@thinkingai/ae-cli 6.1.19 → 6.1.20

package/dist/chunk-RWXIXOZG.js

@@ -1,326 +0,0 @@
-import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  SecureStoreAuthError,
-  getToken,
-  load,
-  loadCliToken,
-  save
-} from "./chunk-O6K2ODUE.js";
-import {
-  getActiveHost,
-  getConfigDir,
-  getFallbackCliToken,
-  listHosts,
-  normalizeUrl,
-  safeJsonParse,
-  safeReadJsonFile
-} from "./chunk-KZ6ZHF5J.js";
-import {
-  PermissionError
-} from "./chunk-533JK3YX.js";
-import {
-  logger
-} from "./chunk-FR2EDAQM.js";
-
-// src/core/cli-token.ts
-import fs from "fs";
-import path from "path";
-var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
-var CLI_TOKEN_RENEW_PATH = "/v1/ta/cli/token/renew";
-var CLI_TOKEN_VALIDATE_PATH = "/v1/ta/cli/token/validate";
-var CliTokenValidationUnavailableError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CliTokenValidationUnavailableError";
-  }
-};
-function isExplicitCliTokenRejection(data, responseText) {
-  const code = String(data?.code ?? data?.error?.code ?? "");
-  const message = String(data?.return_message ?? data?.message ?? data?.error?.message ?? responseText);
-  return /cli[_-]?token[_-]?(invalid|expired)/i.test(code) || /cli[-_\s]?token.*\b(invalid|expired)\b/i.test(message) || /\b(invalid|expired)\b.*cli[-_\s]?token/i.test(message);
-}
-var _cliTokenCache = /* @__PURE__ */ new Map();
-var _renewedLocalDateByHost = /* @__PURE__ */ new Map();
-var _renewInFlightByHost = /* @__PURE__ */ new Map();
-function renewHostKey(hostUrl) {
-  return normalizeUrl(hostUrl);
-}
-function renewStateFilePath() {
-  return path.join(getConfigDir(), "cli-token-renew.json");
-}
-function localRenewDate(now = /* @__PURE__ */ new Date()) {
-  const y = now.getFullYear();
-  const m = String(now.getMonth() + 1).padStart(2, "0");
-  const d = String(now.getDate()).padStart(2, "0");
-  return `${y}-${m}-${d}`;
-}
-function loadRenewStore() {
-  try {
-    const file = renewStateFilePath();
-    if (!fs.existsSync(file)) return {};
-    const data = safeReadJsonFile(file);
-    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
-    return data;
-  } catch {
-    return {};
-  }
-}
-function saveRenewStore(store) {
-  const dir = getConfigDir();
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  const file = renewStateFilePath();
-  if (Object.keys(store).length === 0) {
-    try {
-      fs.unlinkSync(file);
-    } catch {
-    }
-    return;
-  }
-  fs.writeFileSync(file, JSON.stringify(store, null, 2), { encoding: "utf8" });
-  try {
-    fs.chmodSync(file, 384);
-  } catch {
-  }
-}
-function getPersistedRenewDate(hostUrl) {
-  const key = renewHostKey(hostUrl);
-  const store = loadRenewStore();
-  return store[key]?.date ?? (key !== hostUrl ? store[hostUrl]?.date : void 0) ?? null;
-}
-function markRenewSucceeded(hostUrl, date) {
-  const key = renewHostKey(hostUrl);
-  _renewedLocalDateByHost.set(key, date);
-  const store = loadRenewStore();
-  if (key !== hostUrl && store[hostUrl]) {
-    delete store[hostUrl];
-  }
-  store[key] = { date };
-  saveRenewStore(store);
-}
-function clearRenewState(hostUrl) {
-  if (hostUrl) {
-    const key = renewHostKey(hostUrl);
-    _renewedLocalDateByHost.delete(key);
-    _renewInFlightByHost.delete(key);
-    if (key !== hostUrl) {
-      _renewedLocalDateByHost.delete(hostUrl);
-      _renewInFlightByHost.delete(hostUrl);
-    }
-    const store = loadRenewStore();
-    let changed = false;
-    for (const k of /* @__PURE__ */ new Set([key, hostUrl])) {
