@thinkingai/ae-cli 6.1.14 → 6.1.16

package/dist/{auth-GBMV6TEJ.js → auth-2WTQOP77.js}

@@ -3,9 +3,9 @@ import {
   invalidateAccessTokenForRetry,
   resolveHost,
   validateToken
-} from "./chunk-ZQKDZXDO.js";
-import "./chunk-3FY3RJ26.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-ZZUOD757.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 export {
   getToken,
   invalidateAccessTokenForRetry,

package/dist/{auth-NDSXE54J.js → auth-77BUFLGC.js}

@@ -5,29 +5,33 @@ import {
   printError,
   printOutput,
   runHostCompatCheck
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   clearCliToken,
-  mintCliToken
-} from "./chunk-S5NTSDBS.js";
+  mintCliToken,
+  validateCliTokenOnServer
+} from "./chunk-4SGZG4XY.js";
 import {
+  SecureStoreAuthError,
   clear,
+  getFallbackCliToken,
   load,
+  loadConfig,
   missingAeHostGuidance,
   missingAeHostHint,
-  resolveHost,
-  save
-} from "./chunk-ZQKDZXDO.js";
-import {
-  getFallbackCliToken,
-  loadConfig,
   normalizeUrl,
   removeHost,
+  resolveHost,
+  save,
   saveConfig
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
+import {
+  PermissionError
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -142,6 +146,19 @@ async function pollDeviceToken(host, deviceCode) {
     if (err === "expired_token") return { status: "expired" };
     return { status: "error", message: `Unknown error: ${err ?? "unknown"}` };
   }
+  if (resp.status === 403) {
+    let errorBody = {};
+    try {
+      errorBody = await resp.json();
+    } catch {
+    }
+    return {
+      status: "denied",
+      code: errorBody.code ?? "CLI_ACCESS_DISABLED",
+      message: errorBody.message ?? errorBody.error ?? "CLI access is disabled for this account.",
+      hint: errorBody.hint
+    };
+  }
   const contentType = resp.headers.get("content-type");
   const text = await resp.text().catch(() => "");
   if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
@@ -186,6 +203,9 @@ async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
         `Device code has expired. Please run ae-cli auth login again to restart the authorization flow.`
       );
     }
+    if (result.status === "denied") {
+      throw new PermissionError(result.message, result.code, result.hint);
+    }
     if (result.status === "unsupported") {
       throw new DeviceFlowUnsupportedError();
     }
@@ -239,6 +259,19 @@ function getExplicitAuthHostOverride(program, opts) {
 function resolveAuthHost(program, opts) {
   return resolveHost(getExplicitAuthHostOverride(program, opts));
 }
+async function validateExistingCliToken(host, cliToken) {
+  try {
+    await validateCliTokenOnServer(host, cliToken);
+    return true;
+  } catch (error) {
+    if (!(error instanceof SecureStoreAuthError)) {
+      throw error;
+    }
+    printError("auth", error.message);
+    process.exitCode = 1;
+    return false;
+  }
+}
 function activateHostAfterLogin(host, explicitHostOverride) {
   if (!explicitHostOverride) return;
   const normalized = normalizeUrl(host);
@@ -259,12 +292,13 @@ async function persistDeviceTokens(host, tokens) {
     expiresInSeconds = DEFAULT_EXPIRES_IN;
   }
   const expiresAt = new Date(Date.now() + expiresInSeconds * 1e3).toISOString();
+  const cliToken = await mintCliToken(host, tokens.access_token, false);
   save(host, {
     accessToken: tokens.access_token,
     refreshToken: tokens.refresh_token ?? "",
-    accessExpiresAt: expiresAt
+    accessExpiresAt: expiresAt,
+    cliToken
   });
-  await mintCliToken(host);
   await runHostCompatCheck(getLocalCliPackageInfo(), host);
 }
 function loginSummary(host, tokens) {
@@ -344,6 +378,10 @@ function registerAuth(program) {
         );
         process.exit(1);
       }
+      if (err instanceof PermissionError) {
+        printError("permission", err.message, err.hint, err.code);
+        process.exit(1);
+      }
       printError("auth", err.message);
       process.exit(1);
     }
@@ -364,6 +402,9 @@ function registerAuth(program) {
     }
     const secureEntry = load(host);
     if (secureEntry) {
+      if (secureEntry.cliToken && !await validateExistingCliToken(host, secureEntry.cliToken)) {
+        return;
+      }
       const pastStaticExpiry = new Date(secureEntry.accessExpiresAt).getTime() < Date.now();
       await printOutput(
         {
@@ -381,6 +422,9 @@ function registerAuth(program) {
     }
     const fallbackCliToken = getFallbackCliToken(host);
     if (fallbackCliToken) {
+      if (!await validateExistingCliToken(host, fallbackCliToken)) {
+        return;
+      }
       await printOutput(
         {
           authenticated: true,

package/dist/{capability-TAMDRZYV.js → capability-72DTW5M2.js}

@@ -9,7 +9,7 @@ import {
 import {
   printError,
   printOutput
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   CapabilityGatewayError,
   dryRunCapability,
@@ -17,19 +17,19 @@ import {
   inspectCapability,
   listCapabilities,
   validateCapability
-} from "./chunk-JUW4AJXN.js";
-import "./chunk-S5NTSDBS.js";
+} from "./chunk-P3FGXJTU.js";
+import "./chunk-C4MGVGJW.js";
+import "./chunk-4SGZG4XY.js";
 import {
   SecureStoreAuthError,
-  resolveHost
-} from "./chunk-ZQKDZXDO.js";
-import {
+  resolveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/commands/capability/index.ts
 import * as readline from "readline";

package/dist/{capability-U7TDEEEG.js → capability-PJHNI4GJ.js}

@@ -9,7 +9,7 @@ import {
 import {
   printError,
   printOutput
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   CapabilityGatewayError,
   dryRunCapability,
@@ -17,19 +17,19 @@ import {
   inspectCapability,
   listCapabilities,
   validateCapability
-} from "./chunk-5XUSIK27.js";
-import "./chunk-S5NTSDBS.js";
+} from "./chunk-ILIU36SU.js";
+import "./chunk-6EIJSNBD.js";
+import "./chunk-4SGZG4XY.js";
 import {
   SecureStoreAuthError,
-  resolveHost
-} from "./chunk-ZQKDZXDO.js";
-import {
+  resolveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-UW5UN47B.js";
+import "./chunk-LYVNONC4.js";
+import "./chunk-QGM4M3NI.js";
 
 // src/commands/capability/index.ts
 import * as readline from "readline";

package/dist/{chunk-AFXA7BRK.js → chunk-4KVPKXFX.js}

@@ -1,12 +1,12 @@
 import {
   getCliToken
-} from "./chunk-S5NTSDBS.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {
@@ -33,13 +33,13 @@ function parseKbResponse(resp, text) {
   }
   if (resp.status === 401) {
     throw new Error(
-      `KB MCP token auth failed: HTTP ${resp.status} ${resp.statusText}`
+      `KB API token auth failed: HTTP ${resp.status} ${resp.statusText}`
     );
   }
   const data = safeJsonParse(text);
   if (data.return_code === -1001) {
     throw new Error(
-      `KB MCP token auth failed: ${data.return_message || "unauthorized"} (code: ${data.return_code})`
+      `KB API token auth failed: ${data.return_message || "unauthorized"} (code: ${data.return_code})`
     );
   }
   if (data.return_code !== 0 && data.return_code !== void 0) {

