@thinkingai/ae-cli 1.0.28 → 1.0.30

package/dist/chunk-U6TKB3IV.js

@@ -0,0 +1,171 @@
+import {
+  SecureStoreAuthError,
+  getValidAccessToken
+} from "./chunk-JM34JPCO.js";
+import {
+  getActiveHost,
+  getConfigDir,
+  logger,
+  safeJsonParse,
+  safeReadJsonFile
+} from "./chunk-SRJIAOBN.js";
+
+// src/core/auth.ts
+import fs from "fs";
+import path from "path";
+var TOKENS_FILE = path.join(getConfigDir(), "tokens.json");
+var LEGACY_MCP_TOKENS_FILE = path.join(getConfigDir(), "mcp-tokens.json");
+var LEGACY_DIR = path.join(process.env.HOME || "", ".te-mcp");
+(function removeLegacyMcpTokens() {
+  try {
+    if (fs.existsSync(LEGACY_MCP_TOKENS_FILE)) {
+      fs.rmSync(LEGACY_MCP_TOKENS_FILE);
+      logger.info("auth: removed legacy mcp-tokens.json (plaintext MCP token file)");
+    }
+  } catch {
+  }
+})();
+function ensureDir() {
+  const dir = getConfigDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+}
+function resolveHost(hostOverride) {
+  if (hostOverride) return hostOverride;
+  return getActiveHost();
+}
+async function validateToken(token, hostUrl) {
+  const url = `${hostUrl}/v1/oauth/checkToken`;
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ accessToken: token }).toString()
+    });
+    const respJson = safeJsonParse(await resp.text());
+    return respJson?.return_code === 0;
+  } catch {
+    return false;
+  }
+}
+function loadAllTokens() {
+  try {
+    const legacyTokens = path.join(LEGACY_DIR, "tokens.json");
+    if (fs.existsSync(legacyTokens) && !fs.existsSync(TOKENS_FILE)) {
+      const data = safeReadJsonFile(legacyTokens);
+      const migrated = {};
+      for (const [key, val] of Object.entries(data)) {
+        const url = key.startsWith("http") ? key : `https://${key}`;
+        migrated[url] = val;
+      }
+      ensureDir();
+      fs.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
+      return migrated;
+    }
+    if (fs.existsSync(TOKENS_FILE)) {
+      const data = safeReadJsonFile(TOKENS_FILE);
+      let needsMigration = false;
+      const migrated = {};
+      for (const [key, val] of Object.entries(data)) {
+        if (!key.startsWith("http")) {
+          migrated[`https://${key}`] = val;
+          needsMigration = true;
+        } else {
+          migrated[key] = val;
+        }
+      }
+      if (needsMigration) {
+        fs.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
+        return migrated;
+      }
+      return data;
+    }
+  } catch {
+  }
+  return {};
+}
+function saveAllTokens(tokens) {
+  ensureDir();
+  fs.writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2));
+  try {
+    fs.chmodSync(TOKENS_FILE, 384);
+  } catch {
+  }
+}
+function loadToken(hostUrl) {
+  const tokens = loadAllTokens();
+  const entry = tokens[hostUrl];
+  if (!entry || !entry.token) return null;
+  return { host: hostUrl, token: entry.token, updatedAt: entry.updatedAt };
+}
+function saveToken(token, hostUrl) {
+  const tokens = loadAllTokens();
+  tokens[hostUrl] = { token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  saveAllTokens(tokens);
+  logger.info(`Token saved for ${hostUrl}`);
+}
+function clearToken(hostUrl) {
+  const tokens = loadAllTokens();
+  delete tokens[hostUrl];
+  saveAllTokens(tokens);
+}
+function setTokenManual(token, hostUrl) {
+  saveToken(token, hostUrl);
+}
+function getAuthStatus(hostUrl) {
+  if (process.env.TE_TOKEN) {
+    return { authenticated: true, host: hostUrl, source: "env:TE_TOKEN" };
+  }
+  const cached = loadToken(hostUrl);
+  if (cached) {
+    const ageMs = Date.now() - new Date(cached.updatedAt).getTime();
+    const hours = Math.round(ageMs / 36e5);
+    return { authenticated: true, host: hostUrl, tokenAge: `${hours}h ago`, source: "cache" };
+  }
+  return { authenticated: false, host: hostUrl };
+}
+async function getToken(hostUrl) {
+  if (!hostUrl) {
+    throw new Error(
+      `No AE host configured.
+Run: ae-cli config set-host <url>`
+    );
+  }
+  if (process.env.TE_TOKEN) {
+    logger.info("Using token from env:TE_TOKEN");
+    return process.env.TE_TOKEN;
+  }
+  const cached = loadToken(hostUrl);
+  if (cached && cached.token) {
+    logger.info(`Using cached token for ${hostUrl}`);
+    return cached.token;
+  }
+  try {
+    const secureToken = await getValidAccessToken(hostUrl);
+    logger.info(`Using secure-store token for ${hostUrl}`);
+    return secureToken;
+  } catch (e) {
+    if (e instanceof SecureStoreAuthError) {
+      logger.info(`secure-store: ${e.message}`);
+    } else {
+      logger.warn(`secure-store unexpected error: ${e.message}`);
+    }
+  }
+  throw new Error(
+    `Cannot obtain token for ${hostUrl}.
+Options:
+  1. ae-cli auth login   (device code flow, cross-platform)
+  2. ae-cli auth set-token <token>
+  3. export TE_TOKEN=<token>  (CI/headless)`
+  );
+}
+
+export {
+  resolveHost,
+  validateToken,
+  loadToken,
+  saveToken,
+  clearToken,
+  setTokenManual,
+  getAuthStatus,
+  getToken
+};

package/dist/{chunk-AD5V3ZPJ.js → chunk-VJFUB3H3.js}

@@ -1,11 +1,98 @@
 import {
-  TeAgentCredentialsError,
-  tryLoadTeAgentSandboxCredentials
-} from "./chunk-KAEZTSXN.js";
-import {
-  getActiveHost
+  getActiveHost,
+  getSandboxRuntimeRoot
 } from "./chunk-SRJIAOBN.js";
 
+// src/core/te-agent-credentials.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function getCredentialsPath() {
+  return join(process.env.HOME || homedir(), ".te-agent", "credentials.json");
+}
+function getPersistentEnvPath() {
+  return join(getSandboxRuntimeRoot(), ".env");
+}
+function parseDotEnv(raw) {
+  const result = {};
+  for (const line of raw.split("\n")) {
+    if (/^\s*#/.test(line) || line.trim() === "") continue;
+    const match = /^\s*([^=]+)=(.*)$/.exec(line);
+    if (!match) continue;
+    const key = match[1].trim();
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1).replace(/\\"/g, '"');
+    }
+    if (value !== "") result[key] = value;
+  }
+  return result;
+}
+function readPersistentEnv() {
+  const envPath = getPersistentEnvPath();
+  try {
+    const raw = readFileSync(envPath, "utf8");
+    return parseDotEnv(raw);
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    throw new TeAgentCredentialsError(
+      `Failed to read ${envPath}: ${err?.message ?? err}`,
+      "Check file permissions, or inject runtime credentials via TE_CLAUDE_BASE_URL / SANDBOX_ID / SECRET_KEY"
+    );
+  }
+}
+var TeAgentCredentialsError = class extends Error {
+  constructor(message, hint) {
+    super(message);
+    this.hint = hint;
+    this.name = "TeAgentCredentialsError";
+  }
+  hint;
+};
+function readLegacyCredentials() {
+  const credPath = getCredentialsPath();
+  try {
+    const raw = readFileSync(credPath, "utf8");
+    const parsed = JSON.parse(raw);
+    const main = parsed?.mainApp;
+    return main && typeof main === "object" ? main : null;
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    if (err instanceof SyntaxError) {
+      throw new TeAgentCredentialsError(
+        `Failed to parse ${credPath}: ${err.message}`,
+        "The credentials file may be corrupted; alternatively inject runtime credentials via TE_CLAUDE_BASE_URL / SANDBOX_ID / SECRET_KEY"
+      );
+    }
+    throw new TeAgentCredentialsError(
+      `Failed to read ${credPath}: ${err?.message ?? err}`,
+      "Check file permissions, or inject runtime credentials via TE_CLAUDE_BASE_URL / SANDBOX_ID / SECRET_KEY"
+    );
+  }
+}
+function tryLoadTeAgentSandboxCredentials() {
+  const legacy = readLegacyCredentials();
+  const persistent = readPersistentEnv();
+  const url = process.env.TE_CLAUDE_BASE_URL || persistent?.TE_CLAUDE_BASE_URL || legacy?.url;
+  if (typeof url !== "string" || !url) {
+    return null;
+  }
+  const sandboxId = process.env.SANDBOX_ID || persistent?.SANDBOX_ID || legacy?.sandboxId || null;
+  const sandboxSecretKey = process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY || persistent?.SECRET_KEY || persistent?.SANDBOX_SECRET_KEY || legacy?.sandboxSecretKey || legacy?.secretKey || null;
+  return {
+    url,
+    sandboxId: typeof sandboxId === "string" ? sandboxId : null,
+    sandboxSecretKey: typeof sandboxSecretKey === "string" ? sandboxSecretKey : null
+  };
+}
+function getClaudeConfigDir() {
+  const fromEnv = process.env.CLAUDE_CONFIG_DIR;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) {
+    return fromEnv;
+  }
+  return join(homedir(), ".claude");
+}
+
 // src/core/te-agent-client.ts
 var TeAgentApiError = class extends Error {
   constructor(message, status, code, body) {
@@ -60,7 +147,7 @@ async function signRequest(method, path, rawBody) {
       rawBody
     };
   }
-  const { getToken } = await import("./auth-H2376DEF.js");
+  const { getToken } = await import("./auth-U25QJU5D.js");
   const baseUrl = sandboxCred?.url || teClaudeBaseFromActiveHost();
   if (!baseUrl) {
     throw new TeAgentCredentialsError(
@@ -147,8 +234,7 @@ async function postSandboxSyncPull(args) {
     kind: args.kind,
     skills: args.skills,
     mcp: args.mcp,
-    mode: "merge",
-    ifUnmodifiedSince: args.ifUnmodifiedSince
+    mode: "merge"
   });
 }
 async function deleteFromMainApp(path) {
@@ -180,7 +266,7 @@ async function uploadToMainApp(path, formData) {
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
   } else {
-    const { getToken } = await import("./auth-H2376DEF.js");
+    const { getToken } = await import("./auth-U25QJU5D.js");
     baseUrl = (sandboxCred?.url || teClaudeBaseFromActiveHost() || "").replace(/\/$/, "");
     if (!baseUrl) {
       throw new TeAgentCredentialsError(
@@ -204,6 +290,8 @@ async function uploadToMainApp(path, formData) {
 }
 
 export {
+  TeAgentCredentialsError,
+  getClaudeConfigDir,
   TeAgentApiError,
   postToMainApp,
   getFromMainApp,

package/dist/{client-FCMK3XEK.js → client-IN42F223.js}

@@ -7,8 +7,9 @@ import {
   queryReportData,
   querySql,
   wsQuery
-} from "./chunk-LU7SXK4Q.js";
-import "./chunk-CAQYQA4R.js";
+} from "./chunk-I42JGQ2J.js";
+import "./chunk-U6TKB3IV.js";
+import "./chunk-JM34JPCO.js";
 import "./chunk-SRJIAOBN.js";
 export {
   httpDelete,

package/dist/index.js

@@ -1,10 +1,17 @@
 import {
+  TeAgentApiError,
   TeAgentCredentialsError
-} from "./chunk-KAEZTSXN.js";
+} from "./chunk-VJFUB3H3.js";
 import {
   printError,
   printOutput
 } from "./chunk-CLJF7MQA.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  SecureStoreAuthError
+} from "./chunk-JM34JPCO.js";
 import {
   getActiveHost,
   logger,
@@ -57,21 +64,36 @@ async function runCommand(cmd, opts, globalOpts) {
     logger.error(`Command failed: ${message}`);
     if (err instanceof TeAgentCredentialsError) {
       printError("config", message, err.hint);
-    } else if (message.includes("token") || message.includes("auth") || message.includes("401") || message.includes("403")) {
+    } else if (err instanceof PermissionError) {
+      printError("permission", message);
+    } else if (err instanceof SecureStoreAuthError) {
+      printError("auth", message, "Run: ae-cli auth login");
+    } else if (err instanceof TeAgentApiError) {
+      if (err.status === 403) {
+        printError("permission", message);
+      } else if (err.status === 401) {
+        printError("auth", message, "Run: ae-cli auth login");
+      } else {
+        printError("api", message);
+      }
+    } else if (looksLikeAuthFailure(message)) {
       printError("auth", message, "Run: ae-cli auth login");
-    } else if (message.includes("AE API error")) {
-      printError("api", message);
     } else {
       printError("api", message);
     }
     process.exit(1);
   }
 }
+function looksLikeAuthFailure(message) {
+  const m = message.toLowerCase();
+  if (m.includes("403") || m.includes("forbidden") || m.includes("permission")) return false;
+  return m.includes("401") || m.includes("unauthorized") || m.includes("session expired") || m.includes("invalid access token") || m.includes("-1001") || m.includes("\u767B\u5F55") || m.includes("ae-cli auth login");
+}
 function createRuntimeContext(cmd, opts, globalOpts) {
   let _clientModule = null;
   async function getClient() {
     if (!_clientModule) {
-      _clientModule = await import("./client-FCMK3XEK.js");
+      _clientModule = await import("./client-IN42F223.js");
     }
     return _clientModule;
   }
@@ -114,7 +136,7 @@ function createRuntimeContext(cmd, opts, globalOpts) {
       return client.queryReportData(projectId, reportId, qp, eventModel, options, ctx.host());
     },
     async token() {
-      const { getToken } = await import("./auth-H2376DEF.js");
+      const { getToken } = await import("./auth-U25QJU5D.js");
       return getToken(ctx.host());
     },
     host() {
@@ -363,52 +385,52 @@ program.name("ae-cli").version(version).description("CLI tool for ThinkingAI (AE
 async function loadCommands() {
   const commands = [];
   try {
-    const teAnalysis = await import("./te-analysis-A2OSGHQ4.js");
+    const teAnalysis = await import("./te-analysis-CB3DA5I5.js");
     commands.push(...teAnalysis.default);
   } catch {
   }
   try {
-    const teAudience = await import("./te-audience-LI67PPGO.js");
+    const teAudience = await import("./te-audience-W7SCQFC7.js");
     commands.push(...teAudience.default);
   } catch {
   }
   try {
-    const teMeta = await import("./te-meta-HBTIEDRO.js");
+    const teMeta = await import("./te-meta-PDKLMWXN.js");
     commands.push(...teMeta.default);
   } catch {
   }
   try {
-    const teCommon = await import("./te-common-35WVU3C5.js");
+    const teCommon = await import("./te-common-FBXVWBSI.js");
     commands.push(...teCommon.default);
   } catch {
   }
   try {
-    const engage = await import("./te-engage-H7C72Z46.js");
+    const engage = await import("./te-engage-KARARMIR.js");
     commands.push(...engage.default);
   } catch {
   }
   try {
-    const community = await import("./te-community-LEAP6PWT.js");
+    const community = await import("./te-community-LNVDZSGW.js");
     commands.push(...community.default);
   } catch {
   }
   try {
-    const dataops = await import("./te-dataops-N2LGZBOX.js");
+    const dataops = await import("./te-dataops-IPCSSWYH.js");
     commands.push(...dataops.default);
   } catch {
   }
   try {
-    const teKb = await import("./te-kb-I2OKTBAI.js");
+    const teKb = await import("./te-kb-2Z2CARN3.js");
     commands.push(...teKb.default);
   } catch {
   }
   try {
-    const teTeam = await import("./te-team-EM5OWRQL.js");
+    const teTeam = await import("./te-team-SW5B7DHO.js");
     commands.push(...teTeam.default);
   } catch {
   }
   try {
-    const teAgent = await import("./te-agent-7U7JLJKU.js");
+    const teAgent = await import("./te-agent-YV4DXEXK.js");
     commands.push(...teAgent.default);
   } catch {
   }
@@ -416,7 +438,7 @@ async function loadCommands() {
 }
 async function registerAuthCommands() {
   try {
-    const { registerAuth } = await import("./auth-5NSDQFQB.js");
+    const { registerAuth } = await import("./auth-H3GJD55A.js");
     registerAuth(program);
   } catch {
   }
@@ -430,21 +452,21 @@ async function registerConfigCommands() {
 }
 async function registerApiCommand() {
   try {
-    const { registerApi } = await import("./raw-VEF3D6UD.js");
+    const { registerApi } = await import("./raw-WJIWC6YP.js");
     registerApi(program);
   } catch {
   }
 }
 async function registerSyncCommand() {
   try {
-    const { registerSync } = await import("./sync-NRODEVNH.js");
+    const { registerSync } = await import("./sync-NVASAISS.js");
     registerSync(program);
   } catch {
   }
 }
 async function registerModelCommand() {
   try {
-    const { registerModel } = await import("./model-EZ6K7FXI.js");
+    const { registerModel } = await import("./model-VZCYNIOG.js");
     registerModel(program);
   } catch {
   }

package/dist/{model-EZ6K7FXI.js → model-VZCYNIOG.js}

@@ -2,16 +2,14 @@ import {
   MultiselectCancelled,
   getCurrentWorkspace,
   promptSingleCheckboxSelect
-} from "./chunk-IMBKVXKY.js";
+} from "./chunk-EGEIXA2Z.js";
 import {
   TeAgentApiError,
+  TeAgentCredentialsError,
+  getClaudeConfigDir,
   getSandboxModels,
   postSandboxModelSelection
-} from "./chunk-AD5V3ZPJ.js";
-import {
-  TeAgentCredentialsError,
-  getClaudeConfigDir
-} from "./chunk-KAEZTSXN.js";
+} from "./chunk-VJFUB3H3.js";
 import "./chunk-SRJIAOBN.js";
 
 // src/commands/model/index.ts

package/dist/{raw-VEF3D6UD.js → raw-WJIWC6YP.js}

@@ -5,11 +5,13 @@ import {
 import {
   httpGet,
   httpPost
-} from "./chunk-LU7SXK4Q.js";
+} from "./chunk-I42JGQ2J.js";
 import {
-  SecureStoreAuthError,
   resolveHost
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-U6TKB3IV.js";
+import {
+  SecureStoreAuthError
+} from "./chunk-JM34JPCO.js";
 import {
   safeJsonParse
 } from "./chunk-SRJIAOBN.js";