@thinkingai/ae-cli 6.0.22 → 6.0.27

package/dist/{chunk-H52CSLJW.js → chunk-R77JT7XD.js}

@@ -1,7 +1,7 @@
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-WPXHCP4A.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -138,7 +138,7 @@ async function signRequest(method, path, rawBody) {
       "X-Sandbox-Id": sandboxCred.sandboxId,
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
-    if (method === "POST" || method === "PATCH") {
+    if (method === "POST" || method === "PATCH" || method === "PUT") {
       headers["Content-Type"] = "application/json";
     }
     return {
@@ -147,8 +147,8 @@ async function signRequest(method, path, rawBody) {
       rawBody
     };
   }
-  const { getToken } = await import("./auth-I2G7OAU2.js");
-  const { getCliToken } = await import("./cli-token-6AGEDJF4.js");
+  const { getToken } = await import("./auth-MEJ642P4.js");
+  const { getCliToken } = await import("./cli-token-TVQRSE46.js");
   const baseUrl = sandboxCred?.url || teClaudeBaseFromActiveHost();
   const hostForToken = getActiveHost() || baseUrl;
   if (!baseUrl) {
@@ -157,7 +157,7 @@ async function signRequest(method, path, rawBody) {
       "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
     );
   }
-  const contentTypeHeader = method === "POST" || method === "PATCH" ? { "Content-Type": "application/json" } : {};
+  const contentTypeHeader = method === "POST" || method === "PATCH" || method === "PUT" ? { "Content-Type": "application/json" } : {};
   let accessToken = null;
   try {
     accessToken = await getToken(hostForToken);
@@ -282,6 +282,51 @@ async function patchToMainApp(path, body) {
   });
   return parseResponse(response, "Main app returned");
 }
+async function putToMainApp(path, body) {
+  const rawBody = JSON.stringify(body);
+  const signed = await signRequest("PUT", path, rawBody);
+  const response = await fetchWithTimeout(signed.url, {
+    method: "PUT",
+    headers: signed.headers,
+    body: signed.rawBody
+  });
+  return parseResponse(response, "Main app returned");
+}
+async function getBufferFromMainApp(path) {
+  const signed = await signRequest("GET", path, "");
+  const response = await fetchWithTimeout(signed.url, {
+    method: "GET",
+    headers: signed.headers
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    let parsed = void 0;
+    if (text) {
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        parsed = text;
+      }
+    }
+    if (response.status === 401) {
+      throw new TeAgentApiError(
+        "Session expired or unauthorized. Please run: ae-cli auth login",
+        response.status,
+        "auth_expired",
+        parsed
+      );
+    }
+    const message = typeof parsed === "object" && parsed && typeof parsed.error === "string" ? parsed.error : `Main app returned ${response.status}`;
+    const code = typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : void 0;
+    throw new TeAgentApiError(message, response.status, code, parsed);
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+  const cd = response.headers.get("Content-Disposition") || "";
+  const match = cd.match(/filename\*=UTF-8''([^;]+)/);
+  const fileName = match ? decodeURIComponent(match[1]) : null;
+  return { buffer, fileName };
+}
 async function uploadToMainApp(path, formData) {
   const sandboxCred = tryLoadTeAgentSandboxCredentials();
   let baseUrl;
@@ -293,7 +338,7 @@ async function uploadToMainApp(path, formData) {
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
   } else {
-    const { getToken } = await import("./auth-I2G7OAU2.js");
+    const { getToken } = await import("./auth-MEJ642P4.js");
     baseUrl = (sandboxCred?.url || teClaudeBaseFromActiveHost() || "").replace(/\/$/, "");
     if (!baseUrl) {
       throw new TeAgentCredentialsError(
@@ -328,5 +373,7 @@ export {
   postSandboxSyncPull,
   deleteFromMainApp,
   patchToMainApp,
+  putToMainApp,
+  getBufferFromMainApp,
   uploadToMainApp
 };

package/dist/{chunk-WPXHCP4A.js → chunk-YCLVYFK7.js}

@@ -66,9 +66,14 @@ var Logger = class {
     }
     this.info(parts.join(" | "));
   }
-  /** Log command execution */
+  /** Log command execution (sensitive flags redacted to ***) */
   command(name, args) {
-    const filtered = Object.entries(args).filter(([, v]) => v !== void 0 && v !== null && v !== "").map(([k, v]) => `--${k}=${JSON.stringify(v)}`).join(" ");
+    const SENSITIVE = ["token", "apikey", "secret", "accesstoken", "headers"];
+    const isSensitive = (k) => {
+      const lk = k.toLowerCase();
+      return SENSITIVE.some((s) => lk.includes(s));
+    };
+    const filtered = Object.entries(args).filter(([, v]) => v !== void 0 && v !== null && v !== "").map(([k, v]) => `--${k}=${isSensitive(k) ? "***" : JSON.stringify(v)}`).join(" ");
     this.info(`CMD ${name}${filtered ? " " + filtered : ""}`);
   }
 };
@@ -88,6 +93,15 @@ function safeReadJsonFile(filePath) {
   return safeJsonParse(content);
 }
 
