@thinkingai/ae-cli 1.0.28 → 6.0.16

package/README.md

@@ -31,24 +31,9 @@ npx skills add ThinkingAIAgenticEngine/ae-cli -g -y
 ## Quick Start
 
 ```bash
-# First run — interactive host setup + auto-login
-ae-cli config
+ae-cli auth login --host xxxxx
 ```
 
-The `config` command opens an interactive terminal UI:
-- First run: prompts you to add a AE host URL and label, then auto-authenticates
-- Subsequent runs: shows all configured hosts, lets you switch, edit, delete, or add new ones
-
-```
-AE Host Manager  (↑↓ select · Enter switch · e edit label · d delete · a add · q quit)
-
-❯ ● Production  https://ta.thinkingdata.cn  ✓
-  ○ Staging     https://ta-staging.example.com:8080  ✗
-  + Add new host...
-```
-
-After selecting a host, ae-cli automatically checks if the token is valid. If not, it triggers `auth login` for you.
-
 ## Usage
 
 ```bash

package/README.zh.md

@@ -31,24 +31,9 @@ npx skills add ThinkingAIAgenticEngine/ae-cli -g -y
 ## 快速开始
 
 ```bash
-# 首次运行 — 交互式主机配置 + 自动登录
-ae-cli config
+ae-cli auth login --host xxxxx
 ```
 
-`config` 命令会打开一个交互式终端界面：
-- 首次运行：提示您添加 AE 主机 URL 和标签，然后自动进行身份验证
-- 后续运行：显示所有已配置的主机，可以切换、编辑、删除或添加新主机
-
-```
-AE Host Manager  (↑↓ 选择 · Enter 切换 · e 编辑标签 · d 删除 · a 添加 · q 退出)
-
-❯ ● Production  https://ta.thinkingdata.cn  ✓
-  ○ Staging     https://ta-staging.example.com:8080  ✗
-  + Add new host...
-```
-
-选择主机后，ae-cli 会自动检查 token 是否有效。如果无效，会自动触发 `auth login`。
-
 ## 使用方法
 
 ```bash

package/dist/{auth-H2376DEF.js → auth-DYC2BGLM.js}

@@ -7,8 +7,8 @@ import {
   saveToken,
   setTokenManual,
   validateToken
-} from "./chunk-CAQYQA4R.js";
-import "./chunk-SRJIAOBN.js";
+} from "./chunk-RSHMZ3LG.js";
+import "./chunk-6W4QOZAL.js";
 export {
   clearToken,
   getAuthStatus,

package/dist/{auth-5NSDQFQB.js → auth-GHBMJ5ZR.js}

@@ -1,13 +1,14 @@
 import {
   printError,
   printOutput
-} from "./chunk-CLJF7MQA.js";
+} from "./chunk-2DUEAXV3.js";
 import {
   clearMcpToken,
   setMcpTokenManual,
   validateMcpToken
-} from "./chunk-WCHI7725.js";
-import "./chunk-GSJGPNKK.js";
+} from "./chunk-DMMEPCST.js";
+import "./chunk-PN3OS34E.js";
+import "./chunk-NOO24N7W.js";
 import {
   clear,
   clearToken,
@@ -17,12 +18,13 @@ import {
   save,
   setTokenManual,
   validateToken
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-RSHMZ3LG.js";
 import {
   loadConfig,
   logger,
+  removeHost,
   saveConfig
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -228,8 +230,21 @@ function sleep(ms) {
 