-      if (store[k]) {
-        delete store[k];
-        changed = true;
-      }
-    }
-    if (changed) {
-      saveRenewStore(store);
-    }
-    return;
-  }
-  _renewedLocalDateByHost.clear();
-  _renewInFlightByHost.clear();
-  saveRenewStore({});
-}
-async function generateCliToken(hostUrl, accessTokenOverride) {
-  const accessToken = accessTokenOverride ?? await getToken(hostUrl);
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = `${base}${CLI_TOKEN_GENERATE_PATH}`;
-  const resp = await fetch(url, {
-    method: "GET",
-    headers: {
-      "Authorization": `bearer ${accessToken}`
-    }
-  });
-  if (!resp.ok) {
-    if (resp.status === 403) {
-      const text = await resp.text();
-      let body = {};
-      try {
-        body = text ? safeJsonParse(text) : {};
-      } catch {
-      }
-      const message = body.message ?? body.return_message ?? "CLI access is disabled for this account.";
-      const code = body.code ?? (String(message).includes("CLI_ACCESS_DISABLED") ? "CLI_ACCESS_DISABLED" : void 0);
-      throw new PermissionError(message, code, body.hint);
-    }
-    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
-  }
-  const data = safeJsonParse(await resp.text());
-  if (data.return_code !== 0) {
-    const message = data.return_message || data.message || "unknown";
-    if (data.code === "CLI_ACCESS_DISABLED" || String(message).includes("CLI_ACCESS_DISABLED")) {
-      throw new PermissionError(message, "CLI_ACCESS_DISABLED", data.hint);
-    }
-    throw new Error(`CLI token generate error: ${message} (code: ${data.return_code})`);
-  }
-  const cliToken = data.data?.userSecret;
-  if (!cliToken) {
-    throw new Error("CLI token generate error: empty userSecret in response");
-  }
-  return cliToken;
-}
-async function validateCliTokenOnServer(hostUrl, cliToken) {
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = `${base}${CLI_TOKEN_VALIDATE_PATH}`;
-  let resp;
-  try {
-    resp = await fetch(url, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        "cli-token": cliToken
-      }
-    });
-  } catch (e) {
-    throw new CliTokenValidationUnavailableError(`Unable to validate CLI token for ${hostUrl}: ${e.message}`);
-  }
-  const responseText = await resp.text();
-  let data;
-  try {
-    data = safeJsonParse(responseText);
-  } catch {
-    data = void 0;
-  }
-  if (isExplicitCliTokenRejection(data, responseText)) {
-    throw new SecureStoreAuthError(
-      `CLI token is invalid or expired for ${hostUrl}. Run: ae-cli auth logout --host ${hostUrl}, then ae-cli auth login --host ${hostUrl}`
-    );
-  }
-  if (!resp.ok) {
-    throw new CliTokenValidationUnavailableError(
-      `CLI token validation is unavailable for ${hostUrl} (HTTP ${resp.status} ${resp.statusText})`
-    );
-  }
-  if (data?.return_code !== 0) {
-    throw new CliTokenValidationUnavailableError(`CLI token validation returned an unsupported response for ${hostUrl}`);
-  }
-}
-async function renewCliTokenOnServer(hostUrl, cliToken) {
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = new URL(`${base}${CLI_TOKEN_RENEW_PATH}`);
-  url.searchParams.set("cli-token", cliToken);
-  const headers = {
-    Accept: "application/json"
-  };
-  try {
-    const accessToken = await getToken(hostUrl);
-    if (accessToken) {
-      headers.Authorization = `bearer ${accessToken}`;
-    }
-  } catch {
-  }
-  const resp = await fetch(url.toString(), { method: "GET", headers });
-  const text = await resp.text();
-  const data = safeJsonParse(text);
