@thinkingai/ae-cli 6.0.18 → 6.0.22

package/README.md

@@ -67,12 +67,9 @@ ae-cli kb +read --source '{"scope":"company","name":"engineering-handbook"}' \
 Authentication is handled per-host. Each AE host URL maintains its own token.
 
 ```bash
-# Auto-login for active host (macOS, extracts token from Chrome)
+# Device code login (cross-platform)
 ae-cli auth login
 
-# Manually set token
-ae-cli auth set-token <your-token>
-
 # Check status
 ae-cli auth status
 
@@ -90,11 +87,12 @@ ae-cli auth logout
 | `analysis_audience` | 10+ | Audience operations: clusters, tags, and cluster/tag definition schema |
 | `analysis_meta` | 20+ | Metadata governance: events/properties, metrics, virtual metadata, project config, tracking plan, mark times, entity catalog |
 | `engage` | 40+ | Hermes Engage MCP: channels, tasks, configs, flows, strategies |
-| `dataops_repo` | 8 | Data warehouse repos: spaces, catalogs, schemas, members |
-| `dataops_datatable` | 10+ | Data tables: table creation, views, batch operations, data dictionary |
-| `dataops_flow` | 20+ | Task flows: flow creation, task nodes, scheduling, execution, monitoring |
-| `dataops_ide` | 10+ | IDE queries: metadata browsing, SQL execution, query management |
-| `dataops_integration` | 20+ | Data integration: datasource management, sync solutions, data synchronization |
+| `dataops_repo` | 1 | DataOps repo utilities: space discovery |
+| `dataops_datatable` | 5 | Data tables: table/view creation, publishing, details, data dictionary |
+| `dataops_flow` | 15 | Task flows: flow creation, task nodes, scheduling, execution, release preview |
+| `dataops_operations` | 4 | Operations: workflow instance search, instance detail, task logs, stop |
+| `dataops_ide` | 9 | IDE queries: metadata browsing, SQL execution, query management |
+| `dataops_integration` | 19 | Data integration: datasource management, sync solutions, data synchronization |
 | `community` | 10+ | Community analysis: posts search, sentiment analysis, topic trends, livestream data |
 | `analysis_common` | 2 | Cross-module common constraints: resource link completion, project ID gate |
 | `team` | 14 | AI Agent Team: manage teams (list/create/update/delete/ai-generate/templates/projects) and execute TeamRuns (start/watch/chat/reply/cancel/result/artifacts) |
@@ -169,7 +167,7 @@ Hermes Engage MCP capabilities:
 ### ae-dataops
 
 Data warehouse management:
-- **Repo Management**: spaces, catalogs, schemas, members
+- **Repo Utilities**: space discovery
 - **Data Tables**: table creation, views, batch operations, data dictionary
 - **Task Flows**: flow creation, task nodes, scheduling, execution, monitoring
 - **IDE Queries**: metadata browsing, SQL execution, query management

package/README.zh.md

@@ -67,12 +67,9 @@ ae-cli kb +read --source '{"scope":"company","name":"engineering-handbook"}' \
 每个 AE 主机 URL 维护独立的身份验证 token。
 
