@thinkingai/ae-cli 1.0.27 → 1.0.28

package/dist/chunk-CAQYQA4R.js

@@ -0,0 +1,399 @@
+import {
+  getActiveHost,
+  getConfigDir,
+  logger,
+  safeJsonParse,
+  safeReadJsonFile
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/auth.ts
+import fs2 from "fs";
+import path2 from "path";
+
+// src/core/secure-store.ts
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execFileSync } from "child_process";
+var STORE_DIR_SUFFIX = "secure-tokens";
+var SCRYPT_SALT = Buffer.from("ae-cli-secure-store-v1");
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var KEY_LEN = 32;
+var NONCE_LEN = 12;
+var REFRESH_TOKEN_PATH = "/v1/oauth/refreshForToken";
+function getMachineId() {
+  if (process.platform === "darwin") {
+    try {
+      const out = execFileSync(
+        "ioreg",
+        ["-rd1", "-c", "IOPlatformExpertDevice"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const m = out.match(/IOPlatformUUID.*?=.*?"([0-9A-F-]{36})"/i);
+      if (m?.[1]) return `darwin:${m[1]}`;
+    } catch {
+    }
+  }
+  if (process.platform === "linux") {
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      try {
+        const id = fs.readFileSync(p, "utf8").trim();
+        if (id) return `linux:${id}`;
+      } catch {
+      }
+    }
+  }
+  if (process.platform === "win32") {
+    try {
+      const out = execFileSync(
+        "reg",
+        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
+      if (m?.[1]) return `win32:${m[1]}`;
+    } catch {
+    }
+  }
+  const fallback = `${os.homedir()}|${os.hostname()}|${os.platform()}`;
+  logger.warn("secure-store: using fallback machine-id (HOME+hostname+platform)");
+  return `fallback:${fallback}`;
+}
+var _cachedMachineId;
+function getCachedMachineId() {
+  if (!_cachedMachineId) _cachedMachineId = getMachineId();
+  return _cachedMachineId;
+}
+function deriveKey(machineId) {
+  return crypto.scryptSync(machineId, SCRYPT_SALT, KEY_LEN, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P
+  });
+}
+var _cachedKey;
+function getKey() {
+  if (!_cachedKey) _cachedKey = deriveKey(getCachedMachineId());
+  return _cachedKey;
+}
+function encrypt(plaintext) {
+  const key = getKey();
+  const nonce = crypto.randomBytes(NONCE_LEN);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    nonce: nonce.toString("hex"),
+    tag: tag.toString("hex"),
+    data: encrypted.toString("hex")
+  };
+}
+function decrypt(blob) {
+  const key = getKey();
+  const nonce = Buffer.from(blob.nonce, "hex");
+  const tag = Buffer.from(blob.tag, "hex");
+  const data = Buffer.from(blob.data, "hex");
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
+  return decrypted.toString("utf8");
+}
+function storeDir() {
+  return path.join(getConfigDir(), STORE_DIR_SUFFIX);
+}
+function tokenFilePath(host) {
+  const safe = host.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "_");
+  return path.join(storeDir(), `${safe}.enc.json`);
+}
+function ensureStoreDir() {
+  const dir = storeDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+    try {
+      fs.chmodSync(dir, 448);
+    } catch {
+    }
+  }
+}
+function save(host, payload) {
+  ensureStoreDir();
+  const plaintext = JSON.stringify(payload);
+  const blob = encrypt(plaintext);
+  const filePath = tokenFilePath(host);
+  fs.writeFileSync(filePath, JSON.stringify(blob, null, 2), { encoding: "utf8" });
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+  logger.info(`secure-store: token saved for ${host}`);
+}
+function load(host) {
+  const filePath = tokenFilePath(host);
+  if (!fs.existsSync(filePath)) return null;
+  try {
+    const raw = fs.readFileSync(filePath, "utf8");
+    const blob = safeJsonParse(raw);
+    if (!blob?.nonce || !blob?.tag || !blob?.data) {
+      logger.warn(`secure-store: malformed blob for ${host}`);
+      return null;
+    }
