@thinkingai/ae-cli 6.0.48-customer.1 → 6.1.0-project-role-upsert.1

package/dist/{auth-QPEVVBKT.js → auth-FUM37MHF.js}

@@ -1,39 +1,47 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  MultiselectCancelled,
+  promptSingleSelect
+} from "./chunk-7K24F7T2.js";
+import {
+  missingAeHostGuidance,
+  missingAeHostHint
+} from "./chunk-6ZIQV5GW.js";
 import {
   getLocalCliPackageInfo
 } from "./chunk-E2JKXMVO.js";
+import {
+  resolveHost
+} from "./chunk-ECBLHAZO.js";
 import {
   printError,
   printOutput,
   runHostCompatCheck
-} from "./chunk-KEWVSO64.js";
+} from "./chunk-CZU3V3DQ.js";
 import {
   CliTokenValidationUnavailableError,
-  clearCliToken,
+  SecureStoreAuthError,
+  activateCredential,
+  clearAllCredentials,
+  clearCliTokenCache,
+  getActiveCredential,
+  listCredentials,
   mintCliToken,
+  removeActiveCredential,
+  saveCredential,
+  updateCredentialMetadata,
   validateCliTokenOnServer
-} from "./chunk-RWXIXOZG.js";
-import {
-  SecureStoreAuthError,
-  clear,
-  load,
-  missingAeHostGuidance,
-  missingAeHostHint,
-  resolveHost,
-  save
-} from "./chunk-O6K2ODUE.js";
+} from "./chunk-ATSM5XAW.js";
 import {
   getFallbackCliToken,
   loadConfig,
   normalizeUrl,
   saveConfig
-} from "./chunk-KZ6ZHF5J.js";
-import {
-  PermissionError
-} from "./chunk-533JK3YX.js";
+} from "./chunk-WZ6YVQSF.js";
 import {
+  PermissionError,
   logger
-} from "./chunk-FR2EDAQM.js";
+} from "./chunk-4P355ZWB.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -263,55 +271,141 @@ function resolveAuthHost(program, opts) {
 }
 async function validateExistingCliToken(host, cliToken) {
   try {
-    await validateCliTokenOnServer(host, cliToken);
-    return true;
+    return { valid: true, trusted: false, details: await validateCliTokenOnServer(host, cliToken) };
   } catch (error) {
     if (error instanceof CliTokenValidationUnavailableError) {
       logger.warn(`auth status: ${error.message}; trusting the stored CLI token for compatibility`);
-      return true;
-    }
-    if (!(error instanceof SecureStoreAuthError)) {
-      throw error;
+      return { valid: true, trusted: true, details: {} };
     }
+    if (!(error instanceof SecureStoreAuthError)) throw error;
     printError("auth", error.message);
     process.exitCode = 1;
-    return false;
+    return { valid: false, trusted: false, details: {} };
   }
 }
 function activateHostAfterLogin(host, explicitHostOverride) {
   if (!explicitHostOverride) return;
   const normalized = normalizeUrl(host);
   const config = loadConfig();
-  if (!config.hosts[normalized]) {
-    config.hosts[normalized] = { label: normalized };
-  }
+  if (!config.hosts[normalized]) config.hosts[normalized] = { label: normalized };
   config.activeHost = normalized;
   saveConfig(config);
   logger.info(`Active host set to ${normalized} after login`);
 }
-async function persistDeviceTokens(host, tokens) {
-  const DEFAULT_EXPIRES_IN = 72e3;
-  const MAX_EXPIRES_IN = 86400 * 365;
-  let expiresInSeconds = tokens.expires_in ?? DEFAULT_EXPIRES_IN;
-  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0 || expiresInSeconds > MAX_EXPIRES_IN) {
-    logger.warn(`auth login: expires_in=${tokens.expires_in} is out of range, falling back to ${DEFAULT_EXPIRES_IN}s`);
-    expiresInSeconds = DEFAULT_EXPIRES_IN;
-  }
-  const expiresAt = new Date(Date.now() + expiresInSeconds * 1e3).toISOString();
-  const cliToken = await mintCliToken(host, tokens.access_token, false);
-  save(host, {
-    accessToken: tokens.access_token,
-    refreshToken: tokens.refresh_token ?? "",
-    accessExpiresAt: expiresAt,
-    cliToken
+function accountOutput(account) {
+  return {
+    open_id: account.openId,
+    login_name: account.loginName,
+    user_name: account.userName
+  };
+}
+function credentialOutput(credential, active) {
