@thinkingai/ae-cli 6.1.14 → 6.1.16

package/dist/te-system-Z77IKZFN.js

@@ -0,0 +1,2213 @@
+import {
+  deleteFromMainApp,
+  downloadFromMainApp,
+  getFromMainApp,
+  patchToMainApp,
+  postToMainApp,
+  putToMainApp,
+  tryLoadTeAgentSandboxCredentials,
+  uploadToMainApp
+} from "./chunk-VPKZ7I72.js";
+import "./chunk-6EIJSNBD.js";
+import "./chunk-4SGZG4XY.js";
+import {
+  safeJsonParse
+} from "./chunk-ZZUOD757.js";
+import {
+  CliValidationError
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
+
+// src/commands/te-system/shared.ts
+import { readFileSync } from "fs";
+var SECRET_KEYS = /* @__PURE__ */ new Set([
+  "appsecret",
+  "bottoken",
+  "apptoken",
+  "clientsecret",
+  "apikey",
+  "secret",
+  "token"
+]);
+function assertAdminPath(path3) {
+  if (path3 === "/api/admin" || path3.startsWith("/api/admin/")) return;
+  throw new CliValidationError("System commands may only call /api/admin endpoints");
+}
+async function getAdmin(path3, host) {
+  assertAdminPath(path3);
+  return getFromMainApp(path3, host);
+}
+async function uploadAdminForm(path3, formData, host) {
+  assertAdminPath(path3);
+  return uploadToMainApp(path3, formData, host);
+}
+async function downloadAdmin(path3, outputPath, host) {
+  assertAdminPath(path3);
+  return downloadFromMainApp(path3, outputPath, host);
+}
+async function executeAdminRequest(ctx, request) {
+  assertAdminPath(request.path);
+  const host = ctx.host();
+  switch (request.method) {
+    case "GET":
+      return getFromMainApp(request.path, host);
+    case "POST":
+      return postToMainApp(request.path, request.body ?? {}, host);
+    case "PATCH":
+      return patchToMainApp(request.path, request.body ?? {}, host);
+    case "PUT":
+      return putToMainApp(request.path, request.body ?? {}, host);
+    case "DELETE":
+      return deleteFromMainApp(request.path, host);
+  }
+}
+function createAdminCommand(config) {
+  return {
+    service: "system",
+    command: config.command,
+    description: config.description,
+    flags: config.flags,
+    risk: config.risk,
+    helpText: config.helpText,
+    validate: config.validate,
+    preflight: config.risk === "high-risk-write" ? (ctx) => {
+      const request = config.prepare(ctx);
+      assertAdminPath(request.path);
+    } : void 0,
+    dryRun: (ctx) => {
+      const request = config.prepare(ctx);
+      assertAdminPath(request.path);
+      return {
+        method: request.method,
+        url: request.path,
+        ...request.body === void 0 ? {} : { body: config.redactDryRun ? redactSecrets(request.body) : request.body }
+      };
+    },
+    execute: async (ctx) => executeAdminRequest(ctx, config.prepare(ctx))
+  };
+}
+function createAdminDownloadCommand(config) {
+  return {
+    service: "system",
+    command: config.command,
+    description: config.description,
+    flags: config.flags,
+    risk: "read",
+    helpText: config.helpText,
+    validate: config.validate,
+    dryRun: (ctx) => {
+      const request = config.prepare(ctx);
+      assertAdminPath(request.path);
+      return {
+        method: "GET",
+        url: request.path,
+        body: { outputPath: request.outputPath }
+      };
+    },
+    execute: async (ctx) => {
+      const request = config.prepare(ctx);
+      return downloadAdmin(request.path, request.outputPath, ctx.host());
+    }
+  };
+}
+function optionalString(ctx, name) {
+  const value = ctx.str(name).trim();
+  return value || void 0;
+}
+function assertEnum(flagName, value, values) {
+  if (!value || values.includes(value)) return;
+  throw new CliValidationError(`--${flagName} must be one of: ${values.join(", ")}`);
+}
+function withQuery(path3, values) {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(values)) {
+    if (value === void 0 || value === "") continue;
+    query.set(key, String(value));
+  }
+  const encoded = query.toString();
+  return encoded ? `${path3}?${encoded}` : path3;
+}
+function readJsonSource(raw, flagName) {
+  if (raw === "-") {
+    return readFileSync(0, "utf8");
+  }
+  if (raw.startsWith("@")) {
+    const filePath = raw.slice(1).trim();
+    if (!filePath) {
+      throw new CliValidationError(`--${flagName} @file path cannot be empty`);
+    }
+    try {
+      return readFileSync(filePath, "utf8");
+    } catch {
+      throw new CliValidationError(`Unable to read JSON file for --${flagName}`, {
+        hint: "Check that the file exists and is readable."
+      });
+    }
+  }
+  return raw;
+}
+function readJsonFlag(ctx, name) {
+  const raw = ctx.str(name);
+  try {
+    return safeJsonParse(readJsonSource(raw, name));
+  } catch (error) {
+    if (error instanceof CliValidationError) throw error;
+    throw new CliValidationError(`--${name} must be valid JSON`, {
+      hint: `Pass inline JSON, @file, or - for stdin.`
+    });
+  }
+}
+function requireJsonObject(ctx, name) {
+  const value = readJsonFlag(ctx, name);
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new CliValidationError(`--${name} must be a JSON object`);
+  }
+  return value;
+}
+function optionalJsonObject(ctx, name) {
+  if (!optionalString(ctx, name)) return void 0;
+  return requireJsonObject(ctx, name);
+}
+function requireJsonArray(ctx, name) {
+  const value = readJsonFlag(ctx, name);
+  if (!Array.isArray(value)) {
+    throw new CliValidationError(`--${name} must be a JSON array`);
+  }
+  return value;
+}
+function requireStringArray(ctx, name) {
+  const value = requireJsonArray(ctx, name);
+  if (value.length === 0 || value.some((item) => typeof item !== "string" || !item.trim())) {
+    throw new CliValidationError(`--${name} must be a non-empty JSON array of strings`);
+  }
+  return value.map((item) => item.trim());
+}
+function requireBoundedStringArray(ctx, name, max) {
+  const values = requireStringArray(ctx, name);
+  if (values.length > max) {
+    throw new CliValidationError(`--${name} supports at most ${max} values`);
+  }
+  if (new Set(values).size !== values.length) {
+    throw new CliValidationError(`--${name} must not contain duplicate values`);
+  }
+  return values;
+}
+function redactSecrets(value) {
+  if (Array.isArray(value)) return value.map(redactSecrets);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [
+      key,
+      SECRET_KEYS.has(key.toLowerCase()) ? "***" : redactSecrets(item)
+    ])
+  );
+}
+function encodeId(value) {
+  return encodeURIComponent(value);
+}
+
+// src/commands/te-system/members.ts
+var MEMBER_STATUSES = ["all", "enabled", "disabled"];
+var MEMBER_ROLES = ["agent_admin", "member"];
+var SORT_DIRECTIONS = ["asc", "desc"];
+function memberBatchBody(ctx) {
+  const members = requireJsonArray(ctx, "members");
+  if (members.length === 0 || members.some(
+    (member) => !member || typeof member !== "object" || Array.isArray(member) || typeof member.openId !== "string" || !member.openId.trim()
+  )) {
+    throw new CliValidationError(
+      "--members must contain objects with a non-empty openId",
+      { hint: `Example: --members '[{"openId":"ou_x","loginName":"alice"}]'` }
+    );
+  }
+  return {
+    members,
+    ...optionalString(ctx, "rule-id") ? { ruleId: ctx.str("rule-id") } : {},
+    createSandbox: ctx.bool("create-sandbox")
+  };
+}
+var listMemberCandidates = createAdminCommand({
+  command: "+list-member-candidates",
+  description: "List TE company users that can be added to Agent system management",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/te-members" })
+});
+var listMembers = createAdminCommand({
+  command: "+list-members",
+  description: "List Agent system members in the current company",
+  flags: [
+    { name: "q", type: "string", desc: "Search login name or display name" },
+    {
+      name: "status",
+      type: "string",
+      desc: `Member status filter: ${MEMBER_STATUSES.join(" | ")}`
+    },
+    { name: "page", type: "number", min: 1, desc: "Page number (default: 1)" },
+    { name: "page-size", type: "number", min: 1, max: 100, desc: "Page size (1-100, default: 20)" },
+    { name: "all", type: "boolean", desc: "Return all matching members without pagination" },
+    { name: "sort-field", type: "string", desc: "Optional sort field: periodUsedAmount" },
+    {
+      name: "sort-dir",
+      type: "string",
+      desc: `Sort direction: ${SORT_DIRECTIONS.join(" | ")}`
+    }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    assertEnum("status", optionalString(ctx, "status"), MEMBER_STATUSES);
+    assertEnum("sort-dir", optionalString(ctx, "sort-dir"), SORT_DIRECTIONS);
+    const sortField = optionalString(ctx, "sort-field");
+    if (sortField && sortField !== "periodUsedAmount") {
+      throw new CliValidationError("--sort-field must be periodUsedAmount");
+    }
+  },
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/members", {
+      q: optionalString(ctx, "q"),
+      status: optionalString(ctx, "status"),
+      page: ctx.optionalNum("page"),
+      pageSize: ctx.optionalNum("page-size"),
+      all: ctx.bool("all") ? true : void 0,
+      sortField: optionalString(ctx, "sort-field"),
+      sortDir: optionalString(ctx, "sort-dir")
+    })
+  })
+});
+var addMembers = createAdminCommand({
+  command: "+add-members",
+  description: "Add one or more TE users to the Agent system member list",
+  flags: [
+    {
+      name: "members",
+      type: "string",
+      required: true,
+      sensitive: true,
+      desc: "JSON array, @file, or stdin (-): openId plus optional loginName/displayName"
+    },
+    { name: "rule-id", type: "string", desc: "Optional quota rule ID to bind to every member" },
+    {
+      name: "create-sandbox",
+      type: "boolean",
