@thinkingai/ae-cli 1.0.27 → 1.0.30

package/dist/chunk-JM34JPCO.js

@@ -0,0 +1,239 @@
+import {
+  getConfigDir,
+  logger,
+  safeJsonParse
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/secure-store.ts
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execFileSync } from "child_process";
+var STORE_DIR_SUFFIX = "secure-tokens";
+var SCRYPT_SALT = Buffer.from("ae-cli-secure-store-v1");
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var KEY_LEN = 32;
+var NONCE_LEN = 12;
+var REFRESH_TOKEN_PATH = "/v1/oauth/refreshForToken";
+function getMachineId() {
+  if (process.platform === "darwin") {
+    try {
+      const out = execFileSync(
+        "ioreg",
+        ["-rd1", "-c", "IOPlatformExpertDevice"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const m = out.match(/IOPlatformUUID.*?=.*?"([0-9A-F-]{36})"/i);
+      if (m?.[1]) return `darwin:${m[1]}`;
+    } catch {
+    }
+  }
+  if (process.platform === "linux") {
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      try {
+        const id = fs.readFileSync(p, "utf8").trim();
+        if (id) return `linux:${id}`;
+      } catch {
+      }
+    }
+  }
+  if (process.platform === "win32") {
+    try {
+      const out = execFileSync(
+        "reg",
+        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
+      if (m?.[1]) return `win32:${m[1]}`;
+    } catch {
+    }
+  }
+  const fallback = `${os.homedir()}|${os.hostname()}|${os.platform()}`;
+  logger.warn("secure-store: using fallback machine-id (HOME+hostname+platform)");
+  return `fallback:${fallback}`;
+}
+var _cachedMachineId;
+function getCachedMachineId() {
+  if (!_cachedMachineId) _cachedMachineId = getMachineId();
+  return _cachedMachineId;
+}
+function deriveKey(machineId) {
+  return crypto.scryptSync(machineId, SCRYPT_SALT, KEY_LEN, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P
+  });
+}
+var _cachedKey;
+function getKey() {
+  if (!_cachedKey) _cachedKey = deriveKey(getCachedMachineId());
+  return _cachedKey;
+}
+function encrypt(plaintext) {
+  const key = getKey();
+  const nonce = crypto.randomBytes(NONCE_LEN);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    nonce: nonce.toString("hex"),
+    tag: tag.toString("hex"),
+    data: encrypted.toString("hex")
+  };
+}
+function decrypt(blob) {
+  const key = getKey();
+  const nonce = Buffer.from(blob.nonce, "hex");
+  const tag = Buffer.from(blob.tag, "hex");
+  const data = Buffer.from(blob.data, "hex");
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
+  return decrypted.toString("utf8");
+}
+function storeDir() {
+  return path.join(getConfigDir(), STORE_DIR_SUFFIX);
+}
+function tokenFilePath(host) {
+  const safe = host.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "_");
+  return path.join(storeDir(), `${safe}.enc.json`);
+}
+function ensureStoreDir() {
+  const dir = storeDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+    try {
+      fs.chmodSync(dir, 448);
+    } catch {
+    }
+  }
+}
+function save(host, payload) {
+  ensureStoreDir();
+  const plaintext = JSON.stringify(payload);
+  const blob = encrypt(plaintext);
+  const filePath = tokenFilePath(host);
+  fs.writeFileSync(filePath, JSON.stringify(blob, null, 2), { encoding: "utf8" });
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+  logger.info(`secure-store: token saved for ${host}`);
+}
+function load(host) {
+  const filePath = tokenFilePath(host);
+  if (!fs.existsSync(filePath)) return null;
+  try {
+    const raw = fs.readFileSync(filePath, "utf8");
+    const blob = safeJsonParse(raw);
+    if (!blob?.nonce || !blob?.tag || !blob?.data) {
+      logger.warn(`secure-store: malformed blob for ${host}`);
+      return null;
+    }
+    const plaintext = decrypt(blob);
+    return JSON.parse(plaintext);
+  } catch (e) {
+    logger.error(`secure-store: decrypt failed for ${host}: ${e.message}`);
+    return null;
+  }
+}
+function clear(host) {
+  const filePath = tokenFilePath(host);
+  if (fs.existsSync(filePath)) {
+    fs.rmSync(filePath);
+    logger.info(`secure-store: token cleared for ${host}`);
+  }
+}
+async function getValidAccessToken(host) {
+  const payload = load(host);
+  if (!payload) {
+    throw new SecureStoreAuthError(
+      `No stored token for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  const expiresAt = new Date(payload.accessExpiresAt).getTime();
+  const now = Date.now();
+  const needsRefresh = expiresAt - now < 6e4;
+  if (!needsRefresh) {
+    return payload.accessToken;
+  }
+  if (payload.refreshToken) {
+    logger.info(`secure-store: access token past local expiry for ${host}, refreshing\u2026`);
+    const refreshed = await doRefresh(host, payload.refreshToken);
+    save(host, { ...refreshed, mcpToken: payload.mcpToken });
+    logger.info(`secure-store: token refreshed for ${host}`);
+    return refreshed.accessToken;
+  }
+  logger.info(`secure-store: ${host} past static local expiry, no refresh token \u2014 returning stored token, server validates (lazy)`);
+  return payload.accessToken;
+}
+function loadMcpToken(host) {
+  return load(host)?.mcpToken ?? null;
+}
+async function doRefresh(host, refreshToken) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}${REFRESH_TOKEN_PATH}`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken })
+    });
+  } catch (e) {
+    throw new SecureStoreAuthError(
+      `Token refresh network error for ${host}: ${e.message}. Please run: ae-cli auth login`
+    );
+  }
+  if (!resp.ok) {
+    throw new SecureStoreAuthError(
+      `Token refresh failed (HTTP ${resp.status}) for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  let body;
+  try {
+    body = safeJsonParse(await resp.text());
+  } catch {
+    throw new SecureStoreAuthError(
+      `Token refresh returned invalid JSON for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  if (body.return_code !== 0) {
+    throw new SecureStoreAuthError(
+      `Token refresh error (${body.return_code}: ${body.return_message ?? "unknown"}) for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  const d = body.data;
+  const newAccess = d?.accessToken ?? d?.access_token ?? "";
+  const newRefresh = d?.refreshToken ?? d?.refresh_token ?? refreshToken;
+  const expiresIn = d?.expiresIn ?? d?.expires_in ?? 72e3;
+  if (!newAccess) {
+    throw new SecureStoreAuthError(
+      `Token refresh returned empty accessToken for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  return {
+    accessToken: newAccess,
+    refreshToken: newRefresh,
+    accessExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+  };
+}
+var SecureStoreAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecureStoreAuthError";
+  }
+};
+
+export {
+  save,
+  load,
+  clear,
+  getValidAccessToken,
+  loadMcpToken,
+  SecureStoreAuthError
+};