+  return {
+    credential_id: credential.id,
+    active,
+    ...credential.account ? { account: accountOutput(credential.account) } : {},
+    cli_token: {
+      ...credential.cliTokenExpiresAt ? { expires_at: credential.cliTokenExpiresAt } : {},
+      ...credential.lastRenewedOn ? { last_renewed_on: credential.lastRenewedOn } : {}
+    }
+  };
+}
+function buildAccountSelectionItems(credentials, activeCredentialId) {
+  return credentials.filter((credential) => Boolean(credential.account)).sort((left, right) => Number(right.id === activeCredentialId) - Number(left.id === activeCredentialId)).map((credential) => {
+    const account = credential.account;
+    const displayName = account.userName && account.userName !== account.loginName ? `${account.loginName} (${account.userName})` : account.loginName;
+    const active = credential.id === activeCredentialId ? " [active]" : "";
+    return {
+      value: account.openId,
+      label: `${displayName} \xB7 ${account.openId}${active}`
+    };
   });
+}
+async function switchActiveAccount(program, opts) {
+  const host = resolveAuthHost(program, opts);
+  if (!host) {
+    printError("config", "No AE host configured.", missingAeHostHint());
+    process.exitCode = 1;
+    return;
+  }
+  let account = opts.account;
+  if (!account) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+      printError(
+        "validation",
+        "Interactive account selection requires a TTY.",
+        `Run: ae-cli auth list --host ${host}, then ae-cli auth use --host ${host} --account <login-name-or-open-id>`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const active = getActiveCredential(host);
+    const items = buildAccountSelectionItems(listCredentials(host), active?.id);
+    if (items.length === 0) {
+      printError(
+        "auth",
+        `No stored accounts with identity metadata for ${host}.`,
+        `Upgrade the AE server if needed, then run: ae-cli auth login --host ${host}`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      account = await promptSingleSelect({
+        title: `Select an account for ${host} (up/down: move, enter: select, q: cancel)`,
+        items
+      });
+    } catch (error) {
+      if (error instanceof MultiselectCancelled) return;
+      throw error;
+    }
+  }
+  try {
+    const selected = activateCredential(host, account);
+    clearCliTokenCache(host);
+    await printOutput({
+      host,
+      active: true,
+      account: accountOutput(selected.account)
+    }, program.opts().format || "json");
+  } catch (error) {
+    printError("auth", error.message);
+    process.exitCode = 1;
+  }
+}
+async function persistDeviceTokens(host, tokens, options = {}) {
+  const cliToken = await mintCliToken(host, tokens.access_token);
+  let validation = {};
+  try {
+    validation = await validateCliTokenOnServer(host, cliToken);
+  } catch (error) {
+    if (error instanceof CliTokenValidationUnavailableError) {
+      logger.warn(`auth login: ${error.message}; saving CLI token without account metadata for compatibility`);
+    } else {
+      clearCliTokenCache(host);
+      throw error;
+    }
+  }
+  let saved;
+  try {
+    saved = saveCredential(host, {
+      cliToken,
+      ...validation.account ? { account: validation.account } : {},
+      ...validation.cliTokenExpiresAt ? { cliTokenExpiresAt: validation.cliTokenExpiresAt } : {}
+    }, options);
+  } catch (error) {
+    clearCliTokenCache(host);
+    throw error;
+  }
+  clearCliTokenCache(host);
   await runHostCompatCheck(getLocalCliPackageInfo(), host);
+  return saved;
 }
-function loginSummary(host, tokens) {
+function loginSummary(host, credential) {
   return {
     authenticated: true,
     host,
-    token: tokens.access_token.slice(0, 8) + "..."
