@thinkingai/ae-cli 6.1.18 → 6.1.20

package/dist/{te-system-FXITO2JG.js → te-system-7G6F2LJA.js}

@@ -1,4 +1,6 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
+  TeAgentApiError,
   deleteFromMainApp,
   downloadFromMainApp,
   getFromMainApp,
@@ -7,25 +9,28 @@ import {
   putToMainApp,
   tryLoadTeAgentSandboxCredentials,
   uploadToMainApp
-} from "./chunk-QNOLN2LJ.js";
-import "./chunk-6EIJSNBD.js";
-import "./chunk-J2DEBMRF.js";
-import "./chunk-ZQKDZXDO.js";
+} from "./chunk-BBEFP4SB.js";
+import "./chunk-Y74WTIKJ.js";
+import "./chunk-ATSM5XAW.js";
 import {
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-WZ6YVQSF.js";
 import {
-  CliValidationError
-} from "./chunk-UW5UN47B.js";
-import "./chunk-JHENBQ5B.js";
+  CliValidationError,
+  PermissionError
+} from "./chunk-4P355ZWB.js";
 
 // src/commands/te-system/shared.ts
 import { readFileSync } from "fs";
 var SECRET_KEYS = /* @__PURE__ */ new Set([
   "appsecret",
   "bottoken",
+  "botsecret",
   "apptoken",
   "clientsecret",
+  "corpsecret",
+  "serviceaccountjson",
+  "privatekey",
   "apikey",
   "secret",
   "token"
@@ -34,6 +39,12 @@ function assertAdminPath(path3) {
   if (path3 === "/api/admin" || path3.startsWith("/api/admin/")) return;
   throw new CliValidationError("System commands may only call /api/admin endpoints");
 }
+function assertCliChannelPath(path3) {
+  if (path3 === "/api/cli/channel/v1" || path3.startsWith("/api/cli/channel/v1/")) return;
+  throw new CliValidationError(
+    "Channel commands may only call /api/cli/channel/v1 endpoints"
+  );
+}
 async function getAdmin(path3, host) {
   assertAdminPath(path3);
   return getFromMainApp(path3, host);
@@ -46,8 +57,8 @@ async function downloadAdmin(path3, outputPath, host) {
   assertAdminPath(path3);
   return downloadFromMainApp(path3, outputPath, host);
 }
-async function executeAdminRequest(ctx, request) {
-  assertAdminPath(request.path);
+async function executeSignedRequest(ctx, request, assertPath) {
+  assertPath(request.path);
   const host = ctx.host();
   switch (request.method) {
     case "GET":
@@ -62,9 +73,10 @@ async function executeAdminRequest(ctx, request) {
       return deleteFromMainApp(request.path, host);
   }
 }
-function createAdminCommand(config) {
+function createSignedCommand(config, assertPath) {
   return {
     service: "system",
+    ...config.resource ? { resource: config.resource } : {},
     command: config.command,
     description: config.description,
     flags: config.flags,
@@ -73,20 +85,36 @@ function createAdminCommand(config) {
     validate: config.validate,
     preflight: config.risk === "high-risk-write" ? (ctx) => {
       const request = config.prepare(ctx);
-      assertAdminPath(request.path);
+      assertPath(request.path);
     } : void 0,
     dryRun: (ctx) => {
       const request = config.prepare(ctx);
-      assertAdminPath(request.path);
+      assertPath(request.path);
       return {
         method: request.method,
         url: request.path,
         ...request.body === void 0 ? {} : { body: config.redactDryRun ? redactSecrets(request.body) : request.body }
       };
     },
-    execute: async (ctx) => executeAdminRequest(ctx, config.prepare(ctx))
+    execute: async (ctx) => executeSignedRequest(ctx, config.prepare(ctx), assertPath)
+  };
+}
+function createAdminCommand(config) {
+  return createSignedCommand(config, assertAdminPath);
+}
+function createCliChannelCommand(config) {
+  const command = createSignedCommand(config, assertCliChannelPath);
+  const execute = command.execute;
+  return {
+    ...command,
+    execute: async (ctx) => unwrapCliChannelResponse(await execute(ctx))
   };
 }
