@thinkingai/ae-cli 6.1.18 → 6.1.20

package/dist/{chunk-ZQ47LWTI.js → chunk-QJQZH5GQ.js}

@@ -1,19 +1,17 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   internalCallSourceHeaders
-} from "./chunk-SERWF6G5.js";
+} from "./chunk-Y74WTIKJ.js";
 import {
-  clearCliToken,
+  SecureStoreAuthError,
   getCliToken
-} from "./chunk-J2DEBMRF.js";
+} from "./chunk-ATSM5XAW.js";
 import {
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-WZ6YVQSF.js";
 import {
   PermissionError
-} from "./chunk-UW5UN47B.js";
-import {
-  logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-4P355ZWB.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
@@ -134,7 +132,13 @@ function buildCapabilityHttpError(resp, body) {
 }
 async function throwCapabilityHttpError(resp) {
   const body = parseCapabilityResponse(await resp.text());
-  throw buildCapabilityHttpError(resp, body);
+  const error = buildCapabilityHttpError(resp, body);
+  if (resp.status === 401) {
+    throw new SecureStoreAuthError(
+      `${error.message}. The stored CLI token is invalid or expired; run: ae-cli auth login`
+    );
+  }
+  throw error;
 }
 async function requestOnce(url, method, token, body, accept = "application/json") {
   const headers = {
@@ -166,45 +170,17 @@ async function callGateway(host, domain, pathAfterV1, method, body, queryParams
 async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body, queryParams = {}, options = {}) {
   const url = buildCapabilityGatewayUrl(options.apiBaseUrl ?? host, domain, pathAfterV1, queryParams);
   const token = await getCliToken(host);
-  let resp = await requestOnce(url, method, token, body);
-  let permissionMsg;
+  const resp = await requestOnce(url, method, token, body);
   if (resp.status === 403) {
     const error = await permissionError(resp);
-    permissionMsg = error.message;
-    if (options.retryOnInvalidTokenForbidden === false || !isInvalidCliTokenMessage(permissionMsg)) {
-      throw error;
+    if (options.retryOnInvalidTokenForbidden !== false && isInvalidCliTokenMessage(error.message)) {
+      throw new SecureStoreAuthError(
+        `${error.message} Run: ae-cli auth login`
+      );
     }
+    throw error;
   }
-  if (resp.status === 401) {
-    if (options.retryOnUnauthorized === false) {
-      await throwCapabilityHttpError(resp);
-    }
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestOnce(url, method, newToken, body);
-    if (resp.status === 403) {
-      throw new PermissionError(await permissionMessage(resp));
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
-    }
-  } else if (resp.status === 403 && permissionMsg) {
-    logger.warn(`Capability gateway request failed (${permissionMsg}) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestOnce(url, method, newToken, body);
-    if (resp.status === 403) {
-      throw await permissionError(resp);
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
-    }
-  } else if (!resp.ok) {
+  if (!resp.ok) {
     await throwCapabilityHttpError(resp);
   }
   return parseCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
@@ -212,24 +188,15 @@ async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body,
 async function fetchCapabilityGateway(host, domain, pathAfterV1, method = "GET", body, accept = "application/json") {
   const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
   const token = await getCliToken(host);
-  let resp = await requestOnce(url, method, token, body, accept);
+  const resp = await requestOnce(url, method, token, body, accept);
   if (resp.status === 403) {
-    throw await permissionError(resp);
-  }
-  if (resp.status === 401) {
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestOnce(url, method, newToken, body, accept);
-    if (resp.status === 403) {
-      throw await permissionError(resp);
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
+    const error = await permissionError(resp);
+    if (isInvalidCliTokenMessage(error.message)) {
+      throw new SecureStoreAuthError(`${error.message} Run: ae-cli auth login`);
     }
-  } else if (!resp.ok) {
+    throw error;
+  }
+  if (!resp.ok) {
     await throwCapabilityHttpError(resp);
   }
   return resp;
@@ -242,8 +209,11 @@ async function requestCapabilityGatewayWithEnvelope(host, domain, pathAfterV1, m
   const resp = await fetchCapabilityGateway(host, domain, pathAfterV1, method, body);
   return parseCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
 }
-async function listCapabilities(host, domain, projectId) {
-  return callGateway(host, domain, "capabilities", "GET", void 0, { project_id: projectId });
+async function listCapabilitiesWithEnvelope(host, domain, projectId) {
+  return callGatewayWithEnvelope(host, domain, "capabilities", "GET", void 0, { project_id: projectId });
+}
+async function inspectCapabilityWithEnvelope(host, domain, capabilityId, projectId) {
+  return callGatewayWithEnvelope(host, domain, `capabilities/${capabilityId}`, "GET", void 0, { project_id: projectId });
 }
 async function inspectCapability(host, domain, capabilityId, projectId) {
   return callGateway(
@@ -264,6 +234,12 @@ async function executeCapabilityWithEnvelope(host, domain, capabilityId, input =
 async function dryRunCapability(host, domain, capabilityId, input = {}) {
   return callGateway(host, domain, `capabilities/${capabilityId}/dry-run`, "POST", { input });
 }
+async function dryRunCapabilityWithEnvelope(host, domain, capabilityId, input = {}) {
+  return callGatewayWithEnvelope(host, domain, `capabilities/${capabilityId}/dry-run`, "POST", { input });
+}
+async function validateCapabilityWithEnvelope(host, domain, capabilityId, input = {}) {
+  return callGatewayWithEnvelope(host, domain, `capabilities/${capabilityId}/validate`, "POST", { input });
+}
 async function validateCapability(host, domain, capabilityId, input = {}) {
   return callGateway(host, domain, `capabilities/${capabilityId}/validate`, "POST", { input });
 }
@@ -301,24 +277,15 @@ async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, fil
   form.append("purpose", purpose);
   form.append("file", new Blob([fileBuffer], { type: contentType }), filename);
   const token = await getCliToken(host);
-  let resp = await requestMultipartOnce(url, token, form);
+  const resp = await requestMultipartOnce(url, token, form);
   if (resp.status === 403) {
-    throw await permissionError(resp);
-  }
-  if (resp.status === 401) {
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestMultipartOnce(url, newToken, form);
-    if (resp.status === 403) {
-      throw await permissionError(resp);
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
+    const error = await permissionError(resp);
+    if (isInvalidCliTokenMessage(error.message)) {
+      throw new SecureStoreAuthError(`${error.message} Run: ae-cli auth login`);
     }
-  } else if (!resp.ok) {
+    throw error;
+  }
+  if (!resp.ok) {
     await throwCapabilityHttpError(resp);
   }
   return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
@@ -337,11 +304,14 @@ export {
   fetchCapabilityGateway,
   requestCapabilityGateway,
   requestCapabilityGatewayWithEnvelope,
-  listCapabilities,
+  listCapabilitiesWithEnvelope,
+  inspectCapabilityWithEnvelope,
   inspectCapability,
   executeCapability,
   executeCapabilityWithEnvelope,
   dryRunCapability,
+  dryRunCapabilityWithEnvelope,
+  validateCapabilityWithEnvelope,
   validateCapability,
   uploadInputFile,
   uploadInputFileBytes,