+      desc: "Create and bind a personal sandbox for every added member"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: "/api/admin/members/batch-add",
+    body: memberBatchBody(ctx)
+  })
+});
+var setMemberStatus = createAdminCommand({
+  command: "+set-member-status",
+  description: "Enable or disable an Agent system member",
+  flags: [
+    { name: "open-id", type: "string", required: true, desc: "TE user openId" },
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the member can use Agent" },
+    { name: "display-name", type: "string", desc: "Optional display name update" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: "/api/admin/members",
+    body: {
+      openId: ctx.str("open-id"),
+      enabled: ctx.bool("enabled"),
+      ...optionalString(ctx, "display-name") ? { displayName: ctx.str("display-name") } : {}
+    }
+  })
+});
+var setMemberRole = createAdminCommand({
+  command: "+set-member-role",
+  description: "Grant or revoke the Agent administrator role for a member",
+  flags: [
+    { name: "user-id", type: "string", required: true, desc: "Agent database user ID from +list-members" },
+    {
+      name: "role",
+      type: "string",
+      required: true,
+      desc: `Target role: ${MEMBER_ROLES.join(" | ")}`
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => assertEnum("role", optionalString(ctx, "role"), MEMBER_ROLES),
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/members/${encodeId(ctx.str("user-id"))}/role`,
+    body: { agentRole: ctx.str("role") }
+  })
+});
+var removeMember = createAdminCommand({
+  command: "+remove-member",
+  description: "Remove a non-root member from Agent system management",
+  flags: [
+    { name: "user-id", type: "string", required: true, desc: "Agent database user ID from +list-members" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/admin/members/${encodeId(ctx.str("user-id"))}`
+  })
+});
+var getMemberStats = createAdminCommand({
+  command: "+get-member-stats",
+  description: "Get token usage and recent conversation statistics for one company member",
+  flags: [
+    { name: "user-id", type: "string", required: true, desc: "Agent database user ID from +list-members" },
+    { name: "days", type: "number", min: 1, max: 365, desc: "Recent range in days (1-365, default: 30)" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery(`/api/admin/members/${encodeId(ctx.str("user-id"))}/stats`, {
+      days: ctx.optionalNum("days")
+    })
+  })
+});
+var memberCommands = [
+  listMemberCandidates,
+  listMembers,
+  addMembers,
+  setMemberStatus,
+  setMemberRole,
+  removeMember,
+  getMemberStats
+];
+
+// src/commands/te-system/sandboxes.ts
+function batchCreateBody(ctx) {
+  const userIds = requireStringArray(ctx, "user-ids");
+  if (userIds.length > 100) {
+    throw new CliValidationError("--user-ids supports at most 100 users per request");
+  }
+  return {
+    userIds,
+    ...optionalString(ctx, "description") ? { description: ctx.str("description") } : {}
+  };
+}
+var listSandboxes = createAdminCommand({
+  command: "+list-sandboxes",
+  description: "List sandboxes managed by the current company",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/sandboxes" })
+});
+var getSandboxConfig = createAdminCommand({
+  command: "+get-sandbox-config",
+  description: "Get sandbox feature status and company create/active seat limits",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/sandbox/config" })
+});
+var batchCreateSandboxes = createAdminCommand({
+  command: "+batch-create-sandboxes",
+  description: "Create personal sandboxes for up to 100 company members",
+  flags: [
+    {
+      name: "user-ids",
+      type: "string",
+      required: true,
+      sensitive: true,
+      desc: "Non-empty JSON string array, @file, or stdin (-) of Agent user IDs"
+    },
+    {
+      name: "description",
+      type: "string",
+      maxLength: 48,
+      desc: "Optional sandbox description (max 48 characters)"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: "/api/admin/sandboxes/batch-create",
+    body: batchCreateBody(ctx)
+  })
+});
+var updateSandbox = createAdminCommand({
+  command: "+update-sandbox",
+  description: "Update a sandbox description",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" },
+    {
+      name: "description",
+      type: "string",
+      required: true,
+      maxLength: 48,
+      desc: "New sandbox description (max 48 characters)"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PUT",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}`,
+    body: { description: ctx.str("description") }
+  })
+});
+var setSandboxEnabled = createAdminCommand({
+  command: "+set-sandbox-enabled",
+  description: "Enable or disable a sandbox",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" },
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the sandbox is enabled" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}/enabled`,
+    body: { enabled: ctx.bool("enabled") }
+  })
+});
+var startSandbox = createAdminCommand({
+  command: "+start-sandbox",
+  description: "Start the container for an enabled sandbox",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}/containers/start`
+  })
+});
+var stopSandbox = createAdminCommand({
+  command: "+stop-sandbox",
+  description: "Stop the container for a sandbox",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}/containers/stop`
+  })
+});
+var listSandboxUsers = createAdminCommand({
+  command: "+list-sandbox-users",
+  description: "List users bound to a sandbox",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}/users`
+  })
+});
+var bindSandboxUser = createAdminCommand({
+  command: "+bind-sandbox-user",
+  description: "Bind a company member to a sandbox",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" },
+    { name: "user-id", type: "string", required: true, desc: "Agent user ID from +list-members" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}/users`,
+    body: { userId: ctx.str("user-id") }
+  })
+});
+var unbindSandboxUser = createAdminCommand({
+  command: "+unbind-sandbox-user",
+  description: "Remove a user binding from a sandbox",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" },
+    { name: "user-id", type: "string", required: true, desc: "Agent user ID from +list-members" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: withQuery(`/api/admin/sandboxes/${encodeId(ctx.str("id"))}/users`, {
+      userId: ctx.str("user-id")
+    })
+  })
+});
+var removeSandbox = createAdminCommand({
+  command: "+remove-sandbox",
+  description: "Delete a sandbox and its user bindings",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox ID from +list-sandboxes" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/admin/sandboxes/${encodeId(ctx.str("id"))}`
+  })
+});
+var sandboxCommands = [
+  listSandboxes,
+  getSandboxConfig,
+  batchCreateSandboxes,
+  updateSandbox,
+  setSandboxEnabled,
+  startSandbox,
+  stopSandbox,
+  listSandboxUsers,
+  bindSandboxUser,
+  unbindSandboxUser,
+  removeSandbox
+];
+
+// src/commands/te-system/models.ts
+var BIZ_TYPES = ["AE_AGENT", "AI_QA"];
+var listSystemModels = createAdminCommand({
+  command: "+list-system-models",
+  description: "List system models and current company visibility",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/system-models" })
+});
+var setSystemModelEnabled = createAdminCommand({
+  command: "+set-system-model-enabled",
+  description: "Enable or disable a system model for the current company",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "System Model.id from +list-system-models" },
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the model is visible to the company" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/system-models/${encodeId(ctx.str("model-id"))}/company-enabled`,
+    body: { enabled: ctx.bool("enabled") }
+  })
+});
+var getModelSyncSettings = createAdminCommand({
+  command: "+get-model-sync-settings",
+  description: "Get the company policy for newly synchronized system models",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/models/sync-settings" })
+});
+var setModelSyncSettings = createAdminCommand({
+  command: "+set-model-sync-settings",
+  description: "Set whether newly synchronized system models are enabled for the company",
+  flags: [
+    {
+      name: "new-system-models-enabled-by-default",
+      type: "boolean",
+      required: true,
+      desc: "Whether future system models are enabled for this company by default"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: "/api/admin/models/sync-settings",
+    body: {
+      newSystemModelsEnabledByDefault: ctx.bool("new-system-models-enabled-by-default")
+    }
+  })
+});
+var getSystemModelPriceRules = createAdminCommand({
+  command: "+get-system-model-price-rules",
+  description: "Get the stored pricing rule snapshot for one managed system model",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "System Model.id from +list-system-models" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/admin/system-models/${encodeId(ctx.str("model-id"))}/price-rules`
+  })
+});
+var listCompanyModels = createAdminCommand({
+  command: "+list-company-models",
+  description: "List all company models, including disabled models",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/company-models" })
+});
+var setCompanyModelEnabled = createAdminCommand({
+  command: "+set-company-model-enabled",
+  description: "Enable or disable a company model for all company users",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "Company Model.id from +list-company-models" },
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the company model is enabled" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/company-models/${encodeId(ctx.str("model-id"))}`,
