npm - @thinkingai/ae-cli - Versions diffs - 1.0.27 → 1.0.28 - Mend

@thinkingai/ae-cli 1.0.27 → 1.0.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (88) hide show

package/dist/auth-5NSDQFQB.js ADDED Viewed

@@ -0,0 +1,454 @@
+import {
+  printError,
+  printOutput
+} from "./chunk-CLJF7MQA.js";
+import {
+  clearMcpToken,
+  setMcpTokenManual,
+  validateMcpToken
+} from "./chunk-WCHI7725.js";
+import "./chunk-GSJGPNKK.js";
+import {
+  clear,
+  clearToken,
+  getAuthStatus,
+  load,
+  resolveHost,
+  save,
+  setTokenManual,
+  validateToken
+} from "./chunk-CAQYQA4R.js";
+import {
+  loadConfig,
+  logger,
+  saveConfig
+} from "./chunk-SRJIAOBN.js";
+// src/core/device-auth.ts
+import { execFileSync } from "child_process";
+var DeviceFlowUnsupportedError = class extends Error {
+  constructor() {
+    super("This AE server does not support device code login (it may be an older server version).");
+    this.name = "DeviceFlowUnsupportedError";
+  }
+};
+function looksLikeMissingEndpoint(status, contentType, body) {
+  if (status === 404) return true;
+  if (contentType && contentType.toLowerCase().includes("text/html")) return true;
+  const head = body.trimStart().toLowerCase();
+  return head.startsWith("<!doctype html") || head.startsWith("<html");
+}
+function openBrowser(url, _execFile) {
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    logger.warn(`openBrowser: invalid URL, not opening`);
+    return false;
+  }
+  if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+    logger.warn(`openBrowser: unsafe protocol "${parsedUrl.protocol}", not opening`);
+    return false;
+  }
+  const safeLogUrl = `${parsedUrl.origin}${parsedUrl.pathname}`;
+  const exec = _execFile ?? execFileSync;
+  try {
+    if (process.platform === "darwin") {
+      exec("open", [url], { timeout: 5e3 });
+      return true;
+    }
+    if (process.platform === "win32") {
+      exec("cmd", ["/c", "start", "", url], { timeout: 5e3 });
+      return true;
+    }
+    exec("xdg-open", [url], { timeout: 5e3 });
+    return true;
+  } catch (e) {
+    logger.warn(`openBrowser: failed to open ${safeLogUrl}: ${e.message}`);
+    return false;
+  }
+}
+async function authorizeDevice(host) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/authorize`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" }
+    });
+  } catch (e) {
+    throw new Error(`Device authorize request failed: ${e.message}`);
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    throw new DeviceFlowUnsupportedError();
+  }
+  if (!resp.ok) {
+    throw new Error(`Device authorize returned HTTP ${resp.status}: ${text}`);
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new Error("Device authorize returned invalid JSON");
+  }
+  if (!body.device_code || !body.user_code) {
+    throw new Error("Device authorize response missing required fields");
+  }
+  return body;
+}
+async function pollDeviceToken(host, deviceCode) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/token`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+  } catch (e) {
+    return { status: "error", message: `Network error: ${e.message}` };
+  }
+  if (resp.status === 200) {
+    let body;
+    try {
+      body = await resp.json();
+    } catch {
+      return { status: "error", message: "Token response is not valid JSON" };
+    }
+    if (!body.access_token) {
+      return { status: "error", message: "Token response missing access_token" };
+    }
+    return { status: "approved", tokens: body };
+  }
+  if (resp.status === 400) {
+    let errorBody;
+    try {
+      errorBody = await resp.json();
+    } catch {
+      errorBody = {};
+    }
+    const err = errorBody.error;
+    if (err === "authorization_pending") return { status: "pending" };
+    if (err === "slow_down") return { status: "slow_down" };
+    if (err === "expired_token") return { status: "expired" };
+    return { status: "error", message: `Unknown error: ${err ?? "unknown"}` };
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    return { status: "unsupported" };
+  }
+  return { status: "error", message: `Unexpected HTTP ${resp.status} from token endpoint` };
+}
+function buildVerificationUrl(host, userCode) {
+  return `${host.replace(/\/+$/, "")}/device-activate?user_code=${encodeURIComponent(userCode)}`;
+}
+async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  let intervalMs = options.intervalMs ?? 5e3;
+  const expiresIn = options.expiresIn ?? 300;
+  const deadline = Date.now() + expiresIn * 1e3;
+  let pollCount = 0;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    pollCount++;
