@thinkingai/ae-cli 6.1.27 → 6.1.29

package/dist/{te-agent-AORRE2FM.js → te-agent-5ENVZJUH.js}

@@ -11,7 +11,7 @@ import {
   workspaceResourcePath,
   workspaceTargetFlags,
   workspaceTargetPath
-} from "./chunk-Q5US7JC5.js";
+} from "./chunk-7JAVT5TK.js";
 import {
   currentAgentSpaceId
 } from "./chunk-RK6GLDGI.js";
@@ -19,24 +19,31 @@ import {
   deleteAgentApi,
   getAgentApi,
   getAgentBuffer,
+  isTransientResourcePackageError,
   patchAgentApi,
   postAgentApi,
   putAgentApi,
+  requestResourcePackageApi,
+  requestResourcePackageRaw,
+  resourcePackagePreflightChange,
   uploadAgentApi
-} from "./chunk-CI24BDR2.js";
+} from "./chunk-N6XBLRB7.js";
 import {
+  TeAgentApiError,
   resolveTeClaudeBaseUrl
-} from "./chunk-3YVEAZUN.js";
+} from "./chunk-RJHGDWSC.js";
 import {
   buildCapabilityGatewayUrl,
   callCapabilityApi
-} from "./chunk-VZZNLV3I.js";
+} from "./chunk-3SDHJOCR.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-GHXZK54S.js";
-import "./chunk-ZL7SGNIA.js";
+import "./chunk-H3K5UGYC.js";
+import {
+  getConfigDir
+} from "./chunk-JNVVJ273.js";
 import {
   CliValidationError
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-Z3Q2AEIN.js";
 
 // src/commands/te-agent/notifications.ts
 import { openSync, closeSync, fstatSync, readSync } from "fs";
@@ -44,28 +51,29 @@ import { openSync, closeSync, fstatSync, readSync } from "fs";
 // src/commands/te-agent/approval-cli-client.ts
 var APPROVAL_GATEWAY_DOMAIN = "approval";
 var resolveApprovalApiBaseUrl = resolveTeClaudeBaseUrl;
-function buildApprovalCliUrl(ctx, path) {
-  return buildCapabilityGatewayUrl(resolveApprovalApiBaseUrl(ctx.host()), APPROVAL_GATEWAY_DOMAIN, path);
+function buildApprovalCliUrl(ctx, path2) {
+  return buildCapabilityGatewayUrl(resolveApprovalApiBaseUrl(ctx.host()), APPROVAL_GATEWAY_DOMAIN, path2);
 }
-function requestApprovalCli(ctx, method, path, body, options = {}) {
+function requestApprovalCli(ctx, method, path2, body, options = {}) {
   return callCapabilityApi(
     ctx.host(),
     APPROVAL_GATEWAY_DOMAIN,
-    path,
+    path2,
     method,
     body,
     {
       apiBaseUrl: resolveApprovalApiBaseUrl(ctx.host()),
+      includeClientContextInBody: false,
       ...options,
       retryOnInvalidTokenForbidden: false
     }
   );
 }
-function getApprovalCli(ctx, path) {
-  return requestApprovalCli(ctx, "GET", path);
+function getApprovalCli(ctx, path2) {
+  return requestApprovalCli(ctx, "GET", path2);
 }
-function postApprovalCli(ctx, path, body, options = {}) {
-  return requestApprovalCli(ctx, "POST", path, body, options);
+function postApprovalCli(ctx, path2, body, options = {}) {
+  return requestApprovalCli(ctx, "POST", path2, body, options);
 }
 
 // src/commands/te-agent/notifications.ts
@@ -204,7 +212,7 @@ function query(ctx, mode) {
   }
   return params.toString() ? `?${params}` : "";
 }
-function command(name, description, flags, method, path, body) {
+function command(name, description, flags, method, path2, body) {
   return {
     service: "agent",
     resource: "notification",
@@ -214,7 +222,7 @@ function command(name, description, flags, method, path, body) {
     flags,
     risk: method === "GET" ? "read" : "write",
     validate(ctx) {
-      path(ctx);
+      path2(ctx);
       body?.(ctx);
     },
     dryRun(ctx) {
@@ -224,7 +232,7 @@ function command(name, description, flags, method, path, body) {
         url: buildCapabilityGatewayUrl(
           resolveApprovalApiBaseUrl(ctx.host()),
           "agent",
-          path(ctx)
+          path2(ctx)
         ),
         ...payload ? {
           body: name === "send" ? { ...payload, title: "[redacted]", body: "[redacted]" } : payload
@@ -235,7 +243,7 @@ function command(name, description, flags, method, path, body) {
       return callCapabilityApi(
         ctx.host(),
         "agent",
-        path(ctx),
+        path2(ctx),
         method,
         body?.(ctx),
         {
@@ -355,9 +363,9 @@ var notificationCommands = [
 var BASE_PATH = "/api/sandbox/agent/agents";
 function buildQuery(ctx) {
   const params = new URLSearchParams();
-  const scope = ctx.str("scope");
+  const scope2 = ctx.str("scope");
   const q = ctx.str("q");
-  if (scope) params.set("scope", scope);
+  if (scope2) params.set("scope", scope2);
   if (q) params.set("q", q);
   const qs = params.toString();
   return qs ? `?${qs}` : "";
@@ -382,8 +390,8 @@ var listAgents = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company", "system"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company", "system"].includes(scope2)) {
       throw new Error("--scope \u5FC5\u987B\u662F personal\u3001company \u6216 system");
     }
   },
@@ -422,8 +430,8 @@ var createAgent = {
     if (!name || name.length < 1 || name.length > 100) {
       throw new Error("--name length must be between 1 and 100");
     }
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
   },
@@ -569,8 +577,8 @@ var getAgentContext = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const id = ctx.str("id");
-    if (!id || id !== id.trim() || id.length > 191) {
+    const id2 = ctx.str("id");
+    if (!id2 || id2 !== id2.trim() || id2.length > 191) {
       throw new CliValidationError("--id must be a non-empty identifier of at most 191 characters");
     }
   },
@@ -601,11 +609,11 @@ function requireId(ctx, key, flag2) {
   }
   return value;
 }
-function url(ctx, path) {
-  return buildCapabilityGatewayUrl(resolveApprovalApiBaseUrl(ctx.host()), "agent", path);
+function url(ctx, path2) {
+  return buildCapabilityGatewayUrl(resolveApprovalApiBaseUrl(ctx.host()), "agent", path2);
 }
-function request(ctx, method, path, body) {
-  return callCapabilityApi(ctx.host(), "agent", path, method, body, {
+function request(ctx, method, path2, body) {
+  return callCapabilityApi(ctx.host(), "agent", path2, method, body, {