+function unwrapCliChannelResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const envelope = value;
+  return envelope.ok === true && "data" in envelope ? envelope.data : value;
+}
 function createAdminDownloadCommand(config) {
   return {
     service: "system",
@@ -199,7 +227,7 @@ function redactSecrets(value) {
   return Object.fromEntries(
     Object.entries(value).map(([key, item]) => [
       key,
-      SECRET_KEYS.has(key.toLowerCase()) ? "***" : redactSecrets(item)
+      SECRET_KEYS.has(key.toLowerCase().replace(/[^a-z0-9]/g, "")) ? "***" : redactSecrets(item)
     ])
   );
 }
@@ -1131,47 +1159,137 @@ var costControlCommands = [
 ];
 
 // src/commands/te-system/channels.ts
-var CHANNEL_TYPES = /* @__PURE__ */ new Set(["feishu", "slack", "lark"]);
+var CHANNEL_TYPES = /* @__PURE__ */ new Set([
+  "feishu",
+  "lark",
+  "slack",
+  "discord",
+  "dingtalk",
+  "wecom",
+  "mattermost",
+  "google_chat",
+  "whatsapp"
+]);
+var REQUIRED_CONFIG_KEYS = {
+  feishu: ["app_id", "app_secret"],
+  lark: ["app_id", "app_secret"],
+  slack: ["bot_token", "app_token"],
+  discord: ["bot_token"],
+  dingtalk: ["client_id", "client_secret", "corp_id"],
+  wecom: ["bot_id", "bot_secret"],
+  mattermost: ["server_url", "bot_token"],
+  google_chat: ["service_account_json"],
+  whatsapp: []
+};
+var OAUTH_REQUIRED_CONFIG_KEYS = {
+  wecom: ["corp_id", "corp_secret", "agent_id"],
+  mattermost: ["client_id", "client_secret"],
+  google_chat: ["client_id", "client_secret"]
+};
+var CONFIG_KEY_ALIASES = {
+  appId: "app_id",
+  appSecret: "app_secret",
+  botToken: "bot_token",
+  appToken: "app_token",
+  clientId: "client_id",
+  clientSecret: "client_secret",
+  corpId: "corp_id",
+  corpSecret: "corp_secret",
+  botId: "bot_id",
+  botSecret: "bot_secret",
+  agentId: "agent_id",
+  oauthEnabled: "oauth_enabled",
+  interactionCardTemplateId: "interaction_card_template_id",
+  serverUrl: "server_url",
+  serviceAccountJson: "service_account_json",
+  workspaceAddonServiceAccountEmail: "workspace_addon_service_account_email"
+};
+function normalizeKeys(value, aliases) {
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [aliases[key] ?? key, item])
+  );
+}
+function normalizeChannelBody(channel) {
+  const normalized = normalizeKeys(channel, {
+    systemPrompt: "system_prompt",
+    unbindUsers: "unbind_users"
+  });
+  if (normalized.config && typeof normalized.config === "object" && !Array.isArray(normalized.config)) {
+    normalized.config = normalizeKeys(
+      normalized.config,
+      CONFIG_KEY_ALIASES
+    );
+  }
+  return normalized;
+}
 function createChannelBody(ctx) {
-  const channel = requireJsonObject(ctx, "channel");
+  const channel = normalizeChannelBody(requireJsonObject(ctx, "channel"));
   if (typeof channel.name !== "string" || !channel.name.trim()) {
     throw new CliValidationError("--channel.name is required");
   }
   if (typeof channel.type !== "string" || !CHANNEL_TYPES.has(channel.type)) {
-    throw new CliValidationError("--channel.type must be one of: feishu, slack, lark");
+    throw new CliValidationError(
+      `--channel.type must be one of: ${Array.from(CHANNEL_TYPES).join(", ")}`
+    );
+  }
+  if (channel.config === void 0 && channel.type === "whatsapp") {
+    channel.config = {};
   }
   if (!channel.config || typeof channel.config !== "object" || Array.isArray(channel.config)) {
     throw new CliValidationError("--channel.config must be a JSON object");
   }
   const config = channel.config;
-  const requiredConfigKeys = channel.type === "slack" ? ["botToken", "appToken"] : ["appId", "appSecret"];
-  for (const key of requiredConfigKeys) {
+  for (const key of REQUIRED_CONFIG_KEYS[channel.type] ?? []) {
     if (typeof config[key] !== "string" || !config[key].trim()) {
