@wave-ai-os/wave-cli 0.1.63 → 0.1.66

package/README.md

@@ -39,7 +39,7 @@ Secure stdin auth/context examples:
 ```bash
 printf '%s' "token-value" | wave --token-stdin --base-url https://api.example.com --organization-id 42 tasks list --page 1 --per 10
 
-printf '%s' '{"token":"token-value","baseUrl":"https://api.example.com","organizationId":"42","agentName":"atlas"}' \
+printf '%s' '{"token":"token-value","baseUrl":"https://api.example.com","agentName":"atlas"}' \
   | wave --auth-json-stdin tasks list --page 1 --per 10
 ```
 
@@ -72,10 +72,7 @@ Required (from flags, stdin, env, config, or stored credentials):
 - `WAVE_API_BASE_URL`
 
 Organization-scoped data commands use the organization certified by the
-authenticated CLI token. `--organization-id` is the only local override. The
-CLI intentionally ignores `WAVE_ORGANIZATION_ID`, `WAVE_ORG_ID`, stdin, and
-stored config organization values as automatic scopes so a stale local value
-cannot select a different organization.
+authenticated CLI token. `--organization-id` is the only local override.
 
 Optional env:
 
@@ -103,7 +100,6 @@ Config files are JSON objects using the same keys accepted by `--auth-json-stdin
 {
   "token": "token-value",
   "baseUrl": "https://api.example.com",
-  "organizationId": "42",
   "agentName": "atlas"
 }
 ```

package/dist/index.cjs

@@ -128,9 +128,7 @@ function getConfig(options) {
   const parsed = configSchema.safeParse({
     baseUrl,
     token,
-    organizationId: toOptionalNonEmpty(
-      options.organizationId ?? process.env.WAVE_ORGANIZATION_ID ?? process.env.WAVE_ORG_ID
-    ),
+    organizationId: toOptionalNonEmpty(options.organizationId),
     timeoutMs: parseTimeoutMs(options.timeoutMs ?? process.env.WAVE_TIMEOUT_MS),
     debug: options.debug ?? parseDebug(process.env.WAVE_DEBUG),
     agentName: toOptionalNonEmpty(options.agentName ?? process.env.WAVE_AGENT_NAME),
@@ -2187,7 +2185,6 @@ function parseAuthJson(raw) {
     return {
       token: normalize3(obj.token),
       baseUrl: normalize3(obj.baseUrl ?? obj.base_url),
-      organizationId: normalize3(obj.organizationId ?? obj.organization_id),
       timeoutMs: typeof obj.timeoutMs === "number" || typeof obj.timeoutMs === "string" ? obj.timeoutMs : typeof obj.timeout_ms === "number" || typeof obj.timeout_ms === "string" ? obj.timeout_ms : void 0,
       debug: parseBool(obj.debug),
       agentName: normalize3(obj.agentName ?? obj.agent_name),
@@ -2270,7 +2267,6 @@ function resolveAuthToken(options, stdin, config, env) {
     { token: normalize3(options.token), source: "flag" },
     { token: normalize3(stdin.token), source: "stdin" },
     { token: normalize3(env.WAVE_API_TOKEN), source: "env" },
-    { token: normalize3(config.token), source: "config" },
     { token: normalize3(config.token), source: "config" }
   ];
   return candidates.find((candidate) => candidate.token) ?? { source: "none" };
@@ -2283,18 +2279,8 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(env.WAVE_API_URL),
     normalize3(config.baseUrl)
   );
-  const organizationCandidates = [
-    { organizationId: normalize3(options.organizationId), source: "flag" },
-    { organizationId: normalize3(stdin.organizationId), source: "stdin" },
-    { organizationId: normalize3(env.WAVE_ORGANIZATION_ID), source: "env" },
-    { organizationId: normalize3(env.WAVE_ORG_ID), source: "env" },
-    { organizationId: normalize3(config.organizationId), source: "config" }
-  ];
-  const resolvedOrganization = organizationCandidates.find((candidate) => candidate.organizationId) ?? {
-    organizationId: void 0,
-    source: "none"
-  };
-  const organizationId = resolvedOrganization.organizationId;
+  const organizationId = normalize3(options.organizationId);
+  const organizationIdSource = organizationId ? "flag" : "none";
   const timeoutMs = firstDefined(options.timeoutMs, stdin.timeoutMs, env.WAVE_TIMEOUT_MS, config.timeoutMs);
   const debug = firstDefined(
     options.debug,
@@ -2383,7 +2369,7 @@ function resolveFromSources(options, stdin, config, env) {
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
   return {
     organizationId,
-    organizationIdSource: resolvedOrganization.source,
+    organizationIdSource,
     runtimeOptions: {
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
