@thinkingai/ae-cli 6.1.14 → 6.1.17

package/dist/{chunk-5XUSIK27.js → chunk-ILIU36SU.js}

@@ -1,16 +1,19 @@
+import {
+  internalCallSourceHeaders
+} from "./chunk-6EIJSNBD.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
@@ -137,7 +140,7 @@ async function requestOnce(url, method, token, body, accept = "application/json"
   const headers = {
     "cli-token": token,
     "Accept": accept,
-    "X-Source": "ae-cli"
+    ...internalCallSourceHeaders()
   };
   const init = { method, headers };
   if (body !== void 0 && method !== "GET") {
@@ -152,7 +155,7 @@ async function requestMultipartOnce(url, token, form) {
     headers: {
       "cli-token": token,
       "Accept": "application/json",
-      "X-Source": "ae-cli"
+      ...internalCallSourceHeaders()
     },
     body: form
   });
@@ -168,7 +171,7 @@ async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body,
   if (resp.status === 403) {
     const error = await permissionError(resp);
     permissionMsg = error.message;
-    if (!isInvalidCliTokenMessage(permissionMsg)) {
+    if (options.retryOnInvalidTokenForbidden === false || !isInvalidCliTokenMessage(permissionMsg)) {
       throw error;
     }
   }

package/dist/{chunk-JHENBQ5B.js → chunk-LYVNONC4.js}

@@ -1,35 +1,3 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
 // src/core/logger.ts
 import fs from "fs";
 import path from "path";
@@ -114,8 +82,5 @@ var Logger = class {
 var logger = new Logger();
 
 export {
-  __require,
-  __commonJS,
-  __toESM,
   logger
 };

package/dist/{chunk-JUW4AJXN.js → chunk-P3FGXJTU.js}

@@ -1,16 +1,19 @@
+import {
+  internalCallSourceHeaders
+} from "./chunk-C4MGVGJW.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-S5NTSDBS.js";
+} from "./chunk-4SGZG4XY.js";
 import {
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-LYVNONC4.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
@@ -136,7 +139,8 @@ async function throwCapabilityHttpError(resp) {
 async function requestOnce(url, method, token, body, accept = "application/json") {
   const headers = {
     "cli-token": token,
-    "Accept": accept
+    "Accept": accept,
+    ...internalCallSourceHeaders()
   };
   const init = { method, headers };
   if (body !== void 0 && method !== "GET") {
@@ -150,7 +154,8 @@ async function requestMultipartOnce(url, token, form) {
     method: "POST",
     headers: {
       "cli-token": token,
-      "Accept": "application/json"
+      "Accept": "application/json",
+      ...internalCallSourceHeaders()
     },
     body: form
   });
@@ -166,7 +171,7 @@ async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body,
   if (resp.status === 403) {
     const error = await permissionError(resp);
     permissionMsg = error.message;
-    if (!isInvalidCliTokenMessage(permissionMsg)) {
+    if (options.retryOnInvalidTokenForbidden === false || !isInvalidCliTokenMessage(permissionMsg)) {
       throw error;
     }
   }

package/dist/chunk-QGM4M3NI.js

@@ -0,0 +1,37 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __require,
+  __commonJS,
+  __toESM
+};

package/dist/{chunk-753BUTNZ.js → chunk-RGKJGKT7.js}

@@ -3,12 +3,12 @@ import {
 } from "./chunk-PTE56QPL.js";
 import {
   withOutputMetadata
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   dryRunCapability,
   executeCapabilityWithEnvelope,
   validateCapability
-} from "./chunk-5XUSIK27.js";
+} from "./chunk-P3FGXJTU.js";
 
 // src/core/capability-command.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-UIHQJK5E.js → chunk-SAU3QFIQ.js}