-  if (!resp.ok) {
-    throw new Error(`CLI token renew HTTP error: ${resp.status} ${resp.statusText}`);
-  }
-  if (data?.return_code !== void 0 && data.return_code !== 0) {
-    throw new Error(`CLI token renew error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
-  }
-}
-async function maybeRenewCliTokenDaily(hostUrl, cliToken) {
-  const hostKey = renewHostKey(hostUrl);
-  const today = localRenewDate();
-  if (_renewedLocalDateByHost.get(hostKey) === today) {
-    return;
-  }
-  if (getPersistedRenewDate(hostUrl) === today) {
-    _renewedLocalDateByHost.set(hostKey, today);
-    return;
-  }
-  const existing = _renewInFlightByHost.get(hostKey);
-  if (existing) {
-    await existing;
-    return;
-  }
-  const attempt = (async () => {
-    try {
-      await renewCliTokenOnServer(hostUrl, cliToken);
-      markRenewSucceeded(hostUrl, today);
-      logger.info(`cli-token: renewed for ${hostKey} (local day ${today})`);
-    } catch (e) {
-      logger.warn(`cli-token: renew failed for ${hostKey}: ${e?.message || e}; business call proceeds with cached token`);
-    } finally {
-      _renewInFlightByHost.delete(hostKey);
-    }
-  })();
-  _renewInFlightByHost.set(hostKey, attempt);
-  await attempt;
-}
-function persistCliTokenIfPossible(hostUrl, cliToken) {
-  const existing = load(hostUrl);
-  if (!existing) {
-    logger.info(`cli-token: no secure-store session for ${hostUrl}, keeping token in-process only`);
-    return;
-  }
-  save(hostUrl, { ...existing, cliToken });
-}
-function clearPersistedCliToken(hostUrl) {
-  const existing = load(hostUrl);
-  if (existing?.cliToken) {
-    save(hostUrl, { ...existing, cliToken: void 0 });
-  }
-}
-function peekCliToken(hostOverride) {
-  const hostUrl = hostOverride || getActiveHost();
-  if (!hostUrl) return void 0;
-  return _cliTokenCache.get(hostUrl) || loadCliToken(hostUrl) || getFallbackCliToken(hostUrl) || void 0;
-}
-async function getCliToken(hostOverride) {
-  const hostUrl = hostOverride || getActiveHost();
-  let token = _cliTokenCache.get(hostUrl);
-  if (!token) {
-    const storedToken = loadCliToken(hostUrl);
-    if (storedToken) {
-      _cliTokenCache.set(hostUrl, storedToken);
-      logger.info(`Using persisted CLI token (secure-store) for ${hostUrl}`);
-      token = storedToken;
-    }
-  }
-  if (!token) {
-    const fallbackToken = getFallbackCliToken(hostUrl);
-    if (fallbackToken) {
-      _cliTokenCache.set(hostUrl, fallbackToken);
-      logger.info(`Using sandbox-provisioned CLI token (fallback file) for ${hostUrl}`);
-      token = fallbackToken;
-    }
-  }
-  if (!token) {
-    token = await mintCliToken(hostUrl);
-  }
-  await maybeRenewCliTokenDaily(hostUrl, token);
-  return token;
-}
-async function mintCliToken(hostUrl, accessTokenOverride, persist = true) {
-  logger.info(`Generating CLI token for ${hostUrl}`);
-  const cliToken = await generateCliToken(hostUrl, accessTokenOverride);
-  _cliTokenCache.set(hostUrl, cliToken);
-  if (persist) persistCliTokenIfPossible(hostUrl, cliToken);
-  logger.info(`CLI token generated and cached${persist ? " and persisted" : ""} for ${hostUrl}`);
-  return cliToken;
-}
-function clearCliToken(hostUrl) {
-  if (hostUrl) {
-    _cliTokenCache.delete(hostUrl);
-    clearPersistedCliToken(hostUrl);
-    clearRenewState(hostUrl);
-    return;
-  }
-  _cliTokenCache.clear();
-  clearRenewState();
-  for (const { url } of listHosts()) {
-    clearPersistedCliToken(url);
-  }
-}
-
-export {
-  CliTokenValidationUnavailableError,
