@thinkingai/ae-cli 6.1.27 → 6.1.28

package/dist/{automation-VAAQBM7Y.js → automation-K32V2NKP.js}

@@ -1,15 +1,22 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  resolveWorkspaceTarget
+} from "./chunk-UUD5RB36.js";
+import {
+  currentAgentSpaceId
+} from "./chunk-RK6GLDGI.js";
+import "./chunk-JJJIP2XQ.js";
 import {
   TeAgentApiError,
   deleteFromMainApp,
   getFromMainApp,
   patchToMainApp,
   postToMainApp
-} from "./chunk-3YVEAZUN.js";
+} from "./chunk-2UWS5CUP.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GHXZK54S.js";
-import "./chunk-ZL7SGNIA.js";
-import "./chunk-WNGFSIOB.js";
+import "./chunk-P7KL7IOH.js";
+import "./chunk-LMCYSVVA.js";
+import "./chunk-ZW4VMY5H.js";
 
 // src/commands/automation/index.ts
 import { randomUUID } from "crypto";
@@ -24,7 +31,7 @@ var typeFlag = flag(
 );
 var scopeFlag = flag(
   "agent-space-id",
-  "Explicit space; otherwise server resolves sandbox context or personal space"
+  "Explicit space; otherwise current AgentSpace, then personal space"
 );
 var runFlag = flag(
   "run-id",
@@ -62,7 +69,21 @@ var configFlags = [
   flag("time", "HH:mm in server timezone"),
   flag("minute", "Hourly minute, 0-59", "number"),
   flag("weekday", "Weekly day, 0=Sunday through 6=Saturday", "number"),
-  flag("day-of-month", "Monthly day, 1-28", "number"),
+  flag(
+    "weekdays",
+    "Weekly days as JSON array, 0=Sunday through 6=Saturday",
+    "json"
+  ),
+  flag(
+    "day-of-month",
+    "Monthly day, 1-31; missing dates are skipped",
+    "number"
+  ),
+  flag(
+    "days-of-month",
+    'Monthly days as JSON array: integers 1-31 or "L" for last day; missing dates are skipped',
+    "json"
+  ),
   flag("model", "Agent model configuration ID; null clears the override"),
   flag("reuse-conversation", "Agent: true | false", "json"),
   {
@@ -71,12 +92,12 @@ var configFlags = [
   },
   flag(
     "channels",
-    "Team notification channel array; [] clears channels",
+    "Agent or Team notification channel array; [] clears external notifications",
     "json"
   ),
-  flag("feishu-chat-id", "Team Feishu destination; null clears it"),
-  flag("lark-chat-id", "Team Lark destination; null clears it"),
-  flag("slack-channel-id", "Team Slack destination; null clears it"),
+  flag("feishu-chat-id", "Feishu destination; null clears it"),
+  flag("lark-chat-id", "Lark destination; null clears it"),
+  flag("slack-channel-id", "Slack destination; null clears it"),
   flag(
     "save-to-knowledge-base-id",
     "Team output knowledge base ID; null clears it"
@@ -133,11 +154,33 @@ function configuration(ctx, create) {
   const kind = ctx.str("scheduleKind"), cron = ctx.str("cronExpression");
   enumValue(kind, ["hourly", "daily", "weekly", "monthly"], "schedule-kind");
   if (kind && cron) throw new Error("Use --schedule-kind or --cron-expression");
-  if (!kind && ["time", "minute", "weekday", "dayOfMonth"].some((name2) => ctx.str(name2)))
+  if (!kind && (["time", "minute", "weekday", "dayOfMonth"].some(
+    (name2) => ctx.str(name2)
+  ) || ctx.json("weekdays") !== void 0 || ctx.json("daysOfMonth") !== void 0))
     throw new Error("Schedule details require --schedule-kind");
-  if (kind && ctx.str("weekday") && kind !== "weekly" || kind && ctx.str("dayOfMonth") && kind !== "monthly" || kind && ctx.str("minute") && kind !== "hourly")
+  if (kind && (ctx.str("weekday") || ctx.json("weekdays") !== void 0) && kind !== "weekly" || kind && (ctx.str("dayOfMonth") || ctx.json("daysOfMonth") !== void 0) && kind !== "monthly" || kind && ctx.str("minute") && kind !== "hourly")
     throw new Error("Schedule field is not applicable to this frequency");
