@thinkingai/ae-cli 6.1.27 → 6.1.29

package/dist/{chunk-3YVEAZUN.js → chunk-RJHGDWSC.js}

@@ -4,15 +4,17 @@ import {
 } from "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-GHXZK54S.js";
+} from "./chunk-H3K5UGYC.js";
 import {
   getActiveHost,
   getSandboxRuntimeRoot
-} from "./chunk-ZL7SGNIA.js";
+} from "./chunk-JNVVJ273.js";
 import {
   PermissionError,
-  isApiErrorType
-} from "./chunk-WNGFSIOB.js";
+  externalCliTokenRequestOptions,
+  isApiErrorType,
+  readExternalCliToken
+} from "./chunk-Z3Q2AEIN.js";
 
 // src/core/te-agent-credentials.ts
 import { readFileSync } from "fs";
@@ -153,7 +155,7 @@ async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await fetch(url, { ...init, signal: controller.signal });
+    return await fetch(url, { ...init, signal: controller.signal, ...externalCliTokenRequestOptions(url) });
   } catch (err) {
     if (err?.name === "AbortError") {
       throw new TeAgentApiError(
@@ -197,7 +199,8 @@ function teClaudeBaseFromActiveHost(hostOverride) {
   if (!h) return void 0;
   return resolveTeClaudeBaseUrl(h);
 }
-async function signRequest(method, path2, hostOverride, includeJsonContentType = true) {
+async function signRequest(method, path2, hostOverride, includeJsonContentType = true, authMode = "auto") {
+  const external = readExternalCliToken(hostOverride);
   const configuredHost = hostOverride || getActiveHost();
   const sandboxOnly = !hostOverride && (/* @__PURE__ */ new Set([
     "/api/sandbox/models",
@@ -207,8 +210,8 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
     "/api/sandbox/sync/pull",
     "/api/sandbox/sync/pull/candidates"
   ])).has(path2.split("?")[0]);
-  const sandboxCred = configuredHost && !sandboxOnly ? null : tryLoadTeAgentSandboxCredentials();
-  if (!hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
+  const sandboxCred = external || configuredHost && !sandboxOnly ? null : tryLoadTeAgentSandboxCredentials();
+  if (authMode === "auto" && !hostOverride && sandboxCred && sandboxCred.sandboxId && sandboxCred.sandboxSecretKey) {
     const headers = {
       "X-Sandbox-Id": sandboxCred.sandboxId,
       "X-Sandbox-Secret-Key": sandboxCred.sandboxSecretKey
@@ -222,7 +225,7 @@ async function signRequest(method, path2, hostOverride, includeJsonContentType =
       authKind: "sandbox"
     };
   }
-  const baseUrl = hostOverride ? teClaudeBaseFromActiveHost(hostOverride) : sandboxCred?.url || teClaudeBaseFromActiveHost();
+  const baseUrl = hostOverride || external ? teClaudeBaseFromActiveHost(hostOverride || external?.url) : sandboxCred?.url || teClaudeBaseFromActiveHost();
   if (!baseUrl) {
     throw new TeAgentCredentialsError(
       "Cannot determine the te-claude service URL",
@@ -248,13 +251,14 @@ async function fetchSigned(options) {
     options.method,
     options.path,
     options.hostOverride,
-    options.includeJsonContentType
+    options.includeJsonContentType,
+    options.authMode
   );
   return fetchWithTimeout(
     signed.url,
     {
       method: options.method,
-      headers: signed.headers,
+      headers: { ...Object.fromEntries(new Headers(options.headers).entries()), ...signed.headers },
       body: options.body
     },
     options.timeoutMs