+    ...credential.account ? { account: accountOutput(credential.account) } : {}
   };
 }
 function resolveLoginTeClaudeBase(host) {
@@ -320,8 +414,10 @@ function resolveLoginTeClaudeBase(host) {
   return base.endsWith(basePath) ? base : base + basePath;
 }
 function registerAuth(program) {
-  const auth = program.command("auth").description("Authentication management");
-  auth.command("login").description("Log in to AE using the device code flow (cross-platform; --no-browser to print URL only)").option("--host <url>", HOST_OPTION_DESC).option("--no-browser", "Do not auto-open the browser; only print the authorization URL (headless / Linux)").option("--no-wait", "Request the device code and print the authorization URL as JSON, then exit without polling (for AI agents / split-flow). Resume with --device-code").option("--device-code <code>", "Resume a split-flow login: poll for the given device code until authorized, then save the token").action(async (opts) => {
+  const auth = program.command("auth").description("Manage authentication or switch the active account interactively").action(async () => {
+    await switchActiveAccount(program, {});
+  });
+  auth.command("login").description("Log in to AE; by default replaces this host credentials, --add keeps existing accounts").option("--host <url>", HOST_OPTION_DESC).option("--add", "Add another account for the host and keep existing accounts").option("--no-browser", "Do not auto-open the browser; only print the authorization URL").option("--no-wait", "Print device authorization data and exit; resume with --device-code").option("--device-code <code>", "Resume a split-flow login with the given device code").action(async (opts) => {
     const explicitHost = getExplicitAuthHostOverride(program, opts);
     const host = resolveAuthHost(program, opts);
     if (!host) {
@@ -331,135 +427,148 @@ function registerAuth(program) {
     const config = loadConfig();
     if (!config.hosts[host]) {
       config.hosts[host] = { label: host };
-      if (!config.activeHost) {
-        config.activeHost = host;
-      }
+      if (!config.activeHost) config.activeHost = host;
       saveConfig(config);
-      logger.info(`Host config auto-saved for ${host}`);
       process.stderr.write(`[ae-cli] Config saved for ${host}
 `);
     }
     const noBrowser = !opts.browser;
-    const fmt = program.opts().format || "json";
+    const format = program.opts().format || "json";
     const teClaudeBase = resolveLoginTeClaudeBase(host);
-    const emit = (msg) => process.stderr.write(`[ae-cli] ${msg}
+    const emit = (message) => process.stderr.write(`[ae-cli] ${message}
 `);
     try {
       if (opts.deviceCode) {
         const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
-        await persistDeviceTokens(host, tokens2);
+        const saved2 = await persistDeviceTokens(host, tokens2, { add: opts.add });
         activateHostAfterLogin(host, explicitHost);
-        logger.info(`Device flow login successful for ${host} (resumed)`);
-        emit("Login successful! Token saved securely.");
-        await printOutput(loginSummary(host, tokens2), fmt);
+        emit("Login successful! CLI token saved securely.");
+        await printOutput(loginSummary(host, saved2), format);
         return;
       }
       if (opts.wait === false) {
         const authResp = await authorizeDevice(teClaudeBase);
-        await printOutput(
-          {
-            device_code: authResp.device_code,
-            user_code: authResp.user_code,
-            verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
-            interval: authResp.interval,
-            expires_in: authResp.expires_in,
-            next: `Open verification_url in a browser to authorize, then run: ae-cli auth login --device-code ${authResp.device_code}`
-          },
-          fmt
-        );
+        const addFlag = opts.add ? " --add" : "";
+        await printOutput({
+          device_code: authResp.device_code,
+          user_code: authResp.user_code,
+          verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
+          interval: authResp.interval,
+          expires_in: authResp.expires_in,
+          next: `Open verification_url in a browser to authorize, then run: ae-cli auth login${addFlag} --device-code ${authResp.device_code}`
+        }, format);
         return;
       }
       const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
-      await persistDeviceTokens(host, tokens);
+      const saved = await persistDeviceTokens(host, tokens, { add: opts.add });
       activateHostAfterLogin(host, explicitHost);
-      logger.info(`Device flow login successful for ${host}`);
-      emit("Login successful! Token saved securely.");
-      await printOutput(loginSummary(host, tokens), fmt);
-    } catch (err) {
-      if (err instanceof DeviceFlowUnsupportedError) {
-        printError(
-          "auth",
-          err.message,
-          "Upgrade the AE server to a version that supports device login."
