@thinkingai/ae-cli 6.1.26 → 6.1.27

package/dist/{auth-YHMC3GDH.js → auth-WA7YGGRT.js}

@@ -9,13 +9,13 @@ import {
 } from "./chunk-6ZIQV5GW.js";
 import {
   resolveHost
-} from "./chunk-7QXISROD.js";
+} from "./chunk-OP44TT4H.js";
 import {
   getLocalCliPackageInfo,
   printError,
   printOutput,
   runHostCompatCheck
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import {
   CliTokenValidationUnavailableError,
   CredentialStoreUnreadableError,
@@ -31,13 +31,13 @@ import {
   saveCredential,
   updateCredentialMetadata,
   validateCliTokenOnServer
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   getFallbackCliToken,
   loadConfig,
   normalizeUrl,
   saveConfig
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   PermissionError,
   logger

package/dist/{automation-NWWVLWG2.js → automation-VAAQBM7Y.js}

@@ -5,10 +5,10 @@ import {
   getFromMainApp,
   patchToMainApp,
   postToMainApp
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/automation/index.ts

package/dist/{capability-3QLLIVFB.js → capability-GAAYJ3IQ.js}

@@ -11,7 +11,7 @@ import {
   inspectCapabilityWithEnvelope,
   listCapabilitiesWithEnvelope,
   validateCapabilityWithEnvelope
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   findGatewayDomain,
   listCapabilityDiscoveryPrefixes,
@@ -20,20 +20,20 @@ import {
 } from "./chunk-KPQY44JQ.js";
 import {
   resolveHost
-} from "./chunk-7QXISROD.js";
+} from "./chunk-OP44TT4H.js";
 import {
   printError,
   printOutput,
   withOutputMetadata
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   CredentialStoreUnreadableError,
   SecureStoreAuthError
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError,
   PermissionError

package/dist/{chunk-PLE722AJ.js → chunk-3YVEAZUN.js}

@@ -4,11 +4,11 @@ import {
 } from "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   PermissionError,
   isApiErrorType
@@ -82,19 +82,27 @@ function readLegacyCredentials() {
   }
 }
 function tryLoadTeAgentSandboxCredentials() {
-  const legacy = readLegacyCredentials();
-  const persistent = readPersistentEnv();
-  const url = process.env.TE_CLAUDE_BASE_URL || persistent?.TE_CLAUDE_BASE_URL || legacy?.url;
-  if (typeof url !== "string" || !url) {
-    return null;
+  const credentials = readSandboxCredentials();
+  return credentials.url ? { ...credentials, url: credentials.url } : null;
+}
+function readSandboxCredentials() {
+  let url = process.env.TE_CLAUDE_BASE_URL || null;
+  let sandboxId = process.env.SANDBOX_ID || null;
+  let sandboxSecretKey = process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY || null;
+  if (!url || !sandboxId || !sandboxSecretKey) {
+    const persistent = readPersistentEnv();
+    url ||= persistent?.TE_CLAUDE_BASE_URL || null;
+    sandboxId ||= persistent?.SANDBOX_ID || null;
+    sandboxSecretKey ||= persistent?.SECRET_KEY || persistent?.SANDBOX_SECRET_KEY || null;
   }
-  const sandboxId = process.env.SANDBOX_ID || persistent?.SANDBOX_ID || legacy?.sandboxId || null;
-  const sandboxSecretKey = process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY || persistent?.SECRET_KEY || persistent?.SANDBOX_SECRET_KEY || legacy?.sandboxSecretKey || legacy?.secretKey || null;
-  return {
-    url,
-    sandboxId: typeof sandboxId === "string" ? sandboxId : null,
-    sandboxSecretKey: typeof sandboxSecretKey === "string" ? sandboxSecretKey : null
-  };
+  if (!url || !sandboxId || !sandboxSecretKey) {
+    const legacy = readLegacyCredentials();
+    url ||= typeof legacy?.url === "string" ? legacy.url : null;
+    sandboxId ||= typeof legacy?.sandboxId === "string" ? legacy.sandboxId : null;
+    const legacySecret = legacy?.sandboxSecretKey || legacy?.secretKey;
+    sandboxSecretKey ||= typeof legacySecret === "string" ? legacySecret : null;
+  }
+  return { url, sandboxId, sandboxSecretKey };
 }
 function getClaudeConfigDir() {
   const fromEnv = process.env.CLAUDE_CONFIG_DIR;
@@ -190,7 +198,16 @@ function teClaudeBaseFromActiveHost(hostOverride) {
   return resolveTeClaudeBaseUrl(h);
 }
 async function signRequest(method, path2, hostOverride, includeJsonContentType = true) {
-  const sandboxCred = tryLoadTeAgentSandboxCredentials();
+  const configuredHost = hostOverride || getActiveHost();
+  const sandboxOnly = !hostOverride && (/* @__PURE__ */ new Set([
+    "/api/sandbox/models",
+    "/api/sandbox/models/select",
+    "/api/sandbox/sync/push",
+    "/api/sandbox/sync/push/skill",
+    "/api/sandbox/sync/pull",
+    "/api/sandbox/sync/pull/candidates"
+  ])).has(path2.split("?")[0]);
+  const sandboxCred = configuredHost && !sandboxOnly ? null : tryLoadTeAgentSandboxCredentials();
   if (!hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
     const headers = {
       "X-Sandbox-Id": sandboxCred.sandboxId,
@@ -212,7 +229,7 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
       "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
     );
   }
-  const hostForToken = hostOverride || getActiveHost() || baseUrl;
+  const hostForToken = configuredHost || baseUrl;
   const contentTypeHeader = includeJsonContentType && (method === "POST" || method === "PATCH" || method === "PUT") ? { "Content-Type": "application/json" } : {};
   const cliToken = await getCliToken(hostForToken);
   return {
@@ -499,7 +516,6 @@ async function uploadToMainApp(path2, formData, hostOverride) {
 