+    body: { enabled: ctx.bool("enabled") }
+  })
+});
+var getDefaultModels = createAdminCommand({
+  command: "+get-default-models",
+  description: "Get the company default models for Agent and AI QA",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/models/default-config" })
+});
+var setDefaultModel = createAdminCommand({
+  command: "+set-default-model",
+  description: "Set the company default model for Agent or AI QA",
+  flags: [
+    { name: "model-id", type: "string", required: true, desc: "Model.id from a system/company model list" },
+    {
+      name: "biz-type",
+      type: "string",
+      default: "AE_AGENT",
+      desc: `Default model slot: ${BIZ_TYPES.join(" | ")}`
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => assertEnum("biz-type", optionalString(ctx, "biz-type"), BIZ_TYPES),
+  prepare: (ctx) => ({
+    method: "POST",
+    path: "/api/admin/models/default-config",
+    body: {
+      modelId: ctx.str("model-id"),
+      bizType: ctx.str("biz-type") || "AE_AGENT"
+    }
+  })
+});
+var clearDefaultModel = createAdminCommand({
+  command: "+clear-default-model",
+  description: "Clear the company default model for Agent or AI QA",
+  flags: [
+    {
+      name: "biz-type",
+      type: "string",
+      default: "AE_AGENT",
+      desc: `Default model slot: ${BIZ_TYPES.join(" | ")}`
+    }
+  ],
+  risk: "high-risk-write",
+  validate: (ctx) => assertEnum("biz-type", optionalString(ctx, "biz-type"), BIZ_TYPES),
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: withQuery("/api/admin/models/default-config", {
+      bizType: ctx.str("biz-type") || "AE_AGENT"
+    })
+  })
+});
+var modelCommands = [
+  listSystemModels,
+  setSystemModelEnabled,
+  getModelSyncSettings,
+  setModelSyncSettings,
+  getSystemModelPriceRules,
+  listCompanyModels,
+  setCompanyModelEnabled,
+  getDefaultModels,
+  setDefaultModel,
+  clearDefaultModel
+];
+
+// src/commands/te-system/usage.ts
+import { resolve } from "path";
+var GROUP_BY = ["user", "model", "date", "app_type"];
+var SORT_BY = ["totalTokens", "cost", "share", "requestCount"];
+var SORT_DIRECTIONS2 = ["asc", "desc"];
+var EXPORT_SCOPES = ["full", "drill"];
+var DATE_PATTERN = "^\\d{4}-\\d{2}-\\d{2}$";
+function validateDatePair(ctx, required, supportsDays = false) {
+  const startDate = optionalString(ctx, "start-date");
+  const endDate = optionalString(ctx, "end-date");
+  const days = ctx.optionalNum("days");
+  if (Boolean(startDate) !== Boolean(endDate)) {
+    throw new CliValidationError("--start-date and --end-date must be provided together");
+  }
+  if (required && (!startDate || !endDate)) {
+    throw new CliValidationError("--start-date and --end-date are required");
+  }
+  if (supportsDays && days !== void 0 && startDate) {
+    throw new CliValidationError("--days cannot be combined with --start-date/--end-date");
+  }
+  if (startDate && endDate && startDate > endDate) {
+    throw new CliValidationError("--start-date cannot be later than --end-date");
+  }
+}
+function usageRangeQuery(ctx) {
+  return {
+    days: ctx.optionalNum("days"),
+    startDate: optionalString(ctx, "start-date"),
+    endDate: optionalString(ctx, "end-date")
+  };
+}
+function usageCombinationQuery(ctx) {
+  return {
+    startDate: ctx.str("start-date"),
+    endDate: ctx.str("end-date"),
+    parentDimension: ctx.str("parent-dimension"),
+    openId: optionalString(ctx, "open-id"),
+    modelId: optionalString(ctx, "model-id"),
+    modelScope: optionalString(ctx, "model-scope"),
+    appType: optionalString(ctx, "app-type"),
+    date: optionalString(ctx, "date"),
+    page: ctx.optionalNum("page"),
+    pageSize: ctx.optionalNum("page-size"),
+    sortBy: optionalString(ctx, "sort-by") || "totalTokens",
+    sortDir: optionalString(ctx, "sort-dir") || "desc"
+  };
+}
+function validateUsageCombination(ctx) {
+  validateDatePair(ctx, true);
+  const parent = optionalString(ctx, "parent-dimension");
+  assertEnum("parent-dimension", parent, GROUP_BY);
+  assertEnum("sort-by", optionalString(ctx, "sort-by"), SORT_BY);
+  assertEnum("sort-dir", optionalString(ctx, "sort-dir"), SORT_DIRECTIONS2);
+  const openId = optionalString(ctx, "open-id");
+  const modelId = optionalString(ctx, "model-id");
+  const modelScope = optionalString(ctx, "model-scope");
+  const appType = optionalString(ctx, "app-type");
+  const date = optionalString(ctx, "date");
+  const supplied = [openId, modelId, modelScope, appType, date].filter(Boolean).length;
+  if (parent === "user" && (!openId || supplied !== 1)) {
+    throw new CliValidationError("user drill-down requires only --open-id");
+  }
+  if (parent === "model" && (!modelId || !modelScope || supplied !== 2)) {
+    throw new CliValidationError("model drill-down requires only --model-id and --model-scope");
+  }
+  if (parent === "app_type" && (!appType || supplied !== 1)) {
+    throw new CliValidationError("app_type drill-down requires only --app-type");
+  }
+  if (parent === "date" && (!date || supplied !== 1)) {
+    throw new CliValidationError("date drill-down requires only --date");
+  }
+  if (date && (date < ctx.str("start-date") || date > ctx.str("end-date"))) {
+    throw new CliValidationError("--date must be within --start-date and --end-date");
+  }
+}
+var COMBINATION_FLAGS = [
+  { name: "start-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD)" },
+  { name: "end-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD)" },
+  { name: "parent-dimension", type: "string", required: true, desc: `Parent dimension: ${GROUP_BY.join(" | ")}` },
+  { name: "open-id", type: "string", desc: "Required only for user drill-down" },
+  { name: "model-id", type: "string", desc: "Required only for model drill-down" },
+  { name: "model-scope", type: "string", desc: "Required only for model drill-down" },
+  { name: "app-type", type: "string", desc: "Required only for app_type drill-down" },
+  { name: "date", type: "string", pattern: DATE_PATTERN, desc: "Required only for date drill-down" },
+  { name: "page", type: "number", min: 1, desc: "Page number (default: 1)" },
+  { name: "page-size", type: "number", min: 1, max: 100, desc: "Page size (1-100, default: 20)" },
+  { name: "sort-by", type: "string", default: "totalTokens", desc: `Sort by: ${SORT_BY.join(" | ")}` },
+  { name: "sort-dir", type: "string", default: "desc", desc: `Sort direction: ${SORT_DIRECTIONS2.join(" | ")}` }
+];
+var getUsageSummary = createAdminCommand({
+  command: "+get-usage-summary",
+  description: "Get company token and cost usage summary",
+  flags: [
+    { name: "days", type: "number", min: 1, max: 365, desc: "Relative range in days (1-365, default: 30)" },
+    {
+      name: "start-date",
+      type: "string",
+      pattern: DATE_PATTERN,
+      desc: "Start date (YYYY-MM-DD); requires --end-date"
+    },
+    {
+      name: "end-date",
+      type: "string",
+      pattern: DATE_PATTERN,
+      desc: "End date (YYYY-MM-DD); requires --start-date"
+    },
+    { name: "refresh", type: "boolean", desc: "Bypass the cached overview and refresh from the source" }
+  ],
+  risk: "read",
+  validate: (ctx) => validateDatePair(ctx, false, true),
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/stats/summary", {
+      ...usageRangeQuery(ctx),
+      refresh: ctx.bool("refresh") ? "true" : void 0
+    })
+  })
+});
+var getUsageDetails = createAdminCommand({
+  command: "+get-usage-details",
+  description: "Get paginated company usage details grouped by one dimension",
+  flags: [
+    {
+      name: "start-date",
+      type: "string",
+      required: true,
+      pattern: DATE_PATTERN,
+      desc: "Start date (YYYY-MM-DD)"
+    },
+    {
+      name: "end-date",
+      type: "string",
+      required: true,
+      pattern: DATE_PATTERN,
+      desc: "End date (YYYY-MM-DD)"
+    },
+    { name: "group-by", type: "string", default: "user", desc: `Group by: ${GROUP_BY.join(" | ")}` },
+    { name: "search", type: "string", maxLength: 100, desc: "Optional search text (max 100 characters)" },
+    { name: "open-id", type: "string", desc: "Filter by TE user openId" },
+    { name: "model-id", type: "string", desc: "Filter by model ID" },
+    { name: "model-scope", type: "string", desc: "Model scope; requires --model-id" },
+    { name: "app-type", type: "string", desc: "Filter by product/application type" },
+    { name: "page", type: "number", min: 1, desc: "Page number (default: 1)" },
+    { name: "page-size", type: "number", min: 1, max: 100, desc: "Page size (1-100, default: 20)" },
+    { name: "sort-by", type: "string", default: "totalTokens", desc: `Sort by: ${SORT_BY.join(" | ")}` },
+    { name: "sort-dir", type: "string", default: "desc", desc: `Sort direction: ${SORT_DIRECTIONS2.join(" | ")}` }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    validateDatePair(ctx, true);
+    assertEnum("group-by", optionalString(ctx, "group-by"), GROUP_BY);
+    assertEnum("sort-by", optionalString(ctx, "sort-by"), SORT_BY);
+    assertEnum("sort-dir", optionalString(ctx, "sort-dir"), SORT_DIRECTIONS2);
+    if (optionalString(ctx, "model-scope") && !optionalString(ctx, "model-id")) {
+      throw new CliValidationError("--model-scope requires --model-id");
+    }
+  },
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/stats/details", {
+      startDate: ctx.str("start-date"),
+      endDate: ctx.str("end-date"),
+      groupBy: ctx.str("group-by") || "user",
+      search: optionalString(ctx, "search"),
+      openId: optionalString(ctx, "open-id"),
+      modelId: optionalString(ctx, "model-id"),
+      modelScope: optionalString(ctx, "model-scope"),
