@thinkingai/ae-cli 6.0.54 → 6.0.56

package/dist/{chunk-PLE722AJ.js → chunk-2UWS5CUP.js}

@@ -4,15 +4,17 @@ import {
 } from "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-LMCYSVVA.js";
 import {
   PermissionError,
-  isApiErrorType
-} from "./chunk-WNGFSIOB.js";
+  externalCliTokenRequestOptions,
+  isApiErrorType,
+  readExternalCliToken
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -82,19 +84,27 @@ function readLegacyCredentials() {
   }
 }
 function tryLoadTeAgentSandboxCredentials() {
-  const legacy = readLegacyCredentials();
-  const persistent = readPersistentEnv();
-  const url = process.env.TE_CLAUDE_BASE_URL || persistent?.TE_CLAUDE_BASE_URL || legacy?.url;
-  if (typeof url !== "string" || !url) {
-    return null;
+  const credentials = readSandboxCredentials();
+  return credentials.url ? { ...credentials, url: credentials.url } : null;
+}
+function readSandboxCredentials() {
+  let url = process.env.TE_CLAUDE_BASE_URL || null;
+  let sandboxId = process.env.SANDBOX_ID || null;
+  let sandboxSecretKey = process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY || null;
+  if (!url || !sandboxId || !sandboxSecretKey) {
+    const persistent = readPersistentEnv();
+    url ||= persistent?.TE_CLAUDE_BASE_URL || null;
+    sandboxId ||= persistent?.SANDBOX_ID || null;
+    sandboxSecretKey ||= persistent?.SECRET_KEY || persistent?.SANDBOX_SECRET_KEY || null;
   }
-  const sandboxId = process.env.SANDBOX_ID || persistent?.SANDBOX_ID || legacy?.sandboxId || null;
-  const sandboxSecretKey = process.env.SECRET_KEY || process.env.SANDBOX_SECRET_KEY || persistent?.SECRET_KEY || persistent?.SANDBOX_SECRET_KEY || legacy?.sandboxSecretKey || legacy?.secretKey || null;
-  return {
-    url,
-    sandboxId: typeof sandboxId === "string" ? sandboxId : null,
-    sandboxSecretKey: typeof sandboxSecretKey === "string" ? sandboxSecretKey : null
-  };
+  if (!url || !sandboxId || !sandboxSecretKey) {
+    const legacy = readLegacyCredentials();
+    url ||= typeof legacy?.url === "string" ? legacy.url : null;
+    sandboxId ||= typeof legacy?.sandboxId === "string" ? legacy.sandboxId : null;
+    const legacySecret = legacy?.sandboxSecretKey || legacy?.secretKey;
+    sandboxSecretKey ||= typeof legacySecret === "string" ? legacySecret : null;
+  }
+  return { url, sandboxId, sandboxSecretKey };
 }
 function getClaudeConfigDir() {
   const fromEnv = process.env.CLAUDE_CONFIG_DIR;
@@ -145,7 +155,7 @@ async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await fetch(url, { ...init, signal: controller.signal });
+    return await fetch(url, { ...init, signal: controller.signal, ...externalCliTokenRequestOptions(url) });
   } catch (err) {
     if (err?.name === "AbortError") {
       throw new TeAgentApiError(
@@ -189,9 +199,19 @@ function teClaudeBaseFromActiveHost(hostOverride) {
   if (!h) return void 0;
   return resolveTeClaudeBaseUrl(h);
 }
-async function signRequest(method, path2, hostOverride, includeJsonContentType = true) {
-  const sandboxCred = tryLoadTeAgentSandboxCredentials();
-  if (!hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
+async function signRequest(method, path2, hostOverride, includeJsonContentType = true, authMode = "auto") {
+  const external = readExternalCliToken(hostOverride);
+  const configuredHost = hostOverride || getActiveHost();
+  const sandboxOnly = !hostOverride && (/* @__PURE__ */ new Set([
+    "/api/sandbox/models",
+    "/api/sandbox/models/select",
+    "/api/sandbox/sync/push",
+    "/api/sandbox/sync/push/skill",
+    "/api/sandbox/sync/pull",
+    "/api/sandbox/sync/pull/candidates"
+  ])).has(path2.split("?")[0]);
+  const sandboxCred = external || configuredHost && !sandboxOnly ? null : tryLoadTeAgentSandboxCredentials();
+  if (authMode === "auto" && !hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
     const headers = {
       "X-Sandbox-Id": sandboxCred.sandboxId,
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
@@ -205,14 +225,14 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
       authKind: "sandbox"
     };
   }
-  const baseUrl = hostOverride ? teClaudeBaseFromActiveHost(hostOverride) : sandboxCred?.url || teClaudeBaseFromActiveHost();
