@thinkingai/ae-cli 1.0.24 → 1.0.28

package/README.md

@@ -68,6 +68,13 @@ ae-cli kb +schema --name engineering-handbook
 ae-cli kb +compile --name engineering-handbook
 ae-cli kb +query -q "How to configure sandbox?" \
   --sources '[{"scope":"company","name":"engineering-handbook"}]'
+
+# Retrieval primitives for external agents (read index → grep → read page)
+ae-cli kb +index --sources '[{"scope":"company","name":"engineering-handbook"}]'
+ae-cli kb +grep -q "sandbox config" \
+  --sources '[{"scope":"company","name":"engineering-handbook"}]'
+ae-cli kb +read --source '{"scope":"company","name":"engineering-handbook"}' \
+  --path "wiki/sandbox.md"
 ```
 
 ## Authentication
@@ -105,21 +112,29 @@ ae-cli auth logout
 | `dataops_integration` | 20+ | Data integration: datasource management, sync solutions, data synchronization |
 | `community` | 10+ | Community analysis: posts search, sentiment analysis, topic trends, livestream data |
 | `analysis_common` | 2 | Cross-module common constraints: resource link completion, project ID gate |
-| `kb` | 7 | Knowledge base lifecycle: query / new / add (md/dir/url) / schema / compile / rm-source / remove |
+| `team` | 14 | AI Agent Team: manage teams (list/create/update/delete/ai-generate/templates/projects) and execute TeamRuns (start/watch/chat/reply/cancel/result/artifacts) |
+| `kb` | 10 | Knowledge base lifecycle: query / new / add (md/dir/url) / schema / compile / rm-source / remove; retrieval primitives: index / grep / read |
 | `auth` / `config` | 2 | Authentication and host configuration |
 
 ### kb
 
-Knowledge base lifecycle (`+new` → `+add` → `+schema` → `+compile` → `+query`):
+Knowledge base lifecycle (`+new` → `+add` → `+schema` → `+compile` → `+status` → `+query`):
 
 - **Create** (`+new`): `--scope personal|company`, `--name`, optional `--description`, `--tags`, `--project-id`, `--project-name`
 - **Upload** (`+add`): `--name`, `--files` JSON array (`.md` file, directory non-recursive scan, or http(s) URL with HTML-to-Markdown conversion)
 - **Schema** (`+schema`): `--name`, optional `--force`, `--model`
 - **Compile** (`+compile`): `--name`, `--mode incremental|full` (default: incremental)
+- **Status** (`+status`): `--name`
 - **Query** (`+query`): `--query` / `-q`, `--sources` JSON refs e.g. `[{"scope":"company","name":"engineering-handbook"}]`
 - **Remove source** (`+rm-source`): `--name`, `--display-name`
 - **Remove KB** (`+remove`): `--name`
 
+Retrieval primitives for external agents (`+index` → `+grep` → `+read`); these are deterministic file-search endpoints with no server-side LLM, designed for agents (Claude Code / Codex / Cursor) to explore a KB the way they explore a codebase:
+
+- **Index** (`+index`): optional `--sources` JSON refs (omit to list all accessible KBs), optional `--locale`. Returns each KB's metadata plus its `index.md` navigation map.
+- **Grep** (`+grep`): `--query` / `-q`, optional `--sources`, `--top-k` (1-50, default 10), `--locale`. Returns matched lines with path, line number, breadcrumb and context snippet.
+- **Read** (`+read`): `--source` JSON ref (exactly one KB), `--path` (page path relative to the KB root), optional `--offset` / `--limit` (line window), `--locale`. Returns the full page or a line window.
+
 ### Global Options
 
 | Option | Description | Default |

package/README.zh.md

@@ -68,6 +68,13 @@ ae-cli kb +schema --name engineering-handbook
 ae-cli kb +compile --name engineering-handbook
 ae-cli kb +query -q "如何配置 sandbox 容器？" \
   --sources '[{"scope":"company","name":"engineering-handbook"}]'
+
+# 面向外部 agent 的检索原语（读 index → grep 定位 → read 翻页）
+ae-cli kb +index --sources '[{"scope":"company","name":"engineering-handbook"}]'
+ae-cli kb +grep -q "sandbox 配置" \
+  --sources '[{"scope":"company","name":"engineering-handbook"}]'
+ae-cli kb +read --source '{"scope":"company","name":"engineering-handbook"}' \
+  --path "wiki/sandbox.md"
 ```
 
