npm - @thinkingai/ae-cli - Versions diffs - 6.0.47 → 6.0.48-workbuddy - Mend

@thinkingai/ae-cli 6.0.47 → 6.0.48-workbuddy

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (84) hide show

package/dist/auth-HJG2L6DR.js ADDED Viewed

@@ -0,0 +1,910 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  MultiselectCancelled,
+  promptSingleSelect
+} from "./chunk-7K24F7T2.js";
+import {
+  missingAeHostGuidance,
+  missingAeHostHint
+} from "./chunk-6ZIQV5GW.js";
+import {
+  getLocalCliPackageInfo
+} from "./chunk-E2JKXMVO.js";
+import {
+  resolveHost
+} from "./chunk-2BDQB42E.js";
+import {
+  printError,
+  printOutput,
+  runHostCompatCheck
+} from "./chunk-ZCM47ROU.js";
+import {
+  CliTokenValidationUnavailableError,
+  SecureStoreAuthError,
+  activateCredential,
+  clearAllCredentials,
+  clearCliTokenCache,
+  getActiveCredential,
+  listCredentials,
+  mintCliToken,
+  removeActiveCredential,
+  saveCredential,
+  updateCredentialMetadata,
+  validateCliTokenOnServer
+} from "./chunk-Y3S2KNNR.js";
+import {
+  getFallbackCliToken,
+  listHosts,
+  loadConfig,
+  normalizeUrl,
+  saveConfig
+} from "./chunk-ARTIHWVD.js";
+import {
+  PermissionError,
+  logger
+} from "./chunk-NXRKDG6E.js";
+// src/core/device-auth.ts
+import { execFileSync } from "child_process";
+var DeviceFlowUnsupportedError = class extends Error {
+  constructor() {
+    super("This AE server does not support device code login (it may be an older server version).");
+    this.name = "DeviceFlowUnsupportedError";
+  }
+};
+function looksLikeMissingEndpoint(status, contentType, body) {
+  if (status === 404) return true;
+  if (contentType && contentType.toLowerCase().includes("text/html")) return true;
+  const head = body.trimStart().toLowerCase();
+  return head.startsWith("<!doctype html") || head.startsWith("<html");
+}
+function openBrowser(url, _execFile) {
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    logger.warn(`openBrowser: invalid URL, not opening`);
+    return false;
+  }
+  if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+    logger.warn(`openBrowser: unsafe protocol "${parsedUrl.protocol}", not opening`);
+    return false;
+  }
+  const safeLogUrl = `${parsedUrl.origin}${parsedUrl.pathname}`;
+  const exec = _execFile ?? execFileSync;
+  try {
+    if (process.platform === "darwin") {
+      exec("open", [url], { timeout: 5e3 });
+      return true;
+    }
+    if (process.platform === "win32") {
+      exec("cmd", ["/c", "start", "", url], { timeout: 5e3 });
+      return true;
+    }
+    exec("xdg-open", [url], { timeout: 5e3 });
+    return true;
+  } catch (e) {
+    logger.warn(`openBrowser: failed to open ${safeLogUrl}: ${e.message}`);
+    return false;
+  }
+}
+async function authorizeDevice(host) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/authorize`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" }
+    });
+  } catch (e) {
+    throw new Error(`Device authorize request failed: ${e.message}`);
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    throw new DeviceFlowUnsupportedError();
+  }
+  if (!resp.ok) {
+    throw new Error(`Device authorize returned HTTP ${resp.status}: ${text}`);
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new Error("Device authorize returned invalid JSON");
+  }
+  if (!body.device_code || !body.user_code) {
+    throw new Error("Device authorize response missing required fields");
+  }
+  return body;
+}
+async function pollDeviceToken(host, deviceCode) {
+  const base = host.replace(/\/+$/, "");
+  const url = `${base}/api/auth/device/token`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+  } catch (e) {
+    return { status: "error", message: `Network error: ${e.message}` };
+  }
+  if (resp.status === 200) {
+    let body;
+    try {
+      body = await resp.json();
+    } catch {
+      return { status: "error", message: "Token response is not valid JSON" };
+    }
+    if (!body.access_token) {
+      return { status: "error", message: "Token response missing access_token" };
+    }
+    return { status: "approved", tokens: body };
+  }
+  if (resp.status === 400) {
+    let errorBody;
+    try {
+      errorBody = await resp.json();
+    } catch {
+      errorBody = {};
+    }
+    const err = errorBody.error;
+    if (err === "authorization_pending") return { status: "pending" };
+    if (err === "slow_down") return { status: "slow_down" };
+    if (err === "expired_token") return { status: "expired" };
+    return { status: "error", message: `Unknown error: ${err ?? "unknown"}` };
+  }
+  if (resp.status === 403) {
+    let errorBody = {};
+    try {
