@thinkingai/ae-cli 1.0.28 → 1.0.30

package/README.md

@@ -31,24 +31,9 @@ npx skills add ThinkingAIAgenticEngine/ae-cli -g -y
 ## Quick Start
 
 ```bash
-# First run — interactive host setup + auto-login
-ae-cli config
+ae-cli auth login --host xxxxx
 ```
 
-The `config` command opens an interactive terminal UI:
-- First run: prompts you to add a AE host URL and label, then auto-authenticates
-- Subsequent runs: shows all configured hosts, lets you switch, edit, delete, or add new ones
-
-```
-AE Host Manager  (↑↓ select · Enter switch · e edit label · d delete · a add · q quit)
-
-❯ ● Production  https://ta.thinkingdata.cn  ✓
-  ○ Staging     https://ta-staging.example.com:8080  ✗
-  + Add new host...
-```
-
-After selecting a host, ae-cli automatically checks if the token is valid. If not, it triggers `auth login` for you.
-
 ## Usage
 
 ```bash

package/README.zh.md

@@ -31,24 +31,9 @@ npx skills add ThinkingAIAgenticEngine/ae-cli -g -y
 ## 快速开始
 
 ```bash
-# 首次运行 — 交互式主机配置 + 自动登录
-ae-cli config
+ae-cli auth login --host xxxxx
 ```
 
-`config` 命令会打开一个交互式终端界面：
-- 首次运行：提示您添加 AE 主机 URL 和标签，然后自动进行身份验证
-- 后续运行：显示所有已配置的主机，可以切换、编辑、删除或添加新主机
-
-```
-AE Host Manager  (↑↓ 选择 · Enter 切换 · e 编辑标签 · d 删除 · a 添加 · q 退出)
-
-❯ ● Production  https://ta.thinkingdata.cn  ✓
-  ○ Staging     https://ta-staging.example.com:8080  ✗
-  + Add new host...
-```
-
-选择主机后，ae-cli 会自动检查 token 是否有效。如果无效，会自动触发 `auth login`。
-
 ## 使用方法
 
 ```bash

package/dist/{auth-5NSDQFQB.js → auth-H3GJD55A.js}

@@ -6,18 +6,21 @@ import {
   clearMcpToken,
   setMcpTokenManual,
   validateMcpToken
-} from "./chunk-WCHI7725.js";
+} from "./chunk-GLNZSDKO.js";
 import "./chunk-GSJGPNKK.js";
+import "./chunk-NOO24N7W.js";
 import {
-  clear,
   clearToken,
   getAuthStatus,
-  load,
   resolveHost,
-  save,
   setTokenManual,
   validateToken
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-U6TKB3IV.js";
+import {
+  clear,
+  load,
+  save
+} from "./chunk-JM34JPCO.js";
 import {
   loadConfig,
   logger,

package/dist/{auth-H2376DEF.js → auth-U25QJU5D.js}

@@ -7,7 +7,8 @@ import {
   saveToken,
   setTokenManual,
   validateToken
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-U6TKB3IV.js";
+import "./chunk-JM34JPCO.js";
 import "./chunk-SRJIAOBN.js";
 export {
   clearToken,

package/dist/{chunk-IMBKVXKY.js → chunk-EGEIXA2Z.js}

@@ -293,8 +293,33 @@ function writeSkillManifestEntries(manifestPath, entries) {
   );
 }
 