+// src/core/url-utils.ts
+function normalizeUrl(url) {
+  if (!url) return url;
+  if (!url.startsWith("http://") && !url.startsWith("https://")) {
+    url = `https://${url}`;
+  }
+  return url.replace(/\/$/, "");
+}
+
 // src/core/config.ts
 import fs3 from "fs";
 import path2 from "path";
@@ -143,9 +157,6 @@ function readSandboxCliTokenEntry() {
   }
   return null;
 }
-function ensureDir() {
-  if (!fs3.existsSync(CONFIG_DIR)) fs3.mkdirSync(CONFIG_DIR, { recursive: true });
-}
 function forceMigrateFromFallback() {
   const entry = readSandboxCliTokenEntry();
   if (!entry) return null;
@@ -159,16 +170,44 @@ function getFallbackCliToken(hostUrl) {
   if (entries.length === 1) return entries[0];
   return null;
 }
+function ensureDir() {
+  if (!fs3.existsSync(CONFIG_DIR)) fs3.mkdirSync(CONFIG_DIR, { recursive: true });
+}
+function dedupeNormalizedHosts(config) {
+  const hosts = {};
+  for (const [url, entry] of Object.entries(config.hosts)) {
+    const key = normalizeUrl(url);
+    if (!hosts[key]) {
+      hosts[key] = entry;
+    }
+  }
+  return {
+    activeHost: config.activeHost ? normalizeUrl(config.activeHost) : "",
+    hosts
+  };
+}
+function configNeedsNormalization(config) {
+  if (config.activeHost && normalizeUrl(config.activeHost) !== config.activeHost) return true;
+  const keys = Object.keys(config.hosts);
+  if (keys.some((url) => normalizeUrl(url) !== url)) return true;
+  return new Set(keys.map(normalizeUrl)).size !== keys.length;
+}
 function loadConfig() {
   try {
     if (fs3.existsSync(CONFIG_FILE)) {
       const raw = safeReadJsonFile(CONFIG_FILE);
       if (raw.defaultHost && !raw.activeHost) {
-        const migrated = migrateConfig(raw);
+        const migrated = dedupeNormalizedHosts(migrateConfig(raw));
         saveConfig(migrated);
         return migrated;
       }
-      return raw;
+      const rawConfig = raw;
+      if (configNeedsNormalization(rawConfig)) {
+        const config = dedupeNormalizedHosts(rawConfig);
+        saveConfig(config);
+        return config;
+      }
+      return rawConfig;
     }
   } catch (err) {
     logger.error(`Error loading config: ${err.message}`);
@@ -181,11 +220,11 @@ function migrateConfig(old) {
   const oldHost = old.defaultHost;
   if (old.hosts) {
     for (const [key, val] of Object.entries(old.hosts)) {
-      const url = key.startsWith("http") ? key : `https://${key}`;
+      const url = normalizeUrl(key.startsWith("http") ? key : `https://${key}`);
       hosts[url] = val;
     }
   }
-  const activeHost = oldHost.startsWith("http") ? oldHost : `https://${oldHost}`;
+  const activeHost = normalizeUrl(oldHost.startsWith("http") ? oldHost : `https://${oldHost}`);
   if (!hosts[activeHost]) {
     hosts[activeHost] = { label: "default" };
   }
@@ -203,6 +242,7 @@ function getActiveHost() {
   return config.activeHost || "";
 }
 function setActiveHost(url) {
+  url = normalizeUrl(url);
   const config = loadConfig();
   if (!config.hosts[url]) {
     throw new Error(`Host ${url} is not in the configured hosts list. Add it first.`);
@@ -211,6 +251,7 @@ function setActiveHost(url) {
   saveConfig(config);
 }
 function addHost(url, label) {
+  url = normalizeUrl(url);
   const config = loadConfig();
   assertUniqueHostLabel(config, label, url);
   config.hosts[url] = { label };
@@ -226,6 +267,7 @@ function assertUniqueHostLabel(config, label, excludeUrl) {
   }
 }
 function removeHost(url) {
+  url = normalizeUrl(url);
   const config = loadConfig();
   delete config.hosts[url];
   if (config.activeHost === url) {
@@ -250,6 +292,7 @@ export {
   logger,
   safeJsonParse,
   safeReadJsonFile,
+  normalizeUrl,
   getSandboxRuntimeRoot,
   getSandboxClusterInfoFilePath,
   getFallbackCliToken,