     apiBaseUrl: resolveApprovalApiBaseUrl(ctx.host()),
     retryOnInvalidTokenForbidden: false
   });
@@ -647,7 +655,7 @@ var expectedVersionFlag = {
 };
 function shareBody(ctx) {
   const recipients = ctx.json("toUserIds");
-  if (!Array.isArray(recipients) || recipients.length < 1 || recipients.length > 50 || recipients.some((id) => typeof id !== "string" || !id || id.trim() !== id || id.length > 191) || new Set(recipients).size !== recipients.length) {
+  if (!Array.isArray(recipients) || recipients.length < 1 || recipients.length > 50 || recipients.some((id2) => typeof id2 !== "string" || !id2 || id2.trim() !== id2 || id2.length > 191) || new Set(recipients).size !== recipients.length) {
     throw new CliValidationError(
       "--to-user-ids must be a JSON array of 1-50 distinct non-empty user IDs"
     );
@@ -865,22 +873,22 @@ var listModels = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company", "system"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company", "system"].includes(scope2)) {
       throw new Error("--scope must be personal, company, or system");
     }
   },
   dryRun: (ctx) => {
-    const scope = ctx.str("scope");
+    const scope2 = ctx.str("scope");
     const params = new URLSearchParams();
-    if (scope) params.set("scope", scope);
+    if (scope2) params.set("scope", scope2);
     const qs = params.toString();
     return { method: "GET", url: `${BASE_PATH2}${qs ? `?${qs}` : ""}` };
   },
   execute: async (ctx) => {
-    const scope = ctx.str("scope");
+    const scope2 = ctx.str("scope");
     const params = new URLSearchParams();
-    if (scope) params.set("scope", scope);
+    if (scope2) params.set("scope", scope2);
     const qs = params.toString();
     const current = process.env.TE_AGENT_CURRENT_MODEL_ID?.trim();
     const data = await getAgentApi(
@@ -944,8 +952,8 @@ var addModel = {
     } catch {
       throw new Error("--base-url must be a valid URL");
     }
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
   },
@@ -997,19 +1005,19 @@ var delModel = {
   ],
   risk: "high-risk-write",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
   },
   dryRun: (ctx) => {
-    const scope = ctx.str("scope") || "personal";
-    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope)}`;
+    const scope2 = ctx.str("scope") || "personal";
+    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope2)}`;
     return { method: "DELETE", url: `${BASE_PATH2}?${qs}` };
   },
   execute: async (ctx) => {
-    const scope = ctx.str("scope") || "personal";
-    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope)}`;
+    const scope2 = ctx.str("scope") || "personal";
+    const qs = `id=${encodeURIComponent(ctx.str("id"))}&scope=${encodeURIComponent(scope2)}`;
     return deleteAgentApi(ctx, `${BASE_PATH2}?${qs}`);
   }
 };
@@ -1069,8 +1077,8 @@ var updateModel = {
     } catch {
       throw new Error("--base-url must be a valid URL");
     }
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
   },
@@ -1144,8 +1152,8 @@ var testModel = {
     if (apiKey) body.apiKey = apiKey;
     const provider = ctx.str("provider");
     if (provider) body.provider = provider;
-    const id = ctx.str("id");
-    if (id) body.existingConfigId = id;
+    const id2 = ctx.str("id");
+    if (id2) body.existingConfigId = id2;
     return { method: "POST", url: `${BASE_PATH2}/test`, body };
   },
   execute: async (ctx) => {
@@ -1157,8 +1165,8 @@ var testModel = {
     if (apiKey) body.apiKey = apiKey;
     const provider = ctx.str("provider");
     if (provider) body.provider = provider;
-    const id = ctx.str("id");
-    if (id) body.existingConfigId = id;
+    const id2 = ctx.str("id");
+    if (id2) body.existingConfigId = id2;
     return postAgentApi(ctx, `${BASE_PATH2}/test`, body);
   }
 };
@@ -1220,19 +1228,19 @@ var listMcps = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company", "system"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company", "system"].includes(scope2)) {
       throw new Error("--scope must be personal, company, or system");
     }
   },
   dryRun: (ctx) => {
-    const scope = ctx.str("scope");
-    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    const scope2 = ctx.str("scope");
+    const qs = scope2 ? `?scope=${encodeURIComponent(scope2)}` : "";
     return { method: "GET", url: `${BASE_PATH3}${qs}` };
   },
   execute: async (ctx) => {
-    const scope = ctx.str("scope");
-    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    const scope2 = ctx.str("scope");
+    const qs = scope2 ? `?scope=${encodeURIComponent(scope2)}` : "";
     return getAgentApi(ctx, `${BASE_PATH3}${qs}`);
   }
 };
@@ -1277,8 +1285,8 @@ var addMcp = {
     if (category && !isValidMarketCategory(category)) {
       throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
     }
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
   },
@@ -1306,11 +1314,11 @@ var addMcp = {
       headers: ctx.json("headers") || void 0,
       scope: ctx.str("scope") || "personal"
     });
-    const id = created?.item?.id;
+    const id2 = created?.item?.id;
     const meta = buildMetaBody(ctx);
-    if (id && meta) {
+    if (id2 && meta) {
       try {
-        await patchAgentApi(ctx, `${MARKET_BASE_PATH}/${encodeURIComponent(id)}/meta`, meta);
+        await patchAgentApi(ctx, `${MARKET_BASE_PATH}/${encodeURIComponent(id2)}/meta`, meta);
       } catch (err) {
         process.stderr.write(`Warning: MCP created but meta update failed: ${err?.message ?? err}
 `);
@@ -1370,8 +1378,8 @@ var listMcpMarket = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !MARKET_SCOPES.includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !MARKET_SCOPES.includes(scope2)) {
       throw new Error(`--scope must be one of: ${MARKET_SCOPES.join(", ")}`);
