@thinkingai/ae-cli 6.1.13 → 6.1.16

package/dist/{te-analysis-LLOCCBJ4.js → te-analysis-ZMNGOVNW.js}

@@ -6,17 +6,17 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-UIHQJK5E.js";
+} from "./chunk-SAU3QFIQ.js";
 import {
   createCapabilityCommand
-} from "./chunk-753BUTNZ.js";
+} from "./chunk-RGKJGKT7.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-PTE56QPL.js";
 import {
   withOutputMetadata
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -27,16 +27,17 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-5XUSIK27.js";
+} from "./chunk-P3FGXJTU.js";
+import "./chunk-C4MGVGJW.js";
 import {
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
-import "./chunk-3FY3RJ26.js";
+} from "./chunk-4SGZG4XY.js";
+import "./chunk-ZZUOD757.js";
 import {
   CliValidationError
-} from "./chunk-AXDXJTPC.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -258,7 +259,7 @@ function projectInput(ctx) {
 function listInput(ctx) {
   return compactInput({
     ...projectInput(ctx),
-    query: optionalString(ctx, "query"),
+    queries: optionalJson(ctx, "queries"),
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset")
@@ -1281,7 +1282,7 @@ var metadataVirtualPropertySqlRuleUpdate = createAnalysisMetaCapabilityCommand({
   flags: [
     projectIdFlag,
     { name: "sql-expression", type: "string", required: true, desc: "SQL expression used to calculate the virtual property." },
-    { name: "v-prop", type: "json", required: true, desc: "Virtual property JSON object with prop_id/property fields." },
+    { name: "v-prop", type: "json", required: true, desc: "Virtual property JSON object with prop_id beside property." },
     { name: "properties", type: "json", required: false, desc: "Dependent property JSON array." },
     { name: "sql-event-relation-type", type: "string", required: false, desc: "relation_default, relation_always, or relation_by_setting." },
     { name: "related-events", type: "json", required: false, desc: "Related events JSON array when using relation_by_setting." },
@@ -1396,16 +1397,7 @@ var metadataMetricGet = createAnalysisMetaCapabilityCommand({
 
 // src/commands/te-analysis/meta/metric/shared.ts
 function metricMode(ctx) {
-  const mode = optionalNumber(ctx, "metric-mode");
-  const modelType = optionalString(ctx, "model-type");
-  const mapped = modelType === void 0 ? void 0 : modelTypeToMetricMode(modelType);
-  if (mode === void 0 && mapped === void 0) {
-    throw new Error("Pass one of --model-type or --metric-mode");
-  }
-  if (mode !== void 0 && mapped !== void 0 && mode !== mapped) {
-    throw new Error("--metric-mode must match --model-type when both are provided");
-  }
-  return mode ?? mapped;
+  return modelTypeToMetricMode(ctx.str("model-type"));
 }
 function optionalMetricMode(ctx) {
   const mode = optionalNumber(ctx, "metric-mode");
@@ -1438,9 +1430,8 @@ var metadataMetricCreate = createAnalysisMetaCapabilityCommand({
     { name: "metric-name", type: "string", required: true, desc: "Metric technical name, for example pay_count." },
     { name: "metric-desc", type: "string", required: true, desc: "Metric display name." },
     { name: "metric-remark", type: "string", required: false, desc: "Metric remark." },
-    { name: "metric-mode", type: "number", required: false, desc: "Metric model mode, for example 0 for event analysis." },
-    { name: "model-type", type: "string", required: false, desc: "Semantic metric model type: event or retention. Prefer this over metric-mode." },
-    { name: "metric-events", type: "json", required: true, desc: "Metric event-analysis QP JSON array." },
+    { name: "model-type", type: "string", required: true, desc: "Semantic metric model type: event or retention." },
+    { name: "metric-events", type: "json", required: true, desc: "One semantic event-analysis definition, or a native snake_case QP array for compatibility." },
     { name: "metric-params", type: "json", required: false, desc: "Metric params JSON object. Defaults to {} in common when omitted." }
   ],
   risk: "write",
@@ -2329,8 +2320,9 @@ var reportList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.report.list",
   description: "List analysis reports visible to the current user through the capability gateway.",
-  flags: [projectIdFlag, queryFlag, fieldsFlag, reportModelTypesFlag, reportListLimitFlag, directoryOffsetFlag],
+  flags: [projectIdFlag, queriesFlag, fieldsFlag, reportModelTypesFlag, reportListLimitFlag, directoryOffsetFlag],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: reportListInput
 });
 
@@ -2343,7 +2335,7 @@ var reportListExport = createAnalysisCapabilityCommand({
   description: "Export the accessible report catalog as a gzip artifact.",
   flags: [
     projectIdFlag,
-    queryFlag,
+    queriesFlag,
     fieldsFlag,
     reportModelTypesFlag,
     requestIdFlag,
@@ -2351,9 +2343,10 @@ var reportListExport = createAnalysisCapabilityCommand({
     asyncTimeoutSecondsFlag
   ],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
-    query: optionalString(ctx, "query"),
+    queries: optionalQueries(ctx),
     fields: optionalJson(ctx, "fields"),
     model_types: optionalJson(ctx, "model-types"),
     ...exportLifecycleInput(ctx)
@@ -2736,7 +2729,7 @@ var dashboardList = createAnalysisCapabilityCommand({
   description: "List dashboards visible to the current user through the capability gateway.",
   flags: [
     projectIdFlag,
-    queryFlag,
+    queriesFlag,
     {
       name: "fields",
       type: "json",
@@ -2748,6 +2741,7 @@ var dashboardList = createAnalysisCapabilityCommand({
     directoryOffsetFlag
   ],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: listInput
 });
 
@@ -2781,7 +2775,7 @@ var dashboardGet = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "get",
   capabilityId: "analysis.dashboard.get",
-  description: "Get one dashboard detail, including creator, create/update time, settings, reports, notes, and share information.",
+  description: "Get one dashboard detail, including location, creator, create/update time, settings, reports, notes, and share information.",
   flags: [
     projectIdFlag,
     { name: "dashboard-id", type: "number", required: true, desc: "Dashboard ID." },
@@ -2800,10 +2794,10 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "update",
   capabilityId: "analysis.dashboard.update",
-  description: "Update dashboard settings or create/update a dashboard note. Use --operation settings or note-upsert.",
+  description: "Update dashboard settings, create/update a dashboard note, or replace the dashboard-level business filter. Use --operation settings, note-upsert, or business-filter.",
   flags: [
     projectIdFlag,
-    { name: "operation", type: "string", required: true, desc: "Update operation: settings or note-upsert." },
+    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, or business-filter." },
     { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
@@ -2814,6 +2808,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
     { name: "description", type: "string", required: false, desc: "Dashboard note description." },
     { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
+    { name: "filter", type: "json", required: false, desc: 'Dashboard-level business filter in snake_case QP form. Required with --operation business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' },
     payloadFlag
   ],
   risk: "write",
@@ -2830,6 +2825,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     note_title: optionalString(ctx, "note-title"),
     description: optionalString(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
+    filter: optionalJson(ctx, "filter"),
     payload: optionalJson(ctx, "payload")
   })
 });
@@ -3713,8 +3709,9 @@ var biPanelList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.bi_panel.list",
   description: "List BI panels visible to the current user through the capability gateway.",
-  flags: [projectIdFlag, queryFlag, fieldsFlag, directoryLimitFlag, directoryOffsetFlag],
+  flags: [projectIdFlag, queriesFlag, fieldsFlag, directoryLimitFlag, directoryOffsetFlag],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: listInput
 });
 
@@ -3958,8 +3955,9 @@ var projectSpaceList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.project_space.list",
   description: "List project spaces visible to the current user.",
-  flags: [projectIdFlag, queryFlag, fieldsFlag, directoryLimitFlag, directoryOffsetFlag],
+  flags: [projectIdFlag, queriesFlag, fieldsFlag, directoryLimitFlag, directoryOffsetFlag],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: listInput
 });
 
@@ -3978,10 +3976,30 @@ var projectSpaceGet = createAnalysisCapabilityCommand({
   })
 });
 
+// src/commands/te-analysis/project-space/business-filter-upsert.ts
+var projectSpaceBusinessFilterUpsert = createAnalysisCapabilityCommand({
+  resource: "project-space",
+  command: "business-filter-upsert",
+  capabilityId: "analysis.project_space.business_filter_upsert",
+  description: "Create or replace the space-level business filter inherited by dashboards in a project space.",
+  flags: [
+    projectIdFlag,
+    { name: "space-id", type: "number", required: true, desc: "Project space ID." },
+    { name: "filter", type: "json", required: true, desc: 'Space-level business filter in snake_case QP form. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' }
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    ...projectInput(ctx),
+    space_id: ctx.num("space-id"),
+    filter: ctx.json("filter")
+  })
+});
+
 // src/commands/te-analysis/project-space/index.ts
 var commands31 = [
   projectSpaceList,
-  projectSpaceGet
+  projectSpaceGet,
+  projectSpaceBusinessFilterUpsert
 ];
 var project_space_default = commands31;
 
@@ -3993,20 +4011,16 @@ var favoriteAdd = createAnalysisCapabilityCommand({
   description: "Favorite one dashboard, BI panel, or folder.",
   flags: [
     projectIdFlag,
-    { name: "asset-id", type: "number", required: false, desc: "Asset ID." },
-    { name: "asset-type", type: "string", required: false, desc: "Asset type, for example dashboard, bi_panel, or folder." },
-    { name: "space-id", type: "number", required: false, desc: "Project space ID when relevant." },
-    { name: "id", type: "number", required: false, desc: "Backend DTO ID field when required." },
-    payloadFlag
+    { name: "asset-id", type: "number", required: true, desc: "Dashboard, BI panel, or folder ID." },
+    { name: "asset-type", type: "string", required: true, desc: "Asset type: dashboard, bi_panel, or folder." },
+    { name: "space-id", type: "number", required: false, desc: "Project space ID when relevant." }
   ],
   risk: "write",
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
-    asset_id: optionalNumber(ctx, "asset-id"),
-    asset_type: optionalString(ctx, "asset-type"),
-    space_id: optionalNumber(ctx, "space-id"),
-    id: optionalNumber(ctx, "id"),
-    payload: optionalJson(ctx, "payload")
+    asset_id: ctx.num("asset-id"),
+    asset_type: ctx.str("asset-type"),
+    space_id: optionalNumber(ctx, "space-id")
   })
 });
 
@@ -4018,20 +4032,16 @@ var favoriteRemove = createAnalysisCapabilityCommand({
   description: "Remove favorite from one dashboard, BI panel, or folder.",
   flags: [
     projectIdFlag,
-    { name: "asset-id", type: "number", required: false, desc: "Asset ID." },
-    { name: "asset-type", type: "string", required: false, desc: "Asset type, for example dashboard, bi_panel, or folder." },
-    { name: "space-id", type: "number", required: false, desc: "Project space ID when relevant." },
-    { name: "id", type: "number", required: false, desc: "Backend DTO ID field when required." },
-    payloadFlag
+    { name: "asset-id", type: "number", required: true, desc: "Dashboard, BI panel, or folder ID." },
+    { name: "asset-type", type: "string", required: true, desc: "Asset type: dashboard, bi_panel, or folder." },
+    { name: "space-id", type: "number", required: false, desc: "Project space ID when relevant." }
   ],
   risk: "write",
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
-    asset_id: optionalNumber(ctx, "asset-id"),
-    asset_type: optionalString(ctx, "asset-type"),
-    space_id: optionalNumber(ctx, "space-id"),
-    id: optionalNumber(ctx, "id"),
-    payload: optionalJson(ctx, "payload")
+    asset_id: ctx.num("asset-id"),
+    asset_type: ctx.str("asset-type"),
+    space_id: optionalNumber(ctx, "space-id")
   })
 });
 
@@ -4079,8 +4089,9 @@ var publicLinkList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.public_link.list",
   description: "List public links in a project.",
-  flags: [projectIdFlag, queryFlag, fieldsFlag, directoryLimitFlag, directoryOffsetFlag],
+  flags: [projectIdFlag, queriesFlag, fieldsFlag, directoryLimitFlag, directoryOffsetFlag],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: listInput
 });
 
@@ -4747,6 +4758,12 @@ var zoneOffsetFlag3 = {
   required: false,
   desc: "Optional timezone offset. UTC+8 is 8; UTC-5 is -5."
 };
+var autoRefreshCronFlag = {
+  name: "auto-refresh-cron",
+  type: "string",
+  required: false,
+  desc: "Optional Quartz cron expression for an existing enabled auto-refresh schedule. This does not enable auto refresh."
+};
 var entityIdFlag = {
   name: "entity-id",
   type: "number",
@@ -4988,6 +5005,7 @@ function clusterWriteInput(ctx, create) {
     authenticated_only: optionalBoolean(ctx, "authenticated-only"),
     remark: create ? void 0 : optionalString(ctx, "remark"),
     zone_offset: optionalNumber(ctx, "zone-offset"),
+    auto_refresh_cron: create ? void 0 : optionalString(ctx, "auto-refresh-cron"),
     entity_id: create ? optionalNumber(ctx, "entity-id") : void 0
   });
 }
@@ -5002,6 +5020,7 @@ function tagWriteInput(ctx, create) {
     authenticated_only: optionalBoolean(ctx, "authenticated-only"),
     remark: create ? void 0 : optionalString(ctx, "remark"),
     zone_offset: optionalNumber(ctx, "zone-offset"),
+    auto_refresh_cron: create ? void 0 : optionalString(ctx, "auto-refresh-cron"),
     entity_id: create ? optionalNumber(ctx, "entity-id") : void 0
   });
 }
@@ -5180,7 +5199,8 @@ var commands40 = [
     optionalClusterDefinitionRequestFlag,
     authenticatedOnlyFlag,
     remarkFlag,
-    zoneOffsetFlag3
+    zoneOffsetFlag3,
+    autoRefreshCronFlag
   ], "write", (ctx) => clusterWriteInput(ctx, false)),
   idImportCapability(capability("user-cluster", "create-id", "analysis.user_cluster.create_id", "Create a cluster by mapping imported values to an analysis entity.", [
     projectIdFlag,
@@ -5272,7 +5292,8 @@ var commands40 = [
     optionalTagDefinitionRequestFlag,
     authenticatedOnlyFlag,
     remarkFlag,
-    zoneOffsetFlag3
+    zoneOffsetFlag3,
+    autoRefreshCronFlag
   ], "write", (ctx) => tagWriteInput(ctx, false)),
   capability("user-tag", "refresh", "analysis.user_tag.refresh", "Refresh a user tag by exact tag_name.", [
     projectIdFlag,
@@ -5422,11 +5443,12 @@ var sqlTableList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.sql_table.list",
   description: "List server-authoritative SQL table references queryable by the current user in a project.",
-  flags: [projectIdFlag, queryFlag, directoryLimitFlag, directoryOffsetFlag, sqlTableUsageFlag],
+  flags: [projectIdFlag, queriesFlag, directoryLimitFlag, directoryOffsetFlag, sqlTableUsageFlag],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: (ctx) => compactInput({
     project_id: ctx.num("project-id"),
-    query: optionalString(ctx, "query"),
+    queries: optionalQueries(ctx),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
     usage: optionalString(ctx, "usage")
@@ -7674,9 +7696,10 @@ var analysisAlertList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.alert.list",
   description: "List project alerts.",
-  flags: [projectIdFlag, queryFlag, directoryLimitFlag, directoryOffsetFlag],
+  flags: [projectIdFlag, queriesFlag, directoryLimitFlag, directoryOffsetFlag],
   risk: "read",
-  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), query: optionalString(ctx, "query"), limit: optionalNumber(ctx, "limit"), offset: optionalNumber(ctx, "offset") })
+  validate: validateQueriesFlag,
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), queries: optionalQueries(ctx), limit: optionalNumber(ctx, "limit"), offset: optionalNumber(ctx, "offset") })
 });
 
 // src/commands/te-analysis/alert/get.ts

package/dist/{te-community-HNKVTERD.js → te-community-6HPBWJUZ.js}

@@ -1,36 +1,42 @@
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-PTE56QPL.js";
+import {
+  internalCallSourceHeaders
+} from "./chunk-C4MGVGJW.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   getActiveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   CliValidationError,
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/core/mcp.ts
-async function permissionMessage(resp) {
+async function permissionDetails(resp) {
   const text = await resp.text().catch(() => "");
   try {
     const d = safeJsonParse(text);
     const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
-    if (msg && typeof msg === "string") return msg;
+    if (msg && typeof msg === "string") {
+      return {
+        message: msg,
+        code: typeof d.code === "string" ? d.code : typeof d.error?.code === "string" ? d.error.code : void 0,
+        hint: typeof d.hint === "string" ? d.hint : typeof d.error?.hint === "string" ? d.error.hint : void 0
+      };
+    }
   } catch {
   }
-  return "Permission denied for this resource (HTTP 403)";
-}
-function isInvalidCliTokenMessage(message) {
-  return /\b(cli[-_\s]?token|token)\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\b(cli[-_\s]?token|token)\b/i.test(message);
+  return { message: "Permission denied for this resource (HTTP 403)" };
 }
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
@@ -85,6 +91,7 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     "Content-Type": "application/json",
     "Accept": "application/json, text/event-stream",
     "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+    ...internalCallSourceHeaders(),
     ...buildAuthHeaders(token)
   };
   const resp = await fetch(url, {
@@ -93,15 +100,12 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    let permissionMsg;
     if (resp.status === 403) {
-      permissionMsg = await permissionMessage(resp);
-      if (!isInvalidCliTokenMessage(permissionMsg)) {
-        throw new PermissionError(permissionMsg);
-      }
+      const permission = await permissionDetails(resp);
+      throw new PermissionError(permission.message, permission.code, permission.hint);
     }
-    if (resp.status === 401 || resp.status === 403 && permissionMsg) {
-      logger.warn(`MCP request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${hostUrl}, refreshing CLI token`);
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, refreshing CLI token`);
       clearCliToken(hostUrl);
       const newToken = await getCliToken(hostUrl);
       logger.info(`CLI token refreshed for ${hostUrl}`);
@@ -114,7 +118,8 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
         body: JSON.stringify(body)
       });
       if (retryResp.status === 403) {
-        throw new PermissionError(await permissionMessage(retryResp));
+        const permission = await permissionDetails(retryResp);
+        throw new PermissionError(permission.message, permission.code, permission.hint);
       }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);

