@wave-ai-os/wave-cli 0.1.71 → 0.1.73

package/README.md

@@ -74,6 +74,12 @@ The API base defaults to production: `https://api.ourwave.io`. Supply
 `--base-url`, stdin context, `WAVE_API_BASE_URL`/`WAVE_API_URL`, or config only
 when using a non-production environment.
 
+`wave login` always opens the production browser login at
+`https://app.ourwave.io/login` unless `--base-url` is supplied explicitly.
+The CLI uses `https://api.ourwave.io` only to create and poll that login
+session. Ambient endpoint configuration never redirects a bare login to a
+local environment.
+
 Organization-scoped data commands use the organization certified by the
 authenticated CLI token. `--organization-id` is the only local override.
 

package/dist/index.cjs

@@ -4199,18 +4199,8 @@ var SKILL_SELECTION = `{
   }
   createdAt
   updatedAt
+  updateVersion
 }`;
-function asRecord4(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function findSkillById(id) {
-  return (payload) => {
-    if (!Array.isArray(payload)) {
-      return null;
-    }
-    return payload.find((entry2) => String(asRecord4(entry2)?.id ?? "") === id) ?? null;
-  };
-}
 function registerSkillCommands(program) {
   const skills = program.command("skills").description("Skill record operations");
   skills.command("list").description("List Skill records").option("--scope <scope>", "Filter skills by scope").option("--query <query>", "Filter skills by search query").option("--limit <limit>", "Limit skills returned").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
@@ -4238,7 +4228,7 @@ function registerSkillCommands(program) {
       isList: true
     });
   });
-  skills.command("show").description("Read one persisted Skill record by id").requiredOption("--id <id>", "Skill id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
+  skills.command("show").description("Read one persisted Skill record by id or slug").requiredOption("--id <idOrSlug>", "Skill id or slug").option("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const id = idSchema7.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -4246,16 +4236,17 @@ function registerSkillCommands(program) {
       command: "skills.show",
       operationName: "SkillsShow",
       runtimeOptions: context.runtimeOptions,
-      field: "skills",
+      field: "skill",
       variables: {
-        organization_id: organizationId
+        organization_id: organizationId,
+        id
       },
       variableTypes: {
-        organization_id: "ID!"
+        organization_id: "ID!",
+        id: "ID!"
       },
       selectionSet: SKILL_SELECTION,
-      isShow: true,
-      transformData: findSkillById(id)
+      isShow: true
     });
   });
 }
@@ -6483,7 +6474,7 @@ var import_zod16 = require("zod");
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
-function asRecord5(value) {
+function asRecord4(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -6497,7 +6488,7 @@ function setInternalCliOptions(program, options) {
 function getInternalCliOptions(command) {
   let current = command;
   while (current) {
-    const record = asRecord5(current[INTERNAL_OPTIONS_KEY]);
+    const record = asRecord4(current[INTERNAL_OPTIONS_KEY]);
     if (record) {
       return {
         enableRetryOnEmptyPhrase: record.enableRetryOnEmptyPhrase === true
@@ -10169,12 +10160,15 @@ function positiveInt2(raw, fallback) {
 function requestTimeoutMs(totalTimeoutMs) {
   return Math.max(1e3, Math.min(totalTimeoutMs, 1e4));
 }
-function asRecord6(value) {
+function asRecord5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
+function resolveLoginApiBaseUrl(globals) {
+  return asString(globals.baseUrl) ?? DEFAULT_PRODUCTION_API_BASE_URL;
+}
 function localUiBaseUrlFor(baseUrl) {
   const parsed = new URL(baseUrl);
   if ((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") && parsed.port === "3009") {
@@ -10216,9 +10210,9 @@ function cliTokenFromPoll(payload) {
   return asString(payload.cliToken) ?? asString(payload.cli_token) ?? asString(payload.token);
 }
 function unwrapMutationResult(value) {
-  const record = asRecord6(value);
+  const record = asRecord5(value);
   if (!record) return null;
-  const data = asRecord6(record.data);
+  const data = asRecord5(record.data);
   if (data && (Object.prototype.hasOwnProperty.call(record, "ok") || Object.prototype.hasOwnProperty.call(record, "errors") || Object.prototype.hasOwnProperty.call(record, "errorCode") || Object.prototype.hasOwnProperty.call(record, "error_code"))) {
     return data;
   }
@@ -10237,9 +10231,10 @@ async function authStatusRequest(params) {
 }
 async function runTokenLogin(cmd, opts) {
   const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
-  const baseUrl = context.runtimeOptions.baseUrl;
   const globals = cmd.optsWithGlobals();
-  const token = typeof opts.token === "string" && opts.token.trim() !== "" ? opts.token.trim() : typeof globals.token === "string" && globals.token.trim() !== "" ? globals.token.trim() : context.runtimeOptions.token;
+  const explicitBaseUrl = asString(globals.baseUrl);
+  const baseUrl = resolveLoginApiBaseUrl(globals);
+  const token = typeof opts.token === "string" && opts.token.trim() !== "" ? opts.token.trim() : typeof globals.token === "string" && globals.token.trim() !== "" ? globals.token.trim() : explicitBaseUrl ? context.runtimeOptions.token : void 0;
   const timeoutMs = positiveInt2(opts.timeoutMs ?? context.runtimeOptions.timeoutMs, 1e4);
   if (!baseUrl) {
     return printEnvelopeAndExit({
@@ -10282,7 +10277,7 @@ async function runTokenLogin(cmd, opts) {
       exitCode: mapStatusToExitCode(status.error.status)
     });
   }
-  const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
+  const statusData = asRecord5(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
   const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
@@ -10304,7 +10299,7 @@ async function runTokenLogin(cmd, opts) {
 }
 async function runBrowserLogin(cmd, opts) {
   const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
-  const baseUrl = context.runtimeOptions.baseUrl;
+  const baseUrl = resolveLoginApiBaseUrl(cmd.optsWithGlobals());
   const timeoutMs = positiveInt2(opts.timeoutMs ?? context.runtimeOptions.timeoutMs, DEFAULT_LOGIN_TIMEOUT_MS);
   const pollIntervalMs = positiveInt2(opts.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
   if (!baseUrl) {
@@ -10499,7 +10494,7 @@ async function runLogout(cmd) {
     });
     if (result.ok) {
       requestId = result.result.requestId;
-      const payload = asRecord6(result.result.data.revokeCliToken) ?? {};
+      const payload = asRecord5(result.result.data.revokeCliToken) ?? {};
       revokedRemote = payload.ok !== false;
     } else {
       requestId = result.requestId;
@@ -10562,7 +10557,7 @@ async function runAuthStatus(cmd) {
       exitCode: mapStatusToExitCode(result.error.status)
     });
   }
-  const status = asRecord6(result.result.data.cliAuthStatus) ?? {};
+  const status = asRecord5(result.result.data.cliAuthStatus) ?? {};
   const baseAuthStatus = status.baseAuthStatus;
   return printEnvelopeAndExit({
     envelope: envelope({
@@ -12213,11 +12208,11 @@ function sanitizePlannerJson(value) {
   }
   return output;
 }
-function asRecord7(value) {
+function asRecord6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readPlannerStateKey(value, keys) {
-  const record = asRecord7(value);
+  const record = asRecord6(value);
   if (!record) {
     return null;
   }
@@ -14786,6 +14781,7 @@ var agentToolAccessSchema = import_zod19.z.array(
     scope_value: nonEmptyStringSchema
   }).strict()
 ).min(1);
+var agentToolAccessUpdateSchema = agentToolAccessSchema.min(0);
 var agentPluginConnectionsSchema = import_zod19.z.array(
   import_zod19.z.object({
     external_tool_connection_id: nonEmptyStringSchema,
@@ -14797,6 +14793,30 @@ var agentPluginConnectionsSchema = import_zod19.z.array(
     enabled: import_zod19.z.boolean().optional()
   }).strict()
 ).min(1);
+var agentPluginConnectionUpdateSchema = import_zod19.z.array(
+  import_zod19.z.union([
+    import_zod19.z.object({
+      id: nonEmptyStringSchema,
+      _destroy: import_zod19.z.literal(true)
+    }).strict(),
+    import_zod19.z.object({
+      id: nonEmptyStringSchema.optional(),
+      external_tool_connection_id: nonEmptyStringSchema.optional(),
+      tool_key: nonEmptyStringSchema.optional(),
+      scope_value: nonEmptyStringSchema.optional(),
+      allowed_tools: import_zod19.z.array(nonEmptyStringSchema).optional(),
+      allowed_scopes: import_zod19.z.array(nonEmptyStringSchema).optional(),
+      requires_confirmation: import_zod19.z.boolean().optional(),
+      enabled: import_zod19.z.boolean().optional()
+    }).strict().superRefine((value, context) => {
+      if (value.id || value.external_tool_connection_id && value.tool_key) return;
+      context.addIssue({
+        code: import_zod19.z.ZodIssueCode.custom,
+        message: "Plugin updates require an id, or both external_tool_connection_id and tool_key for a new grant."
