@thinkingai/ae-cli 6.0.24 → 6.0.28

package/dist/{auth-A2XXG5K4.js → auth-7TQRGLBC.js}

@@ -1,24 +1,25 @@
 import {
   printError,
   printOutput
-} from "./chunk-ONOA6DYB.js";
+} from "./chunk-ZAOL36CG.js";
 import {
   clearCliToken,
   mintCliToken
-} from "./chunk-OCQPQYHZ.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   clear,
   load,
   resolveHost,
   save
-} from "./chunk-PFJFZVCK.js";
+} from "./chunk-AJTH7LT3.js";
 import {
   getFallbackCliToken,
   loadConfig,
   logger,
+  normalizeUrl,
   removeHost,
   saveConfig
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -232,13 +233,14 @@ function resolveAuthHost(program, opts) {
 }
 function activateHostAfterLogin(host, explicitHostOverride) {
   if (!explicitHostOverride) return;
+  const normalized = normalizeUrl(host);
   const config = loadConfig();
-  if (!config.hosts[host]) {
-    config.hosts[host] = { label: host };
+  if (!config.hosts[normalized]) {
+    config.hosts[normalized] = { label: normalized };
   }
-  config.activeHost = host;
+  config.activeHost = normalized;
   saveConfig(config);
-  logger.info(`Active host set to ${host} after login`);
+  logger.info(`Active host set to ${normalized} after login`);
 }
 async function persistDeviceTokens(host, tokens) {
   const DEFAULT_EXPIRES_IN = 72e3;

package/dist/{auth-IDPKDFSY.js → auth-MEJ642P4.js}

@@ -3,8 +3,8 @@ import {
   invalidateAccessTokenForRetry,
   resolveHost,
   validateToken
-} from "./chunk-PFJFZVCK.js";
-import "./chunk-65DKFJZB.js";
+} from "./chunk-AJTH7LT3.js";
+import "./chunk-YCLVYFK7.js";
 export {
   getToken,
   invalidateAccessTokenForRetry,

