@thinkingai/ae-cli 1.0.27 → 1.0.30

package/dist/{chunk-6T7245YE.js → chunk-EGEIXA2Z.js}

@@ -1,7 +1,7 @@
 // src/core/multiselect.ts
 var MultiselectCancelled = class extends Error {
   constructor() {
-    super("\u7528\u6237\u53D6\u6D88\u9009\u62E9");
+    super("Selection cancelled by user");
     this.name = "MultiselectCancelled";
   }
 };
@@ -27,7 +27,7 @@ function promptMultiselect(opts) {
   const stdin = process.stdin;
   if (!stdin.isTTY) {
     return Promise.reject(
-      new Error("ae-cli sync \u9700\u8981 TTY \u624D\u80FD\u8FDB\u884C\u591A\u9009\uFF1B\u8BF7\u5728\u4EA4\u4E92\u5F0F\u7EC8\u7AEF\u4E2D\u8FD0\u884C")
+      new Error("ae-cli sync requires a TTY for multi-select; please run in an interactive terminal")
     );
   }
   const rows = buildRows(items);
@@ -48,7 +48,7 @@ function promptMultiselect(opts) {
     if (renderCount > 0) {
       stderr.write(`\x1B[${totalLines()}A`);
     }
-    stderr.write(`${title}  (space \u9009\u62E9 \xB7 a \u5168\u9009/\u5168\u4E0D\u9009 \xB7 enter \u786E\u8BA4 \xB7 q \u53D6\u6D88)\x1B[K
+    stderr.write(`${title}  (space: select \xB7 a: select all/none \xB7 enter: confirm \xB7 q: cancel)\x1B[K
 `);
     stderr.write(`\x1B[K
 `);
@@ -128,10 +128,10 @@ function promptMultiselect(opts) {
 }
 function promptSingleCheckboxSelect(opts) {
   const { title, items } = opts;
-  if (items.length === 0) return Promise.reject(new Error("\u65E0\u53EF\u9009\u9879"));
+  if (items.length === 0) return Promise.reject(new Error("No items to select"));
   const stderr = process.stderr;
   const stdin = process.stdin;
-  if (!stdin.isTTY) return Promise.reject(new Error("\u9700\u8981 TTY \u624D\u80FD\u8FDB\u884C\u5355\u9009"));
+  if (!stdin.isTTY) return Promise.reject(new Error("A TTY is required for single-select"));
   const preselectedIndex = items.findIndex((item) => item.preselected);
   let cursor = preselectedIndex >= 0 ? preselectedIndex : 0;
   let selected = preselectedIndex >= 0 ? preselectedIndex : null;
@@ -139,7 +139,7 @@ function promptSingleCheckboxSelect(opts) {
   const lines = items.length + 2;
   function render() {
     if (renderCount > 0) stderr.write(`\x1B[${lines}A`);
-    stderr.write(`${title}  (space \u9009\u62E9 \xB7 enter \u786E\u8BA4 \xB7 q \u53D6\u6D88)\x1B[K
+    stderr.write(`${title}  (space: select \xB7 enter: confirm \xB7 q: cancel)\x1B[K
 `);
     stderr.write(`\x1B[K
 `);
@@ -193,10 +193,10 @@ function promptSingleCheckboxSelect(opts) {
 }
 function promptSingleSelect(opts) {
   const { title, items } = opts;
-  if (items.length === 0) return Promise.reject(new Error("\u65E0\u53EF\u9009\u9879"));
+  if (items.length === 0) return Promise.reject(new Error("No items to select"));
   const stderr = process.stderr;
   const stdin = process.stdin;
-  if (!stdin.isTTY) return Promise.reject(new Error("\u9700\u8981 TTY \u624D\u80FD\u8FDB\u884C\u5355\u9009"));
+  if (!stdin.isTTY) return Promise.reject(new Error("A TTY is required for single-select"));
   let cursor = 0;
   let renderCount = 0;
   const lines = items.length + 1;
@@ -293,8 +293,33 @@ function writeSkillManifestEntries(manifestPath, entries) {
   );
 }
 