+  const baseUrl = hostOverride || external ? teClaudeBaseFromActiveHost(hostOverride || external?.url) : sandboxCred?.url || teClaudeBaseFromActiveHost();
   if (!baseUrl) {
     throw new TeAgentCredentialsError(
       "Cannot determine the te-claude service URL",
       "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
     );
   }
-  const hostForToken = hostOverride || getActiveHost() || baseUrl;
+  const hostForToken = configuredHost || baseUrl;
   const contentTypeHeader = includeJsonContentType && (method === "POST" || method === "PATCH" || method === "PUT") ? { "Content-Type": "application/json" } : {};
   const cliToken = await getCliToken(hostForToken);
   return {
@@ -231,13 +251,14 @@ async function fetchSigned(options) {
     options.method,
     options.path,
     options.hostOverride,
-    options.includeJsonContentType
+    options.includeJsonContentType,
+    options.authMode
   );
   return fetchWithTimeout(
     signed.url,
     {
       method: options.method,
-      headers: signed.headers,
+      headers: { ...Object.fromEntries(new Headers(options.headers).entries()), ...signed.headers },
       body: options.body
     },
     options.timeoutMs
@@ -246,7 +267,7 @@ async function fetchSigned(options) {
 function errorDetails(parsed, defaultErrorPrefix, status) {
   const nested = parsed && typeof parsed === "object" && parsed.error && typeof parsed.error === "object" ? parsed.error : parsed;
   const message = typeof parsed?.error === "string" ? parsed.error : typeof nested?.message === "string" ? nested.message : typeof parsed?.message === "string" ? parsed.message : typeof parsed?.return_message === "string" ? parsed.return_message : `${defaultErrorPrefix} ${status}`;
-  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : void 0;
+  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : typeof parsed?.errorCode === "string" ? parsed.errorCode : void 0;
   const hint = typeof nested?.hint === "string" ? nested.hint : typeof parsed?.hint === "string" ? parsed.hint : void 0;
   const declaredType = isApiErrorType(nested?.type) ? nested.type : void 0;
   const type = status === 401 ? "auth" : status === 403 ? "permission" : declaredType ?? ([400, 413, 422].includes(status) ? "validation" : status === 404 ? "not_found" : "api");
@@ -286,21 +307,23 @@ async function parseResponse(response, defaultErrorPrefix) {
   }
   return parsed;
 }
-async function postToMainApp(path2, body, hostOverride) {
+async function postToMainApp(path2, body, hostOverride, authMode = "auto") {
   const rawBody = JSON.stringify(body);
   const response = await fetchSigned({
     method: "POST",
     path: path2,
     body: rawBody,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
-async function getFromMainApp(path2, hostOverride) {
+async function getFromMainApp(path2, hostOverride, authMode = "auto") {
   const response = await fetchSigned({
     method: "GET",
     path: path2,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
@@ -330,21 +353,23 @@ async function postSandboxSyncPull(args) {
     mode: "merge"
   });
 }
-async function deleteFromMainApp(path2, hostOverride) {
+async function deleteFromMainApp(path2, hostOverride, authMode = "auto") {
   const response = await fetchSigned({
     method: "DELETE",
     path: path2,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
-async function patchToMainApp(path2, body, hostOverride) {
+async function patchToMainApp(path2, body, hostOverride, authMode = "auto") {
   const rawBody = JSON.stringify(body);
   const response = await fetchSigned({
     method: "PATCH",
     path: path2,
     body: rawBody,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
@@ -430,7 +455,8 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
         return await fetch(requestToSend.url, {
           method: "GET",
           headers: requestToSend.headers,
-          signal: controller.signal
+          signal: controller.signal,
+          ...externalCliTokenRequestOptions(requestToSend.url)
         });
       } catch (error) {
         if (error?.name === "AbortError") {
@@ -499,11 +525,12 @@ async function uploadToMainApp(path2, formData, hostOverride) {
 
