npm - @thinkingai/ae-cli - Versions diffs - 1.0.27 → 1.0.30 - Mend

@thinkingai/ae-cli 1.0.27 → 1.0.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (90) hide show

package/README.md CHANGED Viewed

@@ -31,24 +31,9 @@ npx skills add ThinkingAIAgenticEngine/ae-cli -g -y
 ## Quick Start
 ```bash
-# First run — interactive host setup + auto-login
-ae-cli config
+ae-cli auth login --host xxxxx
 ```
-The `config` command opens an interactive terminal UI:
-- First run: prompts you to add a AE host URL and label, then auto-authenticates
-- Subsequent runs: shows all configured hosts, lets you switch, edit, delete, or add new ones
-```
-AE Host Manager  (↑↓ select · Enter switch · e edit label · d delete · a add · q quit)
-❯ ● Production  https://ta.thinkingdata.cn  ✓
-  ○ Staging     https://ta-staging.example.com:8080  ✗
-  + Add new host...
-```
-After selecting a host, ae-cli automatically checks if the token is valid. If not, it triggers `auth login` for you.
 ## Usage
 ```bash

package/README.zh.md CHANGED Viewed

@@ -31,24 +31,9 @@ npx skills add ThinkingAIAgenticEngine/ae-cli -g -y
 ## 快速开始
 ```bash
-# 首次运行 — 交互式主机配置 + 自动登录
-ae-cli config
+ae-cli auth login --host xxxxx
 ```
-`config` 命令会打开一个交互式终端界面：
-- 首次运行：提示您添加 AE 主机 URL 和标签，然后自动进行身份验证
-- 后续运行：显示所有已配置的主机，可以切换、编辑、删除或添加新主机
-```
-AE Host Manager  (↑↓ 选择 · Enter 切换 · e 编辑标签 · d 删除 · a 添加 · q 退出)
-❯ ● Production  https://ta.thinkingdata.cn  ✓
-  ○ Staging     https://ta-staging.example.com:8080  ✗
-  + Add new host...
-```
-选择主机后，ae-cli 会自动检查 token 是否有效。如果无效，会自动触发 `auth login`。
 ## 使用方法
 ```bash