-  validateCliTokenOnServer,
-  peekCliToken,
-  getCliToken,
-  mintCliToken,
-  clearCliToken
-};

package/dist/client-N7NGZUNI.js

@@ -1,204 +0,0 @@
-import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  SecureStoreAuthError,
-  getToken,
-  invalidateAccessTokenForRetry,
-  resolveHost
-} from "./chunk-O6K2ODUE.js";
-import {
-  safeJsonParse
-} from "./chunk-KZ6ZHF5J.js";
-import {
-  logger
-} from "./chunk-FR2EDAQM.js";
-
-// src/core/client.ts
-import WebSocket from "ws";
-import { randomBytes } from "crypto";
-function genRequestId(prefix) {
-  const rand = randomBytes(4).toString("base64url").slice(0, 8);
-  return `${prefix}@@${rand}`;
-}
-function buildUrl(baseUrl, modulePath, params = {}) {
-  const base = baseUrl.replace(/\/$/, "");
-  const p = modulePath.startsWith("/") ? modulePath : `/${modulePath}`;
-  const url = new URL(`${base}${p}`);
-  for (const [k, v] of Object.entries(params)) {
-    if (v !== void 0 && v !== null) url.searchParams.set(k, String(v));
-  }
-  return url.toString();
-}
-function buildWsUrl(baseUrl, token) {
-  const base = baseUrl.replace(/\/$/, "");
-  const wsBase = base.replace(/^https:\/\//, "wss://").replace(/^http:\/\//, "ws://");
-  return `${wsBase}/v1/ta-websocket/query/${token}`;
-}
-async function request(method, modulePath, params = {}, body = null, retry = true, hostUrl) {
-  const resolvedHost = resolveHost(hostUrl);
-  const token = await getToken(resolvedHost);
-  const url = buildUrl(resolvedHost, modulePath, params);
-  const headers = {
-    "Authorization": `bearer ${token}`,
-    "Content-Type": "application/json"
-  };
-  const options = { method, headers };
-  if (body && method !== "GET") options.body = JSON.stringify(body);
-  const resp = await fetch(url, options);
-  const text = await resp.text();
-  const data = safeJsonParse(text);
-  logger.api(method, url, resp.status, body, data);
-  if (resp.status === 401) {
-    if (retry) {
-      invalidateAccessTokenForRetry(resolvedHost);
-      return request(method, modulePath, params, body, false, resolvedHost);
-    }
-    throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
-  }
-  if (resp.status === 403) {
-    const m = data && typeof data === "object" && typeof data.error === "string" ? data.error : "Permission denied";
-    throw new Error(m);
-  }
-  if (data.return_code === -1001 && retry) {
-    invalidateAccessTokenForRetry(resolvedHost);
-    return request(method, modulePath, params, body, false, resolvedHost);
-  }
-  if (data.return_code !== 0 && data.return_code !== void 0) {
-    throw new Error(`AE API error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
-  }
-  return data.data !== void 0 ? data.data : data;
-}
-async function httpGet(modulePath, params = {}, hostUrl) {
-  return request("GET", modulePath, params, null, true, hostUrl);
-}
-async function httpPost(modulePath, params = {}, body, hostUrl) {
-  return request("POST", modulePath, params, body ?? {}, true, hostUrl);
-}
-async function httpRequest(method, modulePath, params = {}, body, hostUrl) {
-  return request(method.toUpperCase(), modulePath, params, body ?? {}, true, hostUrl);
-}
-async function httpDelete(modulePath, params = {}, body, hostUrl) {
-  return request("DELETE", modulePath, params, body ?? null, true, hostUrl);
-}
-async function uploadRequest(modulePath, form, params = {}, retry = true, hostUrl) {
-  const resolvedHost = resolveHost(hostUrl);
-  const token = await getToken(resolvedHost);
-  const url = buildUrl(resolvedHost, modulePath, params);
