@thinkingai/ae-cli 6.0.55 → 6.0.57

package/dist/chunk-YVG6QD3V.js

@@ -0,0 +1,233 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  CliValidationError,
+  logger
+} from "./chunk-Z3Q2AEIN.js";
+
+// src/core/eval-endpoint.ts
+function resolveEvaluationHost(host) {
+  let endpoint;
+  try {
+    endpoint = new URL(host);
+    if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || /[?#\s]/.test(host)) throw new Error();
+  } catch {
+    throw new CliValidationError("Evaluation AE Host must be an absolute HTTP(S) URL without credentials, query, or fragment.", {
+      code: "EVAL_ENDPOINT_INVALID"
+    });
+  }
+  const hostname = endpoint.hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  const mappedIpv4 = /^::ffff:([0-9a-f]+):[0-9a-f]+$/.exec(hostname);
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "::" || hostname === "0.0.0.0" || hostname.startsWith("127.") || mappedIpv4 && parseInt(mappedIpv4[1], 16) >> 8 === 127 || hostname === "::ffff:0:0") {
+    throw new CliValidationError("Loopback evaluation endpoints are unsupported.", {
+      code: "EVAL_ENDPOINT_LOOPBACK_UNSUPPORTED",
+      hint: "Select an online AE Host with --host."
+    });
+  }
+  if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:") {
+    throw new CliValidationError("Evaluation AE Host must use HTTP or HTTPS.", {
+      code: "EVAL_ENDPOINT_INVALID"
+    });
+  }
+  return endpoint.toString().replace(/\/+$/, "").replace(/\/agent$/, "");
+}
+
+// src/core/eval-client.ts
+import { open, unlink } from "fs/promises";
+import { resolve } from "path";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var EvalApiError = class extends Error {
+  code;
+  httpStatus;
+  hint;
+  details;
+  constructor(message, options) {
+    const redact = evaluationErrorRedactor([
+      ...options.sensitiveValues ?? [],
+      process.env.AE_EVAL_ACCESS_TOKEN ?? ""
+    ]);
+    super(redact(message));
+    this.name = "EvalApiError";
+    this.code = options.code;
+    this.httpStatus = options.httpStatus;
+    this.hint = options.hint === void 0 ? void 0 : redact(options.hint);
+    this.details = options.details === void 0 ? void 0 : redact(options.details);
+  }
+};
+function evaluationErrorRedactor(secrets) {
+  const forms = [...new Set(secrets.filter(Boolean).flatMap((secret) => [
+    secret,
+    JSON.stringify(secret).slice(1, -1),
+    encodeURIComponent(secret)
+  ]))].sort((a, b) => b.length - a.length);
+  const redact = (value) => {
+    if (typeof value === "string") {
+      for (const secret of forms) value = value.split(secret).join("[REDACTED]");
+      return value;
+    }
+    if (Array.isArray(value)) return value.map(redact);
+    if (value && typeof value === "object") {
+      return Object.fromEntries(Object.entries(value).map(([key, item]) => [redact(key), redact(item)]));
+    }
+    return value;
+  };
+  return redact;
+}
+async function evalRequest(options) {
+  const url = buildEvalUrl(options.baseUrl, options.path, options.params);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  const headers = {
+    ...options.headers,
+    Accept: options.responseType === "bytes" ? "application/octet-stream, application/json" : "application/json"
+  };
+  const isMultipart = options.body instanceof FormData;
+  if (options.body !== void 0 && !isMultipart) {
+    headers["Content-Type"] = "application/json";
+  }
+  if (options.idempotencyKey) {
+    headers["Idempotency-Key"] = options.idempotencyKey;
+  }
+  let response;
+  let responseText = "";
+  let bytes;
+  try {
+    response = await fetchImpl(url, {
+      method: options.method,
+      headers,
+      body: options.body === void 0 ? void 0 : options.body instanceof FormData ? options.body : JSON.stringify(options.body),
+      redirect: "error",
+      signal: controller.signal
+    });
+    if (response.ok && options.responseType === "bytes") {
+      bytes = new Uint8Array(await response.arrayBuffer());
+    } else {
+      responseText = await response.text();
+    }
+  } catch (error) {
+    const timedOut = controller.signal.aborted || error instanceof Error && error.name === "AbortError";
+    logEvalRequest(options.method, url, response?.status ?? "unavailable");
+    if (timedOut) {
+      throw new EvalApiError(`Evaluation API request timed out after ${timeoutMs} ms.`, {
+        code: "EVAL_API_TIMEOUT",
+        httpStatus: 0,
+        hint: "Verify the evaluation platform is reachable at the configured endpoint."
+      });
+    }
+    throw new EvalApiError("Evaluation API request failed before a response was received.", {
+      code: "EVAL_API_NETWORK_ERROR",
+      httpStatus: 0,
+      hint: "Verify the --endpoint URL and network path."
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+  logEvalRequest(options.method, url, response.status);
+  if (bytes !== void 0) return bytes;
+  const responseBody = parseEvalResponseBody(responseText, response.status);
+  if (!response.ok) {
+    const sensitiveValues = Object.values(options.headers).flatMap((value) => [value, value.replace(/^Bearer\s+/i, "")]);
+    if (isRecord(options.body)) {
+      for (const key of ["secret", "data_token", "report_source"]) {
+        if (typeof options.body[key] === "string") sensitiveValues.push(options.body[key]);
+      }
+    }
+    throw evalErrorFromBody(responseBody, response.status, sensitiveValues);
+  }
+  return responseBody;
+}
+async function evalDownloadFile(options, outputPath) {
+  const path = resolve(outputPath);
+  let file;
+  try {
+    file = await open(path, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      throw new CliValidationError("Output file already exists; choose a new --output path.", {
+        code: "EVAL_OUTPUT_EXISTS"
+      });
+    }
+    throw error;
+  }
+  let completed = false;
+  try {
+    const bytes = await evalRequest({ ...options, responseType: "bytes" });
+    await file.writeFile(bytes);
+    completed = true;
+    return { path, byte_size: bytes.byteLength };
+  } finally {
+    await file.close();
+    if (!completed) await unlink(path);
+  }
+}
+function buildEvalUrl(baseUrl, path, params) {
+  const base = resolveEvaluationHost(baseUrl);
+  const url = new URL(`${base}${path}`);
+  if (params) {
+    for (const [key, value] of Object.entries(params)) {
+      if (value === void 0 || value === null || value === "") continue;
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function parseEvalResponseBody(text, httpStatus) {
+  if (!text.trim()) {
+    if (httpStatus === 204) return void 0;
+    throw new EvalApiError("Evaluation API returned an empty response body.", {
+      code: "EVAL_API_INVALID_RESPONSE",
+      httpStatus
+    });
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new EvalApiError("Evaluation API returned a non-JSON response body.", {
+      code: "EVAL_API_INVALID_RESPONSE",
+      httpStatus
+    });
+  }
+}
+function evalErrorFromBody(body, httpStatus, sensitiveValues) {
+  const error = body?.error;
+  if (isRecord(error) && typeof error.message === "string" && error.message.trim()) {
+    return new EvalApiError(error.message.trim(), {
+      code: typeof error.code === "string" && /^[A-Z][A-Z0-9_]{0,127}$/.test(error.code) ? error.code : `EVAL_API_HTTP_${httpStatus}`,
+      httpStatus,
+      hint: typeof error.details === "string" ? error.details : void 0,
+      details: isRecord(error.details) ? error.details : void 0,
+      sensitiveValues
+    });
+  }
+  return new EvalApiError(`Evaluation API returned HTTP ${httpStatus}.`, {
+    code: `EVAL_API_HTTP_${httpStatus}`,
+    httpStatus,
+    hint: httpStatus >= 500 ? "The server response was suppressed. Check the evaluation platform logs; the CLI did not retry." : void 0
+  });
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function logEvalRequest(method, url, status) {
+  logger.info(`EVAL ${method} ${redactEvalLogUrl(url)} status=${status}`);
+}
+function redactEvalLogUrl(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return "[invalid evaluation URL]";
+  }
+}
+
+export {
+  resolveEvaluationHost,
+  EvalApiError,
+  evalRequest,
+  evalDownloadFile
+};

package/dist/{chunk-WNGFSIOB.js → chunk-Z3Q2AEIN.js}

@@ -48,101 +48,20 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/core/logger.ts
-import fs from "fs";
-import path from "path";
-var LOG_DIR = path.join(process.env.HOME || "", ".ae-cli", "log");
-var Logger = class {
-  logDir;
-  date;
-  constructor() {
-    this.logDir = LOG_DIR;
-    this.date = this.today();
-    this.ensureDir();
-  }
-  today() {
-    const d = /* @__PURE__ */ new Date();
-    return `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, "0")}${String(d.getDate()).padStart(2, "0")}`;
-  }
-  timestamp() {
-    return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").split(".")[0];
-  }
-  ensureDir() {
-    if (!fs.existsSync(this.logDir)) {
-      fs.mkdirSync(this.logDir, { recursive: true });
-    }
-  }
-  filePath(level) {
-    const today = this.today();
-    if (today !== this.date) {
-      this.date = today;
-    }
-    return path.join(this.logDir, `${this.date}_${level}.log`);
-  }
-  /**
-   * Write a log entry to file (not printed to the console; console output is handled by existing process.stderr.write calls)
-   */
-  write(level, message) {
-    const ts = this.timestamp();
-    const line = `[${ts}] ${message}
-`;
-    try {
-      fs.appendFileSync(this.filePath(level), line);
-    } catch {
-    }
-  }
-  /** Informational log */
-  info(message) {
-    this.write("info", message);
-  }
-  /** Warning log */
-  warn(message) {
-    this.write("warning", message);
-  }
-  /** Error log */
-  error(message) {
-    this.write("error", message);
-  }
-  /** Log HTTP API request details */
-  api(method, url, status, reqBody, respBody) {
-    const parts = [`API ${method} ${url} \u2192 HTTP ${status}`];
-    if (reqBody !== void 0 && reqBody !== null) {
-      const s = typeof reqBody === "string" ? reqBody : JSON.stringify(reqBody);
-      parts.push(`REQ: ${s.slice(0, 500)}`);
-    }
-    if (respBody !== void 0 && respBody !== null) {
-      const s = typeof respBody === "string" ? respBody : JSON.stringify(respBody);
-      parts.push(`RESP: ${s.slice(0, 500)}`);
-    }
-    this.info(parts.join(" | "));
-  }
-  /** Log command execution (sensitive flags redacted to ***) */
-  command(name, args, sensitiveFlags = []) {
-    const normalizeFlagName = (name2) => name2.toLowerCase().replace(/[-_]/g, "");
-    const explicitSensitive = new Set(Array.from(sensitiveFlags, normalizeFlagName));
-    const SENSITIVE = ["token", "apikey", "secret", "accesstoken", "headers"];
-    const isSensitive = (k) => {
-      const normalized = normalizeFlagName(k);
-      return explicitSensitive.has(normalized) || SENSITIVE.some((s) => normalized.includes(s));
-    };
-    const filtered = Object.entries(args).filter(([, v]) => v !== void 0 && v !== null && v !== "").map(([k, v]) => `--${k}=${isSensitive(k) ? "***" : JSON.stringify(v)}`).join(" ");
-    this.info(`CMD ${name}${filtered ? " " + filtered : ""}`);
-  }
-};
-var logger = new Logger();
-
 // src/core/errors.ts
 var PermissionError = class extends Error {
-  constructor(message, code, hint, details) {
+  constructor(message, code, hint, details, meta) {
     super(message);
     this.code = code;
     this.hint = hint;
     this.details = details;
+    this.meta = meta;
     this.name = "PermissionError";
   }
   code;
   hint;
   details;
+  meta;
 };
 function isApiErrorType(value) {
   return value === "auth" || value === "permission" || value === "validation" || value === "not_found" || value === "api";
@@ -212,6 +131,228 @@ var LocalDataUploadError = class extends Error {
   }
 };
 
+// src/core/kb-read-context.ts
+import fs from "fs";
+var secrets = /* @__PURE__ */ new Set();
+function fail(code) {
+  throw new CliValidationError(code, { code });
+}
+function kbExecutionContextRequired() {
+  return process.env.AE_KB_READ_CONTEXT_REQUIRED !== void 0 || process.env.AE_KB_READ_CONTEXT_FILE !== void 0;
+}
+function isKbQueryPath(method, pathname) {
+  return method === "POST" && /^\/(?:agent\/)?api\/external\/knowledge-bases\/(list|index|grep|read)$/.test(pathname);
+}
+function readKbExecutionContext() {
+  if (!kbExecutionContextRequired()) return void 0;
+  const file = process.env.AE_KB_READ_CONTEXT_FILE;
+  if (process.env.AE_KB_READ_CONTEXT_REQUIRED !== "1" || !file) fail("KB_READ_CONTEXT_REQUIRED");
+  let fd;
+  let data;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.size > 16384 || (stat.mode & 511) !== 384 || process.getuid && stat.uid !== process.getuid())
+      throw new Error();
+    data = JSON.parse(fs.readFileSync(fd, "utf8"));
+    if (!data || Array.isArray(data) || Object.keys(data).sort().join(",") !== "executionRef,expiresAt,formatVersion,origin,readContextId,required,token" || data.formatVersion !== 1 || data.required !== true || typeof data.executionRef !== "string" || !/^[^\s\0]{1,191}$/.test(data.executionRef) || typeof data.readContextId !== "string" || !/^[^\s\0]{1,191}$/.test(data.readContextId) || typeof data.token !== "string" || !/^cli_kbr_[A-Za-z0-9_-]{43,}$/.test(data.token) || typeof data.expiresAt !== "string" || !Number.isFinite(Date.parse(data.expiresAt)))
+      throw new Error();
+    const origin = new URL(data.origin);
+    if (!["http:", "https:"].includes(origin.protocol) || origin.username || origin.password || origin.origin !== data.origin)
+      throw new Error();
+  } catch {
+    fail("KB_READ_CONTEXT_REQUIRED");
+  } finally {
+    if (fd !== void 0) fs.closeSync(fd);
+  }
+  secrets.add(data.token);
+  if (Date.parse(data.expiresAt) <= Date.now()) fail("KB_READ_CONTEXT_EXPIRED");
+  return data;
+}
+function kbReadHeaders(url, explicitId) {
+  const context = readKbExecutionContext();
+  if (!context) return explicitId ? { "X-KB-Read-Context": explicitId } : void 0;
+  if (new URL(url).origin !== context.origin || explicitId && explicitId !== context.readContextId)
+    fail("KB_READ_CONTEXT_MISMATCH");
+  return { "cli-token": context.token, "X-KB-Read-Context": context.readContextId };
+}
+function redactKbReadCredential(value) {
+  for (const token of secrets) value = value.split(token).join("[REDACTED]");
+  return value.replace(/cli_kbr_[A-Za-z0-9_-]+/g, "[REDACTED]");
+}
+
+// src/core/url-utils.ts
+function normalizeUrl(url) {
+  if (!url) return url;
+  if (!url.startsWith("http://") && !url.startsWith("https://")) {
+    url = `https://${url}`;
+  }
+  return url.replace(/\/$/, "");
+}
+
+// src/core/external-cli-token.ts
+import fs2 from "fs";
+var ExternalCliTokenError = class extends Error {
+  constructor(message, code = "EXTERNAL_CLI_TOKEN_INVALID") {
+    super(message);
+    this.code = code;
+    this.name = "ExternalCliTokenError";
+  }
+  code;
+  hint = "Set AE_CLI_TOKEN with AE_CLI_TOKEN_HOST, or use a JSON CLI token file containing url and token. Remove external token settings to use stored accounts.";
+};
+var explicitTokenFile;
+var diagnosticSecrets = /* @__PURE__ */ new Set();
+function setExternalCliTokenFile(file) {
+  explicitTokenFile = file;
+}
+function normalizedHost(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new ExternalCliTokenError("The external CLI token requires a host URL.");
+  }
+  try {
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash || /\s/.test(value)) throw new Error();
+    return normalizeUrl(url.toString());
+  } catch {
+    throw new ExternalCliTokenError("The external CLI token host must be an HTTP(S) URL without credentials, query, or fragment.");
+  }
+}
+function credential(url, value, source) {
+  if (typeof value !== "string" || !/^cli_[!-~]+$/.test(value.trim())) {
+    throw new ExternalCliTokenError("The external CLI token must be a non-empty ASCII cli_ token without whitespace.");
+  }
+  return { url: normalizedHost(url), token: value.trim(), source };
+}
+function readExternalCliToken(hostOverride) {
+  let entry;
+  const file = explicitTokenFile ?? (process.env.AE_CLI_TOKEN === void 0 ? process.env.AE_CLI_TOKEN_FILE : void 0);
+  if (file !== void 0) {
+    if (!file.trim()) throw new ExternalCliTokenError("The external CLI token file path is empty.");
+    let data;
+    try {
+      const stat = fs2.statSync(file);
+      if (!stat.isFile() || stat.size > 64 * 1024) throw new Error();
+      data = JSON.parse(fs2.readFileSync(file, "utf8"));
+    } catch {
+      throw new ExternalCliTokenError("The external CLI token file must be a readable JSON file no larger than 64 KiB.");
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+      throw new ExternalCliTokenError("The external CLI token file must contain an object with url and token.");
+    }
+    entry = credential(data.url, data.token ?? data["cli-token"], "file-cli-token");
+  } else if (process.env.AE_CLI_TOKEN !== void 0) {
+    entry = credential(process.env.AE_CLI_TOKEN_HOST, process.env.AE_CLI_TOKEN, "environment-cli-token");
+  } else if (process.env.AE_CLI_TOKEN_HOST !== void 0) {
+    throw new ExternalCliTokenError("AE_CLI_TOKEN_HOST requires AE_CLI_TOKEN.");
+  }
+  if (entry && hostOverride && normalizedHost(hostOverride) !== entry.url) {
+    throw new ExternalCliTokenError("The selected host does not match the external CLI token host.");
+  }
+  if (entry) diagnosticSecrets.add(entry.token);
+  return entry;
+}
+function externalCliTokenRequestOptions(destination) {
+  const external = readExternalCliToken();
+  if (!external) return {};
+  if (new URL(destination).origin !== new URL(external.url).origin) {
+    throw new ExternalCliTokenError("The request destination does not match the external CLI token host.");
+  }
+  return { redirect: "error" };
+}
+function redactExternalCliToken(value) {
+  try {
+    readExternalCliToken();
+  } catch {
+  }
+  const forms = [...diagnosticSecrets].flatMap((token) => [token, JSON.stringify(token).slice(1, -1), encodeURIComponent(token)]);
+  for (const form of [...new Set(forms)].sort((a, b) => b.length - a.length)) value = value.split(form).join("[REDACTED]");
+  return redactKbReadCredential(value);
+}
+
+// src/core/logger.ts
+import fs3 from "fs";
+import path from "path";
+var LOG_DIR = path.join(process.env.HOME || "", ".ae-cli", "log");
+var Logger = class {
+  logDir;
+  date;
+  constructor() {
+    this.logDir = LOG_DIR;
+    this.date = this.today();
+    this.ensureDir();
+  }
+  today() {
+    const d = /* @__PURE__ */ new Date();
+    return `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, "0")}${String(d.getDate()).padStart(2, "0")}`;
+  }
+  timestamp() {
+    return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").split(".")[0];
+  }
+  ensureDir() {
+    if (!fs3.existsSync(this.logDir)) {
+      fs3.mkdirSync(this.logDir, { recursive: true });
+    }
+  }
+  filePath(level) {
+    const today = this.today();
+    if (today !== this.date) {
+      this.date = today;
+    }
+    return path.join(this.logDir, `${this.date}_${level}.log`);
+  }
+  /**
+   * Write a log entry to file (not printed to the console; console output is handled by existing process.stderr.write calls)
+   */
+  write(level, message) {
+    const ts = this.timestamp();
+    const line = `[${ts}] ${redactExternalCliToken(message)}
+`;
+    try {
+      fs3.appendFileSync(this.filePath(level), line);
+    } catch {
+    }
+  }
+  /** Informational log */
+  info(message) {
+    this.write("info", message);
+  }
+  /** Warning log */
+  warn(message) {
+    this.write("warning", message);
+  }
+  /** Error log */
+  error(message) {
+    this.write("error", message);
+  }
+  /** Log HTTP API request details */
+  api(method, url, status, reqBody, respBody) {
+    const parts = [`API ${method} ${url} \u2192 HTTP ${status}`];
+    if (reqBody !== void 0 && reqBody !== null) {
+      const s = typeof reqBody === "string" ? reqBody : JSON.stringify(reqBody);
+      parts.push(`REQ: ${s.slice(0, 500)}`);
+    }
+    if (respBody !== void 0 && respBody !== null) {
+      const s = typeof respBody === "string" ? respBody : JSON.stringify(respBody);
+      parts.push(`RESP: ${s.slice(0, 500)}`);
+    }
+    this.info(parts.join(" | "));
+  }
+  /** Log command execution (sensitive flags redacted to ***) */
+  command(name, args, sensitiveFlags = []) {
+    const normalizeFlagName = (name2) => name2.toLowerCase().replace(/[-_]/g, "");
+    const explicitSensitive = new Set(Array.from(sensitiveFlags, normalizeFlagName));
+    const SENSITIVE = ["token", "apikey", "secret", "accesstoken", "headers"];
+    const isSensitive = (k) => {
+      const normalized = normalizeFlagName(k);
+      return explicitSensitive.has(normalized) || SENSITIVE.some((s) => normalized.includes(s));
+    };
+    const filtered = Object.entries(args).filter(([, v]) => v !== void 0 && v !== null && v !== "").map(([k, v]) => `--${k}=${isSensitive(k) ? "***" : JSON.stringify(v)}`).join(" ");
+    this.info(`CMD ${name}${filtered ? " " + filtered : ""}`);
+  }
+};
+var logger = new Logger();
+
 export {
   __require,
   __esm,
@@ -219,11 +360,21 @@ export {
   __export,
   __toESM,
   __toCommonJS,
-  logger,
   PermissionError,
   isApiErrorType,
   CliValidationError,
   CliApiError,
   CommunityReportError,
-  LocalDataUploadError
+  LocalDataUploadError,
+  kbExecutionContextRequired,
+  isKbQueryPath,
+  readKbExecutionContext,
+  kbReadHeaders,
+  normalizeUrl,
+  ExternalCliTokenError,
+  setExternalCliTokenFile,
+  readExternalCliToken,
+  externalCliTokenRequestOptions,
+  redactExternalCliToken,
+  logger
 };