+    const plaintext = decrypt(blob);
+    return JSON.parse(plaintext);
+  } catch (e) {
+    logger.error(`secure-store: decrypt failed for ${host}: ${e.message}`);
+    return null;
+  }
+}
+function clear(host) {
+  const filePath = tokenFilePath(host);
+  if (fs.existsSync(filePath)) {
+    fs.rmSync(filePath);
+    logger.info(`secure-store: token cleared for ${host}`);
+  }
+}
+async function getValidAccessToken(host) {
+  const payload = load(host);
+  if (!payload) {
+    throw new SecureStoreAuthError(
+      `No stored token for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  const expiresAt = new Date(payload.accessExpiresAt).getTime();
+  const now = Date.now();
+  const needsRefresh = expiresAt - now < 6e4;
+  if (!needsRefresh) {
+    return payload.accessToken;
+  }
+  if (payload.refreshToken) {
+    logger.info(`secure-store: access token past local expiry for ${host}, refreshing\u2026`);
+    const refreshed = await doRefresh(host, payload.refreshToken);
+    save(host, { ...refreshed, mcpToken: payload.mcpToken });
+    logger.info(`secure-store: token refreshed for ${host}`);
+    return refreshed.accessToken;
+  }
+  logger.info(`secure-store: ${host} past static local expiry, no refresh token \u2014 returning stored token, server validates (lazy)`);
+  return payload.accessToken;
+}
+function loadMcpToken(host) {
+  return load(host)?.mcpToken ?? null;
+}
+async function doRefresh(host, refreshToken) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}${REFRESH_TOKEN_PATH}`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken })
+    });
+  } catch (e) {
+    throw new SecureStoreAuthError(
+      `Token refresh network error for ${host}: ${e.message}. Please run: ae-cli auth login`
+    );
+  }
+  if (!resp.ok) {
+    throw new SecureStoreAuthError(
+      `Token refresh failed (HTTP ${resp.status}) for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  let body;
+  try {
+    body = safeJsonParse(await resp.text());
+  } catch {
+    throw new SecureStoreAuthError(
+      `Token refresh returned invalid JSON for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  if (body.return_code !== 0) {
+    throw new SecureStoreAuthError(
+      `Token refresh error (${body.return_code}: ${body.return_message ?? "unknown"}) for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  const d = body.data;
+  const newAccess = d?.accessToken ?? d?.access_token ?? "";
+  const newRefresh = d?.refreshToken ?? d?.refresh_token ?? refreshToken;
+  const expiresIn = d?.expiresIn ?? d?.expires_in ?? 72e3;
+  if (!newAccess) {
+    throw new SecureStoreAuthError(
+      `Token refresh returned empty accessToken for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  return {
+    accessToken: newAccess,
+    refreshToken: newRefresh,
+    accessExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+  };
+}
+var SecureStoreAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecureStoreAuthError";
+  }
+};
+
+// src/core/auth.ts
+var TOKENS_FILE = path2.join(getConfigDir(), "tokens.json");
+var LEGACY_MCP_TOKENS_FILE = path2.join(getConfigDir(), "mcp-tokens.json");
+var LEGACY_DIR = path2.join(process.env.HOME || "", ".te-mcp");
+(function removeLegacyMcpTokens() {
+  try {
+    if (fs2.existsSync(LEGACY_MCP_TOKENS_FILE)) {
+      fs2.rmSync(LEGACY_MCP_TOKENS_FILE);
+      logger.info("auth: removed legacy mcp-tokens.json (plaintext MCP token file)");
+    }
+  } catch {
+  }
+})();
+function ensureDir() {
+  const dir = getConfigDir();
+  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
+}
+function resolveHost(hostOverride) {
+  if (hostOverride) return hostOverride;
+  return getActiveHost();
+}
+async function validateToken(token, hostUrl) {
+  const url = `${hostUrl}/v1/oauth/checkToken`;
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ accessToken: token }).toString()