     }
     const category = ctx.str("category");
@@ -1558,14 +1566,14 @@ var mcpAuthStart = {
       }
     );
     if (result?.authorizeUrl && (process.stderr.isTTY || process.stdout.isTTY)) {
-      const id = ctx.str("id");
+      const id2 = ctx.str("id");
       process.stderr.write(
         `
 \u8BF7\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00\u4EE5\u4E0B URL \u5B8C\u6210\u6388\u6743\uFF1A
 ${result.authorizeUrl}
 
 \u6388\u6743\u5B8C\u6210\u540E\uFF0C\u8FD0\u884C\u4EE5\u4E0B\u547D\u4EE4\u8F6E\u8BE2\u6388\u6743\u72B6\u6001\uFF1A
-ae-cli agent +mcp-auth-status --id ${id}
+ae-cli agent +mcp-auth-status --id ${id2}
 
 `
       );
@@ -1752,19 +1760,19 @@ var listSkills = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company", "system"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company", "system"].includes(scope2)) {
       throw new Error("--scope must be personal, company, or system");
     }
   },
   dryRun: (ctx) => {
-    const scope = ctx.str("scope");
-    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    const scope2 = ctx.str("scope");
+    const qs = scope2 ? `?scope=${encodeURIComponent(scope2)}` : "";
     return { method: "GET", url: `${BASE_PATH4}${qs}` };
   },
   execute: async (ctx) => {
-    const scope = ctx.str("scope");
-    const qs = scope ? `?scope=${encodeURIComponent(scope)}` : "";
+    const scope2 = ctx.str("scope");
+    const qs = scope2 ? `?scope=${encodeURIComponent(scope2)}` : "";
     return getAgentApi(ctx, `${BASE_PATH4}${qs}`);
   }
 };
@@ -1839,8 +1847,8 @@ var addSkill = {
     if (category && !isValidMarketCategory(category)) {
       throw new Error(`--category must be one of: ${MARKET_CATEGORIES.join(", ")}`);
     }
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
     const version = ctx.str("version");
@@ -1869,11 +1877,11 @@ var addSkill = {
       scope: ctx.str("scope") || "personal",
       version: ctx.str("version") || void 0
     });
-    const id = created?.item?.id;
+    const id2 = created?.item?.id;
     const meta = buildMetaBody2(ctx);
-    if (id && meta) {
+    if (id2 && meta) {
       try {
-        await patchAgentApi(ctx, `${MARKET_BASE_PATH2}/${encodeURIComponent(id)}/meta`, meta);
+        await patchAgentApi(ctx, `${MARKET_BASE_PATH2}/${encodeURIComponent(id2)}/meta`, meta);
       } catch (err) {
         process.stderr.write(`Warning: Skill created but meta update failed: ${err?.message ?? err}
 `);
@@ -1982,8 +1990,8 @@ var listSkillMarket = {
   ],
   risk: "read",
   validate: (ctx) => {
-    const scope = ctx.str("scope");
-    if (scope && !MARKET_SCOPES.includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !MARKET_SCOPES.includes(scope2)) {
       throw new Error(`--scope must be one of: ${MARKET_SCOPES.join(", ")}`);
     }
     const category = ctx.str("category");
@@ -2594,8 +2602,8 @@ var uploadSkill = {
     if (!existsSync(resolved)) throw new Error(`File not found: ${resolved}`);
     const ext = extname(resolved).toLowerCase();
     if (ext !== ".zip") throw new Error("--file must be a .zip file");
-    const scope = ctx.str("scope");
-    if (scope && !["personal", "company"].includes(scope)) {
+    const scope2 = ctx.str("scope");
+    if (scope2 && !["personal", "company"].includes(scope2)) {
       throw new Error("--scope must be personal or company");
     }
     const category = ctx.str("category");
@@ -2640,8 +2648,8 @@ var uploadSkill = {
       type: "application/zip"
     });
     fd.append("file", blob, fileName);
-    const scope = ctx.str("scope") || "personal";
-    fd.append("scope", scope);
+    const scope2 = ctx.str("scope") || "personal";
+    fd.append("scope", scope2);
     if (ctx.bool("autoRename")) fd.append("autoRename", "true");
     if (ctx.str("replaceSkillId")) fd.append("replaceSkillId", ctx.str("replaceSkillId"));
     if (ctx.str("category")) fd.append("category", ctx.str("category"));
@@ -3121,12 +3129,12 @@ function parseShim(filePath) {
     target: ""
   };
   try {
-    const stat = lstatSync(filePath);
-    if (!stat.isFile() || stat.isSymbolicLink()) return fallback;
-    const lines = readShimHeader(filePath, stat.size).split("\n").slice(0, 10);
+    const stat2 = lstatSync(filePath);
+    if (!stat2.isFile() || stat2.isSymbolicLink()) return fallback;
+    const lines = readShimHeader(filePath, stat2.size).split("\n").slice(0, 10);
     const managed = lines.includes(`# ${SHIM_MARKER}`);
     if (!managed) return fallback;
-    if (stat.size > MAX_SHIM_BYTES) {
+    if (stat2.size > MAX_SHIM_BYTES) {
       return { ...fallback, managed: true, reason: "shim exceeds size limit" };
     }
     const values = /* @__PURE__ */ new Map();
@@ -3578,17 +3586,17 @@ function validateLimit(ctx) {
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function validateSnakeCaseValue(value, path = "payload") {
+function validateSnakeCaseValue(value, path2 = "payload") {
   if (Array.isArray(value)) {
-    value.forEach((item, index) => validateSnakeCaseValue(item, `${path}[${index}]`));
+    value.forEach((item, index) => validateSnakeCaseValue(item, `${path2}[${index}]`));
     return;
   }
   if (!isRecord(value)) return;
   for (const [key, child] of Object.entries(value)) {
     if (!/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/.test(key)) {
-      validation(`--payload keys must use snake_case (invalid key at ${path})`);
+      validation(`--payload keys must use snake_case (invalid key at ${path2})`);
     }
-    validateSnakeCaseValue(child, `${path}.${key}`);
+    validateSnakeCaseValue(child, `${path2}.${key}`);
   }
 }
 function approvalPayload(ctx) {
@@ -4013,6 +4021,652 @@ var retryApprovalEffect = {
   )
 };
 
+// src/commands/te-agent/resource-packages.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { readFileSync as readFileSync3 } from "fs";