@@ -5,15 +5,15 @@ import {
   readOutputMetadata,
   unwrapOutputData,
   withOutputMetadata
-} from "./chunk-WZRX4KOH.js";
+} from "./chunk-GT46FPXN.js";
 import {
   CapabilityGatewayError,
   fetchCapabilityGateway,
   requestCapabilityGateway
-} from "./chunk-5XUSIK27.js";
+} from "./chunk-P3FGXJTU.js";
 import {
   PermissionError
-} from "./chunk-AXDXJTPC.js";
+} from "./chunk-UW5UN47B.js";
 
 // src/core/analysis-async-artifact.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-VLWOLBGZ.js → chunk-UOUS37JQ.js}

@@ -1,7 +1,17 @@
+import {
+  internalCallSourceHeaders
+} from "./chunk-C4MGVGJW.js";
+import {
+  clearCliToken,
+  getCliToken
+} from "./chunk-4SGZG4XY.js";
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-ZZUOD757.js";
+import {
+  PermissionError
+} from "./chunk-UW5UN47B.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -120,13 +130,40 @@ async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS) {
     return await fetch(url, { ...init, signal: controller.signal });
   } catch (err) {
     if (err?.name === "AbortError") {
-      throw new TeAgentApiError(`Request timed out (${timeoutMs}ms): ${url}`, 0, "TIMEOUT");
+      throw new TeAgentApiError(
+        `Request timed out (${timeoutMs}ms) for ${safeRequestOrigin(url)}`,
+        0,
+        "TIMEOUT"
+      );
     }
-    throw new TeAgentApiError(`Network request failed: ${err?.message ?? err}`, 0, "NETWORK_ERROR");
+    throw networkRequestError(url, err);
   } finally {
     clearTimeout(timer);
   }
 }
+function safeRequestOrigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "the configured service";
+  }
+}
+function networkRequestError(url, error) {
+  const nestedCause = error && typeof error === "object" && "cause" in error ? error.cause : void 0;
+  const root = nestedCause ?? error;
+  const detail = root && typeof root === "object" ? root : {};
+  const code = typeof detail.code === "string" ? detail.code : void 0;
+  const address = typeof detail.address === "string" ? detail.address : typeof detail.hostname === "string" ? detail.hostname : void 0;
+  const port = typeof detail.port === "number" || typeof detail.port === "string" ? String(detail.port) : void 0;
+  const endpoint = address ? `${address}${port ? `:${port}` : ""}` : void 0;
+  const cause = [code, endpoint].filter(Boolean).join(" ");
+  const suffix = cause ? ` (${cause})` : "";
+  return new TeAgentApiError(
+    `Network request failed for ${safeRequestOrigin(url)}${suffix}`,
+    0,
+    "NETWORK_ERROR"
+  );
+}
 function teClaudeBaseFromActiveHost(hostOverride) {
   const override = hostOverride ? void 0 : process.env.TE_CLAUDE_BASE_URL;
   if (override) return override.replace(/\/+$/, "");
@@ -136,24 +173,22 @@ function teClaudeBaseFromActiveHost(hostOverride) {
   const bp = process.env.TE_CLAUDE_BASE_PATH || "/agent";
   return base.endsWith(bp) ? base : base + bp;
 }
-async function signRequest(method, path2, rawBody, hostOverride) {
+async function signRequest(method, path2, hostOverride, includeJsonContentType = true) {
   const sandboxCred = tryLoadTeAgentSandboxCredentials();
   if (!hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
     const headers = {
       "X-Sandbox-Id": sandboxCred.sandboxId,
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
     };
-    if (method === "POST" || method === "PATCH" || method === "PUT") {
+    if (includeJsonContentType && (method === "POST" || method === "PATCH" || method === "PUT")) {
       headers["Content-Type"] = "application/json";
     }
     return {
       url: `${sandboxCred.url.replace(/\/$/, "")}${path2}`,
       headers,
-      rawBody
+      authKind: "sandbox"
     };
   }
-  const { getToken } = await import("./auth-GBMV6TEJ.js");
-  const { getCliToken } = await import("./cli-token-4UPER74P.js");
   const baseUrl = hostOverride ? teClaudeBaseFromActiveHost(hostOverride) : sandboxCred?.url || teClaudeBaseFromActiveHost();