+      errorBody = await resp.json();
+    } catch {
+    }
+    return {
+      status: "denied",
+      code: errorBody.code ?? "CLI_ACCESS_DISABLED",
+      message: errorBody.message ?? errorBody.error ?? "CLI access is disabled for this account.",
+      hint: errorBody.hint
+    };
+  }
+  const contentType = resp.headers.get("content-type");
+  const text = await resp.text().catch(() => "");
+  if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
+    return { status: "unsupported" };
+  }
+  return { status: "error", message: `Unexpected HTTP ${resp.status} from token endpoint` };
+}
+function buildVerificationUrl(host, userCode) {
+  return `${host.replace(/\/+$/, "")}/device-activate?user_code=${encodeURIComponent(userCode)}`;
+}
+async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  let intervalMs = options.intervalMs ?? 5e3;
+  const expiresIn = options.expiresIn ?? 300;
+  const deadline = Date.now() + expiresIn * 1e3;
+  let pollCount = 0;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    pollCount++;
+    const result = await pollDeviceToken(host, deviceCode);
+    if (result.status === "approved") {
+      emit(`Authorization successful! (polled ${pollCount} time(s))`);
+      return result.tokens;
+    }
+    if (result.status === "pending") {
+      if (pollCount % 5 === 0) {
+        const remaining = Math.max(0, Math.round((deadline - Date.now()) / 1e3));
+        emit(`Waiting for authorization... (expires in ${remaining}s)`);
+      }
+      logger.info(`device-auth: poll #${pollCount} pending`);
+      continue;
+    }
+    if (result.status === "slow_down") {
+      intervalMs += 5e3;
+      logger.info(`device-auth: slow_down received, new interval=${intervalMs}ms`);
+      continue;
+    }
+    if (result.status === "expired") {
+      throw new Error(
+        `Device code has expired. Please run ae-cli auth login again to restart the authorization flow.`
+      );
+    }
+    if (result.status === "denied") {
+      throw new PermissionError(result.message, result.code, result.hint);
+    }
+    if (result.status === "unsupported") {
+      throw new DeviceFlowUnsupportedError();
+    }
+    if (result.status === "error") {
+      logger.warn(`device-auth: poll error: ${result.message}`);
+      emit(`Poll error: ${result.message}`);
+      if (result.message.includes("HTTP 401") || result.message.includes("HTTP 403")) {
+        throw new Error(`Authorization denied (${result.message}). Please check your configuration or run ae-cli auth login again.`);
+      }
+      continue;
+    }
+  }
+  throw new Error(
+    `Authorization timed out (not completed within ${expiresIn}s). Please run ae-cli auth login again.`
+  );
+}
+async function runDeviceFlow(host, options = {}, onStatus) {
+  const emit = (msg) => {
+    if (onStatus) onStatus(msg);
+  };
+  emit("Requesting authorization code from server...");
+  const auth = await authorizeDevice(host);
+  const userCode = auth.user_code;
+  const verifyUrl = buildVerificationUrl(host, userCode);
+  const expiresIn = auth.expires_in ?? 300;
+  emit("");
+  emit(`Verification code: ${userCode}`);
+  emit(`Open the following link in your browser to complete authorization:`);
+  emit(`  ${verifyUrl}`);
+  emit("");
+  if (!options.noBrowser) {
+    const opened = openBrowser(verifyUrl);
+    if (opened) {
+      emit("(Attempted to open the link in your browser)");
+    } else {
+      emit("(Could not open browser automatically; please copy the link above manually)");
+    }
+    emit("");
+  }
+  return pollDeviceFlow(host, auth.device_code, { intervalMs: (auth.interval ?? 5) * 1e3, expiresIn }, onStatus);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// src/integrations/workbuddy/host-page.ts
+import { randomBytes } from "crypto";
+import fs from "fs";
+import { createServer } from "http";
+import { fileURLToPath } from "url";
+var LOOPBACK_ADDRESS = "127.0.0.1";
+var MAX_REQUEST_BYTES = 4096;
+function validateWorkBuddyHost(input) {
+  if (typeof input !== "string" || !input.trim()) {
+    return { ok: false, message: "\u8BF7\u8F93\u5165 AE Host\u3002" };
+  }
+  let url;
+  try {
+    url = new URL(input.trim());
+  } catch {
+    return { ok: false, message: "\u8BF7\u8F93\u5165\u6709\u6548\u7684 HTTPS \u5730\u5740\u3002" };
+  }
+  if (url.protocol !== "https:") {
+    return { ok: false, message: "\u4EC5\u652F\u6301 HTTPS \u5730\u5740\u3002" };
+  }
+  if (url.username || url.password) {
+    return { ok: false, message: "Host \u5730\u5740\u4E0D\u80FD\u5305\u542B\u7528\u6237\u540D\u6216\u5BC6\u7801\u3002" };
+  }
+  if (url.search || url.hash) {