+      });
+    })
+  ])
+);
 var agentTriggerSchema = import_zod19.z.object({
   trigger_type: import_zod19.z.literal("cron"),
   cron_expression: nonEmptyStringSchema,
@@ -14806,6 +14826,14 @@ var agentTriggerSchema = import_zod19.z.object({
   max_runs: import_zod19.z.number().int().positive().nullable().optional(),
   enabled: import_zod19.z.boolean().optional()
 }).strict();
+var agentTriggerUpdateSchema = import_zod19.z.union([
+  agentTriggerSchema.extend({ id: nonEmptyStringSchema.optional() }).strict(),
+  import_zod19.z.object({
+    id: nonEmptyStringSchema,
+    _destroy: import_zod19.z.literal(true)
+  }).strict()
+]);
+var automationConfigSchema = import_zod19.z.record(import_zod19.z.string(), import_zod19.z.unknown());
 var AGENT_SELECTION = `{
   id
   type
@@ -14856,6 +14884,7 @@ var AGENT_SELECTION = `{
   memberId
   createdAt
   updatedAt
+  updateVersion
 }`;
 var AGENT_PLUGIN_CATALOG_SELECTION = `{
   externalToolConnectionId
@@ -14883,8 +14912,9 @@ var AUTOMATION_SELECTION = `{
   memberId
   createdAt
   updatedAt
+  updateVersion
 }`;
-function asRecord8(value) {
+function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asRequiredString(value) {
@@ -14933,12 +14963,12 @@ function parseJsonOption(value, optionName, schema) {
   return schema.parse(parseJson(String(value), optionName));
 }
 function normalizePersistedCreatePayload(payload) {
-  const mutation = asRecord8(payload);
-  const mutationData = asRecord8(mutation?.data);
-  const persisted = asRecord8(mutationData?.data) ?? mutationData;
-  const attributes = asRecord8(persisted?.attributes);
-  const meta = asRecord8(mutationData?.meta);
-  const idempotency = asRecord8(meta?.atlas_idempotency);
+  const mutation = asRecord7(payload);
+  const mutationData = asRecord7(mutation?.data);
+  const persisted = asRecord7(mutationData?.data) ?? mutationData;
+  const attributes = asRecord7(persisted?.attributes);
+  const meta = asRecord7(mutationData?.meta);
+  const idempotency = asRecord7(meta?.atlas_idempotency);
   const id = asRequiredString(persisted?.id);
   const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
   const replay = idempotency?.replay;
@@ -14967,6 +14997,36 @@ function normalizePersistedCreatePayload(payload) {
     }
   };
 }
+function normalizePersistedUpdatePayload(payload) {
+  const mutation = asRecord7(payload);
+  const mutationData = asRecord7(mutation?.data);
+  const persisted = asRecord7(mutationData?.data) ?? mutationData;
+  const attributes = asRecord7(persisted?.attributes);
+  const id = asRequiredString(persisted?.id);
+  const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
+  const updateVersion = asRequiredString(persisted?.updateVersion) ?? asRequiredString(attributes?.updateVersion) ?? asRequiredString(attributes?.update_version);
+  if (!mutation || !mutationData || !persisted || !id || !slug || !updateVersion) {
+    throw new CliError({
+      message: "Update response did not include persisted id, slug, and updateVersion.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  return {
+    ok: mutation.ok,
+    status: mutation.status,
+    errorCode: mutation.errorCode ?? null,
+    errors: mutation.errors ?? null,
+    persisted: { id, slug, update_version: updateVersion }
+  };
+}
+function parseAutomationConfig(value) {
+  return automationConfigSchema.parse(parseJson(String(value), "--ai-task-config"));
+}
+function parseExpectedUpdateVersion(value) {
+  return nonEmptyStringSchema.parse(String(value));
+}
 function registerAtlasAuthoringCommands(program) {
   const agents = program.command("agents").description("Bounded Agent authoring operations");
   agents.command("create").description("Create an Agent through the API-owned createAgent contract").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--name <name>").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--visibility <visibility>").option("--model <model>").option("--run-when-mentioned <boolean>", "true or false").option("--web-access-enabled <boolean>", "true or false").option("--web-fetch-enabled <boolean>", "true or false").option("--search-past-conversations-enabled <boolean>", "true or false").option("--app-rules-creation-enabled <boolean>", "true or false").option("--tool-discovery-enabled <boolean>", "true or false").option("--self-updates-enabled <boolean>", "true or false").option("--trusted-urls <urls>", "Comma-separated trusted URLs").option("--tool-access <json>", "JSON array of canonical native Agent tool scopes").option(
@@ -15046,7 +15106,7 @@ function registerAtlasAuthoringCommands(program) {
       transformMutationPayload: normalizePersistedCreatePayload
     });
   });
-  agents.command("show").description("Read one persisted Agent by id").requiredOption("--id <id>", "Agent id").action(async (opts, cmd) => {
+  agents.command("show").description("Read one persisted Agent by id or slug").requiredOption("--id <idOrSlug>", "Agent id or slug").action(async (opts, cmd) => {
     const id = idSchema14.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15061,6 +15121,104 @@ function registerAtlasAuthoringCommands(program) {
       isShow: true
     });
   });
+  agents.command("update").description("Update one persisted Agent through the API-owned updateAgent contract").requiredOption("--id <idOrSlug>", "Agent id or slug").requiredOption(
+    "--expected-update-version <version>",
+    "Exact opaque updateVersion value from agents show; rejects stale writes"
+  ).option("--name <name>").option("--description <description>").option("--notes <notes>").option("--status <status>").option("--visibility <visibility>").option("--model <model>").option("--run-when-mentioned <boolean>", "true or false").option("--web-access-enabled <boolean>", "true or false").option("--web-fetch-enabled <boolean>", "true or false").option("--search-past-conversations-enabled <boolean>", "true or false").option("--app-rules-creation-enabled <boolean>", "true or false").option("--tool-discovery-enabled <boolean>", "true or false").option("--self-updates-enabled <boolean>", "true or false").option("--trusted-urls <urls>", "Comma-separated trusted URLs").option("--clear-trusted-urls", "Clear all trusted URLs").option("--tool-access <json>", "JSON array of the complete canonical native Agent tool scopes").option(
+    "--plugin-connections <json>",
+    "JSON array of Agent connector grant patches; removals require id and _destroy:true"
+  ).option(
+    "--trigger <json>",
+    "Canonical Agent trigger patch; use the trigger id from agents show to replace or remove it"
+  ).action(async (opts, cmd) => {
+    if (opts.clearTrustedUrls && opts.trustedUrls !== void 0) {
+      throw new CliError({
+        message: "Use either --trusted-urls or --clear-trusted-urls, not both.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const runWhenMentioned = parseBooleanOption(opts.runWhenMentioned, "--run-when-mentioned");
+    const webAccessEnabled = parseBooleanOption(opts.webAccessEnabled, "--web-access-enabled");
+    const webFetchEnabled = parseBooleanOption(opts.webFetchEnabled, "--web-fetch-enabled");
+    const searchPastConversationsEnabled = parseBooleanOption(
+      opts.searchPastConversationsEnabled,
+      "--search-past-conversations-enabled"
+    );
+    const appRulesCreationEnabled = parseBooleanOption(
