@thinkingai/ae-cli 6.1.19 → 6.1.21

package/dist/{chunk-6QK7SYYY.js → chunk-HBGADCKA.js}

@@ -3,16 +3,15 @@ import {
   internalCallSourceHeaders
 } from "./chunk-Y74WTIKJ.js";
 import {
-  clearCliToken,
   getCliToken
-} from "./chunk-RWXIXOZG.js";
+} from "./chunk-7XGFSUOM.js";
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-KZ6ZHF5J.js";
+} from "./chunk-7FTTULED.js";
 import {
   PermissionError
-} from "./chunk-533JK3YX.js";
+} from "./chunk-MAPZ7VB6.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -109,6 +108,17 @@ import { open, unlink } from "fs/promises";
 import path from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
+
+// src/core/te-claude-base-url.ts
+function resolveTeClaudeBaseUrl(host) {
+  const base = host.replace(/\/+$/, "");
+  const configured = (process.env.TE_CLAUDE_BASE_PATH ?? process.env.AE_API_PREFIX ?? "/agent").trim();
+  const path2 = configured.replace(/^\/+|\/+$/g, "");
+  const basePath = path2 ? `/${path2}` : "";
+  return basePath && !base.endsWith(basePath) ? `${base}${basePath}` : base;
+}
+
+// src/core/te-agent-client.ts
 var TeAgentApiError = class extends Error {
   constructor(message, status, code, body) {
     super(message);
@@ -170,9 +180,7 @@ function teClaudeBaseFromActiveHost(hostOverride) {
   if (override) return override.replace(/\/+$/, "");
   const h = hostOverride || getActiveHost();
   if (!h) return void 0;
-  const base = h.replace(/\/+$/, "");
-  const bp = process.env.TE_CLAUDE_BASE_PATH || "/agent";
-  return base.endsWith(bp) ? base : base + bp;
+  return resolveTeClaudeBaseUrl(h);
 }
 async function signRequest(method, path2, hostOverride, includeJsonContentType = true) {
   const sandboxCred = tryLoadTeAgentSandboxCredentials();
@@ -211,34 +219,22 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
     tokenHost: hostForToken
   };
 }
-async function fetchSignedWithRetry(options) {
-  let signed = await signRequest(
+async function fetchSigned(options) {
+  const signed = await signRequest(
     options.method,
     options.path,
     options.hostOverride,
     options.includeJsonContentType
   );
-  const request = (requestToSend) => fetchWithTimeout(
-    requestToSend.url,
+  return fetchWithTimeout(
+    signed.url,
     {
       method: options.method,
-      headers: requestToSend.headers,
+      headers: signed.headers,
       body: options.body
     },
     options.timeoutMs
   );
-  let response = await request(signed);
-  if (response.status === 401 && signed.authKind === "cli-token" && signed.tokenHost) {
-    clearCliToken(signed.tokenHost);
-    signed = await signRequest(
-      options.method,
-      options.path,
-      options.hostOverride,
-      options.includeJsonContentType
-    );
-    response = await request(signed);
-  }
-  return response;
 }
 function errorDetails(parsed, defaultErrorPrefix, status) {
   const nested = parsed && typeof parsed === "object" && parsed.error && typeof parsed.error === "object" ? parsed.error : parsed;
@@ -276,7 +272,7 @@ async function parseResponse(response, defaultErrorPrefix) {
 }
 async function postToMainApp(path2, body, hostOverride) {
   const rawBody = JSON.stringify(body);
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "POST",
     path: path2,
     body: rawBody,
@@ -285,7 +281,7 @@ async function postToMainApp(path2, body, hostOverride) {
   return parseResponse(response, "Main app returned");
 }
 async function getFromMainApp(path2, hostOverride) {
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "GET",
     path: path2,
     hostOverride
@@ -319,7 +315,7 @@ async function postSandboxSyncPull(args) {
   });
 }
 async function deleteFromMainApp(path2, hostOverride) {
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "DELETE",
     path: path2,
     hostOverride
@@ -328,7 +324,7 @@ async function deleteFromMainApp(path2, hostOverride) {
 }
 async function patchToMainApp(path2, body, hostOverride) {
   const rawBody = JSON.stringify(body);
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "PATCH",
     path: path2,
     body: rawBody,
@@ -338,7 +334,7 @@ async function patchToMainApp(path2, body, hostOverride) {
 }
 async function putToMainApp(path2, body, hostOverride) {
   const rawBody = JSON.stringify(body);
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "PUT",
     path: path2,
     body: rawBody,
@@ -347,7 +343,7 @@ async function putToMainApp(path2, body, hostOverride) {
   return parseResponse(response, "Main app returned");
 }
 async function getBufferFromMainApp(path2, hostOverride) {
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "GET",
     path: path2,
     hostOverride
@@ -411,7 +407,7 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
         "OUTPUT_ERROR"
       );
     }
-    let signed = await signRequest("GET", requestPath, hostOverride);
+    const signed = await signRequest("GET", requestPath, hostOverride);
     let response;
     const request = async (requestToSend) => {
       try {
@@ -432,11 +428,6 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
       }
     };
     response = await request(signed);
-    if (response.status === 401 && signed.authKind === "cli-token" && signed.tokenHost) {
-      clearCliToken(signed.tokenHost);
-      signed = await signRequest("GET", requestPath, hostOverride);
-      response = await request(signed);
-    }
     if (!response.ok) {
       await parseResponse(response, "Main app returned");
     }
@@ -479,7 +470,7 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
   }
 }
 async function uploadToMainApp(path2, formData, hostOverride) {
-  const response = await fetchSignedWithRetry({
+  const response = await fetchSigned({
     method: "POST",
     path: path2,
     body: formData,
@@ -494,6 +485,7 @@ export {
   TeAgentCredentialsError,
   tryLoadTeAgentSandboxCredentials,
   getClaudeConfigDir,
+  resolveTeClaudeBaseUrl,
   TeAgentApiError,
   postToMainApp,
   getFromMainApp,