-  const headers = {
-    "Authorization": `bearer ${token}`
-  };
-  const resp = await fetch(url, { method: "POST", headers, body: form });
-  const text = await resp.text();
-  const data = safeJsonParse(text);
-  logger.api("POST", url, resp.status, { upload: true }, data);
-  if (resp.status === 401) {
-    if (retry) {
-      invalidateAccessTokenForRetry(resolvedHost);
-      return uploadRequest(modulePath, form, params, false, resolvedHost);
-    }
-    throw new SecureStoreAuthError(`Session expired or unauthorized for ${resolvedHost}. Please run: ae-cli auth login`);
-  }
-  if (resp.status === 403) {
-    const m = data && typeof data === "object" && typeof data.error === "string" ? data.error : "Permission denied";
-    throw new Error(m);
-  }
-  if (data.return_code === -1001 && retry) {
-    invalidateAccessTokenForRetry(resolvedHost);
-    return uploadRequest(modulePath, form, params, false, resolvedHost);
-  }
-  if (data.return_code !== 0 && data.return_code !== void 0) {
-    throw new Error(`AE API error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
-  }
-  return data.data !== void 0 ? data.data : data;
-}
-async function httpUpload(modulePath, form, params = {}, hostUrl) {
-  return uploadRequest(modulePath, form, params, true, hostUrl);
-}
-async function wsQueryOnce(projectId, requestId, qp, eventModel, options = {}, token, hostUrl, timeoutMs = 3e4) {
-  const wsUrl = buildWsUrl(hostUrl, token);
-  return new Promise((resolve, reject) => {
-    const ws = new WebSocket(wsUrl);
-    const timer = setTimeout(() => {
-      ws.close();
-      reject(new Error(`WebSocket query timed out after ${timeoutMs}ms`));
-    }, timeoutMs);
-    ws.on("open", () => {
-      const payload = {
-        requestId,
-        projectId,
-        eventModel,
-        qp: typeof qp === "string" ? qp : JSON.stringify(qp),
-        searchSource: options.searchSource || "reportQuery",
-        querySource: options.querySource || "single_report",
-        contentTranslate: options.contentTranslate !== false,
-        ...options.extra || {}
-      };
-      ws.send(JSON.stringify(["data", payload, { channel: "ta" }]));
-    });
-    ws.on("message", (raw) => {
-      try {
-        const msg = safeJsonParse(raw.toString());
-        if (Array.isArray(msg) && msg.length >= 2) {
-          const data = msg[1];
-          if (data.requestId === requestId && data.progress === 100) {
-            clearTimeout(timer);
-            ws.close();
-            resolve(data);
-          }
-        }
-      } catch {
-      }
-    });
-    ws.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-    ws.on("close", () => {
-      clearTimeout(timer);
-    });
-  });
-}
-async function wsQuery(projectId, requestId, qp, eventModel, options = {}, hostUrl) {
-  const resolvedHost = resolveHost(hostUrl);
-  const token = await getToken(resolvedHost);
-  try {
-    return await wsQueryOnce(projectId, requestId, qp, eventModel, options, token, resolvedHost);
-  } catch (err) {
-    const msg = err.message || "";
-    if (msg.includes("401") || msg.includes("403") || msg.includes("auth")) {
-      invalidateAccessTokenForRetry(resolvedHost);
-      const newToken = await getToken(resolvedHost);
-      return wsQueryOnce(projectId, requestId, qp, eventModel, options, newToken, resolvedHost);
-    }
-    throw err;
-  }
-}
-async function querySql(projectId, sql, hostUrl) {
-  const requestId = genRequestId("sqlIde");
-  const qp = {
-    events: { sql },