+    return { ok: false, message: "Host \u5730\u5740\u4E0D\u80FD\u5305\u542B\u67E5\u8BE2\u53C2\u6570\u6216\u7247\u6BB5\u3002" };
+  }
+  const pathname = url.pathname.replace(/\/+$/, "");
+  return { ok: true, host: `${url.origin}${pathname === "/" ? "" : pathname}` };
+}
+function renderWorkBuddyHostPage(hosts, sessionPath, nonce) {
+  const availableHosts = hosts.filter((host) => validateWorkBuddyHost(host.url).ok);
+  const selectedIndex = Math.max(0, availableHosts.findIndex((host) => host.active));
+  const hostRows = availableHosts.length > 0 ? availableHosts.map((host, index) => renderHostRow(host, index === selectedIndex)).join("\n") : '<p class="empty">\u8FD8\u6CA1\u6709\u4FDD\u5B58\u7684\u73AF\u5883\uFF0C\u8BF7\u5728\u4E0B\u65B9\u8F93\u5165 AE Host\u3002</p>';
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>ThinkingAI AE \xD7 WorkBuddy</title>
+  <style nonce="${nonce}">
+    :root { color-scheme: light; font-family: Inter, "PingFang SC", "Microsoft YaHei", system-ui, sans-serif; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px 20px; color: #111c35; background: #f3f7fb; }
+    .card { width: min(640px, 100%); padding: 28px 40px 22px; background: #fff; border: 1px solid #dbe3ee; border-radius: 14px; box-shadow: 0 20px 55px rgba(39, 62, 92, .12); }
+    .brands { display: flex; align-items: center; justify-content: center; gap: 16px; min-height: 48px; margin-bottom: 14px; }
+    .thinkingai { display: flex; align-items: center; gap: 9px; font-size: 21px; font-weight: 750; letter-spacing: -.02em; }
+    .thinkingai img { width: 38px; height: 42px; object-fit: none; object-position: 65% 55%; }
+    .workbuddy { width: 132px; height: auto; object-fit: contain; }
+    .collaboration { color: #8490a5; font-size: 21px; }
+    h1 { margin: 0; text-align: center; font-size: 30px; line-height: 1.25; letter-spacing: -.025em; }
+    .subtitle { margin: 7px 0 22px; text-align: center; color: #62708a; font-size: 16px; }
+    fieldset { margin: 0; padding: 0; border: 0; }
+    legend, .field-label { display: block; margin-bottom: 10px; color: #18243c; font-size: 15px; font-weight: 700; }
+    .host-list { display: grid; gap: 8px; max-height: 188px; overflow: auto; }
+    .host-option { display: flex; align-items: center; gap: 14px; min-height: 68px; padding: 11px 16px; border: 1px solid #d5deea; border-radius: 8px; cursor: pointer; transition: border-color .15s, background .15s, box-shadow .15s; }
+    .host-option:hover { border-color: #92b8ff; }
+    .host-option:has(input:checked) { border-color: #0878f9; background: #edf5ff; box-shadow: 0 0 0 1px #0878f9 inset; }
+    .host-option input { width: 18px; height: 18px; margin: 0; accent-color: #0878f9; flex: none; }
+    .host-copy { min-width: 0; display: grid; gap: 3px; }
+    .host-label { color: #111827; font-weight: 700; }
+    .host-url { overflow: hidden; color: #65738d; font-size: 14px; text-overflow: ellipsis; white-space: nowrap; }
+    .empty { margin: 0; padding: 18px; color: #65738d; background: #f7f9fc; border: 1px dashed #cad5e3; border-radius: 8px; }
+    .divider { display: flex; align-items: center; gap: 16px; margin: 18px 0; color: #7b879d; font-size: 14px; }
+    .divider::before, .divider::after { content: ""; height: 1px; background: #dbe3ee; flex: 1; }
+    input[type="url"] { width: 100%; height: 46px; padding: 0 14px; color: #162238; font: inherit; border: 1px solid #cad5e3; border-radius: 7px; outline: none; }
+    input[type="url"]:focus { border-color: #0878f9; box-shadow: 0 0 0 3px rgba(8, 120, 249, .13); }
+    input[type="url"]::placeholder { color: #8a96aa; }
+    .helper { margin: 7px 0 0; color: #6b7890; font-size: 13px; }
+    .notice { display: flex; align-items: flex-start; gap: 10px; margin: 18px 0; padding: 12px 15px; color: #405579; background: #edf5ff; border-radius: 7px; font-size: 13px; line-height: 1.55; }
+    .shield { width: 18px; height: 21px; flex: none; color: #0878f9; }
+    .actions { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1fr); gap: 12px; }
+    button { width: 100%; height: 44px; border-radius: 7px; font: inherit; font-weight: 700; cursor: pointer; }
+    .primary { color: #fff; background: #0878f9; border: 1px solid #0878f9; }
+    .primary:hover { background: #0069df; }
+    .secondary { color: #38465d; background: #fff; border: 1px solid #cad5e3; }
+    .secondary:hover { background: #f6f8fb; }
+    .status { min-height: 22px; margin: 14px 0 0; text-align: center; color: #0a6d3a; font-size: 13px; }
+    .status.error { color: #bd1e2d; }
+    footer { margin-top: 2px; text-align: center; color: #7b879d; font-size: 12px; font-style: italic; }