package/dist/chunk-2NDGFQHW.js

@@ -0,0 +1,190 @@
+import {
+  getToken,
+  load,
+  loadCliToken,
+  save
+} from "./chunk-AJTH7LT3.js";
+import {
+  getActiveHost,
+  getConfigDir,
+  getFallbackCliToken,
+  listHosts,
+  logger,
+  normalizeUrl,
+  safeJsonParse,
+  safeReadJsonFile
+} from "./chunk-YCLVYFK7.js";
+
+// src/core/cli-token.ts
+import fs from "fs";
+import path from "path";
+var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
+var _cliTokenCache = /* @__PURE__ */ new Map();
+var _renewedLocalDateByHost = /* @__PURE__ */ new Map();
+var _renewInFlightByHost = /* @__PURE__ */ new Map();
+function renewHostKey(hostUrl) {
+  return normalizeUrl(hostUrl);
+}
+function renewStateFilePath() {
+  return path.join(getConfigDir(), "cli-token-renew.json");
+}
+function localRenewDate(now = /* @__PURE__ */ new Date()) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, "0");
+  const d = String(now.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+function loadRenewStore() {
+  try {
+    const file = renewStateFilePath();
+    if (!fs.existsSync(file)) return {};
+    const data = safeReadJsonFile(file);
+    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
+    return data;
+  } catch {
+    return {};
+  }
+}
+function saveRenewStore(store) {
+  const dir = getConfigDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const file = renewStateFilePath();
+  if (Object.keys(store).length === 0) {
+    try {
+      fs.unlinkSync(file);
+    } catch {
+    }
+    return;
+  }
+  fs.writeFileSync(file, JSON.stringify(store, null, 2), { encoding: "utf8" });
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function clearRenewState(hostUrl) {
+  if (hostUrl) {
+    const key = renewHostKey(hostUrl);
+    _renewedLocalDateByHost.delete(key);
+    _renewInFlightByHost.delete(key);
+    if (key !== hostUrl) {
+      _renewedLocalDateByHost.delete(hostUrl);
+      _renewInFlightByHost.delete(hostUrl);
+    }
+    const store = loadRenewStore();
+    let changed = false;
+    for (const k of /* @__PURE__ */ new Set([key, hostUrl])) {
+      if (store[k]) {
+        delete store[k];
+        changed = true;
+      }
+    }
+    if (changed) {
+      saveRenewStore(store);
+    }
+    return;
+  }
+  _renewedLocalDateByHost.clear();
+  _renewInFlightByHost.clear();
+  saveRenewStore({});
+}
+async function generateCliToken(hostUrl) {
+  const accessToken = await getToken(hostUrl);
+  const base = hostUrl.replace(/\/+$/, "");
+  const url = `${base}${CLI_TOKEN_GENERATE_PATH}`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Authorization": `bearer ${accessToken}`
+    }
+  });
+  if (!resp.ok) {
+    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  const data = safeJsonParse(await resp.text());
+  if (data.return_code !== 0) {
+    throw new Error(`CLI token generate error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
+  }
+  const cliToken = data.data?.userSecret;
+  if (!cliToken) {
+    throw new Error("CLI token generate error: empty userSecret in response");
+  }
+  return cliToken;
+}
+function persistCliTokenIfPossible(hostUrl, cliToken) {
+  const existing = load(hostUrl);
+  if (!existing) {
+    logger.info(`cli-token: no secure-store session for ${hostUrl}, keeping token in-process only`);
+    return;
+  }
+  save(hostUrl, { ...existing, cliToken });
+}
+function clearPersistedCliToken(hostUrl) {
+  const existing = load(hostUrl);
+  if (existing?.cliToken) {
+    save(hostUrl, { ...existing, cliToken: void 0 });
+  }
+}
+async function getCliToken(hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  let token = _cliTokenCache.get(hostUrl);
+  if (!token) {
+    const storedToken = loadCliToken(hostUrl);
+    if (storedToken) {
+      _cliTokenCache.set(hostUrl, storedToken);
+      logger.info(`Using persisted CLI token (secure-store) for ${hostUrl}`);
+      token = storedToken;
+    }
+  }
+  if (!token) {
+    const fallbackToken = getFallbackCliToken(hostUrl);
+    if (fallbackToken) {
+      _cliTokenCache.set(hostUrl, fallbackToken);
+      logger.info(`Using sandbox-provisioned CLI token (fallback file) for ${hostUrl}`);
+      token = fallbackToken;
+    }
+  }
+  if (!token) {
+    token = await mintCliToken(hostUrl);
+  }
+  return token;
+}
+async function mintCliToken(hostUrl) {
+  logger.info(`Generating CLI token for ${hostUrl}`);
+  const cliToken = await generateCliToken(hostUrl);
+  _cliTokenCache.set(hostUrl, cliToken);
+  persistCliTokenIfPossible(hostUrl, cliToken);
+  logger.info(`CLI token generated, cached, and persisted for ${hostUrl}`);
+  return cliToken;
+}
+function clearCliToken(hostUrl) {
+  if (hostUrl) {
+    _cliTokenCache.delete(hostUrl);
+    clearPersistedCliToken(hostUrl);
+    clearRenewState(hostUrl);
+    return;
+  }
+  _cliTokenCache.clear();
+  clearRenewState();
+  for (const { url } of listHosts()) {
+    clearPersistedCliToken(url);
+  }
+}
+function setCliTokenManual(token, hostUrl) {
+  _cliTokenCache.set(hostUrl, token);
+  persistCliTokenIfPossible(hostUrl, token);
+  logger.info(`CLI token set for ${hostUrl}`);
+}
+function _resetRenewMemoryForTest() {
+  _renewedLocalDateByHost.clear();
+  _renewInFlightByHost.clear();
+}
+
+export {
+  localRenewDate,
+  getCliToken,
+  mintCliToken,
+  clearCliToken,
+  setCliTokenManual,
+  _resetRenewMemoryForTest
+};

package/dist/{chunk-NGJDCOYA.js → chunk-7QQ4233A.js}

@@ -1,18 +1,18 @@
 import {
   getAnalysisMappingPathForClusterMode
-} from "./chunk-WXBCP6SD.js";
+} from "./chunk-KGJQCYVC.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-OCQPQYHZ.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   getActiveHost,
   logger,
   safeJsonParse
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/mcp.ts
 async function permissionMessage(resp) {

package/dist/{chunk-PFJFZVCK.js → chunk-AJTH7LT3.js}

@@ -2,8 +2,9 @@ import {
   getActiveHost,
   getConfigDir,
   logger,
+  normalizeUrl,
   safeJsonParse
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/secure-store.ts
 import crypto from "crypto";
@@ -232,7 +233,7 @@ var SecureStoreAuthError = class extends Error {
 