 export {
   TeAgentCredentialsError,
-  tryLoadTeAgentSandboxCredentials,
   getClaudeConfigDir,
   resolveTeClaudeBaseUrl,
   TeAgentApiError,

package/dist/{chunk-KFNMQTZI.js → chunk-6VNIR4AP.js}

@@ -1,13 +1,13 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   peekCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   getActiveHost,
   getConfigDir,
   isAeSandboxRuntime,
   normalizeUrl
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   logger
 } from "./chunk-WNGFSIOB.js";

package/dist/{chunk-FMNNGNYO.js → chunk-7KU2WNQE.js}

@@ -1,14 +1,14 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   CapabilityGatewayError
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   SecureStoreAuthError,
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   PermissionError
 } from "./chunk-WNGFSIOB.js";

package/dist/{chunk-XCHAYMSF.js → chunk-AQJPNWZF.js}

@@ -3,7 +3,7 @@ import {
   CapabilityGatewayError,
   fetchCapabilityGateway,
   requestCapabilityGateway
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
@@ -11,7 +11,7 @@ import {
   readOutputMetadata,
   unwrapOutputData,
   withOutputMetadata
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import {
   PermissionError
 } from "./chunk-WNGFSIOB.js";

package/dist/{chunk-4655PUNX.js → chunk-CI24BDR2.js}

@@ -7,7 +7,7 @@ import {
   postToMainApp,
   putToMainApp,
   uploadToMainApp
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 
 // src/commands/te-agent/api-client.ts
 function getAgentApi(ctx, path) {

package/dist/{chunk-GIK6EDUG.js → chunk-GHXZK54S.js}

@@ -6,7 +6,7 @@ import {
   normalizeUrl,
   safeJsonParse,
   safeReadJsonFile
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   PermissionError,
   logger

package/dist/{chunk-KAEHZZH4.js → chunk-MWIA43UJ.js}

@@ -3,13 +3,13 @@ import {
   dryRunCapability,
   executeCapabilityWithEnvelope,
   validateCapability
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
 import {
   withOutputMetadata
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/dist/{chunk-7QXISROD.js → chunk-OP44TT4H.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from 'node:module'; const require =
 import {
   getActiveHost,
   normalizeUrl
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 
 // src/core/auth.ts
 function resolveHost(hostOverride) {