   if (kind) {
+    const dateSelection = (single, multiple, min, max, label, allowLastDay = false) => {
+      const values = ctx.json(multiple);
+      if (values === void 0)
+        return {
+          [single]: range(ctx.optionalNum(single) ?? NaN, min, max, label)
+        };
+      if (ctx.optionalNum(single) !== void 0)
+        throw new Error(`Use --${label} or its plural array, not both`);
+      if (!Array.isArray(values) || !values.length || values.length > max - min + 1 + Number(allowLastDay) || values.some(
+        (value) => !(allowLastDay && value === "L") && (!Number.isInteger(value) || value < min || value > max)
+      ))
+        throw new Error(
+          `${multiple} must be a non-empty JSON array of integers from ${min} to ${max}${allowLastDay ? ' or "L" for last day' : ""}`
+        );
+      return {
+        [multiple]: [...new Set(values)].sort(
+          (a, b) => (a === "L" ? 32 : a) - (b === "L" ? 32 : b)
+        )
+      };
+    };
     const schedule = { kind };
     if (kind === "hourly")
       schedule.minute = range(ctx.optionalNum("minute") ?? 0, 0, 59, "minute");
@@ -146,18 +189,21 @@ function configuration(ctx, create) {
         throw new Error("--time must use HH:mm");
       schedule.time = ctx.str("time");
       if (kind === "weekly")
-        schedule.weekday = range(
-          ctx.optionalNum("weekday") ?? NaN,
-          0,
-          6,
-          "weekday"
+        Object.assign(
+          schedule,
+          dateSelection("weekday", "weekdays", 0, 6, "weekday")
         );
       if (kind === "monthly")
-        schedule.dayOfMonth = range(
-          ctx.optionalNum("dayOfMonth") ?? NaN,
-          1,
-          28,
-          "day-of-month"
+        Object.assign(
+          schedule,
+          dateSelection(
+            "dayOfMonth",
+            "daysOfMonth",
+            1,
+            31,
+            "day-of-month",
+            true
+          )
         );
     }
     result.schedule = schedule;
@@ -165,8 +211,11 @@ function configuration(ctx, create) {
   if (cron) {
     const parts = cron.trim().split(/\s+/);
     const validNumber = (v, a, b) => /^\d+$/.test(v) && Number(v) >= a && Number(v) <= b;
+    const validDays = (v, a, b, allowLastDay = false) => v.split(",").length <= b - a + 1 + Number(allowLastDay) && v.split(",").every(
+      (day) => allowLastDay && day === "L" || validNumber(day, a, b)
+    );
     const [m, h, d, mo, w] = parts;
-    if (parts.length !== 5 || !validNumber(m, 0, 59) || !(h === "*" || validNumber(h, 0, 23)) || mo !== "*" || !(d === "*" || validNumber(d, 1, 28)) || !(w === "*" || validNumber(w, 0, 6)) || d !== "*" && w !== "*" || h === "*" && (d !== "*" || w !== "*"))
+    if (parts.length !== 5 || !validNumber(m, 0, 59) || !(h === "*" || validNumber(h, 0, 23)) || mo !== "*" || !(d === "*" || validDays(d, 1, 31, true)) || !(w === "*" || validDays(w, 0, 6)) || d !== "*" && w !== "*" || h === "*" && (d !== "*" || w !== "*"))
       throw new Error(
         "--cron-expression must specify an hourly, daily, weekly or monthly schedule"
       );
@@ -175,19 +224,18 @@ function configuration(ctx, create) {
   if (create && (ctx.str("triggerType") || "scheduled") === "scheduled" && !kind && !cron)
     throw new Error("Scheduled automation requires a schedule");
   const agentNames = ["model", "reuseConversation"];
-  const teamNames = [
-    "scope",
+  const teamNames = ["scope", "saveToKnowledgeBaseId"];
+  const notificationNames = [
     "channels",
     "feishuChatId",
     "larkChatId",
-    "slackChannelId",
-    "saveToKnowledgeBaseId"
+    "slackChannelId"