+    });
+    const respJson = safeJsonParse(await resp.text());
+    return respJson?.return_code === 0;
+  } catch {
+    return false;
+  }
+}
+function loadAllTokens() {
+  try {
+    const legacyTokens = path2.join(LEGACY_DIR, "tokens.json");
+    if (fs2.existsSync(legacyTokens) && !fs2.existsSync(TOKENS_FILE)) {
+      const data = safeReadJsonFile(legacyTokens);
+      const migrated = {};
+      for (const [key, val] of Object.entries(data)) {
+        const url = key.startsWith("http") ? key : `https://${key}`;
+        migrated[url] = val;
+      }
+      ensureDir();
+      fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
+      return migrated;
+    }
+    if (fs2.existsSync(TOKENS_FILE)) {
+      const data = safeReadJsonFile(TOKENS_FILE);
+      let needsMigration = false;
+      const migrated = {};
+      for (const [key, val] of Object.entries(data)) {
+        if (!key.startsWith("http")) {
+          migrated[`https://${key}`] = val;
+          needsMigration = true;
+        } else {
+          migrated[key] = val;
+        }
+      }
+      if (needsMigration) {
+        fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
+        return migrated;
+      }
+      return data;
+    }
+  } catch {
+  }
+  return {};
+}
+function saveAllTokens(tokens) {
+  ensureDir();
+  fs2.writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2));
+  try {
+    fs2.chmodSync(TOKENS_FILE, 384);
+  } catch {
+  }
+}
+function loadToken(hostUrl) {
+  const tokens = loadAllTokens();
+  const entry = tokens[hostUrl];
+  if (!entry || !entry.token) return null;
+  return { host: hostUrl, token: entry.token, updatedAt: entry.updatedAt };
+}
+function saveToken(token, hostUrl) {
+  const tokens = loadAllTokens();
+  tokens[hostUrl] = { token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  saveAllTokens(tokens);
+  logger.info(`Token saved for ${hostUrl}`);
+}
+function clearToken(hostUrl) {
+  const tokens = loadAllTokens();
+  delete tokens[hostUrl];
+  saveAllTokens(tokens);
+}
+function setTokenManual(token, hostUrl) {
+  saveToken(token, hostUrl);
+}
+function getAuthStatus(hostUrl) {
+  if (process.env.TE_TOKEN) {
+    return { authenticated: true, host: hostUrl, source: "env:TE_TOKEN" };
+  }
+  const cached = loadToken(hostUrl);
+  if (cached) {
+    const ageMs = Date.now() - new Date(cached.updatedAt).getTime();
+    const hours = Math.round(ageMs / 36e5);
+    return { authenticated: true, host: hostUrl, tokenAge: `${hours}h ago`, source: "cache" };
+  }
+  return { authenticated: false, host: hostUrl };
+}
+async function getToken(hostUrl) {
+  if (!hostUrl) {
+    throw new Error(
+      `No AE host configured.
+Run: ae-cli config set-host <url>`
+    );
+  }
+  if (process.env.TE_TOKEN) {
+    logger.info("Using token from env:TE_TOKEN");
+    return process.env.TE_TOKEN;
+  }
+  const cached = loadToken(hostUrl);
+  if (cached && cached.token) {
+    logger.info(`Using cached token for ${hostUrl}`);
+    return cached.token;
+  }
+  try {
+    const secureToken = await getValidAccessToken(hostUrl);
+    logger.info(`Using secure-store token for ${hostUrl}`);
+    return secureToken;
+  } catch (e) {
+    if (e instanceof SecureStoreAuthError) {
+      logger.info(`secure-store: ${e.message}`);
+    } else {
+      logger.warn(`secure-store unexpected error: ${e.message}`);
+    }
+  }
+  throw new Error(
+    `Cannot obtain token for ${hostUrl}.
+Options:
+  1. ae-cli auth login   (device code flow, cross-platform)
+  2. ae-cli auth set-token <token>
+  3. export TE_TOKEN=<token>  (CI/headless)`
+  );
+}
+
+export {
+  save,
+  load,
+  clear,
+  loadMcpToken,
+  SecureStoreAuthError,
+  resolveHost,
+  validateToken,
+  loadToken,
+  saveToken,
+  clearToken,
+  setTokenManual,
+  getAuthStatus,
+  getToken
+};

