@thinkingai/ae-cli 6.1.27 → 6.1.29

package/dist/{auth-WA7YGGRT.js → auth-OBQ5KVQM.js}

@@ -1,4 +1,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  invalidateBusinessSkillSynchronization,
+  refreshEnvironmentAfterLogin
+} from "./chunk-6HAUVWOQ.js";
 import {
   MultiselectCancelled,
   promptSingleSelect
@@ -9,13 +13,15 @@ import {
 } from "./chunk-6ZIQV5GW.js";
 import {
   resolveHost
-} from "./chunk-OP44TT4H.js";
+} from "./chunk-IN7KKL6K.js";
 import {
-  getLocalCliPackageInfo,
   printError,
-  printOutput,
+  printOutput
+} from "./chunk-QZLRHGVH.js";
+import {
+  getLocalCliPackageInfo,
   runHostCompatCheck
-} from "./chunk-6VNIR4AP.js";
+} from "./chunk-2UW3Y463.js";
 import {
   CliTokenValidationUnavailableError,
   CredentialStoreUnreadableError,
@@ -31,25 +37,54 @@ import {
   saveCredential,
   updateCredentialMetadata,
   validateCliTokenOnServer
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-H3K5UGYC.js";
 import {
   getFallbackCliToken,
   loadConfig,
-  normalizeUrl,
   saveConfig
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-JNVVJ273.js";
 import {
+  ExternalCliTokenError,
   PermissionError,
-  logger
-} from "./chunk-WNGFSIOB.js";
+  logger,
+  normalizeUrl,
+  readExternalCliToken
+} from "./chunk-Z3Q2AEIN.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
+function deviceApiPath(protocol, action) {
+  return protocol === "uba" ? `/v1/ta/cli/auth/device/${action}` : `/api/auth/device/${action}`;
+}
+function ubaAuthorizationDenial(code) {
+  if (code === "CLI_ACCESS_DISABLED") return {
+    code,
+    message: "CLI access is disabled for this account.",
+    hint: "Contact your administrator."
+  };
+  if (code === "ACCOUNT_UNAVAILABLE") return {
+    code,
+    message: "This account is unavailable.",
+    hint: "Contact your administrator or sign in with an active account."
+  };
+  if (code === "ORIGIN_DENIED") return {
+    code,
+    message: "Authorization must be approved from the trusted platform page.",
+    hint: "Open the verification URL on the configured AE host and sign in there."
+  };
+  return {
+    code: "AUTHORIZATION_DENIED",
+    message: "Device authorization was denied.",
+    hint: "Check your account status with your administrator before requesting authorization again."
+  };
+}
 var DeviceFlowUnsupportedError = class extends Error {
-  constructor() {
+  constructor(httpStatus) {
     super("This AE server does not support device code login (it may be an older server version).");
+    this.httpStatus = httpStatus;
     this.name = "DeviceFlowUnsupportedError";
   }
+  httpStatus;
 };
 function looksLikeMissingEndpoint(status, contentType, body) {
   if (status === 404) return true;
@@ -83,29 +118,46 @@ function openBrowser(url, _execFile) {
     exec("xdg-open", [url], { timeout: 5e3 });
     return true;
   } catch (e) {
-    logger.warn(`openBrowser: failed to open ${safeLogUrl}: ${e.message}`);
+    logger.warn(`openBrowser: failed to open ${safeLogUrl}`);
     return false;
   }
 }
-async function authorizeDevice(host) {
+async function authorizeDevice(host, protocol = "legacy") {
   const base = host.replace(/\/+$/, "");
-  const url = `${base}/api/auth/device/authorize`;
+  const url = `${base}${deviceApiPath(protocol, "authorize")}`;
   let resp;
   try {
     resp = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" }
+      headers: {
+        "Content-Type": "application/json",
+        ...protocol === "uba" ? { "X-CLI-Verification-Origin": new URL(host).origin } : {}
+      },
+      redirect: "error",
+      signal: AbortSignal.timeout(1e4)