package/dist/{chunk-4EUZRJPO.js → chunk-YNQFYBDB.js}

@@ -4,30 +4,33 @@ import {
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-FPE5LGVU.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   logger,
   safeJsonParse
-} from "./chunk-WPXHCP4A.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
 import { basename } from "path";
 var CapabilityGatewayError = class extends Error {
-  constructor(message, code, httpStatus) {
+  constructor(message, code, httpStatus, hint) {
     super(message);
     this.code = code;
     this.httpStatus = httpStatus;
+    this.hint = hint;
     this.name = "CapabilityGatewayError";
   }
   code;
   httpStatus;
+  hint;
 };
 function buildCapabilityGatewayUrl(host, domain, pathAfterV1, queryParams = {}) {
   const base = host.replace(/\/+$/, "");
   const cleanDomain = domain.replace(/^\/+|\/+$/g, "");
   const cleanPath = pathAfterV1.replace(/^\/+|\/+$/g, "");
-  const url = new URL(`${base}/api/cli/${cleanDomain}/v1/${cleanPath}`);
+  const gatewayPrefix = cleanDomain === "" ? "/api/cli/v1" : `/api/cli/${cleanDomain}/v1`;
+  const url = new URL(`${base}${gatewayPrefix}/${cleanPath}`);
   for (const [key, value] of Object.entries(queryParams)) {
     if (value !== void 0 && value !== null) {
       url.searchParams.set(key, String(value));
@@ -45,6 +48,9 @@ async function permissionMessage(resp) {
   }
   return "Permission denied for this resource (HTTP 403)";
 }
+function isInvalidCliTokenMessage(message) {
+  return /\byour token is invalid\b/i.test(message) || /\bcli[-_\s]?token\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\bcli[-_\s]?token\b/i.test(message);
+}
 function parseCapabilityResponse(text) {
   if (!text) return void 0;
   try {
@@ -62,11 +68,37 @@ function unwrapCapabilityEnvelope(body) {
       return body.data;
     }
     const err = body.error ?? {};
-    const message = err.message || err.code || "Capability gateway request failed";
-    throw new CapabilityGatewayError(message, err.code, err.http_status ?? err.httpStatus);
+    const code = nonEmptyString(err.code);
+    const message = nonEmptyString(err.message) ?? code ?? "Capability gateway request failed";
+    const hint = nonEmptyString(err.hint);
+    throw new CapabilityGatewayError(message, code, err.http_status ?? err.httpStatus, hint);
   }
   return body;
 }
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function buildCapabilityHttpError(resp, body) {
+  const fallback = `Capability gateway HTTP error: ${resp.status} ${resp.statusText}`.trim();
+  if (body && typeof body === "object") {
+    const err = body.error ?? body.data?.error ?? body;
+    const code = nonEmptyString(err.code) ?? nonEmptyString(err.errorCode) ?? nonEmptyString(body.code);
+    const message = nonEmptyString(err.message) ?? nonEmptyString(body.message);
+    const hint = nonEmptyString(err.hint) ?? nonEmptyString(body.hint);
+    const details = [code, message, hint ? `Hint: ${hint}` : void 0].filter(Boolean);
+    if (details.length > 0) {
+      return new CapabilityGatewayError(message ?? fallback, code, resp.status, hint);
+    }
+  }
+  if (typeof body === "string" && body.trim()) {
+    return new CapabilityGatewayError(`${fallback}: ${body.slice(0, 500)}`, void 0, resp.status);
+  }
+  return new CapabilityGatewayError(fallback, void 0, resp.status);
+}
+async function throwCapabilityHttpError(resp) {
+  const body = parseCapabilityResponse(await resp.text());
+  throw buildCapabilityHttpError(resp, body);
+}
 async function requestOnce(url, method, token, body) {
   const headers = {
     "cli-token": token,
@@ -89,15 +121,28 @@ async function requestMultipartOnce(url, token, form) {
     body: form
   });
 }
+async function requestDownloadOnce(url, token) {
+  return fetch(url, {
+    method: "GET",
+    headers: {
+      "cli-token": token,
+      "Accept": "*/*"
+    }
+  });
+}
 async function callGateway(host, domain, pathAfterV1, method, body) {
   const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
   const token = await getCliToken(host);
   let resp = await requestOnce(url, method, token, body);
+  let permissionMsg;
   if (resp.status === 403) {
-    throw new PermissionError(await permissionMessage(resp));
+    permissionMsg = await permissionMessage(resp);
+    if (!isInvalidCliTokenMessage(permissionMsg)) {
+      throw new PermissionError(permissionMsg);
+    }
   }
-  if (resp.status === 401) {
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+  if (resp.status === 401 || resp.status === 403 && permissionMsg) {
+    logger.warn(`Capability gateway request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${host}, refreshing CLI token`);
     clearCliToken(host);
     const newToken = await getCliToken(host);
     process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
@@ -107,10 +152,10 @@ async function callGateway(host, domain, pathAfterV1, method, body) {
       throw new PermissionError(await permissionMessage(resp));
     }
     if (!resp.ok) {
-      throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+      await throwCapabilityHttpError(resp);
     }
   } else if (!resp.ok) {
-    throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+    await throwCapabilityHttpError(resp);
   }
   return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
 }
@@ -147,17 +192,60 @@ async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, fil
       throw new PermissionError(await permissionMessage(resp));
     }
     if (!resp.ok) {
-      throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+      await throwCapabilityHttpError(resp);
     }
   } else if (!resp.ok) {
-    throw new Error(`Capability gateway HTTP error: ${resp.status} ${resp.statusText}`);
+    await throwCapabilityHttpError(resp);
   }
   return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
 }
+async function downloadCapabilityArtifact(host, domain, runId, artifactId) {
+  const url = buildCapabilityGatewayUrl(
+    host,
+    domain,
+    `runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}/download`
+  );
+  const token = await getCliToken(host);
+  let resp = await requestDownloadOnce(url, token);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway artifact download failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestDownloadOnce(url, newToken);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      await throwCapabilityHttpError(resp);
+    }
+  } else if (!resp.ok) {
+    await throwCapabilityHttpError(resp);
+  }
+  return {
+    bytes: Buffer.from(await resp.arrayBuffer()),
+    contentType: resp.headers.get("content-type") ?? void 0,
+    contentDisposition: resp.headers.get("content-disposition") ?? void 0
+  };
+}
+async function callCapabilityApi(host, domain, action, method = "POST", params = {}) {
+  const isGet = method === "GET";
+  if (isGet) {
+    return callGateway(host, domain, action.replace(/^\/+|\/+$/g, ""), "GET");
+  }
+  return callGateway(host, domain, action.replace(/^\/+|\/+$/g, ""), method, params);
+}
 