   ];
-  for (const name2 of [...agentNames, ...teamNames]) {
+  for (const name2 of [...agentNames, ...teamNames, ...notificationNames]) {
     const json = ["scope", "channels", "reuseConversation"].includes(name2);
     const value = json ? ctx.json(name2) : ctx.str(name2) || void 0;
     if (value === void 0) continue;
-    if ((agentNames.includes(name2) ? "agent" : "team") !== targetType)
+    if (!notificationNames.includes(name2) && (agentNames.includes(name2) ? "agent" : "team") !== targetType)
       throw new Error(`${name2} is not applicable to ${targetType} automations`);
     if (name2 === "reuseConversation" && typeof value !== "boolean")
       throw new Error("--reuse-conversation must be true or false");
@@ -217,9 +265,13 @@ function configuration(ctx, create) {
   if (create) result.triggerImmediately = ctx.bool("triggerImmediately");
   return result;
 }
-function query(ctx, list = false, typed = false) {
+async function query(ctx, list = false, typed = false) {
   const p = new URLSearchParams();
-  if (ctx.str("agentSpaceId")) p.set("agentSpaceId", ctx.str("agentSpaceId"));
+  let spaceId = ctx.str("agentSpaceId").trim() || currentAgentSpaceId();
+  if (!spaceId && process.env.TE_AGENT_CONVERSATION_ID?.trim()) {
+    spaceId = (await resolveWorkspaceTarget(ctx)).agentSpaceId;
+  }
+  if (spaceId) p.set("agentSpaceId", spaceId);
   if (typed && ctx.str("targetType"))
     p.set("targetType", ctx.str("targetType"));
   if (list) {
@@ -232,23 +284,27 @@ async function request(ctx, method, path, body) {
   if (method === "GET")
     return getFromMainApp(
       path,
-      ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+      ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+      "cli-token"
     );
   if (method === "POST")
     return postToMainApp(
       path,
       body,
-      ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+      ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+      "cli-token"
     );
   if (method === "PATCH")
     return patchToMainApp(
       path,
       body,
-      ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+      ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+      "cli-token"
     );
   return deleteFromMainApp(
     path,
-    ctx.hostOverride ? ctx.hostOverride() : ctx.host()
+    ctx.hostOverride ? ctx.hostOverride() : ctx.host(),
+    "cli-token"
   );
 }
 function withDryRun(path) {
@@ -267,7 +323,7 @@ async function waitForRun(ctx, id, runId) {
     const result = await request(
       ctx,
       "GET",
-      `${base}/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/result${query(ctx)}`
+      `${base}/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/result${await query(ctx)}`
     );
     if (result.status !== "running")
       return { ...result, executionCompleted: true, timedOut: false };
@@ -397,7 +453,7 @@ var automationCommands = actions.map((a) => ({
       ...body,
       ...a.wait ? { commandId } : {}
     };
-    const path = base + a.suffix(ctx) + query(ctx, a.list, a.typed);
+    const path = base + a.suffix(ctx) + await query(ctx, a.list, a.typed);
     return {
       request: redactedPreview(a.method, path, requestBody),
       validation: await request(ctx, a.method, withDryRun(path), requestBody)
@@ -410,7 +466,7 @@ var automationCommands = actions.map((a) => ({
       output = await request(
         ctx,
         a.method,
-        base + a.suffix(ctx) + query(ctx, a.list, a.typed),
+        base + a.suffix(ctx) + await query(ctx, a.list, a.typed),
         body && { ...body, ...a.wait ? { commandId } : {} }
       );
     } catch (error) {