       throw new CliValidationError(`--channel.config.${key} is required for ${channel.type}`);
     }
   }
+  if (config.oauth_enabled === true) {
+    for (const key of OAUTH_REQUIRED_CONFIG_KEYS[channel.type] ?? []) {
+      if (typeof config[key] !== "string" || !config[key].trim()) {
+        throw new CliValidationError(
+          `--channel.config.${key} is required when oauth_enabled is true for ${channel.type}`
+        );
+      }
+    }
+  }
   return channel;
 }
 function updateChannelBody(ctx) {
-  const channel = requireJsonObject(ctx, "channel");
+  const channel = normalizeChannelBody(requireJsonObject(ctx, "channel"));
   if (Object.keys(channel).length === 0) {
     throw new CliValidationError("--channel must contain at least one update field");
   }
-  if ("type" in channel) {
-    throw new CliValidationError("--channel.type cannot be changed after channel creation");
+  if (channel.type !== void 0 && (typeof channel.type !== "string" || !CHANNEL_TYPES.has(channel.type))) {
+    throw new CliValidationError(
+      `--channel.type must be one of: ${Array.from(CHANNEL_TYPES).join(", ")}`
+    );
   }
   return channel;
 }
-var listChannels = createAdminCommand({
+var listChannels = createCliChannelCommand({
   command: "+list-channels",
-  description: "List configured Feishu, Lark, and Slack channels",
+  description: "List configured channels",
   flags: [],
   risk: "read",
-  prepare: () => ({ method: "GET", path: "/api/admin/channels" })
+  prepare: () => ({ method: "GET", path: "/api/cli/channel/v1/channels" })
 });
-var createChannel = createAdminCommand({
+var getChannel = createCliChannelCommand({
+  resource: "channel",
+  command: "get",
+  description: "Get one configured channel",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Channel ID from +list-channels" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/cli/channel/v1/channels/${encodeId(ctx.str("id"))}`
+  })
+});
+var createChannel = createCliChannelCommand({
   command: "+create-channel",
-  description: "Create a Feishu, Lark, or Slack channel",
+  description: "Create a managed channel",
   flags: [
     {
       name: "channel",
@@ -1185,11 +1303,11 @@ var createChannel = createAdminCommand({
   redactDryRun: true,
   prepare: (ctx) => ({
     method: "POST",
-    path: "/api/admin/channels",
+    path: "/api/cli/channel/v1/channels",
     body: createChannelBody(ctx)
   })
 });
-var updateChannel = createAdminCommand({
+var updateChannel = createCliChannelCommand({
   command: "+update-channel",
   description: "Update channel settings, credentials, model, prompt, or enabled state",
   flags: [
@@ -1205,12 +1323,12 @@ var updateChannel = createAdminCommand({
   risk: "write",
   redactDryRun: true,
   prepare: (ctx) => ({
-    method: "PUT",
-    path: `/api/admin/channels/${encodeId(ctx.str("id"))}`,
+    method: "PATCH",
+    path: `/api/cli/channel/v1/channels/${encodeId(ctx.str("id"))}`,
     body: updateChannelBody(ctx)
   })
 });
-var removeChannel = createAdminCommand({
+var removeChannel = createCliChannelCommand({
   command: "+remove-channel",
   description: "Delete a channel, unbind its users, and stop its runtime connection",
   flags: [
@@ -1219,14 +1337,427 @@ var removeChannel = createAdminCommand({
   risk: "high-risk-write",
   prepare: (ctx) => ({
     method: "DELETE",
-    path: `/api/admin/channels/${encodeId(ctx.str("id"))}`
+    path: `/api/cli/channel/v1/channels/${encodeId(ctx.str("id"))}`
+  })
+});
+var verifyChannel = createCliChannelCommand({
+  resource: "channel",
+  command: "verify",