package/dist/{chunk-HVHR4SCP.js → chunk-Q5US7JC5.js}

@@ -9,11 +9,11 @@ import {
   postAgentApi,
   putAgentApi,
   uploadAgentApi
-} from "./chunk-4655PUNX.js";
+} from "./chunk-CI24BDR2.js";
 import {
   TeAgentApiError,
   createTeAgentApiError
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import {
   CliValidationError,
   isApiErrorType

package/dist/{chunk-D6ACFILC.js → chunk-RPBOAQQQ.js}

@@ -3,7 +3,7 @@ import {
   getAgentApi,
   patchAgentApi,
   postAgentApi
-} from "./chunk-4655PUNX.js";
+} from "./chunk-CI24BDR2.js";
 
 // src/commands/memory/cli-client.ts
 var DEFAULT_TE_CLAUDE_BASE_PATH = "/agent";

package/dist/{chunk-EOYSKMXN.js → chunk-VZZNLV3I.js}

@@ -6,10 +6,10 @@ import {
   SecureStoreAuthError,
   clearCliTokenCache,
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   PermissionError
 } from "./chunk-WNGFSIOB.js";

package/dist/{chunk-UQ77JXYH.js → chunk-ZL7SGNIA.js}

@@ -284,6 +284,7 @@ export {
   normalizeUrl,
   getSandboxRuntimeRoot,
   isAeSandboxRuntime,
+  readSandboxCliTokenEntry,
   getFallbackCliToken,
   loadConfig,
   saveConfig,

package/dist/{config-AHPMEW5A.js → config-JOD5DOPE.js}

@@ -12,10 +12,10 @@ import {
   printError,
   printOutput,
   resolveKbAutoDiscoveryFeature
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import {
   peekCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   addHost,
   getActiveHost,
@@ -26,7 +26,7 @@ import {
   resolveHostSelector,
   setActiveHost,
   updateHostLabel
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/config.ts

package/dist/{context-YAE3QXP3.js → context-NGVFPCBK.js}

@@ -2,12 +2,12 @@ import { createRequire as __createRequire } from 'node:module'; const require =
 import {
   TeAgentApiError,
   getFromMainApp
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
+import "./chunk-GHXZK54S.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/dist/{data-integration-HESZET7E.js → data-integration-BCLQFTGU.js}

@@ -16,7 +16,7 @@ import {
 import "./chunk-S6M42KND.js";
 import {
   getConfigDir
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError,
   LocalDataUploadError,