+    @media (max-width: 620px) { body { padding: 0; background: #fff; } .card { min-height: 100vh; padding: 28px 20px 22px; border: 0; border-radius: 0; box-shadow: none; } .brands { gap: 10px; } .thinkingai { font-size: 17px; } .workbuddy { width: 112px; } h1 { font-size: 26px; } }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <header>
+      <div class="brands" aria-label="ThinkingAI AE \u4E0E WorkBuddy">
+        <div class="thinkingai"><img src="${sessionPath}thinkingai.png" alt=""><span>ThinkingAI AE</span></div>
+        <span class="collaboration" aria-hidden="true">\xD7</span>
+        <img class="workbuddy" src="${sessionPath}workbuddy.png" alt="WorkBuddy">
+      </div>
+      <h1>\u8FDE\u63A5 ThinkingAI AE</h1>
+      <p class="subtitle">\u9009\u62E9\u8981\u5728 WorkBuddy \u4E2D\u4F7F\u7528\u7684 AE \u73AF\u5883</p>
+    </header>
+    <form id="host-form" novalidate>
+      <fieldset>
+        <legend>\u5DF2\u4FDD\u5B58\u7684\u73AF\u5883</legend>
+        <div class="host-list">${hostRows}</div>
+      </fieldset>
+      <div class="divider">\u6216</div>
+      <label class="field-label" for="custom-host">\u4F7F\u7528\u5176\u4ED6 Host</label>
+      <input id="custom-host" name="custom-host" type="url" inputmode="url" autocomplete="url" placeholder="https://your-ae-host.example.com">
+      <p class="helper">\u4EC5\u652F\u6301 HTTPS \u5730\u5740</p>
+      <div class="notice">
+        <svg class="shield" viewBox="0 0 24 28" aria-hidden="true"><path fill="none" stroke="currentColor" stroke-width="2" d="M12 1.5 21 5v7.2c0 6-3.8 11.2-9 13.8-5.2-2.6-9-7.8-9-13.8V5l9-3.5Z"/></svg>
+        <span>\u8D26\u53F7\u5BC6\u7801\u5C06\u5728 AE \u7EDF\u4E00\u767B\u5F55\u9875\u4E2D\u8F93\u5165\uFF0C\u672C\u9875\u9762\u4EC5\u7528\u4E8E\u9009\u62E9 Host\u3002</span>
+      </div>
+      <div class="actions">
+        <button class="primary" type="submit">\u7EE7\u7EED\u524D\u5F80 AE \u767B\u5F55</button>
+        <button class="secondary" id="cancel" type="button">\u53D6\u6D88</button>
+      </div>
+      <p class="status" id="status" role="status" aria-live="polite"></p>
+    </form>
+    <footer>\u7531 WorkBuddy \xB7 ae-cli \u53D1\u8D77</footer>
+  </main>
+  <script nonce="${nonce}">
+    const form = document.getElementById('host-form');
+    const customHost = document.getElementById('custom-host');
+    const status = document.getElementById('status');
+    const radios = Array.from(document.querySelectorAll('input[name="saved-host"]'));
+    customHost.addEventListener('input', () => {
+      if (customHost.value.trim()) radios.forEach(radio => { radio.checked = false; });
+      status.textContent = '';
+      status.classList.remove('error');
+    });
+    radios.forEach(radio => radio.addEventListener('change', () => {
+      customHost.value = '';
+      status.textContent = '';
+      status.classList.remove('error');
+    }));
+    form.addEventListener('submit', async event => {
+      event.preventDefault();
+      const selected = radios.find(radio => radio.checked);
+      const host = customHost.value.trim() || (selected ? selected.value : '');
+      status.textContent = '';
+      status.classList.remove('error');
+      try {
+        const response = await fetch('${sessionPath}select', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ host }),
+        });
+        const result = await response.json();
+        if (!response.ok || !result.ok) throw new Error(result.message || 'Host \u6821\u9A8C\u5931\u8D25\u3002');
+        status.textContent = '\u5DF2\u4FDD\u5B58 ' + result.host + '\uFF0C\u6B63\u5728\u7EE7\u7EED\u767B\u5F55\u2026';
+      } catch (error) {
+        status.textContent = error instanceof Error ? error.message : 'Host \u6821\u9A8C\u5931\u8D25\u3002';
+        status.classList.add('error');
+      }
+    });
+    document.getElementById('cancel').addEventListener('click', () => {
+      status.textContent = '\u5DF2\u53D6\u6D88\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002';
+      status.classList.remove('error');
+    });
+  </script>
+</body>
+</html>`;
+}
+async function startWorkBuddyHostPage(options = {}) {
+  const hosts = options.hosts ?? listHosts();
+  const sessionId = randomBytes(24).toString("base64url");
+  const sessionPath = `/workbuddy/${sessionId}/`;
+  const nonce = randomBytes(18).toString("base64url");
+  const assets = {
+    thinkingai: readBrandAsset("thinkingai.png"),
+    workbuddy: readBrandAsset("workbuddy.png")
+  };
+  let resolveSelection = (_host) => {
+  };
+  const selection = new Promise((resolve) => {
+    resolveSelection = resolve;
+  });
+  const server = createServer(async (request, response) => {