package/dist/auth-H3GJD55A.js ADDED Viewed

@@ -0,0 +1,457 @@
+import {
+  printError,
+  printOutput
+} from "./chunk-CLJF7MQA.js";
+import {
+  clearMcpToken,
+  setMcpTokenManual,
+  validateMcpToken
+} from "./chunk-GLNZSDKO.js";
+import "./chunk-GSJGPNKK.js";
+import "./chunk-NOO24N7W.js";
+import {
+  clearToken,
+  getAuthStatus,
+  resolveHost,
+  setTokenManual,
+  validateToken
+} from "./chunk-U6TKB3IV.js";
+import {
+  clear,
+  load,
+  save
+} from "./chunk-JM34JPCO.js";
+import {
+  loadConfig,
+  logger,
+  saveConfig
+} from "./chunk-SRJIAOBN.js";
+// src/core/device-auth.ts
+import { execFileSync } from "child_process";
+var DeviceFlowUnsupportedError = class extends Error {
+  constructor() {
+    super("This AE server does not support device code login (it may be an older server version).");
+    this.name = "DeviceFlowUnsupportedError";
+  }
+};
+function looksLikeMissingEndpoint(status, contentType, body) {
+  if (status === 404) return true;
+  if (contentType && contentType.toLowerCase().includes("text/html")) return true;
+  const head = body.trimStart().toLowerCase();
+  return head.startsWith("<!doctype html") || head.startsWith("<html");
+}
+function openBrowser(url, _execFile) {
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    logger.warn(`openBrowser: invalid URL, not opening`);
+    return false;
+  }
+  if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+    logger.warn(`openBrowser: unsafe protocol "${parsedUrl.protocol}", not opening`);
+    return false;
+  }
+  const safeLogUrl = `${parsedUrl.origin}${parsedUrl.pathname}`;
+  const exec = _execFile ?? execFileSync;
+  try {
+    if (process.platform === "darwin") {
+      exec("open", [url], { timeout: 5e3 });
+      return true;
+    }
+    if (process.platform === "win32") {
+      exec("cmd", ["/c", "start", "", url], { timeout: 5e3 });
+      return true;
+    }
+    exec("xdg-open", [url], { timeout: 5e3 });
+    return true;
+  } catch (e) {
+    logger.warn(`openBrowser: failed to open ${safeLogUrl}: ${e.message}`);
+    return false;
+  }
+}
+async function authorizeDevice(host) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/authorize`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" }
+    });
+  } catch (e) {
+    throw new Error(`Device authorize request failed: ${e.message}`);
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    throw new DeviceFlowUnsupportedError();
+  }
+  if (!resp.ok) {
+    throw new Error(`Device authorize returned HTTP ${resp.status}: ${text}`);
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new Error("Device authorize returned invalid JSON");
+  }
+  if (!body.device_code || !body.user_code) {
+    throw new Error("Device authorize response missing required fields");
+  }
+  return body;
+}
+async function pollDeviceToken(host, deviceCode) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/token`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+  } catch (e) {
+    return { status: "error", message: `Network error: ${e.message}` };
+  }
+  if (resp.status === 200) {
+    let body;
+    try {
+      body = await resp.json();
+    } catch {
+      return { status: "error", message: "Token response is not valid JSON" };
+    }
+    if (!body.access_token) {
+      return { status: "error", message: "Token response missing access_token" };
+    }
+    return { status: "approved", tokens: body };
+  }
+  if (resp.status === 400) {
+    let errorBody;
+    try {
+      errorBody = await resp.json();
+    } catch {
+      errorBody = {};
+    }
+    const err = errorBody.error;
+    if (err === "authorization_pending") return { status: "pending" };
+    if (err === "slow_down") return { status: "slow_down" };
+    if (err === "expired_token") return { status: "expired" };
+    return { status: "error", message: `Unknown error: ${err ?? "unknown"}` };
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    return { status: "unsupported" };
+  }
+  return { status: "error", message: `Unexpected HTTP ${resp.status} from token endpoint` };
+}
+function buildVerificationUrl(host, userCode) {
+  return `${host.replace(/\/+$/, "")}/device-activate?user_code=${encodeURIComponent(userCode)}`;
+}
+async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  let intervalMs = options.intervalMs ?? 5e3;
+  const expiresIn = options.expiresIn ?? 300;
+  const deadline = Date.now() + expiresIn * 1e3;
+  let pollCount = 0;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    pollCount++;
+    const result = await pollDeviceToken(host, deviceCode);
+    if (result.status === "approved") {
+      emit(`Authorization successful! (polled ${pollCount} time(s))`);
+      return result.tokens;
+    }
+    if (result.status === "pending") {
+      if (pollCount % 5 === 0) {
+        const remaining = Math.max(0, Math.round((deadline - Date.now()) / 1e3));
+        emit(`Waiting for authorization... (expires in ${remaining}s)`);
+      }
+      logger.info(`device-auth: poll #${pollCount} pending`);
+      continue;
+    }
+    if (result.status === "slow_down") {
+      intervalMs += 5e3;
+      logger.info(`device-auth: slow_down received, new interval=${intervalMs}ms`);
+      continue;