+
+// src/commands/te-agent/resource-package-transfer.ts
+import { createHash, randomUUID } from "crypto";
+import { createReadStream, createWriteStream } from "fs";
+import { chmod, link, lstat, mkdir, open, readFile, rename, stat, unlink, writeFile } from "fs/promises";
+import path from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+function stateDirectory() {
+  return path.join(getConfigDir(), "transfers", "resource-packages");
+}
+async function ensureDirectory(directory) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await chmod(directory, 448);
+}
+async function saveJson(filePath, data) {
+  const temporary = `${filePath}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(data)}
+`, { mode: 384 });
+  await chmod(temporary, 384);
+  await rename(temporary, filePath);
+}
+async function loadJson(filePath) {
+  try {
+    const info = await lstat(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) throw new Error(`Unsafe transfer metadata: ${filePath}`);
+    return JSON.parse(await readFile(filePath, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new Error(`Invalid transfer metadata: ${filePath}`);
+  }
+}
+async function removeFile(filePath) {
+  try {
+    await unlink(filePath);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function sameIdentity(left, right) {
+  return left.size === right.size && left.mtimeMs === right.mtimeMs && left.dev === right.dev && left.ino === right.ino;
+}
+function statePath(directory, host, filePath, scope2) {
+  const key = createHash("sha256").update(`${host}\0${filePath}\0${scope2}`).digest("hex");
+  return path.join(directory, `upload-${key}.json`);
+}
+async function slice(filePath, offset, length) {
+  const file = await open(filePath, "r");
+  try {
+    const bytes = Buffer.allocUnsafe(length);
+    const result = await file.read(bytes, 0, length, offset);
+    if (result.bytesRead !== length) throw new Error("The resource package file changed during upload");
+    return bytes;
+  } finally {
+    await file.close();
+  }
+}
+async function transientRetry(operation, maxAttempts) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error) {
+      const transient = isTransientResourcePackageError(error);
+      if (!transient || attempt + 1 >= maxAttempts) throw error;
+      await new Promise((resolve4) => setTimeout(resolve4, 250 * 2 ** attempt));
+    }
+  }
+}
+async function uploadPackage(ctx, input) {
+  const absolute = path.resolve(input.filePath);
+  const before = await lstat(absolute).catch(() => void 0);
+  if (!before?.isFile() || before.isSymbolicLink() || before.size < 1 || path.extname(absolute).toLowerCase() !== ".zip") {
+    throw new Error("--file must point to a non-empty regular .zip file");
+  }
+  const directory = input.stateRoot ?? stateDirectory();
+  await ensureDirectory(directory);
+  const savedPath = statePath(directory, ctx.host(), absolute, input.scope);
+  let saved = await loadJson(savedPath);
+  if (saved && (!sameIdentity(saved, before) || saved.host !== ctx.host() || saved.scope !== input.scope)) {
+    await removeFile(savedPath);
+    saved = void 0;
+  }
+  let upload;
+  const candidate = input.uploadId || saved?.uploadId;
+  if (candidate) {
+    try {
+      upload = await requestResourcePackageApi(
+        ctx,
+        "GET",
+        `/api/resource-packages/uploads/${encodeURIComponent(candidate)}`
+      );
+    } catch (error) {
+      if (input.uploadId || !(error instanceof TeAgentApiError) || error.status !== 404 && error.status !== 410 && error.code !== "UPLOAD_EXPIRED") throw error;
+      await removeFile(savedPath);
+      saved = void 0;
+    }
+  }
+  if (upload && (upload.fileName !== path.basename(absolute) || upload.totalBytes !== before.size || upload.scope !== input.scope || !["uploading", "completed"].includes(upload.status))) {
+    if (input.uploadId) throw new Error("--upload-id does not match the selected ZIP and scope");
+    upload = void 0;
+    await removeFile(savedPath);
+  }
+  if (!upload) {
+    upload = await requestResourcePackageApi(ctx, "POST", "/api/resource-packages/uploads", {
+      fileName: path.basename(absolute),
+      totalBytes: before.size,
+      scope: input.scope
+    });
+  }
+  if (!upload) throw new Error("The service did not create an upload");
+  const active = upload;
+  if (saved?.requestKey && input.requestKey && saved.requestKey !== input.requestKey) {
+    throw new Error("--request-key differs from the existing upload state; reuse its original key");
+  }
+  const requestKey = input.requestKey || saved?.requestKey || randomUUID();
+  const trustedLocalState = Boolean(saved && saved.uploadId === active.id && sameIdentity(saved, before));
+  const state = {
+    version: 1,
+    host: ctx.host(),
+    filePath: absolute,
+    scope: input.scope,
+    uploadId: active.id,
+    size: before.size,
+    mtimeMs: before.mtimeMs,
+    dev: before.dev,
+    ino: before.ino,
+    requestKey
+  };
+  await saveJson(savedPath, state);
+  if (active.status === "uploading") {
+    const limits = await requestResourcePackageApi(
+      ctx,
+      "GET",
+      "/api/resource-packages/limits"
+    );
+    const concurrency = Math.max(1, Math.min(8, limits.desktopUploadConcurrency || 3));
+    const maxAttempts = Math.max(1, Math.min(10, limits.uploadChunkRetries || 3));
+    const done = new Set(active.parts ?? []);
+    const pending = Array.from({ length: active.totalChunks }, (_, index) => index).filter((index) => !trustedLocalState || !done.has(index));
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(concurrency, pending.length) }, async () => {
+      while (next < pending.length) {
+        const part = pending[next++];
+        const offset = part * active.chunkBytes;