package/dist/index.js

@@ -24,15 +24,15 @@ import "./chunk-S6M42KND.js";
 import {
   TeAgentApiError,
   TeAgentCredentialsError
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import {
   CapabilityGatewayError,
   executeCapability,
   uploadInputFileBytes
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   resolveHost
-} from "./chunk-7QXISROD.js";
+} from "./chunk-OP44TT4H.js";
 import {
   failInstallation,
   fetchCliConfig,
@@ -45,19 +45,19 @@ import {
   resolveKbAutoDiscoveryFeature,
   runHostCompatCheck,
   shouldSkipAutoSync
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   CredentialStoreUnreadableError,
   SecureStoreAuthError,
   getCliToken,
   peekCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   getActiveHost,
   getConfigDir,
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliApiError,
   CliValidationError,
@@ -2435,105 +2435,105 @@ function warnLoadFailure(label, err) {
 async function loadCommands() {
   const commands = [];
   try {
-    const teAnalysis = await import("./te-analysis-2ECAAIFK.js");
+    const teAnalysis = await import("./te-analysis-GP7DSQ7Q.js");
     commands.push(...teAnalysis.default);
   } catch (err) {
     warnLoadFailure("domain te-analysis", err);
   }
   try {
-    const engage = await import("./te-engage-QKUGIWSR.js");
+    const engage = await import("./te-engage-2CO6LRCX.js");
     commands.push(...engage.default);
   } catch (err) {
     warnLoadFailure("domain te-engage", err);
   }
   try {
-    const experiment = await import("./te-experiment-26PXR2UO.js");
+    const experiment = await import("./te-experiment-652CLXMU.js");
     commands.push(...experiment.default);
   } catch (err) {
     warnLoadFailure("domain te-experiment", err);
   }
   try {
-    const community = await import("./te-community-PFLDLPP4.js");
+    const community = await import("./te-community-42M7ICDO.js");
     commands.push(...community.default);
   } catch (err) {
     warnLoadFailure("domain te-community", err);
   }
   try {
-    const dataops = await import("./te-dataops-FOQSRIAZ.js");
+    const dataops = await import("./te-dataops-BNKNZ4F2.js");
     commands.push(...dataops.default);
   } catch (err) {
     warnLoadFailure("domain te-dataops", err);
   }
   try {
-    const teKb = await import("./te-kb-MHDOST62.js");
+    const teKb = await import("./te-kb-ULATOTQ3.js");
     commands.push(...teKb.default);
   } catch (err) {
     warnLoadFailure("domain te-kb", err);
   }
   try {
-    const teTeam = await import("./te-team-5UOZPTU3.js");
+    const teTeam = await import("./te-team-YA6SNOJ3.js");
     commands.push(...teTeam.default);
   } catch (err) {
     warnLoadFailure("domain te-team", err);
   }
   try {
-    const teAgent = await import("./te-agent-F5QBZSQA.js");
+    const teAgent = await import("./te-agent-AORRE2FM.js");
     commands.push(...teAgent.default);
   } catch (err) {
     warnLoadFailure("domain te-agent", err);
   }
   try {
-    const memory = await import("./memory-62BJOULV.js");
+    const memory = await import("./memory-CQKH2JAV.js");
     commands.push(...memory.default);
   } catch (err) {
     warnLoadFailure("domain memory", err);
   }
-  const automation = await import("./automation-NWWVLWG2.js");
+  const automation = await import("./automation-VAAQBM7Y.js");
   commands.push(...automation.default);
   try {
-    const things = await import("./things-VPPXXLHB.js");
+    const things = await import("./things-DTCOQIQB.js");
     commands.push(...things.default);
   } catch (err) {
     warnLoadFailure("domain things", err);
   }
   try {
-    const workspace = await import("./workspace-O3EEIYQM.js");
+    const workspace = await import("./workspace-JEOHKFPX.js");
     commands.push(...workspace.default);
   } catch (err) {
     warnLoadFailure("domain workspace", err);
   }
   try {
-    const teSystem = await import("./te-system-J2FQF5ER.js");
+    const teSystem = await import("./te-system-UGHVKBVV.js");
     commands.push(...teSystem.default);
   } catch (err) {
     warnLoadFailure("domain te-system", err);
   }
   try {
-    const metadata = await import("./metadata-C7CEDHOJ.js");
+    const metadata = await import("./metadata-NR3PHR23.js");
     commands.push(...metadata.default);
   } catch (err) {
     warnLoadFailure("domain metadata", err);
   }
   try {
-    const personalSemanticPreference = await import("./personal-semantic-preference-QECDPHND.js");
+    const personalSemanticPreference = await import("./personal-semantic-preference-2RAI36P3.js");
     commands.push(...personalSemanticPreference.default);
   } catch (err) {
     warnLoadFailure("domain personal-semantic-preference", err);
   }
   try {
-    const projectSemantic = await import("./project-semantic-Z4QAMBWF.js");
+    const projectSemantic = await import("./project-semantic-3BUGP3ZM.js");
     commands.push(...projectSemantic.default);
   } catch (err) {
     warnLoadFailure("domain project-semantic", err);
   }
   try {
-    const dataIntegration = await import("./data-integration-HESZET7E.js");
+    const dataIntegration = await import("./data-integration-BCLQFTGU.js");
     commands.push(...dataIntegration.default);
   } catch (err) {
     warnLoadFailure("domain data-integration", err);
   }
   try {
-    const context = await import("./context-YAE3QXP3.js");
+    const context = await import("./context-NGVFPCBK.js");
     commands.push(...context.default);
   } catch (err) {
     warnLoadFailure("domain context", err);
@@ -2542,7 +2542,7 @@ async function loadCommands() {
 }
 async function registerAuthCommands() {
   try {
-    const { registerAuth } = await import("./auth-YHMC3GDH.js");
+    const { registerAuth } = await import("./auth-WA7YGGRT.js");
     registerAuth(program);
   } catch (err) {
     warnLoadFailure("auth commands", err);
@@ -2550,7 +2550,7 @@ async function registerAuthCommands() {
 }
 async function registerConfigCommands() {
   try {
-    const { registerConfig } = await import("./config-AHPMEW5A.js");
+    const { registerConfig } = await import("./config-JOD5DOPE.js");
     registerConfig(program);
   } catch (err) {
     warnLoadFailure("config commands", err);
@@ -2558,7 +2558,7 @@ async function registerConfigCommands() {
 }
 async function registerCapabilityCommands() {
   try {
-    const { registerCapability } = await import("./capability-3QLLIVFB.js");
+    const { registerCapability } = await import("./capability-GAAYJ3IQ.js");
     registerCapability(program);
   } catch (err) {
     warnLoadFailure("capability commands", err);
@@ -2566,7 +2566,7 @@ async function registerCapabilityCommands() {
 }
 async function registerSyncCommand() {
   try {
-    const { registerSync } = await import("./sync-SU33KYX7.js");
+    const { registerSync } = await import("./sync-RZIAV37C.js");
     registerSync(program);
   } catch (err) {
     warnLoadFailure("sync commands", err);
@@ -2574,7 +2574,7 @@ async function registerSyncCommand() {
 }
 async function registerModelCommand() {
   try {
-    const { registerModel } = await import("./model-SBV2JFJI.js");
+    const { registerModel } = await import("./model-VX5M2CJ6.js");
     registerModel(program);
   } catch (err) {
     warnLoadFailure("model commands", err);
@@ -2582,7 +2582,7 @@ async function registerModelCommand() {
 }
 async function registerUpdateCommand() {
   try {
-    const { registerUpdate } = await import("./update-EEUTEI6R.js");
+    const { registerUpdate } = await import("./update-ESNYKUVR.js");
     registerUpdate(program);
   } catch (err) {
     warnLoadFailure("update commands", err);