 // src/commands/auth.ts
 var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function getExplicitAuthHostOverride(program, opts) {
+  return opts.host || program.opts().host;
+}
 function resolveAuthHost(program, opts) {
-  return resolveHost(opts.host || program.opts().host);
+  return resolveHost(getExplicitAuthHostOverride(program, opts));
+}
+function activateHostAfterLogin(host, explicitHostOverride) {
+  if (!explicitHostOverride) return;
+  const config = loadConfig();
+  if (!config.hosts[host]) {
+    config.hosts[host] = { label: host };
+  }
+  config.activeHost = host;
+  saveConfig(config);
+  logger.info(`Active host set to ${host} after login`);
 }
 function persistDeviceTokens(host, tokens) {
   const DEFAULT_EXPIRES_IN = 72e3;
@@ -255,9 +270,7 @@ function loginSummary(host, tokens) {
     mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
   };
 }
-function resolveTeClaudeBase(host) {
-  const override = process.env.TE_CLAUDE_BASE_URL;
-  if (override) return override.replace(/\/+$/, "");
+function resolveLoginTeClaudeBase(host) {
   const base = host.replace(/\/+$/, "");
   const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
   return base.endsWith(basePath) ? base : base + basePath;
@@ -265,6 +278,7 @@ function resolveTeClaudeBase(host) {
 function registerAuth(program) {
   const auth = program.command("auth").description("Authentication management");
   auth.command("login").description("Log in to AE using the device code flow (cross-platform; --no-browser to print URL only)").option("--host <url>", HOST_OPTION_DESC).option("--no-browser", "Do not auto-open the browser; only print the authorization URL (headless / Linux)").option("--no-wait", "Request the device code and print the authorization URL as JSON, then exit without polling (for AI agents / split-flow). Resume with --device-code").option("--device-code <code>", "Resume a split-flow login: poll for the given device code until authorized, then save the token").action(async (opts) => {
+    const explicitHost = getExplicitAuthHostOverride(program, opts);
     const host = resolveAuthHost(program, opts);
     if (!host) {
       printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
@@ -283,13 +297,14 @@ function registerAuth(program) {
     }
     const noBrowser = !opts.browser;
     const fmt = program.opts().format || "json";
-    const teClaudeBase = resolveTeClaudeBase(host);
+    const teClaudeBase = resolveLoginTeClaudeBase(host);
     const emit = (msg) => process.stderr.write(`[ae-cli] ${msg}
 `);
     try {
       if (opts.deviceCode) {
         const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
         persistDeviceTokens(host, tokens2);
+        activateHostAfterLogin(host, explicitHost);
         logger.info(`Device flow login successful for ${host} (resumed)`);
         emit("Login successful! Token saved securely.");
         printOutput(loginSummary(host, tokens2), fmt);
@@ -312,6 +327,7 @@ function registerAuth(program) {
       }
       const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
       persistDeviceTokens(host, tokens);
+      activateHostAfterLogin(host, explicitHost);
       logger.info(`Device flow login successful for ${host}`);
       emit("Login successful! Token saved securely.");
       printOutput(loginSummary(host, tokens), fmt);
@@ -396,7 +412,8 @@ function registerAuth(program) {
     }
     clearToken(host);
     clear(host);
-    process.stderr.write(`[ae-cli] Token cleared for ${host}
+    removeHost(host);
+    process.stderr.write(`[ae-cli] Token and config cleared for ${host}
 `);
     printOutput({ cleared: true, host }, program.opts().format || "json");
   });
@@ -450,5 +467,7 @@ function registerAuth(program) {
   });
 }
 export {
-  registerAuth
+  activateHostAfterLogin,
+  registerAuth,
+  resolveLoginTeClaudeBase
 };

package/dist/{chunk-CLJF7MQA.js → chunk-2DUEAXV3.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/framework/output.ts
 import Table from "cli-table3";