package/dist/{chunk-GJXRF7Y6.js → chunk-HFGZGYCG.js}

@@ -3,35 +3,34 @@ import {
   internalCallSourceHeaders
 } from "./chunk-Y74WTIKJ.js";
 import {
-  clearCliToken,
+  SecureStoreAuthError,
   getCliToken
-} from "./chunk-RWXIXOZG.js";
+} from "./chunk-7XGFSUOM.js";
 import {
   safeJsonParse
-} from "./chunk-KZ6ZHF5J.js";
+} from "./chunk-7FTTULED.js";
 import {
   PermissionError
-} from "./chunk-533JK3YX.js";
-import {
-  logger
-} from "./chunk-FR2EDAQM.js";
+} from "./chunk-MAPZ7VB6.js";
 
 // src/core/capability-api.ts
 import { readFile } from "fs/promises";
 import { basename } from "path";
 var CapabilityGatewayError = class extends Error {
-  constructor(message, code, httpStatus, hint, meta) {
+  constructor(message, code, httpStatus, hint, meta, type = "api") {
     super(message);
     this.code = code;
     this.httpStatus = httpStatus;
     this.hint = hint;
     this.meta = meta;
+    this.type = type;
     this.name = "CapabilityGatewayError";
   }
   code;
   httpStatus;
   hint;
   meta;
+  type;
 };
 function buildCapabilityGatewayUrl(host, domain, pathAfterV1, queryParams = {}) {
   const base = host.replace(/\/+$/, "");
@@ -96,7 +95,8 @@ function parseCapabilityEnvelope(body) {
       code,
       err.http_status ?? err.httpStatus,
       hint,
-      isRecord(body.meta) ? body.meta : void 0
+      isRecord(body.meta) ? body.meta : void 0,
+      err.type === "validation" ? "validation" : "api"
     );
   }
   return { ok: true, data: body };
@@ -124,7 +124,8 @@ function buildCapabilityHttpError(resp, body) {
         code,
         resp.status,
         hint,
-        isRecord(body.meta) ? body.meta : void 0
+        isRecord(body.meta) ? body.meta : void 0,
+        err.type === "validation" ? "validation" : "api"
       );
     }
   }
@@ -135,7 +136,13 @@ function buildCapabilityHttpError(resp, body) {
 }
 async function throwCapabilityHttpError(resp) {
   const body = parseCapabilityResponse(await resp.text());
-  throw buildCapabilityHttpError(resp, body);
+  const error = buildCapabilityHttpError(resp, body);
+  if (resp.status === 401) {
+    throw new SecureStoreAuthError(
+      `${error.message}. The stored CLI token is invalid or expired; run: ae-cli auth login`
+    );
+  }
+  throw error;
 }
 async function requestOnce(url, method, token, body, accept = "application/json") {
   const headers = {
@@ -167,45 +174,17 @@ async function callGateway(host, domain, pathAfterV1, method, body, queryParams
 async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body, queryParams = {}, options = {}) {
   const url = buildCapabilityGatewayUrl(options.apiBaseUrl ?? host, domain, pathAfterV1, queryParams);
   const token = await getCliToken(host);
-  let resp = await requestOnce(url, method, token, body);
-  let permissionMsg;
+  const resp = await requestOnce(url, method, token, body);
   if (resp.status === 403) {
     const error = await permissionError(resp);
-    permissionMsg = error.message;
-    if (options.retryOnInvalidTokenForbidden === false || !isInvalidCliTokenMessage(permissionMsg)) {
-      throw error;
+    if (options.retryOnInvalidTokenForbidden !== false && isInvalidCliTokenMessage(error.message)) {
+      throw new SecureStoreAuthError(
+        `${error.message} Run: ae-cli auth login`
+      );
     }
+    throw error;
   }
-  if (resp.status === 401) {
-    if (options.retryOnUnauthorized === false) {
-      await throwCapabilityHttpError(resp);
-    }
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestOnce(url, method, newToken, body);
-    if (resp.status === 403) {
-      throw new PermissionError(await permissionMessage(resp));
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
-    }
-  } else if (resp.status === 403 && permissionMsg) {
-    logger.warn(`Capability gateway request failed (${permissionMsg}) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestOnce(url, method, newToken, body);
-    if (resp.status === 403) {
-      throw await permissionError(resp);
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
-    }
-  } else if (!resp.ok) {
+  if (!resp.ok) {
     await throwCapabilityHttpError(resp);
   }
   return parseCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
@@ -213,24 +192,15 @@ async function callGatewayWithEnvelope(host, domain, pathAfterV1, method, body,
 async function fetchCapabilityGateway(host, domain, pathAfterV1, method = "GET", body, accept = "application/json") {