   if (!baseUrl) {
     throw new TeAgentCredentialsError(
@@ -162,43 +197,54 @@ async function signRequest(method, path2, rawBody, hostOverride) {
     );
   }
   const hostForToken = hostOverride || getActiveHost() || baseUrl;
-  const contentTypeHeader = method === "POST" || method === "PATCH" || method === "PUT" ? { "Content-Type": "application/json" } : {};
-  let accessToken = null;
-  try {
-    accessToken = await getToken(hostForToken);
-  } catch {
-    accessToken = null;
-  }
-  if (accessToken) {
-    return {
-      url: `${baseUrl.replace(/\/$/, "")}${path2}`,
-      headers: {
-        "Authorization": `bearer ${accessToken}`,
-        ...contentTypeHeader
-      },
-      rawBody
-    };
-  }
-  let cliToken = null;
-  try {
-    cliToken = await getCliToken(hostForToken);
-  } catch {
-    cliToken = null;
-  }
-  if (cliToken) {
-    return {
-      url: `${baseUrl.replace(/\/$/, "")}${path2}`,
-      headers: {
-        "cli-token": cliToken,
-        ...contentTypeHeader
-      },
-      rawBody
-    };
-  }
-  throw new TeAgentCredentialsError(
-    "No te-claude credentials available",
-    "Run ae-cli auth login, or execute inside a te-agent sandbox"
+  const contentTypeHeader = includeJsonContentType && (method === "POST" || method === "PATCH" || method === "PUT") ? { "Content-Type": "application/json" } : {};
+  const cliToken = await getCliToken(hostForToken);
+  return {
+    url: `${baseUrl.replace(/\/$/, "")}${path2}`,
+    headers: {
+      "cli-token": cliToken,
+      ...internalCallSourceHeaders(),
+      ...contentTypeHeader
+    },
+    authKind: "cli-token",
+    tokenHost: hostForToken
+  };
+}
+async function fetchSignedWithRetry(options) {
+  let signed = await signRequest(
+    options.method,
+    options.path,
+    options.hostOverride,
+    options.includeJsonContentType
+  );
+  const request = (requestToSend) => fetchWithTimeout(
+    requestToSend.url,
+    {
+      method: options.method,
+      headers: requestToSend.headers,
+      body: options.body
+    },
+    options.timeoutMs
   );
+  let response = await request(signed);
+  if (response.status === 401 && signed.authKind === "cli-token" && signed.tokenHost) {
+    clearCliToken(signed.tokenHost);
+    signed = await signRequest(
+      options.method,
+      options.path,
+      options.hostOverride,
+      options.includeJsonContentType
+    );
+    response = await request(signed);
+  }
+  return response;
+}
+function errorDetails(parsed, defaultErrorPrefix, status) {
+  const nested = parsed && typeof parsed === "object" && parsed.error && typeof parsed.error === "object" ? parsed.error : parsed;
+  const message = typeof parsed?.error === "string" ? parsed.error : typeof nested?.message === "string" ? nested.message : typeof parsed?.message === "string" ? parsed.message : typeof parsed?.return_message === "string" ? parsed.return_message : `${defaultErrorPrefix} ${status}`;
+  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : void 0;
+  const hint = typeof nested?.hint === "string" ? nested.hint : typeof parsed?.hint === "string" ? parsed.hint : void 0;
+  return { message, code, hint };
 }
 async function parseResponse(response, defaultErrorPrefix) {
   const text = await response.text();
@@ -211,35 +257,37 @@ async function parseResponse(response, defaultErrorPrefix) {
     }
   }
   if (!response.ok) {
+    const details = errorDetails(parsed, defaultErrorPrefix, response.status);
+    if (response.status === 403) {
+      throw new PermissionError(details.message, details.code, details.hint);
+    }
     if (response.status === 401) {
       throw new TeAgentApiError(
-        `Session expired or unauthorized. Please run: ae-cli auth login`,
+        "Session expired or unauthorized. Please run: ae-cli auth login",
         response.status,
         "auth_expired",
         parsed
       );
     }