 ## 身份验证
@@ -105,21 +112,30 @@ ae-cli auth logout
 | `dataops_integration` | 20+ | 数据集成：数据源管理、同步方案、数据同步 |
 | `community` | 10+ | 社区分析：帖子搜索、情感分析、话题趋势、直播数据 |
 | `analysis_common` | 2 | 跨模块通用约束：资源链接补全、项目 ID 门控 |
-| `kb` | 7 | 知识库生命周期：查询 / 新建 / 添加源（md/目录/url）/ schema / 编译 / 删除源 / 删除 |
+| `agent` | 15 | Agent 平台资源管理：模型、MCP 服务、Skill、附件库的增删查和启停 |
+| `team` | 14 | AI Agent Team：团队管理（列表/创建/更新/删除/AI生成/模板/项目）和 TeamRun 执行（启动/监听/对话/回复/取消/结果/产物） |
+| `kb` | 10 | 知识库生命周期：查询 / 新建 / 添加源（md/目录/url）/ schema / 编译 / 删除源 / 删除；检索原语：index / grep / read |
 | `auth` / `config` | 2 | 身份验证和主机配置 |
 
 ### kb（知识库）
 
-知识库生命周期（`+new` → `+add` → `+schema` → `+compile` → `+query`）：
+知识库生命周期（`+new` → `+add` → `+schema` → `+compile` → `+status` → `+query`）：
 
 - **新建** (`+new`)：`--scope personal|company`，`--name`，可选 `--description`、`--tags`、`--project-id`、`--project-name`
 - **上传源** (`+add`)：`--name`，`--files` JSON 数组（`.md` 文件、目录非递归扫描、或 http(s) URL 自动转 Markdown）
 - **生成 schema** (`+schema`)：`--name`，可选 `--force`、`--model`
 - **编译** (`+compile`)：`--name`，`--mode incremental|full`（默认 incremental）
+- **查询状态** (`+status`)：`--name`
 - **查询** (`+query`)：`--query` / `-q`，`--sources` JSON 引用，如 `[{"scope":"company","name":"engineering-handbook"}]`
 - **删除源** (`+rm-source`)：`--name`，`--display-name`
 - **删除知识库** (`+remove`)：`--name`
 
+面向外部 agent 的检索原语（`+index` → `+grep` → `+read`）；均为确定性文件检索端点、服务端零 LLM 调用，让 agent（Claude Code / Codex / Cursor）像翻代码库一样探索知识库：
+
+- **索引** (`+index`)：可选 `--sources` JSON 引用（省略则列出全部可访问知识库），可选 `--locale`。返回每个知识库的元信息及其 `index.md` 导航地图。
+- **检索** (`+grep`)：`--query` / `-q`，可选 `--sources`、`--top-k`（1-50，默认 10）、`--locale`。返回命中行的路径、行号、面包屑与上下文片段。
+- **读取** (`+read`)：`--source` JSON 引用（精确指向一个知识库），`--path`（相对知识库根目录的页面路径），可选 `--offset` / `--limit`（行窗口）、`--locale`。返回页面全文或行窗口。
+
 ### 全局选项
 