package/dist/chunk-NOO24N7W.js

@@ -0,0 +1,11 @@
+// src/core/errors.ts
+var PermissionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PermissionError";
+  }
+};
+
+export {
+  PermissionError
+};

package/dist/chunk-SF3KTPIC.js

@@ -0,0 +1,98 @@
+import {
+  getMcpToken
+} from "./chunk-GLNZSDKO.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  safeJsonParse
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/mcp-access.ts
+function buildUrl(host, path, params = {}) {
+  const base = host.replace(/\/$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  const url = new URL(`${base}${p}`);
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function parseKbResponse(resp, text) {
+  if (resp.status === 403) {
+    let msg = "Permission denied for this resource (HTTP 403)";
+    try {
+      const d = safeJsonParse(text);
+      const m = d && (typeof d.error === "string" ? d.error : d.error?.message || d.message);
+      if (m && typeof m === "string") msg = m;
+    } catch {
+    }
+    throw new PermissionError(msg);
+  }
+  if (resp.status === 401) {
+    throw new Error(
+      `KB MCP token auth failed: HTTP ${resp.status} ${resp.statusText}`
+    );
+  }
+  const data = safeJsonParse(text);
+  if (data.return_code === -1001) {
+    throw new Error(
+      `KB MCP token auth failed: ${data.return_message || "unauthorized"} (code: ${data.return_code})`
+    );
+  }
+  if (data.return_code !== 0 && data.return_code !== void 0) {
+    throw new Error(
+      `AE API error: ${data.return_message || "unknown"} (code: ${data.return_code})`
+    );
+  }
+  if (data && typeof data === "object" && typeof data.error === "string" && data.error.trim() && data.return_code === void 0 && data.success === void 0) {
+    throw new Error(data.error);
+  }
+  return data.data !== void 0 ? data.data : data;
+}
+async function fetchWithMcpToken(input, init, mcpToken) {
+  const headers = new Headers(init.headers);
+  headers.set("mcp-token", mcpToken);
+  const resp = await fetch(input, { ...init, headers });
+  return parseKbResponse(resp, await resp.text());
+}
+async function getAuthHeaders(ctx) {
+  const mcpToken = await getMcpToken(ctx.host());
+  return { "mcp-token": mcpToken };
+}
+async function kbApi(ctx, method, path, params = {}, body) {
+  const host = ctx.host();
+  const mcpToken = await getMcpToken(host);
+  const upperMethod = method.toUpperCase();
+  return fetchWithMcpToken(
+    buildUrl(host, path, params),
+    {
+      method: upperMethod,
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
+    },
+    mcpToken
+  );
+}
+async function kbUpload(ctx, path, form, params = {}) {
+  const host = ctx.host();
+  const mcpToken = await getMcpToken(host);
+  return fetchWithMcpToken(
+    buildUrl(host, path, params),
+    {
+      method: "POST",
+      body: form
+    },
+    mcpToken
+  );
+}
+
+export {
+  getAuthHeaders,
+  kbApi,
+  kbUpload
+};