   const url = buildCapabilityGatewayUrl(host, domain, pathAfterV1);
   const token = await getCliToken(host);
-  let resp = await requestOnce(url, method, token, body, accept);
+  const resp = await requestOnce(url, method, token, body, accept);
   if (resp.status === 403) {
-    throw await permissionError(resp);
-  }
-  if (resp.status === 401) {
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestOnce(url, method, newToken, body, accept);
-    if (resp.status === 403) {
-      throw await permissionError(resp);
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
+    const error = await permissionError(resp);
+    if (isInvalidCliTokenMessage(error.message)) {
+      throw new SecureStoreAuthError(`${error.message} Run: ae-cli auth login`);
     }
-  } else if (!resp.ok) {
+    throw error;
+  }
+  if (!resp.ok) {
     await throwCapabilityHttpError(resp);
   }
   return resp;
@@ -243,8 +213,11 @@ async function requestCapabilityGatewayWithEnvelope(host, domain, pathAfterV1, m
   const resp = await fetchCapabilityGateway(host, domain, pathAfterV1, method, body);
   return parseCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
 }
-async function listCapabilities(host, domain, projectId) {
-  return callGateway(host, domain, "capabilities", "GET", void 0, { project_id: projectId });
+async function listCapabilitiesWithEnvelope(host, domain, projectId) {
+  return callGatewayWithEnvelope(host, domain, "capabilities", "GET", void 0, { project_id: projectId });
+}
+async function inspectCapabilityWithEnvelope(host, domain, capabilityId, projectId) {
+  return callGatewayWithEnvelope(host, domain, `capabilities/${capabilityId}`, "GET", void 0, { project_id: projectId });
 }
 async function inspectCapability(host, domain, capabilityId, projectId) {
   return callGateway(
@@ -265,6 +238,12 @@ async function executeCapabilityWithEnvelope(host, domain, capabilityId, input =
 async function dryRunCapability(host, domain, capabilityId, input = {}) {
   return callGateway(host, domain, `capabilities/${capabilityId}/dry-run`, "POST", { input });
 }
+async function dryRunCapabilityWithEnvelope(host, domain, capabilityId, input = {}) {
+  return callGatewayWithEnvelope(host, domain, `capabilities/${capabilityId}/dry-run`, "POST", { input });
+}
+async function validateCapabilityWithEnvelope(host, domain, capabilityId, input = {}) {
+  return callGatewayWithEnvelope(host, domain, `capabilities/${capabilityId}/validate`, "POST", { input });
+}
 async function validateCapability(host, domain, capabilityId, input = {}) {
   return callGateway(host, domain, `capabilities/${capabilityId}/validate`, "POST", { input });
 }
@@ -302,24 +281,15 @@ async function uploadInputFileBytes(host, domain, projectId, purpose, bytes, fil
   form.append("purpose", purpose);
   form.append("file", new Blob([fileBuffer], { type: contentType }), filename);
   const token = await getCliToken(host);
-  let resp = await requestMultipartOnce(url, token, form);
+  const resp = await requestMultipartOnce(url, token, form);
   if (resp.status === 403) {
-    throw await permissionError(resp);
-  }
-  if (resp.status === 401) {
-    logger.warn(`Capability gateway request failed (HTTP 401) for ${host}, refreshing CLI token`);
-    clearCliToken(host);
-    const newToken = await getCliToken(host);
-    process.stderr.write(`[ae-cli] CLI token refreshed for ${host}
-`);
-    resp = await requestMultipartOnce(url, newToken, form);
-    if (resp.status === 403) {
-      throw await permissionError(resp);
-    }
-    if (!resp.ok) {
-      await throwCapabilityHttpError(resp);
+    const error = await permissionError(resp);
+    if (isInvalidCliTokenMessage(error.message)) {
+      throw new SecureStoreAuthError(`${error.message} Run: ae-cli auth login`);
     }
-  } else if (!resp.ok) {
+    throw error;
+  }
+  if (!resp.ok) {
     await throwCapabilityHttpError(resp);
   }
   return unwrapCapabilityEnvelope(parseCapabilityResponse(await resp.text()));
@@ -338,11 +308,14 @@ export {
   fetchCapabilityGateway,
   requestCapabilityGateway,
   requestCapabilityGatewayWithEnvelope,
-  listCapabilities,
+  listCapabilitiesWithEnvelope,
+  inspectCapabilityWithEnvelope,
   inspectCapability,
   executeCapability,
   executeCapabilityWithEnvelope,
   dryRunCapability,
+  dryRunCapabilityWithEnvelope,
+  validateCapabilityWithEnvelope,
   validateCapability,
   uploadInputFile,
   uploadInputFileBytes,