+      opts.appRulesCreationEnabled,
+      "--app-rules-creation-enabled"
+    );
+    const toolDiscoveryEnabled = parseBooleanOption(
+      opts.toolDiscoveryEnabled,
+      "--tool-discovery-enabled"
+    );
+    const selfUpdatesEnabled = parseBooleanOption(opts.selfUpdatesEnabled, "--self-updates-enabled");
+    const trustedUrls = parseCommaSeparatedStrings(opts.trustedUrls);
+    const toolAccess = parseJsonOption(
+      opts.toolAccess,
+      "--tool-access",
+      agentToolAccessUpdateSchema
+    );
+    const pluginConnections = parseJsonOption(
+      opts.pluginConnections,
+      "--plugin-connections",
+      agentPluginConnectionUpdateSchema
+    );
+    const trigger = parseJsonOption(opts.trigger, "--trigger", agentTriggerUpdateSchema);
+    const patch = {
+      ...opts.name !== void 0 ? { name: String(opts.name) } : {},
+      ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+      ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+      ...opts.status !== void 0 ? { status: String(opts.status) } : {},
+      ...opts.visibility !== void 0 ? { visibility: String(opts.visibility) } : {},
+      ...opts.model !== void 0 ? { model: String(opts.model) } : {},
+      ...runWhenMentioned !== void 0 ? { run_when_mentioned: runWhenMentioned } : {},
+      ...webAccessEnabled !== void 0 ? { web_access_enabled: webAccessEnabled } : {},
+      ...webFetchEnabled !== void 0 ? { web_fetch_enabled: webFetchEnabled } : {},
+      ...searchPastConversationsEnabled !== void 0 ? { search_past_conversations_enabled: searchPastConversationsEnabled } : {},
+      ...appRulesCreationEnabled !== void 0 ? { app_rules_creation_enabled: appRulesCreationEnabled } : {},
+      ...toolDiscoveryEnabled !== void 0 ? { tool_discovery_enabled: toolDiscoveryEnabled } : {},
+      ...selfUpdatesEnabled !== void 0 ? { self_updates_enabled: selfUpdatesEnabled } : {},
+      ...trustedUrls !== void 0 ? { trusted_urls: trustedUrls } : {},
+      ...opts.clearTrustedUrls ? { trusted_urls: [] } : {},
+      ...toolAccess !== void 0 ? { tool_access: toolAccess } : {},
+      ...pluginConnections !== void 0 ? { agent_tool_connections_attributes: pluginConnections } : {},
+      ...trigger !== void 0 ? { trigger_attributes: trigger } : {}
+    };
+    if (Object.keys(patch).length === 0) {
+      throw new CliError({
+        message: "agents update requires at least one mutable Agent field.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const id = idSchema14.parse(opts.id);
+    const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "agents.update",
+      operationName: "AgentsUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_agent",
+      variableTypes: {
+        organization_id: "ID!",
+        agent_id: "ID!",
+        params: "UpdateAgentParamsInput!",
+        expected_update_version: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        agent_id: id,
+        params: { agent: patch },
+        expected_update_version: expectedUpdateVersion
+      },
+      transformMutationPayload: normalizePersistedUpdatePayload
+    });
+  });
   agents.command("plugin-catalog").description("Read connected Agent plugin capabilities for one supported service").requiredOption(
     "--service <service>",
     "Supported service: gmail, calendar, slack, or stripe"
@@ -15079,7 +15237,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   const automations = program.command("automations").description("Bounded Automation authoring operations");
-  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+  automations.command("create").description("Create a Backlog Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
     const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15102,7 +15260,6 @@ function registerAtlasAuthoringCommands(program) {
           ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
           ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
           ...opts.agentId !== void 0 ? { agentId: idSchema14.parse(opts.agentId) } : {},
-          ...opts.status !== void 0 ? { status: String(opts.status) } : {},
           ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
           ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
         },
@@ -15111,7 +15268,7 @@ function registerAtlasAuthoringCommands(program) {
       transformMutationPayload: normalizePersistedCreatePayload
     });
   });
-  automations.command("show").description("Read one persisted Automation by id").requiredOption("--id <id>", "Automation id").action(async (opts, cmd) => {
+  automations.command("show").description("Read one persisted Automation by id or slug").requiredOption("--id <idOrSlug>", "Automation id or slug").action(async (opts, cmd) => {
     const id = idSchema14.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15126,6 +15283,65 @@ function registerAtlasAuthoringCommands(program) {
       isShow: true
     });
   });
+  automations.command("update").description("Update one task-backed Automation without changing its system-managed status").requiredOption("--id <idOrSlug>", "Automation id or slug").requiredOption(
+    "--expected-update-version <version>",
+    "Exact opaque updateVersion value from automations show; rejects stale writes"
+  ).option("--summary <summary>").option("--description <description>").option("--notes <notes>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").option("--ai-task-config <json>", "Complete replacement ai_task_config JSON object").option(
+    "--agent-id <agentId>",
+    "Executor Agent id; requires --ai-task-config and is stored in that config"
+  ).action(async (opts, cmd) => {
+    if (opts.agentId !== void 0 && opts.aiTaskConfig === void 0) {
+      throw new CliError({
+        message: "automations update requires --ai-task-config whenever --agent-id is supplied.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const aiTaskConfig = opts.aiTaskConfig === void 0 ? void 0 : {
+      ...parseAutomationConfig(opts.aiTaskConfig),
+      ...opts.agentId !== void 0 ? { agent_id: idSchema14.parse(opts.agentId) } : {}
+    };
+    const patch = {
+      ...opts.summary !== void 0 ? { summary: String(opts.summary) } : {},
+      ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+      ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+      ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
+      ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {},
+      ...aiTaskConfig !== void 0 ? { ai_task_config: aiTaskConfig } : {}
+    };
+    if (Object.keys(patch).length === 0) {
+      throw new CliError({
+        message: "automations update requires at least one mutable Automation field.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const id = idSchema14.parse(opts.id);
+    const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "automations.update",
+      operationName: "AutomationsUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_task",
+      variableTypes: {
+        organization_id: "ID!",
+        task_id: "ID!",
+        params: "UpdateTaskParamsInput!",
+        expected_update_version: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        task_id: id,
+        params: { task: patch },
+        expected_update_version: expectedUpdateVersion
+      },
+      transformMutationPayload: normalizePersistedUpdatePayload
+    });
+  });
   const skills = program.commands.find((command) => command.name() === "skills");
   if (!skills) {
     throw new Error("Skills command must be registered before Atlas authoring commands.");
@@ -15157,6 +15373,47 @@ function registerAtlasAuthoringCommands(program) {
       transformMutationPayload: normalizePersistedCreatePayload
     });
   });
+  skills.command("update").description("Update one persisted Skill through the API-owned updateSkill contract").requiredOption("--id <idOrSlug>", "Skill id or slug").requiredOption(
+    "--expected-update-version <version>",
+    "Exact opaque updateVersion value from skills show; rejects stale writes"
+  ).option("--name <name>").option("--emoji <emoji>").option("--description <description>").action(async (opts, cmd) => {
+    const patch = {
+      ...opts.name !== void 0 ? { name: String(opts.name) } : {},
+      ...opts.emoji !== void 0 ? { emoji: String(opts.emoji) } : {},
+      ...opts.description !== void 0 ? { description: String(opts.description) } : {}
+    };
+    if (Object.keys(patch).length === 0) {
+      throw new CliError({
+        message: "skills update requires at least one mutable Skill field.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const id = idSchema14.parse(opts.id);
+    const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "skills.update",
+      operationName: "SkillsUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_skill",
+      variableTypes: {
+        organization_id: "ID!",
+        id: "ID!",
+        input: "UpdateSkillInput!",
+        expected_update_version: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        id,
+        input: patch,
+        expected_update_version: expectedUpdateVersion
+      },
+      transformMutationPayload: normalizePersistedUpdatePayload
+    });
+  });
 }
 
 // src/commands/discovery.ts
@@ -15167,7 +15424,7 @@ var import_node_path4 = require("path");
 var import_node_crypto3 = require("crypto");
 
 // src/version.ts
-var CLI_VERSION = "0.1.71";
+var CLI_VERSION = "0.1.73";
 
 // src/operationMetadata.ts
 var DISCOVERY_OPERATION_IDS = [
@@ -15480,7 +15737,9 @@ var WRITE_OPERATION_IDS = [
   "accountability.create",
   "accountability.update",
   "agents.create",
+  "agents.update",
   "automations.create",
+  "automations.update",
   "contacts.create",
   "contacts.update",
   "content.create-contact",
@@ -15586,6 +15845,7 @@ var WRITE_OPERATION_IDS = [
   "scorecards.create",
   "scorecards.update",
   "skills.create",
+  "skills.update",
   "smart-kpi-views.create",
   "stand-ups.create",
   "stand-ups.update",
@@ -15937,12 +16197,13 @@ var NAMESPACE_DOCS = {
   skills: {
     name: "skills",
     tier: "primary",
-    description: "Skill record readback and bounded create operations.",
+    description: "Skill record readback and bounded create/update operations.",
     examples: [
       "wave skills list --json",
       "wave skills list --scope ADMIN_GLOBAL --json",
       "wave skills show --id 123 --json",
-      'wave skills create --name "Weekly planning" --scope MEMBER_PERSONAL --idempotency-key skill-create-001'
+      'wave skills create --name "Weekly planning" --scope MEMBER_PERSONAL --idempotency-key skill-create-001',
+      'wave skills update --id SKL-01 --expected-update-version 2026-07-17T12:00:00.123456Z --description "Review my projects."'
     ],
     schema: {
       output: "json-envelope-default",
@@ -15950,20 +16211,22 @@ var NAMESPACE_DOCS = {
       safety: [
         "Uses API-owned Skill GraphQL read fields only.",
         "Create calls only createSkill with an explicit idempotency key.",
+        "Update calls only updateSkill with an exact opaque updateVersion token and does not change scope or ownership.",
         "Skill create supports the API-defined ADMIN_GLOBAL and MEMBER_PERSONAL scopes.",
         "Does not update, destroy, archive, approve, or apply Skill records."
       ],
-      commands: ["list", "show", "create"]
+      commands: ["list", "show", "create", "update"]
     }
   },
   agents: {
     name: "agents",
     tier: "primary",
-    description: "Bounded Agent create and persisted readback operations.",
+    description: "Bounded Agent create, readback, and stale-write-protected update operations.",
     examples: [
       'wave agents create --name "Planning helper" --idempotency-key agent-create-001',
       `wave agents create --name "Project summary" --notes "Summarize my projects." --tool-access '[{"tool_key":"projects","scope_value":"all"}]' --trigger '{"trigger_type":"cron","cron_expression":"0 14 * * 2","timezone":"America/Phoenix","enabled":true}' --idempotency-key agent-create-002`,
-      "wave agents show --id 123"
+      "wave agents show --id AGT-01",
+      'wave agents update --id AGT-01 --expected-update-version 2026-07-17T12:00:00.123456Z --notes "Summarize my projects."'
     ],
     schema: {
       output: "json-envelope-default",
@@ -15971,32 +16234,36 @@ var NAMESPACE_DOCS = {
       safety: [
         "Create calls only createAgent with an explicit idempotency key.",
         "Create preserves API-owned defaults by sending only supplied typed Agent fields.",
+        "Update calls only updateAgent with an exact opaque updateVersion token and cannot change ownership.",
         "Native tools, plugin connector grants, and the cron trigger use strict canonical JSON shapes.",
         "Outlook Calendar and Outlook Mail are not supported Agent plugin families in this release.",
         "Show uses the API-owned agent query by id; no slug fallback is implemented."
       ],
-      commands: ["create", "show"]
+      commands: ["create", "show", "update"]
     }
   },
   automations: {
     name: "automations",
     tier: "primary",
-    description: "Bounded Automation create and persisted readback operations.",
+    description: "Bounded task-backed Automation create, readback, and stale-write-protected update operations.",
     examples: [
       `wave automations create --summary "Weekly review" --agent-id 123 --ai-task-config '{"cycle":"repeat","repeatSchedule":{"interval":1,"frequency":"week","weekdays":[1,3],"at":"2:30 PM","starting":"2026-07-20T00:00:00.000Z","ending":"never","endingRuns":1,"endingDate":null,"timezone":"America/Phoenix"}}' --idempotency-key automation-create-001`,
-      "wave automations show --id 123"
+      "wave automations show --id ATK-01",
+      'wave automations update --id ATK-01 --expected-update-version 2026-07-17T12:00:00.123456Z --summary "Weekly project review"'
     ],
     schema: {
       output: "json-envelope-default",
       mutates: true,
       safety: [
         "Create calls only createAutomation with an explicit idempotency key.",
+        "Create always leaves status to the API, which starts Automations in Backlog.",
         "Only the API-defined ai_task_config field accepts validated JSON.",
         "Optional executor Agent linkage is sent only through the API-defined top-level agentId input.",
+        "Update calls only updateTask with an exact opaque updateVersion token; it cannot change status, task type, ownership, or project linkage.",
         "Does not create a project Task, run an Automation, or invoke AI OS actions.",
         "Show uses the API-owned automation query by id; no slug fallback is implemented."
       ],
-      commands: ["create", "show"]
+      commands: ["create", "show", "update"]
     }
   },
   broadcast: {

package/dist/index.js

@@ -4198,18 +4198,8 @@ var SKILL_SELECTION = `{
   }
   createdAt
   updatedAt
+  updateVersion
 }`;
-function asRecord4(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function findSkillById(id) {
-  return (payload) => {
-    if (!Array.isArray(payload)) {
-      return null;
-    }
-    return payload.find((entry2) => String(asRecord4(entry2)?.id ?? "") === id) ?? null;
-  };
-}
 function registerSkillCommands(program) {
   const skills = program.command("skills").description("Skill record operations");
   skills.command("list").description("List Skill records").option("--scope <scope>", "Filter skills by scope").option("--query <query>", "Filter skills by search query").option("--limit <limit>", "Limit skills returned").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
@@ -4237,7 +4227,7 @@ function registerSkillCommands(program) {
       isList: true
     });
   });
-  skills.command("show").description("Read one persisted Skill record by id").requiredOption("--id <id>", "Skill id").requiredOption("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
+  skills.command("show").description("Read one persisted Skill record by id or slug").requiredOption("--id <idOrSlug>", "Skill id or slug").option("--json", "Emit the stable JSON envelope").action(async (opts, cmd) => {
     const id = idSchema7.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -4245,16 +4235,17 @@ function registerSkillCommands(program) {
       command: "skills.show",
       operationName: "SkillsShow",
       runtimeOptions: context.runtimeOptions,
-      field: "skills",
+      field: "skill",
       variables: {
-        organization_id: organizationId
+        organization_id: organizationId,
+        id
       },
       variableTypes: {
-        organization_id: "ID!"
+        organization_id: "ID!",
+        id: "ID!"
       },
       selectionSet: SKILL_SELECTION,
-      isShow: true,
-      transformData: findSkillById(id)
+      isShow: true
     });
   });
 }
@@ -6482,7 +6473,7 @@ import { z as z16 } from "zod";
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
-function asRecord5(value) {
+function asRecord4(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -6496,7 +6487,7 @@ function setInternalCliOptions(program, options) {
 function getInternalCliOptions(command) {
   let current = command;
   while (current) {
-    const record = asRecord5(current[INTERNAL_OPTIONS_KEY]);
+    const record = asRecord4(current[INTERNAL_OPTIONS_KEY]);
     if (record) {
       return {
         enableRetryOnEmptyPhrase: record.enableRetryOnEmptyPhrase === true
@@ -10168,12 +10159,15 @@ function positiveInt2(raw, fallback) {
 function requestTimeoutMs(totalTimeoutMs) {
   return Math.max(1e3, Math.min(totalTimeoutMs, 1e4));
 }
-function asRecord6(value) {
+function asRecord5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
+function resolveLoginApiBaseUrl(globals) {
+  return asString(globals.baseUrl) ?? DEFAULT_PRODUCTION_API_BASE_URL;
+}
 function localUiBaseUrlFor(baseUrl) {
   const parsed = new URL(baseUrl);
   if ((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") && parsed.port === "3009") {
@@ -10215,9 +10209,9 @@ function cliTokenFromPoll(payload) {
   return asString(payload.cliToken) ?? asString(payload.cli_token) ?? asString(payload.token);
 }
 function unwrapMutationResult(value) {
-  const record = asRecord6(value);
+  const record = asRecord5(value);
   if (!record) return null;
-  const data = asRecord6(record.data);
+  const data = asRecord5(record.data);
   if (data && (Object.prototype.hasOwnProperty.call(record, "ok") || Object.prototype.hasOwnProperty.call(record, "errors") || Object.prototype.hasOwnProperty.call(record, "errorCode") || Object.prototype.hasOwnProperty.call(record, "error_code"))) {
     return data;
   }
@@ -10236,9 +10230,10 @@ async function authStatusRequest(params) {
 }
 async function runTokenLogin(cmd, opts) {
   const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
-  const baseUrl = context.runtimeOptions.baseUrl;
   const globals = cmd.optsWithGlobals();
-  const token = typeof opts.token === "string" && opts.token.trim() !== "" ? opts.token.trim() : typeof globals.token === "string" && globals.token.trim() !== "" ? globals.token.trim() : context.runtimeOptions.token;
+  const explicitBaseUrl = asString(globals.baseUrl);
+  const baseUrl = resolveLoginApiBaseUrl(globals);
+  const token = typeof opts.token === "string" && opts.token.trim() !== "" ? opts.token.trim() : typeof globals.token === "string" && globals.token.trim() !== "" ? globals.token.trim() : explicitBaseUrl ? context.runtimeOptions.token : void 0;
   const timeoutMs = positiveInt2(opts.timeoutMs ?? context.runtimeOptions.timeoutMs, 1e4);
   if (!baseUrl) {
     return printEnvelopeAndExit({
@@ -10281,7 +10276,7 @@ async function runTokenLogin(cmd, opts) {
       exitCode: mapStatusToExitCode(status.error.status)
     });
   }
-  const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
+  const statusData = asRecord5(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
   const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
@@ -10303,7 +10298,7 @@ async function runTokenLogin(cmd, opts) {
 }
 async function runBrowserLogin(cmd, opts) {
   const context = await resolveUnscopedCommandContext(cmd.optsWithGlobals());
-  const baseUrl = context.runtimeOptions.baseUrl;
+  const baseUrl = resolveLoginApiBaseUrl(cmd.optsWithGlobals());
   const timeoutMs = positiveInt2(opts.timeoutMs ?? context.runtimeOptions.timeoutMs, DEFAULT_LOGIN_TIMEOUT_MS);
   const pollIntervalMs = positiveInt2(opts.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
   if (!baseUrl) {
@@ -10498,7 +10493,7 @@ async function runLogout(cmd) {
     });
     if (result.ok) {
       requestId = result.result.requestId;
-      const payload = asRecord6(result.result.data.revokeCliToken) ?? {};
+      const payload = asRecord5(result.result.data.revokeCliToken) ?? {};
       revokedRemote = payload.ok !== false;
     } else {
       requestId = result.requestId;
@@ -10561,7 +10556,7 @@ async function runAuthStatus(cmd) {
       exitCode: mapStatusToExitCode(result.error.status)
     });
   }
-  const status = asRecord6(result.result.data.cliAuthStatus) ?? {};
+  const status = asRecord5(result.result.data.cliAuthStatus) ?? {};
   const baseAuthStatus = status.baseAuthStatus;
   return printEnvelopeAndExit({
     envelope: envelope({
@@ -12212,11 +12207,11 @@ function sanitizePlannerJson(value) {
   }
   return output;
 }
-function asRecord7(value) {
+function asRecord6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readPlannerStateKey(value, keys) {
-  const record = asRecord7(value);
+  const record = asRecord6(value);
   if (!record) {
     return null;
   }
@@ -14785,6 +14780,7 @@ var agentToolAccessSchema = z19.array(
     scope_value: nonEmptyStringSchema
   }).strict()
 ).min(1);
+var agentToolAccessUpdateSchema = agentToolAccessSchema.min(0);
 var agentPluginConnectionsSchema = z19.array(
   z19.object({
     external_tool_connection_id: nonEmptyStringSchema,
@@ -14796,6 +14792,30 @@ var agentPluginConnectionsSchema = z19.array(
     enabled: z19.boolean().optional()
   }).strict()
 ).min(1);
+var agentPluginConnectionUpdateSchema = z19.array(
+  z19.union([
+    z19.object({
+      id: nonEmptyStringSchema,
+      _destroy: z19.literal(true)
+    }).strict(),
+    z19.object({
+      id: nonEmptyStringSchema.optional(),
+      external_tool_connection_id: nonEmptyStringSchema.optional(),
+      tool_key: nonEmptyStringSchema.optional(),
+      scope_value: nonEmptyStringSchema.optional(),
+      allowed_tools: z19.array(nonEmptyStringSchema).optional(),
+      allowed_scopes: z19.array(nonEmptyStringSchema).optional(),
+      requires_confirmation: z19.boolean().optional(),
+      enabled: z19.boolean().optional()
+    }).strict().superRefine((value, context) => {
+      if (value.id || value.external_tool_connection_id && value.tool_key) return;
+      context.addIssue({
+        code: z19.ZodIssueCode.custom,
+        message: "Plugin updates require an id, or both external_tool_connection_id and tool_key for a new grant."
+      });
+    })
+  ])
+);
 var agentTriggerSchema = z19.object({
   trigger_type: z19.literal("cron"),
   cron_expression: nonEmptyStringSchema,
@@ -14805,6 +14825,14 @@ var agentTriggerSchema = z19.object({
   max_runs: z19.number().int().positive().nullable().optional(),
   enabled: z19.boolean().optional()
 }).strict();
+var agentTriggerUpdateSchema = z19.union([
+  agentTriggerSchema.extend({ id: nonEmptyStringSchema.optional() }).strict(),
+  z19.object({
+    id: nonEmptyStringSchema,
+    _destroy: z19.literal(true)
+  }).strict()
+]);
+var automationConfigSchema = z19.record(z19.string(), z19.unknown());
 var AGENT_SELECTION = `{
   id
   type
@@ -14855,6 +14883,7 @@ var AGENT_SELECTION = `{
   memberId
   createdAt
   updatedAt
+  updateVersion
 }`;
 var AGENT_PLUGIN_CATALOG_SELECTION = `{
   externalToolConnectionId
@@ -14882,8 +14911,9 @@ var AUTOMATION_SELECTION = `{
   memberId
   createdAt
   updatedAt
+  updateVersion
 }`;
-function asRecord8(value) {
+function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asRequiredString(value) {
@@ -14932,12 +14962,12 @@ function parseJsonOption(value, optionName, schema) {
   return schema.parse(parseJson(String(value), optionName));
 }
 function normalizePersistedCreatePayload(payload) {
-  const mutation = asRecord8(payload);
-  const mutationData = asRecord8(mutation?.data);
-  const persisted = asRecord8(mutationData?.data) ?? mutationData;
-  const attributes = asRecord8(persisted?.attributes);
-  const meta = asRecord8(mutationData?.meta);
-  const idempotency = asRecord8(meta?.atlas_idempotency);
+  const mutation = asRecord7(payload);
+  const mutationData = asRecord7(mutation?.data);
+  const persisted = asRecord7(mutationData?.data) ?? mutationData;
+  const attributes = asRecord7(persisted?.attributes);
+  const meta = asRecord7(mutationData?.meta);
+  const idempotency = asRecord7(meta?.atlas_idempotency);
   const id = asRequiredString(persisted?.id);
   const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
   const replay = idempotency?.replay;
@@ -14966,6 +14996,36 @@ function normalizePersistedCreatePayload(payload) {
     }
   };
 }
+function normalizePersistedUpdatePayload(payload) {
+  const mutation = asRecord7(payload);
+  const mutationData = asRecord7(mutation?.data);
+  const persisted = asRecord7(mutationData?.data) ?? mutationData;
+  const attributes = asRecord7(persisted?.attributes);
+  const id = asRequiredString(persisted?.id);
+  const slug = asRequiredString(persisted?.slug) ?? asRequiredString(attributes?.slug);
+  const updateVersion = asRequiredString(persisted?.updateVersion) ?? asRequiredString(attributes?.updateVersion) ?? asRequiredString(attributes?.update_version);
+  if (!mutation || !mutationData || !persisted || !id || !slug || !updateVersion) {
+    throw new CliError({
+      message: "Update response did not include persisted id, slug, and updateVersion.",
+      kind: "malformed_response",
+      status: 502,
+      exitCode: EXIT_CODES.networkOrUpstream
+    });
+  }
+  return {
+    ok: mutation.ok,
+    status: mutation.status,
+    errorCode: mutation.errorCode ?? null,
+    errors: mutation.errors ?? null,
+    persisted: { id, slug, update_version: updateVersion }
+  };
+}
+function parseAutomationConfig(value) {
+  return automationConfigSchema.parse(parseJson(String(value), "--ai-task-config"));
+}
+function parseExpectedUpdateVersion(value) {
+  return nonEmptyStringSchema.parse(String(value));
+}
 function registerAtlasAuthoringCommands(program) {
   const agents = program.command("agents").description("Bounded Agent authoring operations");
   agents.command("create").description("Create an Agent through the API-owned createAgent contract").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--name <name>").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--status <status>").option("--visibility <visibility>").option("--model <model>").option("--run-when-mentioned <boolean>", "true or false").option("--web-access-enabled <boolean>", "true or false").option("--web-fetch-enabled <boolean>", "true or false").option("--search-past-conversations-enabled <boolean>", "true or false").option("--app-rules-creation-enabled <boolean>", "true or false").option("--tool-discovery-enabled <boolean>", "true or false").option("--self-updates-enabled <boolean>", "true or false").option("--trusted-urls <urls>", "Comma-separated trusted URLs").option("--tool-access <json>", "JSON array of canonical native Agent tool scopes").option(
@@ -15045,7 +15105,7 @@ function registerAtlasAuthoringCommands(program) {
       transformMutationPayload: normalizePersistedCreatePayload
     });
   });
-  agents.command("show").description("Read one persisted Agent by id").requiredOption("--id <id>", "Agent id").action(async (opts, cmd) => {
+  agents.command("show").description("Read one persisted Agent by id or slug").requiredOption("--id <idOrSlug>", "Agent id or slug").action(async (opts, cmd) => {
     const id = idSchema14.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15060,6 +15120,104 @@ function registerAtlasAuthoringCommands(program) {
       isShow: true
     });
   });
+  agents.command("update").description("Update one persisted Agent through the API-owned updateAgent contract").requiredOption("--id <idOrSlug>", "Agent id or slug").requiredOption(
+    "--expected-update-version <version>",
+    "Exact opaque updateVersion value from agents show; rejects stale writes"
+  ).option("--name <name>").option("--description <description>").option("--notes <notes>").option("--status <status>").option("--visibility <visibility>").option("--model <model>").option("--run-when-mentioned <boolean>", "true or false").option("--web-access-enabled <boolean>", "true or false").option("--web-fetch-enabled <boolean>", "true or false").option("--search-past-conversations-enabled <boolean>", "true or false").option("--app-rules-creation-enabled <boolean>", "true or false").option("--tool-discovery-enabled <boolean>", "true or false").option("--self-updates-enabled <boolean>", "true or false").option("--trusted-urls <urls>", "Comma-separated trusted URLs").option("--clear-trusted-urls", "Clear all trusted URLs").option("--tool-access <json>", "JSON array of the complete canonical native Agent tool scopes").option(
+    "--plugin-connections <json>",
+    "JSON array of Agent connector grant patches; removals require id and _destroy:true"
+  ).option(
+    "--trigger <json>",
+    "Canonical Agent trigger patch; use the trigger id from agents show to replace or remove it"
+  ).action(async (opts, cmd) => {
+    if (opts.clearTrustedUrls && opts.trustedUrls !== void 0) {
+      throw new CliError({
+        message: "Use either --trusted-urls or --clear-trusted-urls, not both.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const runWhenMentioned = parseBooleanOption(opts.runWhenMentioned, "--run-when-mentioned");
+    const webAccessEnabled = parseBooleanOption(opts.webAccessEnabled, "--web-access-enabled");
+    const webFetchEnabled = parseBooleanOption(opts.webFetchEnabled, "--web-fetch-enabled");
+    const searchPastConversationsEnabled = parseBooleanOption(
+      opts.searchPastConversationsEnabled,
+      "--search-past-conversations-enabled"
+    );
+    const appRulesCreationEnabled = parseBooleanOption(
+      opts.appRulesCreationEnabled,
+      "--app-rules-creation-enabled"
+    );
+    const toolDiscoveryEnabled = parseBooleanOption(
+      opts.toolDiscoveryEnabled,
+      "--tool-discovery-enabled"
+    );
+    const selfUpdatesEnabled = parseBooleanOption(opts.selfUpdatesEnabled, "--self-updates-enabled");
+    const trustedUrls = parseCommaSeparatedStrings(opts.trustedUrls);
+    const toolAccess = parseJsonOption(
+      opts.toolAccess,
+      "--tool-access",
+      agentToolAccessUpdateSchema
+    );
+    const pluginConnections = parseJsonOption(
+      opts.pluginConnections,
+      "--plugin-connections",
+      agentPluginConnectionUpdateSchema
+    );
+    const trigger = parseJsonOption(opts.trigger, "--trigger", agentTriggerUpdateSchema);
+    const patch = {
+      ...opts.name !== void 0 ? { name: String(opts.name) } : {},
+      ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+      ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+      ...opts.status !== void 0 ? { status: String(opts.status) } : {},
+      ...opts.visibility !== void 0 ? { visibility: String(opts.visibility) } : {},
+      ...opts.model !== void 0 ? { model: String(opts.model) } : {},
+      ...runWhenMentioned !== void 0 ? { run_when_mentioned: runWhenMentioned } : {},
+      ...webAccessEnabled !== void 0 ? { web_access_enabled: webAccessEnabled } : {},
+      ...webFetchEnabled !== void 0 ? { web_fetch_enabled: webFetchEnabled } : {},
+      ...searchPastConversationsEnabled !== void 0 ? { search_past_conversations_enabled: searchPastConversationsEnabled } : {},
+      ...appRulesCreationEnabled !== void 0 ? { app_rules_creation_enabled: appRulesCreationEnabled } : {},
+      ...toolDiscoveryEnabled !== void 0 ? { tool_discovery_enabled: toolDiscoveryEnabled } : {},
+      ...selfUpdatesEnabled !== void 0 ? { self_updates_enabled: selfUpdatesEnabled } : {},
+      ...trustedUrls !== void 0 ? { trusted_urls: trustedUrls } : {},
+      ...opts.clearTrustedUrls ? { trusted_urls: [] } : {},
+      ...toolAccess !== void 0 ? { tool_access: toolAccess } : {},
+      ...pluginConnections !== void 0 ? { agent_tool_connections_attributes: pluginConnections } : {},
+      ...trigger !== void 0 ? { trigger_attributes: trigger } : {}
+    };
+    if (Object.keys(patch).length === 0) {
+      throw new CliError({
+        message: "agents update requires at least one mutable Agent field.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const id = idSchema14.parse(opts.id);
+    const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "agents.update",
+      operationName: "AgentsUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_agent",
+      variableTypes: {
+        organization_id: "ID!",
+        agent_id: "ID!",
+        params: "UpdateAgentParamsInput!",
+        expected_update_version: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        agent_id: id,
+        params: { agent: patch },
+        expected_update_version: expectedUpdateVersion
+      },
+      transformMutationPayload: normalizePersistedUpdatePayload
+    });
+  });
   agents.command("plugin-catalog").description("Read connected Agent plugin capabilities for one supported service").requiredOption(
     "--service <service>",
     "Supported service: gmail, calendar, slack, or stripe"
@@ -15078,7 +15236,7 @@ function registerAtlasAuthoringCommands(program) {
     });
   });
   const automations = program.command("automations").description("Bounded Automation authoring operations");
-  automations.command("create").description("Create an Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--status <status>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
+  automations.command("create").description("Create a Backlog Automation through the API-owned createAutomation contract").requiredOption("--summary <summary>").requiredOption("--ai-task-config <json>", "Valid JSON for the API-owned ai_task_config field").requiredOption("--idempotency-key <key>", "Required create idempotency key").option("--description <description>").option("--notes <notes>").option("--member-id <memberId>").option("--agent-id <agentId>", "Optional executor Agent id for a repeat Automation").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").action(async (opts, cmd) => {
     const idempotencyKey = idempotencyKeySchema.parse(opts.idempotencyKey);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15101,7 +15259,6 @@ function registerAtlasAuthoringCommands(program) {
           ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
           ...opts.memberId !== void 0 ? { member_id: idSchema14.parse(opts.memberId) } : {},
           ...opts.agentId !== void 0 ? { agentId: idSchema14.parse(opts.agentId) } : {},
-          ...opts.status !== void 0 ? { status: String(opts.status) } : {},
           ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
           ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {}
         },
@@ -15110,7 +15267,7 @@ function registerAtlasAuthoringCommands(program) {
       transformMutationPayload: normalizePersistedCreatePayload
     });
   });
-  automations.command("show").description("Read one persisted Automation by id").requiredOption("--id <id>", "Automation id").action(async (opts, cmd) => {
+  automations.command("show").description("Read one persisted Automation by id or slug").requiredOption("--id <idOrSlug>", "Automation id or slug").action(async (opts, cmd) => {
     const id = idSchema14.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
     const organizationId = resolveOrganizationId(context.organizationId);
@@ -15125,6 +15282,65 @@ function registerAtlasAuthoringCommands(program) {
       isShow: true
     });
   });
+  automations.command("update").description("Update one task-backed Automation without changing its system-managed status").requiredOption("--id <idOrSlug>", "Automation id or slug").requiredOption(
+    "--expected-update-version <version>",
+    "Exact opaque updateVersion value from automations show; rejects stale writes"
+  ).option("--summary <summary>").option("--description <description>").option("--notes <notes>").option("--priority <priority>").option("--due-date <date>", "ISO-8601 date (YYYY-MM-DD)").option("--ai-task-config <json>", "Complete replacement ai_task_config JSON object").option(
+    "--agent-id <agentId>",
+    "Executor Agent id; requires --ai-task-config and is stored in that config"
+  ).action(async (opts, cmd) => {
+    if (opts.agentId !== void 0 && opts.aiTaskConfig === void 0) {
+      throw new CliError({
+        message: "automations update requires --ai-task-config whenever --agent-id is supplied.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const aiTaskConfig = opts.aiTaskConfig === void 0 ? void 0 : {
+      ...parseAutomationConfig(opts.aiTaskConfig),
+      ...opts.agentId !== void 0 ? { agent_id: idSchema14.parse(opts.agentId) } : {}
+    };
+    const patch = {
+      ...opts.summary !== void 0 ? { summary: String(opts.summary) } : {},
+      ...opts.description !== void 0 ? { description: String(opts.description) } : {},
+      ...opts.notes !== void 0 ? { notes: String(opts.notes) } : {},
+      ...opts.priority !== void 0 ? { priority: String(opts.priority) } : {},
+      ...opts.dueDate !== void 0 ? { due_date: isoDateSchema.parse(opts.dueDate) } : {},
+      ...aiTaskConfig !== void 0 ? { ai_task_config: aiTaskConfig } : {}
+    };
+    if (Object.keys(patch).length === 0) {
+      throw new CliError({
+        message: "automations update requires at least one mutable Automation field.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const id = idSchema14.parse(opts.id);
+    const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "automations.update",
+      operationName: "AutomationsUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_task",
+      variableTypes: {
+        organization_id: "ID!",
+        task_id: "ID!",
+        params: "UpdateTaskParamsInput!",
+        expected_update_version: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        task_id: id,
+        params: { task: patch },
+        expected_update_version: expectedUpdateVersion
+      },
+      transformMutationPayload: normalizePersistedUpdatePayload
+    });
+  });
   const skills = program.commands.find((command) => command.name() === "skills");
   if (!skills) {
     throw new Error("Skills command must be registered before Atlas authoring commands.");
@@ -15156,6 +15372,47 @@ function registerAtlasAuthoringCommands(program) {
       transformMutationPayload: normalizePersistedCreatePayload
     });
   });
+  skills.command("update").description("Update one persisted Skill through the API-owned updateSkill contract").requiredOption("--id <idOrSlug>", "Skill id or slug").requiredOption(
+    "--expected-update-version <version>",
+    "Exact opaque updateVersion value from skills show; rejects stale writes"
+  ).option("--name <name>").option("--emoji <emoji>").option("--description <description>").action(async (opts, cmd) => {
+    const patch = {
+      ...opts.name !== void 0 ? { name: String(opts.name) } : {},
+      ...opts.emoji !== void 0 ? { emoji: String(opts.emoji) } : {},
+      ...opts.description !== void 0 ? { description: String(opts.description) } : {}
+    };
+    if (Object.keys(patch).length === 0) {
+      throw new CliError({
+        message: "skills update requires at least one mutable Skill field.",
+        kind: "invalid_args",
+        status: 400,
+        exitCode: EXIT_CODES.invalidArgs
+      });
+    }
+    const id = idSchema14.parse(opts.id);
+    const expectedUpdateVersion = parseExpectedUpdateVersion(opts.expectedUpdateVersion);
+    const context = await resolveCommandContext(cmd.optsWithGlobals());
+    const organizationId = resolveOrganizationId(context.organizationId);
+    await runGraphqlMutationCommand({
+      command: "skills.update",
+      operationName: "SkillsUpdate",
+      runtimeOptions: context.runtimeOptions,
+      field: "update_skill",
+      variableTypes: {
+        organization_id: "ID!",
+        id: "ID!",
+        input: "UpdateSkillInput!",
+        expected_update_version: "String!"