package/dist/chunk-4SGZG4XY.js

@@ -0,0 +1,311 @@
+import {
+  SecureStoreAuthError,
+  getActiveHost,
+  getConfigDir,
+  getFallbackCliToken,
+  getToken,
+  listHosts,
+  load,
+  loadCliToken,
+  normalizeUrl,
+  safeJsonParse,
+  safeReadJsonFile,
+  save
+} from "./chunk-ZZUOD757.js";
+import {
+  PermissionError
+} from "./chunk-UW5UN47B.js";
+import {
+  logger
+} from "./chunk-LYVNONC4.js";
+
+// src/core/cli-token.ts
+import fs from "fs";
+import path from "path";
+var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
+var CLI_TOKEN_RENEW_PATH = "/v1/ta/cli/token/renew";
+var CLI_TOKEN_VALIDATE_PATH = "/v1/ta/cli/token/validate";
+var _cliTokenCache = /* @__PURE__ */ new Map();
+var _renewedLocalDateByHost = /* @__PURE__ */ new Map();
+var _renewInFlightByHost = /* @__PURE__ */ new Map();
+function renewHostKey(hostUrl) {
+  return normalizeUrl(hostUrl);
+}
+function renewStateFilePath() {
+  return path.join(getConfigDir(), "cli-token-renew.json");
+}
+function localRenewDate(now = /* @__PURE__ */ new Date()) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, "0");
+  const d = String(now.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+function loadRenewStore() {
+  try {
+    const file = renewStateFilePath();
+    if (!fs.existsSync(file)) return {};
+    const data = safeReadJsonFile(file);
+    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
+    return data;
+  } catch {
+    return {};
+  }
+}
+function saveRenewStore(store) {
+  const dir = getConfigDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const file = renewStateFilePath();
+  if (Object.keys(store).length === 0) {
+    try {
+      fs.unlinkSync(file);
+    } catch {
+    }
+    return;
+  }
+  fs.writeFileSync(file, JSON.stringify(store, null, 2), { encoding: "utf8" });
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function getPersistedRenewDate(hostUrl) {
+  const key = renewHostKey(hostUrl);
+  const store = loadRenewStore();
+  return store[key]?.date ?? (key !== hostUrl ? store[hostUrl]?.date : void 0) ?? null;
+}
+function markRenewSucceeded(hostUrl, date) {
+  const key = renewHostKey(hostUrl);
+  _renewedLocalDateByHost.set(key, date);
+  const store = loadRenewStore();
+  if (key !== hostUrl && store[hostUrl]) {
+    delete store[hostUrl];
+  }
+  store[key] = { date };
+  saveRenewStore(store);
+}
+function clearRenewState(hostUrl) {
+  if (hostUrl) {
+    const key = renewHostKey(hostUrl);
+    _renewedLocalDateByHost.delete(key);
+    _renewInFlightByHost.delete(key);
+    if (key !== hostUrl) {
+      _renewedLocalDateByHost.delete(hostUrl);
+      _renewInFlightByHost.delete(hostUrl);
+    }
+    const store = loadRenewStore();
+    let changed = false;
+    for (const k of /* @__PURE__ */ new Set([key, hostUrl])) {
+      if (store[k]) {
+        delete store[k];
+        changed = true;
+      }
+    }
+    if (changed) {
+      saveRenewStore(store);
+    }
+    return;
+  }
+  _renewedLocalDateByHost.clear();
+  _renewInFlightByHost.clear();
+  saveRenewStore({});
+}
+async function generateCliToken(hostUrl, accessTokenOverride) {
+  const accessToken = accessTokenOverride ?? await getToken(hostUrl);
+  const base = hostUrl.replace(/\/+$/, "");
+  const url = `${base}${CLI_TOKEN_GENERATE_PATH}`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Authorization": `bearer ${accessToken}`
+    }
+  });
+  if (!resp.ok) {
+    if (resp.status === 403) {
+      const text = await resp.text();
+      let body = {};
+      try {
+        body = text ? safeJsonParse(text) : {};
+      } catch {
+      }
+      const message = body.message ?? body.return_message ?? "CLI access is disabled for this account.";
+      const code = body.code ?? (String(message).includes("CLI_ACCESS_DISABLED") ? "CLI_ACCESS_DISABLED" : void 0);
+      throw new PermissionError(message, code, body.hint);
+    }
+    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  const data = safeJsonParse(await resp.text());
+  if (data.return_code !== 0) {
+    const message = data.return_message || data.message || "unknown";
+    if (data.code === "CLI_ACCESS_DISABLED" || String(message).includes("CLI_ACCESS_DISABLED")) {
+      throw new PermissionError(message, "CLI_ACCESS_DISABLED", data.hint);
+    }
+    throw new Error(`CLI token generate error: ${message} (code: ${data.return_code})`);
+  }
+  const cliToken = data.data?.userSecret;
+  if (!cliToken) {
+    throw new Error("CLI token generate error: empty userSecret in response");
+  }
+  return cliToken;
+}
+async function validateCliTokenOnServer(hostUrl, cliToken) {
+  const base = hostUrl.replace(/\/+$/, "");
+  const url = `${base}${CLI_TOKEN_VALIDATE_PATH}`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        "cli-token": cliToken
+      }
+    });
+  } catch (e) {
+    throw new SecureStoreAuthError(`Unable to validate CLI token for ${hostUrl}: ${e.message}`);
+  }
+  const responseText = await resp.text();
+  let data;
+  try {
+    data = safeJsonParse(responseText);
+  } catch {
+    data = void 0;
+  }
+  if (resp.status === 401 || resp.status === 403 || data?.return_code !== void 0 && data.return_code !== 0) {
+    throw new SecureStoreAuthError(
+      `CLI token is invalid or expired for ${hostUrl}. Run: ae-cli auth logout --host ${hostUrl}, then ae-cli auth login --host ${hostUrl}`
+    );
+  }
+  if (!resp.ok) {
+    throw new SecureStoreAuthError(
+      `CLI token validation failed for ${hostUrl} (HTTP ${resp.status} ${resp.statusText})`
+    );
+  }
+  if (data?.return_code !== 0) {
+    throw new SecureStoreAuthError(`CLI token validation returned an invalid response for ${hostUrl}`);
+  }
+}
+async function renewCliTokenOnServer(hostUrl, cliToken) {
+  const base = hostUrl.replace(/\/+$/, "");
+  const url = new URL(`${base}${CLI_TOKEN_RENEW_PATH}`);
+  url.searchParams.set("cli-token", cliToken);
+  const headers = {
+    Accept: "application/json"
+  };
+  try {
+    const accessToken = await getToken(hostUrl);
+    if (accessToken) {
+      headers.Authorization = `bearer ${accessToken}`;
+    }
+  } catch {
+  }
+  const resp = await fetch(url.toString(), { method: "GET", headers });
+  const text = await resp.text();
+  const data = safeJsonParse(text);
+  if (!resp.ok) {
+    throw new Error(`CLI token renew HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  if (data?.return_code !== void 0 && data.return_code !== 0) {
+    throw new Error(`CLI token renew error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
+  }
+}
+async function maybeRenewCliTokenDaily(hostUrl, cliToken) {
+  const hostKey = renewHostKey(hostUrl);
+  const today = localRenewDate();
+  if (_renewedLocalDateByHost.get(hostKey) === today) {
+    return;
+  }
+  if (getPersistedRenewDate(hostUrl) === today) {
+    _renewedLocalDateByHost.set(hostKey, today);
+    return;
+  }
+  const existing = _renewInFlightByHost.get(hostKey);
+  if (existing) {
+    await existing;
+    return;
+  }
+  const attempt = (async () => {
+    try {
+      await renewCliTokenOnServer(hostUrl, cliToken);
+      markRenewSucceeded(hostUrl, today);
+      logger.info(`cli-token: renewed for ${hostKey} (local day ${today})`);
+    } catch (e) {
+      logger.warn(`cli-token: renew failed for ${hostKey}: ${e?.message || e}; business call proceeds with cached token`);
+    } finally {
+      _renewInFlightByHost.delete(hostKey);
+    }
+  })();
+  _renewInFlightByHost.set(hostKey, attempt);
+  await attempt;
+}
+function persistCliTokenIfPossible(hostUrl, cliToken) {
+  const existing = load(hostUrl);
+  if (!existing) {
+    logger.info(`cli-token: no secure-store session for ${hostUrl}, keeping token in-process only`);
+    return;
+  }
+  save(hostUrl, { ...existing, cliToken });
+}
+function clearPersistedCliToken(hostUrl) {
+  const existing = load(hostUrl);
+  if (existing?.cliToken) {
+    save(hostUrl, { ...existing, cliToken: void 0 });
+  }
+}
+function peekCliToken(hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  if (!hostUrl) return void 0;
+  return _cliTokenCache.get(hostUrl) || loadCliToken(hostUrl) || getFallbackCliToken(hostUrl) || void 0;
+}
+async function getCliToken(hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  let token = _cliTokenCache.get(hostUrl);
+  if (!token) {
+    const storedToken = loadCliToken(hostUrl);
+    if (storedToken) {
+      _cliTokenCache.set(hostUrl, storedToken);
+      logger.info(`Using persisted CLI token (secure-store) for ${hostUrl}`);
+      token = storedToken;
+    }
+  }
+  if (!token) {
+    const fallbackToken = getFallbackCliToken(hostUrl);
+    if (fallbackToken) {
+      _cliTokenCache.set(hostUrl, fallbackToken);
+      logger.info(`Using sandbox-provisioned CLI token (fallback file) for ${hostUrl}`);
+      token = fallbackToken;
+    }
+  }
+  if (!token) {
+    token = await mintCliToken(hostUrl);
+  }
+  await maybeRenewCliTokenDaily(hostUrl, token);
+  return token;
+}
+async function mintCliToken(hostUrl, accessTokenOverride, persist = true) {
+  logger.info(`Generating CLI token for ${hostUrl}`);
+  const cliToken = await generateCliToken(hostUrl, accessTokenOverride);
+  _cliTokenCache.set(hostUrl, cliToken);
+  if (persist) persistCliTokenIfPossible(hostUrl, cliToken);
+  logger.info(`CLI token generated and cached${persist ? " and persisted" : ""} for ${hostUrl}`);
+  return cliToken;
+}
+function clearCliToken(hostUrl) {
+  if (hostUrl) {
+    _cliTokenCache.delete(hostUrl);
+    clearPersistedCliToken(hostUrl);
+    clearRenewState(hostUrl);
+    return;
+  }
+  _cliTokenCache.clear();
+  clearRenewState();
+  for (const { url } of listHosts()) {
+    clearPersistedCliToken(url);
+  }
+}
+
+export {
+  validateCliTokenOnServer,
+  peekCliToken,
+  getCliToken,
+  mintCliToken,
+  clearCliToken
+};

package/dist/chunk-6EIJSNBD.js

@@ -0,0 +1,8 @@
+// src/core/internal-call-source.ts
+function internalCallSourceHeaders() {
+  return {};
+}
+
+export {
+  internalCallSourceHeaders
+};

package/dist/chunk-C4MGVGJW.js

@@ -0,0 +1,13 @@
+import {
+  isAeSandboxRuntime
+} from "./chunk-ZZUOD757.js";
+
+// src/core/internal-call-source.ts
+function internalCallSourceHeaders() {
+  const source = isAeSandboxRuntime() ? "te-agent" : "ae-cli";
+  return { "X-Source": source };
+}
+
+export {
+  internalCallSourceHeaders
+};

package/dist/{chunk-WZRX4KOH.js → chunk-GT46FPXN.js}

@@ -1,18 +1,16 @@
 import {
   peekCliToken
-} from "./chunk-S5NTSDBS.js";
-import {
-  getToken
-} from "./chunk-ZQKDZXDO.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   getActiveHost,
   getConfigDir,
+  getToken,
   isAeSandboxRuntime,
   normalizeUrl
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
 
 // src/core/version-sync.ts
 import { spawnSync } from "child_process";

package/dist/{chunk-5XUSIK27.js → chunk-ILIU36SU.js}

@@ -1,16 +1,19 @@
+import {
+  internalCallSourceHeaders
+} from "./chunk-6EIJSNBD.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
@@ -137,7 +140,7 @@ async function requestOnce(url, method, token, body, accept = "application/json"
   const headers = {
     "cli-token": token,
     "Accept": accept,
-    "X-Source": "ae-cli"
+    ...internalCallSourceHeaders()
   };
   const init = { method, headers };
   if (body !== void 0 && method !== "GET") {
@@ -152,7 +155,7 @@ async function requestMultipartOnce(url, token, form) {
     headers: {
       "cli-token": token,
       "Accept": "application/json",
-      "X-Source": "ae-cli"
+      ...internalCallSourceHeaders()
     },
     body: form
   });
@@ -168,7 +171,7 @@ async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body,
   if (resp.status === 403) {
     const error = await permissionError(resp);
     permissionMsg = error.message;
-    if (!isInvalidCliTokenMessage(permissionMsg)) {
+    if (options.retryOnInvalidTokenForbidden === false || !isInvalidCliTokenMessage(permissionMsg)) {
       throw error;
     }
   }