package/dist/chunk-SRJIAOBN.js

@@ -0,0 +1,244 @@
+// src/core/logger.ts
+import fs from "fs";
+import path from "path";
+var LOG_DIR = path.join(process.env.HOME || "", ".ae-cli", "log");
+var Logger = class {
+  logDir;
+  date;
+  constructor() {
+    this.logDir = LOG_DIR;
+    this.date = this.today();
+    this.ensureDir();
+  }
+  today() {
+    const d = /* @__PURE__ */ new Date();
+    return `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, "0")}${String(d.getDate()).padStart(2, "0")}`;
+  }
+  timestamp() {
+    return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").split(".")[0];
+  }
+  ensureDir() {
+    if (!fs.existsSync(this.logDir)) {
+      fs.mkdirSync(this.logDir, { recursive: true });
+    }
+  }
+  filePath(level) {
+    const today = this.today();
+    if (today !== this.date) {
+      this.date = today;
+    }
+    return path.join(this.logDir, `${this.date}_${level}.log`);
+  }
+  /**
+   * Write a log entry to file (not printed to the console; console output is handled by existing process.stderr.write calls)
+   */
+  write(level, message) {
+    const ts = this.timestamp();
+    const line = `[${ts}] ${message}
+`;
+    try {
+      fs.appendFileSync(this.filePath(level), line);
+    } catch {
+    }
+  }
+  /** Informational log */
+  info(message) {
+    this.write("info", message);
+  }
+  /** Warning log */
+  warn(message) {
+    this.write("warning", message);
+  }
+  /** Error log */
+  error(message) {
+    this.write("error", message);
+  }
+  /** Log HTTP API request details */
+  api(method, url, status, reqBody, respBody) {
+    const parts = [`API ${method} ${url} \u2192 HTTP ${status}`];
+    if (reqBody !== void 0 && reqBody !== null) {
+      const s = typeof reqBody === "string" ? reqBody : JSON.stringify(reqBody);
+      parts.push(`REQ: ${s.slice(0, 500)}`);
+    }
+    if (respBody !== void 0 && respBody !== null) {
+      const s = typeof respBody === "string" ? respBody : JSON.stringify(respBody);
+      parts.push(`RESP: ${s.slice(0, 500)}`);
+    }
+    this.info(parts.join(" | "));
+  }
+  /** Log command execution */
+  command(name, args) {
+    const filtered = Object.entries(args).filter(([, v]) => v !== void 0 && v !== null && v !== "").map(([k, v]) => `--${k}=${JSON.stringify(v)}`).join(" ");
+    this.info(`CMD ${name}${filtered ? " " + filtered : ""}`);
+  }
+};
+var logger = new Logger();
+
+// src/core/json-utils.ts
+import fs2 from "fs";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var JSONbig = require2("json-bigint");
+var jsonParser = JSONbig({ storeAsString: true });
+function safeJsonParse(text) {
+  return jsonParser.parse(text);
+}
+function safeReadJsonFile(filePath) {
+  const content = fs2.readFileSync(filePath, "utf-8");
+  return safeJsonParse(content);
+}
+
+// src/core/config.ts
+import fs3 from "fs";
+import path2 from "path";
+
+// src/core/sandbox-runtime.ts
+import { homedir } from "os";
+import { join } from "path";
+var LINUX_SANDBOX_RUNTIME_ROOT = "/home/ta/te_agent_ta";
+function getDefaultSandboxRuntimeRoot() {
+  if (process.platform === "linux") {
+    return LINUX_SANDBOX_RUNTIME_ROOT;
+  }
+  return homedir();
+}
+function getSandboxRuntimeRoot() {
+  return process.env.SANDBOX_RUNTIME_ROOT || getDefaultSandboxRuntimeRoot();
+}
+function getSandboxAeConfigDir() {
+  return join(getSandboxRuntimeRoot(), ".ae-config");
+}
+function getSandboxMcpTokenFilePath() {
+  return join(getSandboxAeConfigDir(), "mcp-token.json");
+}
+function getSandboxClusterInfoFilePath() {
+  return join(getSandboxAeConfigDir(), "cluster-info.json");
+}
+
+// src/core/config.ts
+var CONFIG_DIR = path2.join(process.env.HOME || "", ".ae-cli");
+var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json");