+// src/commands/sync/validation.ts
+var SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var MCP_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+function isValidSkillSlug(slug) {
+  return slug.length > 0 && slug.length <= 48 && SKILL_SLUG_RE.test(slug);
+}
+function assertValidSkillSlug(slug) {
+  if (!isValidSkillSlug(slug)) {
+    throw new Error(
+      `Invalid Skill slug: ${slug}. Skill slugs may only contain lowercase letters, digits, and non-consecutive hyphens (-), must be at most 48 characters, and must not start or end with a hyphen`
+    );
+  }
+}
+function isValidMcpName(name) {
+  return name.length >= 2 && name.length <= 64 && MCP_NAME_RE.test(name);
+}
+function assertValidMcpName(name) {
+  if (!isValidMcpName(name)) {
+    throw new Error(
+      `Invalid MCP name: ${name}. MCP names may only contain letters, digits, underscores, and hyphens, must be 2-64 characters, and must start with a letter`
+    );
+  }
+}
+
 // src/commands/sync/scanners.ts
 var SECRET_PATTERN = /TOKEN|SECRET|KEY|PASSWORD/i;
+var MCP_MANIFEST_FILE = ".mcp-manifest.json";
 function safeLstat(p) {
   try {
     return lstatSync(p);
@@ -360,6 +385,7 @@ function scanSkillsInDir(dir, source, workspacePath) {
     if (!isDir) continue;
     const filePath = join(slugDir, "SKILL.md");
     if (!existsSync2(filePath)) continue;
+    assertValidSkillSlug(slug);
     const file = readSkillFile(filePath);
     if (!file) continue;
     out.push({
@@ -389,23 +415,42 @@ function readJsonSafe(p) {
     return null;
   }
 }
+function isMcpManifestScope(value) {
+  return value === "personal" || value === "company" || value === "system";
+}
+function readMcpManifestScopes(workspaceDir) {
+  const parsed = readJsonSafe(join(workspaceDir, MCP_MANIFEST_FILE));
+  const scopes = /* @__PURE__ */ new Map();
+  if (!Array.isArray(parsed)) return scopes;
+  for (const item of parsed) {
+    if (!item || typeof item !== "object") continue;
+    const entry = item;
+    if (typeof entry.name !== "string" || !isMcpManifestScope(entry.scope)) continue;
+    if (scopes.has(entry.name)) continue;
+    scopes.set(entry.name, entry.scope);
+  }
+  return scopes;
+}
 function detectSecrets(env) {
   if (!env) return false;
   return Object.keys(env).some((k) => SECRET_PATTERN.test(k));
 }
-function parseMcpServers(servers, source, workspacePath, options = { filterScope: true }) {
+function parseMcpServers(servers, source, workspacePath, workspaceDir, options = {}) {
   if (!servers || typeof servers !== "object") return [];
   const out = [];
   for (const [slug, raw] of Object.entries(servers)) {
     if (!raw || typeof raw !== "object") continue;
-    if (options.filterScope && (raw._scope === "system" || raw._scope === "company")) continue;
-    const transport = raw.type === "http" || raw.transport === "http" || typeof raw.url === "string" ? "http" : "stdio";
+    if (options.excludedNames?.has(slug)) continue;
+    assertValidMcpName(slug);
+    const rawTransport = raw.transport ?? raw.type;
+    const transport = rawTransport === "sse" ? "sse" : rawTransport === "http" || typeof raw.url === "string" ? "http" : "stdio";
     const env = raw.env && typeof raw.env === "object" ? raw.env : void 0;
     const headers = raw.headers && typeof raw.headers === "object" ? raw.headers : void 0;
     out.push({
       slug,
       source,
       workspacePath,
+      workspaceDir,
       transport,
       url: typeof raw.url === "string" ? raw.url : void 0,
       command: typeof raw.command === "string" ? raw.command : void 0,
@@ -444,21 +489,45 @@ function scanMcps() {
   if (!workspace) return [];
   const out = [];
   const scopedMcpJson = readJsonSafe(join(workspace.dir, ".mcp.json"));
-  out.push(...parseMcpServers(scopedMcpJson?.mcpServers, "workspace", workspace.name, { filterScope: true }));
+  const projectManifestScopes = readMcpManifestScopes(workspace.dir);
+  const excludedProjectMcps = new Set(
+    [...projectManifestScopes.entries()].filter(([, scope]) => scope === "system" || scope === "company").map(([name]) => name)
+  );
+  out.push(
+    ...parseMcpServers(
+      scopedMcpJson?.mcpServers,
+      "project",
+      workspace.name,
+      workspace.dir,
+      { excludedNames: excludedProjectMcps }
+    )
+  );
   const workspaceClaudeJson = readJsonSafe(join(workspace.dir, ".claude", ".claude.json"));
   out.push(
-    ...parseMcpServers(projectMcpServers(workspaceClaudeJson, workspace.dir), "workspace", workspace.name, {
-      filterScope: false
-    })
+    ...parseMcpServers(
+      projectMcpServers(workspaceClaudeJson, workspace.dir),
+      "local",
+      workspace.name,
+      void 0
+    )
   );
   const globalClaudeJson = readJsonSafe(join(home, ".claude.json"));
   out.push(
-    ...parseMcpServers(projectMcpServers(globalClaudeJson, workspace.dir), "global", void 0, {
-      filterScope: false
-    })
+    ...parseMcpServers(
+      projectMcpServers(globalClaudeJson, workspace.dir),
+      "user",
+      void 0,
+      void 0
+    )
   );
   return out;
 }
+function splitPushableMcps(candidates) {
+  return {
+    supported: candidates.filter((mcp) => mcp.transport === "http" || mcp.transport === "sse"),
+    unsupportedStdio: candidates.filter((mcp) => mcp.transport === "stdio")
+  };
+}
 function describeSource(_c) {
   return void 0;
 }
@@ -471,8 +540,11 @@ export {
   SKILL_MANIFEST_FILE,
   readSkillManifestEntries,
   writeSkillManifestEntries,
+  assertValidSkillSlug,
+  assertValidMcpName,
   getCurrentWorkspace,
   scanSkills,
   scanMcps,
+  splitPushableMcps,
   describeSource
 };