+        const bytes = await slice(absolute, offset, Math.min(active.chunkBytes, before.size - offset));
+        const digest = createHash("sha256").update(bytes).digest("hex");
+        await transientRetry(async () => {
+          const response = await requestResourcePackageRaw(
+            ctx,
+            "PUT",
+            `/api/resource-packages/uploads/${encodeURIComponent(active.id)}/chunks/${part}`,
+            {
+              body: new Uint8Array(bytes),
+              timeoutMs: 12e4,
+              headers: {
+                "Content-Type": "application/octet-stream",
+                "Content-Length": String(bytes.length),
+                "X-Chunk-Sha256": digest
+              }
+            }
+          );
+          await response.body?.cancel();
+        }, maxAttempts);
+      }
+    }));
+  }
+  const after = await stat(absolute);
+  if (!sameIdentity(before, after)) {
+    throw new Error("The resource package file changed during upload; retry with the unchanged ZIP");
+  }
+  const completed = await requestResourcePackageApi(
+    ctx,
+    "POST",
+    `/api/resource-packages/uploads/${encodeURIComponent(active.id)}/complete`,
+    {}
+  );
+  return { completed, statePath: savedPath, requestKey };
+}
+async function clearUploadState(filePath) {
+  await removeFile(filePath);
+}
+function artifactFileName(response) {
+  const disposition = response.headers.get("content-disposition") || "";
+  const encoded = disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];
+  if (encoded) {
+    try {
+      return path.basename(decodeURIComponent(encoded.trim()));
+    } catch {
+      return path.basename(encoded.trim());
+    }
+  }
+  const ordinary = disposition.match(/filename="([^"]+)"/i)?.[1] ?? disposition.match(/filename=([^;]+)/i)?.[1];
+  return ordinary ? path.basename(ordinary.trim()) : void 0;
+}
+async function fileHash(filePath) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(filePath)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function downloadArtifact(ctx, task, outputPath, timezone) {
+  const query2 = timezone ? `?timezone=${encodeURIComponent(timezone)}` : "";
+  const url2 = `/api/resource-packages/tasks/${encodeURIComponent(task.id)}/artifact${query2}`;
+  const head = await requestResourcePackageRaw(ctx, "HEAD", url2);
+  const totalBytes = Number(head.headers.get("content-length"));
+  if (!Number.isSafeInteger(totalBytes) || totalBytes < 1) throw new Error("Artifact Content-Length is invalid");
+  const etag = head.headers.get("etag") || "";
+  const output = path.resolve(outputPath ?? artifactFileName(head) ?? `resource-package-${task.id}.zip`);
+  try {
+    await lstat(output);
+    throw new Error(`Output file already exists: ${output}`);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const partial = `${output}.part`;
+  const metadataPath = `${partial}.json`;
+  let offset = 0;
+  try {
+    const info2 = await lstat(partial);
+    if (!info2.isFile() || info2.isSymbolicLink()) throw new Error(`Unsafe partial file: ${partial}`);
+    const metadata = await loadJson(metadataPath);
+    if (!etag || !metadata || metadata.host !== ctx.host() || metadata.taskId !== task.id || metadata.etag !== etag || metadata.totalBytes !== totalBytes || info2.size > totalBytes) {
+      throw new Error(`Partial artifact cannot be resumed safely: ${partial}`);
+    }
+    offset = info2.size;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (offset === 0) {
+    await saveJson(metadataPath, { version: 1, host: ctx.host(), taskId: task.id, etag, totalBytes });
+  }
+  if (offset < totalBytes) {
+    const response = await requestResourcePackageRaw(ctx, "GET", url2, {
+      headers: offset ? { Range: `bytes=${offset}-`, "If-Range": etag } : void 0,
+      timeoutMs: 12e4
+    });
+    if (offset && response.status !== 206 || !offset && response.status !== 200) {
+      throw new Error("Artifact server returned an unexpected range status");
+    }
+    if (etag && response.headers.get("etag") !== etag) throw new Error("Artifact changed while downloading");
+    if (offset && response.headers.get("content-range") !== `bytes ${offset}-${totalBytes - 1}/${totalBytes}`) {
+      throw new Error("Artifact server returned a mismatched Content-Range");
+    }
+    if (!response.body) throw new Error("Artifact response body is empty");
+    await pipeline(
+      Readable.fromWeb(response.body),
+      createWriteStream(partial, { flags: offset ? "a" : "wx", mode: 384 })
+    );
+  }
+  const info = await stat(partial);
+  if (info.size !== totalBytes) throw new Error(`Artifact size mismatch: expected ${totalBytes}, got ${info.size}`);
+  const sha256 = await fileHash(partial);
+  if (!task.packageSha256 || !/^[a-f0-9]{64}$/.test(task.packageSha256)) {
+    throw new Error("Export task does not provide a valid package SHA-256 for verification");
+  }
+  if (sha256 !== task.packageSha256) {
+    throw new Error(`Artifact SHA-256 mismatch: expected ${task.packageSha256}, got ${sha256}`);
+  }
+  await link(partial, output);
+  await removeFile(partial);
+  await removeFile(metadataPath);
+  return { path: output, bytes: totalBytes, sha256 };
+}
+
+// src/commands/te-agent/resource-packages.ts
+var statuses = /* @__PURE__ */ new Set([
+  "uploading",
+  "preflighting",
+  "ready",
+  "queued",
+  "running",
+  "cancelling",
+  "succeeded",
+  "partially_succeeded",
+  "failed",
+  "cancelled",
+  "cancel_failed"
+]);
+var terminal = /* @__PURE__ */ new Set(["succeeded", "partially_succeeded", "failed", "cancelled", "cancel_failed"]);
+var resourceTypes = /* @__PURE__ */ new Set(["knowledge_base", "mcp", "skill", "agent", "team"]);
+var previewNote = "Dry-run previews the local request only; it does not check permissions or current resources.";
+function id(ctx, key, flag2) {
+  const value = ctx.str(key);