+      appType: optionalString(ctx, "app-type"),
+      page: ctx.optionalNum("page"),
+      pageSize: ctx.optionalNum("page-size"),
+      sortBy: ctx.str("sort-by") || "totalTokens",
+      sortDir: ctx.str("sort-dir") || "desc"
+    })
+  })
+});
+var getAgentToolCalls = createAdminCommand({
+  command: "+get-agent-tool-calls",
+  description: "Get the company Agent tool-call count for a usage range",
+  flags: [
+    { name: "days", type: "number", min: 1, max: 365, desc: "Relative range in days (1-365, default: 30)" },
+    { name: "start-date", type: "string", pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD); requires --end-date" },
+    { name: "end-date", type: "string", pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD); requires --start-date" },
+    { name: "refresh", type: "boolean", desc: "Bypass the cached overview and refresh from the source" }
+  ],
+  risk: "read",
+  validate: (ctx) => validateDatePair(ctx, false, true),
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/stats/agent-tool-calls", {
+      ...usageRangeQuery(ctx),
+      refresh: ctx.bool("refresh") ? "true" : void 0
+    })
+  })
+});
+var getUsageCombinations = createAdminCommand({
+  command: "+get-usage-combinations",
+  description: "Drill one usage group into the remaining dimensions",
+  flags: COMBINATION_FLAGS,
+  risk: "read",
+  validate: validateUsageCombination,
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/stats/combinations", usageCombinationQuery(ctx))
+  })
+});
+var exportUsage = createAdminDownloadCommand({
+  command: "+export-usage",
+  description: "Export filtered one-dimension usage groups to a CSV file",
+  flags: [
+    { name: "start-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD)" },
+    { name: "end-date", type: "string", required: true, pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD)" },
+    { name: "group-by", type: "string", default: "user", desc: `Group by: ${GROUP_BY.join(" | ")}` },
+    { name: "search", type: "string", maxLength: 100, desc: "Optional search text (max 100 characters)" },
+    { name: "open-id", type: "string", desc: "Filter by TE user openId" },
+    { name: "model-id", type: "string", desc: "Filter by model ID" },
+    { name: "model-scope", type: "string", desc: "Model scope; requires --model-id" },
+    { name: "app-type", type: "string", desc: "Filter by product/application type" },
+    { name: "sort-by", type: "string", default: "totalTokens", desc: `Sort by: ${SORT_BY.join(" | ")}` },
+    { name: "sort-dir", type: "string", default: "desc", desc: `Sort direction: ${SORT_DIRECTIONS2.join(" | ")}` },
+    { name: "output", type: "string", required: true, desc: "New local CSV path; existing files are never overwritten" }
+  ],
+  validate: (ctx) => {
+    validateDatePair(ctx, true);
+    assertEnum("group-by", optionalString(ctx, "group-by"), GROUP_BY);
+    assertEnum("sort-by", optionalString(ctx, "sort-by"), SORT_BY);
+    assertEnum("sort-dir", optionalString(ctx, "sort-dir"), SORT_DIRECTIONS2);
+    if (optionalString(ctx, "model-scope") && !optionalString(ctx, "model-id")) {
+      throw new CliValidationError("--model-scope requires --model-id");
+    }
+  },
+  prepare: (ctx) => ({
+    path: withQuery("/api/admin/stats/export", {
+      startDate: ctx.str("start-date"),
+      endDate: ctx.str("end-date"),
+      groupBy: ctx.str("group-by") || "user",
+      search: optionalString(ctx, "search"),
+      openId: optionalString(ctx, "open-id"),
+      modelId: optionalString(ctx, "model-id"),
+      modelScope: optionalString(ctx, "model-scope"),
+      appType: optionalString(ctx, "app-type"),
+      sortBy: ctx.str("sort-by") || "totalTokens",
+      sortDir: ctx.str("sort-dir") || "desc"
+    }),
+    outputPath: resolve(ctx.str("output"))
+  })
+});
+var exportUsageDetails = createAdminDownloadCommand({
+  command: "+export-usage-details",
+  description: "Export full or drill-down multi-dimension usage details to a streamed CSV file",
+  flags: [
+    { name: "scope", type: "string", required: true, desc: `Export scope: ${EXPORT_SCOPES.join(" | ")}` },
+    { name: "days", type: "number", min: 1, max: 365, desc: "Relative range for full export (1-365, default: 30)" },
+    { name: "start-date", type: "string", pattern: DATE_PATTERN, desc: "Start date (YYYY-MM-DD)" },
+    { name: "end-date", type: "string", pattern: DATE_PATTERN, desc: "End date (YYYY-MM-DD)" },
+    ...COMBINATION_FLAGS.filter((flag) => !["start-date", "end-date", "page", "page-size", "sort-by", "sort-dir"].includes(flag.name)).map((flag) => ({ ...flag, required: false })),
+    { name: "output", type: "string", required: true, desc: "New local CSV path; existing files are never overwritten" }
+  ],
+  validate: (ctx) => {
+    const scope = optionalString(ctx, "scope");
+    assertEnum("scope", scope, EXPORT_SCOPES);
+    if (scope === "drill") {
+      validateUsageCombination(ctx);
+    } else {
+      validateDatePair(ctx, false, true);
+      if (optionalString(ctx, "parent-dimension") || optionalString(ctx, "open-id") || optionalString(ctx, "model-id") || optionalString(ctx, "model-scope") || optionalString(ctx, "app-type") || optionalString(ctx, "date")) {
+        throw new CliValidationError("full export does not accept drill-down filters");
+      }
+    }
+  },
+  prepare: (ctx) => ({
+    path: withQuery("/api/admin/stats/detailed-export", {
+      scope: ctx.str("scope"),
+      ...usageRangeQuery(ctx),
+      ...ctx.str("scope") === "drill" ? usageCombinationQuery(ctx) : {}
+    }),
+    outputPath: resolve(ctx.str("output"))
+  })
+});
+var usageCommands = [
+  getUsageSummary,
+  getUsageDetails,
+  getAgentToolCalls,
+  getUsageCombinations,
+  exportUsage,
+  exportUsageDetails
+];
+
+// src/commands/te-system/cost-control.ts
+function createRuleBody(ctx) {
+  const rule = requireJsonObject(ctx, "rule");
+  for (const key of ["name", "subjectType", "periodType"]) {
+    if (typeof rule[key] !== "string" || !rule[key].trim()) {
+      throw new CliValidationError(`--rule.${key} is required`);
+    }
+  }
+  return rule;
+}
+var getCostSummary = createAdminCommand({
+  command: "+get-cost-summary",
+  description: "Get company cost, quota, and usage summary",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/cost-control/summary" })
+});
+var getBalance = createAdminCommand({
+  command: "+get-balance",
+  description: "Get the current company model account balance and currency",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/cost-control/balance" })
+});
+var listOverLimitUsers = createAdminCommand({
+  command: "+list-over-limit-users",
+  description: "List company members currently over cost or token quota limits",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/cost-control/over-limit-users" })
+});
+var getBalanceAlert = createAdminCommand({
+  command: "+get-balance-alert",
+  description: "Get the company balance alert configuration and current status",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/cost-control/balance-alert" })
+});
+var setBalanceAlert = createAdminCommand({
+  command: "+set-balance-alert",
+  description: "Enable, update, or disable the company balance alert",
+  flags: [
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the balance alert is enabled" },
+    { name: "threshold", type: "string", desc: "Positive alert threshold; required when enabling" }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    if (ctx.bool("enabled") && !optionalString(ctx, "threshold")) {
+      throw new CliValidationError("--threshold is required when --enabled is true");
+    }
+  },
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: "/api/admin/cost-control/balance-alert",
+    body: {
+      enabled: ctx.bool("enabled"),
+      ...optionalString(ctx, "threshold") ? { threshold: ctx.str("threshold") } : {}
+    }
+  })
+});
+var listQuotaRules = createAdminCommand({
+  command: "+list-quota-rules",
+  description: "List company cost and token quota rules",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/quota-rules" })
+});
+var createQuotaRule = createAdminCommand({
+  command: "+create-quota-rule",
+  description: "Create a company or user cost/token quota rule",
+  flags: [
+    {
+      name: "rule",
+      type: "string",
+      required: true,
+      sensitive: true,
+      desc: "Quota rule JSON object, @file, or stdin (-)"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: "/api/admin/quota-rules",
+    body: createRuleBody(ctx)
+  })
+});
+var updateQuotaRule = createAdminCommand({
+  command: "+update-quota-rule",
+  description: "Update an existing cost/token quota rule",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Quota rule ID from +list-quota-rules" },
+    {
+      name: "rule",
+      type: "string",
+      required: true,
+      sensitive: true,
+      desc: "Partial quota rule JSON object, @file, or stdin (-)"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/quota-rules/${encodeId(ctx.str("id"))}`,
+    body: requireJsonObject(ctx, "rule")
+  })
+});
+var removeQuotaRule = createAdminCommand({
+  command: "+remove-quota-rule",
+  description: "Delete a cost/token quota rule",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Quota rule ID from +list-quota-rules" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/admin/quota-rules/${encodeId(ctx.str("id"))}`
+  })
+});
+var bindQuotaRuleUser = createAdminCommand({
+  command: "+bind-quota-rule-user",
+  description: "Bind a quota rule to a TE user",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Quota rule ID from +list-quota-rules" },