+    const result = await pollDeviceToken(host, deviceCode);
+    if (result.status === "approved") {
+      emit(`Authorization successful! (polled ${pollCount} time(s))`);
+      return result.tokens;
+    }
+    if (result.status === "pending") {
+      if (pollCount % 5 === 0) {
+        const remaining = Math.max(0, Math.round((deadline - Date.now()) / 1e3));
+        emit(`Waiting for authorization... (expires in ${remaining}s)`);
+      }
+      logger.info(`device-auth: poll #${pollCount} pending`);
+      continue;
+    }
+    if (result.status === "slow_down") {
+      intervalMs += 5e3;
+      logger.info(`device-auth: slow_down received, new interval=${intervalMs}ms`);
+      continue;
+    }
+    if (result.status === "expired") {
+      throw new Error(
+        `Device code has expired. Please run ae-cli auth login again to restart the authorization flow.`
+      );
+    }
+    if (result.status === "unsupported") {
+      throw new DeviceFlowUnsupportedError();
+    }
+    if (result.status === "error") {
+      logger.warn(`device-auth: poll error: ${result.message}`);
+      emit(`Poll error: ${result.message}`);
+      if (result.message.includes("HTTP 401") || result.message.includes("HTTP 403")) {
+        throw new Error(`Authorization denied (${result.message}). Please check your configuration or run ae-cli auth login again.`);
+      }
+      continue;
+    }
+  }
+  throw new Error(
+    `Authorization timed out (not completed within ${expiresIn}s). Please run ae-cli auth login again.`
+  );
+}
+async function runDeviceFlow(host, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  emit("Requesting authorization code from server...");
+  const auth = await authorizeDevice(host);
+  const userCode = auth.user_code;
+  const verifyUrl = buildVerificationUrl(host, userCode);
+  const expiresIn = auth.expires_in ?? 300;
+  emit("");
+  emit(`Verification code: ${userCode}`);
+  emit(`Open the following link in your browser to complete authorization:`);
+  emit(`  ${verifyUrl}`);
+  emit("");
+  if (!options.noBrowser) {
+    const opened = openBrowser(verifyUrl);
+    if (opened) {
+      emit("(Attempted to open the link in your browser)");
+    } else {
+      emit("(Could not open browser automatically; please copy the link above manually)");
+    }
+    emit("");
+  }
+  return pollDeviceFlow(host, auth.device_code, { intervalMs: (auth.interval ?? 5) * 1e3, expiresIn }, onStatus);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// src/commands/auth.ts
+var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function resolveAuthHost(program, opts) {
+  return resolveHost(opts.host || program.opts().host);
+}
+function persistDeviceTokens(host, tokens) {
+  const DEFAULT_EXPIRES_IN = 72e3;
+  const MAX_EXPIRES_IN = 86400 * 365;
+  let expiresInSeconds = tokens.expires_in ?? DEFAULT_EXPIRES_IN;
+  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0 || expiresInSeconds > MAX_EXPIRES_IN) {
+    logger.warn(`auth login: expires_in=${tokens.expires_in} is out of range, falling back to ${DEFAULT_EXPIRES_IN}s`);
+    expiresInSeconds = DEFAULT_EXPIRES_IN;
+  }
+  const expiresAt = new Date(Date.now() + expiresInSeconds * 1e3).toISOString();
+  save(host, {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token ?? "",
+    accessExpiresAt: expiresAt,
+    mcpToken: tokens.mcp_token ?? void 0
+  });
+}
+function loginSummary(host, tokens) {
+  return {
+    authenticated: true,
+    host,
+    token: tokens.access_token.slice(0, 8) + "...",
+    mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
+  };
+}
+function resolveTeClaudeBase(host) {
+  const override = process.env.TE_CLAUDE_BASE_URL;
+  if (override) return override.replace(/\/+$/, "");
+  const base = host.replace(/\/+$/, "");
+  const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
+  return base.endsWith(basePath) ? base : base + basePath;
+}
+function registerAuth(program) {
+  const auth = program.command("auth").description("Authentication management");
+  auth.command("login").description("Log in to AE using the device code flow (cross-platform; --no-browser to print URL only)").option("--host <url>", HOST_OPTION_DESC).option("--no-browser", "Do not auto-open the browser; only print the authorization URL (headless / Linux)").option("--no-wait", "Request the device code and print the authorization URL as JSON, then exit without polling (for AI agents / split-flow). Resume with --device-code").option("--device-code <code>", "Resume a split-flow login: poll for the given device code until authorized, then save the token").action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      logger.info(`Host config auto-saved for ${host}`);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+    }