+  if (!value || value.trim() !== value || value.length > 191) {
+    throw new CliValidationError(`--${flag2} must be a non-empty identifier of at most 191 characters`);
+  }
+  return value;
+}
+function scope(ctx) {
+  const value = ctx.str("scope");
+  if (value !== "personal" && value !== "company") {
+    throw new CliValidationError("--scope must be personal or company");
+  }
+  return value;
+}
+function jsonSource(raw, flag2) {
+  if (!raw) throw new CliValidationError(`--${flag2} is required`);
+  try {
+    const text = raw === "-" ? readFileSync3(0, "utf8") : raw.startsWith("@") ? readFileSync3(raw.slice(1), "utf8") : raw;
+    return JSON.parse(text);
+  } catch (error) {
+    throw new CliValidationError(`--${flag2} must contain valid JSON, @file JSON, or - for stdin: ${error.message}`);
+  }
+}
+function references(ctx, key) {
+  const raw = ctx.str(key);
+  if (!raw && key === "excluded") return [];
+  const value = jsonSource(raw, key);
+  const maximum = key === "roots" ? 500 : 2e3;
+  if (!Array.isArray(value) || key === "roots" && !value.length || value.length > maximum || value.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).sort().join(",") !== "sourceId,type" || !resourceTypes.has(entry.type) || typeof entry.sourceId !== "string" || !entry.sourceId || entry.sourceId.length > 191)) {
+    throw new CliValidationError(`--${key} must be a JSON array of valid resource references (max ${maximum})`);
+  }
+  return value;
+}
+function stringArray(ctx, key, flag2) {
+  const raw = ctx.str(key);
+  if (!raw) return [];
+  const value = jsonSource(raw, flag2);
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+    throw new CliValidationError(`--${flag2} must be a JSON string array`);
+  }
+  return value;
+}
+function replacementMap(ctx) {
+  const raw = ctx.str("systemReplacements");
+  if (!raw) return {};
+  const value = jsonSource(raw, "system-replacements");
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.entries(value).length > 500 || Object.entries(value).some(([key, target]) => !key || key.length > 64 || typeof target !== "string" || !target || target.length > 191)) {
+    throw new CliValidationError("--system-replacements must be a JSON object of reference keys to target IDs");
+  }
+  return value;
+}
+function taskPath(ctx) {
+  return `/api/resource-packages/tasks/${encodeURIComponent(id(ctx, "taskId", "task-id"))}`;
+}
+function waitSettings(ctx) {
+  const seconds = ctx.optionalNum("waitTimeoutSeconds") ?? 1800;
+  const pollMs = ctx.optionalNum("pollIntervalMs") ?? 1500;
+  if (!Number.isInteger(seconds) || seconds < 1 || seconds > 86400) {
+    throw new CliValidationError("--wait-timeout-seconds must be an integer from 1 to 86400");
+  }
+  if (!Number.isInteger(pollMs) || pollMs < 250 || pollMs > 6e4) {
+    throw new CliValidationError("--poll-interval-ms must be an integer from 250 to 60000");
+  }
+  return { timeoutMs: seconds * 1e3, pollMs };
+}
+async function waitForTask(ctx, task) {
+  const { timeoutMs, pollMs } = waitSettings(ctx);
+  const deadline = Date.now() + timeoutMs;
+  let current = task;
+  while (!terminal.has(current.status)) {
+    if (Date.now() >= deadline) return { task: current, timedOut: true };
+    await new Promise((resolve4) => setTimeout(resolve4, pollMs));
+    current = await requestResourcePackageApi(ctx, "GET", `/api/resource-packages/tasks/${encodeURIComponent(task.id)}`);
+  }
+  return { task: current, timedOut: false };
+}
+var taskIdFlag2 = { name: "task-id", type: "string", required: true, desc: "Resource package task ID" };
+var waitFlags = [
+  { name: "no-wait", type: "boolean", desc: "Return after submission without polling" },
+  { name: "wait-timeout-seconds", type: "number", desc: "Maximum poll duration in seconds (default: 1800)" },
+  { name: "poll-interval-ms", type: "number", desc: "Poll interval from 250 to 60000 milliseconds (default: 1500)" }
+];
+function listPath2(ctx) {
+  const kind = ctx.str("kind");
+  const selectedScope = ctx.str("scope");
+  const status = ctx.str("status");
+  if (kind && !["export", "import"].includes(kind)) throw new CliValidationError("--kind must be export or import");
+  if (selectedScope && !["personal", "company"].includes(selectedScope)) throw new CliValidationError("--scope must be personal or company");
+  if (status && !statuses.has(status)) throw new CliValidationError("--status is invalid");
+  const page = ctx.optionalNum("page") ?? 1;
+  const pageSize = ctx.optionalNum("pageSize") ?? 20;
+  if (!Number.isSafeInteger(page) || page < 1) throw new CliValidationError("--page must be a positive integer");
+  if (![20, 50, 100].includes(pageSize)) throw new CliValidationError("--page-size must be 20, 50, or 100");
+  const query2 = new URLSearchParams();
+  if (kind) query2.set("kind", kind);
+  if (selectedScope) query2.set("scope", selectedScope);
+  if (status) query2.set("status", status);
+  query2.set("page", String(page));
+  query2.set("pageSize", String(pageSize));
+  return `/api/resource-packages/tasks?${query2}`;
+}
+var listResourcePackages = {
+  service: "agent",
+  resource: "resource-package",
+  command: "list",
+  description: "List personal and company resource package tasks",
+  helpText: previewNote,
+  flags: [
+    { name: "kind", type: "string", desc: "Filter by export or import" },
+    { name: "scope", type: "string", desc: "Filter by personal or company" },
+    { name: "status", type: "string", desc: "Filter by task status" },
+    { name: "page", type: "number", desc: "Page number (default: 1)" },
+    { name: "page-size", type: "number", desc: "Page size: 20, 50, or 100 (default: 20)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    listPath2(ctx);
+  },
+  dryRun: (ctx) => ({ method: "GET", url: listPath2(ctx) }),