+    { name: "open-id", type: "string", required: true, desc: "TE user openId" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: `/api/admin/quota-rules/${encodeId(ctx.str("id"))}/bind-user`,
+    body: { openId: ctx.str("open-id") }
+  })
+});
+var costControlCommands = [
+  getCostSummary,
+  getBalance,
+  listOverLimitUsers,
+  getBalanceAlert,
+  setBalanceAlert,
+  listQuotaRules,
+  createQuotaRule,
+  updateQuotaRule,
+  removeQuotaRule,
+  bindQuotaRuleUser
+];
+
+// src/commands/te-system/channels.ts
+var CHANNEL_TYPES = /* @__PURE__ */ new Set(["feishu", "slack", "lark"]);
+function createChannelBody(ctx) {
+  const channel = requireJsonObject(ctx, "channel");
+  if (typeof channel.name !== "string" || !channel.name.trim()) {
+    throw new CliValidationError("--channel.name is required");
+  }
+  if (typeof channel.type !== "string" || !CHANNEL_TYPES.has(channel.type)) {
+    throw new CliValidationError("--channel.type must be one of: feishu, slack, lark");
+  }
+  if (!channel.config || typeof channel.config !== "object" || Array.isArray(channel.config)) {
+    throw new CliValidationError("--channel.config must be a JSON object");
+  }
+  const config = channel.config;
+  const requiredConfigKeys = channel.type === "slack" ? ["botToken", "appToken"] : ["appId", "appSecret"];
+  for (const key of requiredConfigKeys) {
+    if (typeof config[key] !== "string" || !config[key].trim()) {
+      throw new CliValidationError(`--channel.config.${key} is required for ${channel.type}`);
+    }
+  }
+  return channel;
+}
+function updateChannelBody(ctx) {
+  const channel = requireJsonObject(ctx, "channel");
+  if (Object.keys(channel).length === 0) {
+    throw new CliValidationError("--channel must contain at least one update field");
+  }
+  if ("type" in channel) {
+    throw new CliValidationError("--channel.type cannot be changed after channel creation");
+  }
+  return channel;
+}
+var listChannels = createAdminCommand({
+  command: "+list-channels",
+  description: "List configured Feishu, Lark, and Slack channels",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/channels" })
+});
+var createChannel = createAdminCommand({
+  command: "+create-channel",
+  description: "Create a Feishu, Lark, or Slack channel",
+  flags: [
+    {
+      name: "channel",
+      type: "string",
+      required: true,
+      sensitive: true,
+      desc: "Channel JSON object, @file, or stdin (-); may contain credentials"
+    }
+  ],
+  risk: "write",
+  redactDryRun: true,
+  prepare: (ctx) => ({
+    method: "POST",
+    path: "/api/admin/channels",
+    body: createChannelBody(ctx)
+  })
+});
+var updateChannel = createAdminCommand({
+  command: "+update-channel",
+  description: "Update channel settings, credentials, model, prompt, or enabled state",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Channel ID from +list-channels" },
+    {
+      name: "channel",
+      type: "string",
+      required: true,
+      sensitive: true,
+      desc: "Partial channel JSON object, @file, or stdin (-); may contain credentials"
+    }
+  ],
+  risk: "write",
+  redactDryRun: true,
+  prepare: (ctx) => ({
+    method: "PUT",
+    path: `/api/admin/channels/${encodeId(ctx.str("id"))}`,
+    body: updateChannelBody(ctx)
+  })
+});
+var removeChannel = createAdminCommand({
+  command: "+remove-channel",
+  description: "Delete a channel, unbind its users, and stop its runtime connection",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Channel ID from +list-channels" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/admin/channels/${encodeId(ctx.str("id"))}`
+  })
+});
+var channelCommands = [
+  listChannels,
+  createChannel,
+  updateChannel,
+  removeChannel
+];
+
+// src/commands/te-system/sandbox-tools.ts
+import { spawn } from "child_process";
+import { readFile as readFile2, stat as stat2 } from "fs/promises";
+import path2 from "path";
+
+// src/commands/te-system/sandbox-tool-package.ts
+import { createWriteStream } from "fs";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  readlink,
+  realpath,
+  rm,
+  stat,
+  writeFile
+} from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+import archiver from "archiver";
+var TOOL_UPLOAD_LIMITS = {
+  maxArchiveBytes: 50 * 1024 * 1024,
+  maxUnpackedBytes: 500 * 1024 * 1024,
+  maxFileBytes: 50 * 1024 * 1024,
+  maxFiles: 1e4
+};
+var TOOL_NAME_RE = /^[a-z][a-z0-9._-]{0,63}$/;
+var EXACT_VERSION_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+var SAFE_VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+var PACKAGE_NAME_RE = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+var RESERVED_COMMANDS = /* @__PURE__ */ new Set([
+  "claude",
+  "node",
+  "npm",
+  "npx",
+  "bash",
+  "sh",
+  "python",
+  "python3",
+  "pip",
+  "pip3",
+  "chromium",
+  "git",
+  "lark-cli",
+  "env",
+  "sudo",
+  "curl",
+  "wget"
+]);
+function isValidRelativePath(value) {
+  if (!value || value.length > 500) return false;
+  if (/[\x00-\x1f\x7f]/.test(value) || value.includes("\\")) return false;
+  if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value)) return false;
+  if (value.endsWith("/") || value.includes("//")) return false;
+  const segments = value.split("/");
+  return !segments.some(
+    (segment) => segment === "" || segment === "." || segment === ".." || segment === "current"
+  );
+}
+function requirePlainObject(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new CliValidationError(`${label} must be a JSON object`);
+  }
+  return value;
+}
+function rejectUnknownKeys(value, keys, label) {
+  const unknown = Object.keys(value).filter((key) => !keys.includes(key));
+  if (unknown.length > 0) {
+    throw new CliValidationError(
+      `${label} contains unsupported fields: ${unknown.join(", ")}`
+    );
+  }
+}
+function validateToolManifest(value) {
+  const manifest = requirePlainObject(value, "tool.json");
+  rejectUnknownKeys(
+    manifest,
+    [
+      "schemaVersion",
+      "name",
+      "displayName",
+      "description",
+      "version",
+      "commands"
+    ],
+    "tool.json"
+  );
+  if (manifest.schemaVersion !== 1) {
+    throw new CliValidationError("tool.json schemaVersion must be 1");
+  }
+  if (typeof manifest.name !== "string" || !TOOL_NAME_RE.test(manifest.name)) {
+    throw new CliValidationError(
+      "tool.json name must start with a lowercase letter and contain only lowercase letters, numbers, ., _, or - (max 64)"
+    );
+  }
+  if (typeof manifest.version !== "string" || !SAFE_VERSION_RE.test(manifest.version)) {
+    throw new CliValidationError(
+      "tool.json version contains unsupported characters or is too long"
+    );
+  }
+  if (manifest.displayName !== void 0 && (typeof manifest.displayName !== "string" || manifest.displayName.length > 200)) {
+    throw new CliValidationError(
+      "tool.json displayName must be a string of at most 200 characters"
+    );
+  }
+  if (manifest.description !== void 0 && (typeof manifest.description !== "string" || manifest.description.length > 2e3)) {
+    throw new CliValidationError(
+      "tool.json description must be a string of at most 2000 characters"
+    );
+  }
+  if (!Array.isArray(manifest.commands) || manifest.commands.length < 1 || manifest.commands.length > 64) {
+    throw new CliValidationError(
+      "tool.json commands must contain between 1 and 64 entries"
+    );
+  }
+  const commandNames = /* @__PURE__ */ new Set();
+  const commands2 = manifest.commands.map(
+    (rawCommand, index) => {
+      const command = requirePlainObject(
+        rawCommand,
+        `tool.json commands[${index}]`
+      );
+      rejectUnknownKeys(
+        command,
+        ["name", "entry", "runtime"],
+        `tool.json commands[${index}]`
+      );
+      if (typeof command.name !== "string" || !TOOL_NAME_RE.test(command.name)) {
+        throw new CliValidationError(
+          `tool.json commands[${index}].name is invalid`
+        );
+      }
+      if (RESERVED_COMMANDS.has(command.name)) {
+        throw new CliValidationError(
+          `tool.json command name is reserved: ${command.name}`
+        );
+      }
+      if (commandNames.has(command.name)) {
+        throw new CliValidationError(
+          `tool.json contains duplicate command name: ${command.name}`
+        );
+      }
+      commandNames.add(command.name);
+      if (typeof command.entry !== "string" || !isValidRelativePath(command.entry)) {
+        throw new CliValidationError(
+          `tool.json commands[${index}].entry must be a safe relative path`
+        );
+      }
+      if (command.runtime !== "node" && command.runtime !== "native") {
+        throw new CliValidationError(
+          `tool.json commands[${index}].runtime must be node or native`
+        );
+      }
+      return {
+        name: command.name,
+        entry: command.entry,
+        runtime: command.runtime
+      };
+    }
+  );
+  return {
+    schemaVersion: 1,
+    name: manifest.name,
+    ...manifest.displayName === void 0 ? {} : { displayName: manifest.displayName },
+    ...manifest.description === void 0 ? {} : { description: manifest.description },
+    version: manifest.version,
+    commands: commands2
+  };
+}
+function parseExactNpmPackageSpec(raw) {
+  const value = raw.trim();
+  const separator = value.lastIndexOf("@");
+  const name = separator > 0 ? value.slice(0, separator) : "";
+  const version = separator > 0 ? value.slice(separator + 1) : "";
+  if (!PACKAGE_NAME_RE.test(name) || !EXACT_VERSION_RE.test(version)) {
+    throw new CliValidationError(
+      "--package must be an exact registry package version, for example eslint@9.32.0 or @scope/cli@1.2.3",
+      {
+        hint: "Tags, ranges, URLs, Git sources, aliases, and local paths are not allowed."