package/dist/{chunk-QZ3AS4KK.js → chunk-RSG4ONOI.js}

@@ -1,19 +1,20 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  CapabilityGatewayError,
+  fetchCapabilityGateway,
+  requestCapabilityGateway
+} from "./chunk-QJQZH5GQ.js";
 import {
   resolveGatewayDomain
-} from "./chunk-3KWQYGYI.js";
+} from "./chunk-TKHSULJT.js";
 import {
   readOutputMetadata,
   unwrapOutputData,
   withOutputMetadata
-} from "./chunk-BYYS3ANB.js";
-import {
-  CapabilityGatewayError,
-  fetchCapabilityGateway,
-  requestCapabilityGateway
-} from "./chunk-OMPRXM3V.js";
+} from "./chunk-CZU3V3DQ.js";
 import {
   PermissionError
-} from "./chunk-UW5UN47B.js";
+} from "./chunk-4P355ZWB.js";
 
 // src/core/analysis-async-artifact.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-4NN5IWVN.js → chunk-T6OSFQZD.js}

@@ -1,3 +1,5 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+
 // src/commands/te-agent/skill-version.ts
 var SKILL_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 var MAX_VERSION_PART = 2147483647;

package/dist/{chunk-Y3LOALAV.js → chunk-TAL6CZH6.js}

@@ -1,14 +1,15 @@
-import {
-  resolveGatewayDomain
-} from "./chunk-3KWQYGYI.js";
-import {
-  withOutputMetadata
-} from "./chunk-BYYS3ANB.js";
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   dryRunCapability,
   executeCapabilityWithEnvelope,
   validateCapability
-} from "./chunk-ZQ47LWTI.js";
+} from "./chunk-QJQZH5GQ.js";
+import {
+  resolveGatewayDomain
+} from "./chunk-TKHSULJT.js";
+import {
+  withOutputMetadata
+} from "./chunk-CZU3V3DQ.js";
 
 // src/core/capability-command.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-3KWQYGYI.js → chunk-TKHSULJT.js}

@@ -1,3 +1,5 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+
 // src/core/capability-routing.ts
 var cliServiceRoutes = /* @__PURE__ */ new Map();
 function envGatewayDomain(cliService) {

