenMessage(permissionMsg)) {
-        throw new PermissionError(permissionMsg);
-      }
+      const permission = await permissionDetails(resp);
+      throw new PermissionError(permission.message, permission.code, permission.hint);
     }
-    if (resp.status === 401 || resp.status === 403 && permissionMsg) {
-      logger.warn(`MCP request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${hostUrl}, refreshing CLI token`);
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, refreshing CLI token`);
       clearCliToken(hostUrl);
       const newToken = await getCliToken(hostUrl);
       logger.info(`CLI token refreshed for ${hostUrl}`);
@@ -115,7 +118,8 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
         body: JSON.stringify(body)
       });
       if (retryResp.status === 403) {
-        throw new PermissionError(await permissionMessage(retryResp));
+        const permission = await permissionDetails(retryResp);
+        throw new PermissionError(permission.message, permission.code, permission.hint);
       }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);

package/dist/{te-dataops-KXCEB4CS.js → te-dataops-EJP56W3K.js}

@@ -1,25 +1,33 @@
 import {
   printError
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
+import {
+  internalCallSourceHeaders
+} from "./chunk-6EIJSNBD.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import {
-  resolveHost
-} from "./chunk-ZQKDZXDO.js";
+} from "./chunk-4SGZG4XY.js";
 import {
+  resolveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   CliValidationError,
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/commands/te-dataops/shared.ts
+import { randomBytes } from "crypto";
+import { createWriteStream } from "fs";
+import { mkdir, rename, unlink } from "fs/promises";
+import { basename, dirname, join, resolve } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
 var TOOL_API_MAP = {
   repo_list_spaces: { method: "GET", path: "/api/cli/dataops/v1/gaia/repo/spaces" },
   datatable_get_table_detail: { method: "GET", path: "/api/cli/dataops/v1/gaia/datatable/table-detail" },
@@ -110,16 +118,16 @@ function buildDataopsApiDryRun(ctx, toolName59, args = {}) {
     body: params
   };
 }
-async function downloadDataopsApi(ctx, path2, params, retry = true) {
+async function downloadDataopsApi(ctx, path, params, targetPath, retry = true) {
   const host = resolveHost(ctx.host());
   const token = await getCliToken(host);
-  const url = buildUrl(host, path2, compactArgs(params));
+  const url = buildUrl(host, path, compactArgs(params));
   const resp = await fetch(url, {
     method: "GET",
     headers: {
       "cli-token": token,
       "Accept": "*/*",
-      "X-Source": "ae-cli"
+      ...internalCallSourceHeaders()
     }
   });
   if (resp.status === 403) {
@@ -128,23 +136,44 @@ async function downloadDataopsApi(ctx, path2, params, retry = true) {
   }
   if (resp.status === 401 && retry) {
     clearCliToken(host);
-    return downloadDataopsApi(ctx, path2, params, false);
+    return downloadDataopsApi(ctx, path, params, targetPath, false);
   }
   if (!resp.ok) {
     const data = parseResponseBody(await resp.text(), url, resp.status, true);
     throw new Error(formatHttpError(resp.status, resp.statusText, data));
   }
-  return Buffer.from(await resp.arrayBuffer());
-}
-async function dataopsRequest(ctx, method, path2, params = {}, body, retry = true) {
+  if (!resp.body) {
+    throw new Error("DataOps download response has no body.");
+  }
+  const outputPath = resolve(targetPath);
+  await mkdir(dirname(outputPath), { recursive: true });
+  const tempPath = join(
+    dirname(outputPath),
+    `.${basename(outputPath)}.part-${process.pid}-${randomBytes(6).toString("hex")}`
+  );
+  let tempPresent = false;
+  try {
+    tempPresent = true;
+    await pipeline(
+      Readable.fromWeb(resp.body),
+      createWriteStream(tempPath, { flags: "wx" })
+    );
+    await rename(tempPath, outputPath);
+    tempPresent = false;
+    return outputPath;
+  } finally {
+    if (tempPresent) await unlink(tempPath).catch(() => void 0);
+  }
+}
+async function dataopsRequest(ctx, method, path, params = {}, body, retry = true) {
   const host = resolveHost(ctx.host());
   const token = await getCliToken(host);
-  const url = buildUrl(host, path2, params);
+  const url = buildUrl(host, path, params);
   const headers = {
     "cli-token": token,
     "Accept": "application/json",
     "Content-Type": "application/json",
-    "X-Source": "ae-cli"
+    ...internalCallSourceHeaders()
   };
   const options = { method, headers };
   if (method !== "GET") {
@@ -160,16 +189,16 @@ async function dataopsRequest(ctx, method, path2, params = {}, body, retry = tru
   if (resp.status === 401 && retry) {
     logger.warn(`DataOps request failed (HTTP 401) for ${host}, refreshing CLI token`);
     clearCliToken(host);
-    return dataopsRequest(ctx, method, path2, params, body, false);
+    return dataopsRequest(ctx, method, path, params, body, false);
   }
   if (!resp.ok) {
     throw new Error(formatHttpError(resp.status, resp.statusText, data));
   }
   return unwrapDataResponse(data);
 }
-function buildUrl(host, path2, params = {}) {
+function buildUrl(host, path, params = {}) {
   const base = host.replace(/\/+$/, "");
-  const normalizedPath = path2.startsWith("/") ? path2 : `/${path2}`;
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
   const url = new URL(`${base}${normalizedPath}`);
   for (const [key, value] of Object.entries(params)) {
     if (value !== void 0 && value !== null) {
@@ -219,8 +248,8 @@ function permissionMessage(data) {
 }
 function formatHttpError(status, statusText, data) {
   const detail = typeof data === "string" ? data : data?.message || data?.error || data?.return_message || data?.returnMessage;
-  const path2 = data?.path ? ` path: ${data.path}` : "";
-  return `AE API error: HTTP ${status} ${statusText}${detail ? ` - ${detail}` : ""}${path2}`;
+  const path = data?.path ? ` path: ${data.path}` : "";
+  return `AE API error: HTTP ${status} ${statusText}${detail ? ` - ${detail}` : ""}${path}`;
 }
 