 // src/core/auth.ts
 function resolveHost(hostOverride) {
-  if (hostOverride) return hostOverride;
+  if (hostOverride) return normalizeUrl(hostOverride);
   return getActiveHost();
 }
 async function validateToken(token, hostUrl) {

package/dist/{chunk-V5R5UIRM.js → chunk-BXMXMUD7.js}

@@ -4,11 +4,11 @@ import {
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-OCQPQYHZ.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   logger,
   safeJsonParse
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
@@ -48,6 +48,9 @@ async function permissionMessage(resp) {
   }
   return "Permission denied for this resource (HTTP 403)";
 }
+function isInvalidCliTokenMessage(message) {
+  return /\byour token is invalid\b/i.test(message) || /\bcli[-_\s]?token\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\bcli[-_\s]?token\b/i.test(message);
+}
 function parseCapabilityResponse(text) {
   if (!text) return void 0;
   try {
@@ -120,15 +123,29 @@ async function requestMultipartOnce(url, token, form) {
     body: form
   });
 }
+async function requestDownloadOnce(url, token) {
+  return fetch(url, {
+    method: "GET",
+    headers: {
+      "cli-token": token,
+      "Accept": "*/*",
+      "X-Source": "ae-cli"
+    }
+  });
+}
 async function callGateway(host, domain, pathAfterV1, method, body) {
   const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
   const token = await getCliToken(host);
   let resp = await requestOnce(url, method, token, body);
+  let permissionMsg;
   if (resp.status === 403) {
-    throw new PermissionError(await permissionMessage(resp));
+    permissionMsg = await permissionMessage(resp);
+    if (!isInvalidCliTokenMessage(permissionMsg)) {
+      throw new PermissionError(permissionMsg);
+    }
   }
-  if (resp.status === 401) {
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
+  if (resp.status === 401 || resp.status === 403 && permissionMsg) {
+    logger.warn(`Capability gateway request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${host}, refreshing CLI token`);
     clearCliToken(host);
     const newToken = await getCliToken(host);
     process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
@@ -185,11 +202,53 @@ async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, fil
   }
   return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
 }
+async function downloadCapabilityArtifact(host, domain, runId, artifactId) {
+  const url = buildCapabilityGatewayUrl(
+    host,
+    domain,
+    `runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}/download`
+  );
+  const token = await getCliToken(host);
+  let resp = await requestDownloadOnce(url, token);
+  if (resp.status === 403) {
+    throw new PermissionError(await permissionMessage(resp));
+  }
+  if (resp.status === 401) {
+    logger.warn(`Capability gateway artifact download failed (HTTP 401) for ${host}, refreshing CLI token`);
+    clearCliToken(host);
+    const newToken = await getCliToken(host);
+    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
+`);
+    resp = await requestDownloadOnce(url, newToken);
+    if (resp.status === 403) {
+      throw new PermissionError(await permissionMessage(resp));
+    }
+    if (!resp.ok) {
+      await throwCapabilityHttpError(resp);
+    }
+  } else if (!resp.ok) {
+    await throwCapabilityHttpError(resp);
+  }
+  return {
+    bytes: Buffer.from(await resp.arrayBuffer()),
+    contentType: resp.headers.get("content-type") ?? void 0,
+    contentDisposition: resp.headers.get("content-disposition") ?? void 0
+  };
+}
+async function callCapabilityApi(host, domain, action, method = "POST", params = {}) {
+  const isGet = method === "GET";
+  if (isGet) {
+    return callGateway(host, domain, action.replace(/^\/+|\/+$/g, ""), "GET");
+  }
+  return callGateway(host, domain, action.replace(/^\/+|\/+$/g, ""), method, params);
+}
 
 export {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
   executeCapability,
   uploadInputFile,
-  uploadInputFileBytes
+  uploadInputFileBytes,
+  downloadCapabilityArtifact,
+  callCapabilityApi
 };

package/dist/{chunk-AKORWVHJ.js → chunk-C4DH76LX.js}

@@ -1,7 +1,7 @@
 import {
   buildCapabilityGatewayUrl,
   executeCapability
-} from "./chunk-V5R5UIRM.js";
+} from "./chunk-BXMXMUD7.js";
 
 // src/core/capability-routing.ts
 var cliServiceRoutes = /* @__PURE__ */ new Map();

package/dist/{chunk-NXJP4CES.js → chunk-GWZ5MYWE.js}

@@ -1,18 +1,18 @@
 import {
   getAnalysisMappingPathForClusterMode
-} from "./chunk-WXBCP6SD.js";
+} from "./chunk-KGJQCYVC.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-OCQPQYHZ.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   getActiveHost,
   logger,
   safeJsonParse
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/mcp.ts
 async function permissionMessage(resp) {

package/dist/{chunk-F3ZDMC2W.js → chunk-KCA6BA5D.js}

@@ -3,11 +3,11 @@ import {
   getToken,
   invalidateAccessTokenForRetry,
   resolveHost
-} from "./chunk-PFJFZVCK.js";
+} from "./chunk-AJTH7LT3.js";
 import {
   logger,
   safeJsonParse
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/client.ts
 import WebSocket from "ws";

package/dist/{chunk-WXBCP6SD.js → chunk-KGJQCYVC.js}

@@ -2,7 +2,7 @@ import {
   getSandboxClusterInfoFilePath,
   logger,
   safeReadJsonFile
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/cluster-info.ts
 import fs from "fs";

package/dist/{chunk-FIT4CFIN.js → chunk-LG5YT7P7.js}

@@ -1,7 +1,7 @@
 import {
   buildCapabilityGatewayUrl,
   executeCapability
-} from "./chunk-2OW2RENH.js";
+} from "./chunk-YNQFYBDB.js";
 