@@ -263,7 +267,7 @@ async function fetchSigned(options) {
 function errorDetails(parsed, defaultErrorPrefix, status) {
   const nested = parsed && typeof parsed === "object" && parsed.error && typeof parsed.error === "object" ? parsed.error : parsed;
   const message = typeof parsed?.error === "string" ? parsed.error : typeof nested?.message === "string" ? nested.message : typeof parsed?.message === "string" ? parsed.message : typeof parsed?.return_message === "string" ? parsed.return_message : `${defaultErrorPrefix} ${status}`;
-  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : void 0;
+  const code = typeof nested?.code === "string" ? nested.code : typeof parsed?.code === "string" ? parsed.code : typeof parsed?.errorCode === "string" ? parsed.errorCode : void 0;
   const hint = typeof nested?.hint === "string" ? nested.hint : typeof parsed?.hint === "string" ? parsed.hint : void 0;
   const declaredType = isApiErrorType(nested?.type) ? nested.type : void 0;
   const type = status === 401 ? "auth" : status === 403 ? "permission" : declaredType ?? ([400, 413, 422].includes(status) ? "validation" : status === 404 ? "not_found" : "api");
@@ -303,21 +307,23 @@ async function parseResponse(response, defaultErrorPrefix) {
   }
   return parsed;
 }
-async function postToMainApp(path2, body, hostOverride) {
+async function postToMainApp(path2, body, hostOverride, authMode = "auto") {
   const rawBody = JSON.stringify(body);
   const response = await fetchSigned({
     method: "POST",
     path: path2,
     body: rawBody,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
-async function getFromMainApp(path2, hostOverride) {
+async function getFromMainApp(path2, hostOverride, authMode = "auto") {
   const response = await fetchSigned({
     method: "GET",
     path: path2,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
@@ -347,21 +353,23 @@ async function postSandboxSyncPull(args) {
     mode: "merge"
   });
 }
-async function deleteFromMainApp(path2, hostOverride) {
+async function deleteFromMainApp(path2, hostOverride, authMode = "auto") {
   const response = await fetchSigned({
     method: "DELETE",
     path: path2,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
-async function patchToMainApp(path2, body, hostOverride) {
+async function patchToMainApp(path2, body, hostOverride, authMode = "auto") {
   const rawBody = JSON.stringify(body);
   const response = await fetchSigned({
     method: "PATCH",
     path: path2,
     body: rawBody,
-    hostOverride
+    hostOverride,
+    authMode
   });
   return parseResponse(response, "Main app returned");
 }
@@ -447,7 +455,8 @@ async function downloadFromMainApp(requestPath, outputPath, hostOverride) {
         return await fetch(requestToSend.url, {
           method: "GET",
           headers: requestToSend.headers,
-          signal: controller.signal
+          signal: controller.signal,
+          ...externalCliTokenRequestOptions(requestToSend.url)
         });
       } catch (error) {
         if (error?.name === "AbortError") {
@@ -519,7 +528,9 @@ export {
   getClaudeConfigDir,
   resolveTeClaudeBaseUrl,
   TeAgentApiError,
+  fetchSigned,
   createTeAgentApiError,
+  parseResponse,
   postToMainApp,
   getFromMainApp,
   getSandboxModels,