 // src/commands/te-dataops/datatable/get-table-detail.ts
@@ -1845,8 +1874,6 @@ var cancelSqlQuery = {
 };
 
 // src/commands/te-dataops/ide/get-sql-query-status.ts
-import { mkdir, writeFile } from "fs/promises";
-import path from "path";
 var toolName51 = "ide_get_sql_query_status";
 var downloadPath = "/api/cli/dataops/v1/gaia/ide/sql-query-download";
 function optionalString5(ctx, name) {
@@ -1865,24 +1892,20 @@ function isDownloadReady(data) {
 }
 async function downloadResult(ctx, data, targetPath) {
   const params = data?.downloadParams ?? {};
-  const bytes = await downloadDataopsApi(ctx, downloadPath, {
+  return downloadDataopsApi(ctx, downloadPath, {
     spaceCode: params.spaceCode,
     taskId: params.taskId
-  });
-  const absPath = path.resolve(targetPath);
-  await mkdir(path.dirname(absPath), { recursive: true });
-  await writeFile(absPath, bytes);
-  return absPath;
+  }, targetPath);
 }
 var getSqlQueryStatus = {
   service: "dataops_ide",
   command: "+get_sql_query_status",
-  description: "Poll a Gaia download-center task created by +submit_sql_query. Requires spaceCode and downloadTaskId. requestId is trace-only. Returns status and download metadata; --downloadTo saves the result zip locally after SUCCESS and adds localFile.",
+  description: "Poll a Gaia download-center task created by +submit_sql_query. Requires spaceCode and downloadTaskId. requestId is trace-only. Returns status and download metadata; --downloadTo streams the result zip to a local file after SUCCESS and adds localFile.",
   flags: [
     { name: "spaceCode", type: "string", required: true, desc: "Space code returned by +submit_sql_query" },
     { name: "downloadTaskId", type: "number", required: true, desc: "Download task ID returned by +submit_sql_query" },
     { name: "requestId", type: "string", required: false, desc: "Optional request ID returned by +submit_sql_query, used only for trace display" },
-    { name: "downloadTo", type: "string", required: false, desc: "Optional local file path. When downloadStatus=SUCCESS, save the result zip to this path; use a .zip suffix, for example ./result.zip." }
+    { name: "downloadTo", type: "string", required: false, desc: "Optional local file path. After SUCCESS, stream the result zip and replace this path only when the download completes; use a .zip suffix, for example ./result.zip." }
   ],
   risk: "read",
   dryRun: (ctx) => buildDataopsApiDryRun(ctx, toolName51, buildArgs47(ctx)),
@@ -2144,10 +2167,10 @@ function buildArgs54(ctx) {
 var submitSqlQuery = {
   service: "dataops_ide",
   command: "+submit_sql_query",
-  description: "Submit an IDE SQL query and create a Gaia download-center task. Requires spaceCode and sql. Optional repoCode/engineType default to te_etl/TASK_ENGINE_TRINO. Returns download task metadata; result rows are never returned by MCP/CLI.",
+  description: "Submit exactly one read-only IDE SQL query and create a Gaia download-center task. Optional repoCode/engineType default to te_etl/TASK_ENGINE_TRINO. Results are platform-bounded; Gaia returns downloadRowLimit when supported, and rows are never returned by MCP/CLI.",
   flags: [
     { name: "spaceCode", type: "string", required: true, desc: "Space code" },
-    { name: "sql", type: "string", required: true, desc: "SQL statement to execute" },
+    { name: "sql", type: "string", required: true, desc: "Exactly one read-only SQL query" },
     { name: "repoCode", type: "string", required: false, desc: "Repository code. Defaults to te_etl." },
     { name: "engineType", type: "string", required: false, desc: "SQL execution engine. Defaults to TASK_ENGINE_TRINO. Optional: TASK_ENGINE_STARROCKS." }
   ],