     });
   } catch (e) {
-    throw new Error(`Device authorize request failed: ${e.message}`);
+    throw new Error("Device authorize request failed. Check the AE host and network, then retry.");
   }
   const contentType = resp.headers.get("content-type");
   const text = await resp.text().catch(() => "");
   if (looksLikeMissingEndpoint(resp.status, contentType, text)) {
-    throw new DeviceFlowUnsupportedError();
+    throw new DeviceFlowUnsupportedError(resp.status);
   }
   if (!resp.ok) {
-    throw new Error(`Device authorize returned HTTP ${resp.status}: ${text}`);
+    if (resp.status === 403) {
+      if (protocol === "uba") {
+        let code;
+        try {
+          code = JSON.parse(text)?.code;
+        } catch {
+        }
+        const denial = ubaAuthorizationDenial(code);
+        throw new PermissionError(denial.message, denial.code, denial.hint);
+      }
+      throw new PermissionError("CLI authorization is not allowed.", "CLI_ACCESS_DISABLED", "Contact your administrator.");
+    }
+    throw new Error(`Device authorize returned HTTP ${resp.status}`);
   }
   let body;
   try {
@@ -113,23 +165,28 @@ async function authorizeDevice(host) {
   } catch {
     throw new Error("Device authorize returned invalid JSON");
   }
-  if (!body.device_code || !body.user_code) {
+  if (typeof body.device_code !== "string" || !body.device_code || typeof body.user_code !== "string" || !body.user_code) {
     throw new Error("Device authorize response missing required fields");
   }
+  if (protocol === "uba" && (!Number.isInteger(body.expires_in) || body.expires_in < 1 || body.expires_in > 300 || !Number.isInteger(body.interval) || body.interval < 1 || body.interval > body.expires_in)) {
+    throw new Error("UBA authorization returned invalid polling limits. Check the server deployment.");
+  }
   return body;
 }
-async function pollDeviceToken(host, deviceCode) {
+async function pollDeviceToken(host, deviceCode, protocol = "legacy") {
   const base = host.replace(/\/+$/, "");
-  const url = `${base}/api/auth/device/token`;
+  const url = `${base}${deviceApiPath(protocol, "token")}`;
   let resp;
   try {
     resp = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
+      body: JSON.stringify({ device_code: deviceCode }),
+      redirect: "error",
+      signal: AbortSignal.timeout(1e4)
     });
   } catch (e) {
-    return { status: "error", message: `Network error: ${e.message}` };
+    return { status: "error", message: "Network error while polling authorization." };
   }
   if (resp.status === 200) {
     let body;
@@ -138,7 +195,7 @@ async function pollDeviceToken(host, deviceCode) {
     } catch {
       return { status: "error", message: "Token response is not valid JSON" };
     }
-    if (!body.access_token) {
+    if (typeof body.access_token !== "string" || !body.access_token) {
       return { status: "error", message: "Token response missing access_token" };
     }
     return { status: "approved", tokens: body };
@@ -154,7 +211,13 @@ async function pollDeviceToken(host, deviceCode) {
     if (err === "authorization_pending") return { status: "pending" };
     if (err === "slow_down") return { status: "slow_down" };
     if (err === "expired_token") return { status: "expired" };
-    return { status: "error", message: `Unknown error: ${err ?? "unknown"}` };
+    if (err === "access_denied") return {
+      status: "denied",
+      code: "AUTHORIZATION_DENIED",
+      message: "Device authorization was denied.",
+      hint: "Run ae-cli auth login again only when you want to request authorization."