package/dist/chunk-5OC7CYCG.js

@@ -0,0 +1,98 @@
+import {
+  getMcpToken
+} from "./chunk-DMMEPCST.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  safeJsonParse
+} from "./chunk-6W4QOZAL.js";
+
+// src/core/mcp-access.ts
+function buildUrl(host, path, params = {}) {
+  const base = host.replace(/\/$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  const url = new URL(`${base}${p}`);
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function parseKbResponse(resp, text) {
+  if (resp.status === 403) {
+    let msg = "Permission denied for this resource (HTTP 403)";
+    try {
+      const d = safeJsonParse(text);
+      const m = d && (typeof d.error === "string" ? d.error : d.error?.message || d.message);
+      if (m && typeof m === "string") msg = m;
+    } catch {
+    }
+    throw new PermissionError(msg);
+  }
+  if (resp.status === 401) {
+    throw new Error(
+      `KB MCP token auth failed: HTTP ${resp.status} ${resp.statusText}`
+    );
+  }
+  const data = safeJsonParse(text);
+  if (data.return_code === -1001) {
+    throw new Error(
+      `KB MCP token auth failed: ${data.return_message || "unauthorized"} (code: ${data.return_code})`
+    );
+  }
+  if (data.return_code !== 0 && data.return_code !== void 0) {
+    throw new Error(
+      `AE API error: ${data.return_message || "unknown"} (code: ${data.return_code})`
+    );
+  }
+  if (data && typeof data === "object" && typeof data.error === "string" && data.error.trim() && data.return_code === void 0 && data.success === void 0) {
+    throw new Error(data.error);
+  }
+  return data.data !== void 0 ? data.data : data;
+}
+async function fetchWithMcpToken(input, init, mcpToken) {
+  const headers = new Headers(init.headers);
+  headers.set("mcp-token", mcpToken);
+  const resp = await fetch(input, { ...init, headers });
+  return parseKbResponse(resp, await resp.text());
+}
+async function getAuthHeaders(ctx) {
+  const mcpToken = await getMcpToken(ctx.host());
+  return { "mcp-token": mcpToken };
+}
+async function kbApi(ctx, method, path, params = {}, body) {
+  const host = ctx.host();
+  const mcpToken = await getMcpToken(host);
+  const upperMethod = method.toUpperCase();
+  return fetchWithMcpToken(
+    buildUrl(host, path, params),
+    {
+      method: upperMethod,
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
+    },
+    mcpToken
+  );
+}
+async function kbUpload(ctx, path, form, params = {}) {
+  const host = ctx.host();
+  const mcpToken = await getMcpToken(host);
+  return fetchWithMcpToken(
+    buildUrl(host, path, params),
+    {
+      method: "POST",
+      body: form
+    },
+    mcpToken
+  );
+}
+
+export {
+  getAuthHeaders,
+  kbApi,
+  kbUpload
+};

package/dist/{chunk-SRJIAOBN.js → chunk-6W4QOZAL.js}

@@ -224,6 +224,15 @@ function assertUniqueHostLabel(config, label, excludeUrl) {
     throw new Error(`Label already exists: ${label}. Rename the existing label first: ${duplicate[0]}`);
   }
 }
+function removeHost(url) {
+  const config = loadConfig();
+  delete config.hosts[url];
+  if (config.activeHost === url) {
+    const remaining = Object.keys(config.hosts);
+    config.activeHost = remaining.length > 0 ? remaining[0] : "";
+  }
+  saveConfig(config);
+}
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -240,5 +249,6 @@ export {
   getActiveHost,
   setActiveHost,
   addHost,
+  removeHost,
   getConfigDir
 };

package/dist/{chunk-LU7SXK4Q.js → chunk-BJX3GXWC.js}

@@ -3,11 +3,11 @@ import {
   clearToken,
   getToken,
   resolveHost
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-RSHMZ3LG.js";
 import {
   logger,
   safeJsonParse
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/client.ts
 import WebSocket from "ws";

package/dist/{chunk-WCHI7725.js → chunk-DMMEPCST.js}

@@ -1,18 +1,31 @@
 import {
   getAnalysisMappingPathForClusterMode
-} from "./chunk-GSJGPNKK.js";
+} from "./chunk-PN3OS34E.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
 import {
   getToken,
   loadMcpToken
-} from "./chunk-CAQYQA4R.js";
+} from "./chunk-RSHMZ3LG.js";
 import {
   getActiveHost,
   getFallbackMcpToken,
   logger,
   safeJsonParse
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/mcp.ts
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
 var serviceMappingMap = /* @__PURE__ */ new Map();
@@ -178,8 +191,11 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    logger.warn(`MCP request failed (HTTP ${resp.status}) for ${hostUrl}, re-minting token`);
-    if (resp.status === 401 || resp.status === 403) {
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, re-minting token`);
       _mcpTokenCache.delete(hostUrl);
       const fallbackToken = getFallbackMcpToken(hostUrl);
       const newToken = fallbackToken ?? await generateMcpToken(hostUrl);
@@ -193,6 +209,9 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
         headers,
         body: JSON.stringify(body)
       });
+      if (retryResp.status === 403) {
+        throw new PermissionError(await permissionMessage(retryResp));
+      }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);
       }
@@ -236,14 +255,36 @@ async function callMcpTool(url, toolName, args = {}, hostOverride) {
 function parseMcpResult(result) {
   if (result.content.length > 0 && result.content[0].type === "text") {
     const text = result.content[0].text || "";
+    let parsed;
     try {
-      return safeJsonParse(text);
+      parsed = safeJsonParse(text);
     } catch {
       return text;
     }
+    const errMsg = mcpResultErrorMessage(parsed);
+    if (errMsg !== null) {
+      if (/no_auth|auth_error|permission|forbidden|unauthor|\u65e0\u6743/i.test(errMsg)) {
+        throw new PermissionError(errMsg);
+      }
+      throw new Error(errMsg);
+    }
+    return parsed;
   }
   return result;
 }
+function mcpResultErrorMessage(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.success === true || parsed.ok === true) return null;
+  const e = parsed.error;
+  if (typeof e === "string" && e.trim()) return e;
+  if (e && typeof e === "object") {
+    const msg = typeof e.message === "string" && e.message || void 0;
+    const code = typeof e.code === "string" && e.code || void 0;
+    if (msg && code) return `${code}: ${msg}`;
+    if (msg || code) return msg || code;
+  }
+  return null;
+}
 
 export {
   registerMcpMappings,

package/dist/{chunk-IMBKVXKY.js → chunk-EGEIXA2Z.js}

@@ -293,8 +293,33 @@ function writeSkillManifestEntries(manifestPath, entries) {
   );
 }
 
+// src/commands/sync/validation.ts
+var SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var MCP_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+function isValidSkillSlug(slug) {
+  return slug.length > 0 && slug.length <= 48 && SKILL_SLUG_RE.test(slug);
+}
+function assertValidSkillSlug(slug) {
+  if (!isValidSkillSlug(slug)) {
+    throw new Error(
+      `Invalid Skill slug: ${slug}. Skill slugs may only contain lowercase letters, digits, and non-consecutive hyphens (-), must be at most 48 characters, and must not start or end with a hyphen`
+    );
+  }
+}
+function isValidMcpName(name) {
+  return name.length >= 2 && name.length <= 64 && MCP_NAME_RE.test(name);
+}
+function assertValidMcpName(name) {
+  if (!isValidMcpName(name)) {
+    throw new Error(
+      `Invalid MCP name: ${name}. MCP names may only contain letters, digits, underscores, and hyphens, must be 2-64 characters, and must start with a letter`
+    );
+  }
+}
+
 // src/commands/sync/scanners.ts
 var SECRET_PATTERN = /TOKEN|SECRET|KEY|PASSWORD/i;
+var MCP_MANIFEST_FILE = ".mcp-manifest.json";
 function safeLstat(p) {
   try {
     return lstatSync(p);
@@ -360,6 +385,7 @@ function scanSkillsInDir(dir, source, workspacePath) {
     if (!isDir) continue;
     const filePath = join(slugDir, "SKILL.md");
     if (!existsSync2(filePath)) continue;
+    assertValidSkillSlug(slug);
     const file = readSkillFile(filePath);
     if (!file) continue;
     out.push({
@@ -389,23 +415,42 @@ function readJsonSafe(p) {
     return null;
   }
 }
+function isMcpManifestScope(value) {
+  return value === "personal" || value === "company" || value === "system";
+}
+function readMcpManifestScopes(workspaceDir) {
+  const parsed = readJsonSafe(join(workspaceDir, MCP_MANIFEST_FILE));
+  const scopes = /* @__PURE__ */ new Map();
+  if (!Array.isArray(parsed)) return scopes;
+  for (const item of parsed) {
+    if (!item || typeof item !== "object") continue;
+    const entry = item;
+    if (typeof entry.name !== "string" || !isMcpManifestScope(entry.scope)) continue;
+    if (scopes.has(entry.name)) continue;
+    scopes.set(entry.name, entry.scope);
+  }
+  return scopes;
+}
 function detectSecrets(env) {
   if (!env) return false;
   return Object.keys(env).some((k) => SECRET_PATTERN.test(k));
 }
-function parseMcpServers(servers, source, workspacePath, options = { filterScope: true }) {
+function parseMcpServers(servers, source, workspacePath, workspaceDir, options = {}) {
   if (!servers || typeof servers !== "object") return [];
   const out = [];
   for (const [slug, raw] of Object.entries(servers)) {
     if (!raw || typeof raw !== "object") continue;
-    if (options.filterScope && (raw._scope === "system" || raw._scope === "company")) continue;
-    const transport = raw.type === "http" || raw.transport === "http" || typeof raw.url === "string" ? "http" : "stdio";
+    if (options.excludedNames?.has(slug)) continue;
+    assertValidMcpName(slug);
+    const rawTransport = raw.transport ?? raw.type;
+    const transport = rawTransport === "sse" ? "sse" : rawTransport === "http" || typeof raw.url === "string" ? "http" : "stdio";
     const env = raw.env && typeof raw.env === "object" ? raw.env : void 0;
     const headers = raw.headers && typeof raw.headers === "object" ? raw.headers : void 0;
     out.push({
       slug,
       source,
       workspacePath,
+      workspaceDir,
       transport,
       url: typeof raw.url === "string" ? raw.url : void 0,
       command: typeof raw.command === "string" ? raw.command : void 0,
@@ -444,21 +489,45 @@ function scanMcps() {
   if (!workspace) return [];
   const out = [];
   const scopedMcpJson = readJsonSafe(join(workspace.dir, ".mcp.json"));
-  out.push(...parseMcpServers(scopedMcpJson?.mcpServers, "workspace", workspace.name, { filterScope: true }));
+  const projectManifestScopes = readMcpManifestScopes(workspace.dir);
+  const excludedProjectMcps = new Set(
+    [...projectManifestScopes.entries()].filter(([, scope]) => scope === "system" || scope === "company").map(([name]) => name)
+  );
+  out.push(
+    ...parseMcpServers(
+      scopedMcpJson?.mcpServers,
+      "project",
+      workspace.name,
+      workspace.dir,
+      { excludedNames: excludedProjectMcps }
+    )
+  );
   const workspaceClaudeJson = readJsonSafe(join(workspace.dir, ".claude", ".claude.json"));
   out.push(
-    ...parseMcpServers(projectMcpServers(workspaceClaudeJson, workspace.dir), "workspace", workspace.name, {
-      filterScope: false
-    })
+    ...parseMcpServers(
+      projectMcpServers(workspaceClaudeJson, workspace.dir),
+      "local",
+      workspace.name,
+      void 0
+    )
   );
   const globalClaudeJson = readJsonSafe(join(home, ".claude.json"));
   out.push(
-    ...parseMcpServers(projectMcpServers(globalClaudeJson, workspace.dir), "global", void 0, {
-      filterScope: false
-    })
+    ...parseMcpServers(
+      projectMcpServers(globalClaudeJson, workspace.dir),
+      "user",
+      void 0,
+      void 0
+    )
   );
   return out;
 }
+function splitPushableMcps(candidates) {
+  return {
+    supported: candidates.filter((mcp) => mcp.transport === "http" || mcp.transport === "sse"),
+    unsupportedStdio: candidates.filter((mcp) => mcp.transport === "stdio")
+  };
+}
 function describeSource(_c) {
   return void 0;
 }
@@ -471,8 +540,11 @@ export {
   SKILL_MANIFEST_FILE,
   readSkillManifestEntries,
   writeSkillManifestEntries,
+  assertValidSkillSlug,
+  assertValidMcpName,
   getCurrentWorkspace,
   scanSkills,
   scanMcps,
+  splitPushableMcps,
   describeSource
 };