package/dist/{chunk-B4UL2VIJ.js → chunk-CLJF7MQA.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-MNHE6SSI.js";
+} from "./chunk-SRJIAOBN.js";
 
 // src/framework/output.ts
 import Table from "cli-table3";

package/dist/chunk-GSJGPNKK.js

@@ -0,0 +1,49 @@
+import {
+  getSandboxClusterInfoFilePath,
+  logger,
+  safeReadJsonFile
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/cluster-info.ts
+import fs from "fs";
+import path from "path";
+var GLOBAL_QUERY_CONFIG_KEY = "sw_cfg_enable_global_query";
+var CLUSTER_INFO_FILE_ENV = "AE_CLUSTER_INFO_FILE";
+function getClusterInfoFilePath() {
+  return process.env[CLUSTER_INFO_FILE_ENV] || getSandboxClusterInfoFilePath();
+}
+function loadClusterInfo() {
+  const file = getClusterInfoFilePath();
+  try {
+    if (!fs.existsSync(file)) {
+      return {};
+    }
+    const raw = safeReadJsonFile(file);
+    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  } catch (err) {
+    logger.warn(`Failed to load cluster info from ${file}: ${err.message}`);
+    return {};
+  }
+}
+function isGlobalQueryModeEnabled() {
+  return loadClusterInfo()[GLOBAL_QUERY_CONFIG_KEY] === true;
+}
+function setGlobalQueryModeEnabled(enabled) {
+  const file = getClusterInfoFilePath();
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const next = { [GLOBAL_QUERY_CONFIG_KEY]: enabled };
+  fs.writeFileSync(file, JSON.stringify(next, null, 2));
+  return next;
+}
+function getAnalysisMappingPathForClusterMode(enabled = isGlobalQueryModeEnabled()) {
+  return enabled ? "analysis-global" : "analysis";
+}
+
+export {
+  GLOBAL_QUERY_CONFIG_KEY,
+  getClusterInfoFilePath,
+  isGlobalQueryModeEnabled,
+  setGlobalQueryModeEnabled,
+  getAnalysisMappingPathForClusterMode
+};

