@thinkingai/ae-cli 6.0.20 → 6.0.22

package/README.md

@@ -67,12 +67,9 @@ ae-cli kb +read --source '{"scope":"company","name":"engineering-handbook"}' \
 Authentication is handled per-host. Each AE host URL maintains its own token.
 
 ```bash
-# Auto-login for active host (macOS, extracts token from Chrome)
+# Device code login (cross-platform)
 ae-cli auth login
 
-# Manually set token
-ae-cli auth set-token <your-token>
-
 # Check status
 ae-cli auth status
 

package/README.zh.md

@@ -67,12 +67,9 @@ ae-cli kb +read --source '{"scope":"company","name":"engineering-handbook"}' \
 每个 AE 主机 URL 维护独立的身份验证 token。
 
 ```bash
-# 自动登录当前主机（macOS，从 Chrome 提取 token）
+# 设备码登录（跨平台）
 ae-cli auth login
 
-# 手动设置 token
-ae-cli auth set-token <your-token>
-
 # 检查状态
 ae-cli auth status
 

package/dist/{auth-DYC2BGLM.js → auth-I2G7OAU2.js}

@@ -5,10 +5,9 @@ import {
   loadToken,
   resolveHost,
   saveToken,
-  setTokenManual,
   validateToken
-} from "./chunk-RSHMZ3LG.js";
-import "./chunk-6W4QOZAL.js";
+} from "./chunk-U6QPKCN3.js";
+import "./chunk-WPXHCP4A.js";
 export {
   clearToken,
   getAuthStatus,
@@ -16,6 +15,5 @@ export {
   loadToken,
   resolveHost,
   saveToken,
-  setTokenManual,
   validateToken
 };