+    const noBrowser = !opts.browser;
+    const fmt = program.opts().format || "json";
+    const teClaudeBase = resolveTeClaudeBase(host);
+    const emit = (msg) => process.stderr.write(`[ae-cli] ${msg}
+`);
+    try {
+      if (opts.deviceCode) {
+        const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
+        persistDeviceTokens(host, tokens2);
+        logger.info(`Device flow login successful for ${host} (resumed)`);
+        emit("Login successful! Token saved securely.");
+        printOutput(loginSummary(host, tokens2), fmt);
+        return;
+      }
+      if (opts.wait === false) {
+        const authResp = await authorizeDevice(teClaudeBase);
+        printOutput(
+          {
+            device_code: authResp.device_code,
+            user_code: authResp.user_code,
+            verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
+            interval: authResp.interval,
+            expires_in: authResp.expires_in,
+            next: `Open verification_url in a browser to authorize, then run: ae-cli auth login --device-code ${authResp.device_code}`
+          },
+          fmt
+        );
+        return;
+      }
+      const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
+      persistDeviceTokens(host, tokens);
+      logger.info(`Device flow login successful for ${host}`);
+      emit("Login successful! Token saved securely.");
+      printOutput(loginSummary(host, tokens), fmt);
+    } catch (err) {
+      if (err instanceof DeviceFlowUnsupportedError) {
+        printError(
+          "auth",
+          err.message,
+          "Use `ae-cli auth set-token <token>` to authenticate, or upgrade the AE server to a version that supports device login."
+        );
+        process.exit(1);
+      }
+      printError("auth", err.message);
+      process.exit(1);
+    }
+  });
+  auth.command("set-token <token>").description("Manually set authentication token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+      printOutput({ saved: true, config }, program.opts().format || "json");
+    }
+    process.stderr.write(`[ae-cli] Validating token...
+`);
+    const isValid = await validateToken(token, host);
+    if (!isValid) {
+      logger.warn(`Token validation failed for ${host}`);
+      process.stderr.write(`[ae-cli] Token validation failed
+`);
+      printError("auth", "Invalid token", "Please check your token and try again");
+      process.exit(1);
+    }
+    setTokenManual(token, host);
+    logger.info(`Token manually set and validated for ${host}`);
+    process.stderr.write(`[ae-cli] Token verified and saved for ${host}
+`);
+    printOutput({ saved: true, host, verified: true }, program.opts().format || "json");
+  });
+  auth.command("status").description("Show authentication status for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printOutput({ authenticated: false, host: "(none)", hint: "Run: ae-cli config set-host <url>" }, program.opts().format || "json");
+      return;
+    }
+    const secureEntry = load(host);
+    if (secureEntry) {
+      const pastStaticExpiry = new Date(secureEntry.accessExpiresAt).getTime() < Date.now();
+      printOutput(
+        {
+          authenticated: true,
+          host,
+          source: "secure-store",
+          accessExpiresAt: secureEntry.accessExpiresAt,
+          accessExpiresAtNote: "advisory: access token auto-slides on use server-side; re-login only if a command returns an auth error",
+          pastStaticExpiry,
+          hasMcpToken: !!secureEntry.mcpToken
+        },
+        program.opts().format || "json"
+      );
+      return;
+    }
+    const tokenStatus = getAuthStatus(host);
+    const authenticated = tokenStatus.authenticated;
+    printOutput({ authenticated, host, source: tokenStatus.source ?? "none" }, program.opts().format || "json");
+  });
+  auth.command("logout").description("Clear stored token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    clearToken(host);
+    clear(host);
+    process.stderr.write(`[ae-cli] Token cleared for ${host}
+`);
+    printOutput({ cleared: true, host }, program.opts().format || "json");
+  });
+  auth.command("set-mcp-token <token>").description("Manually set MCP token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Host config saved for ${host}
+`);
+    }
+    process.stderr.write(`[ae-cli] Validating MCP token...