+    }
+    if (result.status === "expired") {
+      throw new Error(
+        `Device code has expired. Please run ae-cli auth login again to restart the authorization flow.`
+      );
+    }
+    if (result.status === "unsupported") {
+      throw new DeviceFlowUnsupportedError();
+    }
+    if (result.status === "error") {
+      logger.warn(`device-auth: poll error: ${result.message}`);
+      emit(`Poll error: ${result.message}`);
+      if (result.message.includes("HTTP 401") || result.message.includes("HTTP 403")) {
+        throw new Error(`Authorization denied (${result.message}). Please check your configuration or run ae-cli auth login again.`);
+      }
+      continue;
+    }
+  }
+  throw new Error(
+    `Authorization timed out (not completed within ${expiresIn}s). Please run ae-cli auth login again.`
+  );
+}
+async function runDeviceFlow(host, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  emit("Requesting authorization code from server...");
+  const auth = await authorizeDevice(host);
+  const userCode = auth.user_code;
+  const verifyUrl = buildVerificationUrl(host, userCode);
+  const expiresIn = auth.expires_in ?? 300;
+  emit("");
+  emit(`Verification code: ${userCode}`);
+  emit(`Open the following link in your browser to complete authorization:`);
+  emit(`  ${verifyUrl}`);
+  emit("");
+  if (!options.noBrowser) {
+    const opened = openBrowser(verifyUrl);
+    if (opened) {
+      emit("(Attempted to open the link in your browser)");
+    } else {
+      emit("(Could not open browser automatically; please copy the link above manually)");
+    }
+    emit("");
+  }
+  return pollDeviceFlow(host, auth.device_code, { intervalMs: (auth.interval ?? 5) * 1e3, expiresIn }, onStatus);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// src/commands/auth.ts
+var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function resolveAuthHost(program, opts) {
+  return resolveHost(opts.host || program.opts().host);
+}
+function persistDeviceTokens(host, tokens) {
+  const DEFAULT_EXPIRES_IN = 72e3;
+  const MAX_EXPIRES_IN = 86400 * 365;
+  let expiresInSeconds = tokens.expires_in ?? DEFAULT_EXPIRES_IN;
+  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0 || expiresInSeconds > MAX_EXPIRES_IN) {
+    logger.warn(`auth login: expires_in=${tokens.expires_in} is out of range, falling back to ${DEFAULT_EXPIRES_IN}s`);
+    expiresInSeconds = DEFAULT_EXPIRES_IN;
+  }
+  const expiresAt = new Date(Date.now() + expiresInSeconds * 1e3).toISOString();
+  save(host, {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token ?? "",
+    accessExpiresAt: expiresAt,
+    mcpToken: tokens.mcp_token ?? void 0
+  });
+}
+function loginSummary(host, tokens) {
+  return {
+    authenticated: true,
+    host,
+    token: tokens.access_token.slice(0, 8) + "...",
+    mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
+  };
+}
+function resolveTeClaudeBase(host) {
+  const override = process.env.TE_CLAUDE_BASE_URL;
+  if (override) return override.replace(/\/+$/, "");
+  const base = host.replace(/\/+$/, "");
+  const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
+  return base.endsWith(basePath) ? base : base + basePath;
+}
+function registerAuth(program) {
+  const auth = program.command("auth").description("Authentication management");
+  auth.command("login").description("Log in to AE using the device code flow (cross-platform; --no-browser to print URL only)").option("--host <url>", HOST_OPTION_DESC).option("--no-browser", "Do not auto-open the browser; only print the authorization URL (headless / Linux)").option("--no-wait", "Request the device code and print the authorization URL as JSON, then exit without polling (for AI agents / split-flow). Resume with --device-code").option("--device-code <code>", "Resume a split-flow login: poll for the given device code until authorized, then save the token").action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      logger.info(`Host config auto-saved for ${host}`);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+    }
+    const noBrowser = !opts.browser;
+    const fmt = program.opts().format || "json";
+    const teClaudeBase = resolveTeClaudeBase(host);
+    const emit = (msg) => process.stderr.write(`[ae-cli] ${msg}
+`);
+    try {
+      if (opts.deviceCode) {
+        const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
+        persistDeviceTokens(host, tokens2);
+        logger.info(`Device flow login successful for ${host} (resumed)`);
+        emit("Login successful! Token saved securely.");
+        printOutput(loginSummary(host, tokens2), fmt);
+        return;
+      }
+      if (opts.wait === false) {
+        const authResp = await authorizeDevice(teClaudeBase);
+        printOutput(
+          {
+            device_code: authResp.device_code,
+            user_code: authResp.user_code,
+            verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
+            interval: authResp.interval,
+            expires_in: authResp.expires_in,
+            next: `Open verification_url in a browser to authorize, then run: ae-cli auth login --device-code ${authResp.device_code}`
+          },
+          fmt
+        );