+      }
+    );
+  }
+  return { name, version, spec: `${name}@${version}` };
+}
+function defaultCommandName(packageName) {
+  const slash = packageName.lastIndexOf("/");
+  return slash >= 0 ? packageName.slice(slash + 1) : packageName;
+}
+function packagePath(packageName) {
+  return path.posix.join("node_modules", ...packageName.split("/"));
+}
+function manifestFromNpmPackage(expected, packageJson, toolName) {
+  if (packageJson.name !== expected.name || packageJson.version !== expected.version) {
+    throw new CliValidationError(
+      `npm installed ${String(packageJson.name)}@${String(packageJson.version)}, expected ${expected.spec}`
+    );
+  }
+  const bins = [];
+  if (typeof packageJson.bin === "string") {
+    bins.push([defaultCommandName(expected.name), packageJson.bin]);
+  } else if (packageJson.bin && typeof packageJson.bin === "object" && !Array.isArray(packageJson.bin)) {
+    for (const [name, entry] of Object.entries(
+      packageJson.bin
+    )) {
+      if (typeof entry !== "string") {
+        throw new CliValidationError(
+          `npm package bin entry must be a string: ${name}`
+        );
+      }
+      bins.push([name, entry]);
+    }
+  }
+  if (bins.length === 0) {
+    throw new CliValidationError(
+      `npm package ${expected.spec} does not expose a CLI through package.json bin`
+    );
+  }
+  const commands2 = bins.map(([name, entry]) => {
+    const normalizedEntry = entry.replace(/^\.\//, "");
+    if (!isValidRelativePath(normalizedEntry)) {
+      throw new CliValidationError(
+        `npm package bin path must stay inside the package: ${name}`
+      );
+    }
+    const packageRoot = packagePath(expected.name);
+    const commandEntry = path.posix.join(packageRoot, normalizedEntry);
+    if (!commandEntry.startsWith(`${packageRoot}/`)) {
+      throw new CliValidationError(
+        `npm package bin path must stay inside the package: ${name}`
+      );
+    }
+    return {
+      name,
+      entry: commandEntry,
+      runtime: "node"
+    };
+  });
+  return validateToolManifest({
+    schemaVersion: 1,
+    name: toolName || defaultCommandName(expected.name),
+    displayName: expected.name,
+    ...typeof packageJson.description === "string" ? { description: packageJson.description.slice(0, 2e3) } : {},
+    version: expected.version,
+    commands: commands2
+  });
+}
+async function pathExists(target) {
+  try {
+    await lstat(target);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function loadManifest(root, manifestPath) {
+  const rootManifest = path.join(root, "tool.json");
+  const explicitPath = manifestPath ? path.resolve(manifestPath) : rootManifest;
+  if (manifestPath && explicitPath !== rootManifest && await pathExists(rootManifest)) {
+    throw new CliValidationError(
+      "The upload root already contains tool.json; remove --manifest or remove the duplicate root manifest"
+    );
+  }
+  let raw;
+  try {
+    raw = await readFile(explicitPath, "utf8");
+  } catch {
+    throw new CliValidationError(
+      `Unable to read tool manifest: ${explicitPath}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new CliValidationError("tool.json must contain valid UTF-8 JSON");
+  }
+  return { manifest: validateToolManifest(parsed), sourcePath: explicitPath };
+}
+function isNpmBinLink(relativePath) {
+  const segments = relativePath.split("/");
+  return segments.length >= 3 && segments[segments.length - 2] === ".bin" && segments[segments.length - 3] === "node_modules";
+}
+function ensureInsideRoot(rootRealPath, targetRealPath, label) {
+  const relative = path.relative(rootRealPath, targetRealPath);
+  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new CliValidationError(`${label} resolves outside the upload root`);
+  }
+}
+function npmBinWrapper(linkRelativePath, targetRealPath, rootRealPath) {
+  const targetRelativePath = path.relative(
+    path.dirname(path.join(rootRealPath, ...linkRelativePath.split("/"))),
+    targetRealPath
+  ).split(path.sep).join("/");
+  if (!targetRelativePath || /[\r\n\x00]/.test(targetRelativePath)) {
+    throw new CliValidationError(
+      `Unable to materialize npm bin link: ${linkRelativePath}`
+    );
+  }
+  const quotedTarget = `'${targetRelativePath.replace(/'/g, `'\\''`)}'`;
+  return [
+    "#!/usr/bin/env bash",
+    "set -euo pipefail",
+    'SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"',
+    `exec "$SCRIPT_DIR"/${quotedTarget} "$@"`,
+    ""
+  ].join("\n");
+}
+async function collectArchiveEntries(root, manifestSourcePath) {
+  const rootRealPath = await realpath(root);
+  const entries = [];
+  const npmBinTargets = /* @__PURE__ */ new Set();
+  let fileCount = 0;
+  let unpackedBytes = 0;
+  async function walk(directory) {
+    const children = await readdir(directory, { withFileTypes: true });
+    children.sort((left, right) => left.name.localeCompare(right.name));
+    for (const child of children) {
+      const sourcePath = path.join(directory, child.name);
+      const relativePath = path.relative(root, sourcePath).split(path.sep).join("/");
+      if (!isValidRelativePath(relativePath)) {
+        throw new CliValidationError(
+          `Upload root contains an unsafe path: ${relativePath}`
+        );
+      }
+      const info = await lstat(sourcePath);
+      if (info.isDirectory()) {
+        await walk(sourcePath);
+        continue;
+      }
+      if (sourcePath === manifestSourcePath || relativePath === "tool.json")
+        continue;
+      fileCount += 1;
+      if (fileCount > TOOL_UPLOAD_LIMITS.maxFiles - 1) {
+        throw new CliValidationError(
+          `Upload root exceeds ${TOOL_UPLOAD_LIMITS.maxFiles} files`
+        );
+      }
+      if (info.isSymbolicLink()) {
+        if (!isNpmBinLink(relativePath)) {
+          throw new CliValidationError(
+            `Symbolic links are only allowed under node_modules/.bin: ${relativePath}`
+          );
+        }
+        const rawTarget = await readlink(sourcePath);
+        if (/[\r\n\x00]/.test(rawTarget)) {
+          throw new CliValidationError(
+            `npm bin link has an unsafe target: ${relativePath}`
+          );
+        }
+        const targetRealPath = await realpath(sourcePath);
+        ensureInsideRoot(
+          rootRealPath,
+          targetRealPath,
+          `npm bin link ${relativePath}`
+        );
+        const targetInfo = await stat(targetRealPath);
+        if (!targetInfo.isFile()) {
+          throw new CliValidationError(
+            `npm bin link must resolve to a regular file: ${relativePath}`
+          );
+        }
+        npmBinTargets.add(
+          path.relative(rootRealPath, targetRealPath).split(path.sep).join("/")
+        );
+        const content = npmBinWrapper(
+          relativePath,
+          targetRealPath,
+          rootRealPath
+        );
+        unpackedBytes += Buffer.byteLength(content);
+        if (unpackedBytes > TOOL_UPLOAD_LIMITS.maxUnpackedBytes) {
+          throw new CliValidationError(
+            "Upload root exceeds the 500 MB unpacked size limit"
+          );
+        }
+        entries.push({ content, archivePath: relativePath, mode: 493 });
+        continue;
+      }
+      if (!info.isFile()) {
+        throw new CliValidationError(
+          `Upload root contains an unsupported file type: ${relativePath}`
+        );
+      }
+      if (info.size > TOOL_UPLOAD_LIMITS.maxFileBytes) {
+        throw new CliValidationError(
+          `File exceeds the 50 MB limit: ${relativePath}`
+        );
+      }
+      unpackedBytes += info.size;
+      if (unpackedBytes > TOOL_UPLOAD_LIMITS.maxUnpackedBytes) {
+        throw new CliValidationError(
+          "Upload root exceeds the 500 MB unpacked size limit"
+        );
+      }
+      entries.push({
+        sourcePath,
+        archivePath: relativePath,
+        mode: info.mode & 511
+      });
+    }
+  }
+  await walk(root);
+  return entries.map(
+    (entry) => npmBinTargets.has(entry.archivePath) ? { ...entry, mode: entry.mode | 73 } : entry
+  );
+}
+async function writeArchive(archivePath, manifest, entries) {