 export {
   TeAgentCredentialsError,
-  tryLoadTeAgentSandboxCredentials,
   getClaudeConfigDir,
   resolveTeClaudeBaseUrl,
   TeAgentApiError,
+  fetchSigned,
   createTeAgentApiError,
+  parseResponse,
   postToMainApp,
   getFromMainApp,
   getSandboxModels,

package/dist/{chunk-ZIQWCZTS.js → chunk-3TQA5RXE.js}

@@ -6,13 +6,13 @@ import {
   dryRunCapability,
   executeCapabilityWithEnvelope,
   validateCapability
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-MXV3PYC3.js";
 import {
   withOutputMetadata
-} from "./chunk-KFNMQTZI.js";
+} from "./chunk-ELCR235M.js";
 import {
   CliValidationError
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/definition-intent.ts
 import { createHash } from "crypto";

package/dist/{chunk-KFNMQTZI.js → chunk-ELCR235M.js}

@@ -1,16 +1,19 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   peekCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   getActiveHost,
   getConfigDir,
-  isAeSandboxRuntime,
-  normalizeUrl
-} from "./chunk-UQ77JXYH.js";
+  isAeSandboxRuntime
+} from "./chunk-LMCYSVVA.js";
 import {
-  logger
-} from "./chunk-WNGFSIOB.js";
+  externalCliTokenRequestOptions,
+  logger,
+  normalizeUrl,
+  readExternalCliToken,
+  redactExternalCliToken
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/install-process.ts
 import spawn from "cross-spawn";
@@ -725,11 +728,13 @@ function recordVersionSyncResult(host, target, result) {
   store.hosts[key] = entry;
   writeSyncStore(store);
 }
-function isAutoSyncTargetEligible(version) {
+function isRegularCliVersion(version) {
   const normalized = normalizeCliVersion(version);
-  const parts = normalized.split("-")[0].split(".").map((part) => Number.parseInt(part, 10));
-  if (parts.length < 3 || parts.some((part) => !Number.isFinite(part))) return false;
-  const [major, minor, patch] = parts;
+  return /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(normalized) && normalized.split(".").every((part) => Number.isSafeInteger(Number(part)));
+}
+function isAutoSyncTargetEligible(version) {
+  if (!isRegularCliVersion(version)) return false;
+  const [major, minor, patch] = normalizeCliVersion(version).split(".").map(Number);
   if (major > 6) return true;
   if (major !== 6) return false;
   if (minor > 1) return true;
@@ -966,7 +971,7 @@ function rootCommand(argv) {
     const token = args[i];
     if (token === "--") return void 0;
     if (token.startsWith("-")) {
-      if (!token.includes("=") && ["--host", "--mcp-url", "--format", "--jq"].includes(token)) {
+      if (!token.includes("=") && ["--host", "--cli-token-file", "--mcp-url", "--format", "--jq"].includes(token)) {
         i += 1;
       }
       continue;
@@ -981,13 +986,15 @@ function shouldSkipAutoSync(argv = process.argv) {
 }
 async function fetchCliConfig(host, cliToken) {
   const url = new URL(CLI_CONFIG_PATH, host.endsWith("/") ? host : `${host}/`);
-  url.searchParams.set("cli-token", cliToken);
+  const external = readExternalCliToken(host)?.token === cliToken;
+  if (!external) url.searchParams.set("cli-token", cliToken);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
     const resp = await fetch(url.toString(), {
       signal: controller.signal,
-      headers: { Accept: "application/json" }
+      headers: { Accept: "application/json", ...external ? { "cli-token": cliToken } : {} },
+      ...externalCliTokenRequestOptions(url.toString())
     });
     if (!resp.ok) return null;
     const body = await resp.json();
@@ -1104,7 +1111,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
   entry.localVersion = pkg.version;
   entry.expectedVersion = expected;
   entry.clusterVersion = cluster || entry.clusterVersion;
-  const canAutoSync = allowAutoSync && isPublicAeCliPackage(pkg.name) && isAutoSyncTargetEligible(expected);
+  const canAutoSync = allowAutoSync && isPublicAeCliPackage(pkg.name) && isRegularCliVersion(pkg.version) && isAutoSyncTargetEligible(expected);
   if (canAutoSync) {
     const confirmed = await fetchCliConfig(host, token);
     if (confirmed) rememberKbAutoDiscoveryFeature(host, token, confirmed.projectSemanticKbAutoDiscovery ?? false);
@@ -1307,7 +1314,7 @@ async function applyJq(data, expr) {
   if (!trimmed) return data;
   let results;
   try {
-    results = await jqJson(data, trimmed);
+    results = await jqJson(data ?? null, trimmed);
   } catch (err) {
     const message = err instanceof JqError ? err.message : err?.message || String(err);
     const error = new Error(`Invalid --jq expression: ${message}`);
@@ -1328,7 +1335,7 @@ async function formatOutput(data, format, jqExpr) {
     processed = await applyJq(outputData, jqExpr);
   }
   if (format === "table") {
-    return formatTable(processed);
+    return redactExternalCliToken(formatTable(processed));
   }
   const hostCompat = getPendingHostCompatNotice();
   const updateNotice = getPendingUpdateNotice();
@@ -1343,7 +1350,7 @@ async function formatOutput(data, format, jqExpr) {
     // Soft tip lives only under _notice (not mirrored into meta) to avoid duplicate fields.
     ...Object.keys(notices).length > 0 ? { _notice: notices } : {}
   };
-  return JSON.stringify(envelope, null, 2);
+  return redactExternalCliToken(JSON.stringify(envelope, null, 2));
 }
 function formatError(type, message, hint, code, meta, details) {
   const envelope = {
@@ -1351,7 +1358,7 @@ function formatError(type, message, hint, code, meta, details) {
     error: { type, message, hint, code, ...details === void 0 ? {} : { details } },
     ...meta && Object.keys(meta).length > 0 ? { meta } : {}
   };
-  return JSON.stringify(envelope, null, 2);
+  return redactExternalCliToken(JSON.stringify(envelope, null, 2));
 }
 function printError(type, message, hint, code, meta, options = {}) {
   const formatted = formatError(type, message, hint, code, meta, options.details);
@@ -1389,7 +1396,7 @@ async function printOutput(data, format, jqExpr, options = {}) {
       const recoveryData = options.redactErrors ? sensitiveRecoveryData(unwrapOutputData(data)) : unwrapOutputData(data);
       await new Promise((resolve, reject) => {
         process.stdout.write(
-          JSON.stringify({ ...recovery, data: recoveryData }, null, 2) + "\n",
+          redactExternalCliToken(JSON.stringify({ ...recovery, data: recoveryData }, null, 2)) + "\n",
           (error2) => error2 ? reject(error2) : resolve()
         );
       });

package/dist/{chunk-FMNNGNYO.js → chunk-F6NIPIT5.js}

@@ -1,17 +1,18 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   CapabilityGatewayError
-} from "./chunk-EOYSKMXN.js";
+} from "./chunk-MXV3PYC3.js";
 import {
   SecureStoreAuthError,
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-LMCYSVVA.js";
 import {
-  PermissionError
-} from "./chunk-WNGFSIOB.js";
+  PermissionError,
+  externalCliTokenRequestOptions
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {
@@ -170,7 +171,7 @@ function parseKbResponse(resp, text, options = {}) {
 async function fetchWithCliToken(input, init, cliToken, options = {}) {
   const headers = new Headers(init.headers);
   headers.set("cli-token", cliToken);
-  const resp = await fetch(input, { ...init, headers });
+  const resp = await fetch(input, { ...init, headers, ...externalCliTokenRequestOptions(input) });
   if (options.responseType === "empty" && resp.status === 204) return null;
   if (options.responseType === "bytes" && resp.ok) {
     if (resp.headers.get("content-type")?.includes("application/json")) {

package/dist/{chunk-D6ACFILC.js → chunk-GI5BMEZO.js}

@@ -3,7 +3,7 @@ import {
   getAgentApi,
   patchAgentApi,
   postAgentApi
-} from "./chunk-4655PUNX.js";
+} from "./chunk-JJJIP2XQ.js";
 
 // src/commands/memory/cli-client.ts
 var DEFAULT_TE_CLAUDE_BASE_PATH = "/agent";

package/dist/chunk-JJJIP2XQ.js

@@ -0,0 +1,105 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  TeAgentApiError,
+  deleteFromMainApp,
+  fetchSigned,
+  getBufferFromMainApp,
+  getFromMainApp,
+  parseResponse,
+  patchToMainApp,
+  postToMainApp,
+  putToMainApp,
+  uploadToMainApp
+} from "./chunk-2UWS5CUP.js";
+import {
+  clearCliTokenCache
+} from "./chunk-P7KL7IOH.js";
+
+// src/core/resource-package-client.ts
+function checkPath(path) {
+  if (!path.startsWith("/api/resource-packages/")) {
+    throw new TypeError("Resource package requests must use /api/resource-packages/");
+  }
+}
+async function fetchResourcePackage(input) {
+  const request = () => fetchSigned({ ...input, hostOverride: input.host });
+  let response = await request();
+  if (response.status === 401) {
+    await response.body?.cancel();
+    clearCliTokenCache(input.host);
+    response = await request();
+  }
+  return response;
+}
+async function resourcePackageJson(input) {
+  checkPath(input.path);
+  const response = await fetchResourcePackage({
+    method: input.method,
+    path: input.path,
+    host: input.host,
+    includeJsonContentType: true,
+    body: input.body === void 0 ? void 0 : JSON.stringify(input.body)
+  });
+  return parseResponse(response, "Resource package service returned");
+}
+async function resourcePackageRaw(input) {
+  checkPath(input.path);
+  const response = await fetchResourcePackage({
+    ...input,
+    includeJsonContentType: false
+  });
+  if (!response.ok) await parseResponse(response, "Resource package service returned");
+  return response;
+}
+
+// src/commands/te-agent/api-client.ts
+function getAgentApi(ctx, path) {
+  return getFromMainApp(path, ctx.host());
+}
+function postAgentApi(ctx, path, body) {
+  return postToMainApp(path, body, ctx.host());
+}
+function patchAgentApi(ctx, path, body) {
+  return patchToMainApp(path, body, ctx.host());
+}
+function putAgentApi(ctx, path, body) {
+  return putToMainApp(path, body, ctx.host());
+}
+function deleteAgentApi(ctx, path) {
+  return deleteFromMainApp(path, ctx.host());
+}
+function uploadAgentApi(ctx, path, formData) {
+  return uploadToMainApp(path, formData, ctx.host());
+}
+function getAgentBuffer(ctx, path) {
+  return getBufferFromMainApp(path, ctx.host());
+}
+function requestResourcePackageApi(ctx, method, path, body) {
+  return resourcePackageJson({ host: ctx.host(), method, path, body });
+}
+function requestResourcePackageRaw(ctx, method, path, options = {}) {
+  return resourcePackageRaw({ host: ctx.host(), method, path, ...options });
+}
+function isTransientResourcePackageError(error) {
+  return error instanceof TeAgentApiError && (error.status === 0 || error.status === 429 || error.status >= 500);
+}
+function resourcePackagePreflightChange(error) {
+  if (!(error instanceof TeAgentApiError) || error.code !== "PREFLIGHT_CHANGED") return void 0;
+  const body = error.body;
+  if (!body || typeof body !== "object" || !("preflight" in body)) return void 0;
+  return body.preflight;
+}
+
+export {
+  getAgentApi,
+  postAgentApi,
+  patchAgentApi,
+  putAgentApi,
+  deleteAgentApi,
+  uploadAgentApi,
+  getAgentBuffer,
+  requestResourcePackageApi,
+  requestResourcePackageRaw,
+  isTransientResourcePackageError,
+  resourcePackagePreflightChange
+};

package/dist/{chunk-5XJYLEVC.js → chunk-KHS64JZQ.js}

@@ -1,20 +1,20 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   require_lib
-} from "./chunk-CT7QDJS6.js";
+} from "./chunk-2IYIYSUO.js";
 import {
   require_archiver,
   require_string_decoder
-} from "./chunk-AP7YP2NX.js";
+} from "./chunk-QSAR3GHY.js";
 import {
   require_inherits,
   require_node
-} from "./chunk-S6M42KND.js";
+} from "./chunk-T44M3PLZ.js";
 import {
   __commonJS,
   __require,
   __toESM
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // node_modules/exceljs/lib/utils/under-dash.js
 var require_under_dash = __commonJS({