 export {
+  CapabilityGatewayError,
   buildCapabilityGatewayUrl,
   executeCapability,
   uploadInputFile,
-  uploadInputFileBytes
+  uploadInputFileBytes,
+  downloadCapabilityArtifact,
+  callCapabilityApi
 };

package/dist/{chunk-YACCPUNQ.js → chunk-ZAOL36CG.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-WPXHCP4A.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/framework/output.ts
 import Table from "cli-table3";

package/dist/cli-token-TVQRSE46.js

@@ -0,0 +1,18 @@
+import {
+  _resetRenewMemoryForTest,
+  clearCliToken,
+  getCliToken,
+  localRenewDate,
+  mintCliToken,
+  setCliTokenManual
+} from "./chunk-2NDGFQHW.js";
+import "./chunk-AJTH7LT3.js";
+import "./chunk-YCLVYFK7.js";
+export {
+  _resetRenewMemoryForTest,
+  clearCliToken,
+  getCliToken,
+  localRenewDate,
+  mintCliToken,
+  setCliTokenManual
+};

package/dist/{client-VTJMUZ4O.js → client-2643Z5AG.js}

@@ -7,9 +7,9 @@ import {
   queryReportData,
   querySql,
   wsQuery
-} from "./chunk-E34XH4GW.js";
-import "./chunk-U6QPKCN3.js";
-import "./chunk-WPXHCP4A.js";
+} from "./chunk-KCA6BA5D.js";
+import "./chunk-AJTH7LT3.js";
+import "./chunk-YCLVYFK7.js";
 export {
   httpDelete,
   httpGet,

package/dist/{config-2SDTLGOC.js → config-ZVPARN4R.js}

@@ -1,19 +1,20 @@
 import {
   printError,
   printOutput
-} from "./chunk-YACCPUNQ.js";
+} from "./chunk-ZAOL36CG.js";
 import {
   GLOBAL_QUERY_CONFIG_KEY,
   getAnalysisMappingPathForClusterMode,
   getClusterInfoFilePath,
   isGlobalQueryModeEnabled,
   setGlobalQueryModeEnabled
-} from "./chunk-XE2PI5DS.js";
+} from "./chunk-KGJQCYVC.js";
 import {
   addHost,
   loadConfig,
+  normalizeUrl,
   setActiveHost
-} from "./chunk-WPXHCP4A.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/commands/config.ts
 function registerConfig(program) {
@@ -119,12 +120,6 @@ function failConfig(message, hint) {
   printError("config", message, hint);
   process.exitCode = 1;
 }
-function normalizeUrl(url) {
-  if (!url.startsWith("http://") && !url.startsWith("https://")) {
-    url = `https://${url}`;
-  }
-  return url.replace(/\/$/, "");
-}
 export {
   registerConfig
 };