package/dist/chunk-VXNMYUXU.js

@@ -0,0 +1,202 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  CapabilityGatewayError
+} from "./chunk-QJQZH5GQ.js";
+import {
+  SecureStoreAuthError,
+  getCliToken
+} from "./chunk-ATSM5XAW.js";
+import {
+  safeJsonParse
+} from "./chunk-WZ6YVQSF.js";
+import {
+  PermissionError
+} from "./chunk-4P355ZWB.js";
+
+// src/core/mcp-access.ts
+function buildUrl(host, path, params = {}) {
+  const base = host.replace(/\/$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  const url = new URL(`${base}${p}`);
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+var KbUnauthorizedError = class extends Error {
+};
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function responseReturnCode(data) {
+  const value = data?.return_code;
+  if (value === void 0 || value === null || value === 0 || value === "0") {
+    return void 0;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return optionalString(value);
+}
+function responseErrorMetadata(data) {
+  const nestedError = data?.error && typeof data.error === "object" ? data.error : void 0;
+  return {
+    code: optionalString(data?.errorCode) ?? optionalString(data?.error_code) ?? optionalString(data?.code) ?? optionalString(nestedError?.code) ?? responseReturnCode(data),
+    hint: optionalString(data?.hint) ?? optionalString(nestedError?.hint)
+  };
+}
+function responseErrorMessage(data) {
+  const nestedError = data?.error && typeof data.error === "object" ? data.error : void 0;
+  return optionalString(typeof data?.error === "string" ? data.error : void 0) ?? optionalString(nestedError?.message) ?? optionalString(data?.message) ?? optionalString(data?.return_message);
+}
+function responseStatus(resp) {
+  const statusText = optionalString(resp.statusText);
+  return statusText ? `${resp.status} ${statusText}` : String(resp.status);
+}
+function malformedResponseError(resp, detail) {
+  if (!resp.ok) {
+    return new Error(`KB API HTTP error: ${responseStatus(resp)} (${detail})`);
+  }
+  return new Error(
+    `KB API protocol error: HTTP ${responseStatus(resp)} (${detail})`
+  );
+}
+var KbHttpError = class extends CapabilityGatewayError {
+  constructor(message, code, status, hint) {
+    super(message, code, status, hint);
+    this.name = "Error";
+  }
+};
+function nonOkResponseError(resp, data, options) {
+  const metadata = responseErrorMetadata(data);
+  const serverMessage = responseErrorMessage(data);
+  const fallbackMessage = `KB API HTTP error: ${responseStatus(resp)}`;
+  const businessCode = options.preserveBusinessErrorCode && typeof data?.error === "string" && metadata.code ? metadata.code : void 0;
+  const message = businessCode ? `${businessCode}: ${serverMessage ?? fallbackMessage}` : serverMessage ?? fallbackMessage;
+  if (options.preserveErrorMetadata !== false && (metadata.code || metadata.hint)) {
+    return new KbHttpError(message, metadata.code, resp.status, metadata.hint);
+  }
+  return new Error(message);
+}
+function parseKbResponse(resp, text, options = {}) {
+  if (resp.status === 403) {
+    let msg = "Permission denied for this resource (HTTP 403)";
+    let metadata = {};
+    try {
+      const d = safeJsonParse(text);
+      const m = d && (typeof d.error === "string" ? d.error : d.error?.message || d.message);
+      if (m && typeof m === "string") msg = m;
+      if (options.preserveErrorMetadata) metadata = responseErrorMetadata(d);
+    } catch {
+    }
+    throw new PermissionError(msg, metadata.code, metadata.hint);
+  }
+  if (resp.status === 401) {