package/dist/chunk-JOCDD4ON.js

@@ -0,0 +1,15 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  getActiveHost,
+  normalizeUrl
+} from "./chunk-7FTTULED.js";
+
+// src/core/auth.ts
+function resolveHost(hostOverride) {
+  if (hostOverride) return normalizeUrl(hostOverride);
+  return getActiveHost();
+}
+
+export {
+  resolveHost
+};

package/dist/{chunk-TKHSULJT.js → chunk-KPQY44JQ.js}

@@ -22,6 +22,11 @@ function findGatewayDomain(cliService) {
 function listRegisteredCapabilityDomains() {
   return [...cliServiceRoutes.keys()].sort();
 }
+function listCapabilityDiscoveryPrefixes(cliService) {
+  const route = cliServiceRoutes.get(cliService);
+  const rawPrefixes = route?.capabilityPrefixes?.length ? route.capabilityPrefixes : [cliService];
+  return [...new Set(rawPrefixes.map((prefix) => prefix.trim().toLowerCase()).filter(Boolean).map((prefix) => prefix.endsWith(".") ? prefix : `${prefix}.`))];
+}
 function resolveGatewayDomain(cliService, override) {
   const envDomain = envGatewayDomain(cliService);
   if (envDomain !== void 0) {
@@ -43,5 +48,6 @@ export {
   registerCapabilityGatewayRoute,
   findGatewayDomain,
   listRegisteredCapabilityDomains,
+  listCapabilityDiscoveryPrefixes,
   resolveGatewayDomain
 };

package/dist/{chunk-FR2EDAQM.js → chunk-MAPZ7VB6.js}

@@ -11,8 +11,24 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -30,6 +46,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/core/logger.ts
 import fs from "fs";
@@ -114,9 +131,80 @@ var Logger = class {
 };
 var logger = new Logger();
 
+// src/core/errors.ts
+var PermissionError = class extends Error {
+  constructor(message, code, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+    this.name = "PermissionError";
+  }
+  code;
+  hint;
+};
+var CliValidationError = class extends Error {
+  code;
+  hint;
+  location;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "CliValidationError";
+    this.code = options.code;
+    this.hint = options.hint;
+    if (options.location) {
+      const location = {};
+      if (typeof options.location.segment === "number" && Number.isFinite(options.location.segment)) {
+        location.segment = options.location.segment;
+      }
+      if (typeof options.location.record === "number" && Number.isFinite(options.location.record)) {
+        location.record = options.location.record;
+      }
+      if (typeof options.location.field === "string" && options.location.field.length > 0) {
+        location.field = options.location.field;
+      }
+      if (Object.keys(location).length > 0) this.location = location;
+    }
+  }
+};
+var CommunityReportError = class extends Error {
+  code;
+  httpStatus;
+  hint;
+  meta;
+  constructor(message, options = {}) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "CommunityReportError";
+    this.code = options.code;
+    this.httpStatus = options.httpStatus;
+    this.hint = options.hint;
+    this.meta = options.meta;
+  }
+};
+var LocalDataUploadError = class extends Error {
+  code;
+  httpStatus;
+  hint;
+  meta;
+  constructor(message, options = {}) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "LocalDataUploadError";
+    this.code = options.code;
+    this.httpStatus = options.httpStatus;
+    this.hint = options.hint;
+    this.meta = options.meta;
+  }
+};
+
 export {
   __require,
+  __esm,
   __commonJS,
+  __export,
   __toESM,
-  logger
+  __toCommonJS,
+  logger,
+  PermissionError,
+  CliValidationError,
+  CommunityReportError,
+  LocalDataUploadError
 };