+  description: "Verify channel credentials and discover endpoints",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "Channel ID from +list-channels" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "POST",
+    path: `/api/cli/channel/v1/channels/${encodeId(ctx.str("id"))}/verify`
   })
 });
 var channelCommands = [
   listChannels,
+  getChannel,
   createChannel,
   updateChannel,
-  removeChannel
+  removeChannel,
+  verifyChannel
+];
+
+// src/commands/te-system/channel-routing.ts
+function routingBody(ctx) {
+  const routing = requireJsonObject(ctx, "routing");
+  if (routing.status !== "enabled" && routing.status !== "disabled") {
+    throw new CliValidationError("--routing.status must be one of: enabled, disabled");
+  }
+  if (!("default_handler" in routing)) {
+    throw new CliValidationError("--routing.default_handler is required and may be null");
+  }
+  if (!Array.isArray(routing.targets)) {
+    throw new CliValidationError("--routing.targets must be a JSON array");
+  }
+  if (routing.targets.length > 19) {
+    throw new CliValidationError("--routing.targets may contain at most 19 items");
+  }
+  return routing;
+}
+var getChannelRouting = createCliChannelCommand({
+  resource: "channel routing",
+  command: "get",
+  description: "Get group message routing for one channel endpoint",
+  flags: [
+    {
+      name: "endpoint-id",
+      type: "string",
+      required: true,
+      desc: "Endpoint ID returned by channel get or channel verify"
+    }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: `/api/cli/channel/v1/endpoints/${encodeId(ctx.str("endpoint-id"))}/routing`
+  })
+});
+var setChannelRouting = createCliChannelCommand({
+  resource: "channel routing",
+  command: "set",
+  description: "Replace group message routing for one channel endpoint",
+  flags: [
+    {
+      name: "endpoint-id",
+      type: "string",
+      required: true,
+      desc: "Endpoint ID returned by channel get or channel verify"
+    },
+    {
+      name: "routing",
+      type: "string",
+      required: true,
+      desc: "Routing JSON object, @file, or stdin (-)"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PUT",
+    path: `/api/cli/channel/v1/endpoints/${encodeId(ctx.str("endpoint-id"))}/routing`,
+    body: routingBody(ctx)
+  })
+});
+var channelRoutingCommands = [getChannelRouting, setChannelRouting];
+
+// src/commands/te-system/channel-whatsapp.ts
+function whatsappWebPath(channelId) {
+  return `/api/cli/channel/v1/channels/${encodeId(channelId)}/whatsapp-web`;
+}
+var getWhatsAppWebStatus = createCliChannelCommand({
+  resource: "channel whatsapp-web",
+  command: "status",
+  description: "Get the WhatsApp Web link status for one channel",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "WhatsApp channel ID" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({ method: "GET", path: whatsappWebPath(ctx.str("id")) })
+});
+var startWhatsAppWebLink = createCliChannelCommand({
+  resource: "channel whatsapp-web",
+  command: "start",
+  description: "Start or resume WhatsApp Web QR linking",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "WhatsApp channel ID" }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({ method: "POST", path: whatsappWebPath(ctx.str("id")) })
+});
+var unlinkWhatsAppWeb = createCliChannelCommand({
+  resource: "channel whatsapp-web",
+  command: "unlink",
+  description: "Unlink WhatsApp Web and remove its stored credentials",
+  flags: [
+    { name: "id", type: "string", required: true, desc: "WhatsApp channel ID" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({ method: "DELETE", path: whatsappWebPath(ctx.str("id")) })
+});
+var channelWhatsAppCommands = [
+  getWhatsAppWebStatus,
+  startWhatsAppWebLink,
+  unlinkWhatsAppWeb
+];
+
+// src/commands/te-system/channel-bindings.ts
+var BATCH_BINDING_KEYS = /* @__PURE__ */ new Set(["te_user_id", "open_id", "union_id", "agent_id"]);
+function requiredBatchString(item, key, index) {
+  const value = item[key];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CliValidationError(`--bindings[${index}].${key} is required`);
+  }
+  return value.trim();
+}
+function optionalBatchString(item, key, index) {
+  if (item[key] === void 0) return void 0;
+  return requiredBatchString(item, key, index);
+}
+function batchBindingPlan(ctx) {
+  const input = requireJsonArray(ctx, "bindings");
+  if (input.length < 1 || input.length > 100) {
+    throw new CliValidationError("--bindings must contain between 1 and 100 items");
+  }
+  const endpointId = optionalString(ctx, "endpoint-id");
+  const privateOnly = ctx.bool("private-only");
+  if (privateOnly && endpointId) {
+    throw new CliValidationError("--private-only cannot be combined with --endpoint-id");
+  }
+  if (!privateOnly && !endpointId) {
+    throw new CliValidationError("--endpoint-id is required unless --private-only is true");
+  }
+  const bindings = input.map((raw, index) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new CliValidationError(`--bindings[${index}] must be a JSON object`);
+    }
+    const item = raw;
+    const unknownKey = Object.keys(item).find((key) => !BATCH_BINDING_KEYS.has(key));
+    if (unknownKey) {
+      throw new CliValidationError(`--bindings[${index}].${unknownKey} is not supported`);
+    }
+    const unionId = optionalBatchString(item, "union_id", index);
+    if (privateOnly && unionId) {
+      throw new CliValidationError(
+        `--bindings[${index}].union_id is not allowed with --private-only`
+      );
+    }
+    if (!privateOnly && !unionId) {
+      throw new CliValidationError(
+        `--bindings[${index}].union_id is required unless --private-only is true`
+      );
+    }
+    const agentId = optionalBatchString(item, "agent_id", index);
+    return {
+      te_user_id: requiredBatchString(item, "te_user_id", index),
+      open_id: requiredBatchString(item, "open_id", index),
+      ...unionId ? { union_id: unionId } : {},
+      ...agentId ? { agent_id: agentId } : {}
+    };
+  });
+  const defaultAgentId = optionalString(ctx, "default-agent-id");
+  return {
+    channelId: ctx.str("channel-id"),
+    ...endpointId ? { endpointId } : {},
+    privateOnly,
+    ...defaultAgentId ? { defaultAgentId } : {},
+    bindings
+  };
+}
+function batchDryRunBody(plan) {
+  return {
+    channel_id: plan.channelId,
+    ...plan.endpointId ? { endpoint_id: plan.endpointId } : {},
+    private_only: plan.privateOnly,
+    ...plan.defaultAgentId ? { default_agent_id: plan.defaultAgentId } : {},
+    bindings: plan.bindings.map((binding) => ({
+      ...binding,
+      ...binding.agent_id || plan.defaultAgentId ? { agent_id: binding.agent_id ?? plan.defaultAgentId } : {}
+    }))
+  };
+}
+function batchError(error) {
+  const value = error && typeof error === "object" ? error : {};
+  return {
+    message: typeof value.message === "string" ? value.message : String(error),
+    ...typeof value.code === "string" ? { code: value.code } : {},
+    ...typeof value.status === "number" ? { status: value.status } : {}
+  };
+}
+function feishuBindingBody(ctx) {
+  const unionId = optionalString(ctx, "union-id");
+  const endpointId = optionalString(ctx, "endpoint-id");
+  const privateOnly = ctx.bool("private-only");
+  if (privateOnly && (unionId || endpointId)) {
+    throw new CliValidationError(
+      "--private-only cannot be combined with --union-id or --endpoint-id"
+    );
+  }
+  if (!privateOnly && (!unionId || !endpointId)) {
+    throw new CliValidationError(