 ```bash
-# 自动登录当前主机（macOS，从 Chrome 提取 token）
+# 设备码登录（跨平台）
 ae-cli auth login
 
-# 手动设置 token
-ae-cli auth set-token <your-token>
-
 # 检查状态
 ae-cli auth status
 
@@ -90,11 +87,12 @@ ae-cli auth logout
 | `analysis_audience` | 10+ | 受众运营：分群、标签及其定义模型 |
 | `analysis_meta` | 20+ | 元数据治理：事件/属性、指标、虚拟元数据、项目配置、埋点方案、标记时间、实体目录 |
 | `engage` | 40+ | Hermes Engage MCP：渠道、任务、配置、流程、策略 |
-| `dataops_repo` | 8 | 数仓仓库：空间、目录、模式、成员 |
-| `dataops_datatable` | 10+ | 数据表：表创建、视图、批量操作、数据字典 |
-| `dataops_flow` | 20+ | 任务流：流程创建、任务节点、调度、执行、监控 |
-| `dataops_ide` | 10+ | IDE 查询：元数据浏览、SQL 执行、查询管理 |
-| `dataops_integration` | 20+ | 数据集成：数据源管理、同步方案、数据同步 |
+| `dataops_repo` | 1 | DataOps 仓库辅助：空间发现 |
+| `dataops_datatable` | 5 | 数据表：表/视图创建、发布、详情、数据字典 |
+| `dataops_flow` | 15 | 任务流：流程创建、任务节点、调度、执行、监控、发布预览 |
+| `dataops_operations` | 4 | 运维：工作流实例搜索、实例详情、任务日志、停止执行 |
+| `dataops_ide` | 9 | IDE 查询：元数据浏览、SQL 执行、查询管理 |
+| `dataops_integration` | 19 | 数据集成：数据源管理、同步方案、数据同步 |
 | `community` | 10+ | 社区分析：帖子搜索、情感分析、话题趋势、直播数据 |
 | `analysis_common` | 2 | 跨模块通用约束：资源链接补全、项目 ID 门控 |
 | `agent` | 15 | Agent 平台资源管理：模型、MCP 服务、Skill、附件库的增删查和启停 |
@@ -170,7 +168,7 @@ Hermes Engage MCP 能力：
 ### ae-dataops
 
 数仓管理：
-- **仓库管理**：空间、目录、模式、成员
+- **仓库辅助**：空间发现
 - **数据表**：表创建、视图、批量操作、数据字典
 - **任务流**：流程创建、任务节点、调度、执行、监控
 - **IDE 查询**：元数据浏览、SQL 执行、查询管理
@@ -223,4 +221,4 @@ npm run verify:analysis-common-tools
 
 ## 许可证
 
-MIT
+MIT

package/dist/{auth-DYC2BGLM.js → auth-I2G7OAU2.js}

@@ -5,10 +5,9 @@ import {
   loadToken,
   resolveHost,
   saveToken,
-  setTokenManual,
   validateToken
-} from "./chunk-RSHMZ3LG.js";
-import "./chunk-6W4QOZAL.js";
+} from "./chunk-U6QPKCN3.js";
+import "./chunk-WPXHCP4A.js";
 export {
   clearToken,
   getAuthStatus,
@@ -16,6 +15,5 @@ export {
   loadToken,
   resolveHost,
   saveToken,
-  setTokenManual,
   validateToken
 };

package/dist/{auth-GHBMJ5ZR.js → auth-RDN6D5HU.js}

@@ -1,30 +1,26 @@
 import {
   printError,
   printOutput
-} from "./chunk-2DUEAXV3.js";
+} from "./chunk-YACCPUNQ.js";
 import {
-  clearMcpToken,
-  setMcpTokenManual,
-  validateMcpToken
-} from "./chunk-DMMEPCST.js";
-import "./chunk-PN3OS34E.js";
-import "./chunk-NOO24N7W.js";
+  clearCliToken,
+  mintCliToken
+} from "./chunk-FPE5LGVU.js";
 import {
   clear,
   clearToken,
   getAuthStatus,
   load,
   resolveHost,
-  save,
-  setTokenManual,
-  validateToken
-} from "./chunk-RSHMZ3LG.js";
+  save
+} from "./chunk-U6QPKCN3.js";
 import {
+  getFallbackCliToken,
   loadConfig,
   logger,
   removeHost,
   saveConfig
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-WPXHCP4A.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -246,7 +242,7 @@ function activateHostAfterLogin(host, explicitHostOverride) {
   saveConfig(config);
   logger.info(`Active host set to ${host} after login`);
 }
-function persistDeviceTokens(host, tokens) {
+async function persistDeviceTokens(host, tokens) {
   const DEFAULT_EXPIRES_IN = 72e3;
   const MAX_EXPIRES_IN = 86400 * 365;
   let expiresInSeconds = tokens.expires_in ?? DEFAULT_EXPIRES_IN;
@@ -258,16 +254,15 @@ function persistDeviceTokens(host, tokens) {
   save(host, {
     accessToken: tokens.access_token,
     refreshToken: tokens.refresh_token ?? "",
-    accessExpiresAt: expiresAt,
-    mcpToken: tokens.mcp_token ?? void 0
+    accessExpiresAt: expiresAt
   });
+  await mintCliToken(host);
 }
 function loginSummary(host, tokens) {
   return {
     authenticated: true,
     host,
-    token: tokens.access_token.slice(0, 8) + "...",
-    mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
+    token: tokens.access_token.slice(0, 8) + "..."
   };
 }
 function resolveLoginTeClaudeBase(host) {
@@ -303,7 +298,7 @@ function registerAuth(program) {
     try {
       if (opts.deviceCode) {
         const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
-        persistDeviceTokens(host, tokens2);
+        await persistDeviceTokens(host, tokens2);
         activateHostAfterLogin(host, explicitHost);
         logger.info(`Device flow login successful for ${host} (resumed)`);
         emit("Login successful! Token saved securely.");
@@ -326,7 +321,7 @@ function registerAuth(program) {
         return;
       }
       const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
-      persistDeviceTokens(host, tokens);
+      await persistDeviceTokens(host, tokens);
       activateHostAfterLogin(host, explicitHost);
       logger.info(`Device flow login successful for ${host}`);
       emit("Login successful! Token saved securely.");
@@ -336,7 +331,7 @@ function registerAuth(program) {
         printError(
           "auth",
           err.message,
-          "Use `ae-cli auth set-token <token>` to authenticate, or upgrade the AE server to a version that supports device login."
+          "Upgrade the AE server to a version that supports device login."
         );
         process.exit(1);
       }
@@ -344,39 +339,6 @@ function registerAuth(program) {
       process.exit(1);
     }
   });
-  auth.command("set-token <token>").description("Manually set authentication token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
-    const host = resolveAuthHost(program, opts);
-    if (!host) {
-      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
-      process.exit(1);
-    }
-    const config = loadConfig();
-    if (!config.hosts[host]) {
-      config.hosts[host] = { label: host };
-      if (!config.activeHost) {
-        config.activeHost = host;
-      }
-      saveConfig(config);
-      process.stderr.write(`[ae-cli] Config saved for ${host}
-`);
-      printOutput({ saved: true, config }, program.opts().format || "json");
-    }
-    process.stderr.write(`[ae-cli] Validating token...
-`);
-    const isValid = await validateToken(token, host);
-    if (!isValid) {
-      logger.warn(`Token validation failed for ${host}`);
-      process.stderr.write(`[ae-cli] Token validation failed
-`);
-      printError("auth", "Invalid token", "Please check your token and try again");
-      process.exit(1);
-    }
-    setTokenManual(token, host);
-    logger.info(`Token manually set and validated for ${host}`);
-    process.stderr.write(`[ae-cli] Token verified and saved for ${host}
-`);
-    printOutput({ saved: true, host, verified: true }, program.opts().format || "json");
-  });
   auth.command("status").description("Show authentication status for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
@@ -394,7 +356,20 @@ function registerAuth(program) {
           accessExpiresAt: secureEntry.accessExpiresAt,
           accessExpiresAtNote: "advisory: access token auto-slides on use server-side; re-login only if a command returns an auth error",
           pastStaticExpiry,
-          hasMcpToken: !!secureEntry.mcpToken
+          hasCliToken: !!secureEntry.cliToken
+        },
+        program.opts().format || "json"
+      );
+      return;
+    }
+    const fallbackCliToken = getFallbackCliToken(host);
+    if (fallbackCliToken) {
+      printOutput(
+        {
+          authenticated: true,
+          host,
+          source: "sandbox-cli-token",
+          hasCliToken: true
         },
         program.opts().format || "json"
       );
@@ -404,64 +379,17 @@ function registerAuth(program) {
     const authenticated = tokenStatus.authenticated;
     printOutput({ authenticated, host, source: tokenStatus.source ?? "none" }, program.opts().format || "json");
   });
-  auth.command("logout").description("Clear stored token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
+  auth.command("logout").description("Clear stored credentials (access token, CLI token, and host config) for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
       printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
       process.exit(1);
     }
+    clearCliToken(host);
     clearToken(host);
     clear(host);
     removeHost(host);
-    process.stderr.write(`[ae-cli] Token and config cleared for ${host}
-`);
-    printOutput({ cleared: true, host }, program.opts().format || "json");
-  });
-  auth.command("set-mcp-token <token>").description("Manually set MCP token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
-    const host = resolveAuthHost(program, opts);
-    if (!host) {
-      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
-      process.exit(1);
-    }
-    const config = loadConfig();
-    if (!config.hosts[host]) {
-      config.hosts[host] = { label: host };
-      if (!config.activeHost) {
-        config.activeHost = host;
-      }
-      saveConfig(config);
-      process.stderr.write(`[ae-cli] Host config saved for ${host}
-`);
-    }
-    process.stderr.write(`[ae-cli] Validating MCP token...
-`);
-    const isValid = await validateMcpToken(token, host);
-    if (!isValid) {
-      process.stderr.write(`[ae-cli] MCP token validation failed
-`);
-      printError("auth", "Invalid MCP token", "Please check your MCP token and try again");
-      process.exit(1);
-    }
-    setMcpTokenManual(token, host);
-    process.stderr.write(`[ae-cli] MCP token verified and saved for ${host}
-`);
-    printOutput({ saved: true, host, verified: true, type: "mcp-token" }, program.opts().format || "json");
-  });
-  auth.command("clear-mcp-token").description("Clear stored MCP token for a host (--host or active host; --all clears all)").option("--host <url>", HOST_OPTION_DESC).option("--all", "Clear MCP tokens for all hosts").action((opts) => {
-    if (opts.all) {
-      clearMcpToken();
-      process.stderr.write(`[ae-cli] All MCP tokens cleared
-`);
-      printOutput({ cleared: true, type: "all-mcp-tokens" }, program.opts().format || "json");
-      return;
-    }
-    const host = resolveAuthHost(program, opts);
-    if (!host) {
-      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
-      process.exit(1);
-    }
-    clearMcpToken(host);
-    process.stderr.write(`[ae-cli] MCP token cleared for ${host}
+    process.stderr.write(`[ae-cli] Credentials and config cleared for ${host}
 `);
     printOutput({ cleared: true, host }, program.opts().format || "json");
   });

package/dist/{chunk-5OC7CYCG.js → chunk-2W7HULUD.js}

@@ -1,12 +1,12 @@
-import {
-  getMcpToken
-} from "./chunk-DMMEPCST.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
+import {
+  getCliToken
+} from "./chunk-FPE5LGVU.js";
 import {
   safeJsonParse
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-WPXHCP4A.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {
@@ -52,21 +52,21 @@ function parseKbResponse(resp, text) {
   }
   return data.data !== void 0 ? data.data : data;
 }
-async function fetchWithMcpToken(input, init, mcpToken) {
+async function fetchWithCliToken(input, init, cliToken) {
   const headers = new Headers(init.headers);
-  headers.set("mcp-token", mcpToken);
+  headers.set("cli-token", cliToken);
   const resp = await fetch(input, { ...init, headers });
   return parseKbResponse(resp, await resp.text());
 }
 async function getAuthHeaders(ctx) {
-  const mcpToken = await getMcpToken(ctx.host());
-  return { "mcp-token": mcpToken };
+  const cliToken = await getCliToken(ctx.host());
+  return { "cli-token": cliToken };
 }
 async function kbApi(ctx, method, path, params = {}, body) {
   const host = ctx.host();
-  const mcpToken = await getMcpToken(host);
+  const cliToken = await getCliToken(host);
   const upperMethod = method.toUpperCase();
-  return fetchWithMcpToken(
+  return fetchWithCliToken(
     buildUrl(host, path, params),
     {
       method: upperMethod,
@@ -75,19 +75,19 @@ async function kbApi(ctx, method, path, params = {}, body) {
       },
       body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
     },
-    mcpToken
+    cliToken
   );
 }
 async function kbUpload(ctx, path, form, params = {}) {
   const host = ctx.host();
-  const mcpToken = await getMcpToken(host);
-  return fetchWithMcpToken(
+  const cliToken = await getCliToken(host);
+  return fetchWithCliToken(
     buildUrl(host, path, params),
     {
       method: "POST",
       body: form
     },
-    mcpToken
+    cliToken
   );
 }
 

package/dist/chunk-4EUZRJPO.js

@@ -0,0 +1,163 @@
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  clearCliToken,
+  getCliToken
+} from "./chunk-FPE5LGVU.js";
+import {
+  logger,
+  safeJsonParse
+} from "./chunk-WPXHCP4A.js";
+
+// src/core/capability-api.ts
+import { readFile } from "fs/promises";
+import { basename } from "path";
+var CapabilityGatewayError = class extends Error {
+  constructor(message, code, httpStatus) {
+    super(message);
+    this.code = code;
+    this.httpStatus = httpStatus;
+    this.name = "CapabilityGatewayError";
+  }
+  code;
+  httpStatus;
+};
+function buildCapabilityGatewayUrl(host, domain, pathAfterV1, queryParams = {}) {
+  const base = host.replace(/\/+$/, "");
+  const cleanDomain = domain.replace(/^\/+|\/+$/g, "");
+  const cleanPath = pathAfterV1.replace(/^\/+|\/+$/g, "");
+  const url = new URL(`${base}/api/cli/${cleanDomain}/v1/${cleanPath}`);
+  for (const [key, value] of Object.entries(queryParams)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
+function parseCapabilityResponse(text) {
+  if (!text) return void 0;
+  try {
+    return safeJsonParse(text);
+  } catch {
+    return text;
+  }
+}
+function unwrapCapabilityEnvelope(body) {
+  if (body == null) {
+    throw new CapabilityGatewayError("Empty capability gateway response");
+  }
+  if (typeof body.ok === "boolean") {
+    if (body.ok) {
+      return body.data;
+    }
+    const err = body.error ?? {};
+    const message = err.message || err.code || "Capability gateway request failed";
+    throw new CapabilityGatewayError(message, err.code, err.http_status ?? err.httpStatus);
+  }
+  return body;
+}
+async function requestOnce(url, method, token, body) {
+  const headers = {
+    "cli-token": token,
+    "Accept": "application/json"
+  };
+  const init = { method, headers };
+  if (body !== void 0 && method !== "GET") {
+    headers["Content-Type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  return fetch(url, init);
+}
+async function requestMultipartOnce(url, token, form) {
+  return fetch(url, {
+    method: "POST",
+    headers: {
+      "cli-token": token,
+      "Accept": "application/json"
+    },
+    body: form
+  });
+}
+async function callGateway(host, domain, pathAfterV1, method, body) {
+  const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
+  const token = await getCliToken(host);
+  let resp = await requestOnce(url, method, token, body);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestOnce(url, method, newToken, body);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+    }
+  } else if (!resp.ok) {
+    throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
+}
+async function executeCapability(host, domain, capabilityId, input = {}) {
+  return callGateway(host, domain, `capabilities/${capabilityId}/execute`, "POST", { input });
+}
+async function uploadInputFile(host, domain, projectId, purpose, filePath) {
+  const fileBytes = await readFile(filePath);
+  return uploadInputFileBytes(host, domain, projectId, purpose, fileBytes, basename(filePath));
+}
+async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, filename, contentType = "application/octet-stream") {
+  const url = buildCapabilityGatewayUrl(host, domain, "input-files");
+  const fileBuffer = bytes instanceof ArrayBuffer ? bytes : bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+  const form = new FormData();
+  form.append("project_id", String(projectId));
+  form.append("purpose", purpose);
+  form.append("file", new Blob([fileBuffer], { type: contentType }), filename);
+  const token = await getCliToken(host);
+  let resp = await requestMultipartOnce(url, token, form);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestMultipartOnce(url, newToken, form);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+    }
+  } else if (!resp.ok) {
+    throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
+}
+
+export {
+  buildCapabilityGatewayUrl,
+  executeCapability,
+  uploadInputFile,
+  uploadInputFileBytes
+};