@@ -2523,7 +2509,9 @@ async function resolveCommandContext(options) {
 function organizationIdFromCliAuthStatus(data) {
   const status = data.cliAuthStatus;
   if (!status || typeof status !== "object" || Array.isArray(status)) return void 0;
-  const organization = status.organization;
+  const cliAuthStatus = status;
+  if (cliAuthStatus.authenticated !== true) return void 0;
+  const organization = cliAuthStatus.organization;
   if (!organization || typeof organization !== "object" || Array.isArray(organization)) return void 0;
   return normalize3(organization.id);
 }
@@ -14460,7 +14448,7 @@ async function runDatasheetsQuery(cmd, config) {
   });
 }
 async function runDatasheetsMutation(cmd, opts, config) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = config.organizationContext === "optional" ? await resolveUnscopedCommandContext(cmd.optsWithGlobals()) : await resolveCommandContext(cmd.optsWithGlobals());
   const variables = config.organizationContext === "optional" ? context.organizationId ? { organization_id: context.organizationId } : {} : { organization_id: resolveOrganizationId(context.organizationId) };
   for (const id of config.requiredIds ?? []) {
     variables[id.variable] = requireNonEmpty(opts[id.option], id.label, config.command);
@@ -14497,7 +14485,7 @@ async function runDatasheetsMutation(cmd, opts, config) {
     runtimeOptions: context.runtimeOptions,
     field: config.field,
     variables: normalizeGraphqlVariables2(variables),
-    variableTypes: { organization_id: "ID!" },
+    variableTypes: config.organizationContext === "optional" && !context.organizationId ? {} : { organization_id: "ID!" },
     selectionSet: DATASHEET_MUTATION_SELECTION
   });
 }
@@ -14789,115 +14777,6 @@ function registerDatasheetsCommands(program) {
   });
 }
 
-// src/commands/aiNotes.ts
-var AI_NOTE_SAFE_FIELDS = [
-  "id",
-  "slug",
-  "title",
-  "status",
-  "visibility",
-  "sourceType",
-  "sourceReference",
-  "ownerMemberId",
-  "scheduledStartAt",
-  "scheduledEndAt",
-  "createdAt",
-  "updatedAt"
-];
-var AI_NOTE_SELECTION = `{ ${AI_NOTE_SAFE_FIELDS.join(" ")} }`;
-var AI_NOTES_SELECTION = AI_NOTE_SELECTION;
-function pickSafeAiNoteFields(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  const record = value;
-  const safe = {};
-  for (const field of AI_NOTE_SAFE_FIELDS) {
-    if (Object.prototype.hasOwnProperty.call(record, field)) {
-      safe[field] = record[field];
-    }
-  }
-  return safe;
-}
-function projectAiNotesPayload(payload) {
-  if (Array.isArray(payload)) {
-    return payload.map((item) => pickSafeAiNoteFields(item)).filter(Boolean);
-  }
-  if (!payload || typeof payload !== "object") {
-    return payload;
-  }
-  return pickSafeAiNoteFields(payload);
-}
-function showVariables(opts) {
-  const id = typeof opts.id === "string" && opts.id.trim() !== "" ? opts.id.trim() : void 0;
-  const slug = typeof opts.slug === "string" && opts.slug.trim() !== "" ? opts.slug.trim() : void 0;
-  if (!id && !slug || id && slug) {
-    throw new CliError({
-      message: "Provide exactly one AI Note identifier: --id or --slug.",
-      kind: "invalid_args",
-      status: 400,
-      exitCode: EXIT_CODES.invalidArgs,
-      details: { requiredOneOf: ["--id", "--slug"] }
-    });
-  }
-  return id ? { id } : { slug };
-}
-async function runAiNotesQuery(cmd, config) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
-  await runGraphqlQueryCommand({
-    command: config.command,
-    operationName: config.operationName,
-    runtimeOptions: context.runtimeOptions,
-    field: config.field,
-    variables: normalizeGraphqlVariables2({
-      organization_id: resolveOrganizationId(context.organizationId),
-      ...config.variables
-    }),
-    variableTypes: config.variableTypes,
-    selectionSet: config.selectionSet,
-    isList: config.isList,
-    isShow: config.isShow,
-    transformData: projectAiNotesPayload
-  });
-}
-function registerAiNotesCommands(program) {
-  const aiNotes = program.command("ai-notes").description("AI Notes read-only list and detail metadata");
-  aiNotes.command("list").description("Read safe AI Note metadata without transcripts or provider payloads").option("--page <page>").option("--per <per>").action(async (opts, cmd) => {
-    await runAiNotesQuery(cmd, {
-      command: "ai-notes.list",