package/dist/{memory-62BJOULV.js → memory-CQKH2JAV.js}

@@ -4,15 +4,15 @@ import {
   getMemoryCli,
   patchMemoryCli,
   postMemoryCli
-} from "./chunk-D6ACFILC.js";
+} from "./chunk-RPBOAQQQ.js";
 import {
   currentAgentSpaceId
 } from "./chunk-RK6GLDGI.js";
-import "./chunk-4655PUNX.js";
-import "./chunk-PLE722AJ.js";
+import "./chunk-CI24BDR2.js";
+import "./chunk-3YVEAZUN.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/dist/{metadata-C7CEDHOJ.js → metadata-NR3PHR23.js}

@@ -1,18 +1,18 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   withAsyncArtifactLifecycle
-} from "./chunk-XCHAYMSF.js";
+} from "./chunk-AQJPNWZF.js";
 import {
   createCapabilityCommand
-} from "./chunk-KAEHZZH4.js";
-import "./chunk-EOYSKMXN.js";
+} from "./chunk-MWIA43UJ.js";
+import "./chunk-VZZNLV3I.js";
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-KPQY44JQ.js";
-import "./chunk-KFNMQTZI.js";
+import "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/metadata/shared.ts

package/dist/{model-SBV2JFJI.js → model-VX5M2CJ6.js}

@@ -15,10 +15,10 @@ import {
   getClaudeConfigDir,
   getSandboxModels,
   postSandboxModelSelection
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/model/index.ts

package/dist/{personal-semantic-preference-QECDPHND.js → personal-semantic-preference-2RAI36P3.js}