package/dist/{chunk-UQ77JXYH.js → chunk-LMCYSVVA.js}

@@ -1,16 +1,9 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
-  logger
-} from "./chunk-WNGFSIOB.js";
-
-// src/core/url-utils.ts
-function normalizeUrl(url) {
-  if (!url) return url;
-  if (!url.startsWith("http://") && !url.startsWith("https://")) {
-    url = `https://${url}`;
-  }
-  return url.replace(/\/$/, "");
-}
+  logger,
+  normalizeUrl,
+  readExternalCliToken
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/config.ts
 import fs3 from "fs";
@@ -93,6 +86,10 @@ function isAeSandboxRuntime() {
 var CONFIG_DIR = path.join(process.env.HOME || os.homedir(), ".ae-cli");
 var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 function sandboxCliTokenCandidatePaths() {
+  if (process.env.TE_AGENT_CLI_CONFIG_DIR !== void 0) {
+    const directory = process.env.TE_AGENT_CLI_CONFIG_DIR;
+    return path.isAbsolute(directory) ? [path.join(directory, "cli-token.json")] : [];
+  }
   const paths = [getSandboxCliTokenFilePath()];
   const homeFallback = path.join(process.env.HOME || os.homedir(), ".ae-config", "cli-token.json");
   if (!paths.includes(homeFallback)) {
@@ -108,7 +105,7 @@ function readSandboxCliTokenEntry() {
       if (data && typeof data === "object" && !Array.isArray(data)) {
         const url = data.url;
         const token = data.token ?? data["cli-token"];
-        if (url && token) {
+        if (typeof url === "string" && url && typeof token === "string" && token) {
           return { url, token };
         }
       }
@@ -196,6 +193,8 @@ function saveConfig(config) {
   logger.info(`Config saved: activeHost=${config.activeHost}, hosts=${Object.keys(config.hosts).length}`);
 }
 function getActiveHost() {
+  const externalHost = readExternalCliToken()?.url;
+  if (externalHost) return externalHost;
   const sandboxHost = readSandboxCliTokenEntry()?.url;
   if (sandboxHost) return sandboxHost;
   const config = loadConfig();
@@ -281,9 +280,9 @@ function getConfigDir() {
 export {
   safeJsonParse,
   safeReadJsonFile,
-  normalizeUrl,
   getSandboxRuntimeRoot,
   isAeSandboxRuntime,
+  readSandboxCliTokenEntry,
   getFallbackCliToken,
   loadConfig,
   saveConfig,

package/dist/{chunk-EOYSKMXN.js → chunk-MXV3PYC3.js}

@@ -6,13 +6,14 @@ import {
   SecureStoreAuthError,
   clearCliTokenCache,
   getCliToken
-} from "./chunk-GIK6EDUG.js";
+} from "./chunk-P7KL7IOH.js";
 import {
   safeJsonParse
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-LMCYSVVA.js";
 import {
-  PermissionError
-} from "./chunk-WNGFSIOB.js";
+  PermissionError,
+  externalCliTokenRequestOptions
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/cli-agent-context.ts
 import { readFileSync, statSync } from "fs";
@@ -306,7 +307,13 @@ async function permissionError(resp) {
   const body = safeJsonParse(await codeResponse.text());
   const error = isRecord(body?.error) ? body.error : void 0;
   const code = nonEmptyString(error?.code) ?? nonEmptyString(body?.code);
-  return new PermissionError(message, code);
+  return new PermissionError(
+    message,
+    code,
+    nonEmptyString(error?.hint),
+    void 0,
+    isRecord(body?.meta) ? body.meta : void 0
+  );
 }
 function isInvalidCliTokenMessage(message) {
   return /\byour token is invalid\b/i.test(message) || /\bcli[-_\s]?token\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\bcli[-_\s]?token\b/i.test(message);
@@ -402,11 +409,12 @@ async function requestOnce(url, method, token, body, accept = "application/json"
     headers["Content-Type"] = "application/json";
     init.body = JSON.stringify(includeClientContextInBody ? withCliAgentContextBody(body, agentContext) : body);
   }
-  return fetch(url, init);
+  return fetch(url, { ...init, ...externalCliTokenRequestOptions(url) });
 }
 async function requestMultipartOnce(url, token, form) {
   return fetch(url, {
     method: "POST",
+    ...externalCliTokenRequestOptions(url),
     headers: {
       "cli-token": token,
       "Accept": "application/json",

package/dist/{chunk-7QXISROD.js → chunk-P6VFCH3P.js}

@@ -1,8 +1,10 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
-  getActiveHost,
+  getActiveHost
+} from "./chunk-LMCYSVVA.js";
+import {
   normalizeUrl
-} from "./chunk-UQ77JXYH.js";
+} from "./chunk-ZW4VMY5H.js";
 
 // src/core/auth.ts
 function resolveHost(hostOverride) {