+    setSecurityHeaders(response, nonce);
+    const requestUrl = new URL(request.url ?? "/", `http://${LOOPBACK_ADDRESS}`);
+    if (request.method === "GET" && requestUrl.pathname === sessionPath) {
+      respond(response, 200, "text/html; charset=utf-8", renderWorkBuddyHostPage(hosts, sessionPath, nonce));
+      return;
+    }
+    if (request.method === "GET" && requestUrl.pathname === `${sessionPath}thinkingai.png`) {
+      respond(response, 200, "image/png", assets.thinkingai);
+      return;
+    }
+    if (request.method === "GET" && requestUrl.pathname === `${sessionPath}workbuddy.png`) {
+      respond(response, 200, "image/png", assets.workbuddy);
+      return;
+    }
+    if (request.method === "POST" && requestUrl.pathname === `${sessionPath}select`) {
+      const selectedHost = await handleSelection(request, response, options.onSelect);
+      if (selectedHost) resolveSelection(selectedHost);
+      return;
+    }
+    respond(response, 404, "application/json; charset=utf-8", JSON.stringify({ ok: false, message: "Not found." }));
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 0, LOOPBACK_ADDRESS, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    await closeServer(server);
+    throw new Error("Cannot resolve the WorkBuddy host page address.");
+  }
+  return {
+    url: `http://${LOOPBACK_ADDRESS}:${address.port}${sessionPath}`,
+    selection,
+    close: () => closeServer(server)
+  };
+}
+function renderHostRow(host, selected) {
+  const url = escapeHtml(host.url);
+  return `<label class="host-option">
+          <input type="radio" name="saved-host" value="${url}"${selected ? " checked" : ""}>
+          <span class="host-copy"><span class="host-label">${escapeHtml(host.label)}</span><span class="host-url">${url}</span></span>
+        </label>`;
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function readBrandAsset(name) {
+  const candidates = [
+    new URL(`../assets/workbuddy-host-page/${name}`, import.meta.url),
+    new URL(`../../../assets/workbuddy-host-page/${name}`, import.meta.url)
+  ];
+  const match = candidates.find((candidate) => fs.existsSync(fileURLToPath(candidate)));
+  if (!match) throw new Error(`WorkBuddy host page asset is missing: ${name}`);
+  return fs.readFileSync(match);
+}
+async function handleSelection(request, response, onSelect) {
+  try {
+    const body = await readJsonBody(request);
+    const result = validateWorkBuddyHost(body.host);
+    if (!result.ok) {
+      respond(response, 400, "application/json; charset=utf-8", JSON.stringify(result));
+      return void 0;
+    }
+    if (!onSelect) {
+      respond(response, 200, "application/json; charset=utf-8", JSON.stringify(result));
+      return result.host;
+    }
+    await onSelect(result.host);
+    respond(response, 200, "application/json; charset=utf-8", JSON.stringify(result));
+    return result.host;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Invalid request.";
+    respond(response, 400, "application/json; charset=utf-8", JSON.stringify({ ok: false, message }));
+    return void 0;
+  }
+}
+async function readJsonBody(request) {
+  let body = "";
+  for await (const chunk of request) {
+    body += chunk;
+    if (Buffer.byteLength(body) > MAX_REQUEST_BYTES) {
+      throw new Error("Request body is too large.");
+    }
+  }
+  const parsed = JSON.parse(body || "{}");
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Request body must be a JSON object.");
+  }
+  return parsed;
+}
+function setSecurityHeaders(response, nonce) {
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Security-Policy", `default-src 'none'; img-src 'self'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'`);
+  response.setHeader("Referrer-Policy", "no-referrer");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+  response.setHeader("X-Frame-Options", "DENY");
+}
+function respond(response, status, contentType, body) {
+  response.statusCode = status;
+  response.setHeader("Content-Type", contentType);
+  response.end(body);
+}
+function closeServer(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => error ? reject(error) : resolve());
+  });
+}
+// src/integrations/workbuddy/auth.ts
+function activateWorkBuddySelectedHost(selectedHost, dependencies = {}) {
+  const validation = validateWorkBuddyHost(selectedHost);
+  if (!validation.ok) {
+    throw new Error(validation.message);
+  }
+  const host = normalizeUrl(validation.host);
+  const readConfig = dependencies.readConfig ?? loadConfig;
+  const writeConfig = dependencies.writeConfig ?? saveConfig;
+  const config = readConfig();