+function sandboxMcpTokenCandidatePaths() {
+  const paths = [getSandboxMcpTokenFilePath()];
+  const homeFallback = path2.join(process.env.HOME || "", ".ae-config", "mcp-token.json");
+  if (!paths.includes(homeFallback)) {
+    paths.push(homeFallback);
+  }
+  return paths;
+}
+function readSandboxMcpTokenEntry() {
+  for (const file of sandboxMcpTokenCandidatePaths()) {
+    if (!fs3.existsSync(file)) continue;
+    try {
+      const data = safeReadJsonFile(file);
+      if (data && typeof data === "object" && !Array.isArray(data)) {
+        const url = data.url;
+        const token = data["mcp-token"];
+        if (url && token) {
+          return { url, token };
+        }
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function ensureDir() {
+  if (!fs3.existsSync(CONFIG_DIR)) fs3.mkdirSync(CONFIG_DIR, { recursive: true });
+}
+function forceMigrateFromFallback() {
+  const entry = readSandboxMcpTokenEntry();
+  if (!entry) return null;
+  return { [entry.url]: entry.token };
+}
+function getFallbackMcpToken(hostUrl) {
+  const store = forceMigrateFromFallback();
+  if (!store) return null;
+  if (hostUrl && store[hostUrl]) return store[hostUrl];
+  const entries = Object.values(store);
+  if (entries.length === 1) return entries[0];
+  return null;
+}
+function loadConfig() {
+  try {
+    if (fs3.existsSync(CONFIG_FILE)) {
+      const raw = safeReadJsonFile(CONFIG_FILE);
+      if (raw.defaultHost && !raw.activeHost) {
+        const migrated = migrateConfig(raw);
+        saveConfig(migrated);
+        return migrated;
+      }
+      return raw;
+    }
+  } catch (err) {
+    logger.error(`Error loading config: ${err.message}`);
+    console.error(`Error loading config: ${err.message}`);
+  }
+  return { activeHost: "", hosts: {} };
+}
+function migrateConfig(old) {
+  const hosts = {};
+  const oldHost = old.defaultHost;
+  if (old.hosts) {
+    for (const [key, val] of Object.entries(old.hosts)) {
+      const url = key.startsWith("http") ? key : `https://${key}`;
+      hosts[url] = val;
+    }
+  }
+  const activeHost = oldHost.startsWith("http") ? oldHost : `https://${oldHost}`;
+  if (!hosts[activeHost]) {
+    hosts[activeHost] = { label: "default" };
+  }
+  return { activeHost, hosts };
+}
+function saveConfig(config) {
+  ensureDir();
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  logger.info(`Config saved: activeHost=${config.activeHost}, hosts=${Object.keys(config.hosts).length}`);
+}
+function getActiveHost() {
+  const config = loadConfig();
+  if (config.activeHost) return config.activeHost;
+  return readSandboxMcpTokenEntry()?.url ?? "";
+}
+function setActiveHost(url) {
+  const config = loadConfig();
+  if (!config.hosts[url]) {
+    throw new Error(`Host ${url} is not in the configured hosts list. Add it first.`);
+  }
+  config.activeHost = url;
+  saveConfig(config);
+}
+function addHost(url, label) {
+  const config = loadConfig();
+  assertUniqueHostLabel(config, label, url);
+  config.hosts[url] = { label };
+  if (!config.activeHost) {
+    config.activeHost = url;
+  }
+  saveConfig(config);
+}
+function assertUniqueHostLabel(config, label, excludeUrl) {
+  const duplicate = Object.entries(config.hosts).find(([url, entry]) => url !== excludeUrl && entry.label === label);
+  if (duplicate) {
+    throw new Error(`Label already exists: ${label}. Rename the existing label first: ${duplicate[0]}`);
+  }
+}
+function getConfigDir() {
+  return CONFIG_DIR;
+}
+
+export {
+  logger,
+  safeJsonParse,
+  safeReadJsonFile,
+  getSandboxRuntimeRoot,
+  getSandboxClusterInfoFilePath,
+  getFallbackMcpToken,
+  loadConfig,
+  saveConfig,
+  getActiveHost,
+  setActiveHost,
+  addHost,
+  getConfigDir
+};