@thinkingai/ae-cli 6.0.20 → 6.0.24

package/dist/chunk-AKORWVHJ.js

@@ -0,0 +1,59 @@
+import {
+  buildCapabilityGatewayUrl,
+  executeCapability
+} from "./chunk-V5R5UIRM.js";
+
+// src/core/capability-routing.ts
+var cliServiceRoutes = /* @__PURE__ */ new Map();
+function registerCapabilityGatewayRoute(cliService, route) {
+  cliServiceRoutes.set(cliService, route);
+}
+function resolveGatewayDomain(cliService, override) {
+  if (override !== void 0) {
+    return override;
+  }
+  const route = cliServiceRoutes.get(cliService);
+  if (!route) {
+    throw new Error(
+      `Capability gateway route not registered for CLI service '${cliService}'. Call registerCapabilityGatewayRoute() in commands/${cliService}/index.ts.`
+    );
+  }
+  return route.gatewayDomain;
+}
+
+// src/core/capability-command.ts
+function createCapabilityCommand(config) {
+  return {
+    service: config.cliService,
+    resource: config.resource,
+    command: config.command,
+    description: config.description,
+    flags: config.flags,
+    risk: config.risk,
+    validate: config.validate,
+    dryRun: (ctx) => {
+      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
+      const input = config.buildInput(ctx);
+      return {
+        method: "POST",
+        url: buildCapabilityGatewayUrl(
+          ctx.host(),
+          gatewayDomain,
+          `capabilities/${config.capabilityId}/dry-run`
+        ),
+        body: { input }
+      };
+    },
+    execute: async (ctx) => {
+      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
+      const input = config.buildInput(ctx);
+      return executeCapability(ctx.host(), gatewayDomain, config.capabilityId, input);
+    }
+  };
+}
+
+export {
+  registerCapabilityGatewayRoute,
+  resolveGatewayDomain,
+  createCapabilityCommand
+};

package/dist/{chunk-BJX3GXWC.js → chunk-F3ZDMC2W.js}

@@ -1,13 +1,13 @@
 import {
   SecureStoreAuthError,
-  clearToken,
   getToken,
+  invalidateAccessTokenForRetry,
   resolveHost
-} from "./chunk-RSHMZ3LG.js";
+} from "./chunk-PFJFZVCK.js";
 import {
   logger,
   safeJsonParse
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-65DKFJZB.js";
 
 // src/core/client.ts
 import WebSocket from "ws";
@@ -46,7 +46,7 @@ async function request(method, modulePath, params = {}, body = null, retry = tru
   logger.api(method, url, resp.status, body, data);
   if (resp.status === 401) {
     if (retry) {
-      clearToken(resolvedHost);
+      invalidateAccessTokenForRetry(resolvedHost);
       return request(method, modulePath, params, body, false, resolvedHost);
     }
     throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
@@ -56,7 +56,7 @@ async function request(method, modulePath, params = {}, body = null, retry = tru
     throw new Error(m);
   }
   if (data.return_code === -1001 && retry) {
-    clearToken(resolvedHost);
+    invalidateAccessTokenForRetry(resolvedHost);
     return request(method, modulePath, params, body, false, resolvedHost);
   }
   if (data.return_code !== 0 && data.return_code !== void 0) {
@@ -89,7 +89,7 @@ async function uploadRequest(modulePath, form, params = {}, retry = true, hostUr
   logger.api("POST", url, resp.status, { upload: true }, data);
   if (resp.status === 401) {
     if (retry) {
-      clearToken(resolvedHost);
+      invalidateAccessTokenForRetry(resolvedHost);
       return uploadRequest(modulePath, form, params, false, resolvedHost);
     }
     throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
@@ -99,7 +99,7 @@ async function uploadRequest(modulePath, form, params = {}, retry = true, hostUr
     throw new Error(m);
   }
   if (data.return_code === -1001 && retry) {
-    clearToken(resolvedHost);
+    invalidateAccessTokenForRetry(resolvedHost);
     return uploadRequest(modulePath, form, params, false, resolvedHost);
   }
   if (data.return_code !== 0 && data.return_code !== void 0) {
@@ -162,7 +162,7 @@ async function wsQuery(projectId, requestId, qp, eventModel, options = {}, hostU
   } catch (err) {
     const msg = err.message || "";
     if (msg.includes("401") || msg.includes("403") || msg.includes("auth")) {
-      clearToken(resolvedHost);
+      invalidateAccessTokenForRetry(resolvedHost);
       const newToken = await getToken(resolvedHost);
       return wsQueryOnce(projectId, requestId, qp, eventModel, options, newToken, resolvedHost);
     }