-      operationName: "AiNotes",
-      field: "ai_notes",
-      variables: {
-        page: opts.page,
-        per: opts.per
-      },
-      variableTypes: {
-        organization_id: "ID!",
-        page: "Int",
-        per: "Int"
-      },
-      selectionSet: AI_NOTES_SELECTION,
-      isList: true
-    });
-  });
-  aiNotes.command("show").description("Read safe AI Note detail metadata by id or slug").option("--id <id>").option("--slug <slug>").action(async (opts, cmd) => {
-    const variables = showVariables(opts);
-    await runAiNotesQuery(cmd, {
-      command: "ai-notes.show",
-      operationName: "AiNote",
-      field: "ai_note",
-      variables,
-      variableTypes: {
-        organization_id: "ID!",
-        ...variables.id ? { id: "ID!" } : {},
-        ...variables.slug ? { slug: "String!" } : {}
-      },
-      selectionSet: AI_NOTE_SELECTION,
-      isShow: true
-    });
-  });
-}
-
 // src/commands/atlasAuthoring.ts
 var import_zod19 = require("zod");
 var idSchema14 = import_zod19.z.string().trim().min(1);
@@ -15072,7 +14951,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   const automations = program.command("automations").description("Bounded Automation authoring operations");
-  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
     const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15094,6 +14973,7 @@ function registerAtlasAuthoringCommands(program) {
           ...opts.description !== void 0 ? { description: String(opts.description) } : {},
           ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
           ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+          ...opts.agentId !== void 0 ? { agentId: idSchema14.parse(opts.agentId) } : {},
           ...opts.status !== void 0 ? { status: String(opts.status) } : {},
           ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
           ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
@@ -15164,7 +15044,6 @@ var PRIMARY_NAMESPACES = [
   "planner",
   "mail",
   "datasheets",
-  "ai-notes",
   "phantom",
   "tasks",
   "projects",
@@ -15329,7 +15208,7 @@ var NAMESPACE_DOCS = {
     tier: "primary",
     description: "Bounded Automation create and persisted readback operations.",
     examples: [
-      `wave automations create --summary "Weekly review" --ai-task-config '{"prompt":"Review tasks"}' --idempotency-key automation-create-001`,
+      `wave automations create --summary "Weekly review" --agent-id 123 --ai-task-config '{"cycle":"repeat","repeatSchedule":{"interval":1,"frequency":"week","weekdays":[1,3],"at":"2:30 PM","starting":"2026-07-20T00:00:00.000Z","ending":"never","endingRuns":1,"endingDate":null,"timezone":"America/Phoenix"}}' --idempotency-key automation-create-001`,
       "wave automations show --id 123"
     ],
     schema: {
@@ -15338,6 +15217,7 @@ var NAMESPACE_DOCS = {
       safety: [
         "Create calls only createAutomation with an explicit idempotency key.",
         "Only the API-defined ai_task_config field accepts validated JSON.",
+        "Optional executor Agent linkage is sent only through the API-defined top-level agentId input.",
         "Does not create a project Task, run an Automation, or invoke AI OS actions.",
         "Show uses the API-owned automation query by id; no slug fallback is implemented."
       ],
@@ -15599,26 +15479,6 @@ var NAMESPACE_DOCS = {
       ]
     }
   },
-  "ai-notes": {
-    name: "ai-notes",
-    tier: "primary",
-    description: "AI Notes read-only list and detail metadata for CLI-backed Atlas and harness inspection.",
-    examples: [
-      "wave ai-notes list --page 1 --per 20",
-      "wave ai-notes show --id note_123",
-      "wave ai-notes show --slug weekly-summary"
-    ],
-    schema: {
-      output: "json-envelope-default",
-      readOnly: true,
-      safety: [
-        "Uses API-owned GraphQL read fields aiNotes and aiNote.",
-        "List/show output is limited to safe AI Note identifiers, title, status, visibility, source reference, owner member id, schedule timestamps, and record timestamps.",
-        "Does not expose transcript upload, transcription finalize, consent grant, create, update, delete, transcript text, segment text, client secrets, unsafe metadata, raw provider payloads, credentials, tokens, or secrets by default."