-    const message = typeof parsed === "object" && parsed && typeof parsed.error === "string" ? parsed.error : `${defaultErrorPrefix} ${response.status}`;
-    const code = typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : void 0;
-    throw new TeAgentApiError(message, response.status, code, parsed);
+    throw new TeAgentApiError(details.message, response.status, details.code, parsed);
   }
   return parsed;
 }
 async function postToMainApp(path2, body, hostOverride) {
   const rawBody = JSON.stringify(body);
-  const signed = await signRequest("POST", path2, rawBody, hostOverride);
-  const response = await fetchWithTimeout(signed.url, {
+  const response = await fetchSignedWithRetry({
     method: "POST",
-    headers: signed.headers,
-    body: signed.rawBody
+    path: path2,
+    body: rawBody,
+    hostOverride
   });
   return parseResponse(response, "Main app returned");
 }
 async function getFromMainApp(path2, hostOverride) {
-  const signed = await signRequest("GET", path2, "", hostOverride);
-  const response = await fetchWithTimeout(signed.url, {
+  const response = await fetchSignedWithRetry({
     method: "GET",
-    headers: signed.headers
+    path: path2,
+    hostOverride
   });
   return parseResponse(response, "Main app returned");
 }
@@ -270,60 +318,41 @@ async function postSandboxSyncPull(args) {
   });
 }
 async function deleteFromMainApp(path2, hostOverride) {
-  const signed = await signRequest("DELETE", path2, "", hostOverride);
-  const response = await fetchWithTimeout(signed.url, {
+  const response = await fetchSignedWithRetry({
     method: "DELETE",
-    headers: signed.headers
+    path: path2,
+    hostOverride
   });
   return parseResponse(response, "Main app returned");
 }
 async function patchToMainApp(path2, body, hostOverride) {
   const rawBody = JSON.stringify(body);
-  const signed = await signRequest("PATCH", path2, rawBody, hostOverride);
-  const response = await fetchWithTimeout(signed.url, {
+  const response = await fetchSignedWithRetry({
     method: "PATCH",
-    headers: signed.headers,
-    body: signed.rawBody
+    path: path2,
+    body: rawBody,
+    hostOverride
   });
   return parseResponse(response, "Main app returned");
 }
 async function putToMainApp(path2, body, hostOverride) {
   const rawBody = JSON.stringify(body);
-  const signed = await signRequest("PUT", path2, rawBody, hostOverride);
-  const response = await fetchWithTimeout(signed.url, {
+  const response = await fetchSignedWithRetry({
     method: "PUT",
-    headers: signed.headers,
-    body: signed.rawBody
+    path: path2,
+    body: rawBody,
+    hostOverride
   });
   return parseResponse(response, "Main app returned");
 }
 async function getBufferFromMainApp(path2, hostOverride) {
-  const signed = await signRequest("GET", path2, "", hostOverride);
-  const response = await fetchWithTimeout(signed.url, {
+  const response = await fetchSignedWithRetry({
     method: "GET",
-    headers: signed.headers
+    path: path2,
+    hostOverride
   });
   if (!response.ok) {
-    const text = await response.text();
-    let parsed = void 0;
-    if (text) {
-      try {
-        parsed = JSON.parse(text);
-      } catch {
-        parsed = text;
-      }
-    }
-    if (response.status === 401) {
-      throw new TeAgentApiError(
-        "Session expired or unauthorized. Please run: ae-cli auth login",
-        response.status,
-        "auth_expired",
-        parsed
-      );
-    }
-    const message = typeof parsed === "object" && parsed && typeof parsed.error === "string" ? parsed.error : `Main app returned ${response.status}`;
-    const code = typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : void 0;
-    throw new TeAgentApiError(message, response.status, code, parsed);
+    await parseResponse(response, "Main app returned");
   }
   const arrayBuffer = await response.arrayBuffer();
   const buffer = Buffer.from(arrayBuffer);
@@ -381,27 +410,31 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