package/dist/{capability-GAAYJ3IQ.js → capability-4CGSL7PK.js}

@@ -11,7 +11,7 @@ import {
   inspectCapabilityWithEnvelope,
   listCapabilitiesWithEnvelope,
   validateCapabilityWithEnvelope
-} from "./chunk-VZZNLV3I.js";
+} from "./chunk-QW3R6O7L.js";
 import {
   findGatewayDomain,
   listCapabilityDiscoveryPrefixes,
@@ -20,24 +20,25 @@ import {
 } from "./chunk-KPQY44JQ.js";
 import {
   resolveHost
-} from "./chunk-OP44TT4H.js";
+} from "./chunk-P6VFCH3P.js";
 import {
   printError,
   printOutput,
   withOutputMetadata
-} from "./chunk-6VNIR4AP.js";
+} from "./chunk-ELCR235M.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   CredentialStoreUnreadableError,
   SecureStoreAuthError
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   safeJsonParse
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-LMCYSVVA.js";
 import {
   CliValidationError,
+  ExternalCliTokenError,
   PermissionError
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // src/commands/capability/index.ts
 import * as readline from "readline";
@@ -368,7 +369,7 @@ function printCapabilityError(error, host) {
     );
     return;
   }
-  if (error instanceof CredentialStoreUnreadableError) {
+  if (error instanceof CredentialStoreUnreadableError || error instanceof ExternalCliTokenError) {
     printError("config", error.message, error.hint, error.code);
     return;
   }
@@ -377,7 +378,7 @@ function printCapabilityError(error, host) {
     return;
   }
   if (error instanceof PermissionError) {
-    printError("permission", error.message, void 0, error.code);
+    printError("permission", error.message, error.hint, error.code);
     return;
   }
   if (error instanceof CapabilityGatewayError) {

package/dist/{chunk-CT7QDJS6.js → chunk-2IYIYSUO.js}

@@ -5,11 +5,11 @@ import {
   require_node,
   require_process_nextick_args,
   require_util
-} from "./chunk-S6M42KND.js";
+} from "./chunk-T44M3PLZ.js";
 import {
   __commonJS,
   __require
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // node_modules/jszip/node_modules/readable-stream/lib/internal/streams/stream.js
 var require_stream = __commonJS({

