@thinkingai/ae-cli 6.0.45 → 6.0.47

package/dist/chunk-O6K2ODUE.js

@@ -0,0 +1,318 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  getActiveHost,
+  getConfigDir,
+  normalizeUrl,
+  safeJsonParse
+} from "./chunk-KZ6ZHF5J.js";
+import {
+  logger
+} from "./chunk-FR2EDAQM.js";
+
+// src/core/secure-store.ts
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execFileSync } from "child_process";
+var STORE_DIR_SUFFIX = "secure-tokens";
+var SCRYPT_SALT = Buffer.from("ae-cli-secure-store-v1");
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var KEY_LEN = 32;
+var NONCE_LEN = 12;
+var REFRESH_TOKEN_PATH = "/v1/oauth/refreshForToken";
+function getMachineId() {
+  if (process.platform === "darwin") {
+    try {
+      const out = execFileSync(
+        "ioreg",
+        ["-rd1", "-c", "IOPlatformExpertDevice"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const m = out.match(/IOPlatformUUID.*?=.*?"([0-9A-F-]{36})"/i);
+      if (m?.[1]) return `darwin:${m[1]}`;
+    } catch {
+    }
+  }
+  if (process.platform === "linux") {
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      try {
+        const id = fs.readFileSync(p, "utf8").trim();
+        if (id) return `linux:${id}`;
+      } catch {
+      }
+    }
+  }
+  if (process.platform === "win32") {
+    try {
+      const out = execFileSync(
+        "reg",
+        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
+      if (m?.[1]) return `win32:${m[1]}`;
+    } catch {
+    }
+  }
+  const fallback = `${os.homedir()}|${os.hostname()}|${os.platform()}`;
+  logger.warn("secure-store: using fallback machine-id (HOME+hostname+platform)");
+  return `fallback:${fallback}`;
+}
+var _cachedMachineId;
+function getCachedMachineId() {
+  if (!_cachedMachineId) _cachedMachineId = getMachineId();
+  return _cachedMachineId;
+}
+function deriveKey(machineId) {
+  return crypto.scryptSync(machineId, SCRYPT_SALT, KEY_LEN, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P
+  });
+}
+var _cachedKey;
+function getKey() {
+  if (!_cachedKey) _cachedKey = deriveKey(getCachedMachineId());
+  return _cachedKey;
+}
+function encrypt(plaintext) {
+  const key = getKey();
+  const nonce = crypto.randomBytes(NONCE_LEN);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    nonce: nonce.toString("hex"),
+    tag: tag.toString("hex"),
+    data: encrypted.toString("hex")
+  };
+}
+function decrypt(blob) {
+  const key = getKey();
+  const nonce = Buffer.from(blob.nonce, "hex");
+  const tag = Buffer.from(blob.tag, "hex");
+  const data = Buffer.from(blob.data, "hex");
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
+  return decrypted.toString("utf8");
+}
+function storeDir() {
+  return path.join(getConfigDir(), STORE_DIR_SUFFIX);
+}
+function tokenFilePath(host) {
+  const safe = host.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "_");
+  return path.join(storeDir(), `${safe}.enc.json`);
+}
+function ensureStoreDir() {
+  const dir = storeDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+    try {
+      fs.chmodSync(dir, 448);
+    } catch {
+    }
+  }
+}
+function save(host, payload) {
+  ensureStoreDir();
+  const plaintext = JSON.stringify(payload);
+  const blob = encrypt(plaintext);
+  const filePath = tokenFilePath(host);
+  fs.writeFileSync(filePath, JSON.stringify(blob, null, 2), { encoding: "utf8" });
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+  logger.info(`secure-store: token saved for ${host}`);
+}
+function load(host) {
+  const filePath = tokenFilePath(host);
+  if (!fs.existsSync(filePath)) return null;
+  try {
+    const raw = fs.readFileSync(filePath, "utf8");
+    const blob = safeJsonParse(raw);
+    if (!blob?.nonce || !blob?.tag || !blob?.data) {
+      logger.warn(`secure-store: malformed blob for ${host}`);
+      return null;
+    }
+    const plaintext = decrypt(blob);
+    return JSON.parse(plaintext);
+  } catch (e) {
+    logger.error(`secure-store: decrypt failed for ${host}: ${e.message}`);
+    return null;
+  }
+}
+function clear(host) {
+  const filePath = tokenFilePath(host);
+  if (fs.existsSync(filePath)) {
+    fs.rmSync(filePath);
+    logger.info(`secure-store: token cleared for ${host}`);
+  }
+}
+async function getValidAccessToken(host) {
+  const payload = load(host);
+  if (!payload) {
+    throw new SecureStoreAuthError(
+      `No stored token for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  const expiresAt = new Date(payload.accessExpiresAt).getTime();
+  const now = Date.now();
+  const needsRefresh = expiresAt - now < 6e4;
+  if (!needsRefresh) {
+    return payload.accessToken;