 | 选项 | 描述 | 默认值 |

package/dist/auth-5NSDQFQB.js

@@ -0,0 +1,454 @@
+import {
+  printError,
+  printOutput
+} from "./chunk-CLJF7MQA.js";
+import {
+  clearMcpToken,
+  setMcpTokenManual,
+  validateMcpToken
+} from "./chunk-WCHI7725.js";
+import "./chunk-GSJGPNKK.js";
+import {
+  clear,
+  clearToken,
+  getAuthStatus,
+  load,
+  resolveHost,
+  save,
+  setTokenManual,
+  validateToken
+} from "./chunk-CAQYQA4R.js";
+import {
+  loadConfig,
+  logger,
+  saveConfig
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/device-auth.ts
+import { execFileSync } from "child_process";
+var DeviceFlowUnsupportedError = class extends Error {
+  constructor() {
+    super("This AE server does not support device code login (it may be an older server version).");
+    this.name = "DeviceFlowUnsupportedError";
+  }
+};
+function looksLikeMissingEndpoint(status, contentType, body) {
+  if (status === 404) return true;
+  if (contentType && contentType.toLowerCase().includes("text/html")) return true;
+  const head = body.trimStart().toLowerCase();
+  return head.startsWith("<!doctype html") || head.startsWith("<html");
+}
+function openBrowser(url, _execFile) {
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    logger.warn(`openBrowser: invalid URL, not opening`);
+    return false;
+  }
+  if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+    logger.warn(`openBrowser: unsafe protocol "${parsedUrl.protocol}", not opening`);
+    return false;
+  }
+  const safeLogUrl = `${parsedUrl.origin}${parsedUrl.pathname}`;
+  const exec = _execFile ?? execFileSync;
+  try {
+    if (process.platform === "darwin") {
+      exec("open", [url], { timeout: 5e3 });
+      return true;
+    }
+    if (process.platform === "win32") {
+      exec("cmd", ["/c", "start", "", url], { timeout: 5e3 });
+      return true;
+    }
+    exec("xdg-open", [url], { timeout: 5e3 });
+    return true;
+  } catch (e) {
+    logger.warn(`openBrowser: failed to open ${safeLogUrl}: ${e.message}`);
+    return false;
+  }
+}
+async function authorizeDevice(host) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/authorize`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" }
+    });
+  } catch (e) {
+    throw new Error(`Device authorize request failed: ${e.message}`);
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    throw new DeviceFlowUnsupportedError();
+  }
+  if (!resp.ok) {
+    throw new Error(`Device authorize returned HTTP ${resp.status}: ${text}`);
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new Error("Device authorize returned invalid JSON");
+  }
+  if (!body.device_code || !body.user_code) {
+    throw new Error("Device authorize response missing required fields");
+  }
+  return body;
+}
+async function pollDeviceToken(host, deviceCode) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/token`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+  } catch (e) {
+    return { status: "error", message: `Network error: ${e.message}` };
+  }
+  if (resp.status === 200) {
+    let body;
+    try {
+      body = await resp.json();
+    } catch {
+      return { status: "error", message: "Token response is not valid JSON" };
+    }
+    if (!body.access_token) {
+      return { status: "error", message: "Token response missing access_token" };
+    }
+    return { status: "approved", tokens: body };
+  }
+  if (resp.status === 400) {
+    let errorBody;
+    try {
+      errorBody = await resp.json();
+    } catch {
+      errorBody = {};
+    }
+    const err = errorBody.error;
+    if (err === "authorization_pending") return { status: "pending" };
+    if (err === "slow_down") return { status: "slow_down" };
+    if (err === "expired_token") return { status: "expired" };
+    return { status: "error", message: `Unknown error: ${err ?? "unknown"}` };
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    return { status: "unsupported" };
+  }
+  return { status: "error", message: `Unexpected HTTP ${resp.status} from token endpoint` };
+}
+function buildVerificationUrl(host, userCode) {
+  return `${host.replace(/\/+$/, "")}/device-activate?user_code=${encodeURIComponent(userCode)}`;
+}
+async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  let intervalMs = options.intervalMs ?? 5e3;
+  const expiresIn = options.expiresIn ?? 300;
+  const deadline = Date.now() + expiresIn * 1e3;
+  let pollCount = 0;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    pollCount++;
+    const result = await pollDeviceToken(host, deviceCode);
+    if (result.status === "approved") {
+      emit(`Authorization successful! (polled ${pollCount} time(s))`);
+      return result.tokens;
+    }
+    if (result.status === "pending") {
+      if (pollCount % 5 === 0) {
+        const remaining = Math.max(0, Math.round((deadline - Date.now()) / 1e3));
+        emit(`Waiting for authorization... (expires in ${remaining}s)`);
+      }
+      logger.info(`device-auth: poll #${pollCount} pending`);
+      continue;
+    }
+    if (result.status === "slow_down") {