package/dist/{chunk-3YVEAZUN.js → chunk-2UWS5CUP.js}

@@ -4,15 +4,17 @@ import {
 } from "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-LMCYSVVA.js";
 import {
   PermissionError,
-  isApiErrorType
-} from "./chunk-WNGFSIOB.js";
+  externalCliTokenRequestOptions,
+  isApiErrorType,
+  readExternalCliToken
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -153,7 +155,7 @@ async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await fetch(url, { ...init, signal: controller.signal });
+    return await fetch(url, { ...init, signal: controller.signal, ...externalCliTokenRequestOptions(url) });
   } catch (err) {
     if (err?.name === "AbortError") {
       throw new TeAgentApiError(
@@ -197,7 +199,8 @@ function teClaudeBaseFromActiveHost(hostOverride) {
   if (!h) return void 0;
   return resolveTeClaudeBaseUrl(h);
 }
-async function signRequest(method, path2, hostOverride, includeJsonContentType = true) {
+async function signRequest(method, path2, hostOverride, includeJsonContentType = true, authMode = "auto") {
+  const external = readExternalCliToken(hostOverride);
   const configuredHost = hostOverride || getActiveHost();
   const sandboxOnly = !hostOverride && (/* @__PURE__ */ new Set([
     "/api/sandbox/models",
@@ -207,8 +210,8 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
     "/api/sandbox/sync/pull",
     "/api/sandbox/sync/pull/candidates"
   ])).has(path2.split("?")[0]);
-  const sandboxCred = configuredHost && !sandboxOnly ? null : tryLoadTeAgentSandboxCredentials();
-  if (!hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
+  const sandboxCred = external || configuredHost && !sandboxOnly ? null : tryLoadTeAgentSandboxCredentials();
+  if (authMode === "auto" && !hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
     const headers = {
       "X-Sandbox-Id": sandboxCred.sandboxId,
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
@@ -222,7 +225,7 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
       authKind: "sandbox"
     };
   }
-  const baseUrl = hostOverride ? teClaudeBaseFromActiveHost(hostOverride) : sandboxCred?.url || teClaudeBaseFromActiveHost();
+  const baseUrl = hostOverride || external ? teClaudeBaseFromActiveHost(hostOverride || external?.url) : sandboxCred?.url || teClaudeBaseFromActiveHost();
   if (!baseUrl) {
     throw new TeAgentCredentialsError(
       "Cannot determine the te-claude service URL",
@@ -248,13 +251,14 @@ async function fetchSigned(options) {
     options.method,
     options.path,
     options.hostOverride,
-    options.includeJsonContentType
+    options.includeJsonContentType,
+    options.authMode
   );
   return fetchWithTimeout(
     signed.url,
     {
       method: options.method,
-      headers: signed.headers,
+      headers: { ...Object.fromEntries(new Headers(options.headers).entries()), ...signed.headers },
       body: options.body
     },
     options.timeoutMs
@@ -263,7 +267,7 @@ async function fetchSigned(options) {
 function errorDetails(parsed, defaultErrorPrefix, status) {
   const nested = parsed && typeof parsed === "object" && parsed.error && typeof parsed.error === "object" ? parsed.error : parsed;
   const message = typeof parsed?.error === "string" ? parsed.error : typeof nested?.message === "string" ? nested.message : typeof parsed?.message === "string" ? parsed.message : typeof parsed?.return_message === "string" ? parsed.return_message : `${defaultErrorPrefix} ${status}`;
-  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : void 0;
+  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : typeof parsed?.errorCode === "string" ? parsed.errorCode : void 0;
   const hint = typeof nested?.hint === "string" ? nested.hint : typeof parsed?.hint === "string" ? parsed.hint : void 0;
   const declaredType = isApiErrorType(nested?.type) ? nested.type : void 0;
   const type = status === 401 ? "auth" : status === 403 ? "permission" : declaredType ?? ([400, 413, 422].includes(status) ? "validation" : status === 404 ? "not_found" : "api");
@@ -303,21 +307,23 @@ async function parseResponse(response, defaultErrorPrefix) {
   }
   return parsed;
 }
-async function postToMainApp(path2, body, hostOverride) {
+async function postToMainApp(path2, body, hostOverride, authMode = "auto") {
   const rawBody = JSON.stringify(body);
   const response = await fetchSigned({
     method: "POST",
     path: path2,
     body: rawBody,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
-async function getFromMainApp(path2, hostOverride) {
+async function getFromMainApp(path2, hostOverride, authMode = "auto") {
   const response = await fetchSigned({
     method: "GET",
     path: path2,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
@@ -347,21 +353,23 @@ async function postSandboxSyncPull(args) {
     mode: "merge"
   });
 }
-async function deleteFromMainApp(path2, hostOverride) {
+async function deleteFromMainApp(path2, hostOverride, authMode = "auto") {
   const response = await fetchSigned({
     method: "DELETE",
     path: path2,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
-async function patchToMainApp(path2, body, hostOverride) {
+async function patchToMainApp(path2, body, hostOverride, authMode = "auto") {
   const rawBody = JSON.stringify(body);
   const response = await fetchSigned({
     method: "PATCH",
     path: path2,
     body: rawBody,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
@@ -447,7 +455,8 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
         return await fetch(requestToSend.url, {
           method: "GET",
           headers: requestToSend.headers,
-          signal: controller.signal
+          signal: controller.signal,
+          ...externalCliTokenRequestOptions(requestToSend.url)
         });
       } catch (error) {
         if (error?.name === "AbortError") {
@@ -519,7 +528,9 @@ export {
   getClaudeConfigDir,
   resolveTeClaudeBaseUrl,
   TeAgentApiError,
+  fetchSigned,
   createTeAgentApiError,
+  parseResponse,
   postToMainApp,
   getFromMainApp,
   getSandboxModels,