+  }
+  if (payload.refreshToken) {
+    logger.info(`secure-store: access token past local expiry for ${host}, refreshing\u2026`);
+    const refreshed = await doRefresh(host, payload.refreshToken);
+    save(host, { ...refreshed, cliToken: payload.cliToken });
+    logger.info(`secure-store: token refreshed for ${host}`);
+    return refreshed.accessToken;
+  }
+  logger.info(`secure-store: ${host} past static local expiry, no refresh token \u2014 returning stored token, server validates (lazy)`);
+  return payload.accessToken;
+}
+function loadCliToken(host) {
+  return load(host)?.cliToken ?? null;
+}
+async function doRefresh(host, refreshToken) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}${REFRESH_TOKEN_PATH}`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken })
+    });
+  } catch (e) {
+    throw new SecureStoreAuthError(
+      `Token refresh network error for ${host}: ${e.message}. Please run: ae-cli auth login`
+    );
+  }
+  if (!resp.ok) {
+    throw new SecureStoreAuthError(
+      `Token refresh failed (HTTP ${resp.status}) for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  let body;
+  try {
+    body = safeJsonParse(await resp.text());
+  } catch {
+    throw new SecureStoreAuthError(
+      `Token refresh returned invalid JSON for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  if (body.return_code !== 0) {
+    throw new SecureStoreAuthError(
+      `Token refresh error (${body.return_code}: ${body.return_message ?? "unknown"}) for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  const d = body.data;
+  const newAccess = d?.accessToken ?? d?.access_token ?? "";
+  const newRefresh = d?.refreshToken ?? d?.refresh_token ?? refreshToken;
+  const expiresIn = d?.expiresIn ?? d?.expires_in ?? 72e3;
+  if (!newAccess) {
+    throw new SecureStoreAuthError(
+      `Token refresh returned empty accessToken for ${host}. Please run: ae-cli auth login`
+    );
+  }
+  return {
+    accessToken: newAccess,
+    refreshToken: newRefresh,
+    accessExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+  };
+}
+var SecureStoreAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecureStoreAuthError";
+  }
+};
+
+// src/core/host-guidance.ts
+var AE_TRIAL_URL = "https://thinkingai.cn/request-demo";
+var AE_HOST_SETUP_COMMAND = "ae-cli config set-host <url>";
+function missingAeHostHint(additionalAction) {
+  const actions = [
+    `If your organization already uses AgenticEngine, ask your administrator for its AE URL, then run: ${AE_HOST_SETUP_COMMAND}.`,
+    `If you do not have an AgenticEngine environment, request a trial: ${AE_TRIAL_URL}`
+  ];
+  if (additionalAction) actions.push(additionalAction);
+  return actions.join(" ");
+}
+function missingAeHostGuidance() {
+  return {
+    configure_host: AE_HOST_SETUP_COMMAND,
+    existing_customer: "Ask your AgenticEngine administrator for the AE environment URL.",
+    request_trial_url: AE_TRIAL_URL
+  };
+}
+
+// src/core/auth.ts
+function resolveHost(hostOverride) {
+  if (hostOverride) return normalizeUrl(hostOverride);
+  return getActiveHost();
+}
+async function validateToken(token, hostUrl) {
+  const url = `${hostUrl}/v1/oauth/checkToken`;
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ accessToken: token }).toString()
+    });
+    const respJson = safeJsonParse(await resp.text());
+    return respJson?.return_code === 0;
+  } catch {
+    return false;
+  }
+}
+function invalidateAccessTokenForRetry(hostUrl) {
+  const payload = load(hostUrl);
+  if (!payload) return;
+  save(hostUrl, { ...payload, accessExpiresAt: (/* @__PURE__ */ new Date(0)).toISOString() });
+  logger.info(`auth: marked access token stale for retry on ${hostUrl}`);
+}
+async function getToken(hostUrl) {
+  if (!hostUrl) {
+    throw new Error(
+      `No AE host configured.
+` + missingAeHostHint()
+    );
+  }
+  try {
+    const secureToken = await getValidAccessToken(hostUrl);
+    logger.info(`Using secure-store token for ${hostUrl}`);
+    return secureToken;
+  } catch (e) {
+    if (e instanceof SecureStoreAuthError) {
+      logger.info(`secure-store: ${e.message}`);
+    } else {
+      logger.warn(`secure-store unexpected error: ${e.message}`);
+    }
+  }
+  throw new Error(
+    `Cannot obtain token for ${hostUrl}.
+Run: ae-cli auth login   (device code flow, cross-platform)`
+  );
+}
+
+export {
+  save,
+  load,
+  clear,
+  loadCliToken,
+  SecureStoreAuthError,
+  AE_TRIAL_URL,
+  missingAeHostHint,
+  missingAeHostGuidance,
+  resolveHost,
+  validateToken,
+  invalidateAccessTokenForRetry,
+  getToken
+};