package/dist/{chunk-MWIA43UJ.js → chunk-VCZE3IWO.js}

@@ -1,18 +1,21 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  dryRunCapability,
-  executeCapabilityWithEnvelope,
-  validateCapability
-} from "./chunk-VZZNLV3I.js";
 import {
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
 import {
   withOutputMetadata
-} from "./chunk-6VNIR4AP.js";
+} from "./chunk-QZLRHGVH.js";
+import {
+  dryRunCapability,
+  executeCapabilityWithEnvelope,
+  validateCapability
+} from "./chunk-3SDHJOCR.js";
 import {
   CliValidationError
-} from "./chunk-WNGFSIOB.js";
+} from "./chunk-Z3Q2AEIN.js";
+
+// src/core/capability-command.ts
+import { randomBytes } from "crypto";
 
 // src/core/definition-intent.ts
 import { createHash } from "crypto";
@@ -83,7 +86,6 @@ function isRecord(value) {
 }
 
 // src/core/capability-command.ts
-import { randomBytes } from "crypto";
 function createCapabilityCommand(config) {
   return {
     service: config.cliService,

package/dist/chunk-YVG6QD3V.js

@@ -0,0 +1,233 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  CliValidationError,
+  logger
+} from "./chunk-Z3Q2AEIN.js";
+
+// src/core/eval-endpoint.ts
+function resolveEvaluationHost(host) {
+  let endpoint;
+  try {
+    endpoint = new URL(host);
+    if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || /[?#\s]/.test(host)) throw new Error();
+  } catch {
+    throw new CliValidationError("Evaluation AE Host must be an absolute HTTP(S) URL without credentials, query, or fragment.", {
+      code: "EVAL_ENDPOINT_INVALID"
+    });
+  }
+  const hostname = endpoint.hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  const mappedIpv4 = /^::ffff:([0-9a-f]+):[0-9a-f]+$/.exec(hostname);
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "::" || hostname === "0.0.0.0" || hostname.startsWith("127.") || mappedIpv4 && parseInt(mappedIpv4[1], 16) >> 8 === 127 || hostname === "::ffff:0:0") {
+    throw new CliValidationError("Loopback evaluation endpoints are unsupported.", {
+      code: "EVAL_ENDPOINT_LOOPBACK_UNSUPPORTED",
+      hint: "Select an online AE Host with --host."
+    });
+  }
+  if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:") {
+    throw new CliValidationError("Evaluation AE Host must use HTTP or HTTPS.", {
+      code: "EVAL_ENDPOINT_INVALID"
+    });
+  }
+  return endpoint.toString().replace(/\/+$/, "").replace(/\/agent$/, "");
+}
+
+// src/core/eval-client.ts
+import { open, unlink } from "fs/promises";
+import { resolve } from "path";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var EvalApiError = class extends Error {
+  code;
+  httpStatus;
+  hint;
+  details;
+  constructor(message, options) {
+    const redact = evaluationErrorRedactor([
+      ...options.sensitiveValues ?? [],
+      process.env.AE_EVAL_ACCESS_TOKEN ?? ""
+    ]);
+    super(redact(message));
+    this.name = "EvalApiError";
+    this.code = options.code;
+    this.httpStatus = options.httpStatus;
+    this.hint = options.hint === void 0 ? void 0 : redact(options.hint);
+    this.details = options.details === void 0 ? void 0 : redact(options.details);
+  }
+};
+function evaluationErrorRedactor(secrets) {
+  const forms = [...new Set(secrets.filter(Boolean).flatMap((secret) => [
+    secret,
+    JSON.stringify(secret).slice(1, -1),
+    encodeURIComponent(secret)
+  ]))].sort((a, b) => b.length - a.length);
+  const redact = (value) => {
+    if (typeof value === "string") {
+      for (const secret of forms) value = value.split(secret).join("[REDACTED]");
+      return value;
+    }
+    if (Array.isArray(value)) return value.map(redact);
+    if (value && typeof value === "object") {
+      return Object.fromEntries(Object.entries(value).map(([key, item]) => [redact(key), redact(item)]));
+    }
+    return value;
+  };
+  return redact;
+}
+async function evalRequest(options) {
+  const url = buildEvalUrl(options.baseUrl, options.path, options.params);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  const headers = {
+    ...options.headers,
+    Accept: options.responseType === "bytes" ? "application/octet-stream, application/json" : "application/json"
+  };
+  const isMultipart = options.body instanceof FormData;
+  if (options.body !== void 0 && !isMultipart) {
+    headers["Content-Type"] = "application/json";
+  }
+  if (options.idempotencyKey) {
+    headers["Idempotency-Key"] = options.idempotencyKey;
+  }
+  let response;
+  let responseText = "";
+  let bytes;
+  try {
+    response = await fetchImpl(url, {
+      method: options.method,