 // src/core/capability-routing.ts
 var cliServiceRoutes = /* @__PURE__ */ new Map();

package/dist/{chunk-IDXW6MEJ.js → chunk-MDJGDI6K.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-NOO24N7W.js";
 import {
   getCliToken
-} from "./chunk-OCQPQYHZ.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   safeJsonParse
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {

package/dist/{chunk-4FQ36OGO.js → chunk-R77JT7XD.js}

@@ -1,7 +1,7 @@
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-65DKFJZB.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -138,7 +138,7 @@ async function signRequest(method, path, rawBody) {
       "X-Sandbox-Id": sandboxCred.sandboxId,
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
-    if (method === "POST" || method === "PATCH") {
+    if (method === "POST" || method === "PATCH" || method === "PUT") {
       headers["Content-Type"] = "application/json";
     }
     return {
@@ -147,8 +147,8 @@ async function signRequest(method, path, rawBody) {
       rawBody
     };
   }
-  const { getToken } = await import("./auth-IDPKDFSY.js");
-  const { getCliToken } = await import("./cli-token-OZXHC3U2.js");
+  const { getToken } = await import("./auth-MEJ642P4.js");
+  const { getCliToken } = await import("./cli-token-TVQRSE46.js");
   const baseUrl = sandboxCred?.url || teClaudeBaseFromActiveHost();
   const hostForToken = getActiveHost() || baseUrl;
   if (!baseUrl) {
@@ -157,7 +157,7 @@ async function signRequest(method, path, rawBody) {
       "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
     );
   }
-  const contentTypeHeader = method === "POST" || method === "PATCH" ? { "Content-Type": "application/json" } : {};
+  const contentTypeHeader = method === "POST" || method === "PATCH" || method === "PUT" ? { "Content-Type": "application/json" } : {};
   let accessToken = null;
   try {
     accessToken = await getToken(hostForToken);
@@ -282,6 +282,51 @@ async function patchToMainApp(path, body) {
   });
   return parseResponse(response, "Main app returned");
 }
+async function putToMainApp(path, body) {
+  const rawBody = JSON.stringify(body);
+  const signed = await signRequest("PUT", path, rawBody);
+  const response = await fetchWithTimeout(signed.url, {
+    method: "PUT",
+    headers: signed.headers,
+    body: signed.rawBody
+  });
+  return parseResponse(response, "Main app returned");
+}
+async function getBufferFromMainApp(path) {
+  const signed = await signRequest("GET", path, "");
+  const response = await fetchWithTimeout(signed.url, {
+    method: "GET",
+    headers: signed.headers
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    let parsed = void 0;
+    if (text) {
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        parsed = text;
+      }
+    }
+    if (response.status === 401) {
+      throw new TeAgentApiError(
+        "Session expired or unauthorized. Please run: ae-cli auth login",
+        response.status,
+        "auth_expired",
+        parsed
+      );
+    }
+    const message = typeof parsed === "object" && parsed && typeof parsed.error === "string" ? parsed.error : `Main app returned ${response.status}`;
+    const code = typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : void 0;
+    throw new TeAgentApiError(message, response.status, code, parsed);
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+  const cd = response.headers.get("Content-Disposition") || "";
+  const match = cd.match(/filename\*=UTF-8''([^;]+)/);
+  const fileName = match ? decodeURIComponent(match[1]) : null;
+  return { buffer, fileName };
+}
 async function uploadToMainApp(path, formData) {
   const sandboxCred = tryLoadTeAgentSandboxCredentials();
   let baseUrl;
@@ -293,7 +338,7 @@ async function uploadToMainApp(path, formData) {
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
   } else {
-    const { getToken } = await import("./auth-IDPKDFSY.js");
+    const { getToken } = await import("./auth-MEJ642P4.js");
     baseUrl = (sandboxCred?.url || teClaudeBaseFromActiveHost() || "").replace(/\/$/, "");
     if (!baseUrl) {
       throw new TeAgentCredentialsError(
@@ -328,5 +373,7 @@ export {
   postSandboxSyncPull,
   deleteFromMainApp,
   patchToMainApp,
+  putToMainApp,
+  getBufferFromMainApp,
   uploadToMainApp
 };