+      "--union-id and --endpoint-id are required unless --private-only is true"
+    );
+  }
+  return {
+    channel_id: ctx.str("channel-id"),
+    te_user_id: ctx.str("te-user-id"),
+    open_id: ctx.str("open-id"),
+    ...unionId && endpointId ? { union_id: unionId, endpoint_id: endpointId } : {}
+  };
+}
+var listChannelBindings = createCliChannelCommand({
+  resource: "channel binding",
+  command: "list",
+  description: "List channel user bindings",
+  flags: [
+    { name: "channel-id", type: "string", desc: "Filter by channel ID" },
+    { name: "te-user-id", type: "string", desc: "Filter by AE user ID" },
+    { name: "open-id", type: "string", desc: "Filter by channel open ID" }
+  ],
+  risk: "read",
+  prepare: (ctx) => ({
+    method: "GET",
+    path: withQuery("/api/cli/channel/v1/bindings", {
+      channel_id: optionalString(ctx, "channel-id"),
+      te_user_id: optionalString(ctx, "te-user-id"),
+      open_id: optionalString(ctx, "open-id")
+    })
+  })
+});
+var bindFeishuUser = createCliChannelCommand({
+  resource: "channel binding",
+  command: "bind-feishu",
+  description: "Bind one Feishu user to a managed Feishu channel",
+  flags: [
+    { name: "channel-id", type: "string", required: true, desc: "Feishu channel ID" },
+    { name: "te-user-id", type: "string", required: true, desc: "AE user ID to bind" },
+    { name: "open-id", type: "string", required: true, desc: "Feishu open_id" },
+    { name: "union-id", type: "string", desc: "Feishu union_id for group chat readiness" },
+    { name: "endpoint-id", type: "string", desc: "Verified Feishu endpoint ID" },
+    {
+      name: "private-only",
+      type: "boolean",
+      default: false,
+      desc: "Create a private-chat-only binding without union_id or endpoint_id"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => ({
+    method: "PUT",
+    path: "/api/cli/channel/v1/bindings/feishu",
+    body: feishuBindingBody(ctx)
+  })
+});
+function createBindFeishuUsersCommand(dependencies = { put: putToMainApp }) {
+  return {
+    service: "system",
+    command: "+bind-feishu-users",
+    description: "Bind 1 to 100 Feishu users and optionally assign default Agents",
+    flags: [
+      { name: "channel-id", type: "string", required: true, desc: "Feishu channel ID" },
+      {
+        name: "endpoint-id",
+        type: "string",
+        desc: "Verified Feishu endpoint ID shared by all group-ready bindings"
+      },
+      {
+        name: "bindings",
+        type: "string",
+        required: true,
+        sensitive: true,
+        desc: "Array of 1 to 100 binding objects as JSON, @file, or stdin (-)"
+      },
+      {
+        name: "default-agent-id",
+        type: "string",
+        desc: "Agent ID used when a binding does not provide agent_id"
+      },
+      {
+        name: "private-only",
+        type: "boolean",
+        default: false,
+        desc: "Create private-chat-only bindings without union_id or endpoint_id"
+      }
+    ],
+    risk: "write",
+    dryRun: (ctx) => ({
+      method: "PUT",
+      url: "/api/cli/channel/v1/bindings/feishu",
+      body: batchDryRunBody(batchBindingPlan(ctx))
+    }),
+    execute: async (ctx) => {
+      const plan = batchBindingPlan(ctx);
+      const host = ctx.host();
+      const results = [];
+      for (const [index, binding] of plan.bindings.entries()) {
+        let bindingId;
+        try {
+          const path3 = "/api/cli/channel/v1/bindings/feishu";
+          assertCliChannelPath(path3);
+          const raw = await dependencies.put(
+            path3,
+            {
+              channel_id: plan.channelId,
+              te_user_id: binding.te_user_id,
+              open_id: binding.open_id,