+  await new Promise((resolvePromise, rejectPromise) => {
+    const output = createWriteStream(archivePath, { mode: 384 });
+    const zip = archiver("zip", { zlib: { level: 9 } });
+    output.on("close", resolvePromise);
+    output.on("error", rejectPromise);
+    zip.on("error", rejectPromise);
+    zip.on("warning", (error) => {
+      if (error.code !== "ENOENT")
+        rejectPromise(error);
+    });
+    zip.pipe(output);
+    zip.append(`${JSON.stringify(manifest, null, 2)}
+`, {
+      name: "tool.json",
+      mode: 420
+    });
+    for (const entry of entries) {
+      if (entry.sourcePath) {
+        zip.file(entry.sourcePath, {
+          name: entry.archivePath,
+          mode: entry.mode
+        });
+      } else {
+        zip.append(entry.content ?? "", {
+          name: entry.archivePath,
+          mode: entry.mode
+        });
+      }
+    }
+    void zip.finalize();
+  });
+}
+async function createToolArchive(rootPath, manifestPath) {
+  const root = path.resolve(rootPath);
+  let rootInfo;
+  try {
+    rootInfo = await stat(root);
+  } catch {
+    throw new CliValidationError(`Upload root does not exist: ${root}`);
+  }
+  if (!rootInfo.isDirectory()) {
+    throw new CliValidationError(`Upload root must be a directory: ${root}`);
+  }
+  const { manifest, sourcePath } = await loadManifest(root, manifestPath);
+  const entries = await collectArchiveEntries(root, sourcePath);
+  const entryPaths = new Set(entries.map((entry) => entry.archivePath));
+  for (const command of manifest.commands) {
+    if (!entryPaths.has(command.entry)) {
+      throw new CliValidationError(
+        `tool.json command entry does not exist in the upload root: ${command.entry}`
+      );
+    }
+  }
+  const archiveDirectory = await mkdtemp(
+    path.join(tmpdir(), "ae-cli-sandbox-tool-")
+  );
+  const archivePath = path.join(
+    archiveDirectory,
+    `${manifest.name}-${manifest.version}.zip`
+  );
+  try {
+    await writeArchive(archivePath, manifest, entries);
+    const archiveInfo = await stat(archivePath);
+    if (archiveInfo.size > TOOL_UPLOAD_LIMITS.maxArchiveBytes) {
+      throw new CliValidationError(
+        "Compressed tool package exceeds the 50 MB upload limit"
+      );
+    }
+    return { archivePath, manifest, archiveBytes: archiveInfo.size };
+  } catch (error) {
+    await rm(archiveDirectory, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function createNpmInstallRoot() {
+  const root = await mkdtemp(path.join(tmpdir(), "ae-cli-npm-tool-"));
+  await mkdir(root, { recursive: true });
+  return root;
+}
+async function writeGeneratedManifest(root, manifest) {
+  await writeFile(
+    path.join(root, "tool.json"),
+    `${JSON.stringify(manifest, null, 2)}
+`,
+    {
+      mode: 384
+    }
+  );
+}
+async function removeTemporaryTree(root) {
+  await rm(root, { recursive: true, force: true });
+}
+
+// src/commands/te-system/sandbox-tools.ts
+var TOOL_UPLOAD_PATH = "/api/admin/sandbox-tools";
+var TOOL_UPLOAD_POLICY_PATH = "/api/admin/sandbox-tools/upload-policy";
+var NPM_INSTALL_TIMEOUT_MS = 10 * 60 * 1e3;
+var TARGET_MODES = ["selected", "all-running"];
+var OPERATION_ACTIONS = ["activate", "deactivate"];
+var SORT_ORDERS = ["asc", "desc"];
+function optionalFlag(ctx, name) {
+  const value = ctx.str(name).trim();
+  return value || void 0;
+}
+function optionalBoundedStringArray(ctx, name, max) {
+  return optionalString(ctx, name) ? requireBoundedStringArray(ctx, name, max) : void 0;
+}
+function validateCommandNamesByToolId(value, toolIds) {
+  if (!value) return void 0;
+  const normalized = {};
+  for (const [toolId, commandNames] of Object.entries(value)) {
+    if (!toolIds.includes(toolId)) {
+      throw new CliValidationError("--command-names-by-tool-id keys must exist in --tool-ids");
+    }
+    if (!Array.isArray(commandNames) || commandNames.length === 0 || commandNames.length > 64 || commandNames.some((name) => typeof name !== "string" || !name.trim())) {
+      throw new CliValidationError(
+        "--command-names-by-tool-id values must be arrays of 1-64 non-empty command names"
+      );
+    }
+    normalized[toolId] = commandNames.map((name) => name.trim());
+  }
+  return normalized;
+}
+function validateExpectedSnapshots(value, toolIds) {
+  if (!value) return void 0;
+  const normalized = {};
+  for (const [toolId, snapshot] of Object.entries(value)) {
+    if (!toolIds.includes(toolId)) {
+      throw new CliValidationError("--expected-tool-snapshots-by-id keys must exist in --tool-ids");
+    }
+    if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) {
+      throw new CliValidationError("--expected-tool-snapshots-by-id values must be objects");
+    }
+    const item = snapshot;
+    if (typeof item.name !== "string" || !item.name.trim() || item.version !== null && typeof item.version !== "string" || typeof item.packagePath !== "string" || !item.packagePath.trim() || !Array.isArray(item.commands) || item.commands.length === 0 || item.commands.length > 64 || item.commands.some((name) => typeof name !== "string" || !name.trim())) {
+      throw new CliValidationError(
+        "--expected-tool-snapshots-by-id contains an invalid tool snapshot"
+      );
+    }
+    normalized[toolId] = {
+      name: item.name.trim(),
+      version: item.version,
+      packagePath: item.packagePath.trim(),
+      commands: item.commands.map((name) => name.trim())
+    };
+  }
+  return normalized;
+}
+function sandboxToolOperationBody(ctx) {
+  const mode = optionalString(ctx, "target-mode");
+  assertEnum("target-mode", mode, TARGET_MODES);
+  const sandboxIds = optionalBoundedStringArray(ctx, "sandbox-ids", 50);
+  if (mode === "selected" && !sandboxIds) {
+    throw new CliValidationError("selected mode requires --sandbox-ids with 1-50 sandbox IDs");
+  }
+  if (mode === "all-running" && sandboxIds) {
+    throw new CliValidationError("all-running mode does not accept --sandbox-ids");
+  }
+  const toolIds = requireBoundedStringArray(ctx, "tool-ids", 20);
+  const commandNamesByToolId = validateCommandNamesByToolId(
+    optionalJsonObject(ctx, "command-names-by-tool-id"),
+    toolIds
+  );
+  const expectedToolSnapshotsById = validateExpectedSnapshots(
+    optionalJsonObject(ctx, "expected-tool-snapshots-by-id"),
+    toolIds
+  );
+  return {
+    target: { mode, ...sandboxIds ? { sandboxIds } : {} },
+    toolIds,
+    ...commandNamesByToolId ? { commandNamesByToolId } : {},
+    ...expectedToolSnapshotsById ? { expectedToolSnapshotsById } : {}
+  };
+}
+var TOOL_OPERATION_FLAGS = [
+  { name: "target-mode", type: "string", required: true, desc: `Target mode: ${TARGET_MODES.join(" | ")}` },
+  { name: "sandbox-ids", type: "string", sensitive: true, desc: "Selected mode only: JSON/@file array of 1-50 sandbox IDs" },
+  { name: "tool-ids", type: "string", required: true, desc: "JSON/@file array of 1-20 sandbox tool IDs" },
+  { name: "command-names-by-tool-id", type: "string", desc: "Optional JSON/@file map of tool ID to selected command names" },
+  { name: "expected-tool-snapshots-by-id", type: "string", sensitive: true, desc: "Optional JSON/@file optimistic-lock snapshots keyed by tool ID" }
+];
+async function requireUploadPolicy(ctx) {
+  const policy = await getAdmin(
+    TOOL_UPLOAD_POLICY_PATH,
+    ctx.host()
+  );
+  if (!policy || policy.enabled !== true || policy.archiveFormat !== "zip" || policy.manifestFile !== "tool.json" || !policy.limits || !Number.isFinite(policy.limits.maxArchiveBytes)) {
+    throw new CliValidationError(
+      "The server returned an invalid sandbox tool upload policy"
+    );
+  }
+  return policy;
+}
+function requireLinuxSandbox() {
+  const credentials = tryLoadTeAgentSandboxCredentials();
+  if (process.platform !== "linux" || !credentials?.sandboxId || !credentials.sandboxSecretKey) {
+    throw new CliValidationError(
+      "+npm-install must run inside a Linux te-agent sandbox",
+      {
+        hint: "Install and package the npm CLI in its target Linux runtime, then authenticate as root or agent_admin."
+      }
+    );
+  }
+}
+async function uploadArchive(ctx, archivePath, archiveBytes, maxArchiveBytes) {
+  if (archiveBytes > maxArchiveBytes) {
+    throw new CliValidationError(
+      `Compressed tool package exceeds the server limit of ${maxArchiveBytes} bytes`
+    );
+  }
+  const archive = await readFile2(archivePath);
+  const formData = new FormData();
+  formData.append(
+    "file",
+    new Blob([new Uint8Array(archive)], { type: "application/zip" }),
+    path2.basename(archivePath)
+  );
+  return uploadAdminForm(TOOL_UPLOAD_PATH, formData, ctx.host());
+}
+async function packageAndUpload(ctx, root, manifestPath, policy) {
+  const created = await createToolArchive(root, manifestPath);
+  try {
+    const result = await uploadArchive(
+      ctx,
+      created.archivePath,
+      created.archiveBytes,
+      policy.limits.maxArchiveBytes
+    );
+    return {
+      ...result,
+      package: {
+        name: created.manifest.name,
+        version: created.manifest.version,
+        archiveBytes: created.archiveBytes
+      }
+    };
+  } finally {
+    await removeTemporaryTree(path2.dirname(created.archivePath));
+  }
+}
+async function runNpmInstall(root, spec, allowScripts) {
+  const args = [
+    "install",
+    "--prefix",
+    root,
+    "--omit=dev",
+    "--no-audit",
+    "--no-fund",
+    "--save-exact",
+    ...allowScripts ? [] : ["--ignore-scripts"],
+    spec
+  ];
+  await new Promise((resolvePromise, rejectPromise) => {
+    let timedOut = false;
+    const child = spawn("npm", args, {
+      shell: false,
+      stdio: ["ignore", "ignore", "pipe"]
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+    }, NPM_INSTALL_TIMEOUT_MS);
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString();
+      process.stderr.write(text);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      rejectPromise(
+        new CliValidationError(`Unable to start npm: ${error.message}`)
+      );
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      if (code === 0) {
+        resolvePromise();
+        return;
+      }
+      rejectPromise(
+        new CliValidationError(
+          timedOut ? `npm install timed out after ${NPM_INSTALL_TIMEOUT_MS / 6e4} minutes` : `npm install failed${code === null ? ` (${signal ?? "terminated"})` : ` with exit code ${code}`}`
+        )
+      );
+    });
+  });
+}
+async function readInstalledPackageJson(root, packageName) {
+  const packageJsonPath = path2.join(
+    root,
+    "node_modules",
+    ...packageName.split("/"),
+    "package.json"
+  );
+  let raw;
+  try {
+    raw = await readFile2(packageJsonPath, "utf8");
+  } catch {
+    throw new CliValidationError(
+      `npm did not install the expected package: ${packageName}`
+    );
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new CliValidationError(
+      `Installed package.json is invalid: ${packageName}`
+    );
+  }
+}
+async function validateCommandEntries(root, entries) {
+  for (const entry of entries) {
+    const entryPath = path2.join(root, ...entry.split("/"));
+    let info;
+    try {
+      info = await stat2(entryPath);
+    } catch {
+      throw new CliValidationError(
+        `Installed npm command entry does not exist: ${entry}`
+      );
+    }
+    if (!info.isFile()) {
+      throw new CliValidationError(
+        `Installed npm command entry is not a regular file: ${entry}`
+      );
+    }
+  }
+}
+var uploadSandboxTool = {
+  service: "system",
+  command: "+upload-sandbox-tool",
+  description: "Package and upload a custom sandbox tool from a local directory",
+  flags: [
+    {
+      name: "path",
+      type: "string",
+      required: true,
+      desc: "Tool package root; tool.json must be at this directory root unless --manifest is used"
+    },
+    {
+      name: "manifest",
+      type: "string",
+      desc: "Optional external tool.json path when the package root does not contain one"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    if (!ctx.str("path").trim()) {
+      throw new CliValidationError("--path cannot be empty");
+    }
+  },
+  dryRun: (ctx) => ({
+    method: "POST",
+    url: TOOL_UPLOAD_PATH,
+    body: {
+      path: path2.resolve(ctx.str("path")),
+      manifest: optionalFlag(ctx, "manifest"),
+      archiveFormat: "zip",
+      activatesTool: false
+    }
+  }),
+  execute: async (ctx) => {
+    const policy = await requireUploadPolicy(ctx);
+    return packageAndUpload(
+      ctx,
+      ctx.str("path"),
+      optionalFlag(ctx, "manifest"),
+      policy
+    );
+  }
+};
+var npmInstallSandboxTool = {
+  service: "system",
+  command: "+npm-install",
+  description: "Install an exact npm CLI package in the sandbox and upload it as a shared tool",
+  flags: [
+    {
+      name: "package",
+      type: "string",
+      required: true,
+      desc: "Exact registry package version, for example eslint@9.32.0 or @scope/cli@1.2.3"
+    },
+    {
+      name: "name",
+      type: "string",
+      desc: "Optional shared tool identifier; defaults to the unscoped npm package name"
+    },
+    {
+      name: "allow-scripts",
+      type: "boolean",
+      default: false,
+      desc: "Allow npm lifecycle scripts; disabled by default for supply-chain safety"
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    parseExactNpmPackageSpec(ctx.str("package"));
+  },
+  dryRun: (ctx) => {
+    const spec = parseExactNpmPackageSpec(ctx.str("package"));
+    return {
+      method: "POST",
+      url: TOOL_UPLOAD_PATH,
+      body: {
+        package: spec.spec,
+        name: optionalFlag(ctx, "name"),
+        ignoreScripts: !ctx.bool("allow-scripts"),
+        installLocation: "temporary sandbox directory",
+        activatesTool: false
+      }
+    };
+  },
+  execute: async (ctx) => {
+    requireLinuxSandbox();
+    const spec = parseExactNpmPackageSpec(ctx.str("package"));
+    const policy = await requireUploadPolicy(ctx);
+    const root = await createNpmInstallRoot();
+    try {
+      await runNpmInstall(root, spec.spec, ctx.bool("allow-scripts"));
+      const packageJson = await readInstalledPackageJson(root, spec.name);
+      const manifest = manifestFromNpmPackage(
+        spec,
+        packageJson,
+        optionalFlag(ctx, "name")
+      );
+      await validateCommandEntries(
+        root,
+        manifest.commands.map((command) => command.entry)
+      );
+      await writeGeneratedManifest(root, manifest);
+      return await packageAndUpload(ctx, root, void 0, policy);
+    } finally {
+      await removeTemporaryTree(root);
+    }
+  }
+};
+var listSandboxTools = createAdminCommand({
+  command: "+list-sandbox-tools",
+  description: "List preset and custom sandbox tools registered for the current company",
+  flags: [],
+  risk: "read",
+  prepare: () => ({ method: "GET", path: "/api/admin/sandbox-tools" })
+});
+var syncSandboxTools = createAdminCommand({
+  command: "+sync-sandbox-tools",
+  description: "Synchronize the current company sandbox tool registry from the system manifest",
+  flags: [],
+  risk: "write",
+  prepare: () => ({ method: "POST", path: "/api/admin/sandbox-tools/sync", body: {} })
+});
+var getSandboxToolDistribution = createAdminCommand({
+  command: "+get-sandbox-tool-distribution",
+  description: "Get the sandboxes to which one tool is currently distributed",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox tool ID from +list-sandbox-tools" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/admin/sandbox-tools/${encodeId(ctx.str("id"))}/distribution`
+  })
+});
+var setSandboxToolEnabled = createAdminCommand({
+  command: "+set-sandbox-tool-enabled",
+  description: "Enable or disable a sandbox tool in the company registry",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox tool ID from +list-sandbox-tools" },
+    { name: "enabled", type: "boolean", required: true, desc: "Whether the sandbox tool is enabled" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PATCH",
+    path: `/api/admin/sandbox-tools/${encodeId(ctx.str("id"))}`,
+    body: { enabled: ctx.bool("enabled") }
+  })
+});
+var removeSandboxTool = createAdminCommand({
+  command: "+remove-sandbox-tool",
+  description: "Delete a sandbox tool after the server verifies it is fully reclaimed",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Sandbox tool ID from +list-sandbox-tools" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/admin/sandbox-tools/${encodeId(ctx.str("id"))}`
+  })
+});
+function createSandboxToolOperationCommand(command, description, route) {
+  return createAdminCommand({
+    command,
+    description,
+    flags: TOOL_OPERATION_FLAGS,
+    risk: "write",
+    validate: (ctx) => {
+      sandboxToolOperationBody(ctx);
+    },
+    prepare: (ctx) => ({
+      method: "POST",
+      path: `/api/admin/sandbox-tools/${route}`,
+      body: sandboxToolOperationBody(ctx)
+    })
+  });
+}
+var activateSandboxTools = createSandboxToolOperationCommand(
+  "+activate-sandbox-tools",
+  "Activate selected tool commands in selected or all running sandboxes",
+  "activate"
+);
+var deactivateSandboxTools = createSandboxToolOperationCommand(
+  "+deactivate-sandbox-tools",
+  "Deactivate selected managed tool commands in selected or all running sandboxes",
+  "deactivate"
+);
+var refreshSandboxToolStatus = createSandboxToolOperationCommand(
+  "+refresh-sandbox-tool-status",
+  "Refresh the observed tool state in selected or all running sandboxes",
+  "status"
+);
+var listSandboxToolOperations = createAdminCommand({
+  command: "+list-sandbox-tool-operations",
+  description: "List sandbox tool activation and deactivation operation history",
+  flags: [
+    { name: "page", type: "number", min: 1, desc: "Page number (default: 1)" },
+    { name: "page-size", type: "number", min: 1, max: 100, desc: "Page size (1-100, default: 20)" },
+    { name: "action", type: "string", desc: `Operation action: ${OPERATION_ACTIONS.join(" | ")}` },
+    { name: "operator", type: "string", maxLength: 100, desc: "Operator name or ID filter" },
+    { name: "sort-order", type: "string", desc: `Sort order: ${SORT_ORDERS.join(" | ")}` }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    assertEnum("action", optionalString(ctx, "action"), OPERATION_ACTIONS);
+    assertEnum("sort-order", optionalString(ctx, "sort-order"), SORT_ORDERS);
+  },
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/admin/sandbox-tools/operations", {
+      page: ctx.optionalNum("page"),
+      pageSize: ctx.optionalNum("page-size"),
+      action: optionalString(ctx, "action"),
+      operator: optionalString(ctx, "operator"),
+      sortOrder: optionalString(ctx, "sort-order")
+    })
+  })
+});
+var sandboxToolCommands = [
+  uploadSandboxTool,
+  npmInstallSandboxTool,
+  listSandboxTools,
+  syncSandboxTools,
+  getSandboxToolDistribution,
+  setSandboxToolEnabled,
+  removeSandboxTool,
+  activateSandboxTools,
+  deactivateSandboxTools,
+  refreshSandboxToolStatus,
+  listSandboxToolOperations
+];
+
+// src/commands/te-system/index.ts
+var commands = [
+  ...memberCommands,
+  ...sandboxCommands,
+  ...modelCommands,
+  ...usageCommands,
+  ...costControlCommands,
+  ...channelCommands,
+  ...sandboxToolCommands
+];
+var te_system_default = commands;
+export {
+  te_system_default as default
+};