+  if (!config.hosts[host]) {
+    const hostname = new URL(host).hostname;
+    const labelExists = Object.entries(config.hosts).some(([url, entry]) => url !== host && entry.label === hostname);
+    config.hosts[host] = { label: labelExists ? host : hostname };
+  }
+  config.activeHost = host;
+  writeConfig(config);
+  logger.info(`Active host set to ${host} for WorkBuddy login`);
+  return host;
+}
+function registerWorkBuddyAuth(auth) {
+  auth.command("workbuddy-host-page", { hidden: true }).description("Run the local WorkBuddy host selection page").action(async () => {
+    const page = await startWorkBuddyHostPage({
+      onSelect: async (host) => {
+        activateWorkBuddySelectedHost(host);
+      }
+    });
+    process.stderr.write(`[ae-cli] WorkBuddy host selection:
+ ${page.url}
+`);
+    const selected = await Promise.race([
+      page.selection.then(() => true),
+      waitForTerminationSignal().then(() => false)
+    ]);
+    await page.close();
+    if (!selected) process.exitCode = 1;
+  });
+}
+function waitForTerminationSignal() {
+  return new Promise((resolve) => {
+    const finish = () => {
+      process.off("SIGINT", finish);
+      process.off("SIGTERM", finish);
+      resolve();
+    };
+    process.once("SIGINT", finish);
+    process.once("SIGTERM", finish);
+  });
+}
+// src/commands/auth.ts
+var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function getExplicitAuthHostOverride(program, opts) {
+  return opts.host || program.opts().host;
+}
+function resolveAuthHost(program, opts) {
+  return resolveHost(getExplicitAuthHostOverride(program, opts));
+}
+async function validateExistingCliToken(host, cliToken) {
+  try {
+    return { valid: true, trusted: false, details: await validateCliTokenOnServer(host, cliToken) };
+  } catch (error) {
+    if (error instanceof CliTokenValidationUnavailableError) {
+      logger.warn(`auth status: ${error.message}; trusting the stored CLI token for compatibility`);
+      return { valid: true, trusted: true, details: {} };
+    }
+    if (!(error instanceof SecureStoreAuthError)) throw error;
+    printError("auth", error.message);
+    process.exitCode = 1;
+    return { valid: false, trusted: false, details: {} };
+  }
+}
+function activateHostAfterLogin(host, explicitHostOverride) {
+  if (!explicitHostOverride) return;
+  const normalized = normalizeUrl(host);
+  const config = loadConfig();
+  if (!config.hosts[normalized]) config.hosts[normalized] = { label: normalized };
+  config.activeHost = normalized;
+  saveConfig(config);
+  logger.info(`Active host set to ${normalized} after login`);
+}
+function accountOutput(account) {
+  return {
+    open_id: account.openId,
+    login_name: account.loginName,
+    user_name: account.userName
+  };
+}
+function credentialOutput(credential, active) {
+  return {
+    credential_id: credential.id,
+    active,
+    ...credential.account ? { account: accountOutput(credential.account) } : {},
+    cli_token: {
+      ...credential.cliTokenExpiresAt ? { expires_at: credential.cliTokenExpiresAt } : {},
+      ...credential.lastRenewedOn ? { last_renewed_on: credential.lastRenewedOn } : {}
+    }
+  };
+}
+function buildAccountSelectionItems(credentials, activeCredentialId) {
+  return credentials.filter((credential) => Boolean(credential.account)).sort((left, right) => Number(right.id === activeCredentialId) - Number(left.id === activeCredentialId)).map((credential) => {
+    const account = credential.account;
+    const displayName = account.userName && account.userName !== account.loginName ? `${account.loginName} (${account.userName})` : account.loginName;
+    const active = credential.id === activeCredentialId ? " [active]" : "";
+    return {
+      value: account.openId,
+      label: `${displayName} \xB7 ${account.openId}${active}`
+    };
+  });
+}
+async function switchActiveAccount(program, opts) {
+  const host = resolveAuthHost(program, opts);
+  if (!host) {
+    printError("config", "No AE host configured.", missingAeHostHint());
+    process.exitCode = 1;
+    return;
+  }
+  let account = opts.account;
+  if (!account) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+      printError(
+        "validation",
+        "Interactive account selection requires a TTY.",
+        `Run: ae-cli auth list --host ${host}, then ae-cli auth use --host ${host} --account <login-name-or-open-id>`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const active = getActiveCredential(host);
+    const items = buildAccountSelectionItems(listCredentials(host), active?.id);
+    if (items.length === 0) {
+      printError(