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   createCapabilityCommand
-} from "./chunk-KAEHZZH4.js";
-import "./chunk-EOYSKMXN.js";
+} from "./chunk-MWIA43UJ.js";
+import "./chunk-VZZNLV3I.js";
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-KPQY44JQ.js";
-import "./chunk-KFNMQTZI.js";
+import "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/personal-semantic-preference/shared.ts

package/dist/{project-semantic-Z4QAMBWF.js → project-semantic-3BUGP3ZM.js}

@@ -3,21 +3,21 @@ import {
   assertOutputPathAvailable,
   downloadAnalysisArtifact,
   withAsyncArtifactLifecycle
-} from "./chunk-XCHAYMSF.js";
+} from "./chunk-AQJPNWZF.js";
 import {
   CapabilityGatewayError,
   dryRunCapability,
   executeCapabilityWithEnvelope,
   validateCapability
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
-import "./chunk-KFNMQTZI.js";
+import "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/project-semantic/asset-package/materializer.ts

package/dist/{sync-SU33KYX7.js → sync-RZIAV37C.js}

@@ -33,13 +33,13 @@ import {
   postSandboxSyncPull,
   postToMainApp,
   uploadToMainApp
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import {
   printError
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   __toESM
 } from "./chunk-WNGFSIOB.js";

package/dist/{te-agent-F5QBZSQA.js → te-agent-AORRE2FM.js}

@@ -11,7 +11,7 @@ import {
   workspaceResourcePath,
   workspaceTargetFlags,
   workspaceTargetPath
-} from "./chunk-HVHR4SCP.js";
+} from "./chunk-Q5US7JC5.js";
 import {
   currentAgentSpaceId
 } from "./chunk-RK6GLDGI.js";
@@ -23,17 +23,17 @@ import {
   postAgentApi,
   putAgentApi,
   uploadAgentApi
-} from "./chunk-4655PUNX.js";
+} from "./chunk-CI24BDR2.js";
 import {
   resolveTeClaudeBaseUrl
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import {
   buildCapabilityGatewayUrl,
   callCapabilityApi
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/dist/{te-analysis-2ECAAIFK.js → te-analysis-GP7DSQ7Q.js}

@@ -7,12 +7,12 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-XCHAYMSF.js";
+} from "./chunk-AQJPNWZF.js";
 import {
   createCapabilityCommand,
   definitionIntentSnapshotFlag,
   modelDefinitionIntentSnapshotFlag
-} from "./chunk-KAEHZZH4.js";
+} from "./chunk-MWIA43UJ.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -26,19 +26,19 @@ import {
   uploadInputFile,
   validateCapability,
   validateCapabilityWithEnvelope
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
 import {
   withOutputMetadata
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+} from "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/dist/{te-community-PFLDLPP4.js → te-community-42M7ICDO.js}

@@ -8,11 +8,11 @@ import {
 import {
   SecureStoreAuthError,
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   getActiveHost,
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError,
   PermissionError,

package/dist/{te-dataops-FOQSRIAZ.js → te-dataops-BNKNZ4F2.js}

@@ -1,20 +1,20 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   resolveHost
-} from "./chunk-7QXISROD.js";
+} from "./chunk-OP44TT4H.js";
 import {
   printError
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import {
   internalCallSourceHeaders
 } from "./chunk-Y74WTIKJ.js";
 import {
   SecureStoreAuthError,
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliApiError,
   CliValidationError,

package/dist/{te-engage-QKUGIWSR.js → te-engage-2CO6LRCX.js}

@@ -1,14 +1,14 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   createCapabilityCommand
-} from "./chunk-KAEHZZH4.js";
+} from "./chunk-MWIA43UJ.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
   fetchCapabilityGateway,
   requestCapabilityGateway,
   requestCapabilityGatewayWithEnvelope
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
@@ -16,10 +16,10 @@ import {
 import {
   printError,
   withOutputMetadata
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/dist/{te-experiment-26PXR2UO.js → te-experiment-652CLXMU.js}