package/dist/chunk-FIT4CFIN.js

@@ -0,0 +1,59 @@
+import {
+  buildCapabilityGatewayUrl,
+  executeCapability
+} from "./chunk-2OW2RENH.js";
+
+// src/core/capability-routing.ts
+var cliServiceRoutes = /* @__PURE__ */ new Map();
+function registerCapabilityGatewayRoute(cliService, route) {
+  cliServiceRoutes.set(cliService, route);
+}
+function resolveGatewayDomain(cliService, override) {
+  if (override !== void 0) {
+    return override;
+  }
+  const route = cliServiceRoutes.get(cliService);
+  if (!route) {
+    throw new Error(
+      `Capability gateway route not registered for CLI service '${cliService}'. Call registerCapabilityGatewayRoute() in commands/${cliService}/index.ts.`
+    );
+  }
+  return route.gatewayDomain;
+}
+
+// src/core/capability-command.ts
+function createCapabilityCommand(config) {
+  return {
+    service: config.cliService,
+    resource: config.resource,
+    command: config.command,
+    description: config.description,
+    flags: config.flags,
+    risk: config.risk,
+    validate: config.validate,
+    dryRun: (ctx) => {
+      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
+      const input = config.buildInput(ctx);
+      return {
+        method: "POST",
+        url: buildCapabilityGatewayUrl(
+          ctx.host(),
+          gatewayDomain,
+          `capabilities/${config.capabilityId}/dry-run`
+        ),
+        body: { input }
+      };
+    },
+    execute: async (ctx) => {
+      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
+      const input = config.buildInput(ctx);
+      return executeCapability(ctx.host(), gatewayDomain, config.capabilityId, input);
+    }
+  };
+}
+
+export {
+  registerCapabilityGatewayRoute,
+  resolveGatewayDomain,
+  createCapabilityCommand
+};

package/dist/{chunk-5OC7CYCG.js → chunk-IDXW6MEJ.js}

@@ -1,12 +1,12 @@
-import {
-  getMcpToken
-} from "./chunk-DMMEPCST.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
+import {
+  getCliToken
+} from "./chunk-OCQPQYHZ.js";
 import {
   safeJsonParse
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-65DKFJZB.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {
@@ -52,21 +52,21 @@ function parseKbResponse(resp, text) {
   }
   return data.data !== void 0 ? data.data : data;
 }
-async function fetchWithMcpToken(input, init, mcpToken) {
+async function fetchWithCliToken(input, init, cliToken) {
   const headers = new Headers(init.headers);
-  headers.set("mcp-token", mcpToken);
+  headers.set("cli-token", cliToken);
   const resp = await fetch(input, { ...init, headers });
   return parseKbResponse(resp, await resp.text());
 }
 async function getAuthHeaders(ctx) {
-  const mcpToken = await getMcpToken(ctx.host());
-  return { "mcp-token": mcpToken };
+  const cliToken = await getCliToken(ctx.host());
+  return { "cli-token": cliToken };
 }
 async function kbApi(ctx, method, path, params = {}, body) {
   const host = ctx.host();
-  const mcpToken = await getMcpToken(host);
+  const cliToken = await getCliToken(host);
   const upperMethod = method.toUpperCase();
-  return fetchWithMcpToken(
+  return fetchWithCliToken(
     buildUrl(host, path, params),
     {
       method: upperMethod,
@@ -75,19 +75,19 @@ async function kbApi(ctx, method, path, params = {}, body) {
       },
       body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
     },
-    mcpToken
+    cliToken
   );
 }
 async function kbUpload(ctx, path, form, params = {}) {
   const host = ctx.host();
-  const mcpToken = await getMcpToken(host);
-  return fetchWithMcpToken(
+  const cliToken = await getCliToken(host);
+  return fetchWithCliToken(
     buildUrl(host, path, params),
     {
       method: "POST",
       body: form
     },
-    mcpToken
+    cliToken
   );
 }
 

package/dist/{chunk-DMMEPCST.js → chunk-NGJDCOYA.js}

@@ -1,19 +1,18 @@
 import {
   getAnalysisMappingPathForClusterMode
-} from "./chunk-PN3OS34E.js";
+} from "./chunk-WXBCP6SD.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
 import {
-  getToken,
-  loadMcpToken
-} from "./chunk-RSHMZ3LG.js";
+  clearCliToken,
+  getCliToken
+} from "./chunk-OCQPQYHZ.js";
 import {
   getActiveHost,
-  getFallbackMcpToken,
   logger,
   safeJsonParse
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-65DKFJZB.js";
 