+    };
+    return { status: "error", message: "Token endpoint returned an unrecognized authorization error." };
   }
   if (resp.status === 403) {
     let errorBody = {};
@@ -162,6 +225,7 @@ async function pollDeviceToken(host, deviceCode) {
       errorBody = await resp.json();
     } catch {
     }
+    if (protocol === "uba") return { status: "denied", ...ubaAuthorizationDenial(errorBody.code) };
     return {
       status: "denied",
       code: errorBody.code ?? "CLI_ACCESS_DISABLED",
@@ -176,7 +240,10 @@ async function pollDeviceToken(host, deviceCode) {
   }
   return { status: "error", message: `Unexpected HTTP ${resp.status} from token endpoint` };
 }
-function buildVerificationUrl(host, userCode) {
+function buildVerificationUrl(host, userCode, protocol = "legacy") {
+  if (protocol === "uba") {
+    return `${host.replace(/\/+$/, "")}/#/cli/device-activate?user_code=${encodeURIComponent(userCode)}`;
+  }
   return `${host.replace(/\/+$/, "")}/device-activate?user_code=${encodeURIComponent(userCode)}`;
 }
 async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
@@ -190,7 +257,7 @@ async function pollDeviceFlow(host, deviceCode, options = {}, onStatus) {
   while (Date.now() < deadline) {
     await sleep(intervalMs);
     pollCount++;
-    const result = await pollDeviceToken(host, deviceCode);
+    const result = await pollDeviceToken(host, deviceCode, options.protocol);
     if (result.status === "approved") {
       emit(`Authorization successful! (polled ${pollCount} time(s))`);
       return result.tokens;
@@ -237,9 +304,9 @@ async function runDeviceFlow(host, options = {}, onStatus) {
     if (onStatus) onStatus(msg);
   };
   emit("Requesting authorization code from server...");
-  const auth = await authorizeDevice(host);
+  const auth = options.authorization ?? await authorizeDevice(host, options.protocol);
   const userCode = auth.user_code;
-  const verifyUrl = buildVerificationUrl(host, userCode);
+  const verifyUrl = buildVerificationUrl(host, userCode, options.protocol);
   const expiresIn = auth.expires_in ?? 300;
   emit("");
   emit(`Verification code: ${userCode}`);
@@ -255,21 +322,47 @@ async function runDeviceFlow(host, options = {}, onStatus) {
     }
     emit("");
   }
-  return pollDeviceFlow(host, auth.device_code, { intervalMs: (auth.interval ?? 5) * 1e3, expiresIn }, onStatus);
+  return pollDeviceFlow(host, auth.device_code, { intervalMs: (auth.interval ?? 5) * 1e3, expiresIn, protocol: options.protocol }, onStatus);
 }
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+// src/core/login-device-flow.ts
+function resolveLegacyLoginBase(host) {
+  const base = host.replace(/\/+$/, "");
+  const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
+  return base.endsWith(basePath) ? base : base + basePath;
+}
+function resolveDeviceSessionRoute(host, deviceCode) {
+  return deviceCode.startsWith("uba_") ? { baseUrl: host, protocol: "uba" } : { baseUrl: resolveLegacyLoginBase(host), protocol: "legacy" };
+}
+async function authorizeLoginDevice(host) {
+  try {
+    const authorization = await authorizeDevice(host, "uba");
+    if (!/^uba_[A-Za-z0-9_-]+$/.test(authorization.device_code)) {
+      throw new Error("UBA authorization returned an unsupported device-code format. Check the server deployment.");
+    }
+    return { baseUrl: host, protocol: "uba", authorization };
+  } catch (error) {
+    if (!(error instanceof DeviceFlowUnsupportedError) || error.httpStatus !== 404) throw error;
+    const baseUrl = resolveLegacyLoginBase(host);
+    return { baseUrl, protocol: "legacy", authorization: await authorizeDevice(baseUrl) };
+  }
+}
+
 // src/commands/auth.ts
 var HOST_OPTION_DESC = "Override active AE host URL (e.g., https://ta.thinkingdata.cn)";
+function shellArgument(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 function getExplicitAuthHostOverride(program, opts) {
   return opts.host || program.opts().host;
 }
 function resolveAuthHost(program, opts) {
   return resolveHost(getExplicitAuthHostOverride(program, opts));
 }
-async function validateExistingCliToken(host, cliToken) {
+async function validateExistingCliToken(host, cliToken, external = false) {
   try {
     return { valid: true, trusted: false, details: await validateCliTokenOnServer(host, cliToken) };