-      ],
-      commands: ["list", "show"]
-    }
-  },
   "markdown-tree": {
     name: "markdown-tree",
     tier: "advanced",
@@ -15840,7 +15700,9 @@ async function resolveDoctorAuthOrganization(params) {
     if (!status || typeof status !== "object" || Array.isArray(status)) {
       return null;
     }
-    const organization = status.organization;
+    const cliAuthStatus = status;
+    if (cliAuthStatus.authenticated !== true) return null;
+    const organization = cliAuthStatus.organization;
     if (!organization || typeof organization !== "object" || Array.isArray(organization)) {
       return null;
     }
@@ -15881,7 +15743,7 @@ async function runDoctor(cmd, opts) {
       name: "organization_id",
       ok: Boolean(organizationId || authOrganization?.id || authOrganization?.slug),
       status: organizationId || authOrganization?.id || authOrganization?.slug ? "resolved" : "missing",
-      source: organizationId ? "flag/stdin/env" : authOrganization ? "auth_token" : "unresolved",
+      source: organizationId ? "explicit_flag" : authOrganization ? "auth_token" : "unresolved",
       ...authOrganization?.id ? { id: authOrganization.id } : {},
       ...authOrganization?.slug ? { slug: authOrganization.slug } : {}
     },
@@ -16134,20 +15996,20 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.63";
+var CLI_VERSION = "0.1.66";
 
 // src/cli.ts
 function buildCli(options) {
   const program = new import_commander.Command();
   program.name("wave").description("Wave agent CLI").version(CLI_VERSION, "-V, --version", "output the version number").showHelpAfterError(false).allowExcessArguments(false).option("--token <token>", "API token (prefer WAVE_API_TOKEN env var)").option("--token-stdin", "Read API token from stdin").option(
     "--auth-json-stdin",
-    "Read auth/runtime context JSON from stdin (token, baseUrl, organizationId, ...)"
+    "Read auth/runtime context JSON from stdin (token, baseUrl, tracing fields, ...)"
   ).option(
     "--base-url <baseUrl>",
     "API base URL (prefer WAVE_API_BASE_URL env var)"
   ).option(
     "--organization-id <organizationId>",
-    "Organization ID (prefer WAVE_ORGANIZATION_ID env var)"
+    "Explicit organization ID override"
   ).option(
     "--config <configPath>",
     "Optional JSON config file (default: WAVE_CONFIG_PATH or ~/.wave/config.json when present)"
@@ -16210,7 +16072,6 @@ function buildCli(options) {
   registerMailCommands(program);
   registerPhantomCommands(program);
   registerDatasheetsCommands(program);
-  registerAiNotesCommands(program);
   registerAuthCommands(program);
   registerDiscoveryCommands(program);
   attachNamespaceDiscovery(program);

package/dist/index.js

@@ -127,9 +127,7 @@ function getConfig(options) {
   const parsed = configSchema.safeParse({
     baseUrl,
     token,
-    organizationId: toOptionalNonEmpty(
-      options.organizationId ?? process.env.WAVE_ORGANIZATION_ID ?? process.env.WAVE_ORG_ID
-    ),
+    organizationId: toOptionalNonEmpty(options.organizationId),
     timeoutMs: parseTimeoutMs(options.timeoutMs ?? process.env.WAVE_TIMEOUT_MS),
     debug: options.debug ?? parseDebug(process.env.WAVE_DEBUG),
     agentName: toOptionalNonEmpty(options.agentName ?? process.env.WAVE_AGENT_NAME),
@@ -2186,7 +2184,6 @@ function parseAuthJson(raw) {
     return {
       token: normalize3(obj.token),
       baseUrl: normalize3(obj.baseUrl ?? obj.base_url),
-      organizationId: normalize3(obj.organizationId ?? obj.organization_id),
       timeoutMs: typeof obj.timeoutMs === "number" || typeof obj.timeoutMs === "string" ? obj.timeoutMs : typeof obj.timeout_ms === "number" || typeof obj.timeout_ms === "string" ? obj.timeout_ms : void 0,
       debug: parseBool(obj.debug),
       agentName: normalize3(obj.agentName ?? obj.agent_name),
@@ -2269,7 +2266,6 @@ function resolveAuthToken(options, stdin, config, env) {
     { token: normalize3(options.token), source: "flag" },
     { token: normalize3(stdin.token), source: "stdin" },
     { token: normalize3(env.WAVE_API_TOKEN), source: "env" },
-    { token: normalize3(config.token), source: "config" },
     { token: normalize3(config.token), source: "config" }
   ];
   return candidates.find((candidate) => candidate.token) ?? { source: "none" };
@@ -2282,18 +2278,8 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(env.WAVE_API_URL),
     normalize3(config.baseUrl)
   );
-  const organizationCandidates = [