package/dist/{chunk-2NGWYMLB.js → chunk-GLNZSDKO.js}

@@ -1,20 +1,33 @@
+import {
+  getAnalysisMappingPathForClusterMode
+} from "./chunk-GSJGPNKK.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
 import {
   getToken
-} from "./chunk-SRRUNQIM.js";
+} from "./chunk-U6TKB3IV.js";
 import {
-  forceMigrateFromFallback,
-  getActiveHost,
-  getConfigDir,
-  safeJsonParse,
-  safeReadJsonFile
-} from "./chunk-BI5ZVD6T.js";
+  loadMcpToken
+} from "./chunk-JM34JPCO.js";
 import {
-  logger
-} from "./chunk-MNHE6SSI.js";
+  getActiveHost,
+  getFallbackMcpToken,
+  logger,
+  safeJsonParse
+} from "./chunk-SRJIAOBN.js";
 
 // src/core/mcp.ts
-import fs from "fs";
-import path from "path";
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
 var serviceMappingMap = /* @__PURE__ */ new Map();
@@ -39,6 +52,9 @@ function getMcpMapping(serviceName) {
   if (!mapping) {
     throw new Error(`MCP mapping not found for service: '${serviceName}'. Please register it using registerMcpMapping() first.`);
   }
+  if (serviceName === "analysis") {
+    return { ...mapping, mappingPath: getAnalysisMappingPathForClusterMode() };
+  }
   return mapping;
 }
 function buildMcpUrl(host, serviceName) {
@@ -56,22 +72,8 @@ var requestIdCounter = 1;
 function genRequestId() {
   return requestIdCounter++;
 }
-var MCP_TOKEN_FILE = path.join(getConfigDir(), "mcp-tokens.json");
 var MCP_TOKEN_GENERATE_PATH = "/v1/ta/mcp/token/generate";
-function loadMcpTokenStore() {
-  try {
-    if (fs.existsSync(MCP_TOKEN_FILE)) {
-      return safeReadJsonFile(MCP_TOKEN_FILE);
-    }
-  } catch {
-  }
-  return {};
-}
-function saveMcpTokenStore(store) {
-  const dir = getConfigDir();
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(MCP_TOKEN_FILE, JSON.stringify(store, null, 2));
-}
+var _mcpTokenCache = /* @__PURE__ */ new Map();
 async function generateMcpToken(hostUrl) {
   const teToken = await getToken(hostUrl);
   const base = hostUrl.replace(/\/+$/, "");
@@ -97,33 +99,38 @@ async function generateMcpToken(hostUrl) {
 }
 async function getMcpToken(hostOverride) {
   const hostUrl = hostOverride || getActiveHost();
-  const store = loadMcpTokenStore();
-  if (store[hostUrl]) {
-    return store[hostUrl];
+  const cached = _mcpTokenCache.get(hostUrl);
+  if (cached) {
+    return cached;
+  }
+  const storedToken = loadMcpToken(hostUrl);
+  if (storedToken) {
+    _mcpTokenCache.set(hostUrl, storedToken);
+    logger.info(`Using persisted MCP token (secure-store) for ${hostUrl}`);
+    return storedToken;
+  }
+  const fallbackToken = getFallbackMcpToken(hostUrl);
+  if (fallbackToken) {
+    _mcpTokenCache.set(hostUrl, fallbackToken);
+    logger.info(`Using sandbox-provisioned MCP token (fallback file) for ${hostUrl}`);
+    return fallbackToken;
   }
   logger.info(`Generating MCP token for ${hostUrl}`);
   const mcpToken = await generateMcpToken(hostUrl);
-  const updatedStore = { ...store, [hostUrl]: mcpToken };
-  saveMcpTokenStore(updatedStore);
-  logger.info(`MCP token generated and cached for ${hostUrl}`);
+  _mcpTokenCache.set(hostUrl, mcpToken);
+  logger.info(`MCP token generated and in-process cached for ${hostUrl}`);
   return mcpToken;