+    throw new KbUnauthorizedError(
+      `KB API token auth failed: HTTP ${resp.status} ${resp.statusText}`
+    );
+  }
+  if (!text.trim()) {
+    throw malformedResponseError(resp, "empty response body");
+  }
+  let data;
+  try {
+    data = safeJsonParse(text);
+  } catch {
+    throw malformedResponseError(resp, "non-JSON response");
+  }
+  if (data?.return_code === -1001) {
+    throw new KbUnauthorizedError(
+      `KB API token auth failed: ${data.return_message || "unauthorized"} (code: ${data.return_code})`
+    );
+  }
+  if (!resp.ok) {
+    throw nonOkResponseError(resp, data, options);
+  }
+  if (data?.return_code !== 0 && data?.return_code !== void 0) {
+    throw new Error(
+      `AE API error: ${data.return_message || "unknown"} (code: ${data.return_code})`
+    );
+  }
+  if (data && typeof data === "object" && typeof data.error === "string" && data.error.trim() && data.return_code === void 0 && data.success === void 0) {
+    if (options.preserveErrorMetadata) {
+      const metadata = responseErrorMetadata(data);
+      throw new CapabilityGatewayError(
+        data.error,
+        metadata.code,
+        resp.status,
+        metadata.hint
+      );
+    }
+    const businessCode = options.preserveBusinessErrorCode && typeof data.code === "string" && data.code.trim() ? data.code.trim() : "";
+    throw new Error(businessCode ? `${businessCode}: ${data.error}` : data.error);
+  }
+  return data?.data !== void 0 ? data.data : data;
+}
+async function fetchWithCliToken(input, init, cliToken, options = {}) {
+  const headers = new Headers(init.headers);
+  headers.set("cli-token", cliToken);
+  const resp = await fetch(input, { ...init, headers });
+  if (options.responseType === "bytes" && resp.ok) {
+    if (resp.headers.get("content-type")?.includes("application/json")) {
+      parseKbResponse(resp, await resp.text(), options);
+      throw new Error("KB raw-file protocol error: unexpected JSON response");
+    }
+    return {
+      bytes: new Uint8Array(await resp.arrayBuffer()),
+      contentType: resp.headers.get("content-type") ?? "application/octet-stream"
+    };
+  }
+  return parseKbResponse(resp, await resp.text(), options);
+}
+async function requestWithCliToken(host, input, init, options) {
+  try {
+    return await fetchWithCliToken(input, init, await getCliToken(host), options);
+  } catch (error) {
+    if (error instanceof KbUnauthorizedError) {
+      throw new SecureStoreAuthError(
+        `The stored CLI token for ${host} is invalid or expired. Run: ae-cli auth login --host ${host}`
+      );
+    }
+    throw error;
+  }
+}
+async function getAuthHeaders(ctx) {
+  const cliToken = await getCliToken(ctx.host());
+  return { "cli-token": cliToken };
+}
+async function kbApi(ctx, method, path, params = {}, body, options = {}) {
+  const host = ctx.host();
+  const upperMethod = method.toUpperCase();
+  return requestWithCliToken(
+    host,
+    buildUrl(host, path, params),
+    {
+      method: upperMethod,
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: upperMethod === "GET" ? void 0 : JSON.stringify(body ?? {})
+    },
+    options
+  );
+}
+async function kbUpload(ctx, path, form, params = {}, options = {}) {
+  const host = ctx.host();
+  const uploadOptions = { preserveErrorMetadata: false, ...options };
+  return requestWithCliToken(
+    host,
+    buildUrl(host, path, params),
+    {
+      method: "POST",
+      body: form
+    },
+    uploadOptions
+  );
+}
+
+export {
+  getAuthHeaders,
+  kbApi,
+  kbUpload
+};