+      },
+      variables: {
+        organization_id: organizationId,
+        id,
+        input: patch,
+        expected_update_version: expectedUpdateVersion
+      },
+      transformMutationPayload: normalizePersistedUpdatePayload
+    });
+  });
 }
 
 // src/commands/discovery.ts
@@ -15166,7 +15423,7 @@ import { join as join3 } from "path";
 import { createHash } from "crypto";
 
 // src/version.ts
-var CLI_VERSION = "0.1.71";
+var CLI_VERSION = "0.1.73";
 
 // src/operationMetadata.ts
 var DISCOVERY_OPERATION_IDS = [
@@ -15479,7 +15736,9 @@ var WRITE_OPERATION_IDS = [
   "accountability.create",
   "accountability.update",
   "agents.create",
+  "agents.update",
   "automations.create",
+  "automations.update",
   "contacts.create",
   "contacts.update",
   "content.create-contact",
@@ -15585,6 +15844,7 @@ var WRITE_OPERATION_IDS = [
   "scorecards.create",
   "scorecards.update",
   "skills.create",
+  "skills.update",
   "smart-kpi-views.create",
   "stand-ups.create",
   "stand-ups.update",
@@ -15936,12 +16196,13 @@ var NAMESPACE_DOCS = {
   skills: {
     name: "skills",
     tier: "primary",
-    description: "Skill record readback and bounded create operations.",
+    description: "Skill record readback and bounded create/update operations.",
     examples: [
       "wave skills list --json",
       "wave skills list --scope ADMIN_GLOBAL --json",
       "wave skills show --id 123 --json",
-      'wave skills create --name "Weekly planning" --scope MEMBER_PERSONAL --idempotency-key skill-create-001'
+      'wave skills create --name "Weekly planning" --scope MEMBER_PERSONAL --idempotency-key skill-create-001',
+      'wave skills update --id SKL-01 --expected-update-version 2026-07-17T12:00:00.123456Z --description "Review my projects."'
     ],
     schema: {
       output: "json-envelope-default",
@@ -15949,20 +16210,22 @@ var NAMESPACE_DOCS = {
       safety: [
         "Uses API-owned Skill GraphQL read fields only.",
         "Create calls only createSkill with an explicit idempotency key.",
+        "Update calls only updateSkill with an exact opaque updateVersion token and does not change scope or ownership.",
         "Skill create supports the API-defined ADMIN_GLOBAL and MEMBER_PERSONAL scopes.",
         "Does not update, destroy, archive, approve, or apply Skill records."
       ],
-      commands: ["list", "show", "create"]
+      commands: ["list", "show", "create", "update"]
     }
   },
   agents: {
     name: "agents",
     tier: "primary",
-    description: "Bounded Agent create and persisted readback operations.",
+    description: "Bounded Agent create, readback, and stale-write-protected update operations.",
     examples: [
       'wave agents create --name "Planning helper" --idempotency-key agent-create-001',
       `wave agents create --name "Project summary" --notes "Summarize my projects." --tool-access '[{"tool_key":"projects","scope_value":"all"}]' --trigger '{"trigger_type":"cron","cron_expression":"0 14 * * 2","timezone":"America/Phoenix","enabled":true}' --idempotency-key agent-create-002`,
-      "wave agents show --id 123"
+      "wave agents show --id AGT-01",
+      'wave agents update --id AGT-01 --expected-update-version 2026-07-17T12:00:00.123456Z --notes "Summarize my projects."'
     ],
     schema: {
       output: "json-envelope-default",
@@ -15970,32 +16233,36 @@ var NAMESPACE_DOCS = {
       safety: [
         "Create calls only createAgent with an explicit idempotency key.",
         "Create preserves API-owned defaults by sending only supplied typed Agent fields.",
+        "Update calls only updateAgent with an exact opaque updateVersion token and cannot change ownership.",
         "Native tools, plugin connector grants, and the cron trigger use strict canonical JSON shapes.",
         "Outlook Calendar and Outlook Mail are not supported Agent plugin families in this release.",
         "Show uses the API-owned agent query by id; no slug fallback is implemented."
       ],
-      commands: ["create", "show"]
+      commands: ["create", "show", "update"]
     }
   },
   automations: {
     name: "automations",
     tier: "primary",
-    description: "Bounded Automation create and persisted readback operations.",
+    description: "Bounded task-backed Automation create, readback, and stale-write-protected update operations.",
     examples: [
       `wave automations create --summary "Weekly review" --agent-id 123 --ai-task-config '{"cycle":"repeat","repeatSchedule":{"interval":1,"frequency":"week","weekdays":[1,3],"at":"2:30 PM","starting":"2026-07-20T00:00:00.000Z","ending":"never","endingRuns":1,"endingDate":null,"timezone":"America/Phoenix"}}' --idempotency-key automation-create-001`,
-      "wave automations show --id 123"
+      "wave automations show --id ATK-01",
+      'wave automations update --id ATK-01 --expected-update-version 2026-07-17T12:00:00.123456Z --summary "Weekly project review"'
     ],
     schema: {
       output: "json-envelope-default",
       mutates: true,
       safety: [
         "Create calls only createAutomation with an explicit idempotency key.",
+        "Create always leaves status to the API, which starts Automations in Backlog.",
         "Only the API-defined ai_task_config field accepts validated JSON.",
         "Optional executor Agent linkage is sent only through the API-defined top-level agentId input.",
+        "Update calls only updateTask with an exact opaque updateVersion token; it cannot change status, task type, ownership, or project linkage.",
         "Does not create a project Task, run an Automation, or invoke AI OS actions.",
         "Show uses the API-owned automation query by id; no slug fallback is implemented."
       ],
-      commands: ["create", "show"]
+      commands: ["create", "show", "update"]
     }
   },
   broadcast: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wave-ai-os/wave-cli",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "type": "module",
   "bin": {
     "wave": "dist/index.js"