package/dist/{chunk-6VNIR4AP.js → chunk-ELCR235M.js}

@@ -1,16 +1,19 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   peekCliToken
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   getActiveHost,
   getConfigDir,
-  isAeSandboxRuntime,
-  normalizeUrl
-} from "./chunk-ZL7SGNIA.js";
+  isAeSandboxRuntime
+} from "./chunk-LMCYSVVA.js";
 import {
-  logger
-} from "./chunk-WNGFSIOB.js";
+  externalCliTokenRequestOptions,
+  logger,
+  normalizeUrl,
+  readExternalCliToken,
+  redactExternalCliToken
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/install-process.ts
 import spawn from "cross-spawn";
@@ -725,11 +728,13 @@ function recordVersionSyncResult(host, target, result) {
   store.hosts[key] = entry;
   writeSyncStore(store);
 }
-function isAutoSyncTargetEligible(version) {
+function isRegularCliVersion(version) {
   const normalized = normalizeCliVersion(version);
-  const parts = normalized.split("-")[0].split(".").map((part) => Number.parseInt(part, 10));
-  if (parts.length < 3 || parts.some((part) => !Number.isFinite(part))) return false;
-  const [major, minor, patch] = parts;
+  return /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(normalized) && normalized.split(".").every((part) => Number.isSafeInteger(Number(part)));
+}
+function isAutoSyncTargetEligible(version) {
+  if (!isRegularCliVersion(version)) return false;
+  const [major, minor, patch] = normalizeCliVersion(version).split(".").map(Number);
   if (major > 6) return true;
   if (major !== 6) return false;
   if (minor > 1) return true;
@@ -966,7 +971,7 @@ function rootCommand(argv) {
     const token = args[i];
     if (token === "--") return void 0;
     if (token.startsWith("-")) {
-      if (!token.includes("=") && ["--host", "--mcp-url", "--format", "--jq"].includes(token)) {
+      if (!token.includes("=") && ["--host", "--cli-token-file", "--mcp-url", "--format", "--jq"].includes(token)) {
         i += 1;
       }
       continue;
@@ -981,13 +986,15 @@ function shouldSkipAutoSync(argv = process.argv) {
 }
 async function fetchCliConfig(host, cliToken) {
   const url = new URL(CLI_CONFIG_PATH, host.endsWith("/") ? host : `${host}/`);
-  url.searchParams.set("cli-token", cliToken);
+  const external = readExternalCliToken(host)?.token === cliToken;
+  if (!external) url.searchParams.set("cli-token", cliToken);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
     const resp = await fetch(url.toString(), {
       signal: controller.signal,
-      headers: { Accept: "application/json" }
+      headers: { Accept: "application/json", ...external ? { "cli-token": cliToken } : {} },
+      ...externalCliTokenRequestOptions(url.toString())
     });
     if (!resp.ok) return null;
     const body = await resp.json();
@@ -1104,7 +1111,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
   entry.localVersion = pkg.version;
   entry.expectedVersion = expected;
   entry.clusterVersion = cluster || entry.clusterVersion;
-  const canAutoSync = allowAutoSync && isPublicAeCliPackage(pkg.name) && isAutoSyncTargetEligible(expected);
+  const canAutoSync = allowAutoSync && isPublicAeCliPackage(pkg.name) && isRegularCliVersion(pkg.version) && isAutoSyncTargetEligible(expected);
   if (canAutoSync) {
     const confirmed = await fetchCliConfig(host, token);
     if (confirmed) rememberKbAutoDiscoveryFeature(host, token, confirmed.projectSemanticKbAutoDiscovery ?? false);
@@ -1307,7 +1314,7 @@ async function applyJq(data, expr) {
   if (!trimmed) return data;
   let results;
   try {
-    results = await jqJson(data, trimmed);
+    results = await jqJson(data ?? null, trimmed);
   } catch (err) {
     const message = err instanceof JqError ? err.message : err?.message || String(err);
     const error = new Error(`Invalid --jq expression: ${message}`);
@@ -1328,7 +1335,7 @@ async function formatOutput(data, format, jqExpr) {
     processed = await applyJq(outputData, jqExpr);
   }
   if (format === "table") {
-    return formatTable(processed);
+    return redactExternalCliToken(formatTable(processed));
   }
   const hostCompat = getPendingHostCompatNotice();
   const updateNotice = getPendingUpdateNotice();
@@ -1343,7 +1350,7 @@ async function formatOutput(data, format, jqExpr) {
     // Soft tip lives only under _notice (not mirrored into meta) to avoid duplicate fields.
     ...Object.keys(notices).length > 0 ? { _notice: notices } : {}
   };
-  return JSON.stringify(envelope, null, 2);
+  return redactExternalCliToken(JSON.stringify(envelope, null, 2));
 }
 function formatError(type, message, hint, code, meta, details) {
   const envelope = {
@@ -1351,7 +1358,7 @@ function formatError(type, message, hint, code, meta, details) {
     error: { type, message, hint, code, ...details === void 0 ? {} : { details } },
     ...meta && Object.keys(meta).length > 0 ? { meta } : {}
   };
-  return JSON.stringify(envelope, null, 2);
+  return redactExternalCliToken(JSON.stringify(envelope, null, 2));
 }
 function printError(type, message, hint, code, meta, options = {}) {
   const formatted = formatError(type, message, hint, code, meta, options.details);
@@ -1389,7 +1396,7 @@ async function printOutput(data, format, jqExpr, options = {}) {
       const recoveryData = options.redactErrors ? sensitiveRecoveryData(unwrapOutputData(data)) : unwrapOutputData(data);
       await new Promise((resolve, reject) => {
         process.stdout.write(
-          JSON.stringify({ ...recovery, data: recoveryData }, null, 2) + "\n",
+          redactExternalCliToken(JSON.stringify({ ...recovery, data: recoveryData }, null, 2)) + "\n",
           (error2) => error2 ? reject(error2) : resolve()
         );
       });