package/dist/{te-community-IWE5B7W6.js → te-community-HLC43QKH.js}

@@ -1,36 +1,42 @@
 import {
   registerCapabilityGatewayRoute
 } from "./chunk-PTE56QPL.js";
+import {
+  internalCallSourceHeaders
+} from "./chunk-6EIJSNBD.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
-import "./chunk-ZQKDZXDO.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   getActiveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   CliValidationError,
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/core/mcp.ts
-async function permissionMessage(resp) {
+async function permissionDetails(resp) {
   const text = await resp.text().catch(() => "");
   try {
     const d = safeJsonParse(text);
     const msg = d && (d.error?.message || (typeof d.error === "string" ? d.error : void 0) || d.message);
-    if (msg && typeof msg === "string") return msg;
+    if (msg && typeof msg === "string") {
+      return {
+        message: msg,
+        code: typeof d.code === "string" ? d.code : typeof d.error?.code === "string" ? d.error.code : void 0,
+        hint: typeof d.hint === "string" ? d.hint : typeof d.error?.hint === "string" ? d.error.hint : void 0
+      };
+    }
   } catch {
   }
-  return "Permission denied for this resource (HTTP 403)";
-}
-function isInvalidCliTokenMessage(message) {
-  return /\b(cli[-_\s]?token|token)\b.*\binvalid\b/i.test(message) || /\binvalid\b.*\b(cli[-_\s]?token|token)\b/i.test(message);
+  return { message: "Permission denied for this resource (HTTP 403)" };
 }
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var JSONRPC_VERSION = "2.0";
@@ -85,7 +91,7 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     "Content-Type": "application/json",
     "Accept": "application/json, text/event-stream",
     "mcp-protocol-version": MCP_PROTOCOL_VERSION,
-    "X-Source": "ae-cli",
+    ...internalCallSourceHeaders(),
     ...buildAuthHeaders(token)
   };
   const resp = await fetch(url, {
@@ -94,15 +100,12 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
     body: JSON.stringify(body)
   });
   if (!resp.ok) {
-    let permissionMsg;
     if (resp.status === 403) {
-      permissionMsg = await permissionMessage(resp);
-      if (!isInvalidCliTokenMessage(permissionMsg)) {
-        throw new PermissionError(permissionMsg);
-      }
+      const permission = await permissionDetails(resp);
+      throw new PermissionError(permission.message, permission.code, permission.hint);
     }
-    if (resp.status === 401 || resp.status === 403 && permissionMsg) {
-      logger.warn(`MCP request failed (${resp.status === 403 ? permissionMsg : "HTTP 401"}) for ${hostUrl}, refreshing CLI token`);
+    if (resp.status === 401) {
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, refreshing CLI token`);
       clearCliToken(hostUrl);
       const newToken = await getCliToken(hostUrl);
       logger.info(`CLI token refreshed for ${hostUrl}`);
@@ -115,7 +118,8 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
         body: JSON.stringify(body)
       });
       if (retryResp.status === 403) {
-        throw new PermissionError(await permissionMessage(retryResp));
+        const permission = await permissionDetails(retryResp);
+        throw new PermissionError(permission.message, permission.code, permission.hint);
       }
       if (!retryResp.ok) {
         throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);