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   createCapabilityCommand
-} from "./chunk-KAEHZZH4.js";
-import "./chunk-EOYSKMXN.js";
+} from "./chunk-MWIA43UJ.js";
+import "./chunk-VZZNLV3I.js";
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-KPQY44JQ.js";
-import "./chunk-KFNMQTZI.js";
+import "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/te-experiment/capability-shared.ts

package/dist/{te-kb-MHDOST62.js → te-kb-ULATOTQ3.js}

@@ -2,19 +2,19 @@ import { createRequire as __createRequire } from 'node:module'; const require =
 import {
   kbApi,
   kbUpload
-} from "./chunk-FMNNGNYO.js";
+} from "./chunk-7KU2WNQE.js";
 import {
   TeAgentApiError
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import {
   CapabilityGatewayError
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import {
   printError
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError,
   PermissionError

package/dist/{te-system-J2FQF5ER.js → te-system-UGHVKBVV.js}

@@ -11,14 +11,15 @@ import {
   patchToMainApp,
   postToMainApp,
   putToMainApp,
-  tryLoadTeAgentSandboxCredentials,
   uploadToMainApp
-} from "./chunk-PLE722AJ.js";
+} from "./chunk-3YVEAZUN.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
+import "./chunk-GHXZK54S.js";
 import {
+  isAeSandboxRuntime,
+  readSandboxCliTokenEntry,
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError,
   PermissionError,
@@ -2369,8 +2370,8 @@ async function requireUploadPolicy(ctx) {
   return policy;
 }
 function requireLinuxSandbox() {
-  const credentials = tryLoadTeAgentSandboxCredentials();
-  if (process.platform !== "linux" || !credentials?.sandboxId || !credentials.sandboxSecretKey) {
+  const legacyRuntime = Boolean(process.env.SANDBOX_ID && (process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY));
+  if (process.platform !== "linux" || !(isAeSandboxRuntime() || legacyRuntime || readSandboxCliTokenEntry())) {
     throw new CliValidationError(
       "+npm-install must run inside a Linux te-agent sandbox",
       {

package/dist/{te-team-5UOZPTU3.js → te-team-YA6SNOJ3.js}

@@ -2,15 +2,15 @@ import { createRequire as __createRequire } from 'node:module'; const require =
 import {
   getAuthHeaders,
   kbApi
-} from "./chunk-FMNNGNYO.js";
-import "./chunk-EOYSKMXN.js";
+} from "./chunk-7KU2WNQE.js";
+import "./chunk-VZZNLV3I.js";
 import {
   printError,
   printOutput
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/te-team/shared.ts

package/dist/{things-VPPXXLHB.js → things-DTCOQIQB.js}

@@ -1,17 +1,17 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   resolveMemoryApiBaseUrl
-} from "./chunk-D6ACFILC.js";
-import "./chunk-4655PUNX.js";
-import "./chunk-PLE722AJ.js";
+} from "./chunk-RPBOAQQQ.js";
+import "./chunk-CI24BDR2.js";
+import "./chunk-3YVEAZUN.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
   callCapabilityApi
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-VZZNLV3I.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   PermissionError
 } from "./chunk-WNGFSIOB.js";

package/dist/{update-EEUTEI6R.js → update-ESNYKUVR.js}

@@ -14,13 +14,13 @@ import {
   printError,
   printOutput,
   recordVersionSyncResult
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-6VNIR4AP.js";
 import {
   peekCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-GHXZK54S.js";
 import {
   getActiveHost
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZL7SGNIA.js";
 import "./chunk-WNGFSIOB.js";
 