+      intervalMs += 5e3;
+      logger.info(`device-auth: slow_down received, new interval=${intervalMs}ms`);
+      continue;
+    }
+    if (result.status === "expired") {
+      throw new Error(
+        `Device code has expired. Please run ae-cli auth login again to restart the authorization flow.`
+      );
+    }
+    if (result.status === "unsupported") {
+      throw new DeviceFlowUnsupportedError();
+    }
+    if (result.status === "error") {
+      logger.warn(`device-auth: poll error: ${result.message}`);
+      emit(`Poll error: ${result.message}`);
+      if (result.message.includes("HTTP 401") || result.message.includes("HTTP 403")) {
+        throw new Error(`Authorization denied (${result.message}). Please check your configuration or run ae-cli auth login again.`);
+      }
+      continue;
+    }
+  }
+  throw new Error(
+    `Authorization timed out (not completed within ${expiresIn}s). Please run ae-cli auth login again.`
+  );
+}
+async function runDeviceFlow(host, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  emit("Requesting authorization code from server...");
+  const auth = await authorizeDevice(host);
+  const userCode = auth.user_code;
+  const verifyUrl = buildVerificationUrl(host, userCode);
+  const expiresIn = auth.expires_in ?? 300;
+  emit("");
+  emit(`Verification code: ${userCode}`);
+  emit(`Open the following link in your browser to complete authorization:`);
+  emit(`  ${verifyUrl}`);
+  emit("");
+  if (!options.noBrowser) {
+    const opened = openBrowser(verifyUrl);
+    if (opened) {
+      emit("(Attempted to open the link in your browser)");
+    } else {
+      emit("(Could not open browser automatically; please copy the link above manually)");
+    }
+    emit("");
+  }
+  return pollDeviceFlow(host, auth.device_code, { intervalMs: (auth.interval ?? 5) * 1e3, expiresIn }, onStatus);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/commands/auth.ts
+var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function resolveAuthHost(program, opts) {
+  return resolveHost(opts.host || program.opts().host);
+}
+function persistDeviceTokens(host, tokens) {
+  const DEFAULT_EXPIRES_IN = 72e3;
+  const MAX_EXPIRES_IN = 86400 * 365;
+  let expiresInSeconds = tokens.expires_in ?? DEFAULT_EXPIRES_IN;
+  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0 || expiresInSeconds > MAX_EXPIRES_IN) {
+    logger.warn(`auth login: expires_in=${tokens.expires_in} is out of range, falling back to ${DEFAULT_EXPIRES_IN}s`);
+    expiresInSeconds = DEFAULT_EXPIRES_IN;
+  }
+  const expiresAt = new Date(Date.now() + expiresInSeconds * 1e3).toISOString();
+  save(host, {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token ?? "",
+    accessExpiresAt: expiresAt,
+    mcpToken: tokens.mcp_token ?? void 0
+  });
+}
+function loginSummary(host, tokens) {
+  return {
+    authenticated: true,
+    host,
+    token: tokens.access_token.slice(0, 8) + "...",
+    mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
+  };
+}
+function resolveTeClaudeBase(host) {
+  const override = process.env.TE_CLAUDE_BASE_URL;
+  if (override) return override.replace(/\/+$/, "");
+  const base = host.replace(/\/+$/, "");
+  const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
+  return base.endsWith(basePath) ? base : base + basePath;
+}
+function registerAuth(program) {
+  const auth = program.command("auth").description("Authentication management");
+  auth.command("login").description("Log in to AE using the device code flow (cross-platform; --no-browser to print URL only)").option("--host <url>", HOST_OPTION_DESC).option("--no-browser", "Do not auto-open the browser; only print the authorization URL (headless / Linux)").option("--no-wait", "Request the device code and print the authorization URL as JSON, then exit without polling (for AI agents / split-flow). Resume with --device-code").option("--device-code <code>", "Resume a split-flow login: poll for the given device code until authorized, then save the token").action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      logger.info(`Host config auto-saved for ${host}`);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+    }
+    const noBrowser = !opts.browser;
+    const fmt = program.opts().format || "json";
+    const teClaudeBase = resolveTeClaudeBase(host);
+    const emit = (msg) => process.stderr.write(`[ae-cli] ${msg}
+`);
+    try {
+      if (opts.deviceCode) {
+        const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
+        persistDeviceTokens(host, tokens2);
+        logger.info(`Device flow login successful for ${host} (resumed)`);
+        emit("Login successful! Token saved securely.");
+        printOutput(loginSummary(host, tokens2), fmt);
+        return;
+      }
+      if (opts.wait === false) {
+        const authResp = await authorizeDevice(teClaudeBase);
+        printOutput(
+          {
+            device_code: authResp.device_code,
+            user_code: authResp.user_code,
+            verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