+      headers,
+      body: options.body === void 0 ? void 0 : options.body instanceof FormData ? options.body : JSON.stringify(options.body),
+      redirect: "error",
+      signal: controller.signal
+    });
+    if (response.ok && options.responseType === "bytes") {
+      bytes = new Uint8Array(await response.arrayBuffer());
+    } else {
+      responseText = await response.text();
+    }
+  } catch (error) {
+    const timedOut = controller.signal.aborted || error instanceof Error && error.name === "AbortError";
+    logEvalRequest(options.method, url, response?.status ?? "unavailable");
+    if (timedOut) {
+      throw new EvalApiError(`Evaluation API request timed out after ${timeoutMs} ms.`, {
+        code: "EVAL_API_TIMEOUT",
+        httpStatus: 0,
+        hint: "Verify the evaluation platform is reachable at the configured endpoint."
+      });
+    }
+    throw new EvalApiError("Evaluation API request failed before a response was received.", {
+      code: "EVAL_API_NETWORK_ERROR",
+      httpStatus: 0,
+      hint: "Verify the --endpoint URL and network path."
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+  logEvalRequest(options.method, url, response.status);
+  if (bytes !== void 0) return bytes;
+  const responseBody = parseEvalResponseBody(responseText, response.status);
+  if (!response.ok) {
+    const sensitiveValues = Object.values(options.headers).flatMap((value) => [value, value.replace(/^Bearer\s+/i, "")]);
+    if (isRecord(options.body)) {
+      for (const key of ["secret", "data_token", "report_source"]) {
+        if (typeof options.body[key] === "string") sensitiveValues.push(options.body[key]);
+      }
+    }
+    throw evalErrorFromBody(responseBody, response.status, sensitiveValues);
+  }
+  return responseBody;
+}
+async function evalDownloadFile(options, outputPath) {
+  const path = resolve(outputPath);
+  let file;
+  try {
+    file = await open(path, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      throw new CliValidationError("Output file already exists; choose a new --output path.", {
+        code: "EVAL_OUTPUT_EXISTS"
+      });
+    }
+    throw error;
+  }
+  let completed = false;
+  try {
+    const bytes = await evalRequest({ ...options, responseType: "bytes" });
+    await file.writeFile(bytes);
+    completed = true;
+    return { path, byte_size: bytes.byteLength };
+  } finally {
+    await file.close();
+    if (!completed) await unlink(path);
+  }
+}
+function buildEvalUrl(baseUrl, path, params) {
+  const base = resolveEvaluationHost(baseUrl);
+  const url = new URL(`${base}${path}`);
+  if (params) {
+    for (const [key, value] of Object.entries(params)) {
+      if (value === void 0 || value === null || value === "") continue;
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function parseEvalResponseBody(text, httpStatus) {
+  if (!text.trim()) {
+    if (httpStatus === 204) return void 0;
+    throw new EvalApiError("Evaluation API returned an empty response body.", {
+      code: "EVAL_API_INVALID_RESPONSE",
+      httpStatus
+    });
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new EvalApiError("Evaluation API returned a non-JSON response body.", {
+      code: "EVAL_API_INVALID_RESPONSE",
+      httpStatus
+    });
+  }
+}
+function evalErrorFromBody(body, httpStatus, sensitiveValues) {
+  const error = body?.error;
+  if (isRecord(error) && typeof error.message === "string" && error.message.trim()) {
+    return new EvalApiError(error.message.trim(), {
+      code: typeof error.code === "string" && /^[A-Z][A-Z0-9_]{0,127}$/.test(error.code) ? error.code : `EVAL_API_HTTP_${httpStatus}`,
+      httpStatus,
+      hint: typeof error.details === "string" ? error.details : void 0,
+      details: isRecord(error.details) ? error.details : void 0,
+      sensitiveValues
+    });
+  }
+  return new EvalApiError(`Evaluation API returned HTTP ${httpStatus}.`, {
+    code: `EVAL_API_HTTP_${httpStatus}`,
+    httpStatus,
+    hint: httpStatus >= 500 ? "The server response was suppressed. Check the evaluation platform logs; the CLI did not retry." : void 0
+  });
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function logEvalRequest(method, url, status) {
+  logger.info(`EVAL ${method} ${redactEvalLogUrl(url)} status=${status}`);
+}
+function redactEvalLogUrl(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return "[invalid evaluation URL]";
+  }
+}
+
+export {
+  resolveEvaluationHost,
+  EvalApiError,
+  evalRequest,
+  evalDownloadFile
+};