   } catch (error) {
@@ -286,7 +379,7 @@ async function validateExistingCliToken(host, cliToken) {
     printError(
       "auth",
       error.message,
-      `Run: ae-cli auth logout --host ${host}, then ae-cli auth login --host ${host}`
+      external ? "Replace the external CLI token with a valid token for this host." : `Run: ae-cli auth logout --host ${host}, then ae-cli auth login --host ${host}`
     );
     process.exitCode = 1;
     return { valid: false, trusted: false, details: {} };
@@ -349,6 +442,7 @@ function promptHiddenCliToken() {
   });
 }
 function activateHostAfterLogin(host, explicitHostOverride) {
+  invalidateBusinessSkillSynchronization();
   if (!explicitHostOverride) return;
   const normalized = normalizeUrl(host);
   const config = loadConfig();
@@ -426,12 +520,15 @@ async function switchActiveAccount(program, opts) {
     }
   }
   try {
+    invalidateBusinessSkillSynchronization();
     const selected = activateCredential(host, account);
     clearCliTokenCache(host);
+    const environment = await refreshEnvironmentAfterLogin(host);
     await printOutput({
       host,
       active: true,
-      account: accountOutput(selected.account)
+      account: accountOutput(selected.account),
+      ...environment ? { environment } : {}
     }, program.opts().format || "json");
   } catch (error) {
     if (error instanceof CredentialStoreUnreadableError) throw error;
@@ -455,6 +552,7 @@ async function persistDeviceTokens(host, tokens, options = {}) {
   }
   let saved;
   try {
+    invalidateBusinessSkillSynchronization();
     saved = saveCredential(host, {
       cliToken,
       ...validation.account ? { account: validation.account } : {},
@@ -473,6 +571,7 @@ async function persistManualCliToken(host, cliToken, options = {}) {
   const validation = await validateCliTokenOnServer(host, cliToken);
   let saved;
   try {
+    invalidateBusinessSkillSynchronization();
     saved = saveCredential(host, {
       cliToken,
       ...validation.account ? { account: validation.account } : {},
@@ -506,12 +605,16 @@ function manualTokenSummary(host, credential) {
   };
 }
 function resolveLoginTeClaudeBase(host) {
-  const base = host.replace(/\/+$/, "");
-  const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
-  return base.endsWith(basePath) ? base : base + basePath;
+  return resolveLegacyLoginBase(host);
 }
 function registerAuth(program) {
   const auth = program.command("auth").description("Manage authentication or switch the active account interactively").hook("preAction", (_command, actionCommand) => {
+    if (["auth", "login", "set-token", "use", "logout"].includes(actionCommand.name()) && readExternalCliToken()) {
+      throw new ExternalCliTokenError(
+        "Stored-account changes are unavailable while an external CLI token is selected.",
+        "EXTERNAL_CLI_TOKEN_ACTIVE"
+      );
+    }
     if (["login", "set-token"].includes(actionCommand.name())) {
       const host = resolveAuthHost(program, actionCommand.opts());
       if (host) assertCredentialsReadable(host);
@@ -536,36 +639,43 @@ function registerAuth(program) {
     }
     const noBrowser = !opts.browser;
     const format = program.opts().format || "json";
-    const teClaudeBase = resolveLoginTeClaudeBase(host);
     const emit = (message) => process.stderr.write(`[ae-cli] ${message}
 `);
     try {
       if (opts.deviceCode) {
-        const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
+        const route = resolveDeviceSessionRoute(host, opts.deviceCode);
+        const tokens2 = await pollDeviceFlow(route.baseUrl, opts.deviceCode, { protocol: route.protocol }, emit);
         const saved2 = await persistDeviceTokens(host, tokens2, { add: opts.add });
         activateHostAfterLogin(host, explicitHost);
+        const environment2 = await refreshEnvironmentAfterLogin(host);
         emit("Login successful! CLI token saved securely.");
-        await printOutput(loginSummary(host, saved2), format);
+        await printOutput({ ...loginSummary(host, saved2), ...environment2 ? { environment: environment2 } : {} }, format);
         return;
       }
+      const session = await authorizeLoginDevice(host);
+      const authResp = session.authorization;