+            interval: authResp.interval,
+            expires_in: authResp.expires_in,
+            next: `Open verification_url in a browser to authorize, then run: ae-cli auth login --device-code ${authResp.device_code}`
+          },
+          fmt
+        );
+        return;
+      }
+      const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
+      persistDeviceTokens(host, tokens);
+      logger.info(`Device flow login successful for ${host}`);
+      emit("Login successful! Token saved securely.");
+      printOutput(loginSummary(host, tokens), fmt);
+    } catch (err) {
+      if (err instanceof DeviceFlowUnsupportedError) {
+        printError(
+          "auth",
+          err.message,
+          "Use `ae-cli auth set-token <token>` to authenticate, or upgrade the AE server to a version that supports device login."
+        );
+        process.exit(1);
+      }
+      printError("auth", err.message);
+      process.exit(1);
+    }
+  });
+  auth.command("set-token <token>").description("Manually set authentication token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+      printOutput({ saved: true, config }, program.opts().format || "json");
+    }
+    process.stderr.write(`[ae-cli] Validating token...
+`);
+    const isValid = await validateToken(token, host);
+    if (!isValid) {
+      logger.warn(`Token validation failed for ${host}`);
+      process.stderr.write(`[ae-cli] Token validation failed
+`);
+      printError("auth", "Invalid token", "Please check your token and try again");
+      process.exit(1);
+    }
+    setTokenManual(token, host);
+    logger.info(`Token manually set and validated for ${host}`);
+    process.stderr.write(`[ae-cli] Token verified and saved for ${host}
+`);
+    printOutput({ saved: true, host, verified: true }, program.opts().format || "json");
+  });
+  auth.command("status").description("Show authentication status for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printOutput({ authenticated: false, host: "(none)", hint: "Run: ae-cli config set-host <url>" }, program.opts().format || "json");
+      return;
+    }
+    const secureEntry = load(host);
+    if (secureEntry) {
+      const pastStaticExpiry = new Date(secureEntry.accessExpiresAt).getTime() < Date.now();
+      printOutput(
+        {
+          authenticated: true,
+          host,
+          source: "secure-store",
+          accessExpiresAt: secureEntry.accessExpiresAt,
+          accessExpiresAtNote: "advisory: access token auto-slides on use server-side; re-login only if a command returns an auth error",
+          pastStaticExpiry,
+          hasMcpToken: !!secureEntry.mcpToken
+        },
+        program.opts().format || "json"
+      );
+      return;
+    }
+    const tokenStatus = getAuthStatus(host);
+    const authenticated = tokenStatus.authenticated;
+    printOutput({ authenticated, host, source: tokenStatus.source ?? "none" }, program.opts().format || "json");
+  });
+  auth.command("logout").description("Clear stored token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    clearToken(host);
+    clear(host);
+    process.stderr.write(`[ae-cli] Token cleared for ${host}
+`);
+    printOutput({ cleared: true, host }, program.opts().format || "json");
+  });
+  auth.command("set-mcp-token <token>").description("Manually set MCP token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Host config saved for ${host}
+`);
+    }
+    process.stderr.write(`[ae-cli] Validating MCP token...
+`);
+    const isValid = await validateMcpToken(token, host);
+    if (!isValid) {
+      process.stderr.write(`[ae-cli] MCP token validation failed
+`);
+      printError("auth", "Invalid MCP token", "Please check your MCP token and try again");
+      process.exit(1);
+    }
+    setMcpTokenManual(token, host);
+    process.stderr.write(`[ae-cli] MCP token verified and saved for ${host}
+`);
+    printOutput({ saved: true, host, verified: true, type: "mcp-token" }, program.opts().format || "json");
+  });
+  auth.command("clear-mcp-token").description("Clear stored MCP token for a host (--host or active host; --all clears all)").option("--host <url>", HOST_OPTION_DESC).option("--all", "Clear MCP tokens for all hosts").action((opts) => {
+    if (opts.all) {
+      clearMcpToken();
+      process.stderr.write(`[ae-cli] All MCP tokens cleared
+`);
+      printOutput({ cleared: true, type: "all-mcp-tokens" }, program.opts().format || "json");
+      return;
+    }
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    clearMcpToken(host);
+    process.stderr.write(`[ae-cli] MCP token cleared for ${host}
+`);
+    printOutput({ cleared: true, host }, program.opts().format || "json");
+  });
+}
+export {
+  registerAuth
+};

package/dist/{auth-4OPL4YWG.js → auth-H2376DEF.js}

@@ -7,8 +7,8 @@ import {
   saveToken,
   setTokenManual,
   validateToken
-} from "./chunk-47MTN54I.js";
-import "./chunk-DC66L5AM.js";
+} from "./chunk-CAQYQA4R.js";
+import "./chunk-SRJIAOBN.js";
 export {
   clearToken,
   getAuthStatus,