-    eventView: { sqlViewParams: [] }
-  };
-  return wsQuery(projectId, requestId, qp, 10, {
-    searchSource: "sqlIde",
-    querySource: "sqlIde"
-  }, hostUrl);
-}
-async function queryReportData(projectId, reportId, qp, eventModel, options = {}, hostUrl) {
-  const dashboardId = options.dashboardId || 0;
-  const requestId = genRequestId(`${projectId}_${dashboardId}_${reportId}`);
-  return wsQuery(projectId, requestId, qp, eventModel, {
-    searchSource: options.searchSource || "model_search",
-    querySource: options.querySource || "module",
-    ...options
-  }, hostUrl);
-}
-export {
-  httpDelete,
-  httpGet,
-  httpPost,
-  httpRequest,
-  httpUpload,
-  queryReportData,
-  querySql,
-  wsQuery
-};

package/skills/ae-agent/references/auto-provision-mcp-credentials.md

@@ -1,57 +0,0 @@
-# agent +auto-provision-mcp-credentials (Auto-Provision MCP Credentials)
-
-> **Prerequisite:** Follow the Global AE CLI Rules in [`../SKILL.md`](../SKILL.md).
-
-Domain: **MCP Credentials / write**
-
-## Use Cases
-- Auto-provision per-user credentials for all system-scope MCP servers in one call.
-- Endpoint: `POST /api/sandbox/agent/mcp-credentials/auto-provision`.
-- Uses the current user's access token to mint MCP tokens via the central token-generation endpoint.
-- For `useMcpToken=true` system servers, a shared MCP token is generated and stored; for OAuth system servers, the access token is stored as the credential.
-
-## Mandatory Rules (MUST)
-- `--access-token` is optional; when omitted, the current session token is used automatically (via `ctx.token()`).
-- The access token must be valid — an invalid/expired token causes the MCP token generation to fail (reported via `mcpTokenFailed: true` in the response).
-- This is an ordinary `write` operation and does not require CLI confirmation.
-- This is a bulk operation — it upserts credentials for ALL system MCP servers visible to the current user.
-
-## Command
-```bash
-# Auto-provision using the current session token (recommended)
-ae-cli agent +auto-provision-mcp-credentials
-
-# Explicitly pass an access token
-ae-cli agent +auto-provision-mcp-credentials --access-token "eyJhbGci..."
-
-# Dry-run to inspect the request
-ae-cli agent +auto-provision-mcp-credentials --dry-run
-```
-
-## Parameters
-| Parameter | Required | Description |
-|---|---|---|
-| `--access-token` | No | Access token (defaults to the current session token) |
-
-## Decision Rules
-- If the user wants to set up all system MCP credentials in one step, use this command.
-- Prefer running without `--access-token` — the CLI automatically sources the current session token.
-- The response reports `count` (total system servers processed), `mcpTokenCount` (servers that got a shared MCP token), and `mcpTokenFailed` (whether the MCP token generation failed).
-- If `mcpTokenFailed` is `true`, the MCP token endpoint may be down or the access token invalid — check the access token and retry.
-- For individual credential control, use `+set-mcp-credential` instead.
-
-## Response Shape
-```json
-{
-  "count": 3,
-  "mcpTokenCount": 1,
-  "mcpTokenFailed": false
-}
-```
-
-## Next Steps on Failure
-- `401` / auth expired: run `ae-cli auth login`, then retry.
-- `mcpTokenFailed: true`: the MCP token generation failed — verify the access token is valid and the MCP token endpoint is configured.
-
-## Recommended Chaining
-- `ae-cli auth login` → `+auto-provision-mcp-credentials` → `+list-mcp-credentials` (verify) → `+mcp-token` (get shared token)