+// src/commands/sync/validation.ts
+var SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var MCP_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+function isValidSkillSlug(slug) {
+  return slug.length > 0 && slug.length <= 48 && SKILL_SLUG_RE.test(slug);
+}
+function assertValidSkillSlug(slug) {
+  if (!isValidSkillSlug(slug)) {
+    throw new Error(
+      `Invalid Skill slug: ${slug}. Skill slugs may only contain lowercase letters, digits, and non-consecutive hyphens (-), must be at most 48 characters, and must not start or end with a hyphen`
+    );
+  }
+}
+function isValidMcpName(name) {
+  return name.length >= 2 && name.length <= 64 && MCP_NAME_RE.test(name);
+}
+function assertValidMcpName(name) {
+  if (!isValidMcpName(name)) {
+    throw new Error(
+      `Invalid MCP name: ${name}. MCP names may only contain letters, digits, underscores, and hyphens, must be 2-64 characters, and must start with a letter`
+    );
+  }
+}
+
 // src/commands/sync/scanners.ts
 var SECRET_PATTERN = /TOKEN|SECRET|KEY|PASSWORD/i;
+var MCP_MANIFEST_FILE = ".mcp-manifest.json";
 function safeLstat(p) {
   try {
     return lstatSync(p);
@@ -360,6 +385,7 @@ function scanSkillsInDir(dir, source, workspacePath) {
     if (!isDir) continue;
     const filePath = join(slugDir, "SKILL.md");
     if (!existsSync2(filePath)) continue;
+    assertValidSkillSlug(slug);
     const file = readSkillFile(filePath);
     if (!file) continue;
     out.push({
@@ -389,23 +415,42 @@ function readJsonSafe(p) {
     return null;
   }
 }
+function isMcpManifestScope(value) {
+  return value === "personal" || value === "company" || value === "system";
+}
+function readMcpManifestScopes(workspaceDir) {
+  const parsed = readJsonSafe(join(workspaceDir, MCP_MANIFEST_FILE));
+  const scopes = /* @__PURE__ */ new Map();
+  if (!Array.isArray(parsed)) return scopes;
+  for (const item of parsed) {
+    if (!item || typeof item !== "object") continue;
+    const entry = item;
+    if (typeof entry.name !== "string" || !isMcpManifestScope(entry.scope)) continue;
+    if (scopes.has(entry.name)) continue;
+    scopes.set(entry.name, entry.scope);
+  }
+  return scopes;
+}
 function detectSecrets(env) {
   if (!env) return false;
   return Object.keys(env).some((k) => SECRET_PATTERN.test(k));
 }
-function parseMcpServers(servers, source, workspacePath, options = { filterScope: true }) {
+function parseMcpServers(servers, source, workspacePath, workspaceDir, options = {}) {
   if (!servers || typeof servers !== "object") return [];
   const out = [];
   for (const [slug, raw] of Object.entries(servers)) {
     if (!raw || typeof raw !== "object") continue;
-    if (options.filterScope && (raw._scope === "system" || raw._scope === "company")) continue;
-    const transport = raw.type === "http" || raw.transport === "http" || typeof raw.url === "string" ? "http" : "stdio";
+    if (options.excludedNames?.has(slug)) continue;
+    assertValidMcpName(slug);
+    const rawTransport = raw.transport ?? raw.type;
+    const transport = rawTransport === "sse" ? "sse" : rawTransport === "http" || typeof raw.url === "string" ? "http" : "stdio";
     const env = raw.env && typeof raw.env === "object" ? raw.env : void 0;
     const headers = raw.headers && typeof raw.headers === "object" ? raw.headers : void 0;
     out.push({
       slug,
       source,
       workspacePath,
+      workspaceDir,
       transport,
       url: typeof raw.url === "string" ? raw.url : void 0,
       command: typeof raw.command === "string" ? raw.command : void 0,
@@ -444,21 +489,45 @@ function scanMcps() {
   if (!workspace) return [];
   const out = [];
   const scopedMcpJson = readJsonSafe(join(workspace.dir, ".mcp.json"));
-  out.push(...parseMcpServers(scopedMcpJson?.mcpServers, "workspace", workspace.name, { filterScope: true }));
+  const projectManifestScopes = readMcpManifestScopes(workspace.dir);
+  const excludedProjectMcps = new Set(
+    [...projectManifestScopes.entries()].filter(([, scope]) => scope === "system" || scope === "company").map(([name]) => name)
+  );
+  out.push(
+    ...parseMcpServers(
+      scopedMcpJson?.mcpServers,
+      "project",
+      workspace.name,
+      workspace.dir,
+      { excludedNames: excludedProjectMcps }
+    )
+  );
   const workspaceClaudeJson = readJsonSafe(join(workspace.dir, ".claude", ".claude.json"));
   out.push(
-    ...parseMcpServers(projectMcpServers(workspaceClaudeJson, workspace.dir), "workspace", workspace.name, {
-      filterScope: false
-    })
+    ...parseMcpServers(
+      projectMcpServers(workspaceClaudeJson, workspace.dir),
+      "local",
+      workspace.name,
+      void 0
+    )
   );
   const globalClaudeJson = readJsonSafe(join(home, ".claude.json"));
   out.push(
-    ...parseMcpServers(projectMcpServers(globalClaudeJson, workspace.dir), "global", void 0, {
-      filterScope: false
-    })
+    ...parseMcpServers(
+      projectMcpServers(globalClaudeJson, workspace.dir),
+      "user",
+      void 0,
+      void 0
+    )
   );
   return out;
 }
+function splitPushableMcps(candidates) {
+  return {
+    supported: candidates.filter((mcp) => mcp.transport === "http" || mcp.transport === "sse"),
+    unsupportedStdio: candidates.filter((mcp) => mcp.transport === "stdio")
+  };
+}
 function describeSource(_c) {
   return void 0;
 }
@@ -471,8 +540,11 @@ export {
   SKILL_MANIFEST_FILE,
   readSkillManifestEntries,
   writeSkillManifestEntries,
+  assertValidSkillSlug,
+  assertValidMcpName,
   getCurrentWorkspace,
   scanSkills,
   scanMcps,
+  splitPushableMcps,
   describeSource
 };