package/dist/{chunk-3FY3RJ26.js → chunk-WZ6YVQSF.js}

@@ -1,6 +1,20 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-4P355ZWB.js";
+
+// src/core/url-utils.ts
+function normalizeUrl(url) {
+  if (!url) return url;
+  if (!url.startsWith("http://") && !url.startsWith("https://")) {
+    url = `https://${url}`;
+  }
+  return url.replace(/\/$/, "");
+}
+
+// src/core/config.ts
+import fs3 from "fs";
+import path from "path";
 
 // src/core/json-utils.ts
 import fs from "fs";
@@ -38,19 +52,6 @@ function safeReadJsonFile(filePath) {
   return safeJsonParse(content);
 }
 
-// src/core/url-utils.ts
-function normalizeUrl(url) {
-  if (!url) return url;
-  if (!url.startsWith("http://") && !url.startsWith("https://")) {
-    url = `https://${url}`;
-  }
-  return url.replace(/\/$/, "");
-}
-
-// src/core/config.ts
-import fs3 from "fs";
-import path from "path";
-
 // src/core/sandbox-runtime.ts
 import { homedir } from "os";
 import { join } from "path";

package/dist/{chunk-6EIJSNBD.js → chunk-Y74WTIKJ.js}

@@ -1,3 +1,5 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+
 // src/core/internal-call-source.ts
 function internalCallSourceHeaders() {
   return {};

package/dist/{community-report-client-C7WDGET3.js → community-report-client-XXWGSBSD.js}

@@ -1,9 +1,8 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
-  CommunityReportError
-} from "./chunk-UW5UN47B.js";
-import {
+  CommunityReportError,
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-4P355ZWB.js";
 
 // src/core/community-report-client.ts
 var DEFAULT_TIMEOUT_MS = 3e4;

package/dist/{config-BMYZX2UE.js → config-EXUGQN5T.js}

@@ -1,16 +1,17 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   MultiselectCancelled,
   promptSingleSelect
-} from "./chunk-TUKQZTMI.js";
-import {
-  printError,
-  printOutput
-} from "./chunk-BYYS3ANB.js";
-import "./chunk-J2DEBMRF.js";
+} from "./chunk-7K24F7T2.js";
 import {
   AE_TRIAL_URL,
   missingAeHostHint
-} from "./chunk-ZQKDZXDO.js";
+} from "./chunk-6ZIQV5GW.js";
+import {
+  printError,
+  printOutput
+} from "./chunk-CZU3V3DQ.js";
+import "./chunk-ATSM5XAW.js";
 import {
   addHost,
   listHosts,
@@ -20,9 +21,8 @@ import {
   resolveHostSelector,
   setActiveHost,
   updateHostLabel
-} from "./chunk-3FY3RJ26.js";
-import "./chunk-UW5UN47B.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-WZ6YVQSF.js";
+import "./chunk-4P355ZWB.js";
 
 // src/commands/config.ts
 import * as readline2 from "readline";