-        );
+      emit("Login successful! CLI token saved securely.");
+      await printOutput(loginSummary(host, saved), format);
+    } catch (error) {
+      if (error instanceof DeviceFlowUnsupportedError) {
+        printError("auth", error.message, "Upgrade the AE server to a version that supports device login.");
         process.exit(1);
       }
-      if (err instanceof PermissionError) {
-        printError("permission", err.message, err.hint, err.code);
+      if (error instanceof PermissionError) {
+        printError("permission", error.message, error.hint, error.code);
         process.exit(1);
       }
-      printError("auth", err.message);
+      printError("auth", error.message);
       process.exit(1);
     }
   });
-  auth.command("status").description("Show authentication status for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+  auth.command("status").description("Show the active CLI-token authentication status for a host").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
-      await printOutput(
-        {
-          authenticated: false,
-          host: "(none)",
-          hint: missingAeHostHint(),
-          next_steps: missingAeHostGuidance()
-        },
-        program.opts().format || "json"
-      );
+      await printOutput({
+        authenticated: false,
+        host: "(none)",
+        hint: missingAeHostHint(),
+        next_steps: missingAeHostGuidance()
+      }, program.opts().format || "json");
       return;
     }
-    const secureEntry = load(host);
-    if (secureEntry) {
-      if (secureEntry.cliToken && !await validateExistingCliToken(host, secureEntry.cliToken)) {
-        return;
+    const active = getActiveCredential(host);
+    if (active) {
+      const state = await validateExistingCliToken(host, active.cliToken);
+      if (!state.valid) return;
+      if (state.details.account || state.details.cliTokenExpiresAt) {
+        updateCredentialMetadata(host, active.cliToken, state.details);
       }
-      const pastStaticExpiry = new Date(secureEntry.accessExpiresAt).getTime() < Date.now();
-      await printOutput(
-        {
-          authenticated: true,
-          host,
-          source: "secure-store",
-          accessExpiresAt: secureEntry.accessExpiresAt,
-          accessExpiresAtNote: "advisory: access token auto-slides on use server-side; re-login only if a command returns an auth error",
-          pastStaticExpiry,
-          hasCliToken: !!secureEntry.cliToken
+      const current = getActiveCredential(host) ?? active;
+      await printOutput({
+        authenticated: true,
+        host,
+        source: "secure-store",
+        cli_token: {
+          status: state.trusted ? "trusted" : "valid",
+          ...current.cliTokenExpiresAt ? { expires_at: current.cliTokenExpiresAt } : {},
+          ...current.lastRenewedOn ? { last_renewed_on: current.lastRenewedOn } : {}
         },
-        program.opts().format || "json"
-      );
+        ...current.account ? { account: accountOutput(current.account) } : {}
+      }, program.opts().format || "json");
       return;
     }
-    const fallbackCliToken = getFallbackCliToken(host);
-    if (fallbackCliToken) {
-      if (!await validateExistingCliToken(host, fallbackCliToken)) {
-        return;
-      }
-      await printOutput(
-        {
-          authenticated: true,
-          host,
-          source: "sandbox-cli-token",
-          hasCliToken: true,
-          note: "sandbox-provisioned cli-token.json; no user access token in secure-store"
+    const fallback = getFallbackCliToken(host);
+    if (fallback) {
+      const state = await validateExistingCliToken(host, fallback);
+      if (!state.valid) return;
+      await printOutput({
+        authenticated: true,
+        host,
+        source: "sandbox-cli-token",
+        cli_token: {
+          status: state.trusted ? "trusted" : "valid",
+          ...state.details.cliTokenExpiresAt ? { expires_at: state.details.cliTokenExpiresAt } : {}
         },
-        program.opts().format || "json"
-      );
+        ...state.details.account ? { account: accountOutput(state.details.account) } : {}
+      }, program.opts().format || "json");
       return;
     }
     await printOutput({ authenticated: false, host, source: "none" }, program.opts().format || "json");
   });
-  auth.command("logout").description("Clear stored credentials (access token, refresh token, and CLI token) for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+  auth.command("list").description("List stored accounts for one host (does not call the server)").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
       printError("config", "No AE host configured.", missingAeHostHint());
       process.exit(1);
     }
-    clearCliToken(host);
-    clear(host);
-    process.stderr.write(`[ae-cli] Credentials cleared for ${host}
-`);
-    await printOutput({ cleared: true, host }, program.opts().format || "json");
+    const active = getActiveCredential(host);
+    const credentials = listCredentials(host);
+    await printOutput({
+      host,
+      accounts: credentials.map((credential) => credentialOutput(credential, credential.id === active?.id))
+    }, program.opts().format || "json");
+  });
+  auth.command("use").description("Switch the active account for a host; omit --account to choose interactively").option("--account <login-name-or-open-id>", "Login name or open_id returned by auth list").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
+    await switchActiveAccount(program, opts);
+  });
+  auth.command("logout").description("Remove the active account, or all accounts with --all").option("--host <url>", HOST_OPTION_DESC).option("--all", "Remove all accounts stored for this host").action(async (opts) => {
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", missingAeHostHint());
+      process.exit(1);
+    }
+    clearCliTokenCache(host);
+    if (opts.all) {
+      clearAllCredentials(host);
+      await printOutput({ cleared: true, all: true, host }, program.opts().format || "json");
+      return;
+    }
+    const result = removeActiveCredential(host);
+    await printOutput({
+      cleared: !!result.removed,
+      all: false,
+      host,
+      remaining_accounts: listCredentials(host).length,
+      ...result.active?.account ? { active_account: accountOutput(result.active.account) } : {}
+    }, program.opts().format || "json");
   });
 }
 export {
   activateHostAfterLogin,
+  buildAccountSelectionItems,
+  persistDeviceTokens,
   registerAuth,
   resolveLoginTeClaudeBase
 };