package/dist/{chunk-WCHI7725.js → chunk-GLNZSDKO.js}

@@ -2,9 +2,14 @@ import {
   getAnalysisMappingPathForClusterMode
 } from "./chunk-GSJGPNKK.js";
 import {
-  getToken,
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  getToken
+} from "./chunk-U6TKB3IV.js";
+import {
   loadMcpToken
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-JM34JPCO.js";
 import {
   getActiveHost,
   getFallbackMcpToken,
@@ -13,6 +18,16 @@ import {
 } from "./chunk-SRJIAOBN.js";
 
 // src/core/mcp.ts
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
 var serviceMappingMap = /* @__PURE__ */ new Map();
@@ -178,8 +193,11 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    logger.warn(`MCP request failed (HTTP ${resp.status}) for ${hostUrl}, re-minting token`);
-    if (resp.status === 401 || resp.status === 403) {
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, re-minting token`);
       _mcpTokenCache.delete(hostUrl);
       const fallbackToken = getFallbackMcpToken(hostUrl);
       const newToken = fallbackToken ?? await generateMcpToken(hostUrl);
@@ -193,6 +211,9 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
         headers,
         body: JSON.stringify(body)
       });
+      if (retryResp.status === 403) {
+        throw new PermissionError(await permissionMessage(retryResp));
+      }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);
       }
@@ -236,14 +257,36 @@ async function callMcpTool(url, toolName, args = {}, hostOverride) {
 function parseMcpResult(result) {
   if (result.content.length > 0 && result.content[0].type === "text") {
     const text = result.content[0].text || "";
+    let parsed;
     try {
-      return safeJsonParse(text);
+      parsed = safeJsonParse(text);
     } catch {
       return text;
     }
+    const errMsg = mcpResultErrorMessage(parsed);
+    if (errMsg !== null) {
+      if (/no_auth|auth_error|permission|forbidden|unauthor|\u65e0\u6743/i.test(errMsg)) {
+        throw new PermissionError(errMsg);
+      }
+      throw new Error(errMsg);
+    }
+    return parsed;
   }
   return result;
 }
+function mcpResultErrorMessage(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.success === true || parsed.ok === true) return null;
+  const e = parsed.error;
+  if (typeof e === "string" && e.trim()) return e;
+  if (e && typeof e === "object") {
+    const msg = typeof e.message === "string" && e.message || void 0;
+    const code = typeof e.code === "string" && e.code || void 0;
+    if (msg && code) return `${code}: ${msg}`;
+    if (msg || code) return msg || code;
+  }
+  return null;
+}
 
 export {
   registerMcpMappings,

package/dist/{chunk-LU7SXK4Q.js → chunk-I42JGQ2J.js}

@@ -1,9 +1,11 @@
 import {
-  SecureStoreAuthError,
   clearToken,
   getToken,
   resolveHost
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-U6TKB3IV.js";
+import {
+  SecureStoreAuthError
+} from "./chunk-JM34JPCO.js";
 import {
   logger,
   safeJsonParse

package/dist/{chunk-CAQYQA4R.js → chunk-JM34JPCO.js}

@@ -1,15 +1,9 @@
 import {
-  getActiveHost,
   getConfigDir,
   logger,
-  safeJsonParse,
-  safeReadJsonFile
+  safeJsonParse
 } from "./chunk-SRJIAOBN.js";
 