package/dist/{auth-GHBMJ5ZR.js → auth-RDN6D5HU.js}

@@ -1,30 +1,26 @@
 import {
   printError,
   printOutput
-} from "./chunk-2DUEAXV3.js";
+} from "./chunk-YACCPUNQ.js";
 import {
-  clearMcpToken,
-  setMcpTokenManual,
-  validateMcpToken
-} from "./chunk-DMMEPCST.js";
-import "./chunk-PN3OS34E.js";
-import "./chunk-NOO24N7W.js";
+  clearCliToken,
+  mintCliToken
+} from "./chunk-FPE5LGVU.js";
 import {
   clear,
   clearToken,
   getAuthStatus,
   load,
   resolveHost,
-  save,
-  setTokenManual,
-  validateToken
-} from "./chunk-RSHMZ3LG.js";
+  save
+} from "./chunk-U6QPKCN3.js";
 import {
+  getFallbackCliToken,
   loadConfig,
   logger,
   removeHost,
   saveConfig
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-WPXHCP4A.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -246,7 +242,7 @@ function activateHostAfterLogin(host, explicitHostOverride) {
   saveConfig(config);
   logger.info(`Active host set to ${host} after login`);
 }
-function persistDeviceTokens(host, tokens) {
+async function persistDeviceTokens(host, tokens) {
   const DEFAULT_EXPIRES_IN = 72e3;
   const MAX_EXPIRES_IN = 86400 * 365;
   let expiresInSeconds = tokens.expires_in ?? DEFAULT_EXPIRES_IN;
@@ -258,16 +254,15 @@ function persistDeviceTokens(host, tokens) {
   save(host, {
     accessToken: tokens.access_token,
     refreshToken: tokens.refresh_token ?? "",
-    accessExpiresAt: expiresAt,
-    mcpToken: tokens.mcp_token ?? void 0
+    accessExpiresAt: expiresAt
   });
+  await mintCliToken(host);
 }
 function loginSummary(host, tokens) {
   return {
     authenticated: true,
     host,
-    token: tokens.access_token.slice(0, 8) + "...",
-    mcpToken: tokens.mcp_token ? tokens.mcp_token.slice(0, 8) + "..." : null
+    token: tokens.access_token.slice(0, 8) + "..."
   };
 }
 function resolveLoginTeClaudeBase(host) {
@@ -303,7 +298,7 @@ function registerAuth(program) {
     try {
       if (opts.deviceCode) {
         const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
-        persistDeviceTokens(host, tokens2);
+        await persistDeviceTokens(host, tokens2);
         activateHostAfterLogin(host, explicitHost);
         logger.info(`Device flow login successful for ${host} (resumed)`);
         emit("Login successful! Token saved securely.");
@@ -326,7 +321,7 @@ function registerAuth(program) {
         return;
       }
       const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
-      persistDeviceTokens(host, tokens);
+      await persistDeviceTokens(host, tokens);
       activateHostAfterLogin(host, explicitHost);
       logger.info(`Device flow login successful for ${host}`);
       emit("Login successful! Token saved securely.");
@@ -336,7 +331,7 @@ function registerAuth(program) {
         printError(
           "auth",
           err.message,
-          "Use `ae-cli auth set-token <token>` to authenticate, or upgrade the AE server to a version that supports device login."
+          "Upgrade the AE server to a version that supports device login."
         );
         process.exit(1);
       }
@@ -344,39 +339,6 @@ function registerAuth(program) {
       process.exit(1);
     }
   });
-  auth.command("set-token <token>").description("Manually set authentication token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
-    const host = resolveAuthHost(program, opts);
-    if (!host) {
-      printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
-      process.exit(1);
-    }
-    const config = loadConfig();
-    if (!config.hosts[host]) {
-      config.hosts[host] = { label: host };
-      if (!config.activeHost) {
-        config.activeHost = host;
-      }
-      saveConfig(config);
-      process.stderr.write(`[ae-cli] Config saved for ${host}
-`);
-      printOutput({ saved: true, config }, program.opts().format || "json");
-    }
-    process.stderr.write(`[ae-cli] Validating token...
-`);
-    const isValid = await validateToken(token, host);
-    if (!isValid) {
-      logger.warn(`Token validation failed for ${host}`);
-      process.stderr.write(`[ae-cli] Token validation failed
-`);
-      printError("auth", "Invalid token", "Please check your token and try again");
-      process.exit(1);
-    }
-    setTokenManual(token, host);
-    logger.info(`Token manually set and validated for ${host}`);
-    process.stderr.write(`[ae-cli] Token verified and saved for ${host}
-`);
-    printOutput({ saved: true, host, verified: true }, program.opts().format || "json");
-  });
   auth.command("status").description("Show authentication status for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
@@ -394,7 +356,20 @@ function registerAuth(program) {
           accessExpiresAt: secureEntry.accessExpiresAt,
           accessExpiresAtNote: "advisory: access token auto-slides on use server-side; re-login only if a command returns an auth error",
           pastStaticExpiry,
-          hasMcpToken: !!secureEntry.mcpToken
+          hasCliToken: !!secureEntry.cliToken
+        },
+        program.opts().format || "json"
+      );
+      return;
+    }
+    const fallbackCliToken = getFallbackCliToken(host);
+    if (fallbackCliToken) {
+      printOutput(
+        {
+          authenticated: true,
+          host,
+          source: "sandbox-cli-token",
+          hasCliToken: true
         },
         program.opts().format || "json"
       );
@@ -404,64 +379,17 @@ function registerAuth(program) {
     const authenticated = tokenStatus.authenticated;
     printOutput({ authenticated, host, source: tokenStatus.source ?? "none" }, program.opts().format || "json");
   });
-  auth.command("logout").description("Clear stored token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
+  auth.command("logout").description("Clear stored credentials (access token, CLI token, and host config) for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
       printError("config", "No AE host configured.", "Run: ae-cli config set-host <url>");
       process.exit(1);
     }
+    clearCliToken(host);
     clearToken(host);
     clear(host);
     removeHost(host);
-    process.stderr.write(`[ae-cli] Token and config cleared for ${host}
-`);
-    printOutput({ cleared: true, host }, program.opts().format || "json");
-  });
-  auth.command("set-mcp-token <token>").description("Manually set MCP token for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (token, opts) => {
-    const host = resolveAuthHost(program, opts);
-    if (!host) {
-      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
-      process.exit(1);
-    }
-    const config = loadConfig();
-    if (!config.hosts[host]) {
-      config.hosts[host] = { label: host };
-      if (!config.activeHost) {
-        config.activeHost = host;
-      }
-      saveConfig(config);
-      process.stderr.write(`[ae-cli] Host config saved for ${host}
-`);
-    }
-    process.stderr.write(`[ae-cli] Validating MCP token...
-`);
-    const isValid = await validateMcpToken(token, host);
-    if (!isValid) {
-      process.stderr.write(`[ae-cli] MCP token validation failed
-`);
-      printError("auth", "Invalid MCP token", "Please check your MCP token and try again");
-      process.exit(1);
-    }
-    setMcpTokenManual(token, host);
-    process.stderr.write(`[ae-cli] MCP token verified and saved for ${host}
-`);
-    printOutput({ saved: true, host, verified: true, type: "mcp-token" }, program.opts().format || "json");
-  });
-  auth.command("clear-mcp-token").description("Clear stored MCP token for a host (--host or active host; --all clears all)").option("--host <url>", HOST_OPTION_DESC).option("--all", "Clear MCP tokens for all hosts").action((opts) => {
-    if (opts.all) {
-      clearMcpToken();
-      process.stderr.write(`[ae-cli] All MCP tokens cleared
-`);
-      printOutput({ cleared: true, type: "all-mcp-tokens" }, program.opts().format || "json");
-      return;
-    }
-    const host = resolveAuthHost(program, opts);
-    if (!host) {
-      printError("config", "No AE host configured.", "Use --host <url> or run: ae-cli config set-host <url>");
-      process.exit(1);
-    }
-    clearMcpToken(host);
-    process.stderr.write(`[ae-cli] MCP token cleared for ${host}
+    process.stderr.write(`[ae-cli] Credentials and config cleared for ${host}
 `);
     printOutput({ cleared: true, host }, program.opts().format || "json");
   });