package/dist/{chunk-RPBOAQQQ.js → chunk-GI5BMEZO.js}

@@ -3,7 +3,7 @@ import {
   getAgentApi,
   patchAgentApi,
   postAgentApi
-} from "./chunk-CI24BDR2.js";
+} from "./chunk-JJJIP2XQ.js";
 
 // src/commands/memory/cli-client.ts
 var DEFAULT_TE_CLAUDE_BASE_PATH = "/agent";

package/dist/{chunk-7KU2WNQE.js → chunk-GTPWDLTE.js}

@@ -1,17 +1,18 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   CapabilityGatewayError
-} from "./chunk-VZZNLV3I.js";
+} from "./chunk-QW3R6O7L.js";
 import {
   SecureStoreAuthError,
   getCliToken
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   safeJsonParse
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-LMCYSVVA.js";
 import {
-  PermissionError
-} from "./chunk-WNGFSIOB.js";
+  PermissionError,
+  externalCliTokenRequestOptions
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {
@@ -170,7 +171,7 @@ function parseKbResponse(resp, text, options = {}) {
 async function fetchWithCliToken(input, init, cliToken, options = {}) {
   const headers = new Headers(init.headers);
   headers.set("cli-token", cliToken);
-  const resp = await fetch(input, { ...init, headers });
+  const resp = await fetch(input, { ...init, headers, ...externalCliTokenRequestOptions(input) });
   if (options.responseType === "empty" && resp.status === 204) return null;
   if (options.responseType === "bytes" && resp.ok) {
     if (resp.headers.get("content-type")?.includes("application/json")) {