+        "auth",
+        `No stored accounts with identity metadata for ${host}.`,
+        `Upgrade the AE server if needed, then run: ae-cli auth login --host ${host}`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      account = await promptSingleSelect({
+        title: `Select an account for ${host} (up/down: move, enter: select, q: cancel)`,
+        items
+      });
+    } catch (error) {
+      if (error instanceof MultiselectCancelled) return;
+      throw error;
+    }
+  }
+  try {
+    const selected = activateCredential(host, account);
+    clearCliTokenCache(host);
+    await printOutput({
+      host,
+      active: true,
+      account: accountOutput(selected.account)
+    }, program.opts().format || "json");
+  } catch (error) {
+    printError("auth", error.message);
+    process.exitCode = 1;
+  }
+}
+async function persistDeviceTokens(host, tokens, options = {}) {
+  const cliToken = await mintCliToken(host, tokens.access_token);
+  let validation = {};
+  try {
+    validation = await validateCliTokenOnServer(host, cliToken);
+  } catch (error) {
+    if (error instanceof CliTokenValidationUnavailableError) {
+      logger.warn(`auth login: ${error.message}; saving CLI token without account metadata for compatibility`);
+    } else {
+      clearCliTokenCache(host);
+      throw error;
+    }
+  }
+  let saved;
+  try {
+    saved = saveCredential(host, {
+      cliToken,
+      ...validation.account ? { account: validation.account } : {},
+      ...validation.cliTokenExpiresAt ? { cliTokenExpiresAt: validation.cliTokenExpiresAt } : {}
+    }, options);
+  } catch (error) {
+    clearCliTokenCache(host);
+    throw error;
+  }
+  clearCliTokenCache(host);
+  await runHostCompatCheck(getLocalCliPackageInfo(), host);
+  return saved;
+}
+function loginSummary(host, credential) {
+  return {
+    authenticated: true,
+    host,
+    ...credential.account ? { account: accountOutput(credential.account) } : {}
+  };
+}
+function resolveLoginTeClaudeBase(host) {
+  const base = host.replace(/\/+$/, "");
+  const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
+  return base.endsWith(basePath) ? base : base + basePath;
+}
+function registerAuth(program) {
+  const auth = program.command("auth").description("Manage authentication or switch the active account interactively").action(async () => {
+    await switchActiveAccount(program, {});
+  });
+  registerWorkBuddyAuth(auth);
+  auth.command("login").description("Log in to AE; by default replaces this host credentials, --add keeps existing accounts").option("--host <url>", HOST_OPTION_DESC).option("--add", "Add another account for the host and keep existing accounts").option("--no-browser", "Do not auto-open the browser; only print the authorization URL").option("--no-wait", "Print device authorization data and exit; resume with --device-code").option("--device-code <code>", "Resume a split-flow login with the given device code").action(async (opts) => {
+    const explicitHost = getExplicitAuthHostOverride(program, opts);
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", missingAeHostHint());
+      process.exit(1);
+    }
+    const config = loadConfig();
+    if (!config.hosts[host]) {
+      config.hosts[host] = { label: host };
+      if (!config.activeHost) config.activeHost = host;
+      saveConfig(config);
+      process.stderr.write(`[ae-cli] Config saved for ${host}
+`);
+    }
+    const noBrowser = !opts.browser;
+    const format = program.opts().format || "json";
+    const teClaudeBase = resolveLoginTeClaudeBase(host);
+    const emit = (message) => process.stderr.write(`[ae-cli] ${message}
+`);
+    try {
+      if (opts.deviceCode) {
+        const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
+        const saved2 = await persistDeviceTokens(host, tokens2, { add: opts.add });
+        activateHostAfterLogin(host, explicitHost);
+        emit("Login successful! CLI token saved securely.");
+        await printOutput(loginSummary(host, saved2), format);
+        return;
+      }
+      if (opts.wait === false) {
+        const authResp = await authorizeDevice(teClaudeBase);
+        const addFlag = opts.add ? " --add" : "";
+        await printOutput({
+          device_code: authResp.device_code,
+          user_code: authResp.user_code,
+          verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
+          interval: authResp.interval,
+          expires_in: authResp.expires_in,
+          next: `Open verification_url in a browser to authorize, then run: ae-cli auth login${addFlag} --device-code ${authResp.device_code}`
+        }, format);