+              ...binding.union_id && plan.endpointId ? { union_id: binding.union_id, endpoint_id: plan.endpointId } : {}
+            },
+            host
+          );
+          const created = unwrapCliChannelResponse(raw);
+          if (typeof created?.binding_id !== "string" || !created.binding_id) {
+            throw new Error("Feishu binding response did not include binding_id");
+          }
+          bindingId = created.binding_id;
+          const agentId = binding.agent_id ?? plan.defaultAgentId;
+          if (agentId) {
+            const agentPath = `/api/cli/channel/v1/bindings/${encodeId(bindingId)}/agent`;
+            assertCliChannelPath(agentPath);
+            await dependencies.put(agentPath, { agent_id: agentId }, host);
+          }
+          results.push({
+            index,
+            te_user_id: binding.te_user_id,
+            status: "succeeded",
+            binding_id: bindingId,
+            group_routing_ready: created.group_routing_ready === true,
+            ...agentId ? { agent_id: agentId } : {}
+          });
+        } catch (error) {
+          if (error instanceof PermissionError || error instanceof TeAgentApiError && error.status === 401) {
+            throw error;
+          }
+          results.push({
+            index,
+            te_user_id: binding.te_user_id,
+            status: "failed",
+            stage: bindingId ? "agent_assignment" : "binding",
+            ...bindingId ? { binding_id: bindingId } : {},
+            error: batchError(error)
+          });
+        }
+      }
+      const succeeded = results.filter((result) => result.status === "succeeded").length;
+      return {
+        total: results.length,
+        succeeded,
+        failed: results.length - succeeded,
+        results
+      };
+    }
+  };
+}
+var bindFeishuUsers = createBindFeishuUsersCommand();
+var unbindChannelUser = createCliChannelCommand({
+  resource: "channel binding",
+  command: "unbind",
+  description: "Delete one channel user binding",
+  flags: [
+    { name: "binding-id", type: "string", required: true, desc: "Binding ID" }
+  ],
+  risk: "high-risk-write",
+  prepare: (ctx) => ({
+    method: "DELETE",
+    path: `/api/cli/channel/v1/bindings/${encodeId(ctx.str("binding-id"))}`
+  })
+});
+var setChannelUserAgent = createCliChannelCommand({
+  resource: "channel binding",
+  command: "set-agent",
+  description: "Set the private-chat default Agent for one channel user binding",
+  flags: [
+    { name: "binding-id", type: "string", required: true, desc: "Binding ID" },
+    { name: "agent-id", type: "string", desc: "Agent ID to assign" },
+    {
+      name: "clear",
+      type: "boolean",
+      default: false,
+      desc: "Clear the binding Agent and restore system-default resolution"
+    }
+  ],
+  risk: "write",
+  prepare: (ctx) => {
+    const agentId = optionalString(ctx, "agent-id");
+    const clear = ctx.bool("clear");
+    if (Boolean(agentId) === clear) {
+      throw new CliValidationError("Pass exactly one of --agent-id or --clear");
+    }
+    return {
+      method: "PUT",
+      path: `/api/cli/channel/v1/bindings/${encodeId(ctx.str("binding-id"))}/agent`,
+      body: { agent_id: clear ? null : agentId }
+    };
+  }
+});
+var channelBindingCommands = [
+  listChannelBindings,
+  bindFeishuUser,
+  bindFeishuUsers,
+  unbindChannelUser,
+  setChannelUserAgent
 ];
 
 // src/commands/te-system/sandbox-tools.ts
@@ -2205,6 +2736,9 @@ var commands = [
   ...usageCommands,
   ...costControlCommands,
   ...channelCommands,
+  ...channelRoutingCommands,
+  ...channelWhatsAppCommands,
+  ...channelBindingCommands,
   ...sandboxToolCommands
 ];
 var te_system_default = commands;