package/dist/{chunk-6T7245YE.js → chunk-IMBKVXKY.js}

@@ -1,7 +1,7 @@
 // src/core/multiselect.ts
 var MultiselectCancelled = class extends Error {
   constructor() {
-    super("\u7528\u6237\u53D6\u6D88\u9009\u62E9");
+    super("Selection cancelled by user");
     this.name = "MultiselectCancelled";
   }
 };
@@ -27,7 +27,7 @@ function promptMultiselect(opts) {
   const stdin = process.stdin;
   if (!stdin.isTTY) {
     return Promise.reject(
-      new Error("ae-cli sync \u9700\u8981 TTY \u624D\u80FD\u8FDB\u884C\u591A\u9009\uFF1B\u8BF7\u5728\u4EA4\u4E92\u5F0F\u7EC8\u7AEF\u4E2D\u8FD0\u884C")
+      new Error("ae-cli sync requires a TTY for multi-select; please run in an interactive terminal")
     );
   }
   const rows = buildRows(items);
@@ -48,7 +48,7 @@ function promptMultiselect(opts) {
     if (renderCount > 0) {
       stderr.write(`\x1B[${totalLines()}A`);
     }
-    stderr.write(`${title}  (space \u9009\u62E9 \xB7 a \u5168\u9009/\u5168\u4E0D\u9009 \xB7 enter \u786E\u8BA4 \xB7 q \u53D6\u6D88)\x1B[K
+    stderr.write(`${title}  (space: select \xB7 a: select all/none \xB7 enter: confirm \xB7 q: cancel)\x1B[K
 `);
     stderr.write(`\x1B[K
 `);
@@ -128,10 +128,10 @@ function promptMultiselect(opts) {
 }
 function promptSingleCheckboxSelect(opts) {
   const { title, items } = opts;
-  if (items.length === 0) return Promise.reject(new Error("\u65E0\u53EF\u9009\u9879"));
+  if (items.length === 0) return Promise.reject(new Error("No items to select"));
   const stderr = process.stderr;
   const stdin = process.stdin;
-  if (!stdin.isTTY) return Promise.reject(new Error("\u9700\u8981 TTY \u624D\u80FD\u8FDB\u884C\u5355\u9009"));
+  if (!stdin.isTTY) return Promise.reject(new Error("A TTY is required for single-select"));
   const preselectedIndex = items.findIndex((item) => item.preselected);
   let cursor = preselectedIndex >= 0 ? preselectedIndex : 0;
   let selected = preselectedIndex >= 0 ? preselectedIndex : null;
@@ -139,7 +139,7 @@ function promptSingleCheckboxSelect(opts) {
   const lines = items.length + 2;
   function render() {
     if (renderCount > 0) stderr.write(`\x1B[${lines}A`);
-    stderr.write(`${title}  (space \u9009\u62E9 \xB7 enter \u786E\u8BA4 \xB7 q \u53D6\u6D88)\x1B[K
+    stderr.write(`${title}  (space: select \xB7 enter: confirm \xB7 q: cancel)\x1B[K
 `);
     stderr.write(`\x1B[K
 `);
@@ -193,10 +193,10 @@ function promptSingleCheckboxSelect(opts) {
 }
 function promptSingleSelect(opts) {
   const { title, items } = opts;
-  if (items.length === 0) return Promise.reject(new Error("\u65E0\u53EF\u9009\u9879"));
+  if (items.length === 0) return Promise.reject(new Error("No items to select"));
   const stderr = process.stderr;
   const stdin = process.stdin;
-  if (!stdin.isTTY) return Promise.reject(new Error("\u9700\u8981 TTY \u624D\u80FD\u8FDB\u884C\u5355\u9009"));
+  if (!stdin.isTTY) return Promise.reject(new Error("A TTY is required for single-select"));
   let cursor = 0;
   let renderCount = 0;
   const lines = items.length + 1;

package/dist/chunk-KAEZTSXN.js

@@ -0,0 +1,99 @@
+import {
+  getSandboxRuntimeRoot
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/te-agent-credentials.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function getCredentialsPath() {
+  return join(process.env.HOME || homedir(), ".te-agent", "credentials.json");
+}
+function getPersistentEnvPath() {
+  return join(getSandboxRuntimeRoot(), ".env");
+}
+function parseDotEnv(raw) {
+  const result = {};
+  for (const line of raw.split("\n")) {
+    if (/^\s*#/.test(line) || line.trim() === "") continue;
+    const match = /^\s*([^=]+)=(.*)$/.exec(line);
+    if (!match) continue;
+    const key = match[1].trim();
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1).replace(/\\"/g, '"');
+    }
+    if (value !== "") result[key] = value;
+  }
+  return result;
+}
+function readPersistentEnv() {
+  const envPath = getPersistentEnvPath();
+  try {
+    const raw = readFileSync(envPath, "utf8");
+    return parseDotEnv(raw);
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    throw new TeAgentCredentialsError(
+      `Failed to read ${envPath}: ${err?.message ?? err}`,
+      "Check file permissions, or inject runtime credentials via TE_CLAUDE_BASE_URL / SANDBOX_ID / SECRET_KEY"
+    );
+  }
+}
+var TeAgentCredentialsError = class extends Error {
+  constructor(message, hint) {
+    super(message);
+    this.hint = hint;
+    this.name = "TeAgentCredentialsError";
+  }
+  hint;
+};
+function readLegacyCredentials() {
+  const credPath = getCredentialsPath();
+  try {
+    const raw = readFileSync(credPath, "utf8");
+    const parsed = JSON.parse(raw);
+    const main = parsed?.mainApp;
+    return main && typeof main === "object" ? main : null;
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    if (err instanceof SyntaxError) {
+      throw new TeAgentCredentialsError(
+        `Failed to parse ${credPath}: ${err.message}`,
+        "The credentials file may be corrupted; alternatively inject runtime credentials via TE_CLAUDE_BASE_URL / SANDBOX_ID / SECRET_KEY"
+      );
+    }
+    throw new TeAgentCredentialsError(
+      `Failed to read ${credPath}: ${err?.message ?? err}`,
+      "Check file permissions, or inject runtime credentials via TE_CLAUDE_BASE_URL / SANDBOX_ID / SECRET_KEY"
+    );
+  }
+}
+function tryLoadTeAgentSandboxCredentials() {
+  const legacy = readLegacyCredentials();
+  const persistent = readPersistentEnv();
+  const url = process.env.TE_CLAUDE_BASE_URL || persistent?.TE_CLAUDE_BASE_URL || legacy?.url;
+  if (typeof url !== "string" || !url) {
+    return null;
+  }
+  const sandboxId = process.env.SANDBOX_ID || persistent?.SANDBOX_ID || legacy?.sandboxId || null;
+  const sandboxSecretKey = process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY || persistent?.SECRET_KEY || persistent?.SANDBOX_SECRET_KEY || legacy?.sandboxSecretKey || legacy?.secretKey || null;
+  return {
+    url,
+    sandboxId: typeof sandboxId === "string" ? sandboxId : null,
+    sandboxSecretKey: typeof sandboxSecretKey === "string" ? sandboxSecretKey : null
+  };
+}
+function getClaudeConfigDir() {
+  const fromEnv = process.env.CLAUDE_CONFIG_DIR;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) {
+    return fromEnv;
+  }
+  return join(homedir(), ".claude");
+}
+
+export {
+  TeAgentCredentialsError,
+  tryLoadTeAgentSandboxCredentials,
+  getClaudeConfigDir
+};