         "OUTPUT_ERROR"
       );
     }
-    const signed = await signRequest("GET", requestPath, "", hostOverride);
+    let signed = await signRequest("GET", requestPath, hostOverride);
     let response;
-    try {
-      response = await fetch(signed.url, {
-        method: "GET",
-        headers: signed.headers,
-        signal: controller.signal
-      });
-    } catch (error) {
-      if (error?.name === "AbortError") {
-        throw new TeAgentApiError(
-          `Request timed out (${DOWNLOAD_TIMEOUT_MS}ms): ${signed.url}`,
-          0,
-          "TIMEOUT"
-        );
+    const request = async (requestToSend) => {
+      try {
+        return await fetch(requestToSend.url, {
+          method: "GET",
+          headers: requestToSend.headers,
+          signal: controller.signal
+        });
+      } catch (error) {
+        if (error?.name === "AbortError") {
+          throw new TeAgentApiError(
+            `Request timed out (${DOWNLOAD_TIMEOUT_MS}ms) for ${safeRequestOrigin(requestToSend.url)}`,
+            0,
+            "TIMEOUT"
+          );
+        }
+        throw networkRequestError(requestToSend.url, error);
       }
-      throw new TeAgentApiError(
-        `Network request failed: ${error instanceof Error ? error.message : String(error)}`,
-        0,
-        "NETWORK_ERROR"
-      );
+    };
+    response = await request(signed);
+    if (response.status === 401 && signed.authKind === "cli-token" && signed.tokenHost) {
+      clearCliToken(signed.tokenHost);
+      signed = await signRequest("GET", requestPath, hostOverride);
+      response = await request(signed);
     }
     if (!response.ok) {
       await parseResponse(response, "Main app returned");
@@ -445,59 +478,14 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
   }
 }
 async function uploadToMainApp(path2, formData, hostOverride) {
-  const sandboxCred = tryLoadTeAgentSandboxCredentials();
-  let baseUrl;
-  let authHeaders;
-  if (!hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
-    baseUrl = sandboxCred.url.replace(/\/$/, "");
-    authHeaders = {
-      "X-Sandbox-Id": sandboxCred.sandboxId,
-      "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
-    };
-  } else {
-    const { getToken } = await import("./auth-GBMV6TEJ.js");
-    const { getCliToken } = await import("./cli-token-4UPER74P.js");
-    baseUrl = (hostOverride ? teClaudeBaseFromActiveHost(hostOverride) : sandboxCred?.url || teClaudeBaseFromActiveHost())?.replace(/\/$/, "") || "";
-    if (!baseUrl) {
-      throw new TeAgentCredentialsError(
-        "Cannot determine the te-claude service URL",
-        "Run ae-cli config set-host <url> to configure the service URL, or execute inside a te-agent sandbox"
-      );
-    }
-    const hostForToken = hostOverride || getActiveHost() || baseUrl;
-    let accessToken = null;
-    try {
-      accessToken = await getToken(hostForToken);
-    } catch {
-      accessToken = null;
-    }
-    if (accessToken) {
-      authHeaders = { "Authorization": `bearer ${accessToken}` };
-    } else {
-      let cliToken = null;
-      try {
-        cliToken = await getCliToken(hostForToken);
-      } catch {
-        cliToken = null;
-      }
-      if (!cliToken) {
-        throw new TeAgentCredentialsError(
-          "No te-claude credentials available",
-          "Run ae-cli auth login, or execute inside a te-agent sandbox"
-        );
-      }
-      authHeaders = { "cli-token": cliToken };
-    }
-  }
-  const response = await fetchWithTimeout(
-    `${baseUrl}${path2}`,
-    {
-      method: "POST",
-      headers: authHeaders,
-      body: formData
-    },
-    UPLOAD_TIMEOUT_MS
-  );
+  const response = await fetchSignedWithRetry({
+    method: "POST",
+    path: path2,
+    body: formData,
+    hostOverride,
+    includeJsonContentType: false,
+    timeoutMs: UPLOAD_TIMEOUT_MS
+  });
   return parseResponse(response, "Upload failed");
 }