+        return;
+      }
+      const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
+      const saved = await persistDeviceTokens(host, tokens, { add: opts.add });
+      activateHostAfterLogin(host, explicitHost);
+      emit("Login successful! CLI token saved securely.");
+      await printOutput(loginSummary(host, saved), format);
+    } catch (error) {
+      if (error instanceof DeviceFlowUnsupportedError) {
+        printError("auth", error.message, "Upgrade the AE server to a version that supports device login.");
+        process.exit(1);
+      }
+      if (error instanceof PermissionError) {
+        printError("permission", error.message, error.hint, error.code);
+        process.exit(1);
+      }
+      printError("auth", error.message);
+      process.exit(1);
+    }
+  });
+  auth.command("status").description("Show the active CLI-token authentication status for a host").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      await printOutput({
+        authenticated: false,
+        host: "(none)",
+        hint: missingAeHostHint(),
+        next_steps: missingAeHostGuidance()
+      }, program.opts().format || "json");
+      return;
+    }
+    const active = getActiveCredential(host);
+    if (active) {
+      const state = await validateExistingCliToken(host, active.cliToken);
+      if (!state.valid) return;
+      if (state.details.account || state.details.cliTokenExpiresAt) {
+        updateCredentialMetadata(host, active.cliToken, state.details);
+      }
+      const current = getActiveCredential(host) ?? active;
+      await printOutput({
+        authenticated: true,
+        host,
+        source: "secure-store",
+        cli_token: {
+          status: state.trusted ? "trusted" : "valid",
+          ...current.cliTokenExpiresAt ? { expires_at: current.cliTokenExpiresAt } : {},
+          ...current.lastRenewedOn ? { last_renewed_on: current.lastRenewedOn } : {}
+        },
+        ...current.account ? { account: accountOutput(current.account) } : {}
+      }, program.opts().format || "json");
+      return;
+    }
+    const fallback = getFallbackCliToken(host);
+    if (fallback) {
+      const state = await validateExistingCliToken(host, fallback);
+      if (!state.valid) return;
+      await printOutput({
+        authenticated: true,
+        host,
+        source: "sandbox-cli-token",
+        cli_token: {
+          status: state.trusted ? "trusted" : "valid",
+          ...state.details.cliTokenExpiresAt ? { expires_at: state.details.cliTokenExpiresAt } : {}
+        },
+        ...state.details.account ? { account: accountOutput(state.details.account) } : {}
+      }, program.opts().format || "json");
+      return;
+    }
+    await printOutput({ authenticated: false, host, source: "none" }, program.opts().format || "json");
+  });
+  auth.command("list").description("List stored accounts for one host (does not call the server)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", missingAeHostHint());
+      process.exit(1);
+    }
+    const active = getActiveCredential(host);
+    const credentials = listCredentials(host);
+    await printOutput({
+      host,
+      accounts: credentials.map((credential) => credentialOutput(credential, credential.id === active?.id))
+    }, program.opts().format || "json");
+  });
+  auth.command("use").description("Switch the active account for a host; omit --account to choose interactively").option("--account <login-name-or-open-id>", "Login name or open_id returned by auth list").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    await switchActiveAccount(program, opts);
+  });
+  auth.command("logout").description("Remove the active account, or all accounts with --all").option("--host <url>", HOST_OPTION_DESC).option("--all", "Remove all accounts stored for this host").action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", missingAeHostHint());
+      process.exit(1);
+    }
+    clearCliTokenCache(host);
+    if (opts.all) {
+      clearAllCredentials(host);
+      await printOutput({ cleared: true, all: true, host }, program.opts().format || "json");
+      return;
+    }
+    const result = removeActiveCredential(host);
+    await printOutput({
+      cleared: !!result.removed,
+      all: false,
+      host,
+      remaining_accounts: listCredentials(host).length,
+      ...result.active?.account ? { active_account: accountOutput(result.active.account) } : {}
+    }, program.opts().format || "json");
+  });
+}
+export {
+  activateHostAfterLogin,
+  buildAccountSelectionItems,
+  persistDeviceTokens,
+  registerAuth,
+  resolveLoginTeClaudeBase
+};