 // src/core/mcp.ts
 async function permissionMessage(resp) {
@@ -26,6 +25,9 @@ async function permissionMessage(resp) {
   }
   return "Permission denied for this resource (HTTP 403)";
 }
+function isInvalidCliTokenMessage(message) {
+  return /\b(cli[-_\s]?token|token)\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\b(cli[-_\s]?token|token)\b/i.test(message);
+}
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
 var serviceMappingMap = /* @__PURE__ */ new Map();
@@ -70,104 +72,14 @@ var requestIdCounter = 1;
 function genRequestId() {
   return requestIdCounter++;
 }
-var MCP_TOKEN_GENERATE_PATH = "/v1/ta/mcp/token/generate";
-var _mcpTokenCache = /* @__PURE__ */ new Map();
-async function generateMcpToken(hostUrl) {
-  const teToken = await getToken(hostUrl);
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = `${base}${MCP_TOKEN_GENERATE_PATH}`;
-  const resp = await fetch(url, {
-    method: "GET",
-    headers: {
-      "Authorization": `bearer ${teToken}`
-    }
-  });
-  if (!resp.ok) {
-    throw new Error(`MCP token generate HTTP error: ${resp.status} ${resp.statusText}`);
-  }
-  const data = safeJsonParse(await resp.text());
-  if (data.return_code !== 0) {
-    throw new Error(`MCP token generate error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
-  }
-  const mcpToken = data.data?.userSecret;
-  if (!mcpToken) {
-    throw new Error("MCP token generate error: empty userSecret in response");
-  }
-  return mcpToken;
-}
-async function getMcpToken(hostOverride) {
-  const hostUrl = hostOverride || getActiveHost();
-  const cached = _mcpTokenCache.get(hostUrl);
-  if (cached) {
-    return cached;
-  }
-  const storedToken = loadMcpToken(hostUrl);
-  if (storedToken) {
-    _mcpTokenCache.set(hostUrl, storedToken);
-    logger.info(`Using persisted MCP token (secure-store) for ${hostUrl}`);
-    return storedToken;
-  }
-  const fallbackToken = getFallbackMcpToken(hostUrl);
-  if (fallbackToken) {
-    _mcpTokenCache.set(hostUrl, fallbackToken);
-    logger.info(`Using sandbox-provisioned MCP token (fallback file) for ${hostUrl}`);
-    return fallbackToken;
-  }
-  logger.info(`Generating MCP token for ${hostUrl}`);
-  const mcpToken = await generateMcpToken(hostUrl);
-  _mcpTokenCache.set(hostUrl, mcpToken);
-  logger.info(`MCP token generated and in-process cached for ${hostUrl}`);
-  return mcpToken;
-}
-function clearMcpToken(hostUrl) {
-  if (hostUrl) {
-    _mcpTokenCache.delete(hostUrl);
-  } else {
-    _mcpTokenCache.clear();
-  }
-}
-function setMcpTokenManual(token, hostUrl) {
-  _mcpTokenCache.set(hostUrl, token);
-  logger.info(`MCP token manually set (in-process) for ${hostUrl}`);
-}
-async function validateMcpToken(token, hostUrl) {
-  const mapping = getMcpMapping("analysis");
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = `${base}/mcp/${mapping.componentName}/http/${mapping.mappingPath}`;
-  const requestId = 1;
-  const body = {
-    jsonrpc: JSONRPC_VERSION,
-    id: requestId,
-    method: "tools/list",
-    params: { _meta: { progressToken: requestId } }
-  };
-  const headers = {
-    "Content-Type": "application/json",
-    "Accept": "application/json, text/event-stream",
-    "mcp-protocol-version": MCP_PROTOCOL_VERSION,
-    "mcp-token": token
+function buildAuthHeaders(cliToken) {
+  return {
+    "cli-token": cliToken
   };
-  try {
-    const resp = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
-    });
-    if (!resp.ok) {
-      return false;
-    }
-    const data = safeJsonParse(await resp.text());
-    if (data.error) {
-      return false;
-    }
-    return data.result?.tools !== void 0;
-  } catch {
-    return false;
-  }
 }
 async function mcpRequest(url, method, params = {}, hostOverride) {
   const hostUrl = hostOverride || getActiveHost();
-  const token = await getMcpToken(hostUrl);
+  const token = await getCliToken(hostUrl);
   const requestId = genRequestId();
   const paramsWithMeta = {
     ...params,
@@ -183,7 +95,7 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     "Content-Type": "application/json",
     "Accept": "application/json, text/event-stream",
     "mcp-protocol-version": MCP_PROTOCOL_VERSION,
-    "mcp-token": token
+    ...buildAuthHeaders(token)
   };
   const resp = await fetch(url, {
     method: "POST",
@@ -191,19 +103,21 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
+    let permissionMsg;
     if (resp.status === 403) {
-      throw new PermissionError(await permissionMessage(resp));
+      permissionMsg = await permissionMessage(resp);
+      if (!isInvalidCliTokenMessage(permissionMsg)) {
+        throw new PermissionError(permissionMsg);
+      }
     }
-    if (resp.status === 401) {
-      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, re-minting token`);
-      _mcpTokenCache.delete(hostUrl);
-      const fallbackToken = getFallbackMcpToken(hostUrl);
-      const newToken = fallbackToken ?? await generateMcpToken(hostUrl);
-      _mcpTokenCache.set(hostUrl, newToken);
-      logger.info(`MCP token re-minted for ${hostUrl}`);
-      process.stderr.write(`[ae-cli] MCP token re-minted for ${hostUrl}
+    if (resp.status === 401 || resp.status === 403 && permissionMsg) {
+      logger.warn(`MCP request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${hostUrl}, refreshing CLI token`);
+      clearCliToken(hostUrl);
+      const newToken = await getCliToken(hostUrl);
+      logger.info(`CLI token refreshed for ${hostUrl}`);
+      process.stderr.write(`[ae-cli] CLI token refreshed for ${hostUrl}
 `);
-      headers["mcp-token"] = newToken;
+      Object.assign(headers, buildAuthHeaders(newToken));
       const retryResp = await fetch(url, {
         method: "POST",
         headers,
@@ -289,10 +203,6 @@ function mcpResultErrorMessage(parsed) {
 export {
   registerMcpMappings,
   resolveMcpUrl,
-  getMcpToken,
-  clearMcpToken,
-  setMcpTokenManual,
-  validateMcpToken,
   callMcpTool,
   parseMcpResult
 };

package/dist/chunk-NXJP4CES.js

@@ -0,0 +1,209 @@
+import {
+  getAnalysisMappingPathForClusterMode
+} from "./chunk-WXBCP6SD.js";
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  clearCliToken,
+  getCliToken
+} from "./chunk-OCQPQYHZ.js";
+import {
+  getActiveHost,
+  logger,
+  safeJsonParse
+} from "./chunk-65DKFJZB.js";
+
+// src/core/mcp.ts
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
+function isInvalidCliTokenMessage(message) {
+  return /\b(cli[-_\s]?token|token)\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\b(cli[-_\s]?token|token)\b/i.test(message);
+}
+var MCP_PROTOCOL_VERSION = "2025-11-25";
+var JSONRPC_VERSION = "2.0";
+var serviceMappingMap = /* @__PURE__ */ new Map();
+registerMcpMapping("analysis", {
+  componentName: "analysis",
+  mappingPath: "analysis"
+});
+registerMcpMapping("te_analysis_extend", {
+  componentName: "analysis",
+  mappingPath: "analysis-extend"
+});
+function registerMcpMapping(serviceName, mapping) {
+  serviceMappingMap.set(serviceName, mapping);
+}
+function registerMcpMappings(mappings) {
+  for (const [serviceName, mapping] of Object.entries(mappings)) {
+    serviceMappingMap.set(serviceName, mapping);
+  }
+}
+function getMcpMapping(serviceName) {
+  const mapping = serviceMappingMap.get(serviceName);
+  if (!mapping) {
+    throw new Error(`MCP mapping not found for service: '${serviceName}'. Please register it using registerMcpMapping() first.`);
+  }
+  if (serviceName === "analysis") {
+    return { ...mapping, mappingPath: getAnalysisMappingPathForClusterMode() };
+  }
+  return mapping;
+}
+function buildMcpUrl(host, serviceName) {
+  const mapping = getMcpMapping(serviceName);
+  const base = host.replace(/\/+$/, "");
+  return `${base}/mcp/${mapping.componentName}/http/${mapping.mappingPath}`;
+}
+function resolveMcpUrl(mcpUrlOverride, host, serviceName) {
+  if (mcpUrlOverride) {
+    return mcpUrlOverride;
+  }
+  return buildMcpUrl(host, serviceName);
+}
+var requestIdCounter = 1;
+function genRequestId() {
+  return requestIdCounter++;
+}
+function buildAuthHeaders(cliToken) {
+  return {
+    "cli-token": cliToken
+  };
+}
+async function mcpRequest(url, method, params = {}, hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  const token = await getCliToken(hostUrl);
+  const requestId = genRequestId();
+  const paramsWithMeta = {
+    ...params,
+    _meta: { progressToken: requestId }
+  };
+  const body = {
+    jsonrpc: JSONRPC_VERSION,
+    id: requestId,
+    method,
+    params: paramsWithMeta
+  };
+  const headers = {
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream",
+    "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+    "X-Source": "ae-cli",
+    ...buildAuthHeaders(token)
+  };
+  const resp = await fetch(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  });
+  if (!resp.ok) {
+    let permissionMsg;
+    if (resp.status === 403) {
+      permissionMsg = await permissionMessage(resp);
+      if (!isInvalidCliTokenMessage(permissionMsg)) {
+        throw new PermissionError(permissionMsg);
+      }
+    }
+    if (resp.status === 401 || resp.status === 403 && permissionMsg) {
+      logger.warn(`MCP request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${hostUrl}, refreshing CLI token`);
+      clearCliToken(hostUrl);
+      const newToken = await getCliToken(hostUrl);
+      logger.info(`CLI token refreshed for ${hostUrl}`);
+      process.stderr.write(`[ae-cli] CLI token refreshed for ${hostUrl}
+`);
+      Object.assign(headers, buildAuthHeaders(newToken));
+      const retryResp = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body)
+      });
+      if (retryResp.status === 403) {
+        throw new PermissionError(await permissionMessage(retryResp));
+      }
+      if (!retryResp.ok) {
+        throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);
+      }
+      const retryData = safeJsonParse(await retryResp.text());
+      if (retryData.error) {
+        throw new Error(`MCP error: ${retryData.error.message || JSON.stringify(retryData.error)}`);
+      }
+      return retryData.result;
+    }
+    throw new Error(`MCP HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  const data = safeJsonParse(await resp.text());
+  if (data.error) {
+    throw new Error(`MCP error: ${data.error.message || JSON.stringify(data.error)}`);
+  }
+  return data.result;
+}
+async function callMcpTool(url, toolName, args = {}, hostOverride) {
+  const params = {
+    name: toolName,
+    arguments: args
+  };
+  logger.info(`MCP tool call: ${toolName}`);
+  const result = await mcpRequest(url, "tools/call", params, hostOverride);
+  if (result.isError) {
+    logger.warn(`MCP tool call failed: ${toolName}`);
+  }
+  return {
+    content: result.content.map((item) => {
+      if (item.type === "text") {
+        return { type: "text", text: item.text };
+      } else if (item.type === "image") {
+        return { type: "image", data: item.data, mimeType: item.mimeType };
+      } else {
+        return { type: "resource", ...item };
+      }
+    }),
+    isError: result.isError
+  };
+}
+function parseMcpResult(result) {
+  if (result.content.length > 0 && result.content[0].type === "text") {
+    const text = result.content[0].text || "";
+    let parsed;
+    try {
+      parsed = safeJsonParse(text);
+    } catch {
+      return text;
+    }
+    const errMsg = mcpResultErrorMessage(parsed);
+    if (errMsg !== null) {
+      if (/no_auth|auth_error|permission|forbidden|unauthor|\u65e0\u6743/i.test(errMsg)) {
+        throw new PermissionError(errMsg);
+      }
+      throw new Error(errMsg);
+    }
+    return parsed;
+  }
+  return result;
+}
+function mcpResultErrorMessage(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.success === true || parsed.ok === true) return null;
+  const e = parsed.error;
+  if (typeof e === "string" && e.trim()) return e;
+  if (e && typeof e === "object") {
+    const msg = typeof e.message === "string" && e.message || void 0;
+    const code = typeof e.code === "string" && e.code || void 0;
+    if (msg && code) return `${code}: ${msg}`;
+    if (msg || code) return msg || code;
+  }
+  return null;
+}
+
+export {
+  registerMcpMappings,
+  resolveMcpUrl,
+  callMcpTool,
+  parseMcpResult
+};