-    { organizationId: normalize3(options.organizationId), source: "flag" },
-    { organizationId: normalize3(stdin.organizationId), source: "stdin" },
-    { organizationId: normalize3(env.WAVE_ORGANIZATION_ID), source: "env" },
-    { organizationId: normalize3(env.WAVE_ORG_ID), source: "env" },
-    { organizationId: normalize3(config.organizationId), source: "config" }
-  ];
-  const resolvedOrganization = organizationCandidates.find((candidate) => candidate.organizationId) ?? {
-    organizationId: void 0,
-    source: "none"
-  };
-  const organizationId = resolvedOrganization.organizationId;
+  const organizationId = normalize3(options.organizationId);
+  const organizationIdSource = organizationId ? "flag" : "none";
   const timeoutMs = firstDefined(options.timeoutMs, stdin.timeoutMs, env.WAVE_TIMEOUT_MS, config.timeoutMs);
   const debug = firstDefined(
     options.debug,
@@ -2382,7 +2368,7 @@ function resolveFromSources(options, stdin, config, env) {
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
   return {
     organizationId,
-    organizationIdSource: resolvedOrganization.source,
+    organizationIdSource,
     runtimeOptions: {
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
@@ -2522,7 +2508,9 @@ async function resolveCommandContext(options) {
 function organizationIdFromCliAuthStatus(data) {
   const status = data.cliAuthStatus;
   if (!status || typeof status !== "object" || Array.isArray(status)) return void 0;
-  const organization = status.organization;
+  const cliAuthStatus = status;
+  if (cliAuthStatus.authenticated !== true) return void 0;
+  const organization = cliAuthStatus.organization;
   if (!organization || typeof organization !== "object" || Array.isArray(organization)) return void 0;
   return normalize3(organization.id);
 }
@@ -14459,7 +14447,7 @@ async function runDatasheetsQuery(cmd, config) {
   });
 }
 async function runDatasheetsMutation(cmd, opts, config) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = config.organizationContext === "optional" ? await resolveUnscopedCommandContext(cmd.optsWithGlobals()) : await resolveCommandContext(cmd.optsWithGlobals());
   const variables = config.organizationContext === "optional" ? context.organizationId ? { organization_id: context.organizationId } : {} : { organization_id: resolveOrganizationId(context.organizationId) };
   for (const id of config.requiredIds ?? []) {
     variables[id.variable] = requireNonEmpty(opts[id.option], id.label, config.command);
@@ -14496,7 +14484,7 @@ async function runDatasheetsMutation(cmd, opts, config) {
     runtimeOptions: context.runtimeOptions,
     field: config.field,
     variables: normalizeGraphqlVariables2(variables),
-    variableTypes: { organization_id: "ID!" },
+    variableTypes: config.organizationContext === "optional" && !context.organizationId ? {} : { organization_id: "ID!" },
     selectionSet: DATASHEET_MUTATION_SELECTION
   });
 }
@@ -14788,115 +14776,6 @@ function registerDatasheetsCommands(program) {
   });
 }
 
-// src/commands/aiNotes.ts
-var AI_NOTE_SAFE_FIELDS = [
-  "id",
-  "slug",
-  "title",
-  "status",
-  "visibility",
-  "sourceType",
-  "sourceReference",
-  "ownerMemberId",
-  "scheduledStartAt",
-  "scheduledEndAt",
-  "createdAt",
-  "updatedAt"
-];
-var AI_NOTE_SELECTION = `{ ${AI_NOTE_SAFE_FIELDS.join(" ")} }`;
-var AI_NOTES_SELECTION = AI_NOTE_SELECTION;
-function pickSafeAiNoteFields(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  const record = value;
-  const safe = {};
-  for (const field of AI_NOTE_SAFE_FIELDS) {
-    if (Object.prototype.hasOwnProperty.call(record, field)) {
-      safe[field] = record[field];
-    }
-  }
-  return safe;
-}
-function projectAiNotesPayload(payload) {
-  if (Array.isArray(payload)) {
-    return payload.map((item) => pickSafeAiNoteFields(item)).filter(Boolean);
-  }
-  if (!payload || typeof payload !== "object") {
-    return payload;
-  }
-  return pickSafeAiNoteFields(payload);
-}
-function showVariables(opts) {
-  const id = typeof opts.id === "string" && opts.id.trim() !== "" ? opts.id.trim() : void 0;
-  const slug = typeof opts.slug === "string" && opts.slug.trim() !== "" ? opts.slug.trim() : void 0;
-  if (!id && !slug || id && slug) {
-    throw new CliError({
-      message: "Provide exactly one AI Note identifier: --id or --slug.",
-      kind: "invalid_args",
-      status: 400,
-      exitCode: EXIT_CODES.invalidArgs,