-// src/core/auth.ts
-import fs2 from "fs";
-import path2 from "path";
-
 // src/core/secure-store.ts
 import crypto from "crypto";
 import fs from "fs";
@@ -235,165 +229,11 @@ var SecureStoreAuthError = class extends Error {
   }
 };
 
-// src/core/auth.ts
-var TOKENS_FILE = path2.join(getConfigDir(), "tokens.json");
-var LEGACY_MCP_TOKENS_FILE = path2.join(getConfigDir(), "mcp-tokens.json");
-var LEGACY_DIR = path2.join(process.env.HOME || "", ".te-mcp");
-(function removeLegacyMcpTokens() {
-  try {
-    if (fs2.existsSync(LEGACY_MCP_TOKENS_FILE)) {
-      fs2.rmSync(LEGACY_MCP_TOKENS_FILE);
-      logger.info("auth: removed legacy mcp-tokens.json (plaintext MCP token file)");
-    }
-  } catch {
-  }
-})();
-function ensureDir() {
-  const dir = getConfigDir();
-  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-}
-function resolveHost(hostOverride) {
-  if (hostOverride) return hostOverride;
-  return getActiveHost();
-}
-async function validateToken(token, hostUrl) {
-  const url = `${hostUrl}/v1/oauth/checkToken`;
-  try {
-    const resp = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({ accessToken: token }).toString()
-    });
-    const respJson = safeJsonParse(await resp.text());
-    return respJson?.return_code === 0;
-  } catch {
-    return false;
-  }
-}
-function loadAllTokens() {
-  try {
-    const legacyTokens = path2.join(LEGACY_DIR, "tokens.json");
-    if (fs2.existsSync(legacyTokens) && !fs2.existsSync(TOKENS_FILE)) {
-      const data = safeReadJsonFile(legacyTokens);
-      const migrated = {};
-      for (const [key, val] of Object.entries(data)) {
-        const url = key.startsWith("http") ? key : `https://${key}`;
-        migrated[url] = val;
-      }
-      ensureDir();
-      fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
-      return migrated;
-    }
-    if (fs2.existsSync(TOKENS_FILE)) {
-      const data = safeReadJsonFile(TOKENS_FILE);
-      let needsMigration = false;
-      const migrated = {};
-      for (const [key, val] of Object.entries(data)) {
-        if (!key.startsWith("http")) {
-          migrated[`https://${key}`] = val;
-          needsMigration = true;
-        } else {
-          migrated[key] = val;
-        }
-      }
-      if (needsMigration) {
-        fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
-        return migrated;
-      }
-      return data;
-    }
-  } catch {
-  }
-  return {};
-}
-function saveAllTokens(tokens) {
-  ensureDir();
-  fs2.writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2));
-  try {
-    fs2.chmodSync(TOKENS_FILE, 384);
-  } catch {
-  }
-}
-function loadToken(hostUrl) {
-  const tokens = loadAllTokens();
-  const entry = tokens[hostUrl];
-  if (!entry || !entry.token) return null;
-  return { host: hostUrl, token: entry.token, updatedAt: entry.updatedAt };
-}
-function saveToken(token, hostUrl) {
-  const tokens = loadAllTokens();
-  tokens[hostUrl] = { token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  saveAllTokens(tokens);
-  logger.info(`Token saved for ${hostUrl}`);
-}
-function clearToken(hostUrl) {
-  const tokens = loadAllTokens();
-  delete tokens[hostUrl];
-  saveAllTokens(tokens);
-}
-function setTokenManual(token, hostUrl) {
-  saveToken(token, hostUrl);
-}
-function getAuthStatus(hostUrl) {
-  if (process.env.TE_TOKEN) {
-    return { authenticated: true, host: hostUrl, source: "env:TE_TOKEN" };
-  }
-  const cached = loadToken(hostUrl);
-  if (cached) {
-    const ageMs = Date.now() - new Date(cached.updatedAt).getTime();
-    const hours = Math.round(ageMs / 36e5);
-    return { authenticated: true, host: hostUrl, tokenAge: `${hours}h ago`, source: "cache" };
-  }
-  return { authenticated: false, host: hostUrl };
-}
-async function getToken(hostUrl) {
-  if (!hostUrl) {
-    throw new Error(
-      `No AE host configured.
-Run: ae-cli config set-host <url>`
-    );
-  }
-  if (process.env.TE_TOKEN) {
-    logger.info("Using token from env:TE_TOKEN");
-    return process.env.TE_TOKEN;
-  }
-  const cached = loadToken(hostUrl);
-  if (cached && cached.token) {
-    logger.info(`Using cached token for ${hostUrl}`);
-    return cached.token;
-  }
-  try {
-    const secureToken = await getValidAccessToken(hostUrl);
-    logger.info(`Using secure-store token for ${hostUrl}`);
-    return secureToken;
-  } catch (e) {
-    if (e instanceof SecureStoreAuthError) {
-      logger.info(`secure-store: ${e.message}`);
-    } else {
-      logger.warn(`secure-store unexpected error: ${e.message}`);
-    }
-  }
-  throw new Error(
-    `Cannot obtain token for ${hostUrl}.
-Options:
-  1. ae-cli auth login   (device code flow, cross-platform)
-  2. ae-cli auth set-token <token>
-  3. export TE_TOKEN=<token>  (CI/headless)`
-  );
-}
-
 export {
   save,
   load,
   clear,
+  getValidAccessToken,
   loadMcpToken,
-  SecureStoreAuthError,
-  resolveHost,
-  validateToken,
-  loadToken,
-  saveToken,
-  clearToken,
-  setTokenManual,
-  getAuthStatus,
-  getToken
+  SecureStoreAuthError
 };

package/dist/chunk-NOO24N7W.js

@@ -0,0 +1,11 @@
+// src/core/errors.ts
+var PermissionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PermissionError";
+  }
+};
+
+export {
+  PermissionError
+};

package/dist/chunk-SF3KTPIC.js

@@ -0,0 +1,98 @@
+import {
+  getMcpToken
+} from "./chunk-GLNZSDKO.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  safeJsonParse
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/mcp-access.ts
+function buildUrl(host, path, params = {}) {
+  const base = host.replace(/\/$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  const url = new URL(`${base}${p}`);
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function parseKbResponse(resp, text) {
+  if (resp.status === 403) {
+    let msg = "Permission denied for this resource (HTTP 403)";
+    try {
+      const d = safeJsonParse(text);
+      const m = d && (typeof d.error === "string" ? d.error : d.error?.message || d.message);
+      if (m && typeof m === "string") msg = m;
+    } catch {
+    }
+    throw new PermissionError(msg);
+  }
+  if (resp.status === 401) {
+    throw new Error(
+      `KB MCP token auth failed: HTTP ${resp.status} ${resp.statusText}`
+    );
+  }
+  const data = safeJsonParse(text);
+  if (data.return_code === -1001) {
+    throw new Error(
+      `KB MCP token auth failed: ${data.return_message || "unauthorized"} (code: ${data.return_code})`
+    );
+  }
+  if (data.return_code !== 0 && data.return_code !== void 0) {
+    throw new Error(
+      `AE API error: ${data.return_message || "unknown"} (code: ${data.return_code})`
+    );
+  }
+  if (data && typeof data === "object" && typeof data.error === "string" && data.error.trim() && data.return_code === void 0 && data.success === void 0) {
+    throw new Error(data.error);
+  }
+  return data.data !== void 0 ? data.data : data;
+}
+async function fetchWithMcpToken(input, init, mcpToken) {
+  const headers = new Headers(init.headers);
+  headers.set("mcp-token", mcpToken);
+  const resp = await fetch(input, { ...init, headers });
+  return parseKbResponse(resp, await resp.text());
+}
+async function getAuthHeaders(ctx) {
+  const mcpToken = await getMcpToken(ctx.host());
+  return { "mcp-token": mcpToken };
+}
+async function kbApi(ctx, method, path, params = {}, body) {
+  const host = ctx.host();
+  const mcpToken = await getMcpToken(host);
+  const upperMethod = method.toUpperCase();
+  return fetchWithMcpToken(
+    buildUrl(host, path, params),
+    {
+      method: upperMethod,
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
+    },
+    mcpToken
+  );
+}
+async function kbUpload(ctx, path, form, params = {}) {
+  const host = ctx.host();
+  const mcpToken = await getMcpToken(host);
+  return fetchWithMcpToken(
+    buildUrl(host, path, params),
+    {
+      method: "POST",
+      body: form
+    },
+    mcpToken
+  );
+}
+
+export {
+  getAuthHeaders,
+  kbApi,
+  kbUpload
+};