 }
 function clearMcpToken(hostUrl) {
-  const store = loadMcpTokenStore();
   if (hostUrl) {
-    delete store[hostUrl];
+    _mcpTokenCache.delete(hostUrl);
   } else {
-    for (const key of Object.keys(store)) {
-      delete store[key];
-    }
+    _mcpTokenCache.clear();
   }
-  saveMcpTokenStore(store);
 }
 function setMcpTokenManual(token, hostUrl) {
-  const store = loadMcpTokenStore();
-  store[hostUrl] = token;
-  saveMcpTokenStore(store);
-  logger.info(`MCP token manually set for ${hostUrl}`);
+  _mcpTokenCache.set(hostUrl, token);
+  logger.info(`MCP token manually set (in-process) for ${hostUrl}`);
 }
 async function validateMcpToken(token, hostUrl) {
   const mapping = getMcpMapping("analysis");
@@ -186,18 +193,27 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    logger.warn(`MCP request failed (HTTP ${resp.status}) for ${hostUrl}, trying fallback`);
-    const migrated = forceMigrateFromFallback();
-    if (migrated && migrated[hostUrl]) {
-      logger.info(`MCP token refreshed from fallback for ${hostUrl}`);
-      process.stderr.write(`[ae-cli] MCP token refreshed from fallback for ${hostUrl}
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, re-minting token`);
+      _mcpTokenCache.delete(hostUrl);
+      const fallbackToken = getFallbackMcpToken(hostUrl);
+      const newToken = fallbackToken ?? await generateMcpToken(hostUrl);
+      _mcpTokenCache.set(hostUrl, newToken);
+      logger.info(`MCP token re-minted for ${hostUrl}`);
+      process.stderr.write(`[ae-cli] MCP token re-minted for ${hostUrl}
 `);
-      headers["mcp-token"] = migrated[hostUrl];
+      headers["mcp-token"] = newToken;
       const retryResp = await fetch(url, {
         method: "POST",
         headers,
         body: JSON.stringify(body)
       });
+      if (retryResp.status === 403) {
+        throw new PermissionError(await permissionMessage(retryResp));
+      }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);
       }
@@ -241,19 +257,41 @@ async function callMcpTool(url, toolName, args = {}, hostOverride) {
 function parseMcpResult(result) {
   if (result.content.length > 0 && result.content[0].type === "text") {
     const text = result.content[0].text || "";
+    let parsed;
     try {
-      return safeJsonParse(text);
+      parsed = safeJsonParse(text);
     } catch {
       return text;
     }
+    const errMsg = mcpResultErrorMessage(parsed);
+    if (errMsg !== null) {
+      if (/no_auth|auth_error|permission|forbidden|unauthor|\u65e0\u6743/i.test(errMsg)) {
+        throw new PermissionError(errMsg);
+      }
+      throw new Error(errMsg);
+    }
+    return parsed;
   }
   return result;
 }
+function mcpResultErrorMessage(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.success === true || parsed.ok === true) return null;
+  const e = parsed.error;
+  if (typeof e === "string" && e.trim()) return e;
+  if (e && typeof e === "object") {
+    const msg = typeof e.message === "string" && e.message || void 0;
+    const code = typeof e.code === "string" && e.code || void 0;
+    if (msg && code) return `${code}: ${msg}`;
+    if (msg || code) return msg || code;
+  }
+  return null;
+}
 