-      details: { requiredOneOf: ["--id", "--slug"] }
-    });
-  }
-  return id ? { id } : { slug };
-}
-async function runAiNotesQuery(cmd, config) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
-  await runGraphqlQueryCommand({
-    command: config.command,
-    operationName: config.operationName,
-    runtimeOptions: context.runtimeOptions,
-    field: config.field,
-    variables: normalizeGraphqlVariables2({
-      organization_id: resolveOrganizationId(context.organizationId),
-      ...config.variables
-    }),
-    variableTypes: config.variableTypes,
-    selectionSet: config.selectionSet,
-    isList: config.isList,
-    isShow: config.isShow,
-    transformData: projectAiNotesPayload
-  });
-}
-function registerAiNotesCommands(program) {
-  const aiNotes = program.command("ai-notes").description("AI Notes read-only list and detail metadata");
-  aiNotes.command("list").description("Read safe AI Note metadata without transcripts or provider payloads").option("--page <page>").option("--per <per>").action(async (opts, cmd) => {
-    await runAiNotesQuery(cmd, {
-      command: "ai-notes.list",
-      operationName: "AiNotes",
-      field: "ai_notes",
-      variables: {
-        page: opts.page,
-        per: opts.per
-      },
-      variableTypes: {
-        organization_id: "ID!",
-        page: "Int",
-        per: "Int"
-      },
-      selectionSet: AI_NOTES_SELECTION,
-      isList: true
-    });
-  });
-  aiNotes.command("show").description("Read safe AI Note detail metadata by id or slug").option("--id <id>").option("--slug <slug>").action(async (opts, cmd) => {
-    const variables = showVariables(opts);
-    await runAiNotesQuery(cmd, {
-      command: "ai-notes.show",
-      operationName: "AiNote",
-      field: "ai_note",
-      variables,
-      variableTypes: {
-        organization_id: "ID!",
-        ...variables.id ? { id: "ID!" } : {},
-        ...variables.slug ? { slug: "String!" } : {}
-      },
-      selectionSet: AI_NOTE_SELECTION,
-      isShow: true
-    });
-  });
-}
-
 // src/commands/atlasAuthoring.ts
 import { z as z19 } from "zod";
 var idSchema14 = z19.string().trim().min(1);
@@ -15071,7 +14950,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   const automations = program.command("automations").description("Bounded Automation authoring operations");
-  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
     const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15093,6 +14972,7 @@ function registerAtlasAuthoringCommands(program) {
           ...opts.description !== void 0 ? { description: String(opts.description) } : {},
           ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
           ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
+          ...opts.agentId !== void 0 ? { agentId: idSchema14.parse(opts.agentId) } : {},
           ...opts.status !== void 0 ? { status: String(opts.status) } : {},
           ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
           ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
@@ -15163,7 +15043,6 @@ var PRIMARY_NAMESPACES = [
   "planner",
   "mail",
   "datasheets",
-  "ai-notes",
   "phantom",
   "tasks",
   "projects",
@@ -15328,7 +15207,7 @@ var NAMESPACE_DOCS = {
     tier: "primary",
     description: "Bounded Automation create and persisted readback operations.",
     examples: [
-      `wave automations create --summary "Weekly review" --ai-task-config '{"prompt":"Review tasks"}' --idempotency-key automation-create-001`,
+      `wave automations create --summary "Weekly review" --agent-id 123 --ai-task-config '{"cycle":"repeat","repeatSchedule":{"interval":1,"frequency":"week","weekdays":[1,3],"at":"2:30 PM","starting":"2026-07-20T00:00:00.000Z","ending":"never","endingRuns":1,"endingDate":null,"timezone":"America/Phoenix"}}' --idempotency-key automation-create-001`,
       "wave automations show --id 123"
     ],
     schema: {
@@ -15337,6 +15216,7 @@ var NAMESPACE_DOCS = {
       safety: [
         "Create calls only createAutomation with an explicit idempotency key.",
         "Only the API-defined ai_task_config field accepts validated JSON.",
+        "Optional executor Agent linkage is sent only through the API-defined top-level agentId input.",
         "Does not create a project Task, run an Automation, or invoke AI OS actions.",
         "Show uses the API-owned automation query by id; no slug fallback is implemented."