       if (opts.wait === false) {
-        const authResp = await authorizeDevice(teClaudeBase);
         const addFlag = opts.add ? " --add" : "";
         await printOutput({
           device_code: authResp.device_code,
           user_code: authResp.user_code,
-          verification_url: buildVerificationUrl(teClaudeBase, authResp.user_code),
+          verification_url: buildVerificationUrl(session.baseUrl, authResp.user_code, session.protocol),
           interval: authResp.interval,
           expires_in: authResp.expires_in,
-          next: `Open verification_url in a browser to authorize, then run: ae-cli auth login${addFlag} --device-code ${authResp.device_code}`
+          next: `Open verification_url in a browser to authorize, then run: ae-cli auth login${addFlag} --host ${shellArgument(host)} --device-code ${shellArgument(authResp.device_code)}`
         }, format);
         return;
       }
-      const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
+      const tokens = await runDeviceFlow(session.baseUrl, {
+        noBrowser,
+        protocol: session.protocol,
+        authorization: authResp
+      }, emit);
       const saved = await persistDeviceTokens(host, tokens, { add: opts.add });
       activateHostAfterLogin(host, explicitHost);
+      const environment = await refreshEnvironmentAfterLogin(host);
       emit("Login successful! CLI token saved securely.");
-      await printOutput(loginSummary(host, saved), format);
+      await printOutput({ ...loginSummary(host, saved), ...environment ? { environment } : {} }, format);
     } catch (error) {
       if (error instanceof CredentialStoreUnreadableError) throw error;
       if (error instanceof DeviceFlowUnsupportedError) {
@@ -608,9 +718,10 @@ function registerAuth(program) {
     try {
       const saved = await persistManualCliToken(host, cliToken, { add: opts.add });
       activateHostAfterLogin(host, explicitHost);
+      const environment = await refreshEnvironmentAfterLogin(host);
       process.stderr.write(`[ae-cli] CLI token verified and saved securely for ${host}
 `);
-      await printOutput(manualTokenSummary(host, saved), program.opts().format || "json");
+      await printOutput({ ...manualTokenSummary(host, saved), ...environment ? { environment } : {} }, program.opts().format || "json");
     } catch (error) {
       if (error instanceof CredentialStoreUnreadableError) throw error;
       if (error instanceof PermissionError) {
@@ -644,6 +755,22 @@ function registerAuth(program) {
       }, program.opts().format || "json");
       return;
     }
+    const external = readExternalCliToken(host);
+    if (external) {
+      const state = await validateExistingCliToken(host, external.token, true);
+      if (!state.valid) return;
+      await printOutput({
+        authenticated: true,
+        host,
+        source: external.source,
+        cli_token: {
+          status: state.trusted ? "trusted" : "valid",
+          ...state.details.cliTokenExpiresAt ? { expires_at: state.details.cliTokenExpiresAt } : {}
+        },
+        ...state.details.account ? { account: accountOutput(state.details.account) } : {}
+      }, program.opts().format || "json");
+      return;
+    }
     const active = getActiveCredential(host);
     if (active) {
       const state = await validateExistingCliToken(host, active.cliToken);
@@ -706,18 +833,21 @@ function registerAuth(program) {
       process.exit(1);
     }
     clearCliTokenCache(host);
+    invalidateBusinessSkillSynchronization();
     if (opts.all) {
       clearAllCredentials(host);
       await printOutput({ cleared: true, all: true, host }, program.opts().format || "json");
       return;
     }
     const result = removeActiveCredential(host);
+    const environment = result.active ? await refreshEnvironmentAfterLogin(host) : void 0;
     await printOutput({
       cleared: !!result.removed,
       all: false,
       host,
       remaining_accounts: listCredentials(host).length,
-      ...result.active?.account ? { active_account: accountOutput(result.active.account) } : {}
+      ...result.active?.account ? { active_account: accountOutput(result.active.account) } : {},
+      ...environment ? { environment } : {}
     }, program.opts().format || "json");
   });
 }