@thinkingai/ae-cli 1.0.30 → 6.0.16

package/dist/{auth-U25QJU5D.js → auth-DYC2BGLM.js}

@@ -7,9 +7,8 @@ import {
   saveToken,
   setTokenManual,
   validateToken
-} from "./chunk-U6TKB3IV.js";
-import "./chunk-JM34JPCO.js";
-import "./chunk-SRJIAOBN.js";
+} from "./chunk-RSHMZ3LG.js";
+import "./chunk-6W4QOZAL.js";
 export {
   clearToken,
   getAuthStatus,

package/dist/{auth-H3GJD55A.js → auth-GHBMJ5ZR.js}

@@ -1,31 +1,30 @@
 import {
   printError,
   printOutput
-} from "./chunk-CLJF7MQA.js";
+} from "./chunk-2DUEAXV3.js";
 import {
   clearMcpToken,
   setMcpTokenManual,
   validateMcpToken
-} from "./chunk-GLNZSDKO.js";
-import "./chunk-GSJGPNKK.js";
+} from "./chunk-DMMEPCST.js";
+import "./chunk-PN3OS34E.js";
 import "./chunk-NOO24N7W.js";
 import {
+  clear,
   clearToken,
   getAuthStatus,
+  load,
   resolveHost,
+  save,
   setTokenManual,
   validateToken
-} from "./chunk-U6TKB3IV.js";
-import {
-  clear,
-  load,
-  save
-} from "./chunk-JM34JPCO.js";
+} from "./chunk-RSHMZ3LG.js";
 import {
   loadConfig,
   logger,
+  removeHost,
   saveConfig
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -231,8 +230,21 @@ function sleep(ms) {
 
 // src/commands/auth.ts
 var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function getExplicitAuthHostOverride(program, opts) {
+  return opts.host || program.opts().host;
+}
 function resolveAuthHost(program, opts) {
-  return resolveHost(opts.host || program.opts().host);
+  return resolveHost(getExplicitAuthHostOverride(program, opts));
+}
+function activateHostAfterLogin(host, explicitHostOverride) {
+  if (!explicitHostOverride) return;
+  const config = loadConfig();
+  if (!config.hosts[host]) {
+    config.hosts[host] = { label: host };
+  }
+  config.activeHost = host;
+  saveConfig(config);
+  logger.info(`Active host set to ${host} after login`);
 }
 function persistDeviceTokens(host, tokens) {
   const DEFAULT_EXPIRES_IN = 72e3;
@@ -258,9 +270,7 @@ function loginSummary(host, tokens) {
     mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
   };
 }
-function resolveTeClaudeBase(host) {
-  const override = process.env.TE_CLAUDE_BASE_URL;
-  if (override) return override.replace(/\/+$/, "");
+function resolveLoginTeClaudeBase(host) {
   const base = host.replace(/\/+$/, "");
   const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
   return base.endsWith(basePath) ? base : base + basePath;
@@ -268,6 +278,7 @@ function resolveTeClaudeBase(host) {
 function registerAuth(program) {
   const auth = program.command("auth").description("Authentication management");
   auth.command("login").description("Log in to AE using the device code flow (cross-platform; --no-browser to print URL only)").option("--host <url>", HOST_OPTION_DESC).option("--no-browser", "Do not auto-open the browser; only print the authorization URL (headless / Linux)").option("--no-wait", "Request the device code and print the authorization URL as JSON, then exit without polling (for AI agents / split-flow). Resume with --device-code").option("--device-code <code>", "Resume a split-flow login: poll for the given device code until authorized, then save the token").action(async (opts) => {
+    const explicitHost = getExplicitAuthHostOverride(program, opts);
     const host = resolveAuthHost(program, opts);
     if (!host) {
       printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
@@ -286,13 +297,14 @@ function registerAuth(program) {
     }
     const noBrowser = !opts.browser;
     const fmt = program.opts().format || "json";
-    const teClaudeBase = resolveTeClaudeBase(host);
+    const teClaudeBase = resolveLoginTeClaudeBase(host);
     const emit = (msg) => process.stderr.write(`[ae-cli] ${msg}
 `);
     try {
       if (opts.deviceCode) {
         const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
         persistDeviceTokens(host, tokens2);
+        activateHostAfterLogin(host, explicitHost);
         logger.info(`Device flow login successful for ${host} (resumed)`);
         emit("Login successful! Token saved securely.");
         printOutput(loginSummary(host, tokens2), fmt);
@@ -315,6 +327,7 @@ function registerAuth(program) {
       }
       const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
       persistDeviceTokens(host, tokens);
+      activateHostAfterLogin(host, explicitHost);
       logger.info(`Device flow login successful for ${host}`);
       emit("Login successful! Token saved securely.");
       printOutput(loginSummary(host, tokens), fmt);
@@ -399,7 +412,8 @@ function registerAuth(program) {
     }
     clearToken(host);
     clear(host);
-    process.stderr.write(`[ae-cli] Token cleared for ${host}
+    removeHost(host);
+    process.stderr.write(`[ae-cli] Token and config cleared for ${host}
 `);
     printOutput({ cleared: true, host }, program.opts().format || "json");
   });
@@ -453,5 +467,7 @@ function registerAuth(program) {
   });
 }
 export {
-  registerAuth
+  activateHostAfterLogin,
+  registerAuth,
+  resolveLoginTeClaudeBase
 };

package/dist/{chunk-CLJF7MQA.js → chunk-2DUEAXV3.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/framework/output.ts
 import Table from "cli-table3";

package/dist/{chunk-SF3KTPIC.js → chunk-5OC7CYCG.js}

@@ -1,12 +1,12 @@
 import {
   getMcpToken
-} from "./chunk-GLNZSDKO.js";
+} from "./chunk-DMMEPCST.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
 import {
   safeJsonParse
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {

package/dist/{chunk-SRJIAOBN.js → chunk-6W4QOZAL.js}

@@ -224,6 +224,15 @@ function assertUniqueHostLabel(config, label, excludeUrl) {
     throw new Error(`Label already exists: ${label}. Rename the existing label first: ${duplicate[0]}`);
   }
 }
+function removeHost(url) {
+  const config = loadConfig();
+  delete config.hosts[url];
+  if (config.activeHost === url) {
+    const remaining = Object.keys(config.hosts);
+    config.activeHost = remaining.length > 0 ? remaining[0] : "";
+  }
+  saveConfig(config);
+}
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -240,5 +249,6 @@ export {
   getActiveHost,
   setActiveHost,
   addHost,
+  removeHost,
   getConfigDir
 };

package/dist/{chunk-I42JGQ2J.js → chunk-BJX3GXWC.js}

@@ -1,15 +1,13 @@
 import {
+  SecureStoreAuthError,
   clearToken,
   getToken,
   resolveHost
-} from "./chunk-U6TKB3IV.js";
-import {
-  SecureStoreAuthError
-} from "./chunk-JM34JPCO.js";
+} from "./chunk-RSHMZ3LG.js";
 import {
   logger,
   safeJsonParse
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/client.ts
 import WebSocket from "ws";

package/dist/{chunk-GLNZSDKO.js → chunk-DMMEPCST.js}

@@ -1,21 +1,19 @@
 import {
   getAnalysisMappingPathForClusterMode
-} from "./chunk-GSJGPNKK.js";
+} from "./chunk-PN3OS34E.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
 import {
-  getToken
-} from "./chunk-U6TKB3IV.js";
-import {
+  getToken,
   loadMcpToken
-} from "./chunk-JM34JPCO.js";
+} from "./chunk-RSHMZ3LG.js";
 import {
   getActiveHost,
   getFallbackMcpToken,
   logger,
   safeJsonParse
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/mcp.ts
 async function permissionMessage(resp) {

package/dist/{chunk-VJFUB3H3.js → chunk-I5CRVM2S.js}

@@ -1,7 +1,7 @@
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -147,7 +147,7 @@ async function signRequest(method, path, rawBody) {
       rawBody
     };
   }
-  const { getToken } = await import("./auth-U25QJU5D.js");
+  const { getToken } = await import("./auth-DYC2BGLM.js");
   const baseUrl = sandboxCred?.url || teClaudeBaseFromActiveHost();
   if (!baseUrl) {
     throw new TeAgentCredentialsError(
@@ -266,7 +266,7 @@ async function uploadToMainApp(path, formData) {
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
   } else {
-    const { getToken } = await import("./auth-U25QJU5D.js");
+    const { getToken } = await import("./auth-DYC2BGLM.js");
     baseUrl = (sandboxCred?.url || teClaudeBaseFromActiveHost() || "").replace(/\/$/, "");
     if (!baseUrl) {
       throw new TeAgentCredentialsError(

package/dist/{chunk-GSJGPNKK.js → chunk-PN3OS34E.js}

@@ -2,7 +2,7 @@ import {
   getSandboxClusterInfoFilePath,
   logger,
   safeReadJsonFile
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/core/cluster-info.ts
 import fs from "fs";

package/dist/{chunk-JM34JPCO.js → chunk-RSHMZ3LG.js}

@@ -1,8 +1,14 @@
 import {
+  getActiveHost,
   getConfigDir,
   logger,
-  safeJsonParse
-} from "./chunk-SRJIAOBN.js";
+  safeJsonParse,
+  safeReadJsonFile
+} from "./chunk-6W4QOZAL.js";
+
+// src/core/auth.ts
+import fs2 from "fs";
+import path2 from "path";
 
 // src/core/secure-store.ts
 import crypto from "crypto";
@@ -229,11 +235,179 @@ var SecureStoreAuthError = class extends Error {
   }
 };
 
+// src/core/auth.ts
+var TOKENS_FILE = path2.join(getConfigDir(), "tokens.json");
+var LEGACY_MCP_TOKENS_FILE = path2.join(getConfigDir(), "mcp-tokens.json");
+var LEGACY_DIR = path2.join(process.env.HOME || "", ".te-mcp");
+(function removeLegacyMcpTokens() {
+  try {
+    if (fs2.existsSync(LEGACY_MCP_TOKENS_FILE)) {
+      fs2.rmSync(LEGACY_MCP_TOKENS_FILE);
+      logger.info("auth: removed legacy mcp-tokens.json (plaintext MCP token file)");
+    }
+  } catch {
+  }
+})();
+function ensureDir() {
+  const dir = getConfigDir();
+  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
+}
+function resolveHost(hostOverride) {
+  if (hostOverride) return hostOverride;
+  return getActiveHost();
+}
+async function validateToken(token, hostUrl) {
+  const url = `${hostUrl}/v1/oauth/checkToken`;
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ accessToken: token }).toString()
+    });
+    const respJson = safeJsonParse(await resp.text());
+    return respJson?.return_code === 0;
+  } catch {
+    return false;
+  }
+}
+function loadAllTokens() {
+  try {
+    const legacyTokens = path2.join(LEGACY_DIR, "tokens.json");
+    if (fs2.existsSync(legacyTokens) && !fs2.existsSync(TOKENS_FILE)) {
+      const data = safeReadJsonFile(legacyTokens);
+      const migrated = {};
+      for (const [key, val] of Object.entries(data)) {
+        const url = key.startsWith("http") ? key : `https://${key}`;
+        migrated[url] = val;
+      }
+      ensureDir();
+      fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
+      return migrated;
+    }
+    if (fs2.existsSync(TOKENS_FILE)) {
+      const data = safeReadJsonFile(TOKENS_FILE);
+      if (data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 0) {
+        try {
+          fs2.unlinkSync(TOKENS_FILE);
+        } catch {
+        }
+        return {};
+      }
+      let needsMigration = false;
+      const migrated = {};
+      for (const [key, val] of Object.entries(data)) {
+        if (!key.startsWith("http")) {
+          migrated[`https://${key}`] = val;
+          needsMigration = true;
+        } else {
+          migrated[key] = val;
+        }
+      }
+      if (needsMigration) {
+        fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
+        return migrated;
+      }
+      return data;
+    }
+  } catch {
+  }
+  return {};
+}
+function saveAllTokens(tokens) {
+  ensureDir();
+  if (Object.keys(tokens).length === 0) {
+    try {
+      fs2.unlinkSync(TOKENS_FILE);
+    } catch {
+    }
+    return;
+  }
+  fs2.writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2));
+  try {
+    fs2.chmodSync(TOKENS_FILE, 384);
+  } catch {
+  }
+}
+function loadToken(hostUrl) {
+  const tokens = loadAllTokens();
+  const entry = tokens[hostUrl];
+  if (!entry || !entry.token) return null;
+  return { host: hostUrl, token: entry.token, updatedAt: entry.updatedAt };
+}
+function saveToken(token, hostUrl) {
+  const tokens = loadAllTokens();
+  tokens[hostUrl] = { token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  saveAllTokens(tokens);
+  logger.info(`Token saved for ${hostUrl}`);
+}
+function clearToken(hostUrl) {
+  const tokens = loadAllTokens();
+  delete tokens[hostUrl];
+  saveAllTokens(tokens);
+}
+function setTokenManual(token, hostUrl) {
+  saveToken(token, hostUrl);
+}
+function getAuthStatus(hostUrl) {
+  if (process.env.TE_TOKEN) {
+    return { authenticated: true, host: hostUrl, source: "env:TE_TOKEN" };
+  }
+  const cached = loadToken(hostUrl);
+  if (cached) {
+    const ageMs = Date.now() - new Date(cached.updatedAt).getTime();
+    const hours = Math.round(ageMs / 36e5);
+    return { authenticated: true, host: hostUrl, tokenAge: `${hours}h ago`, source: "cache" };
+  }
+  return { authenticated: false, host: hostUrl };
+}
+async function getToken(hostUrl) {
+  if (!hostUrl) {
+    throw new Error(
+      `No AE host configured.
+Run: ae-cli config set-host <url>`
+    );
+  }
+  if (process.env.TE_TOKEN) {
+    logger.info("Using token from env:TE_TOKEN");
+    return process.env.TE_TOKEN;
+  }
+  const cached = loadToken(hostUrl);
+  if (cached && cached.token) {
+    logger.info(`Using cached token for ${hostUrl}`);
+    return cached.token;
+  }
+  try {
+    const secureToken = await getValidAccessToken(hostUrl);
+    logger.info(`Using secure-store token for ${hostUrl}`);
+    return secureToken;
+  } catch (e) {
+    if (e instanceof SecureStoreAuthError) {
+      logger.info(`secure-store: ${e.message}`);
+    } else {
+      logger.warn(`secure-store unexpected error: ${e.message}`);
+    }
+  }
+  throw new Error(
+    `Cannot obtain token for ${hostUrl}.
+Options:
+  1. ae-cli auth login   (device code flow, cross-platform)
+  2. ae-cli auth set-token <token>
+  3. export TE_TOKEN=<token>  (CI/headless)`
+  );
+}
+
 export {
   save,
   load,
   clear,
-  getValidAccessToken,
   loadMcpToken,
-  SecureStoreAuthError
+  SecureStoreAuthError,
+  resolveHost,
+  validateToken,
+  loadToken,
+  saveToken,
+  clearToken,
+  setTokenManual,
+  getAuthStatus,
+  getToken
 };

package/dist/{client-IN42F223.js → client-2UJ63MVQ.js}

@@ -7,10 +7,9 @@ import {
   queryReportData,
   querySql,
   wsQuery
-} from "./chunk-I42JGQ2J.js";
-import "./chunk-U6TKB3IV.js";
-import "./chunk-JM34JPCO.js";
-import "./chunk-SRJIAOBN.js";
+} from "./chunk-BJX3GXWC.js";
+import "./chunk-RSHMZ3LG.js";
+import "./chunk-6W4QOZAL.js";
 export {
   httpDelete,
   httpGet,

package/dist/{config-64G36TJL.js → config-NCUGK6NS.js}

@@ -1,19 +1,19 @@
 import {
   printError,
   printOutput
-} from "./chunk-CLJF7MQA.js";
+} from "./chunk-2DUEAXV3.js";
 import {
   GLOBAL_QUERY_CONFIG_KEY,
   getAnalysisMappingPathForClusterMode,
   getClusterInfoFilePath,
   isGlobalQueryModeEnabled,
   setGlobalQueryModeEnabled
-} from "./chunk-GSJGPNKK.js";
+} from "./chunk-PN3OS34E.js";
 import {
   addHost,
   loadConfig,
   setActiveHost
-} from "./chunk-SRJIAOBN.js";
+} from "./chunk-6W4QOZAL.js";
 
 // src/commands/config.ts
 function registerConfig(program) {