       ],
@@ -15598,26 +15478,6 @@ var NAMESPACE_DOCS = {
       ]
     }
   },
-  "ai-notes": {
-    name: "ai-notes",
-    tier: "primary",
-    description: "AI Notes read-only list and detail metadata for CLI-backed Atlas and harness inspection.",
-    examples: [
-      "wave ai-notes list --page 1 --per 20",
-      "wave ai-notes show --id note_123",
-      "wave ai-notes show --slug weekly-summary"
-    ],
-    schema: {
-      output: "json-envelope-default",
-      readOnly: true,
-      safety: [
-        "Uses API-owned GraphQL read fields aiNotes and aiNote.",
-        "List/show output is limited to safe AI Note identifiers, title, status, visibility, source reference, owner member id, schedule timestamps, and record timestamps.",
-        "Does not expose transcript upload, transcription finalize, consent grant, create, update, delete, transcript text, segment text, client secrets, unsafe metadata, raw provider payloads, credentials, tokens, or secrets by default."
-      ],
-      commands: ["list", "show"]
-    }
-  },
   "markdown-tree": {
     name: "markdown-tree",
     tier: "advanced",
@@ -15839,7 +15699,9 @@ async function resolveDoctorAuthOrganization(params) {
     if (!status || typeof status !== "object" || Array.isArray(status)) {
       return null;
     }
-    const organization = status.organization;
+    const cliAuthStatus = status;
+    if (cliAuthStatus.authenticated !== true) return null;
+    const organization = cliAuthStatus.organization;
     if (!organization || typeof organization !== "object" || Array.isArray(organization)) {
       return null;
     }
@@ -15880,7 +15742,7 @@ async function runDoctor(cmd, opts) {
       name: "organization_id",
       ok: Boolean(organizationId || authOrganization?.id || authOrganization?.slug),
       status: organizationId || authOrganization?.id || authOrganization?.slug ? "resolved" : "missing",
-      source: organizationId ? "flag/stdin/env" : authOrganization ? "auth_token" : "unresolved",
+      source: organizationId ? "explicit_flag" : authOrganization ? "auth_token" : "unresolved",
       ...authOrganization?.id ? { id: authOrganization.id } : {},
       ...authOrganization?.slug ? { slug: authOrganization.slug } : {}
     },
@@ -16133,20 +15995,20 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.63";
+var CLI_VERSION = "0.1.66";
 
 // src/cli.ts
 function buildCli(options) {
   const program = new Command();
   program.name("wave").description("Wave agent CLI").version(CLI_VERSION, "-V, --version", "output the version number").showHelpAfterError(false).allowExcessArguments(false).option("--token <token>", "API token (prefer WAVE_API_TOKEN env var)").option("--token-stdin", "Read API token from stdin").option(
     "--auth-json-stdin",
-    "Read auth/runtime context JSON from stdin (token, baseUrl, organizationId, ...)"
+    "Read auth/runtime context JSON from stdin (token, baseUrl, tracing fields, ...)"