+  execute: (ctx) => requestResourcePackageApi(ctx, "GET", listPath2(ctx))
+};
+var showResourcePackage = {
+  service: "agent",
+  resource: "resource-package",
+  command: "show",
+  description: "Show a resource package task and its item results",
+  flags: [taskIdFlag2],
+  risk: "read",
+  validate: (ctx) => {
+    taskPath(ctx);
+  },
+  dryRun: (ctx) => ({ method: "GET", url: taskPath(ctx) }),
+  execute: (ctx) => requestResourcePackageApi(ctx, "GET", taskPath(ctx))
+};
+var previewResourcePackageExport = {
+  service: "agent",
+  resource: "resource-package",
+  command: "export-preview",
+  description: "Preview export resources and dependencies",
+  helpText: previewNote,
+  flags: [{ name: "roots", type: "string", required: true, desc: "JSON, @file, or stdin (-) array of resource references" }],
+  risk: "read",
+  validate: (ctx) => {
+    references(ctx, "roots");
+  },
+  dryRun: (ctx) => ({ method: "POST", url: "/api/resource-packages/exports/preview", body: { roots: references(ctx, "roots") } }),
+  execute: (ctx) => requestResourcePackageApi(ctx, "POST", "/api/resource-packages/exports/preview", { roots: references(ctx, "roots") })
+};
+function exportBody(ctx) {
+  return {
+    requestKey: ctx.str("requestKey") || randomUUID2(),
+    kind: "export",
+    scope: scope(ctx),
+    payload: {
+      roots: references(ctx, "roots"),
+      excluded: references(ctx, "excluded"),
+      ...ctx.str("view") ? { view: ctx.str("view") } : {},
+      ...ctx.str("fileNameBase") ? { fileNameBase: ctx.str("fileNameBase") } : {}
+    }
+  };
+}
+function validateExport(ctx) {
+  if (ctx.str("view") && !["working", "published"].includes(ctx.str("view"))) throw new CliValidationError("--view must be working or published");
+  exportBody(ctx);
+  if (ctx.str("requestKey")) id(ctx, "requestKey", "request-key");
+  const base = ctx.str("fileNameBase");
+  if (base && (base.length > 160 || !/^[^\\/\x00-\x1f]+$/.test(base))) {
+    throw new CliValidationError("--file-name-base must be a safe filename base of at most 160 characters");
+  }
+  if (ctx.bool("noWait") && ctx.str("output")) throw new CliValidationError("--no-wait cannot be combined with --output");
+  if (!ctx.bool("noWait")) waitSettings(ctx);
+}
+var exportResourcePackage = {
+  service: "agent",
+  resource: "resource-package",
+  command: "export",
+  description: "Export a personal or company resource package and download the artifact",
+  helpText: previewNote,
+  flags: [
+    { name: "scope", type: "string", required: true, desc: "Export scope: personal or company" },
+    { name: "roots", type: "string", required: true, desc: "JSON, @file, or stdin (-) array of root resources" },
+    { name: "excluded", type: "string", desc: "JSON or @file array of dependencies to exclude" },
+    { name: "view", type: "string", desc: "Knowledge base content: working (default) or published" },
+    { name: "file-name-base", type: "string", desc: "Optional output ZIP base name" },
+    { name: "request-key", type: "string", desc: "Optional idempotency key; reuse only for the same export" },
+    { name: "output", type: "string", desc: "Local ZIP path; defaults to the artifact filename" },
+    { name: "timezone", type: "string", desc: "IANA timezone for generated artifact filename (default: UTC)" },
+    ...waitFlags
+  ],
+  risk: "write",
+  validate: validateExport,
+  preflight: validateExport,
+  dryRun: (ctx) => ({ method: "POST", url: "/api/resource-packages/tasks", body: exportBody(ctx) }),
+  execute: async (ctx) => {
+    let task = await requestResourcePackageApi(ctx, "POST", "/api/resource-packages/tasks", exportBody(ctx));
+    if (ctx.bool("noWait")) return { status: "submitted", task };
+    const waited = await waitForTask(ctx, task);
+    task = waited.task;
+    if (waited.timedOut) return { status: "still_running", task };
+    if (task.status !== "succeeded" || !task.artifactAvailable) return { status: "completed", task };
+    const artifact = await downloadArtifact(ctx, task, ctx.str("output") || void 0, ctx.str("timezone") || void 0);
+    return { status: "downloaded", task, artifact };
+  }
+};
+function validateImport(ctx) {
+  if (!ctx.str("file")) throw new CliValidationError("--file is required");
+  scope(ctx);
+  stringArray(ctx, "confirmations", "confirmations");
+  replacementMap(ctx);
+  if (ctx.str("uploadId")) id(ctx, "uploadId", "upload-id");
+  if (ctx.str("requestKey")) id(ctx, "requestKey", "request-key");
+  if (!ctx.bool("noWait")) waitSettings(ctx);
+}
+function reviewPreflight(preflight, replacements, confirmations) {
+  const unresolvedBlockers = preflight.blockers.filter((item) => {
+    if (item.code !== "CORE_SYSTEM_AGENT_UNRESOLVED" || !item.referenceKey) return true;
+    const replacement = replacements[item.referenceKey];
+    return !replacement || replacement !== "__skip_resource__" && !item.replacementCandidates?.some((candidate) => candidate.id === replacement);
+  });
+  const missingConfirmations = preflight.confirmations.filter((item) => !confirmations.includes(item.code));
+  return { unresolvedBlockers, missingConfirmations };
+}
+var importResourcePackage = {
+  service: "agent",
+  resource: "resource-package",
+  command: "import",
+  description: "Upload, preflight, confirm, and import a resource package with resume support",
+  flags: [
+    { name: "file", type: "string", required: true, desc: "Path to a non-empty resource package ZIP" },
+    { name: "scope", type: "string", required: true, desc: "Import scope: personal or company" },
+    { name: "upload-id", type: "string", desc: "Explicit upload ID to resume" },
+    { name: "request-key", type: "string", desc: "Optional idempotency key; reuse only for the same import" },
+    { name: "confirmations", type: "string", desc: "JSON or @file array of required confirmation codes" },