+        return;
+      }
+      const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
+      persistDeviceTokens(host, tokens);
+      logger.info(`Device flow login successful for ${host}`);
+      emit("Login successful! Token saved securely.");
+      printOutput(loginSummary(host, tokens), fmt);
+    } catch (err) {
+      if (err instanceof DeviceFlowUnsupportedError) {
+        printError(
+          "auth",
+          err.message,
+          "Use `ae-cli auth set-token <token>` to authenticate, or upgrade the AE server to a version that supports device login."
+        );
+        process.exit(1);
+      }
+      printError("auth", err.message);
+      process.exit(1);
+    }
+  });
+  auth.command("set-token <token>").description("Manually set authentication token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+      printOutput({ saved: true, config }, program.opts().format || "json");
+    }
+    process.stderr.write(`[ae-cli] Validating token...
+`);
+    const isValid = await validateToken(token, host);
+    if (!isValid) {
+      logger.warn(`Token validation failed for ${host}`);
+      process.stderr.write(`[ae-cli] Token validation failed
+`);
+      printError("auth", "Invalid token", "Please check your token and try again");
+      process.exit(1);
+    }
+    setTokenManual(token, host);
+    logger.info(`Token manually set and validated for ${host}`);
+    process.stderr.write(`[ae-cli] Token verified and saved for ${host}
+`);
+    printOutput({ saved: true, host, verified: true }, program.opts().format || "json");
+  });
+  auth.command("status").description("Show authentication status for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printOutput({ authenticated: false, host: "(none)", hint: "Run: ae-cli config set-host <url>" }, program.opts().format || "json");
+      return;
+    }
+    const secureEntry = load(host);
+    if (secureEntry) {
+      const pastStaticExpiry = new Date(secureEntry.accessExpiresAt).getTime() < Date.now();
+      printOutput(
+        {
+          authenticated: true,
+          host,
+          source: "secure-store",
+          accessExpiresAt: secureEntry.accessExpiresAt,
+          accessExpiresAtNote: "advisory: access token auto-slides on use server-side; re-login only if a command returns an auth error",
+          pastStaticExpiry,
+          hasMcpToken: !!secureEntry.mcpToken
+        },
+        program.opts().format || "json"
+      );
+      return;
+    }
+    const tokenStatus = getAuthStatus(host);
+    const authenticated = tokenStatus.authenticated;
+    printOutput({ authenticated, host, source: tokenStatus.source ?? "none" }, program.opts().format || "json");
+  });
+  auth.command("logout").description("Clear stored token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    clearToken(host);
+    clear(host);
+    process.stderr.write(`[ae-cli] Token cleared for ${host}
+`);
+    printOutput({ cleared: true, host }, program.opts().format || "json");
+  });
+  auth.command("set-mcp-token <token>").description("Manually set MCP token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) {
+        config.activeHost = host;
+      }
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Host config saved for ${host}
+`);
+    }
+    process.stderr.write(`[ae-cli] Validating MCP token...
+`);
+    const isValid = await validateMcpToken(token, host);
+    if (!isValid) {
+      process.stderr.write(`[ae-cli] MCP token validation failed
+`);
+      printError("auth", "Invalid MCP token", "Please check your MCP token and try again");
+      process.exit(1);
+    }
+    setMcpTokenManual(token, host);
+    process.stderr.write(`[ae-cli] MCP token verified and saved for ${host}
+`);
+    printOutput({ saved: true, host, verified: true, type: "mcp-token" }, program.opts().format || "json");
+  });
+  auth.command("clear-mcp-token").description("Clear stored MCP token for a host (--host or active host; --all clears all)").option("--host <url>", HOST_OPTION_DESC).option("--all", "Clear MCP tokens for all hosts").action((opts) => {
+    if (opts.all) {
+      clearMcpToken();
+      process.stderr.write(`[ae-cli] All MCP tokens cleared
+`);
+      printOutput({ cleared: true, type: "all-mcp-tokens" }, program.opts().format || "json");
+      return;
+    }
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
+      process.exit(1);
+    }
+    clearMcpToken(host);
+    process.stderr.write(`[ae-cli] MCP token cleared for ${host}
+`);
+    printOutput({ cleared: true, host }, program.opts().format || "json");
+  });
+}
+export {
+  registerAuth
+};

package/dist/{auth-TXFJHPXU.js → auth-U25QJU5D.js} RENAMED Viewed

@@ -7,9 +7,9 @@ import {
   saveToken,
   setTokenManual,
   validateToken
-} from "./chunk-SRRUNQIM.js";
-import "./chunk-BI5ZVD6T.js";
-import "./chunk-MNHE6SSI.js";
+} from "./chunk-U6TKB3IV.js";
+import "./chunk-JM34JPCO.js";
+import "./chunk-SRJIAOBN.js";
 export {
   clearToken,
   getAuthStatus,

package/dist/{chunk-B4UL2VIJ.js → chunk-CLJF7MQA.js} RENAMED Viewed

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-MNHE6SSI.js";
+} from "./chunk-SRJIAOBN.js";
 // src/framework/output.ts
 import Table from "cli-table3";