package/dist/{chunk-VT6VC4PA.js → chunk-LU7SXK4Q.js}

@@ -1,14 +1,13 @@
 import {
+  SecureStoreAuthError,
   clearToken,
   getToken,
   resolveHost
-} from "./chunk-SRRUNQIM.js";
+} from "./chunk-CAQYQA4R.js";
 import {
+  logger,
   safeJsonParse
-} from "./chunk-BI5ZVD6T.js";
-import {
-  logger
-} from "./chunk-MNHE6SSI.js";
+} from "./chunk-SRJIAOBN.js";
 
 // src/core/client.ts
 import WebSocket from "ws";
@@ -45,9 +44,16 @@ async function request(method, modulePath, params = {}, body = null, retry = tru
   const text = await resp.text();
   const data = safeJsonParse(text);
   logger.api(method, url, resp.status, body, data);
-  if ((resp.status === 401 || resp.status === 403) && retry) {
-    clearToken(resolvedHost);
-    return request(method, modulePath, params, body, false, resolvedHost);
+  if (resp.status === 401) {
+    if (retry) {
+      clearToken(resolvedHost);
+      return request(method, modulePath, params, body, false, resolvedHost);
+    }
+    throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
+  }
+  if (resp.status === 403) {
+    const m = data && typeof data === "object" && typeof data.error === "string" ? data.error : "Permission denied";
+    throw new Error(m);
   }
   if (data.return_code === -1001 && retry) {
     clearToken(resolvedHost);
@@ -81,9 +87,16 @@ async function uploadRequest(modulePath, form, params = {}, retry = true, hostUr
   const text = await resp.text();
   const data = safeJsonParse(text);
   logger.api("POST", url, resp.status, { upload: true }, data);
-  if ((resp.status === 401 || resp.status === 403) && retry) {
-    clearToken(resolvedHost);
-    return uploadRequest(modulePath, form, params, false, resolvedHost);
+  if (resp.status === 401) {
+    if (retry) {
+      clearToken(resolvedHost);
+      return uploadRequest(modulePath, form, params, false, resolvedHost);
+    }
+    throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
+  }
+  if (resp.status === 403) {
+    const m = data && typeof data === "object" && typeof data.error === "string" ? data.error : "Permission denied";
+    throw new Error(m);
   }
   if (data.return_code === -1001 && retry) {
     clearToken(resolvedHost);