ae-system

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

ae-system

Use the

system

domain for Agent system administration:

bash

ae-cli system +<command> [options]

使用

system

域进行Agent系统管理：

bash

ae-cli system +<command> [options]

Mandatory Rules

强制规则

These commands are only for users whose Agent role is
```
root
```
or
```
agent_admin
```
.
The te-agent
```
/api/admin/**
```
endpoint is the final authorization boundary. A member receives a permission error (HTTP 403). Do not retry login or attempt a different endpoint after a 403.
Run
```
ae-cli auth login --host <host>
```
before using this domain. System administration requires a user access-token session; sandbox identity headers are not an authorization substitute.
```
+npm-install
```
is the exception that must also run inside a Linux te-agent sandbox because it packages the installed Linux files. It still requires the logged-in user to be
```
root
```
or
```
agent_admin
```
.
Discover real IDs with a list command before any update or delete. Never guess a user, sandbox, model, quota rule, or channel ID.
Before every write, run
```
--dry-run
```
, show the target and effect, and obtain explicit user confirmation. The CLI itself prompts only for
```
high-risk-write
```
;
```
--yes
```
can bypass that prompt and is not a security boundary.
Use
```
--dry-run
```
to inspect method, path, query, and redacted body without executing.
JSON inputs accept inline JSON,
```
@file
```
, or
```
-
```
for stdin. Prefer
```
@file
```
for channel credentials and other sensitive values.
Successful output is JSON by default. Use
```
--format table
```
only when a human-readable table is more useful.
After each command, check stderr and
```
_notice.host_compat
```
. If present, show the version warning and its update commands before the business result.
Do not treat an absent ae-cli command as proof that an HTTP endpoint is unreachable. An Agent with Bash/network access can construct requests directly; server authentication, role checks, company isolation, and resource ownership are the actual controls.
Do not call
```
DELETE /api/admin/members?openId=...
```
or
```
/api/internal/sandboxes/**
```
through ad-hoc HTTP. They are intentionally excluded from this Skill because other systems own those integration contracts.

这些命令仅适用于Agent角色为
```
root
```
或
```
agent_admin
```
的用户。
te-agent的
```
/api/admin/**
```
端点是最终授权边界。成员会收到权限错误（HTTP 403）。收到403错误后，请勿重试登录或尝试其他端点。
使用此域前，请先运行
```
ae-cli auth login --host <host>
```
。系统管理需要用户访问令牌会话；沙箱身份头不能替代授权。
```
+npm-install
```
是例外情况，必须在Linux te-agent沙箱内运行，因为它需要打包已安装的Linux文件。该命令仍要求登录用户为
```
root
```
或
```
agent_admin
```
。
在执行任何更新或删除操作前，先通过列表命令获取真实ID。切勿猜测用户、沙箱、模型、配额规则或渠道ID。
每次执行写入操作前，先运行
```
--dry-run
```
，展示目标对象和操作效果，并获取用户的明确确认。CLI仅会针对
```
high-risk-write
```
提示确认；
```
--yes
```
可绕过该提示，但不构成安全边界。
使用
```
--dry-run
```
可查看请求方法、路径、查询参数和已脱敏的请求体，而不会实际执行操作。
JSON输入支持内联JSON、
```
@file
```
或
```
-
```
（标准输入）。对于渠道凭证等敏感值，优先使用
```
@file
```
。
默认情况下，成功输出为JSON格式。仅当人类可读表格更有用时，才使用
```
--format table
```
。
每个命令执行后，检查stderr和
```
_notice.host_compat
```
。如果存在相关内容，先显示版本警告及其更新命令，再展示业务结果。
不要将ae-cli缺少某一命令视为对应HTTP端点不可访问的证明。拥有Bash/网络访问权限的Agent可直接构造请求；服务器认证、角色检查、企业隔离和资源归属才是实际的控制手段。
请勿通过临时HTTP请求调用
```
DELETE /api/admin/members?openId=...
```
或
```
/api/internal/sandboxes/**
```
。这些接口被有意排除在本Skill之外，因为其他系统拥有这些集成契约的所有权。

Command Groups

命令组

Members

成员管理

Command	Risk	Purpose
`+list-member-candidates`	read	List TE company users that can be added.
`+list-members`	read	List Agent members in the current company.
`+add-members`	write	Add one or more TE users, optionally binding a quota rule or creating sandboxes.
`+set-member-status`	write	Enable or disable a member.
`+set-member-role`	write	Change a non-root member between `agent_admin` and `member` .
`+remove-member`	high-risk-write	Remove a non-root member.
`+get-member-stats`	read	Get one member's token usage and recent conversation count.

Examples:

bash

ae-cli system +list-members --status enabled --page 1 --page-size 20

ae-cli system +add-members \
  --members '[{"openId":"ou_x","loginName":"alice","displayName":"Alice"}]' \
  --create-sandbox true

ae-cli system +set-member-role --user-id <user-id> --role agent_admin

+list-members

filters:

```
--q
```
: login/display name search.
```
--status
```
:
```
all | enabled | disabled
```
.
```
--page
```
,
```
--page-size
```
: page size is 1-100.
```
--all
```
: return all matches.

--sort-field periodUsedAmount

--sort-dir asc|desc

: central usage sort.

+add-members --members

schema:

json

[
  {
    "openId": "required",
    "loginName": "optional",
    "displayName": "optional"
  }
]

Optional flags are

--rule-id

and

--create-sandbox true|false

命令	风险等级	用途
`+list-member-candidates`	只读	列出可添加的TE企业用户。
`+list-members`	只读	列出当前企业的Agent成员。
`+add-members`	写入	添加一名或多名TE用户，可选择绑定配额规则或创建沙箱。
`+set-member-status`	写入	启用或禁用成员。
`+set-member-role`	写入	更改非root成员的角色，在 `agent_admin` 和 `member` 之间切换。
`+remove-member`	高风险写入	删除非root成员。
`+get-member-stats`	只读	获取单个成员的令牌使用情况和近期对话次数。

示例：

bash

ae-cli system +list-members --status enabled --page 1 --page-size 20

ae-cli system +add-members \
  --members '[{"openId":"ou_x","loginName":"alice","displayName":"Alice"}]' \
  --create-sandbox true

ae-cli system +set-member-role --user-id <user-id> --role agent_admin

+list-members

过滤参数：

```
--q
```
: 登录名/显示名搜索。
```
--status
```
:
```
all | enabled | disabled
```
。
```
--page
```
,
```
--page-size
```
: 分页大小为1-100。
```
--all
```
: 返回所有匹配结果。

--sort-field periodUsedAmount

--sort-dir asc|desc

: 按中心使用量排序。

+add-members --members

数据结构：

json

[
  {
    "openId": "必填",
    "loginName": "可选",
    "displayName": "可选"
  }
]

可选参数为

--rule-id

和

--create-sandbox true|false

。

Sandboxes

沙箱管理

Command	Risk	Purpose
`+list-sandboxes`	read	List company sandboxes.
`+get-sandbox-config`	read	Read feature status and create/active seat limits.
`+batch-create-sandboxes`	write	Create personal sandboxes for 1-100 users.
`+update-sandbox`	write	Update a sandbox description.
`+set-sandbox-enabled`	write	Enable or disable a sandbox.
`+start-sandbox`	write	Start a sandbox container.
`+stop-sandbox`	write	Stop a sandbox container.
`+list-sandbox-users`	read	List users bound to a sandbox.
`+bind-sandbox-user`	write	Bind a member to a sandbox.
`+unbind-sandbox-user`	high-risk-write	Remove a sandbox user binding.
`+remove-sandbox`	high-risk-write	Delete a sandbox and its bindings.

Examples:

bash

ae-cli system +batch-create-sandboxes \
  --user-ids '["<user-id-1>","<user-id-2>"]' \
  --description "Data team"

ae-cli system +set-sandbox-enabled --id <sandbox-id> --enabled true
ae-cli system +bind-sandbox-user --id <sandbox-id> --user-id <user-id>

Use Agent database user IDs from

+list-members

, not TE openIds, for sandbox commands.

命令	风险等级	用途
`+list-sandboxes`	只读	列出企业沙箱。
`+get-sandbox-config`	只读	读取功能状态和创建/激活席位限制。
`+batch-create-sandboxes`	写入	为1-100名用户创建个人沙箱。
`+update-sandbox`	写入	更新沙箱描述。
`+set-sandbox-enabled`	写入	启用或禁用沙箱。
`+start-sandbox`	写入	启动沙箱容器。
`+stop-sandbox`	写入	停止沙箱容器。
`+list-sandbox-users`	只读	列出绑定到沙箱的用户。
`+bind-sandbox-user`	写入	将成员绑定到沙箱。
`+unbind-sandbox-user`	高风险写入	解除沙箱用户绑定。
`+remove-sandbox`	高风险写入	删除沙箱及其绑定关系。

示例：

bash

ae-cli system +batch-create-sandboxes \
  --user-ids '["<user-id-1>","<user-id-2>"]' \
  --description "Data team"

ae-cli system +set-sandbox-enabled --id <sandbox-id> --enabled true
ae-cli system +bind-sandbox-user --id <sandbox-id> --user-id <user-id>

沙箱命令需使用

+list-members

返回的Agent数据库用户ID，而非TE openId。

Shared Sandbox Tools

共享沙箱工具

Command	Risk	Purpose
`+upload-sandbox-tool`	write	Validate, ZIP, and upload an existing tool directory.
`+npm-install`	write	Install one exact npm CLI version in a temporary sandbox directory, generate `tool.json` , and upload it.
`+list-sandbox-tools`	read	List preset and custom tools for the current company.
`+sync-sandbox-tools`	write	Synchronize preset tools from the server manifest.
`+get-sandbox-tool-distribution`	read	Read the sandboxes currently receiving one tool.
`+set-sandbox-tool-enabled`	write	Enable or disable one registered tool.
`+remove-sandbox-tool`	high-risk-write	Delete a fully reclaimed tool registration.
`+activate-sandbox-tools`	write	Activate selected commands on selected or all running sandboxes.
`+deactivate-sandbox-tools`	write	Remove managed command shims from selected or all running sandboxes.
`+refresh-sandbox-tool-status`	write	Refresh observed tool state on target sandboxes.
`+list-sandbox-tool-operations`	read	List activation/deactivation history.

Uploaded tools are registered for the current company with

enabled=false

. Upload does not activate the tool in any running sandbox. Review and enable/activate it through sandbox tool management after upload.

For activate/deactivate/status operations:

bash

ae-cli system +activate-sandbox-tools \
  --target-mode selected \
  --sandbox-ids '["<sandbox-id>"]' \
  --tool-ids '["<tool-id>"]'

--target-mode selected

requires 1-50

--sandbox-ids

;

all-running

forbids them.

```
--tool-ids
```
contains 1-20 real IDs from
```
+list-sandbox-tools
```
.
```
--command-names-by-tool-id
```
optionally limits an operation to named commands.
```
--expected-tool-snapshots-by-id
```
carries the version/package/command snapshot returned by the server for optimistic concurrency checks.
JSON maps accept inline JSON,
```
@file
```
, or stdin. Use dry-run and user confirmation before distribution changes.

命令	风险等级	用途
`+upload-sandbox-tool`	写入	验证、压缩并上传现有工具目录。
`+npm-install`	写入	在临时沙箱目录中安装指定版本的npm CLI，生成 `tool.json` 并上传。
`+list-sandbox-tools`	只读	列出当前企业的预设工具和自定义工具。
`+sync-sandbox-tools`	写入	从服务器清单同步预设工具。
`+get-sandbox-tool-distribution`	只读	查看当前使用某一工具的沙箱列表。
`+set-sandbox-tool-enabled`	写入	启用或禁用已注册的工具。
`+remove-sandbox-tool`	高风险写入	删除已完全回收的工具注册信息。
`+activate-sandbox-tools`	写入	在指定或所有运行中的沙箱上激活选定命令。
`+deactivate-sandbox-tools`	写入	从指定或所有运行中的沙箱移除托管命令垫片。
`+refresh-sandbox-tool-status`	写入	刷新目标沙箱上工具的观测状态。
`+list-sandbox-tool-operations`	只读	列出激活/禁用操作历史。

上传的工具会以

enabled=false

的状态注册到当前企业。上传操作不会在任何运行中的沙箱激活工具。上传后需通过沙箱工具管理进行审核并启用/激活。

激活/禁用/状态操作示例：

bash

ae-cli system +activate-sandbox-tools \
  --target-mode selected \
  --sandbox-ids '["<sandbox-id>"]' \
  --tool-ids '["<tool-id>"]'

```
--target-mode selected
```
需要1-50个
```
--sandbox-ids
```
；
```
all-running
```
模式下不允许使用该参数。
```
--tool-ids
```
包含1-20个来自
```
+list-sandbox-tools
```
的真实ID。
```
--command-names-by-tool-id
```
可选择性地将操作限制为指定命令。
```
--expected-tool-snapshots-by-id
```
携带服务器返回的版本/包/命令快照，用于乐观并发检查。
JSON映射支持内联JSON、
```
@file
```
或标准输入。在进行分发变更前，需使用dry-run并获取用户确认。

Preferred npm Flow

Existing Directory Flow

现有目录流程

Use the low-level command when the tool is already installed or assembled:

bash

ae-cli system +upload-sandbox-tool --path /absolute/path/to/tool-root

The directory root must contain exactly one

tool.json

. An external manifest is allowed only when the root has no

tool.json

bash

ae-cli system +upload-sandbox-tool \
  --path /absolute/path/to/tool-root \
  --manifest /absolute/path/to/tool.json

Minimal manifest:

json

{
  "schemaVersion": 1,
  "name": "example-cli",
  "displayName": "Example CLI",
  "description": "Optional description",
  "version": "1.2.3",
  "commands": [
    {
      "name": "example",
      "entry": "node_modules/example-cli/bin/example.js",
      "runtime": "node"
    }
  ]
}

Upload contract:

```
name
```
and command names must start with a lowercase letter and contain only lowercase letters, numbers,
```
.
```
,
```
_
```
, or
```
-
```
, with a maximum length of 64.
Command names must not replace reserved runtime commands such as
```
node
```
,
```
npm
```
,
```
npx
```
,
```
bash
```
,
```
python
```
,
```
git
```
,
```
curl
```
, or
```
sudo
```
.
Every command
```
entry
```
must be a regular file under the upload root. Use
```
runtime: "node"
```
for JavaScript entry files and
```
runtime: "native"
```
only for an executable compatible with the sandbox Linux image.
Paths must be relative and normalized. Absolute paths,
```
..
```
, backslashes, control characters, empty segments, and a
```
current
```
path segment are rejected.
ZIP limits are 50 MB compressed, 500 MB unpacked, 50 MB per file, and 10,000 files. The server publishes only after independently validating the same boundaries.
Do not pre-create or write
```
/data/app/te_agent_ta/share/tools
```
from a sandbox. Sandboxes are read-only for that directory; the authenticated te-agent upload endpoint owns the final write and registration.
A tool name can be registered only once per company in this first static-version flow. Choose the final name and version before upload.

当工具已安装或组装完成时，使用低级命令：

bash

ae-cli system +upload-sandbox-tool --path /absolute/path/to/tool-root

tool.json

。仅当根目录没有

tool.json

时，才允许使用外部清单：

bash

ae-cli system +upload-sandbox-tool \
  --path /absolute/path/to/tool-root \
  --manifest /absolute/path/to/tool.json

最小化清单：

json

{
  "schemaVersion": 1,
  "name": "example-cli",
  "displayName": "Example CLI",
  "description": "可选描述",
  "version": "1.2.3",
  "commands": [
    {
      "name": "example",
      "entry": "node_modules/example-cli/bin/example.js",
      "runtime": "node"
    }
  ]
}

上传契约：

```
name
```
和命令名称必须以小写字母开头，且仅包含小写字母、数字、
```
.
```
、
```
_
```
或
```
-
```
，最大长度为64。
命令名称不得替换保留的运行时命令，如
```
node
```
、
```
npm
```
、
```
npx
```
、
```
bash
```
、
```
python
```
、
```
git
```
、
```
curl
```
或
```
sudo
```
。
每个命令的
```
entry
```
必须是上传根目录下的常规文件。JavaScript入口文件使用
```
runtime: "node"
```
，仅当可执行文件与沙箱Linux镜像兼容时才使用
```
runtime: "native"
```
。
路径必须是相对路径且已规范化。绝对路径、
```
..
```
、反斜杠、控制字符、空段和
```
current
```
路径段都会被拒绝。
ZIP限制：压缩后50MB，解压后500MB，单文件50MB，最多10000个文件。服务器会独立验证这些边界后才发布。
请勿从沙箱中预创建或写入
```
/data/app/te_agent_ta/share/tools
```
。沙箱对该目录具有只读权限；已认证的te-agent上传端点拥有最终写入和注册权限。
在这种静态版本流程中，每个企业只能注册一次工具名称。上传前请确定最终名称和版本。

Models

模型管理

Command	Risk	Purpose
`+list-system-models`	read	List system models and company visibility.
`+set-system-model-enabled`	write	Toggle a system model for the current company.
`+get-model-sync-settings`	read	Read the default visibility policy for newly synchronized system models.
`+set-model-sync-settings`	write	Update the new-system-model visibility policy.
`+get-system-model-price-rules`	read	Read one managed system model's stored pricing snapshot.
`+list-company-models`	read	List company models, including disabled models.
`+set-company-model-enabled`	write	Toggle a company model for all company users.
`+get-default-models`	read	Read the `AE_AGENT` and `AI_QA` default slots.
`+set-default-model`	write	Set one default model slot.
`+clear-default-model`	high-risk-write	Clear one default model slot.

Examples:

bash

ae-cli system +list-system-models
ae-cli system +set-system-model-enabled --model-id <model-id> --enabled false
ae-cli system +set-default-model --model-id <model-id> --biz-type AE_AGENT

--biz-type

AE_AGENT | AI_QA

and defaults to

AE_AGENT

. Use the database

id

returned by a model list, not the provider model name.

命令	风险等级	用途
`+list-system-models`	只读	列出系统模型和企业可见性设置。
`+set-system-model-enabled`	写入	切换当前企业的系统模型启用状态。
`+get-model-sync-settings`	只读	读取新同步系统模型的默认可见性策略。
`+set-model-sync-settings`	写入	更新新系统模型的可见性策略。
`+get-system-model-price-rules`	只读	读取某一托管系统模型的存储定价快照。
`+list-company-models`	只读	列出企业模型，包括已禁用的模型。
`+set-company-model-enabled`	写入	切换企业模型对所有企业用户的启用状态。
`+get-default-models`	只读	读取 `AE_AGENT` 和 `AI_QA` 默认插槽设置。
`+set-default-model`	写入	设置一个默认模型插槽。
`+clear-default-model`	高风险写入	清除一个默认模型插槽。

示例：

bash

ae-cli system +list-system-models
ae-cli system +set-system-model-enabled --model-id <model-id> --enabled false
ae-cli system +set-default-model --model-id <model-id> --biz-type AE_AGENT

--biz-type

可选值为

AE_AGENT | AI_QA

，默认值为

AE_AGENT

。使用模型列表返回的数据库

id

，而非供应商模型名称。

Usage

使用统计

Command	Risk	Purpose
`+get-usage-summary`	read	Get token/cost summary for a relative or absolute range.
`+get-usage-details`	read	Get paginated usage grouped by user, model, date, or application type.
`+get-agent-tool-calls`	read	Get Agent tool-call count for a range, optionally refreshing the cache.
`+get-usage-combinations`	read	Drill one parent group into the remaining dimensions.
`+export-usage`	read	Stream filtered one-dimension usage groups to CSV.
`+export-usage-details`	read	Stream full or drill-down multi-dimension details to CSV.

Examples:

bash

ae-cli system +get-usage-summary --days 30
ae-cli system +get-usage-summary --days 30 --refresh true

ae-cli system +get-usage-details \
  --start-date 2026-07-01 \
  --end-date 2026-07-24 \
  --group-by user \
  --page 1 \
  --page-size 20

ae-cli system +get-usage-combinations \
  --start-date 2026-07-01 \
  --end-date 2026-07-24 \
  --parent-dimension user \
  --open-id <open-id>

ae-cli system +export-usage \
  --start-date 2026-07-01 \
  --end-date 2026-07-24 \
  --group-by user \
  --output ./system-usage.csv

Summary range:

Use
```
--days 1..365
```
, or provide both
```
--start-date
```
and
```
--end-date
```
.
Dates use
```
YYYY-MM-DD
```
.
Do not combine
```
--days
```
with an absolute date pair.

--refresh true

is available on

+get-usage-summary

and

+get-agent-tool-calls

and bypasses the overview cache.

Details flags:

```
--start-date
```
and
```
--end-date
```
are required.

--group-by

user | model | date | app_type

Optional filters:

--search

--open-id

--model-id

--model-scope

--app-type

```
--model-scope
```
requires
```
--model-id
```
.

--sort-by

totalTokens | cost | share | requestCount

```
--sort-dir
```
:
```
asc | desc
```
.

Combination drill-down requires exactly one parent selector:

```
user
```
→
```
--open-id
```
only.
```
model
```
→
```
--model-id
```
and
```
--model-scope
```
only.
```
app_type
```
→
```
--app-type
```
only.
```
date
```
→
```
--date
```
only, inside the selected range.

CSV exports require an explicit

--output

. The target is created exclusively: an existing file is never overwritten, and an HTTP or stream failure removes the incomplete file. The JSON result reports the absolute local path, bytes written, server filename, and content type.

命令	风险等级	用途
`+get-usage-summary`	只读	获取相对或绝对时间范围内的令牌/成本汇总。
`+get-usage-details`	只读	获取按用户、模型、日期或应用类型分组的分页使用数据。
`+get-agent-tool-calls`	只读	获取指定时间范围内的Agent工具调用次数，可选择刷新缓存。
`+get-usage-combinations`	只读	将父组深入到剩余维度进行分析。
`+export-usage`	只读	将过滤后的一维使用分组数据流式导出为CSV。
`+export-usage-details`	只读	将完整或深入分析的多维详细数据流式导出为CSV。

示例：

bash

ae-cli system +get-usage-summary --days 30
ae-cli system +get-usage-summary --days 30 --refresh true

ae-cli system +get-usage-details \
  --start-date 2026-07-01 \
  --end-date 2026-07-24 \
  --group-by user \
  --page 1 \
  --page-size 20

ae-cli system +get-usage-combinations \
  --start-date 2026-07-01 \
  --end-date 2026-07-24 \
  --parent-dimension user \
  --open-id <open-id>

ae-cli system +export-usage \
  --start-date 2026-07-01 \
  --end-date 2026-07-24 \
  --group-by user \
  --output ./system-usage.csv

时间范围规则：

使用
```
--days 1..365
```
，或同时提供
```
--start-date
```
和
```
--end-date
```
。
日期格式为
```
YYYY-MM-DD
```
。
请勿将
```
--days
```
与绝对日期对组合使用。

--refresh true

适用于

+get-usage-summary

和

+get-agent-tool-calls

，可绕过概览缓存。

详细数据参数：

```
--start-date
```
和
```
--end-date
```
为必填项。

--group-by

user | model | date | app_type

。

可选过滤器：

--search

--open-id

--model-id

--model-scope

--app-type

。

```
--model-scope
```
需要配合
```
--model-id
```
使用。

--sort-by

totalTokens | cost | share | requestCount

。

```
--sort-dir
```
:
```
asc | desc
```
。

组合深入分析需要恰好一个父选择器：

```
user
```
→ 仅使用
```
--open-id
```
。
```
model
```
→ 仅使用
```
--model-id
```
和
```
--model-scope
```
。
```
app_type
```
→ 仅使用
```
--app-type
```
。
```
date
```
→ 仅使用
```
--date
```
，且日期需在选定范围内。

CSV导出需要明确指定

--output

。目标文件会被独占创建：不会覆盖现有文件，若HTTP或流传输失败，会删除不完整的文件。JSON结果会报告绝对本地路径、写入字节数、服务器文件名和内容类型。

Cost Control

成本控制

Command	Risk	Purpose
`+get-cost-summary`	read	Get company cost, quota, and usage summary.
`+get-balance`	read	Get the current model account balance and currency.
`+list-over-limit-users`	read	List members over cost or token quota limits.
`+get-balance-alert`	read	Get balance alert config and current status.
`+set-balance-alert`	write	Enable, update, or disable the balance alert.
`+list-quota-rules`	read	List cost/token quota rules.
`+create-quota-rule`	write	Create a company or user quota rule.
`+update-quota-rule`	write	Update a quota rule.
`+remove-quota-rule`	high-risk-write	Delete a quota rule.
`+bind-quota-rule-user`	write	Bind a quota rule to a TE user openId.

Examples:

bash

ae-cli system +set-balance-alert --enabled true --threshold 100

ae-cli system +create-quota-rule --rule @quota-rule.json
ae-cli system +bind-quota-rule-user --id <rule-id> --open-id <open-id>

Quota rule JSON:

json

{
  "name": "Daily user quota",
  "subjectType": "USER",
  "periodType": "DAY",
  "quotaType": "TOKEN",
  "totalTokens": "10",
  "allowedModels": ["<model-id>"],
  "modelLimits": [
    {
      "modelId": "<model-id>",
      "limitTokens": "5"
    }
  ],
  "openIds": ["<open-id>"]
}

Rules:

```
subjectType
```
:
```
USER | COMPANY
```
.
```
periodType
```
:
```
DAY | WEEK | MONTH
```
.
```
quotaType
```
:
```
COST | TOKEN
```
.
COST uses
```
budgetAmount
```
; TOKEN uses
```
totalTokens
```
. Token values are expressed in millions.
```
allowedModels
```
and
```
modelLimits
```
are optional according to the server rule type.
Update accepts a partial rule object.

命令	风险等级	用途
`+get-cost-summary`	只读	获取企业成本、配额和使用情况汇总。
`+get-balance`	只读	获取当前模型账户余额和货币类型。
`+list-over-limit-users`	只读	列出超出成本或令牌配额限制的成员。
`+get-balance-alert`	只读	获取余额提醒配置和当前状态。
`+set-balance-alert`	写入	启用、更新或禁用余额提醒。
`+list-quota-rules`	只读	列出成本/令牌配额规则。
`+create-quota-rule`	写入	创建企业或用户配额规则。
`+update-quota-rule`	写入	更新配额规则。
`+remove-quota-rule`	高风险写入	删除配额规则。
`+bind-quota-rule-user`	写入	将配额规则绑定到TE用户openId。

示例：

bash

ae-cli system +set-balance-alert --enabled true --threshold 100

ae-cli system +create-quota-rule --rule @quota-rule.json
ae-cli system +bind-quota-rule-user --id <rule-id> --open-id <open-id>

配额规则JSON：

json

{
  "name": "Daily user quota",
  "subjectType": "USER",
  "periodType": "DAY",
  "quotaType": "TOKEN",
  "totalTokens": "10",
  "allowedModels": ["<model-id>"],
  "modelLimits": [
    {
      "modelId": "<model-id>",
      "limitTokens": "5"
    }
  ],
  "openIds": ["<open-id>"]
}

规则说明：

```
subjectType
```
:
```
USER | COMPANY
```
。
```
periodType
```
:
```
DAY | WEEK | MONTH
```
。
```
quotaType
```
:
```
COST | TOKEN
```
。
COST类型使用
```
budgetAmount
```
；TOKEN类型使用
```
totalTokens
```
。令牌值以百万为单位。
```
allowedModels
```
和
```
modelLimits
```
根据服务器规则类型可选。
更新操作接受部分规则对象。

Channels

渠道管理

Command	Risk	Purpose
`+list-channels`	read	List Feishu, Lark, and Slack channels.
`+create-channel`	write	Create one channel.
`+update-channel`	write	Update channel settings, credentials, model, prompt, or enabled state.
`+remove-channel`	high-risk-write	Delete a channel, unbind users, and stop its connection.

Always use

@file

for channel payloads when they contain credentials:

bash

ae-cli system +create-channel --channel @channel.json
ae-cli system +update-channel --id <channel-id> --channel @channel-update.json

Create schema:

json

{
  "name": "Required display name",
  "type": "feishu",
  "config": {
    "appId": "Feishu/Lark",
    "appSecret": "Feishu/Lark",
    "botToken": "Slack",
    "appToken": "Slack",
    "clientId": "optional",
    "clientSecret": "optional"
  },
  "model": "optional Model.id or modelId::scope",
  "systemPrompt": "optional"
}

Update accepts a partial object with

name

config

model

systemPrompt

enabled

, or

unbindUsers

. Channel type is immutable after creation. Dry-run replaces secret values with

***

命令	风险等级	用途
`+list-channels`	只读	列出Feishu、Lark和Slack渠道。
`+create-channel`	写入	创建一个渠道。
`+update-channel`	写入	更新渠道设置、凭证、模型、提示词或启用状态。
`+remove-channel`	高风险写入	删除渠道、解除用户绑定并停止其连接。

当渠道负载包含凭证时，请始终使用

@file

：

bash

ae-cli system +create-channel --channel @channel.json
ae-cli system +update-channel --id <channel-id> --channel @channel-update.json

创建数据结构：

json

{
  "name": "必填显示名称",
  "type": "feishu",
  "config": {
    "appId": "Feishu/Lark",
    "appSecret": "Feishu/Lark",
    "botToken": "Slack",
    "appToken": "Slack",
    "clientId": "可选",
    "clientSecret": "可选"
  },
  "model": "可选Model.id或modelId::scope",
  "systemPrompt": "可选"
}

更新操作接受包含

name

、

config

、

model

、

systemPrompt

、

enabled

或

unbindUsers

的部分对象。渠道类型创建后不可更改。Dry-run会将机密值替换为

***

。

Permission Errors

权限错误

A permission response looks like:

json

{
  "ok": false,
  "error": {
    "type": "permission",
    "message": "..."
  }
}

On this response:

Do not retry with another admin path.
Do not recommend re-login unless the server returned 401 instead.
Tell the user that
```
root
```
or
```
agent_admin
```
is required.

An authenticated

root

agent_admin

is still scoped to their own company. The current service checks the database role and company against the session, and audited member, channel, sandbox-tool, and sandbox-management routes apply company/resource ownership checks. Never use that statement as a claim that every unreviewed admin route is safe.

权限响应示例：

json

{
  "ok": false,
  "error": {
    "type": "permission",
    "message": "..."
  }
}

收到此响应时：

请勿尝试使用其他管理员路径重试。
除非服务器返回401错误，否则不建议重新登录。
告知用户需要
```
root
```
或
```
agent_admin
```
权限。

已认证的

root

或

agent_admin

仍受限于自身企业。当前服务会检查会话中的数据库角色和企业信息，经过审计的成员、渠道、沙箱工具和沙箱管理路由会应用企业/资源归属检查。切勿将此表述视为所有未审核管理员路由均安全的声明。

Transport Status

传输状态

This is a Transitional L2 domain backed by te-agent

/api/admin/**

Maintainer: te-agent admin routes and
```
src/commands/te-system/**
```
.
Migration target: system Capability Gateway.
Review date: 2026-10-24.
Exit condition: migrate after equivalent gateway schema, auth, risk, dry-run, and output contracts are stable.

这是一个过渡性L2域，基于te-agent的

/api/admin/**

构建。

维护者：te-agent管理员路由和
```
src/commands/te-system/**
```
。
迁移目标：系统能力网关。
审核日期：2026-10-24。
退出条件：在等效网关的 schema、认证、风险控制、dry-run和输出契约稳定后进行迁移。

ae-system

Original

Translation

ae-system

ae-system

Mandatory Rules

强制规则

Command Groups

命令组

Members

成员管理

Sandboxes

沙箱管理

Shared Sandbox Tools

共享沙箱工具

Preferred npm Flow

推荐的npm流程

Existing Directory Flow

现有目录流程

Models

模型管理

Usage

使用统计

Cost Control

成本控制

Channels

渠道管理

Permission Errors

权限错误

Transport Status

传输状态