feat: add inkreach CLI + inkreach-teable-ops skill

A self-built CLI and companion agent skill for operating a deployed
inkreach-teable instance — configuring tables, fields, records, views, and
the project's OWN automation engine.

Why not the official 'teable' CLI:
  inkreach-teable's automation is self-built with a different contract:
  - conditions (not filter), fieldIds (not watchFieldIds)
  - recordCondition (not recordMatchesConditions)
  - webhook route /api/webhook/{baseId}/{wfId} (not the /base//workflow/ form)
  - scheduledTime backend honors only timing.type + timing.interval
  The official CLI targets the upstream contract and 404s/misconfigures here.
  Table/field/record/view APIs ARE upstream-compatible, but automation is not.

inkreach CLI (packages/inkreach-cli/):
  - Node.js + commander, zero extra runtime deps
  - Uses node:http (NOT fetch — Node 24 fetch drops Authorization header)
  - Commands: auth (login/status/token), base/table/field/record/view,
    workflow (list/get/create/update/delete/activate/deactivate/test),
    trigger set (8 types, builds correct config keys), action add/update/delete
    (6 types), secret, runs (list/get/rerun), fire (button-click/webhook), sql
  - --json mode for agent parsing; GET->modify->PUT whole-graph for node edits
  - Verified end-to-end: create workflow -> set webhook trigger -> add script
    action -> activate -> fire webhook -> runs list (succeeded)

inkreach-teable-ops skill (.agents/skills/inkreach-teable-ops/):
  - SKILL.md entry: module map, routing rules, 11 key constraints (the real
    contract keys), execution rules, error recovery
  - guides/: cli-reference, automation-guide, tables-fields, instance-access,
    development (build/restart, known gotchas)
  - api-reference/: trigger-types (8 triggers, exact config), action-types
    (6 actions, sandbox globals), field-types (21 types incl. Button)
  - metadata.json + install.sh

dist/commands/auth.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authCommand = void 0;
+/**
+ * `inkreach auth` — authentication & config commands.
+ */
+const commander_1 = require("commander");
+const ctx_1 = require("../lib/ctx");
+const config_1 = require("../lib/config");
+const output_1 = require("../lib/output");
+void ctx_1.requireBaseId;
+function authCommand() {
+    const cmd = new commander_1.Command('auth');
+    cmd.description('Manage authentication and CLI config');
+    cmd
+        .command('status')
+        .description('Verify the configured token by calling GET /api/user/me')
+        .action((0, ctx_1.run)(async (ctx) => {
+        const me = (await ctx.client.getMe());
+        const cfg = (0, config_1.readConfigFile)();
+        if (ctx.json) {
+            (0, output_1.printJson)({ config: cfg, user: me });
+        }
+        else {
+            (0, output_1.printKv)([
+                ['config path', (0, config_1.configPath)()],
+                ['endpoint', cfg.endpoint || config_1.DEFAULT_ENDPOINT],
+                ['token set', cfg.token ? `yes (${cfg.token.slice(0, 14)}…)` : 'no'],
+                ['base id', cfg.baseId || '(none)'],
+                ['', ''],
+                ['user id', me?.id || 'unknown'],
+                ['name', me?.name || 'unknown'],
+                ['email', me?.email || 'unknown'],
+            ]);
+        }
+    }));
+    cmd
+        .command('login')
+        .description('Configure endpoint, token, and default base id')
+        .option('--endpoint <url>', 'Backend URL (default http://localhost:3000)')
+        .option('--token <pat>', 'Personal Access Token (format: teable_xxx_yyy)')
+        .option('--base-id <id>', 'Default base id for subsequent commands')
+        .action((0, ctx_1.run)(async (ctx, _args, o) => {
+        const opts = o;
+        // Merge global flags (--token/--endpoint/--base-id on the program) with
+        // this subcommand's own --endpoint/--token/--base-id options.
+        const g = ctx.program.opts();
+        const patch = {};
+        const endpoint = opts.endpoint || g.endpoint;
+        const tokenVal = opts.token || g.token;
+        const baseId = opts.baseId || g.baseId;
+        if (endpoint)
+            patch.endpoint = endpoint;
+        if (tokenVal)
+            patch.token = tokenVal;
+        if (baseId)
+            patch.baseId = baseId;
+        (0, config_1.writeConfigFile)(patch);
+        const cfg = (0, config_1.readConfigFile)();
+        if (ctx.json) {
+            (0, output_1.printJson)({ ok: true, config: cfg });
+        }
+        else {
+            process.stdout.write('✓ Configuration saved:\n');
+            (0, output_1.printKv)([
+                ['endpoint', cfg.endpoint || config_1.DEFAULT_ENDPOINT],
+                ['token', cfg.token ? `set (${cfg.token.slice(0, 14)}…)` : '(not set)'],
+                ['base id', cfg.baseId || '(none)'],
+                ['path', (0, config_1.configPath)()],
+            ]);
+        }
+    }));
+    const token = cmd.command('token').description('Manage Personal Access Tokens (PAT)');
+    token
+        .command('list')
+        .description('List your access tokens')
+        .action((0, ctx_1.run)(async (ctx) => {
+        const list = (await ctx.client.listAccessTokens());
+        if (ctx.json)
+            (0, output_1.printJson)(list);
+        else
+            (0, output_1.printTable)([
+                { key: 'id', header: 'ID' },
+                { key: 'name', header: 'NAME' },
+                { key: 'scopes', header: 'SCOPES' },
+                { key: 'expiredTime', header: 'EXPIRES' },
+            ], list.map((t) => ({ ...t, scopes: (t.scopes || []).join(',') })));
+    }));
+    token
+        .command('create')
+        .description('Create a PAT. The full token is returned ONLY ONCE.')
+        .requiredOption('--name <name>', 'Token name')
+        .option('--scopes <csv>', 'Comma-separated scopes', 'automation|read,automation|create,automation|update,automation|delete,table|read,record|read,record|create,record|update')
+        .option('--base-ids <csv>', 'Restrict to base ids (comma-separated). Omit for full access')
+        .option('--full-access', 'Grant full access')
+        .option('--expires <date>', 'Expiry date YYYY-MM-DD (default 2099-12-31)', '2099-12-31')
+        .action((0, ctx_1.run)(async (ctx, _args, o) => {
+        const opts = o;
+        const scopes = opts.scopes.split(',').map((s) => s.trim()).filter(Boolean);
+        const baseIds = opts['base-ids']
+            ? opts['base-ids'].split(',').map((s) => s.trim())
+            : undefined;
+        const created = (await ctx.client.createAccessToken({
+            name: opts.name,
+            scopes,
+            baseIds,
+            hasFullAccess: !!opts['full-access'],
+            expiredTime: opts.expires,
+        }));
+        if (ctx.json)
+            (0, output_1.printJson)(created);
+        else {
+            (0, output_1.printKv)([
+                ['id', created.id],
+                ['token', created.token],
+                ['', ''],
+                ['note', 'Save this token now — it cannot be retrieved again.'],
+                ['use', 'inkreach auth login --token <above>'],
+            ]);
+        }
+    }));
+    token
+        .command('delete <id>')
+        .description('Revoke an access token')
+        .action((0, ctx_1.run)(async (ctx, args) => {
+        const id = args[0];
+        await ctx.client.deleteAccessToken(id);
+        if (ctx.json)
+            (0, output_1.printJson)({ ok: true, id });
+        else
+            process.stdout.write(`✓ Token ${id} revoked\n`);
+    }));
+    return cmd;
+}
+exports.authCommand = authCommand;