+`);
+    const isValid = await validateMcpToken(token, host);
+    if (!isValid) {
+      process.stderr.write(`[ae-cli] MCP token validation failed
+`);
+      printError("auth", "Invalid MCP token", "Please check your MCP token and try again");
+      process.exit(1);
+    }
+    setMcpTokenManual(token, host);
+    process.stderr.write(`[ae-cli] MCP token verified and saved for ${host}
+`);
+    printOutput({ saved: true, host, verified: true, type: "mcp-token" }, program.opts().format || "json");
+  });
+  auth.command("clear-mcp-token").description("Clear stored MCP token for a host (--host or active host; --all clears all)").option("--host <url>", HOST_OPTION_DESC).option("--all", "Clear MCP tokens for all hosts").action((opts) => {
+    if (opts.all) {
+      clearMcpToken();
+      process.stderr.write(`[ae-cli] All MCP tokens cleared
+`);
+      printOutput({ cleared: true, type: "all-mcp-tokens" }, program.opts().format || "json");
+      return;
+    }
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    clearMcpToken(host);
+    process.stderr.write(`[ae-cli] MCP token cleared for ${host}
+`);
+    printOutput({ cleared: true, host }, program.opts().format || "json");
+  });
+}
+export {
+  registerAuth
+};

package/dist/{auth-TXFJHPXU.js → auth-H2376DEF.js} RENAMED Viewed

@@ -7,9 +7,8 @@ import {
   saveToken,
   setTokenManual,
   validateToken
-} from "./chunk-SRRUNQIM.js";
-import "./chunk-BI5ZVD6T.js";
-import "./chunk-MNHE6SSI.js";
+} from "./chunk-CAQYQA4R.js";
+import "./chunk-SRJIAOBN.js";
 export {
   clearToken,
   getAuthStatus,

package/dist/chunk-AD5V3ZPJ.js ADDED Viewed

@@ -0,0 +1,217 @@
+import {
+  TeAgentCredentialsError,
+  tryLoadTeAgentSandboxCredentials
+} from "./chunk-KAEZTSXN.js";
+import {
+  getActiveHost
+} from "./chunk-SRJIAOBN.js";
+// src/core/te-agent-client.ts
+var TeAgentApiError = class extends Error {
+  constructor(message, status, code, body) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.body = body;
+    this.name = "TeAgentApiError";
+  }
+  status;
+  code;
+  body;
+};
+var DEFAULT_TIMEOUT_MS = 3e4;
+var UPLOAD_TIMEOUT_MS = 12e4;
+async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } catch (err) {
+    if (err?.name === "AbortError") {
+      throw new TeAgentApiError(`Request timed out (${timeoutMs}ms): ${url}`, 0, "TIMEOUT");
+    }
+    throw new TeAgentApiError(`Network request failed: ${err?.message ?? err}`, 0, "NETWORK_ERROR");
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function teClaudeBaseFromActiveHost() {
+  const override = process.env.TE_CLAUDE_BASE_URL;
+  if (override) return override.replace(/\/+$/, "");
+  const h = getActiveHost();
+  if (!h) return void 0;
+  const base = h.replace(/\/+$/, "");
+  const bp = process.env.TE_CLAUDE_BASE_PATH || "/agent";
+  return base.endsWith(bp) ? base : base + bp;
+}
+async function signRequest(method, path, rawBody) {
+  const sandboxCred = tryLoadTeAgentSandboxCredentials();
+  if (sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
+    const headers2 = {
+      "X-Sandbox-Id": sandboxCred.sandboxId,
+      "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
+    };
+    if (method === "POST" || method === "PATCH") {
+      headers2["Content-Type"] = "application/json";
+    }
+    return {
+      url: `${sandboxCred.url.replace(/\/$/, "")}${path}`,
+      headers: headers2,
+      rawBody
+    };
+  }
+  const { getToken } = await import("./auth-H2376DEF.js");
+  const baseUrl = sandboxCred?.url || teClaudeBaseFromActiveHost();
+  if (!baseUrl) {
+    throw new TeAgentCredentialsError(
+      "Cannot determine the te-claude service URL",
+      "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
+    );
+  }
+  const accessToken = await getToken(getActiveHost() || baseUrl);
+  const headers = {
+    "Authorization": `bearer ${accessToken}`
+  };
+  if (method === "POST" || method === "PATCH") {
+    headers["Content-Type"] = "application/json";
+  }
+  return {
+    url: `${baseUrl.replace(/\/$/, "")}${path}`,
+    headers,
+    rawBody
+  };
+}
+async function parseResponse(response, defaultErrorPrefix) {
+  const text = await response.text();
