@alphafox/cli 0.1.1 → 0.1.3

package/README.md

@@ -1,4 +1,4 @@
-# @alphafox/cli
+# alphafox-cli
 
 Alphafox CLI (`alphafox`) — Agent and human entry for the versioned Public Application API on alphafox-web.
 
@@ -7,7 +7,7 @@ Alphafox CLI (`alphafox`) — Agent and human entry for the versioned Public App
 ```bash
 npm install -g @alphafox/cli
 # or
-npx @alphafox/cli version
+npx alphafox-cli version
 ```
 
 ## Quick start

package/dist/http/client.js

@@ -50,13 +50,15 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
     if (!options.skipAuth) {
         const tokens = (0, store_1.loadTokens)(options.profile.name, env);
         if (tokens) {
-            // Never send tokens to a different origin than the profile audience.
+            // Never send tokens to a different site than the profile audience.
+            // Apex/www (and trailing host variants) of the same registrable domain
+            // are treated as equivalent so production domain redirects do not break CLI.
             const tokenAudienceOrigin = originOf(tokens.audience);
             const targetOrigin = originOf(url);
             if (tokens.audience &&
                 tokenAudienceOrigin &&
                 targetOrigin &&
-                tokenAudienceOrigin !== targetOrigin) {
+                !sameAuthSite(tokenAudienceOrigin, targetOrigin)) {
                 throw Object.assign(new Error("Refusing to send stored tokens to a different origin than token audience (fail-closed)."), {
                     status: 403,
                     type: "authorization",
@@ -72,12 +74,15 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
     const init = {
         method: options.method.toUpperCase(),
         headers,
+        // Follow redirects ourselves so Authorization is re-attached after apex→www.
+        // fetch()'s automatic redirect drops Authorization on cross-origin hops.
+        redirect: "manual",
     };
     if (options.body !== undefined) {
         headers["Content-Type"] = "application/json";
         init.body = JSON.stringify(options.body);
     }
-    const response = await fetchImpl(url, init);
+    const response = await fetchFollowingAuthRedirects(fetchImpl, url, init);
     const bodyText = await response.text();
     let json = null;
     try {
@@ -97,7 +102,44 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
         json,
     };
 }
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/**
+ * Re-issue requests on same-site redirects while keeping Authorization.
+ * Needed because alphafox.app → www.alphafox.app is a cross-origin hop for fetch.
+ */
+async function fetchFollowingAuthRedirects(fetchImpl, startUrl, init, maxHops = 5) {
+    let url = startUrl;
+    let method = (init.method ?? "GET").toUpperCase();
+    let body = init.body;
+    let response = await fetchImpl(url, { ...init, method, body, redirect: "manual" });
+    for (let hop = 0; hop < maxHops && REDIRECT_STATUSES.has(response.status); hop++) {
+        const location = response.headers.get("location");
+        if (!location) {
+            break;
+        }
+        const nextUrl = new URL(location, url).toString();
+        if (!sameAuthSite(originOf(url), originOf(nextUrl))) {
+            break;
+        }
+        // 303 switches to GET without body; 301/302 historically do for non-GET.
+        if (response.status === 303 ||
+            ((response.status === 301 || response.status === 302) && method !== "GET" && method !== "HEAD")) {
+            method = "GET";
+            body = undefined;
+        }
+        url = nextUrl;
+        response = await fetchImpl(url, {
+            ...init,
+            method,
+            body,
+            redirect: "manual",
+        });
+    }
+    return response;
+}
 function originOf(value) {
+    if (!value)
+        return null;
     try {
         if (value.startsWith("http://") || value.startsWith("https://")) {
             return new URL(value).origin;
@@ -108,3 +150,22 @@ function originOf(value) {
         return null;
     }
 }
+/** Apex and www hosts of the same site share auth tokens. */
+function sameAuthSite(a, b) {
+    if (!a || !b)
+        return false;
+    if (a === b)
+        return true;
+    try {
+        const ua = new URL(a);
+        const ub = new URL(b);
+        if (ua.protocol !== ub.protocol)
+            return false;
+        const ha = ua.hostname.replace(/^www\./i, "").toLowerCase();
+        const hb = ub.hostname.replace(/^www\./i, "").toLowerCase();
+        return ha === hb && ua.port === ub.port;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.1.0";
+export declare const CLI_VERSION = "0.1.2";
 export declare const CLI_CONTRACT_VERSION = "2026-08-11";

package/dist/version.js

@@ -3,5 +3,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.1.0";
+exports.CLI_VERSION = "0.1.2";
 exports.CLI_CONTRACT_VERSION = "2026-08-11";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Alphafox CLI \u2014 Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {