@thinkingai/ae-cli 6.0.20 → 6.0.24

package/dist/chunk-OCQPQYHZ.js

@@ -0,0 +1,105 @@
+import {
+  getToken,
+  load,
+  loadCliToken,
+  save
+} from "./chunk-PFJFZVCK.js";
+import {
+  getActiveHost,
+  getFallbackCliToken,
+  listHosts,
+  logger,
+  safeJsonParse
+} from "./chunk-65DKFJZB.js";
+
+// src/core/cli-token.ts
+var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
+var _cliTokenCache = /* @__PURE__ */ new Map();
+async function generateCliToken(hostUrl) {
+  const accessToken = await getToken(hostUrl);
+  const base = hostUrl.replace(/\/+$/, "");
+  const url = `${base}${CLI_TOKEN_GENERATE_PATH}`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Authorization": `bearer ${accessToken}`
+    }
+  });
+  if (!resp.ok) {
+    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  const data = safeJsonParse(await resp.text());
+  if (data.return_code !== 0) {
+    throw new Error(`CLI token generate error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
+  }
+  const cliToken = data.data?.userSecret;
+  if (!cliToken) {
+    throw new Error("CLI token generate error: empty userSecret in response");
+  }
+  return cliToken;
+}
+function persistCliTokenIfPossible(hostUrl, cliToken) {
+  const existing = load(hostUrl);
+  if (!existing) {
+    logger.info(`cli-token: no secure-store session for ${hostUrl}, keeping token in-process only`);
+    return;
+  }
+  save(hostUrl, { ...existing, cliToken });
+}
+function clearPersistedCliToken(hostUrl) {
+  const existing = load(hostUrl);
+  if (existing?.cliToken) {
+    save(hostUrl, { ...existing, cliToken: void 0 });
+  }
+}
+async function getCliToken(hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  const cached = _cliTokenCache.get(hostUrl);
+  if (cached) {
+    return cached;
+  }
+  const storedToken = loadCliToken(hostUrl);
+  if (storedToken) {
+    _cliTokenCache.set(hostUrl, storedToken);
+    logger.info(`Using persisted CLI token (secure-store) for ${hostUrl}`);
+    return storedToken;
+  }
+  const fallbackToken = getFallbackCliToken(hostUrl);
+  if (fallbackToken) {
+    _cliTokenCache.set(hostUrl, fallbackToken);
+    logger.info(`Using sandbox-provisioned CLI token (fallback file) for ${hostUrl}`);
+    return fallbackToken;
+  }
+  return mintCliToken(hostUrl);
+}
+async function mintCliToken(hostUrl) {
+  logger.info(`Generating CLI token for ${hostUrl}`);
+  const cliToken = await generateCliToken(hostUrl);
+  _cliTokenCache.set(hostUrl, cliToken);
+  persistCliTokenIfPossible(hostUrl, cliToken);
+  logger.info(`CLI token generated, cached, and persisted for ${hostUrl}`);
+  return cliToken;
+}
+function clearCliToken(hostUrl) {
+  if (hostUrl) {
+    _cliTokenCache.delete(hostUrl);
+    clearPersistedCliToken(hostUrl);
+    return;
+  }
+  _cliTokenCache.clear();
+  for (const { url } of listHosts()) {
+    clearPersistedCliToken(url);
+  }
+}
+function setCliTokenManual(token, hostUrl) {
+  _cliTokenCache.set(hostUrl, token);
+  persistCliTokenIfPossible(hostUrl, token);
+  logger.info(`CLI token set for ${hostUrl}`);
+}
+
+export {
+  getCliToken,
+  mintCliToken,
+  clearCliToken,
+  setCliTokenManual
+};

package/dist/{chunk-2DUEAXV3.js → chunk-ONOA6DYB.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-65DKFJZB.js";
 
 // src/framework/output.ts
 import Table from "cli-table3";

package/dist/{chunk-RSHMZ3LG.js → chunk-PFJFZVCK.js}

@@ -2,13 +2,8 @@ import {
   getActiveHost,
   getConfigDir,
   logger,
-  safeJsonParse,
-  safeReadJsonFile
-} from "./chunk-6W4QOZAL.js";
-
-// src/core/auth.ts
-import fs2 from "fs";
-import path2 from "path";
+  safeJsonParse
+} from "./chunk-65DKFJZB.js";
 
 // src/core/secure-store.ts
 import crypto from "crypto";
@@ -170,15 +165,15 @@ async function getValidAccessToken(host) {
   if (payload.refreshToken) {
     logger.info(`secure-store: access token past local expiry for ${host}, refreshing\u2026`);
     const refreshed = await doRefresh(host, payload.refreshToken);
-    save(host, { ...refreshed, mcpToken: payload.mcpToken });
+    save(host, { ...refreshed, cliToken: payload.cliToken });
     logger.info(`secure-store: token refreshed for ${host}`);
     return refreshed.accessToken;
   }
   logger.info(`secure-store: ${host} past static local expiry, no refresh token \u2014 returning stored token, server validates (lazy)`);
   return payload.accessToken;
 }
-function loadMcpToken(host) {
-  return load(host)?.mcpToken ?? null;
+function loadCliToken(host) {
+  return load(host)?.cliToken ?? null;
 }
 async function doRefresh(host, refreshToken) {
   const base = host.replace(/\/+$/, "");
@@ -236,22 +231,6 @@ var SecureStoreAuthError = class extends Error {
 };
 
 // src/core/auth.ts
-var TOKENS_FILE = path2.join(getConfigDir(), "tokens.json");
-var LEGACY_MCP_TOKENS_FILE = path2.join(getConfigDir(), "mcp-tokens.json");
-var LEGACY_DIR = path2.join(process.env.HOME || "", ".te-mcp");
-(function removeLegacyMcpTokens() {
-  try {
-    if (fs2.existsSync(LEGACY_MCP_TOKENS_FILE)) {
-      fs2.rmSync(LEGACY_MCP_TOKENS_FILE);
-      logger.info("auth: removed legacy mcp-tokens.json (plaintext MCP token file)");
-    }
-  } catch {
-  }
-})();
-function ensureDir() {
-  const dir = getConfigDir();
-  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-}
 function resolveHost(hostOverride) {
   if (hostOverride) return hostOverride;
   return getActiveHost();
@@ -270,95 +249,11 @@ async function validateToken(token, hostUrl) {
     return false;
   }
 }
-function loadAllTokens() {
-  try {
-    const legacyTokens = path2.join(LEGACY_DIR, "tokens.json");
-    if (fs2.existsSync(legacyTokens) && !fs2.existsSync(TOKENS_FILE)) {
-      const data = safeReadJsonFile(legacyTokens);
-      const migrated = {};
-      for (const [key, val] of Object.entries(data)) {
-        const url = key.startsWith("http") ? key : `https://${key}`;
-        migrated[url] = val;
-      }
-      ensureDir();
-      fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
-      return migrated;
-    }
-    if (fs2.existsSync(TOKENS_FILE)) {
-      const data = safeReadJsonFile(TOKENS_FILE);
-      if (data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 0) {
-        try {
-          fs2.unlinkSync(TOKENS_FILE);
-        } catch {
-        }
-        return {};
-      }
-      let needsMigration = false;
-      const migrated = {};
-      for (const [key, val] of Object.entries(data)) {
-        if (!key.startsWith("http")) {
-          migrated[`https://${key}`] = val;
-          needsMigration = true;
-        } else {
-          migrated[key] = val;
-        }
-      }
-      if (needsMigration) {
-        fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
-        return migrated;
-      }
-      return data;
-    }
-  } catch {
-  }
-  return {};
-}
-function saveAllTokens(tokens) {
-  ensureDir();
-  if (Object.keys(tokens).length === 0) {
-    try {
-      fs2.unlinkSync(TOKENS_FILE);
-    } catch {
-    }
-    return;
-  }
-  fs2.writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2));
-  try {
-    fs2.chmodSync(TOKENS_FILE, 384);
-  } catch {
-  }
-}
-function loadToken(hostUrl) {
-  const tokens = loadAllTokens();
-  const entry = tokens[hostUrl];
-  if (!entry || !entry.token) return null;
-  return { host: hostUrl, token: entry.token, updatedAt: entry.updatedAt };
-}
-function saveToken(token, hostUrl) {
-  const tokens = loadAllTokens();
-  tokens[hostUrl] = { token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  saveAllTokens(tokens);
-  logger.info(`Token saved for ${hostUrl}`);
-}
-function clearToken(hostUrl) {
-  const tokens = loadAllTokens();
-  delete tokens[hostUrl];
-  saveAllTokens(tokens);
-}
-function setTokenManual(token, hostUrl) {
-  saveToken(token, hostUrl);
-}
-function getAuthStatus(hostUrl) {
-  if (process.env.TE_TOKEN) {
-    return { authenticated: true, host: hostUrl, source: "env:TE_TOKEN" };
-  }
-  const cached = loadToken(hostUrl);
-  if (cached) {
-    const ageMs = Date.now() - new Date(cached.updatedAt).getTime();
-    const hours = Math.round(ageMs / 36e5);
-    return { authenticated: true, host: hostUrl, tokenAge: `${hours}h ago`, source: "cache" };
-  }
-  return { authenticated: false, host: hostUrl };
+function invalidateAccessTokenForRetry(hostUrl) {
+  const payload = load(hostUrl);
+  if (!payload) return;
+  save(hostUrl, { ...payload, accessExpiresAt: (/* @__PURE__ */ new Date(0)).toISOString() });
+  logger.info(`auth: marked access token stale for retry on ${hostUrl}`);
 }
 async function getToken(hostUrl) {
   if (!hostUrl) {
@@ -367,15 +262,6 @@ async function getToken(hostUrl) {
 Run: ae-cli config set-host <url>`
     );
   }
-  if (process.env.TE_TOKEN) {
-    logger.info("Using token from env:TE_TOKEN");
-    return process.env.TE_TOKEN;
-  }
-  const cached = loadToken(hostUrl);
-  if (cached && cached.token) {
-    logger.info(`Using cached token for ${hostUrl}`);
-    return cached.token;
-  }
   try {
     const secureToken = await getValidAccessToken(hostUrl);
     logger.info(`Using secure-store token for ${hostUrl}`);
@@ -389,10 +275,7 @@ Run: ae-cli config set-host <url>`
   }
   throw new Error(
     `Cannot obtain token for ${hostUrl}.
-Options:
-  1. ae-cli auth login   (device code flow, cross-platform)
-  2. ae-cli auth set-token <token>
-  3. export TE_TOKEN=<token>  (CI/headless)`
+Run: ae-cli auth login   (device code flow, cross-platform)`
   );
 }
 
@@ -400,14 +283,10 @@ export {
   save,
   load,
   clear,
-  loadMcpToken,
+  loadCliToken,
   SecureStoreAuthError,
   resolveHost,
   validateToken,
-  loadToken,
-  saveToken,
-  clearToken,
-  setTokenManual,
-  getAuthStatus,
+  invalidateAccessTokenForRetry,
   getToken
 };

package/dist/chunk-V5R5UIRM.js

@@ -0,0 +1,195 @@
+import {
+  PermissionError
+} from "./chunk-NOO24N7W.js";
+import {
+  clearCliToken,
+  getCliToken
+} from "./chunk-OCQPQYHZ.js";
+import {
+  logger,
+  safeJsonParse
+} from "./chunk-65DKFJZB.js";
+
+// src/core/capability-api.ts
+import { readFile } from "fs/promises";
+import { basename } from "path";
+var CapabilityGatewayError = class extends Error {
+  constructor(message, code, httpStatus, hint) {
+    super(message);
+    this.code = code;
+    this.httpStatus = httpStatus;
+    this.hint = hint;
+    this.name = "CapabilityGatewayError";
+  }
+  code;
+  httpStatus;
+  hint;
+};
+function buildCapabilityGatewayUrl(host, domain, pathAfterV1, queryParams = {}) {
+  const base = host.replace(/\/+$/, "");
+  const cleanDomain = domain.replace(/^\/+|\/+$/g, "");
+  const cleanPath = pathAfterV1.replace(/^\/+|\/+$/g, "");
+  const gatewayPrefix = cleanDomain === "" ? "/api/cli/v1" : `/api/cli/${cleanDomain}/v1`;
+  const url = new URL(`${base}${gatewayPrefix}/${cleanPath}`);
+  for (const [key, value] of Object.entries(queryParams)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+async function permissionMessage(resp) {
+  const text = await resp.text().catch(() => "");
+  try {
+    const d = safeJsonParse(text);
+    const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
+    if (msg && typeof msg === "string") return msg;
+  } catch {
+  }
+  return "Permission denied for this resource (HTTP 403)";
+}
+function parseCapabilityResponse(text) {
+  if (!text) return void 0;
+  try {
+    return safeJsonParse(text);
+  } catch {
+    return text;
+  }
+}
+function unwrapCapabilityEnvelope(body) {
+  if (body == null) {
+    throw new CapabilityGatewayError("Empty capability gateway response");
+  }
+  if (typeof body.ok === "boolean") {
+    if (body.ok) {
+      return body.data;
+    }
+    const err = body.error ?? {};
+    const code = nonEmptyString(err.code);
+    const message = nonEmptyString(err.message) ?? code ?? "Capability gateway request failed";
+    const hint = nonEmptyString(err.hint);
+    throw new CapabilityGatewayError(message, code, err.http_status ?? err.httpStatus, hint);
+  }
+  return body;
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function buildCapabilityHttpError(resp, body) {
+  const fallback = `Capability gateway HTTP error: ${resp.status} ${resp.statusText}`.trim();
+  if (body && typeof body === "object") {
+    const err = body.error ?? body.data?.error ?? body;
+    const code = nonEmptyString(err.code) ?? nonEmptyString(err.errorCode) ?? nonEmptyString(body.code);
+    const message = nonEmptyString(err.message) ?? nonEmptyString(body.message);
+    const hint = nonEmptyString(err.hint) ?? nonEmptyString(body.hint);
+    const details = [code, message, hint ? `Hint: ${hint}` : void 0].filter(Boolean);
+    if (details.length > 0) {
+      return new CapabilityGatewayError(message ?? fallback, code, resp.status, hint);
+    }
+  }
+  if (typeof body === "string" && body.trim()) {
+    return new CapabilityGatewayError(`${fallback}: ${body.slice(0, 500)}`, void 0, resp.status);
+  }
+  return new CapabilityGatewayError(fallback, void 0, resp.status);
+}
+async function throwCapabilityHttpError(resp) {
+  const body = parseCapabilityResponse(await resp.text());
+  throw buildCapabilityHttpError(resp, body);
+}
+async function requestOnce(url, method, token, body) {
+  const headers = {
+    "cli-token": token,
+    "Accept": "application/json",
+    "X-Source": "ae-cli"
+  };
+  const init = { method, headers };
+  if (body !== void 0 && method !== "GET") {
+    headers["Content-Type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  return fetch(url, init);
+}
+async function requestMultipartOnce(url, token, form) {
+  return fetch(url, {
+    method: "POST",
+    headers: {
+      "cli-token": token,
+      "Accept": "application/json",
+      "X-Source": "ae-cli"
+    },
+    body: form
+  });
+}
+async function callGateway(host, domain, pathAfterV1, method, body) {
+  const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
+  const token = await getCliToken(host);
+  let resp = await requestOnce(url, method, token, body);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestOnce(url, method, newToken, body);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      await throwCapabilityHttpError(resp);
+    }
+  } else if (!resp.ok) {
+    await throwCapabilityHttpError(resp);
+  }
+  return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
+}
+async function executeCapability(host, domain, capabilityId, input = {}) {
+  return callGateway(host, domain, `capabilities/${capabilityId}/execute`, "POST", { input });
+}
+async function uploadInputFile(host, domain, projectId, purpose, filePath) {
+  const fileBytes = await readFile(filePath);
+  return uploadInputFileBytes(host, domain, projectId, purpose, fileBytes, basename(filePath));
+}
+async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, filename, contentType = "application/octet-stream") {
+  const url = buildCapabilityGatewayUrl(host, domain, "input-files");
+  const fileBuffer = bytes instanceof ArrayBuffer ? bytes : bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+  const form = new FormData();
+  form.append("project_id", String(projectId));
+  form.append("purpose", purpose);
+  form.append("file", new Blob([fileBuffer], { type: contentType }), filename);
+  const token = await getCliToken(host);
+  let resp = await requestMultipartOnce(url, token, form);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestMultipartOnce(url, newToken, form);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      await throwCapabilityHttpError(resp);
+    }
+  } else if (!resp.ok) {
+    await throwCapabilityHttpError(resp);
+  }
+  return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
+}
+
+export {
+  CapabilityGatewayError,
+  buildCapabilityGatewayUrl,
+  executeCapability,
+  uploadInputFile,
+  uploadInputFileBytes
+};

package/dist/{chunk-PN3OS34E.js → chunk-WXBCP6SD.js}

@@ -2,7 +2,7 @@ import {
   getSandboxClusterInfoFilePath,
   logger,
   safeReadJsonFile
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-65DKFJZB.js";
 
 // src/core/cluster-info.ts
 import fs from "fs";

package/dist/cli-token-OZXHC3U2.js

@@ -0,0 +1,14 @@
+import {
+  clearCliToken,
+  getCliToken,
+  mintCliToken,
+  setCliTokenManual
+} from "./chunk-OCQPQYHZ.js";
+import "./chunk-PFJFZVCK.js";
+import "./chunk-65DKFJZB.js";
+export {
+  clearCliToken,
+  getCliToken,
+  mintCliToken,
+  setCliTokenManual
+};

package/dist/{client-2UJ63MVQ.js → client-7L735LVY.js}

@@ -7,9 +7,9 @@ import {
   queryReportData,
   querySql,
   wsQuery
-} from "./chunk-BJX3GXWC.js";
-import "./chunk-RSHMZ3LG.js";
-import "./chunk-6W4QOZAL.js";
+} from "./chunk-F3ZDMC2W.js";
+import "./chunk-PFJFZVCK.js";
+import "./chunk-65DKFJZB.js";
 export {
   httpDelete,
   httpGet,

package/dist/{config-NCUGK6NS.js → config-SXD2JKSL.js}

@@ -1,19 +1,19 @@
 import {
   printError,
   printOutput
-} from "./chunk-2DUEAXV3.js";
+} from "./chunk-ONOA6DYB.js";
 import {
   GLOBAL_QUERY_CONFIG_KEY,
   getAnalysisMappingPathForClusterMode,
   getClusterInfoFilePath,
   isGlobalQueryModeEnabled,
   setGlobalQueryModeEnabled
-} from "./chunk-PN3OS34E.js";
+} from "./chunk-WXBCP6SD.js";
 import {
   addHost,
   loadConfig,
   setActiveHost
-} from "./chunk-6W4QOZAL.js";
+} from "./chunk-65DKFJZB.js";
 
 // src/commands/config.ts
 function registerConfig(program) {