+  let parsed = void 0;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = text;
+    }
+  }
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new TeAgentApiError(
+        `Session expired or unauthorized. Please run: ae-cli auth login`,
+        response.status,
+        "auth_expired",
+        parsed
+      );
+    }
+    const message = typeof parsed === "object" && parsed && typeof parsed.error === "string" ? parsed.error : `${defaultErrorPrefix} ${response.status}`;
+    const code = typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : void 0;
+    throw new TeAgentApiError(message, response.status, code, parsed);
+  }
+  return parsed;
+}
+async function postToMainApp(path, body) {
+  const rawBody = JSON.stringify(body);
+  const signed = await signRequest("POST", path, rawBody);
+  const response = await fetchWithTimeout(signed.url, {
+    method: "POST",
+    headers: signed.headers,
+    body: signed.rawBody
+  });
+  return parseResponse(response, "Main app returned");
+}
+async function getFromMainApp(path) {
+  const signed = await signRequest("GET", path, "");
+  const response = await fetchWithTimeout(signed.url, {
+    method: "GET",
+    headers: signed.headers
+  });
+  return parseResponse(response, "Main app returned");
+}
+async function getSandboxModels(currentModelId) {
+  const qs = currentModelId ? `?current=${encodeURIComponent(currentModelId)}` : "";
+  const data = await getFromMainApp(`/api/sandbox/models${qs}`);
+  return Array.isArray(data?.models) ? data.models : [];
+}
+async function postSandboxModelSelection(args) {
+  return postToMainApp("/api/sandbox/models/select", args);
+}
+async function getSandboxSyncPullCandidates(args) {
+  const qs = new URLSearchParams({
+    workspacePath: args.workspacePath,
+    kind: args.kind
+  });
+  return getFromMainApp(
+    `/api/sandbox/sync/pull/candidates?${qs.toString()}`
+  );
+}
+async function postSandboxSyncPull(args) {
+  return postToMainApp("/api/sandbox/sync/pull", {
+    workspacePath: args.workspacePath,
+    kind: args.kind,
+    skills: args.skills,
+    mcp: args.mcp,
+    mode: "merge",
+    ifUnmodifiedSince: args.ifUnmodifiedSince
+  });
+}
+async function deleteFromMainApp(path) {
+  const signed = await signRequest("DELETE", path, "");
+  const response = await fetchWithTimeout(signed.url, {
+    method: "DELETE",
+    headers: signed.headers
+  });
+  return parseResponse(response, "Main app returned");
+}
+async function patchToMainApp(path, body) {
+  const rawBody = JSON.stringify(body);
+  const signed = await signRequest("PATCH", path, rawBody);
+  const response = await fetchWithTimeout(signed.url, {
+    method: "PATCH",
+    headers: signed.headers,
+    body: signed.rawBody
+  });
+  return parseResponse(response, "Main app returned");
+}
+async function uploadToMainApp(path, formData) {
+  const sandboxCred = tryLoadTeAgentSandboxCredentials();
+  let baseUrl;
+  let authHeaders;
+  if (sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
+    baseUrl = sandboxCred.url.replace(/\/$/, "");
+    authHeaders = {
+      "X-Sandbox-Id": sandboxCred.sandboxId,
+      "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
+    };
+  } else {
+    const { getToken } = await import("./auth-H2376DEF.js");
+    baseUrl = (sandboxCred?.url || teClaudeBaseFromActiveHost() || "").replace(/\/$/, "");
+    if (!baseUrl) {
+      throw new TeAgentCredentialsError(
+        "Cannot determine the te-claude service URL",
+        "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
+      );
+    }
+    const accessToken = await getToken(getActiveHost() || baseUrl);
+    authHeaders = { "Authorization": `bearer ${accessToken}` };
+  }
+  const response = await fetchWithTimeout(
+    `${baseUrl}${path}`,
+    {
+      method: "POST",
+      headers: authHeaders,
+      body: formData
+    },
+    UPLOAD_TIMEOUT_MS
+  );
+  return parseResponse(response, "Upload failed");
+}
+export {
+  TeAgentApiError,
+  postToMainApp,
+  getFromMainApp,
+  getSandboxModels,
+  postSandboxModelSelection,
+  getSandboxSyncPullCandidates,
+  postSandboxSyncPull,
+  deleteFromMainApp,
+  patchToMainApp,
+  uploadToMainApp
+};