 export {
   registerMcpMappings,
   resolveMcpUrl,
-  loadMcpTokenStore,
+  getMcpToken,
   clearMcpToken,
   setMcpTokenManual,
   validateMcpToken,

package/dist/chunk-GSJGPNKK.js

@@ -0,0 +1,49 @@
+import {
+  getSandboxClusterInfoFilePath,
+  logger,
+  safeReadJsonFile
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/cluster-info.ts
+import fs from "fs";
+import path from "path";
+var GLOBAL_QUERY_CONFIG_KEY = "sw_cfg_enable_global_query";
+var CLUSTER_INFO_FILE_ENV = "AE_CLUSTER_INFO_FILE";
+function getClusterInfoFilePath() {
+  return process.env[CLUSTER_INFO_FILE_ENV] || getSandboxClusterInfoFilePath();
+}
+function loadClusterInfo() {
+  const file = getClusterInfoFilePath();
+  try {
+    if (!fs.existsSync(file)) {
+      return {};
+    }
+    const raw = safeReadJsonFile(file);
+    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  } catch (err) {
+    logger.warn(`Failed to load cluster info from ${file}: ${err.message}`);
+    return {};
+  }
+}
+function isGlobalQueryModeEnabled() {
+  return loadClusterInfo()[GLOBAL_QUERY_CONFIG_KEY] === true;
+}
+function setGlobalQueryModeEnabled(enabled) {
+  const file = getClusterInfoFilePath();
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const next = { [GLOBAL_QUERY_CONFIG_KEY]: enabled };
+  fs.writeFileSync(file, JSON.stringify(next, null, 2));
+  return next;
+}
+function getAnalysisMappingPathForClusterMode(enabled = isGlobalQueryModeEnabled()) {
+  return enabled ? "analysis-global" : "analysis";
+}
+
+export {
+  GLOBAL_QUERY_CONFIG_KEY,
+  getClusterInfoFilePath,
+  isGlobalQueryModeEnabled,
+  setGlobalQueryModeEnabled,
+  getAnalysisMappingPathForClusterMode
+};

package/dist/{chunk-VT6VC4PA.js → chunk-I42JGQ2J.js}

@@ -2,13 +2,14 @@ import {
   clearToken,
   getToken,
   resolveHost
-} from "./chunk-SRRUNQIM.js";
+} from "./chunk-U6TKB3IV.js";
 import {
-  safeJsonParse
-} from "./chunk-BI5ZVD6T.js";
+  SecureStoreAuthError
+} from "./chunk-JM34JPCO.js";
 import {
-  logger
-} from "./chunk-MNHE6SSI.js";
+  logger,
+  safeJsonParse
+} from "./chunk-SRJIAOBN.js";
 
 // src/core/client.ts
 import WebSocket from "ws";
@@ -45,9 +46,16 @@ async function request(method, modulePath, params = {}, body = null, retry = tru
   const text = await resp.text();
   const data = safeJsonParse(text);
   logger.api(method, url, resp.status, body, data);
-  if ((resp.status === 401 || resp.status === 403) && retry) {
-    clearToken(resolvedHost);
-    return request(method, modulePath, params, body, false, resolvedHost);
+  if (resp.status === 401) {
+    if (retry) {
+      clearToken(resolvedHost);
+      return request(method, modulePath, params, body, false, resolvedHost);
+    }
+    throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
+  }
+  if (resp.status === 403) {
+    const m = data && typeof data === "object" && typeof data.error === "string" ? data.error : "Permission denied";
+    throw new Error(m);
   }
   if (data.return_code === -1001 && retry) {
     clearToken(resolvedHost);
@@ -81,9 +89,16 @@ async function uploadRequest(modulePath, form, params = {}, retry = true, hostUr
   const text = await resp.text();
   const data = safeJsonParse(text);
   logger.api("POST", url, resp.status, { upload: true }, data);
-  if ((resp.status === 401 || resp.status === 403) && retry) {
-    clearToken(resolvedHost);
-    return uploadRequest(modulePath, form, params, false, resolvedHost);
+  if (resp.status === 401) {
+    if (retry) {
+      clearToken(resolvedHost);
+      return uploadRequest(modulePath, form, params, false, resolvedHost);
+    }
+    throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
+  }
+  if (resp.status === 403) {
+    const m = data && typeof data === "object" && typeof data.error === "string" ? data.error : "Permission denied";
+    throw new Error(m);
   }
   if (data.return_code === -1001 && retry) {
     clearToken(resolvedHost);