package/dist/{chunk-5OC7CYCG.js → chunk-2W7HULUD.js}

@@ -1,12 +1,12 @@
-import {
-  getMcpToken
-} from "./chunk-DMMEPCST.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
+import {
+  getCliToken
+} from "./chunk-FPE5LGVU.js";
 import {
   safeJsonParse
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-WPXHCP4A.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {
@@ -52,21 +52,21 @@ function parseKbResponse(resp, text) {
   }
   return data.data !== void 0 ? data.data : data;
 }
-async function fetchWithMcpToken(input, init, mcpToken) {
+async function fetchWithCliToken(input, init, cliToken) {
   const headers = new Headers(init.headers);
-  headers.set("mcp-token", mcpToken);
+  headers.set("cli-token", cliToken);
   const resp = await fetch(input, { ...init, headers });
   return parseKbResponse(resp, await resp.text());
 }
 async function getAuthHeaders(ctx) {
-  const mcpToken = await getMcpToken(ctx.host());
-  return { "mcp-token": mcpToken };
+  const cliToken = await getCliToken(ctx.host());
+  return { "cli-token": cliToken };
 }
 async function kbApi(ctx, method, path, params = {}, body) {
   const host = ctx.host();
-  const mcpToken = await getMcpToken(host);
+  const cliToken = await getCliToken(host);
   const upperMethod = method.toUpperCase();
-  return fetchWithMcpToken(
+  return fetchWithCliToken(
     buildUrl(host, path, params),
     {
       method: upperMethod,
@@ -75,19 +75,19 @@ async function kbApi(ctx, method, path, params = {}, body) {
       },
       body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
     },
-    mcpToken
+    cliToken
   );
 }
 async function kbUpload(ctx, path, form, params = {}) {
   const host = ctx.host();
-  const mcpToken = await getMcpToken(host);
-  return fetchWithMcpToken(
+  const cliToken = await getCliToken(host);
+  return fetchWithCliToken(
     buildUrl(host, path, params),
     {
       method: "POST",
       body: form
     },
-    mcpToken
+    cliToken
   );
 }
 

package/dist/chunk-4EUZRJPO.js

@@ -0,0 +1,163 @@
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  clearCliToken,
+  getCliToken
+} from "./chunk-FPE5LGVU.js";
+import {
+  logger,
+  safeJsonParse
+} from "./chunk-WPXHCP4A.js";
+
+// src/core/capability-api.ts
+import { readFile } from "fs/promises";
+import { basename } from "path";
+var CapabilityGatewayError = class extends Error {
+  constructor(message, code, httpStatus) {
+    super(message);
+    this.code = code;
+    this.httpStatus = httpStatus;
+    this.name = "CapabilityGatewayError";
+  }
+  code;
+  httpStatus;
+};
+function buildCapabilityGatewayUrl(host, domain, pathAfterV1, queryParams = {}) {
+  const base = host.replace(/\/+$/, "");
+  const cleanDomain = domain.replace(/^\/+|\/+$/g, "");
+  const cleanPath = pathAfterV1.replace(/^\/+|\/+$/g, "");
+  const url = new URL(`${base}/api/cli/${cleanDomain}/v1/${cleanPath}`);
+  for (const [key, value] of Object.entries(queryParams)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
+function parseCapabilityResponse(text) {
+  if (!text) return void 0;
+  try {
+    return safeJsonParse(text);
+  } catch {
+    return text;
+  }
+}
+function unwrapCapabilityEnvelope(body) {
+  if (body == null) {
+    throw new CapabilityGatewayError("Empty capability gateway response");
+  }
+  if (typeof body.ok === "boolean") {
+    if (body.ok) {
+      return body.data;
+    }
+    const err = body.error ?? {};
+    const message = err.message || err.code || "Capability gateway request failed";
+    throw new CapabilityGatewayError(message, err.code, err.http_status ?? err.httpStatus);
+  }
+  return body;
+}
+async function requestOnce(url, method, token, body) {
+  const headers = {
+    "cli-token": token,
+    "Accept": "application/json"
+  };
+  const init = { method, headers };
+  if (body !== void 0 && method !== "GET") {
+    headers["Content-Type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  return fetch(url, init);
+}
+async function requestMultipartOnce(url, token, form) {
+  return fetch(url, {
+    method: "POST",
+    headers: {
+      "cli-token": token,
+      "Accept": "application/json"
+    },
+    body: form
+  });
+}
+async function callGateway(host, domain, pathAfterV1, method, body) {
+  const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
+  const token = await getCliToken(host);
+  let resp = await requestOnce(url, method, token, body);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestOnce(url, method, newToken, body);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+    }
+  } else if (!resp.ok) {
+    throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
+}
+async function executeCapability(host, domain, capabilityId, input = {}) {
+  return callGateway(host, domain, `capabilities/${capabilityId}/execute`, "POST", { input });
+}
+async function uploadInputFile(host, domain, projectId, purpose, filePath) {
+  const fileBytes = await readFile(filePath);
+  return uploadInputFileBytes(host, domain, projectId, purpose, fileBytes, basename(filePath));
+}
+async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, filename, contentType = "application/octet-stream") {
+  const url = buildCapabilityGatewayUrl(host, domain, "input-files");
+  const fileBuffer = bytes instanceof ArrayBuffer ? bytes : bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+  const form = new FormData();
+  form.append("project_id", String(projectId));
+  form.append("purpose", purpose);
+  form.append("file", new Blob([fileBuffer], { type: contentType }), filename);
+  const token = await getCliToken(host);
+  let resp = await requestMultipartOnce(url, token, form);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestMultipartOnce(url, newToken, form);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+    }
+  } else if (!resp.ok) {
+    throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
+}
+
+export {
+  buildCapabilityGatewayUrl,
+  executeCapability,
+  uploadInputFile,
+  uploadInputFileBytes
+};