+    { name: "system-replacements", type: "string", desc: "JSON or @file mapping of reference keys to target IDs or __skip_resource__" },
+    { name: "accept-warnings", type: "boolean", desc: "Accept all warnings from the current preflight snapshot" },
+    { name: "allow-duplicate", type: "boolean", desc: "Allow a package previously imported successfully" },
+    ...waitFlags
+  ],
+  risk: "write",
+  validate: validateImport,
+  preflight: validateImport,
+  dryRun: (ctx) => ({ method: "WORKFLOW", url: "/api/resource-packages/uploads", body: {
+    file: ctx.str("file"),
+    scope: scope(ctx),
+    resume: true,
+    wait: !ctx.bool("noWait")
+  } }),
+  execute: async (ctx) => {
+    const { completed, statePath: statePath2, requestKey } = await uploadPackage(ctx, {
+      filePath: ctx.str("file"),
+      scope: scope(ctx),
+      uploadId: ctx.str("uploadId") || void 0,
+      requestKey: ctx.str("requestKey") || void 0
+    });
+    const confirmations = stringArray(ctx, "confirmations", "confirmations");
+    const replacements = replacementMap(ctx);
+    const review = reviewPreflight(completed.preflight, replacements, confirmations);
+    if (completed.duplicateImport && !ctx.bool("allowDuplicate") || completed.preflight.warnings.length && !ctx.bool("acceptWarnings") || review.unresolvedBlockers.length || review.missingConfirmations.length) {
+      return {
+        status: "review_required",
+        uploadId: completed.uploadId,
+        requestKey,
+        duplicateImport: completed.duplicateImport,
+        preflight: completed.preflight,
+        ...review
+      };
+    }
+    let task;
+    try {
+      task = await requestResourcePackageApi(
+        ctx,
+        "POST",
+        `/api/resource-packages/uploads/${encodeURIComponent(completed.uploadId)}/confirm`,
+        {
+          requestKey,
+          preflightSnapshotId: completed.preflight.snapshotId,
+          confirmations,
+          systemReplacements: replacements
+        }
+      );
+    } catch (error) {
+      const changed = resourcePackagePreflightChange(error);
+      if (changed) return {
+        status: "review_required",
+        reason: "preflight_changed",
+        uploadId: completed.uploadId,
+        requestKey,
+        preflight: changed
+      };
+      throw error;
+    }
+    await clearUploadState(statePath2);
+    if (ctx.bool("noWait")) return { status: "submitted", task };
+    const waited = await waitForTask(ctx, task);
+    return { status: waited.timedOut ? "still_running" : "completed", task: waited.task };
+  }
+};
+var downloadResourcePackageCommand = {
+  service: "agent",
+  resource: "resource-package",
+  command: "download",
+  description: "Download or resume a completed export artifact and verify its SHA-256",
+  flags: [
+    taskIdFlag2,
+    { name: "output", type: "string", desc: "Local ZIP path; defaults to the artifact filename" },
+    { name: "timezone", type: "string", desc: "IANA timezone for generated artifact filename (default: UTC)" }
+  ],
+  risk: "read",
+  validate: (ctx) => {
+    taskPath(ctx);
+  },
+  dryRun: (ctx) => ({ method: "GET", url: `${taskPath(ctx)}/artifact` }),
+  execute: async (ctx) => {
+    const task = await requestResourcePackageApi(ctx, "GET", taskPath(ctx));
+    if (task.kind !== "export" || task.status !== "succeeded" || !task.artifactAvailable) {
+      throw new Error("This task does not have an available export artifact");
+    }
+    return downloadArtifact(ctx, task, ctx.str("output") || void 0, ctx.str("timezone") || void 0);
+  }
+};
+var cancelResourcePackage = {
+  service: "agent",
+  resource: "resource-package",
+  command: "cancel",
+  description: "Request cancellation of a running resource package task",
+  flags: [taskIdFlag2],
+  risk: "high-risk-write",
+  validate: (ctx) => {
+    taskPath(ctx);
+  },
+  dryRun: (ctx) => ({ method: "POST", url: `${taskPath(ctx)}/cancel` }),
+  execute: (ctx) => requestResourcePackageApi(ctx, "POST", `${taskPath(ctx)}/cancel`, {})
+};
+var retryResourcePackage = {
+  service: "agent",
+  resource: "resource-package",
+  command: "retry",
+  description: "Retry a retryable failed resource package task",
+  flags: [taskIdFlag2, ...waitFlags],
+  risk: "write",
+  validate: (ctx) => {
+    taskPath(ctx);
+    if (!ctx.bool("noWait")) waitSettings(ctx);
+  },
+  dryRun: (ctx) => ({ method: "POST", url: `${taskPath(ctx)}/retry` }),
+  execute: async (ctx) => {
+    const task = await requestResourcePackageApi(ctx, "POST", `${taskPath(ctx)}/retry`, {});
+    if (ctx.bool("noWait")) return { status: "submitted", task };
+    const waited = await waitForTask(ctx, task);
+    return { status: waited.timedOut ? "still_running" : "completed", task: waited.task };
+  }
+};
+var resourcePackageCommands = [
+  listResourcePackages,
+  showResourcePackage,
+  previewResourcePackageExport,
+  exportResourcePackage,
+  importResourcePackage,
+  downloadResourcePackageCommand,
+  cancelResourcePackage,
+  retryResourcePackage
+];
+
 // src/commands/te-agent/index.ts
 var commands = [
   ...notificationCommands,
@@ -4113,15 +4767,24 @@ var commands = [
   findArchivedConversations,
   restoreConversation,
   // Sandbox tools (local scan of /home/ta/.local/bin managed shims)
-  listSandboxTools
+  listSandboxTools,
+  ...resourcePackageCommands
 ];
 var te_agent_default = commands;
 export {
+  cancelResourcePackage,
   te_agent_default as default,
+  downloadResourcePackageCommand,
+  exportResourcePackage,
+  importResourcePackage,
+  listResourcePackages,
   notificationGet,
   notificationList,
   notificationMarkRead,
   notificationRecipients,
   notificationSend,
-  notificationUnreadCount
+  notificationUnreadCount,
+  previewResourcePackageExport,
+  retryResourcePackage,
+  showResourcePackage
 };