 // src/commands/update.ts

package/dist/{workspace-O3EEIYQM.js → workspace-JEOHKFPX.js}

@@ -13,15 +13,15 @@ import {
   workspaceResourcePath,
   workspaceTargetFlags,
   workspaceTargetPath
-} from "./chunk-HVHR4SCP.js";
+} from "./chunk-Q5US7JC5.js";
 import "./chunk-RK6GLDGI.js";
 import {
   getAgentBuffer
-} from "./chunk-4655PUNX.js";
-import "./chunk-PLE722AJ.js";
+} from "./chunk-CI24BDR2.js";
+import "./chunk-3YVEAZUN.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GIK6EDUG.js";
-import "./chunk-UQ77JXYH.js";
+import "./chunk-GHXZK54S.js";
+import "./chunk-ZL7SGNIA.js";
 import {
   CliValidationError
 } from "./chunk-WNGFSIOB.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkingai/ae-cli",
-  "version": "6.1.26",
+  "version": "6.1.27",
   "description": "CLI tool for ThinkingAI (AE) analytics platform",
   "type": "module",
   "bin": {
@@ -49,7 +49,7 @@
     "verify:analysis-common-tools": "node scripts/verify-te-common-tools.mjs",
     "verify:experiment-tools": "node scripts/verify-te-experiment-tools.mjs && node --import tsx test/experiment/experiment-capability-command.test.mjs",
     "verify:team-tools": "node scripts/verify-te-team-tools.mjs",
-    "verify:agent-tools": "node --test test/agent-command-registry.test.mjs && tsx tests/te-agent-credentials.test.ts && tsx tests/te-agent-unified-auth.test.ts && tsx tests/te-agent-conversations.test.ts && tsx scripts/verify-agent-tools.mjs && npm run verify:approval && npm run verify:agent-distribution && npm run verify:agent-context && npm run verify:sandbox-tools && npm run verify:notifications",
+    "verify:agent-tools": "node --test test/agent-command-registry.test.mjs && tsx tests/te-agent-credentials.test.ts && tsx tests/te-agent-unified-auth.test.ts && node --import tsx --test tests/te-agent-env-isolation.test.ts && tsx tests/te-agent-conversations.test.ts && tsx scripts/verify-agent-tools.mjs && npm run verify:approval && npm run verify:agent-distribution && npm run verify:agent-context && npm run verify:sandbox-tools && npm run verify:notifications",
     "verify:agent-context": "tsx tests/agent-context-command.test.ts",
     "verify:cli-agent-model-context": "tsx --test tests/cli-agent-model-context.test.ts",
     "verify:analysis-feedback": "tsx --test tests/analysis-feedback-command.test.ts",

package/skills/ae-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ae-agent
-version: 2.0.0
+version: 2.0.1
 description: "AE Agent platform CLI for Agent, notification, approval, archived conversation, model, MCP, Skill, attachment, and user-memory work. Use when managing these resources, browsing Agent markets, handling approval requests and tasks, restoring archived conversations, persisting user memory, or answering from user preferences, background, stable workflows, or historical conventions."
 ---
 
@@ -13,6 +13,8 @@ description: "AE Agent platform CLI for Agent, notification, approval, archived
 > **CRITICAL — Never guess record IDs (Agent / model / MCP / Skill / submission / share / attachment).** Always use the appropriate `+list-*` command to discover real IDs first.
 > **CRITICAL — Legacy Agent CRUD uses `/api/sandbox/agent/*`; Agent distribution and generic approvals use CLI-token-only `/api/cli/agent/v1/*` and `/api/cli/approval/v1/*`; AgentSpace memory uses `/api/cli/memory/v2/*`.** Do not use Web session, sandbox credentials, or memory v1 paths for CLI-token endpoints.
 
+Agent API requests with an explicit or configured host use CLI-token authentication without reading legacy sandbox `.env` or `credentials.json` files. Legacy model/sync routes outside Agent CRUD retain sandbox identity for authentication and workspace updates. Do not change file permissions or copy secrets to work around authentication errors.
+
 `CREDENTIAL_STORE_UNREADABLE` (`error.type: config`) means local credentials exist but cannot be read or decrypted. Preserve the files and retry in the original OS user/runtime with machine-identifier access. Do not automatically log in, import another token, or log out; this error does not establish server-side token expiration.
 
 AE CLI (`ae-cli`) agent platform resource commands are invoked through: