feat(cli): support --dependencies for script actions

- action add/update: new --dependencies <json> option
- parseDependencies accepts JSON, name@version shorthand, or bare names
- update is incremental; --dependencies replaces the whole array
- docs: deployment/systemd.md + skill SKILL/action-types/development
  document the npm-deps feature and the service-PATH requirement
  (spawn npm ENOENT without nvm bin dir on PATH)

.agents/skills/inkreach-teable/SKILL.md

@@ -109,7 +109,7 @@ These differ from official teable and from the (stale) `docs/automation/triggers
 8. **`workflow delete` is a SOFT delete** (cascades to base_node, auto-token, trigger unregister). Test workflows should be `deactivate`d, not deleted.
 9. **Secrets values are write-only** — `secret list` never returns the value. Scripts read them via `process.env.<NAME>`.
 10. **PAT format is `teable_{id}_{encryptedSign}`** — create via `auth token create`, the full string is returned **once**.
-11. **Script sandbox has NO `fs`/`eval`/`Function`**, but has `triggerInput`, `console`, `fetch`, `process.env` (= secrets + `AUTOMATION_TOKEN` + `PUBLIC_ORIGIN`), and a controlled `require`. Use `triggerInput._accessToken` + `triggerInput._apiBaseUrl` to call back into the instance API.
+11. **Script sandbox has NO `fs`/`eval`/`Function`**, but has `triggerInput`, `console`, `fetch`, `process.env` (= secrets + `AUTOMATION_TOKEN` + `PUBLIC_ORIGIN`), and a controlled `require`. Use `triggerInput._accessToken` + `triggerInput._apiBaseUrl` to call back into the instance API. **npm deps supported**: declare via `action add/update --dependencies '[{"name":"axios","version":"1.6.0"}]'` (or shorthand `axios@1.6.0,dayjs`), then `require('axios')` works in-sandbox. **Requires** `npm` on the backend service PATH (see [action-types.md](api-reference/action-types.md) §script + [deployment/systemd.md](../../../../deployment/systemd.md) Troubleshooting) — missing it → `spawn npm ENOENT`.
 
 ## 4. Execution Rules
 

.agents/skills/inkreach-teable/api-reference/action-types.md

@@ -50,6 +50,21 @@ inkreach-teable action add <wfId> --type script \
 inkreach-teable action add <wfId> --type script --code-file ./my-script.js --timeout 120000
 ```
 
+**With npm dependencies** (installed into a sandbox cache, then `require()`-able):
+```bash
+# JSON form (recommended)
+inkreach-teable action add <wfId> --type script \
+  --code-file ./sync.js \
+  --dependencies '[{"name":"axios","version":"1.6.0"},{"name":"dayjs","version":"1.11.10"}]'
+# shorthand: name@version,name  (version omitted → 'latest')
+inkreach-teable action add <wfId> --type script --code-file ./sync.js --dependencies 'axios@1.6.0,dayjs'
+# replace / clear deps on an existing node
+inkreach-teable action update <wfId> <nodeId> --dependencies '[{"name":"axios"}]'
+inkreach-teable action update <wfId> <nodeId> --dependencies '[]'   # clear
+```
+
+> ⚠️ **Deployment requirement**: the backend installs deps via `spawn('npm')`, so `npm` must be on the **service** PATH. systemd user units default to a PATH that omits the nvm bin dir → scripts with deps fail with `spawn npm ENOENT`. Fix: add `Environment=PATH=<nvm-bin>:/usr/local/sbin:...` to `teable-backend.service` (see [deployment/systemd.md](../../../../deployment/systemd.md) Troubleshooting).
+
 **Config:**
 ```json
 {
@@ -59,7 +74,7 @@ inkreach-teable action add <wfId> --type script --code-file ./my-script.js --tim
 }
 ```
 - `timeout`: default 60000 (120000 in batch mode).
-- `dependencies`: optional npm packages; `require('axios')` works in-sandbox.
+- `dependencies`: optional npm packages; `require('axios')` works in-sandbox. Install is cached by `name@version` hash; first run downloads, later runs reuse. CLI accepts JSON `[{"name","version?"}]` or shorthand `name@version,name`. `update` replaces the whole array (not append).
 
 **Output:**
 ```json

.agents/skills/inkreach-teable/guides/development.md

@@ -59,6 +59,21 @@ via `process.env.NAME` (this is allowed — only `process.env` is exposed, not
 `triggerInput._apiBaseUrl` for back-channel API calls. No `fs`, `eval`,
 `Function`, or `child_process`.
 
+### Script sandbox npm deps need npm on the service PATH
+Script actions CAN use npm packages — declare them via the CLI
+(`action add/update --dependencies '[{"name":"axios","version":"1.6.0"}]'`
+or shorthand `axios@1.6.0,dayjs`) and `require('axios')` works in-sandbox.
+The backend installs deps into a cache dir (`/tmp/teable-automation-deps/<hash>`)
+via `spawn('npm', ['install', ...])`, keyed by `name@version`.
+
+**Gotcha:** systemd user services default to `PATH=/usr/local/bin:/usr/bin:...`
+which OMITS the nvm bin dir where `npm` lives → scripts with deps fail with
+`Dependency install failed: spawn npm ENOENT`. Fix: add
+`Environment=PATH=/root/.nvm/versions/node/vX/bin:/usr/local/sbin:...` to
+`teable-backend.service`, `daemon-reload`, restart. Verify:
+`inkreach-teable workflow test <wfId>` on a script with `require('dayjs')` →
+`succeeded`.
+
 ### scheduledTime backend is a simplified implementation
 The backend `scheduled-time.trigger.ts` only honors `timing.type` + `timing.interval`.
 It ignores `triggerTime`, `weekdays`, `daysOfMonth`, `starting`, `ending`, `tz`.