   ).option(
     "--base-url <baseUrl>",
     "API base URL (prefer WAVE_API_BASE_URL env var)"
   ).option(
     "--organization-id <organizationId>",
-    "Organization ID (prefer WAVE_ORGANIZATION_ID env var)"
+    "Explicit organization ID override"
   ).option(
     "--config <configPath>",
     "Optional JSON config file (default: WAVE_CONFIG_PATH or ~/.wave/config.json when present)"
@@ -16209,7 +16071,6 @@ function buildCli(options) {
   registerMailCommands(program);
   registerPhantomCommands(program);
   registerDatasheetsCommands(program);
-  registerAiNotesCommands(program);
   registerAuthCommands(program);
   registerDiscoveryCommands(program);
   attachNamespaceDiscovery(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wave-ai-os/wave-cli",
-  "version": "0.1.63",
+  "version": "0.1.66",
   "type": "module",
   "bin": {
     "wave": "dist/index.js"

package/scripts/benchmark-cli.mjs

@@ -2,6 +2,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { spawnSync } from "node:child_process";
+import { REQUIRED_WAVE_RUNTIME_INPUTS } from "./cli-token-scope.mjs";
 
 const DEFAULTS = {
   runs: 10,
@@ -479,7 +480,7 @@ function main() {
   };
 
   const waveEntryAbs = resolve(cwd, options.waveEntry);
-  const waveMissing = ["WAVE_API_BASE_URL", "WAVE_API_TOKEN", "WAVE_ORGANIZATION_ID"].filter((key) => !baseEnv[key]);
+  const waveMissing = REQUIRED_WAVE_RUNTIME_INPUTS.filter((key) => !baseEnv[key]);
   const waveReady = existsSync(waveEntryAbs) && waveMissing.length === 0;
 
   const obsidian = resolveObsidianBinary(options.obsidianBin);

package/scripts/cli-token-scope.mjs

@@ -0,0 +1,10 @@
+export const REQUIRED_WAVE_RUNTIME_INPUTS = ["WAVE_API_BASE_URL", "WAVE_API_TOKEN"];
+
+export function organizationIdFromAuthenticatedStatus(envelope) {
+  if (!envelope || envelope.ok !== true) return undefined;
+  if (envelope.data?.authenticated !== true) return undefined;
+  const organizationId = envelope.data?.organization?.id;
+  return typeof organizationId === "string" && organizationId.trim() !== ""
+    ? organizationId
+    : undefined;
+}

package/scripts/verify-dev-api.mjs

@@ -2,6 +2,7 @@
 import { readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
+import { organizationIdFromAuthenticatedStatus } from "./cli-token-scope.mjs";
 
 function loadDotEnv(filePath) {
   const raw = readFileSync(filePath, "utf8");
@@ -348,12 +349,18 @@ const dot = loadDotEnv(envFile);
 const env = {
   WAVE_API_BASE_URL: dot.WAVE_API_BASE_URL,
   WAVE_API_TOKEN: dot.WAVE_API_TOKEN,
-  WAVE_ORGANIZATION_ID: dot.WAVE_ORGANIZATION_ID,
   WAVE_AGENT_NAME: dot.WAVE_AGENT_NAME || "cli-verifier",
   WAVE_AGENT_RUN_ID: `verify-${Date.now()}`,
   WAVE_TIMEOUT_MS: dot.WAVE_TIMEOUT_MS || "10000"
 };
 
+const authStatus = runWave(["auth", "status"], env);
+const orgId = organizationIdFromAuthenticatedStatus(authStatus.parsed);
+if (!orgId) {
+  console.error("verify-dev-api failed: authenticated CLI token status did not return an organization id.");
+  process.exit(1);
+}
+
 const idLookup = {};
 const listSeeds = [
   ["projects", ["projects", "list", "--page", "1", "--per", "2"]],
@@ -386,7 +393,7 @@ const listSeeds = [
   ["quarterlyObjectives", ["foundation", "quarterly-objectives", "list", "--page", "1", "--per", "2"]]
 ];
 
-const results = [];
+const results = [authStatus];
 for (const [key, args] of listSeeds) {
   const res = runWave(args, env);
   results.push(res);
@@ -413,7 +420,6 @@ for (const [key, args] of listSeeds) {
   }
 }
 
-const orgId = env.WAVE_ORGANIZATION_ID;
 const projectId = idLookup.projects;
 const taskId = idLookup.tasks;
 const rockId = idLookup.rocks;